daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update and rename miscellaneous/crypto-mining-malware.yaml to http/miscellaneous/crypto-mining-malware.yaml

patch-10
Dhiyaneshwaran 2023-05-11 01:14:44 +05:30 committed by GitHub
parent 7bc198d3ae
commit 5acbe618fe
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
miscellaneous/crypto-mining-malware.yaml → http/miscellaneous/crypto-mining-malware.yaml
View File

@ -1,14 +1,16 @@
id: crypto-mining-malware id: crypto-mining-malware
info: info:
name: Check for crypto-mining malware name: Crypto Mining Malware
author: geeknik author: geeknik
severity: info severity: info
description: Checks websites for crypto-mining malware. description: |
reference: https://github.com/xd4rker/MinerBlock/blob/master/assets/filters.txt Checks websites for crypto-mining malware.
tags: malware,crypto,mining reference:
- https://github.com/xd4rker/MinerBlock/blob/master/assets/filters.txt
tags: malware,crypto,mining,misc
requests: http:
- method: GET - method: GET
path: path:
- "{{BaseURL}}" - "{{BaseURL}}"
@ -18,13 +20,13 @@ requests:
matchers: matchers:
- type: regex - type: regex
part: body part: body
condition: or
regex: regex:
- '(?mi)cryptonight\.wasm|deepMiner|proxy\=ws|coinhive\.min\.js|wpupdates\.github\.io\/ping|cryptonight\.asm\.js|coin-hive\.com|jsecoin\.com|cryptoloot\.pro' - '(?mi)cryptonight\.wasm|deepMiner|proxy\=ws|coinhive\.min\.js|wpupdates\.github\.io\/ping|cryptonight\.asm\.js|coin-hive\.com|jsecoin\.com|cryptoloot\.pro'
- '(?mi)webassembly\.stream|monero\-miner|wasmminer|cn\-asmjs\.min\.js|aj(\-?)cryptominer|wp\-monero\-miner\-pro|crlt\.js|pool\/direct\.js|n\.2\.1\.(js|l.*)' - '(?mi)webassembly\.stream|monero\-miner|wasmminer|cn\-asmjs\.min\.js|aj(\-?)cryptominer|wp\-monero\-miner\-pro|crlt\.js|pool\/direct\.js|n\.2\.1\.(js|l.*)'
- '(?mi)ppoi\.org|xmrstudio|webmine\.pro|miner\.start|allfontshere\.press|upgraderservices\.cf|vuuwd\.com|gridcash\.js|worker\-asmjs\.min\.js|perfekt\=wss\:' - '(?mi)ppoi\.org|xmrstudio|webmine\.pro|miner\.start|allfontshere\.press|upgraderservices\.cf|vuuwd\.com|gridcash\.js|worker\-asmjs\.min\.js|perfekt\=wss\:'
- '(?mi)coin\-hive\.com|coinhive|CoinHive|var\ miner|miner\.start|me0w\.js|web(x?)mr(4?)\.js|miner\.js|static\/js\/tpb\.js|lib\/crypta\.js' - '(?mi)coin\-hive\.com|coinhive|CoinHive|var\ miner|miner\.start|me0w\.js|web(x?)mr(4?)\.js|miner\.js|static\/js\/tpb\.js|lib\/crypta\.js'
- '(?mi)bitrix\/js\/main\/core\/core\_(tasker|loader)\.js' - '(?mi)bitrix\/js\/main\/core\/core\_(tasker|loader)\.js'
condition: or
- type: word - type: word
part: header part: header
@ -33,8 +35,8 @@ requests:
- type: word - type: word
part: body part: body
condition: or
negative: true
words: words:
- "<title>Access Denied</title>" - "<title>Access Denied</title>"
- "You don't have permission to access" - "You don't have permission to access"
condition: or
negative: true