Instruction: Generate a Nuclei template for: Misconfigured Concrete5

Input:
Title: Misconfigured Concrete5
Summary: Misconfigured Concrete5. Concrete5 CMS is misconfigured.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: misconfigured-concrete5

info:
  name: Misconfigured Concrete5
  author: pdteam
  severity: low
  description: Concrete5 CMS is misconfigured.
  tags: misconfig,concrete,cms,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "concrete5 has encountered an issue"
        part: body


Instruction: Generate a Nuclei template for: DragonFly Login - Panel

Input:
Title: DragonFly Login - Panel
Summary: DragonFly Login - Panel. Dragonfly Login Panel was discovered

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: dragonfly-panel

info:
  name: DragonFly Login - Panel
  author: DhiyaneshDK
  severity: info
  description: Dragonfly Login Panel was discovered
  tags: dragonfly,panel,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "href="logo-dragonfly.png""
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: xphoneconnect-admin-panel

info:
  name: XPhone Connect Admin Interface - Detect
  author: FLX
  severity: info
  description: Detects the presence of the XPhone Connect admin interface.
  tags: panel,xphone,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/xphoneconnect/admin/Login.aspx"
    matchers:
      - type: word
        words:
          - "XPhone Connect server - Logon"
          - "XPhone Web-Meeting"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: imagefap

info:
  name: Imagefap User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Imagefap user name information check was conducted.
  tags: osint,osint-porn,imagefap,discovery

http:
  - method: GET
    path:
      - "https://www.imagefap.com/profile/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "s Profile"
        part: body


Instruction: Generate a Nuclei template for: Azure App Service Always On Disabled

Input:
Title: Azure App Service Always On Disabled
Summary: Azure App Service Always On Disabled. Ensure that your Microsoft Azure App Services web applications have Always On feature enabled in order to prevent applications from being idled out due to inactivity. Always On keeps your websites/web applications loaded even when there's no traffic.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: azure-appservice-always-on-disabled

info:
  name: Azure App Service Always On Disabled
  author: princechaddha
  severity: medium
  description: Ensure that your Microsoft Azure App Services web applications have Always On feature enabled in order to prevent applications from being idled out due to inactivity. Always On keeps your websites/web applications loaded even when there's no traffic.
  tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Virtual Machine Disk Encryption with Customer-Managed Keys Not Enabled

Input:
Title: Virtual Machine Disk Encryption with Customer-Managed Keys Not Enabled
Summary: Virtual Machine Disk Encryption with Customer-Managed Keys Not Enabled. Ensure that the persistent disks attached to your Google Compute Engine instances are encrypted with Customer-Managed Keys (CMKs) in order to have a fine control over your sensitive data encryption and decryption process. You can create and manage your own Customer-Managed Keys (CMKs) with Cloud Key Management Service (Cloud KMS). Cloud KMS provides secure and efficient encryption key management, controlled key rotation, and
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: gcloud-vm-disk-cmk-not-enabled

info:
  name: Virtual Machine Disk Encryption with Customer-Managed Keys Not Enabled
  author: princechaddha
  severity: high
  description: Ensure that the persistent disks attached to your Google Compute Engine instances are encrypted with Customer-Managed Keys (CMKs) in order to have a fine control over your sensitive data encryption and decryption process. You can create and manage your own Customer-Managed Keys (CMKs) with Cloud Key Management Service (Cloud KMS). Cloud KMS provides secure and efficient encryption key management, controlled key rotation, and revocation mechanisms.
  tags: cloud,devops,gcp,gcloud,compute,encryption,cmk,security,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: vmware-vcenter-converter-standalone

info:
  name: VMware vCenter Converter Panel - Detect
  author: DhiyaneshDK
  severity: info
  description: VMware vCenter Converter panel was detected.
  tags: panel,vmware,vcenter,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "VMware vCenter Converter Standalone"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: justforfans

info:
  name: Justforfans User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Justforfans user name information check was conducted.
  tags: osint,osint-porn,justforfans,discovery

http:
  - method: GET
    path:
      - "https://justfor.fans/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - " @ JustFor.Fans"
        part: body


Instruction: Generate a Nuclei template for CVE-2018-14474

Input:
Title: Vulnerability (CWE-601) in goodoldweb orange_forum
Summary: views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup.
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: goodoldweb orange_forum
Indicators: error, vulnerability detected

Output:
id: CVE-2018-14474

info:
  name: Orange Forum 1.4.0 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: Orange Forum 1.4.0 contains an open redirect vulnerability in views/auth.go via the next parameter to /login or /signup. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: cve2018,cve,redirect,orangeforum,oss,seclists,goodoldweb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/login?next=http://interact.sh/?app.scan/"
      - "{{BaseURL}}/signup?next=http://interact.sh/?app.scan/"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template for CVE-2020-14144

Input:
Title: OS Command Injection in gitea gitea
Summary: The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides.
Vulnerability Type: OS Command Injection
Severity: high
Affected Products: gitea gitea
Indicators: warning

Output:
id: CVE-2020-14144

info:
  name: Gitea 1.1.0 - 1.12.5 - Remote Code Execution
  author: theamanrawat
  severity: high
  description: Gitea 1.1.0 through 1.12.5 is susceptible to authenticated remote code execution, via the git hook functionality, in customer environments where the documentation is not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides."
  tags: cve2020,cve,rce,gitea,authenticated,git,intrusive,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol
      - type: word
        words:
          - "Gitea:"
        part: body_1


Instruction: Generate a Nuclei template for CVE-2010-2035

Input:
Title: Path Traversal in percha com_perchagallery
Summary: Directory traversal vulnerability in the Percha Gallery (com_perchagallery) component 1.6 Beta for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: percha com_perchagallery
Indicators: error, vulnerability detected

Output:
id: CVE-2010-2035

info:
  name: Joomla! Component Percha Gallery 1.6 Beta - Directory Traversal
  author: daffainfo
  severity: high
  description: A directory traversal vulnerability in the Percha Gallery (com_perchagallery) component 1.6 Beta for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php.
  tags: cve,cve2010,packetstorm,joomla,lfi,edb,percha,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_perchagallery&controller=../../../../../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: 3Com Wireless 8760 Dual Radio - Default Login

Input:
Title: 3Com Wireless 8760 Dual Radio - Default Login
Summary: 3Com Wireless 8760 Dual Radio - Default Login. 3COM Wireless 8760 Dual Radio contains a default login vulnerability. Default admin login password 'password' was found.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: 3Com-wireless-default-login

info:
  name: 3Com Wireless 8760 Dual Radio - Default Login
  author: ritikchaddha
  severity: high
  description: 3COM Wireless 8760 Dual Radio contains a default login vulnerability. Default admin login password 'password' was found.
  tags: default-login,3com,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "alt="Advanced Configuration""
          - "image/setup_wizard"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2010-5028

Input:
Title: SQL Injection in harmistechnology com_jejob
Summary: SQL injection vulnerability in the JExtensions JE Job (com_jejob) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an item action to index.php.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: harmistechnology com_jejob
Indicators: error, vulnerability detected

Output:
id: CVE-2010-5028

info:
  name: Joomla! Component JE Job 1.0 - Local File Inclusion
  author: daffainfo
  severity: high
  description: A SQL injection vulnerability in the JExtensions JE Job (com_jejob) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an item action to index.php.
  tags: cve,cve2010,joomla,lfi,edb,harmistechnology,sqli,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_jejob&view=../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure Network Security Group Delete Alert Not Configured

Input:
Title: Azure Network Security Group Delete Alert Not Configured
Summary: Azure Network Security Group Delete Alert Not Configured. Ensure that an Azure activity log alert is used to detect "Delete Network Security Group" events in your Microsoft Azure cloud account. Activity log alerts get activated when a new activity log event that matches the condition specified in the alert occurs. In this case, the condition used is 'Whenever the Administrative Activity Log "Delete Network Security Group (networkSecurityGroups)" has "any" level, with "any" status and event is in
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: azure-nsg-delete-unalerted

info:
  name: Azure Network Security Group Delete Alert Not Configured
  author: princechaddha
  severity: high
  description: Ensure that an Azure activity log alert is used to detect "Delete Network Security Group" events in your Microsoft Azure cloud account. Activity log alerts get activated when a new activity log event that matches the condition specified in the alert occurs. In this case, the condition used is 'Whenever the Administrative Activity Log "Delete Network Security Group (networkSecurityGroups)" has "any" level, with "any" status and event is initiated by "any"'.
  tags: cloud,devops,azure,microsoft,network-security-group,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: jupyterhub-default-login

info:
  name: Jupyterhub - Default Admin Discovery
  author: For3stCo1d
  severity: high
  description: Jupyterhub default admin credentials were discovered.
  tags: jupyterhub,default-login,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: memrise

info:
  name: Memrise User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Memrise user name information check was conducted.
  tags: osint,osint-hobby,memrise,discovery

http:
  - method: GET
    path:
      - "https://app.memrise.com/user/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "followers"
        part: body


Instruction: Generate a Nuclei template to detect Open Redirect

Input:
Title: Open Redirect (CWE-601)
Summary: The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Vulnerability Type: Open Redirect
Severity: high
Indicators: vulnerability detected, error

Output:
id: weekender-newspaper-open-redirect

info:
  name: WordPress Weekender Newspaper 9.0 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: WordPress Weekender Newspaper theme 9.0 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: wordpress,wp-plugin,redirect,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/themes/weekender/friend.php?id=aHR0cHM6Ly9pbnRlcmFjdC5zaA=="
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template for: Read the Docs Takeover Detection

Input:
Title: Read the Docs Takeover Detection
Summary: Read the Docs Takeover Detection. Read the Docs takeover was detected.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: readthedocs-takeover

info:
  name: Read the Docs Takeover Detection
  author: pdteam
  severity: high
  description: Read the Docs takeover was detected.
  tags: takeover,readthedocs,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
      - type: word
        words:
          - "unknown to Read the Docs"


Instruction: Generate a Nuclei template for: Mac OS X Server FTP Service - Detect

Input:
Title: Mac OS X Server FTP Service - Detect
Summary: Mac OS X Server FTP Service - Detect. Mac OS X Server FTP service was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: macosx-ftp-detect

info:
  name: Mac OS X Server FTP Service - Detect
  author: pussycat0x
  severity: info
  description: Mac OS X Server FTP service was detected.
  tags: network,ftp,macosx,detect,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: szhe-default-login

info:
  name: Szhe Default Login
  author: pikpikcu
  severity: medium
  description: Szhe default login information was discovered.
  tags: szhe,default-login,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "You should be redirected automatically to target URL: /"
      - type: word
        words:
          - "Set-Cookie: session"
        part: header
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template for: DNS Zone Transfer Allowed to Any Host

Input:
Title: DNS Zone Transfer Allowed to Any Host
Summary: DNS Zone Transfer Allowed to Any Host. DNS Zone Transfer configured with "allow-transfer { any; };" allowed unrestricted zone transfers.This exposed sensitive details like hostnames, network structure, and system data that attackers could use for reconnaissance and further attacks.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: dns-zone-transfer-any

info:
  name: DNS Zone Transfer Allowed to Any Host
  author: songyaeji
  severity: high
  description: DNS Zone Transfer configured with "allow-transfer { any; };" allowed unrestricted zone transfers.This exposed sensitive details like hostnames, network structure, and system data that attackers could use for reconnaissance and further attacks.
  tags: linux,local,kisa,audit,compliance

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Silverlight cross-domain policy

Input:
Title: Silverlight cross-domain policy
Summary: Silverlight cross-domain policy. Tags: miscellaneous, misc, vuln
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: clientaccesspolicy

info:
  name: Silverlight cross-domain policy
  author: emadshanab
  severity: info
  description: Silverlight cross-domain policy
  tags: miscellaneous,misc,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/clientaccesspolicy.xml"
    matchers:
      - type: word
        words:
          - "<access-policy>"
          - "<cross-domain-access>"
          - "domain uri="
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-1170

Input:
Title: Cross-Site Scripting (XSS) in nootheme jobmonster
Summary: In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: nootheme jobmonster
Indicators: error, vulnerability detected

Output:
id: CVE-2022-1170

info:
  name: JobMonster < 4.5.2.9 - Cross-Site Scripting
  author: Akincibor,ritikchaddha
  severity: medium
  description: In the theme JobMonster < 4.5.2.9 there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests.
  tags: cve,cve2022,wpscan,wp,wp-theme,wordpress,xss,jobmonster,nootheme,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/resumes/?s=%22%3E%3Cimg+src%3Dx+onerror%3Dalert(document.domain)%3E"
    matchers:
      - type: word
        words:
          - "<img src=x onerror=alert(document.domain)>"
          - "noo-resume"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ZeroShell Security Checks

Input:
Title: ZeroShell Security Checks
Summary: ZeroShell Security Checks. A simple workflow that runs all ZeroShell related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: zeroshell-workflow

info:
  name: ZeroShell Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all ZeroShell related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: PDI Intellifuel - Device Page

Input:
Title: PDI Intellifuel - Device Page
Summary: PDI Intellifuel - Device Page. Tags: exposure, pdi, intellifuel
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: pdi-device-page

info:
  name: PDI Intellifuel - Device Page
  author: DhiyaneshDk
  severity: low
  description: PDI Intellifuel - Device Page
  tags: exposure,pdi,intellifuel,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php"
    matchers:
      - type: word
        words:
          - "Intellifuel Device page"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: BasicRAT Malware - Detect

Input:
Title: BasicRAT Malware - Detect
Summary: BasicRAT Malware - Detect. Tags: malware, file, basicrat
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: basicrat-malware

info:
  name: BasicRAT Malware - Detect
  author: daffainfo
  severity: info
  description: BasicRAT Malware - Detect
  tags: malware,file,basicrat

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-10486

Input:
Title: Missing Authorization in CVE-2024-10486
Summary: The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
Vulnerability Type: Missing Authorization
Severity: medium
Indicators: error, vulnerability detected

Output:
id: CVE-2024-10486

info:
  name: Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File
  author: popcorn94
  severity: medium
  description: The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
  tags: cve,cve2024,wp,wordpress,wp-plugin,google-listings-and-ads,info-leak,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/google-listings-and-ads/vendor/googleads/google-ads-php/scripts/print_php_information.php"
    matchers:
      - type: word
        words:
          - "PHP Extension"
          - "PHP Version"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Obsolete and less secure SSH Version

Input:
Title: Obsolete and less secure SSH Version
Summary: Obsolete and less secure SSH Version. Tags: enum, js, ssh
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: obsolete-ssh-version

info:
  name: Obsolete and less secure SSH Version
  author: pussycat0x
  severity: info
  description: Obsolete and less secure SSH Version
  tags: enum,js,ssh,network,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-34035

Input:
Title: Vulnerability (CWE-20) in engeniustech esr300_firmware and others
Summary: An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise.
Vulnerability Type: Vulnerability (CWE-20)
Severity: critical
Affected Products: engeniustech esr300_firmware, engeniustech esr350_firmware, engeniustech esr600_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2025-34035

info:
  name: EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution
  author: intelligent-ears
  severity: critical
  description: An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier.The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands.The injected commands are executed with root privileges, leading to full system compromise.
  tags: cve,cve2025,engenius,enshare,rce,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Azure VM Managed Identity Not Assigned

Input:
Title: Azure VM Managed Identity Not Assigned
Summary: Azure VM Managed Identity Not Assigned. Ensure that your Microsoft Azure virtual machines (VMs) have system-assigned managed identities enabled in order to allow secure virtual machine access to Azure resources such as key vaults and storage accounts.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: azure-vm-managed-identity-unassigned

info:
  name: Azure VM Managed Identity Not Assigned
  author: princechaddha
  severity: medium
  description: Ensure that your Microsoft Azure virtual machines (VMs) have system-assigned managed identities enabled in order to allow secure virtual machine access to Azure resources such as key vaults and storage accounts.
  tags: cloud,devops,azure,microsoft,vm,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-40539

Input:
Title: Vulnerability (CWE-706) in zohocorp manageengine_adselfservice_plus
Summary: Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Vulnerability Type: Vulnerability (CWE-706)
Severity: critical
Affected Products: zohocorp manageengine_adselfservice_plus
Indicators: error, vulnerability detected

Output:
id: CVE-2021-40539

info:
  name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution
  author: daffainfo,pdteam
  severity: critical
  description: Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution.
  tags: cve2021,cve,rce,ad,intrusive,manageengine,kev,zohocorp,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "114f7ce498a54a1be1de1f1e5731d0ea"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ManageEngine Applications Manager - Default Credentials

Input:
Title: ManageEngine Applications Manager - Default Credentials
Summary: ManageEngine Applications Manager - Default Credentials. Default credentials grants administrative access to ManageEngine Applications Manager, which can be later escalated into a RCE via DB queries.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: app-manager-default-login

info:
  name: ManageEngine Applications Manager - Default Credentials
  author: 0midC13
  severity: high
  description: Default credentials grants administrative access to ManageEngine Applications Manager, which can be later escalated into a RCE via DB queries.
  tags: default-login,manageengine,zoho,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Super Administrator"
          - "Add Application"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: application.yaml detection

Input:
Title: application.yaml detection
Summary: application.yaml detection. Finds Application YAML files which often contain sensitive information.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: application-yaml

info:
  name: application.yaml detection
  author: Cristi vlad (@cristivlad25)
  severity: info
  description: Finds Application YAML files which often contain sensitive information.
  tags: misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/app.yaml"
      - "{{BaseURL}}/app.yml"
      - "{{BaseURL}}/application.yaml"
      - "{{BaseURL}}/application.yml"
    matchers:
      - type: word
        words:
          - "runtime:"
          - "spring:"
          - "datasource:"
          - "platform:"
          - "server:"
          - "job:"
        condition: or
      - type: status
        status:
          - 200
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: CakePHP Default Page

Input:
Title: CakePHP Default Page
Summary: CakePHP Default Page. Tags: tech, cakephp, default-page
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: default-cakephp-page

info:
  name: CakePHP Default Page
  author: DhiyaneshDK
  severity: info
  description: CakePHP Default Page
  tags: tech,cakephp,default-page,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Welcome to CakePHP"
          - "CakePHP Issues"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-10758

Input:
Title: Code Injection in mongo-express_project mongo-express
Summary: mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
Vulnerability Type: Code Injection
Severity: critical
Affected Products: mongo-express_project mongo-express
Indicators: error, vulnerability detected

Output:
id: CVE-2019-10758

info:
  name: mongo-express Remote Code Execution
  author: princechaddha
  severity: critical
  description: mongo-express before 0.54.0 is vulnerable to remote code execution via endpoints that uses the `toBSON` method and misuse the `vm` dependency to perform `exec` commands in a non-safe environment.
  tags: cve,cve2019,vulhub,mongo,mongo-express,kev,mongo-express_project,node.js,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol


Instruction: Generate a Nuclei template for CVE-2014-8739

Input:
Title: Unrestricted File Upload in creative-solutions creative_contact_form and others
Summary: Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
Vulnerability Type: Unrestricted File Upload
Severity: critical
Affected Products: creative-solutions creative_contact_form, jquery_file_upload_project jquery_file_upload
Indicators: error, vulnerability detected

Output:
id: CVE-2014-8739

info:
  name: WordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File Upload
  author: melmathari
  severity: critical
  description: Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
  tags: cve,cve2014,wordpress,wp-plugin,wp,sexy-contact-form,intrusive,file-upload,rce,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "{{marker}}"


Instruction: Generate a Nuclei template for: Platformio Config File Disclosure

Input:
Title: Platformio Config File Disclosure
Summary: Platformio Config File Disclosure. “platformio.ini” (Project Configuration File) was detected.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: platformio-ini

info:
  name: Platformio Config File Disclosure
  author: DhiyaneshDK
  severity: low
  description: “platformio.ini” (Project Configuration File) was detected.
  tags: config,exposure,platformio,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/platformio.ini"
    matchers:
      - type: word
        words:
          - "[platformio]"
          - "platform ="
          - "board ="
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ElastiCache Redis Multi-AZ - Disabled

Input:
Title: ElastiCache Redis Multi-AZ - Disabled
Summary: ElastiCache Redis Multi-AZ - Disabled. Ensure that your Amazon ElastiCache Redis cache clusters are using a Multi-AZ deployment configuration to enhance reliability through automatic failover.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: cache-redis-multiaz-disabled

info:
  name: ElastiCache Redis Multi-AZ - Disabled
  author: DhiyaneshDK
  severity: medium
  description: Ensure that your Amazon ElastiCache Redis cache clusters are using a Multi-AZ deployment configuration to enhance reliability through automatic failover.
  tags: cloud,devops,aws,amazon,elasticache,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ScriptCase Panel Detect

Input:
Title: ScriptCase Panel Detect
Summary: ScriptCase Panel Detect. Tags: panel, scriptcase, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: scriptcase-panel

info:
  name: ScriptCase Panel Detect
  author: Ricardo Maia (Brainfork)
  severity: info
  description: ScriptCase Panel Detect
  tags: panel,scriptcase,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/devel/iface/"
      - "{{BaseURL}}/scriptcase/devel/iface/"
    matchers:
      - type: regex
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: samsung-wlan-default-login

info:
  name: Samsung Wlan AP (WEA453e) Default Login
  author: pikpikcu
  severity: high
  description: Samsung Wlan AP (WEA453e) default root credentials were discovered.
  tags: samsung,default-login,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "document.formParent2.changepasswd1.value"
          - "passwd_change.ehp"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Live Helper Chat Detect

Input:
Title: Live Helper Chat Detect
Summary: Live Helper Chat Detect. Tags: livehelperchat, tech, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: livehelperchat-detect

info:
  name: Live Helper Chat Detect
  author: pikpikcu,ricardomaia
  severity: info
  description: Live Helper Chat Detect
  tags: livehelperchat,tech,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/doc/CHANGELOG.txt"
      - "{{BaseURL}}/doc/README.txt"
    matchers:
      - type: regex
        part: body
      - type: regex


Instruction: Generate a Nuclei template for: OSS Bucket Public Accessible

Input:
Title: OSS Bucket Public Accessible
Summary: OSS Bucket Public Accessible. Ensure that your Object Storage Service (OSS) buckets are not publicly accessible to the Internet in order to protect against unauthorized access. Allowing public, anonymous access through bucket ACLs and bucket policies gives everyone the ability to access bucket contents.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: oos-bucket-public-access

info:
  name: OSS Bucket Public Accessible
  author: DhiyaneshDK
  severity: high
  description: Ensure that your Object Storage Service (OSS) buckets are not publicly accessible to the Internet in order to protect against unauthorized access. Allowing public, anonymous access through bucket ACLs and bucket policies gives everyone the ability to access bucket contents.
  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,alibaba-oss

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Default IBM HTTP Server

Input:
Title: Default IBM HTTP Server
Summary: Default IBM HTTP Server. Tags: tech, ibm, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: ibm-http-server

info:
  name: Default IBM HTTP Server
  author: dhiyaneshDK,pussycat0x
  severity: info
  description: Default IBM HTTP Server
  tags: tech,ibm,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>IBM HTTP Server</title>"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-20982

Input:
Title: Cross-Site Scripting (XSS) in wdja wdja_cms
Summary: Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, via the backurl parameter to /php/passport/index.php.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: critical
Affected Products: wdja wdja_cms
Indicators: error, vulnerability detected

Output:
id: CVE-2020-20982

info:
  name: shadoweb wdja v1.5.1 - Cross-Site Scripting
  author: pikpikcu,ritikchaddha
  severity: critical
  description: shadoweb wdja v1.5.1 is susceptible to cross-site scripting because it allows attackers to execute arbitrary code and gain escalated privileges via the backurl parameter to /php/passport/index.php.
  tags: cve2020,cve,xss,wdja,shadoweb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/passport/index.php?action=manage&mtype=userset&backurl=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "location.href='</script><script>alert(document.domain)</script>"
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Gradio 3.47/3.50.2 - Local File Inclusion

Input:
Title: Gradio 3.47/3.50.2 - Local File Inclusion
Summary: Gradio 3.47/3.50.2 - Local File Inclusion. Local file read by calling arbitrary methods of Components class between Gradio versions 3.47 / 3.50.2

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: gradio-lfi

info:
  name: Gradio 3.47/3.50.2 - Local File Inclusion
  author: nvn1729
  severity: high
  description: Local file read by calling arbitrary methods of Components class between Gradio versions 3.47 / 3.50.2
  tags: cve,cve2024,intrusive,unauth,gradio,lfi,lfr,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: or
  - method: GET
    path:
    matchers:
      - type: regex
        part: body_2
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: putty phishing Detection

Input:
Title: putty phishing Detection
Summary: putty phishing Detection. A putty phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: putty-phish

info:
  name: putty phishing Detection
  author: rxerium
  severity: info
  description: A putty phishing website was detected
  tags: phishing,putty,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Download PuTTY - a free SSH and telnet client for Windows"
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template for: Wappalyzer Technology Detection

Input:
Title: Wappalyzer Technology Detection
Summary: Wappalyzer Technology Detection. Tags: tech, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: tech-detect

info:
  name: Wappalyzer Technology Detection
  author: hakluke,righettod
  severity: info
  description: Wappalyzer Technology Detection
  tags: tech,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: regex
        part: body
        condition: or
      - type: word
        words:
          - "Project Management Software"
          - "atlassian.com/software/jira"
        part: body
        condition: and
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: word
        words:
          - "<script id="__NEXT_DATA__""
        part: body
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        condition: or
      - type: word
        words:
          - "vBulletin.version"
          - "content="vBulletin"
        part: body
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: word
        words:
          - "SRVE0255E:"
          - "A WebGroup/Virtual Host to handle"
        part: body
        condition: or
      - type: word
        words:
          - "$wsep:"
          - "$WSEP:"
        part: all_headers
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: word
        words:
          - "Powered by Gitea"
        part: body
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: regex
        part: body
        condition: or
      - type: word
        words:
          - "content="a-blog cms"
      - type: word
        words:
          - "content="Adobe GoLive"
      - type: word
        words:
          - "content="AdVantShop.NET"
      - type: word
        words:
          - "AVE.cms"
        part: header
      - type: word
        words:
          - "alterian"
      - type: word
        words:
          - "= Amiro.CMS (c) ="
      - type: word
        words:
          - "content="Apache Lenya""
      - type: word
        words:
          - "content="Backdrop CMS"
      - type: word
        words:
          - "content="BaseKit""
      - type: word
        words:
          - "content="Big Cartel""
      - type: word
        words:
          - "content='blogger'"
      - type: word
        words:
          - "content="Bolt""
      - type: word
        words:
          - "content="Bricolage"
      - type: word
        words:
          - "content="Composite C1 CMS"
      - type: word
        words:
          - "content="www.cm4all.com""
      - type: word
        words:
          - "content="CMS Tool www.cms-tool.net""
      - type: word
        words:
          - "content="CMS Tool www.cms-tool.net""
      - type: word
        words:
          - "content="CMS Made Simple"
      - type: word
        words:
          - "content="CMSimple_XH"
      - type: word
        words:
          - "content="CanalBlog"
      - type: word
        words:
          - "content="CoffeeCup"
      - type: word
        words:
          - "content="CommonSpot"
      - type: word
        words:
          - "content="CMS CONTENIDO"
      - type: word
        words:
          - "content="Contensis CMS"
      - type: word
        words:
          - "content="contentXXL"
      - type: word
        words:
          - "content="Convio CMS""
      - type: word
        words:
          - "content="CoreMedia"
      - type: word
        words:
          - "content="CorePublish"
      - type: word
        words:
          - "content="DIAFAN.CMS"
      - type: word
        words:
          - "content="CMS Danneo"
      - type: word
        words:
          - "Dim Works Kernel"
      - type: word
        words:
          - "content="Discourse "
      - type: word
        words:
          - "content="Hycus"
      - type: word
        words:
          - "content="Doteasy Website Creator""
      - type: word
        words:
          - "<!-- RT CSS Include d-css-runtime-desktop-one-package-new-->"
      - type: word
        words:
          - "content="Dynamicweb "
      - type: word
        words:
          - "content="e-plus "
      - type: word
        words:
          - "content="e-monsite (e-monsite.com)""
      - type: word
        words:
          - "content="ECSHOP "
      - type: word
        words:
          - "content="Ideagen - WCM "
      - type: word
        words:
          - "src="https://dl.episerver.net/"
      - type: word
        words:
          - "content="EverWeb "
      - type: word
        words:
          - "content="Fork CMS""
      - type: word
        words:
          - "content="Zeta Producer "
      - type: word
        words:
          - "content="GX WebManager"
      - type: word
        words:
          - "content="GetSimple""
      - type: word
        words:
          - "content="Ghost "
      - type: word
        words:
          - "content="Starfield Technologies; Go Daddy Website Builder"
      - type: word
        words:
          - "content="Government Site Builder""
      - type: word
        words:
          - "content="Graffiti CMS"
      - type: word
        words:
          - "content="GravCMS""
      - type: word
        words:
          - "content="Drupal"
      - type: word
        words:
          - "content="Webnode"
      - type: word
        words:
          - "'Shopsys\"
      - type: word
        words:
          - "content="pluck "
      - type: word
        words:
          - "content="Homestead SiteBuilder""
      - type: word
        words:
          - "content="HostedShop""
      - type: word
        words:
          - "content="ImageCMS""
      - type: word
        words:
          - "content="Immediacy .NET CMS"
      - type: word
        words:
          - "content="ImpressCMS""
      - type: word
        words:
          - "content="ImpressPages""
      - type: word
        words:
          - "content="Rails Connector for Infopark CMS Fiona"
      - type: word
        words:
          - "content="InstantCMS""
      - type: word
        words:
          - "X-Interactsh-Version"
        part: header
      - type: word
        words:
          - "content="InterRed "
      - type: word
        words:
          - "//www.jadu.net"
      - type: word
        words:
          - "content="jieqi.com""
      - type: word
        words:
          - "content="JustSystems Homepage Builder"
      - type: word
        words:
          - "content="Kernel Video Sharing "
      - type: word
        words:
          - "content="Komodo CMS""
      - type: word
        words:
          - "content="Kryptronic Software""
      - type: word
        words:
          - "by Labrador CMS"
      - type: word
        words:
          - "content="Lauyan TOWeb "
      - type: word
        words:
          - "content="http://www.getLiveEdit.com""
      - type: word
        words:
          - "content="LogiCommerce""
      - type: word
        words:
          - "content="Loja Integrada""
      - type: word
        words:
          - "content="Mabisy""
      - type: word
        words:
          - "content="Mambo -"
      - type: word
        words:
          - "content="Melody CMS""
      - type: word
        words:
          - "content="Metro Publisher "
      - type: word
        words:
          - "powered">Midgard CMS"
      - type: word
        words:
          - "content="Mijnwebwinkel""
      - type: word
        words:
          - "MintoxPlaceHolder"
      - type: word
        words:
          - "content="JetBrains PhpStorm/Intercat/Movable Type"
      - type: word
        words:
          - "content="Netvolution WCM""
      - type: word
        words:
          - "content="Nucleus CMS "
      - type: word
        words:
          - "content="NukeViet "
      - type: word
        words:
          - "content="One.com Web Editor""
      - type: word
        words:
          - "content="OpenNemas "
      - type: word
        words:
          - "content="Orchard""
      - type: word
        words:
          - "content="Orthodox Web Solutions "
      - type: word
        words:
          - "oc-includes/osclass/"
      - type: word
        words:
          - "content="Oxatis "
      - type: word
        words:
          - "content="PHPShop CMS "
      - type: word
        words:
          - "content="PHPVibe""
      - type: word
        words:
          - "content="Pagecloud""
      - type: word
        words:
          - "content="Pagekit""
      - type: word
        words:
          - "content="Parallels Presence Builder "
      - type: word
        words:
          - "content="RiteCMS"
      - type: word
        words:
          - "content="rCMS "
      - type: word
        words:
          - "content="Rvglobalsoft""
      - type: word
        words:
          - "content="Subrion CMS"
      - type: word
        words:
          - "content="RapidWeaver""
      - type: word
        words:
          - "content="SUMOshop""
      - type: word
        words:
          - "content="Sana Commerce""
      - type: word
        words:
          - "content="Sandvox "
      - type: word
        words:
          - "content="OpenCities "
      - type: word
        words:
          - "content="Serendipity "
      - type: word
        words:
          - "content="ShopFactory "
      - type: word
        words:
          - "X-Clockwork-Id:"
          - "X-Clockwork-Version:"
        part: header
      - type: word
        words:
          - "Set-Cookie: symfony="
        part: header
      - type: word
        words:
          - "Set-Cookie: laravel_session="
        part: header
      - type: word
        words:
          - "Set-Cookie: {{DN}}_session="
          - "Set-Cookie: XSRF-TOKEN="
        part: header
        condition: and
      - type: word
        words:
          - "X-Powered-By: Express"
        part: header
      - type: word
        words:
          - "meta content="authenticity_token" name="csrf-param"
        part: body
      - type: word
        words:
          - "ng-app=""
          - "<ng-app"
          - "*ngIf="
          - "ng-controller="
        part: body
        condition: or
      - type: word
        words:
          - "lighttpd"
        part: header
      - type: word
        words:
          - "lighttpd"
        part: header
      - type: word
        words:
          - "WSGIServer"
        part: header
      - type: word
        words:
          - "SimpleHTTP"
        part: header
      - type: word
        words:
          - "TwistedWeb"
        part: header
      - type: word
        words:
          - "TSM_HTTP"
        part: header
      - type: word
        words:
          - "Microsoft-IIS"
        part: header
      - type: word
        words:
          - "Microsoft-HTTPAPI"
        part: header
      - type: word
        words:
          - "darkhttpd"
        part: header
      - type: word
        words:
          - "CherryPy"
        part: header
      - type: word
        words:
          - "Cherokee"
        part: header
      - type: word
        words:
          - "Caddy"
        part: header
      - type: word
        words:
          - "Jetty"
        part: header
      - type: word
        words:
          - "Server: nginx"
        part: header
      - type: word
        words:
          - "X-Powered-By: PHP"
          - "PHPSESSID"
        part: header
      - type: word
        words:
          - "Server: NodeJS"
          - "X-Powered-By: nodejs"
        part: header
        condition: or
      - type: word
        words:
          - "Python/2."
          - "Python/3."
          - "CPython/3."
        part: header
        condition: or
      - type: word
        words:
          - "X-Jenkins"
        part: header
      - type: word
        words:
          - "cloudflare"
        part: server
      - type: regex
        part: cf_cache_status
      - type: regex
        part: cf_ray
      - type: word
        words:
          - "AkamaiGHost"
        part: header
      - type: word
        words:
          - "Sucuri/Cloudproxy"
        part: header
      - type: word
        words:
          - "X-Iinfo:"
        part: header
      - type: word
        words:
          - "ddos-guard"
        part: header
      - type: word
        words:
          - "DOSarrest"
          - "X-DIS-Request-ID:"
        part: header
      - type: word
        words:
          - "ArvanCloud"
          - "AR-Request-ID:"
        part: header
      - type: word
        words:
          - "/etc/clientlibs/"
          - "/content/dam/"
        part: body
      - type: word
        words:
          - "Server: Lotus-Domino"
        part: header
      - type: word
        words:
          - "Set-Cookie: mongo-express="
        part: header
      - type: word
        words:
          - "Login to pfSense"
      - type: word
        words:
          - "<title>Weave Scope</title>"
          - "__WEAVEWORKS_CSRF_TOKEN"
          - "__CSRF_TOKEN_PLACEHOLDER__"
        part: body
        condition: and
      - type: word
        words:
          - "<title>Mida eFramework</title>"
          - "Server: Mida eFramework"
        part: response
        condition: or
      - type: word
        words:
          - "SEEEMS.CMS"
          - "SEEEMS.FRAMEWORK"
        part: body
        condition: or
      - type: regex
        part: header
      - type: word
        words:
          - "Login to pfSense"
          - "<title>pfSense - Login</title>"
          - "maintained by Netgate"
        part: body
        condition: and
      - type: word
        words:
          - "Server: monit"
        part: header
      - type: word
        words:
          - "ThinkPHP"
        part: header
      - type: word
        words:
          - "initApollo)(i.ApolloTargetServer.Self)"
        part: body
      - type: word
        words:
          - "<!-- BEGIN PAN_FORM_CONTENT -->"
          - "js/pan/"
        part: body
        condition: and
      - type: word
        words:
          - "X-Powered-By: Sails"
        part: header
      - type: word
        words:
          - "Tengine"
        part: server
      - type: word
        words:
          - "TornadoServer/"
        part: header
      - type: word
        words:
          - "uvicorn"
        part: server
      - type: word
        words:
          - "istio-envoy"
        part: server
      - type: word
        words:
          - "X-ClickHouse-Summary"
        part: header
      - type: word
        words:
          - "content="Coolify"
      - type: word
        words:
          - "<title>IQ Messenger</title>"
        part: body
      - type: word
        words:
          - "realm="Sagemcom TR-069""
        part: header
      - type: word
        words:
          - "<title>FASTPANEL</title>"
        part: body
      - type: word
        words:
          - "<title>Vaka</title>"
        part: body
      - type: word
        words:
          - "<title>Ksenia Lares WebServer</title>"
        part: body
      - type: word
        words:
          - "/tas/css/auth.css"
          - "topdeskidploginforwardurl"
        part: body
        condition: or
      - type: word
        words:
          - "<title>UserGate UTM</title>"
        part: body
      - type: word
        words:
          - "<title>UserGate NGFW</title>"
        part: body
      - type: word
        words:
          - "<title>RouterOS router configuration page</title>"
        part: body
      - type: word
        words:
          - "<title>ETHM-1 Plus</title>"
        part: body
      - type: word
        words:
          - "<title>Qlik Sense login page</title>"
        part: body
      - type: word
        words:
          - "Server: REDY-Process"
        part: header
      - type: word
        words:
          - "href="css/img/ENTEK.ico""
        part: body
      - type: word
        words:
          - "<title>Macroscop Web Client</title>"
          - "<title>macroscop</title>"
        part: body
      - type: word
        words:
          - "<title>Etic Telecom</title>"
        part: body
      - type: word
        words:
          - "content="Quantum Spark Security Appliance - Login""
        part: body


Instruction: Generate a Nuclei template for CVE-2016-4437

Input:
Title: Vulnerability (CWE-321) in apache aurora and others
Summary: Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
Vulnerability Type: Vulnerability (CWE-321)
Severity: critical
Affected Products: apache aurora, apache shiro, redhat fuse
Indicators: error, vulnerability detected

Output:
id: CVE-2016-4437

info:
  name: Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
  tags: cve2016,cve,apache,rce,kev,packetstorm,shiro,deserialization,oast,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "dns"
        part: interactsh_protocol


Instruction: Generate a Nuclei template for CVE-2024-39914

Input:
Title: Vulnerability (CWE-77) in fogproject fogproject
Summary: FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34.
Vulnerability Type: Vulnerability (CWE-77)
Severity: critical
Affected Products: fogproject fogproject
Indicators: error, vulnerability detected

Output:
id: CVE-2024-39914

info:
  name: FOG Project < 1.5.10.34 - Remote Command Execution
  author: s4e-io
  severity: critical
  description: FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php.
  tags: cve,cve2024,rce,fog,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-0826

Input:
Title: SQL Injection in wp-video-gallery-free_project wp-video-gallery-free
Summary: The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: wp-video-gallery-free_project wp-video-gallery-free
Indicators: error, vulnerability detected

Output:
id: CVE-2022-0826

info:
  name: WordPress WP Video Gallery <=1.7.1 - SQL Injection
  author: theamanrawat
  severity: critical
  description: WordPress WP Video Gallery plugin through 1.7.1 contains a SQL injection vulnerability. The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  tags: time-based-sqli,cve,cve2022,wp-plugin,wpscan,wordpress,wp,sqli,wp-video-gallery-free,unauth,wp-video-gallery-free_project,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2025-27007

Input:
Title: Vulnerability (CWE-266) in CVE-2025-27007
Summary: Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers: from n/a through 1.0.82.
Vulnerability Type: Vulnerability (CWE-266)
Severity: critical
Indicators: error, vulnerability detected

Output:
id: CVE-2025-27007

info:
  name: OttoKit < 1.0.83 - SureTriggers allows Privilege Escalation
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers- from n/a through 1.0.82.
  tags: cve,cve2025,ottokit,intrusive,priv,wordpress,wp-plugin,wp,suretriggers,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "success"
          - "Connected successfully."
        part: body
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""administrator":true"
          - ""success":true"
          - "new_{{username}}"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: AEM Package Manager - Authentication Bypass

Input:
Title: AEM Package Manager - Authentication Bypass
Summary: AEM Package Manager - Authentication Bypass. Adobe Experience Manager Package Manager is susceptible to a hard to exploit authentication bypass issue. This issue only potentially impacts AEM on-premise or AEM as a Managed Service if default security configurations are removed.
Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: aem-crx-bypass

info:
  name: AEM Package Manager - Authentication Bypass
  author: dhiyaneshDK
  severity: critical
  description: Adobe Experience Manager Package Manager is susceptible to a hard to exploit authentication bypass issue. This issue only potentially impacts AEM on-premise or AEM as a Managed Service if default security configurations are removed.
  tags: aem,adobe,misconfig,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "buildCount"
          - "downloadName"
          - "acHandling"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-3850

Input:
Title: Cross-Site Scripting (XSS) in uniview nvr301-04s2-p4_firmware
Summary: Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: uniview nvr301-04s2-p4_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2024-3850

info:
  name: Uniview NVR301-04S2-P4 - Cross-Site Scripting
  author: Bleron Rrustemi,r3naissance
  severity: medium
  description: Uniview NVR301-04S2-P4 contains a reflected cross-site scripting vulnerability via the PATH of LAPI. CISA and Uniview state that this vulnerability needs to be authenticated. This is incorrect. Any PATH payload can cause XSS. A submission to Mitre has been sent to update the verbiage in the finding as well as the CVSS score.
  tags: cve,cve2024,xss,uniview,nvr,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/V1.0%3CsVg/onload=alert.bind%28%29%281%29%3E/Alarm/Exceptions/LinkageActions?="
    matchers:
      - type: word
        words:
          - "/V1.0<sVg/onload=alert.bind()(1)>/Alarm/Exceptions/LinkageActions?="
        part: body
        condition: and
      - type: word
        words:
          - "NVRDVR"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: HIKVISION iSecure Center - Remote Code Execution

Input:
Title: HIKVISION iSecure Center - Remote Code Execution
Summary: HIKVISION iSecure Center - Remote Code Execution. Hikvision's comprehensive security management platform has a Fastjson remote command execution vulnerability, which can execute system commands and obtain system permissions and sensitive data information of the target server.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: hikvision-isecure-center-rce

info:
  name: HIKVISION iSecure Center - Remote Code Execution
  author: SleepingBag945
  severity: critical
  description: Hikvision's comprehensive security management platform has a Fastjson remote command execution vulnerability, which can execute system commands and obtain system permissions and sensitive data information of the target server.
  tags: hikvision,isecure,rce,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "nt authority\system"
          - "{"code""
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-5715

Input:
Title: Cross-Site Scripting (XSS) in sugarcrm sugarcrm
Summary: phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable).
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: sugarcrm sugarcrm
Indicators: error, vulnerability detected

Output:
id: CVE-2018-5715

info:
  name: SugarCRM 3.5.1 - Cross-Site Scripting
  author: edoardottt
  severity: medium
  description: SugarCRM 3.5.1 is vulnerable to cross-site scripting via phprint.php and a parameter name in the query string (aka a $key variable).
  tags: cve2018,cve,sugarcrm,xss,edb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?action=Login&module=Users&print=a&%22%2F%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "&"/><script>alert(1)</script>=&"><< Back</a><br><br>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Command Injection

Input:
Title: Command Injection (CWE-77)
Summary: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attac
Vulnerability Type: Command Injection
Severity: medium
Indicators: vulnerability detected, error

Output:
id: hasura-graphql-psql-exec

info:
  name: Hasura GraphQL Engine - Remote Code Execution
  author: Udyz
  severity: critical
  description: Hasura GraphQL Engine allows remote unauthenticated users to execute arbitrary SQL statements via the '/v2/query' endpoint (aka remote code execution).
  tags: graphql,edb,hasura,rce,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: LLMNR Disabled

Input:
Title: LLMNR Disabled
Summary: LLMNR Disabled. Determine if LLMNR (Link-Local Multicast Name Resolution) is disabled.
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: llmnr-disabled

info:
  name: LLMNR Disabled
  author: princechaddha
  severity: medium
  description: Determine if LLMNR (Link-Local Multicast Name Resolution) is disabled.
  tags: windows,llmnr,network,security,code,windows-audit

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Authentication Bypass Using an Alternate Path or Channel

Input:
Title: Authentication Bypass Using an Alternate Path or Channel (CWE-288)
Summary: The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Vulnerability Type: Authentication Bypass Using an Alternate Path or Channel
Severity: high
Indicators: vulnerability detected, error

Output:
id: jupyter-ipython-unauth

info:
  name: Jupyter ipython - Authorization Bypass
  author: pentest_swissky
  severity: critical
  description: Jupyter was able to be accessed without authentication.
  tags: unauth,jupyter,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ipython/tree"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "ipython/static/components"
          - "ipython/kernelspecs"
        part: body