Miscellaneous template updates

2022-01-28 15:54:49 +05:30 · 2022-01-28 15:54:49 +05:30 · 614fc901d1
parent cb2f2a8721
commit 614fc901d1
15 changed files with 33 additions and 68 deletions
--- a/.nuclei-ignore
+++ b/.nuclei-ignore
@ -10,7 +10,6 @@
 tags:
  - "fuzz"
  - "dos"
-  - "misc"

 # files is a list of files to ignore template execution
 # unless asked for by the user.
--- a/miscellaneous/addeventlistener-detect.yaml
+++ b/miscellaneous/addeventlistener-detect.yaml
@ -4,7 +4,7 @@ info:
  name: AddEventlistener detection
  author: yavolo
  severity: info
-  tags: xss
+  tags: xss,misc
  reference: https://portswigger.net/web-security/dom-based/controlling-the-web-message-source

 requests:
@ -14,6 +14,6 @@ requests:

    matchers:
      - type: word
+        part: body
        words:
          - 'window.addEventListener('
-        part: body
--- a/miscellaneous/apple-app-site-association.yaml
+++ b/miscellaneous/apple-app-site-association.yaml
@ -4,7 +4,7 @@ info:
  name: Apple app site association for harvesting end points
  author: panch0r3d
  severity: info
-  tags: misc
+  tags: misc,apple

 requests:
  - method: GET
@ -17,17 +17,17 @@ requests:
    matchers-condition: and
    matchers:
      - type: word
+        part: body
        words:
          - 'applinks'
          - 'appID'
          - 'paths'
-        part: body
        condition: and

      - type: word
+        part: header
        words:
          - 'application/json'
-        part: header

      - type: status
        status:
--- a/miscellaneous/dir-listing.yaml
+++ b/miscellaneous/dir-listing.yaml
@ -11,6 +11,7 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}"
+
    matchers:
      - type: word
        words:
@ -18,3 +19,4 @@ requests:
          - "Index of /"
          - "[To Parent Directory]"
          - "Directory: /"
+        condition: or
--- a/miscellaneous/display-via-header.yaml
+++ b/miscellaneous/display-via-header.yaml
@ -1,20 +0,0 @@
-id: display-via-header
-
-info:
-  name: Display Via Header
-  author: geeknik
-  reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Via
-  severity: info
-  tags: misc,generic
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}"
-
-    redirects: true
-    extractors:
-      - type: regex
-        part: header
-        regex:
-          - "Via:.*"
--- a/miscellaneous/joomla-htaccess.yaml
+++ b/miscellaneous/joomla-htaccess.yaml
@ -16,14 +16,14 @@ requests:
    matchers:
      - type: word
        words:
-          - "# @package    Joomla"
+          - "Joomla"
          - "Open Source Matters. All rights reserved"
        condition: and

      - type: word
+        part: header
        words:
          - "text/plain"
-        part: header

      - type: status
        status:
--- a/miscellaneous/joomla-manifest-file.yaml
+++ b/miscellaneous/joomla-manifest-file.yaml
@ -21,9 +21,9 @@ requests:
        condition: and

      - type: word
+        part: header
        words:
          - "application/xml"
-        part: header

      - type: status
        status:
--- a/miscellaneous/moodle-changelog.yaml
+++ b/miscellaneous/moodle-changelog.yaml
@ -22,9 +22,9 @@ requests:
        condition: and

      - type: word
+        part: header
        words:
          - "text/plain"
-        part: header

      - type: status
        status:
--- a/miscellaneous/ntlm-directories.yaml
+++ b/miscellaneous/ntlm-directories.yaml
@ -14,7 +14,7 @@ requests:
        Host: {{Hostname}}
        Authorization: NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=

-    threads: 50
+    threads: 10
    payloads:
      path:
        - /
--- a/miscellaneous/old-copyright.yaml
+++ b/miscellaneous/old-copyright.yaml
@ -16,9 +16,9 @@ requests:
    matchers-condition: and
    matchers:
      - type: word
+        part: body
        words:
          - '2022'
-        part: body
        negative: true

      - type: regex
@ -28,10 +28,10 @@ requests:
          - '© [1-9]\d*'
          - '&copy; [1-9]\d*'
          - '&#169; [1-9]\d*'
+
    extractors:
      - type: regex
        part: body
-        name: copyright_year
        regex:
          - 'Copyright [1-9]\d*'
          - '© [1-9]\d*'
--- a/miscellaneous/detect-options-method.yaml
+++ b/miscellaneous/detect-options-method.yaml
@ -1,7 +1,7 @@
-id: detect-options-method
+id: options-method

 info:
-  name: Detect enabled OPTIONS methods
+  name: Allowed Options Method
  author: pdteam
  severity: info
  tags: misc,generic
--- a/miscellaneous/robots-txt.yaml
+++ b/miscellaneous/robots-txt.yaml
@ -9,6 +9,7 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/robots.txt"
+
    matchers-condition: and
    redirects: true
    matchers:
@ -17,9 +18,9 @@ requests:
          - "Disallow:"

      - type: word
+        part: header
        words:
          - text/plain
-        part: header

      - type: dsl
        dsl:
--- a/miscellaneous/security-txt.yaml
+++ b/miscellaneous/security-txt.yaml
@ -10,20 +10,28 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/.well-known/security.txt"
-      - "{{BaseURL}}/security.txt"
+      - "{{RootURL}}/.well-known/security.txt"
+      - "{{RootURL}}/security.txt"
+
+    stop-at-first-match: true
    redirects: true
-    max-redirects: 3
+    max-redirects: 2
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
+
      - type: word
        words:
          - "Contact:"
-        condition: and
+
      - type: dsl
        dsl:
          - "len(body) <= 1024 && len(body) > 0"
-        condition: and
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - '(?mi)Contact:(.*)'
--- a/miscellaneous/tabnabbing-check.yaml
+++ b/miscellaneous/tabnabbing-check.yaml
@ -1,25 +0,0 @@
-id: tabnabbing-check
-
-info:
-  name: Reverse Tabnabbing
-  author: bolli95
-  severity: info
-  tags: misc
-  reference:
-    - https://owasp.org/www-community/attacks/Reverse_Tabnabbing
-    - https://www.youtube.com/watch?v=TMKZCHYmtD4
-    - https://hackerone.com/reports/211065
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}"
-
-    matchers-condition: and
-    matchers:
-      - type: dsl
-        dsl:
-          - 'regex("<a[A-z0-9\/\"\&\=\%\#\.\:\_\@\\\$ ]*target\=\"_blank\"[A-z0-9\/\"\&\%\=\#\.\:\_\@\\\$ ]*>", replace_regex(replace_regex(body, "<a[A-z0-9\/\"\&\=\%\#\.\:\_\@\\\$ ]*target\=\"_blank\"[A-z0-9\/\"\&\%\=\#\.\:\_\@\\\$ ]*(rel=\"noopener noreferrer\"|rel=\"noreferrer noopener\"|rel=\"noreferrer\"|rel=\"noopener\")[A-z0-9\/\"\&\%\=\#\.\:\_\@\\\$ ]*>", ""), "<a[A-z0-9\/\"\&\=\%\#\.\:\_\@\\\$ ]*(rel=\"noopener noreferrer\"|rel=\"noreferrer noopener\"|rel=\"noreferrer\"|rel=\"noopener\")[A-z0-9\/\"\&\%\=\#\.\:\_\@\\\$ ]*target\=\"_blank\"[A-z0-9\/\"\&\%\=\#\.\:\_\@\\\$ ]*>", "")) || regex("window\.open\\([^,]+\\)", body)'
-      - type: dsl
-        dsl:
-          - "!contains(tolower(all_headers), 'referrer-policy: no-referrer')"
--- a/miscellaneous/trace-method.yaml
+++ b/miscellaneous/trace-method.yaml
@ -15,9 +15,9 @@ requests:
    matchers:
      - type: word
        name: trace-request
+        part: body
        words:
          - "TRACE / HTTP"
-        part: body

  - method: OPTIONS
    path:
@ -26,6 +26,6 @@ requests:
    matchers:
      - type: regex
        name: options-request
+        part: header
        regex:
          - "(?i)Allow: [A-Z,]*TRACE"
-        part: header