diff --git a/exposed-panels/sitecore-login.yaml b/exposed-panels/sitecore-login.yaml new file mode 100644 index 0000000000..f11217491c --- /dev/null +++ b/exposed-panels/sitecore-login.yaml @@ -0,0 +1,24 @@ +id: sitecore-login + +info: + name: SiteCore Login + author: dhiyaneshDK + severity: info + metadata: + shodan-query: 'http.title:"Welcome to Sitecore"' + tags: panel,sitecore + +requests: + - method: GET + path: + - '{{BaseURL}}/sitecore/login/default.aspx' + + matchers-condition: and + matchers: + - type: word + words: + - '/sitecore/shell/Themes/Standard/Default/Login.css' + + - type: status + status: + - 200 diff --git a/misconfiguration/sitecore-debug-page.yaml b/misconfiguration/sitecore-debug-page.yaml new file mode 100644 index 0000000000..af6c10e7ba --- /dev/null +++ b/misconfiguration/sitecore-debug-page.yaml @@ -0,0 +1,24 @@ +id: sitecore-debug-page + +info: + name: SiteCore Debug Page + author: dhiyaneshDK + severity: low + metadata: + shodan-query: 'http.title:"Welcome to Sitecore"' + tags: debug,sitecore + +requests: + - method: GET + path: + - "{{BaseURL}}/sitecore/'" + + matchers-condition: and + matchers: + - type: word + words: + - 'extranet\Anonymous' + + - type: status + status: + - 404 diff --git a/technologies/sitecore-default-page.yaml b/technologies/sitecore-default-page.yaml new file mode 100644 index 0000000000..35fa8fb4a8 --- /dev/null +++ b/technologies/sitecore-default-page.yaml @@ -0,0 +1,24 @@ +id: sitecore-default-page + +info: + name: Sitecore Default Page + author: DhiyaneshDK + severity: info + metadata: + shodan-query: http.title:"Welcome to Sitecore" + tags: tech,sitecore + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers-condition: and + matchers: + - type: word + words: + - "Welcome to Sitecore" + + - type: status + status: + - 200 diff --git a/workflows/sitecore-workflow.yaml b/workflows/sitecore-workflow.yaml new file mode 100644 index 0000000000..cfeab5b32a --- /dev/null +++ b/workflows/sitecore-workflow.yaml @@ -0,0 +1,13 @@ +id: sitecore-workflow + +info: + name: SiteCore Security Checks + author: pdteam + description: A simple workflow that runs all SiteCore related nuclei templates on a given target. + +workflows: + - template: technologies/sitecore-default-page.yaml + - template: exposed-panels/sitecore-login.yaml + subtemplates: + - tags: vulnerabilities/sitecore-pre-auth-rce.yaml + - template: misconfiguration/sitecore-debug-page.yaml \ No newline at end of file